I spent a while yesterday thinking over the software projects that I'm currently interested in. It is a reasonably short list. At the time I just looked over the packages that I've got installed and the number of bugs. I'm a little disappointed to see that the bugfixes that I applied to GNU screen have been mostly ignored. Still I have the day off work on Thursday and Friday this week and would probbly spend it releasing the pending advisories I've got in my queue, and then fixing N bugs in a single package. The alternative is to build a quick GPG-based mailing list manager. I'd like a simple system which allowed users to subscribe, and only accepted GPG-signed mails. The subscriber could choose to receive their messages either signed (as-is) by the submitter or encrypted to them. So to join you'd do something like this:

subscribe foo@example.org [encrypted]
--BEGIN PUBLIC KEY --
...
--ND PUBLIC KEY--

There is the risk, with a large enough number of users, that a list could DOS the host if it had to encrypt each message to each subscribers. But if the submissions were validated as being signed by a user with a known key it should be minimal, unless there is a lot of traffic. The cases are simple:

• foo-subscribe => Add the user to the list, assuming valid key data found
• foo-unsubscribe => Do the reverse.
• foo:
  • If the message is signed accept and either mail to each recipient, or encrypt on a per-recipient basis.
  • If the message is not signed, or signed by a non-subscriber drop it.

There are some random hacks out there for this, including a mailman patch (did I mention how much I detest mailman yet today?) but nothing recent.

Today I've been mostly unwell. Although I have managed to write some minor new code, and watch a little bit of Doctor Who on DVD. Recently several people have been ranting about Ruby on Rails. I like it, but I wouldn't use it for personal development in a hurry. Deployment is fiddly, and upgrades are annoying. But one thing that I utterly condemn Rails for is helping to spread bad paging throughout the online world. So, what is "bad paging" and why is it important? Well cool URLs don't change, right? "Bad paging" is any user-interface which presents you with a limited view upon a changing list of items which is non-bookmarkable. Consider the following "list". Assume it represents your view of a collection of items numbering 100+. You may only view ten items at a time; clicking "next", or "previous", to navigate your viewport:

1.  first item
2.  second item
..
10. tenth item
[see next: /start/1] [see prev]

Whats wrong with this picture? It is subtle, but this list is broken. The issue is that when the list grows new items are prepended to the front, yet the navigation is linked to the starting page number. If that description wasn't clear consider what happens if you want to bookmark the page containing item 11. How can you? Right now it is at /start/1. If a ten new items are appended to the head of the list then it will instead become /start/2 - as items that are currently numbered 1-10 will be shifted forward to become items 11-20, and and they will be on page /start/1 instead. The solution is simple enough once you consider what you want to happen:

• Either append items to the end of the list.
  • Such that /start/1 always gives the items 11-20.
• Number the links in the reverse order.

So why does nobody do that? (As a counter example look at my website: Rather than the 'Show previous' items linking you to the changing link /start/1, it instead links you to /start/569 (for example).

mmap()/vmsplice() root exploit and fun with Xen: Today has been a very busy day. First of all, a new exploit was discovered today that uses vmsplice to gain root access. Of course, there’s an unpleasant side effect to that exploit (so don’t try it on your machines!), it messes up the memory map and applications start crashing until you reboot your machine. When combined with Xen, things get worse: the hypervisor crashes and obviously takes out all of your domUs which is unpleasant. As a result, I upgraded my Xen-using stuff to 3.2, but the bug is still there. There’s a nice “feature” though: When the hypervisor crashes, it reboots so you can’t even get a crash log. Fantastic, except not. Xen 3.2 seems nice so far, I backported it to etch for use on my dom0’s. I haven’t noticed any major problems yet so that’s good. It’d be nice to have linux-image-2.6.23-xen backported to etch, that’ll probably be my next project (at the same time, I plan to patch out the vmsplice syscall so it can’t be exploited by users on my machines). Hopefully the backports.org maintainer will do a backport soon. dsyslog in NEW: dsyslog has been released (I did this yesterday actually), and is now in NEW as of today. For those of you who don’t know what dsyslog is, it’s a syslogging daemon I am writing from scratch for my needs. It has a 100% modular design; the core only provides a generic message processing and routing framework. Thanks to naoliv and dmb for collaborating on the packaging. upse 0.6.0 released: Today I also released upse 0.6.0, which adds the ability to use a PSone ROM instead of emulation so that you can listen to mods that require a replayer which depends random aspects of the ROM itself. Right now, this feature only works with upse123, but I will add support to the audacious plugin in 0.7.0. Please note that upse does not include a PSone ROM image as it’s pretty much guaranteed to be non-free. You can use a gameshark, or some sort of JTAG method to dump the ROM’s contents. (The ‘crash2′ replayer is especially a problem with this one.) Additionally, the new release features reworked modeling of the PSone’s SPU analog filters. srctool: A lot of people commented on my ideas for replacing srcinst with something more modern and powerful (presently called srctool). I’ll be sure to take a look at them over the next few days and comment back. freenode adopts DroneBL as part of their anti-trolling defense: LoRez notified me on freenode today that they are using DroneBL to help keep trolls and proxy abusers off the network. I wish them luck with their use of this, and recommend an additional blacklist as a supplement, dnsbl.anoxs.net. While I disagree with the way they have implemented their DNSBL, they do indeed get results.

I was watching the British police drama show The Bill [1] and I was impressed by their use of computers. They were analysing the evidence of a homicide and one of the tasks was to assemble a time-line of the related events. They had a projector connected to a computer which displayed the data and used what was apparently an infra-red pen (presumably similar in technology to Rusty’s infra-red pen for Wii-Mote Pong [2]) to write on the wall and the computer then performed OCR to convert it to printed text. When new evidence was discovered about the time of events they used drag and drop to move the events around to the correct time slots. I’ve seen many horribly faked renditions of computer stuff on TV, but this seemed quite realistic. It was all technically possible, in many cases what was displayed would be quite inconvenient to fake if you didn’t have software to do it, and little touches like closing the session when the case was resolved are things that you wouldn’t bother with if faking it. The down-side to my analysis is that I had a couple of glasses of red wine so I might be more gullible than usual. ;) Some years ago I swore off watching The Bill after a horribly stupid episode about computer crime (teenage haxor sells copies of cracked software to computer store owner for resale to the public, then computer store owner murders him for disrespect and price-gouging). I refrained from watching for almost a decade after that. But it seems that they have redeemed themself to some degree. I wonder whether the software they were showing is really used by law enforcement, or whether it’s designed for corporations to use in tele-conferences etc. In the same episode they showed the recordings of two security cameras on projectors side by side for comparison, they could fast-forward them independently but they couldn’t zoom in or do other silly and impossible things.

• [1] http://www.thebill.com/


• [2] http://arctanx.id.au/blog/?p=37

Share This

Dear lazyweb,
I want to try out a window manager like Ion, but I don't want to actually use Ion due to the fact the author's an irritating nutcase who I'd rather not encourage any further, and its utterly daft license. What's a man to do?

My Apple Powerbook 5,4 just booted for the first time using GRUB, with no manual intervention, from Apple chime to GDM prompt. This is a great milestone for GRUB2 on powerpc-ieee1275 and OpenFirmware, as until now, multiple problems in the loader would drop you to OF console straight away, although other PowerPC hardware with other firmware implementations did manage to work. Recent fixes by Pavel in the core and some other minor fixes for the userland utils have taken grub2 to the point where it is usable on most PowerPC hardware. On Apple, the only minor issue remaining is grub-probe insisting on (hd) not being a valid device name, so for now I have to trick it into believing it's really (hd1). In parallel, many other GRUB2 improvements haven't stopped hitting CVS in the last months, which have seen how new contributors joined grub-devel and helped GRUB2 get the great momentum it's enjoying right now. Vesa, Robert and Bean have been really active lately, and have fixed long standing issues or written a lot of new code. One of the features GRUB2 acquired recently was image loading for background images. Much more powerful than the implementation in GRUB Legacy, GRUB2 can now read images in multiple formats, can handle up to 24bit colour and render a menu in arbitrary resolutions. The menu can now show UTF-8, and the Debian package will configure a pretty theme that matches the rest of the system if desktop-base is installed:

GRUB2 speaking UTF-8 Catalan Although I'm not sure if GRUB2 is completely up-to-par with GRUB Legacy on i386/amd64, it seems the tricky bits, like video, LVM, RAID and the standard filesystems are supported and working. What GRUB2 needs now, in order to finally replace the aging and upstream-lacking GRUB Legacy you probably have installed, is massive testing. Debian has traditionally been a testbed for GRUB Legacy patches, and is also the platform where GRUB2 is being more widely tested. Having GRUB2 included in lenny's debian-installer would be a great step forward, and by the looks, I think we're well on time to manage this. Replacing GRUB Legacy with GRUB2 is trivial. On PCs, just install the grub-pc package. You'll be offered to keep GRUB Legacy, but with an added menu entry to chainload GRUB2. If you're worried that GRUB2 might fail on your hardware, accept this, and try to load GRUB2 from GRUB. If it works, you then know you can get rid of GRUB Legacy completely and keep GRUB2 in the MBR. On PowerPC-based Macs, you'll have to work around the small issue I mentioned above. Install the grub-ieee1275 package. You also need a very recent powerpc-ibm-utils package, which was just uploaded to unstable. Mount your bootstrap partition, probably /dev/hda2 in /boot/grub, and generate a device.map file with grub-mkdevicemap. Check the contents. If your first device name lacks a drive number such as (hd), it's probably correct, although this will make things fail later. Change it to (hd0) for now. As grub-install relies on grub-probe, you'll have to generate your grub image by hand. Copy all .mod files in /usr/lib/grub/powerpc-ieee1275 to your bootstrap partition, and generate a core.img:

root@powerpc:/boot/grub# grub-mkimage -d . -o /boot/grub/core.img *.mod
root@powerpc:/boot/grub# update-grub
root@powerpc:/boot/grub# nvsetenv boot-device hd:2,core.img

The generated grub.cfg will have references to (hd0,X), which you'll have to correct back to (hd,X) if necessary for your OpenFirmware. After this, you are probably ready to reboot, cross two fingers and get a warm "Welcome to GNU GRUB!" message at boot, which will then be followed by a standard GRUB menu, but on your nice PowerPC box. Unfortunately, the eye candy in the screenshot above isn't available yet in this platform, as it lacks VESA. Does someone in the audience want to contribute a video driver for powerpc? :)

We now have 30 complete languages in D-I: bg cs de eo es eu fi fr gl gu it ja ko lt lv nb nl nn pl pt pt_BR ro ru sk sl sv ta th vi zh_CN Some progress was made for others, but I doubt we reach my unofficial target of 40 languages by Thursday February 14th which is the deadline set by Otavio, D-I release manager. Incomplete languages:

 2 099% he
   099% hu
   099% pa      3
 3 098% be
   098% ca
   098% dz
   098% ml
   098% sq
   098% zh_TW   6
 4 097% bn
   097% ne      2
 5 094% ar      1
 6 093% bs
   093% da
   093% el
   093% et
   093% hi
   093% hr
   093% id
   093% ka
   093% km
   093% mk
   093% tl
   093% tr
   093% uk
   093% wo      14
 7 090% am      1
 8 088% ku      1

Translators, hurry up, please! We are in the process of *losing* translations for lenny if some of you don't wake up.

In Montreal, I discovered the joy of visiting Osteopaths. An Osteopath managed to cure Leif's colic and let us sleep, and unlike a chiropractor, a treatment from Martine at Santenergie on the plateau of Montreal (shameless plug) would actually stay in effect for more than 20 minutes (Sometimes for weeks at a time).

Coming to the US, however, means learning a whole new variety of Osteo. Osteopathy was written into law early on, and has grown up as a full alternative to medical doctors - including the ability to prescribe medication. In practice what happens is that Osteopaths wind up in family practice as just another variant of MDs. The amount of "Osteopath" training that they've had compared to an MD turns out not to be that big anyway.

All hope isn't actually lost, though. There are two groups in the US, the American Academy of Osteopathy (Members recognised by the letters FAAO after their names), an the American Osteopathic Assocation (, AOA). Physicians can be fellowshipped into one or the other of these groups and they have different philosophies.

So there are three types of Osteopaths here:

1) Regular doctors (For all that it matters for the patients coming in)

2) Regular doctors who will practice some forms of Osteopathic Manipulative Medicine, but may not perform all techniques, and whom are more likely to be involved in "Integrative medicine" - helping find overall wholistic solutions to problems that might include manipulation, but might include other naturopathic solutions.

3) Osteopaths who specialise in manipulative medicine.

The downside to #3 is that these are people who've taken full medical degrees, and then had to further it with what an Osteopath would take at home. They're expensive, often don't accept any form of medical insurance, and are generally part of private practices.

With some back troubles I've been having recently, I managed to find a doctor in the #2 category who explained to me how this all works (followed by us figuring out that there's more to it than he can fix. But that's another story for later). He very kindly wrote it out for me on a napkin, so I'm copying it here before I blow my nose it in by accident. =)

(This blog post is in Latvian and is about a public discussion that the capital of Latvia, Riga is having about where to put new bicycle racks in the center of the city. In the post I point to an article describing where to send in suggestions, point out a few possible locations for such racks and suggest installing racks with build-in locks that would require inserting a refundable coin to remove the key locking a bike in place) R gas dome v c ierosin jumus par jaunu velost vvietu novietojumu R gas centr . Es tur nos t ju sekojo us ieteikumus, parosieties ar j s. Vislab k velovietnes b tu izvietot t d viet , kas b tu p rredzama no ce iem, pa kuriem iet daudz cilv ku un ar kur b tu novietotas dro bas nov ro anas kameras, lai minimiz tu z dz bu risku. Viena vietne var tu atrasties Str lnieku laukum vai t tuvum , jo tur ir viegla piek uve no Krasta ielas. Vieta starp RTU ku Ka u 1 un
Krasta ielu var tu b t oti piem rota. Tas ar ierosin s studentus lietot velotransportu pa ce am uz lekcij m Ka u iel . Alberta laukuma var tu atrasties vieta velosip du novieto anai - vieta ir viegli pieejama no Stacijas puses un ir tuvu vair k m viesn c m. Ja ir pl ni izveidot Pay&Ride autom tisko velosip du nomu, tad is var tu b t par vienu no vislab kajiem punktiem dai iecerei. Pils laukums ir viegli sasniedzams no P rdaugavas pa Van u tiltu. Ja tur izveidotu velost vvietu, tad tas iev rojami atvieglotu iesp ju atbraukt ar velosip du pa J rmalas veloceli u p ri Van u tiltam, nogriezties pa labi un uzreiz dro i noparkoties. T pat l dzu apv rt ideju pielietot velovietnes ar ieb v tu atsl gu, lai neb tu nepiecie ams vest l dzi savu sl dzeni. Katrai vietai var tu b t sava sl dzene (bieza un pietieko i gara cietmet la trose) un atsl ga. Atsl gu var tu iz emt no sl dzenes tikai tad, kad sl dzene ir aiztais ta un sl dzenes meh nism ir ielikta 1 Ls mon ta. Atsl dzot sl dzeni ar atsl gu mon ta tiktu atdota atpaka . Tas nodro in s pret vand lismu, kad vienk r i vis m sl dzen m tiktu iz emtas atsl gas un aizmestas prom. Ta u jebkur gad jum j b t vieglam veidam k aizvietot nozaud t s atsl gas gan gad jumos kad velosip da pa nieks to pieprasa (tas var aiz emt vair kas dienas un pras t 5-10 Ls un iesnieguma uzrakst anu) vai ar kad velosip ds ir pamests piesl gt st vokl . Jaunas atsl gas izgatavo anai nevajadz tu pras t vair k k 1 Ls no pils tas bud eta, tad tas 1 Ls sl dzen os izdevumus atmaks s.

Fun round-up of web calendars on BBC Click this weekend. Google, Kiko and 30boxes get mentions. I'm mainly using my new phone but reviewer Rob was quite scathing about phone calendars and didn't bother to say how well the different sites integrate with handhelds. Feedback by email was invited... Are there good interoperable web calendars? Any as free software? Talking of BBC being on a different calendar to everyone else, BBC belatedly announces that iPlayer-for-Mac will come at some point in 2008. Sadly, the DG is still repeating the "only for Sony TVs"-like single-platform explanation and still not mentioning a (DRM-free?) GNU/Linux service.

Currently in the US the main political parties are deciding who will contest the next presidential election. Naturally this gets some commentary from all sides. Planet Debian has syndicated two blog posts commenting on these issues, it’s interesting to compare them: First John Goerzen writes a post about an issue he (and almost everyone in the Debian community) considers important - copyright law [1]. He quotes the Randall Munroe who is the author of www.xkcd.com (described by the author as “A webcomic of romance, sarcasm, math, and language“) which is wildly popular in the free software community (I believe that there is a fan-club which has meetings). Randall’s commentary is quite interesting and I recommend reading it [2]. The most noteworthy fact is that Barak Obama has sought advice from Lawrence Lessig - who has done more for the free software community than any other lawyer. John’s post doesn’t contain much original content, but citing a lengthy post from a highly regarded source and quoting a particularly relevant paragraph make it very noteworthy. Next Jaldhar Vyas writes about “the war against Islamic terrorism” [3] and makes the claim “we are finally gaining the upper hand in Iraq“. To consider that claim it’s best to read some expert commentary. William S. Lind [4] is a widely respected conservative who is an expert on military strategy, his comments about stabilising Iraq are always interesting [5]. It’s sufficient to note that William has been predicting failure for the US occupation of Iraq right from the start and that events over the last five years have proven him correct. William S. Lind’s thoughts on Democracy are interesting too [8], I don’t agree with him in this regard (I generally disagree with him on most things other than military matters) but it’s an interesting thought. Jaldhar also claims that “Democrats on the other hand have a closer association with the media who are behind many of the sillier IP laws“, this seems to be a reference the the “liberal media” conspiracy theories. There seems no clear party association with bad IP legislation (both the Democrats and Republicans do silly things in this regard), and debunking the liberal media claims can be done simply by watching some TV (choose a couple of random news shows on different channels). Fox is not the only right-wing news outlet. Jaldhar also has a conspiracy theory about the Supreme Court and the “need to ensure that the court does not veer leftward again as it will inevitably do during a Democratic administration“, not that the Democratic party is particularly “left” by whatever definition you might apply to the word. I prefer the www.politicalcompass.org analysis which shows that all the serious contenders in the Democratic primary are Authoritarian Right [6]. So the result of the next US presidential election will determine how authoritarian and right-wing the government will be, the fact that it will be authoritarian and right-wing is beyond doubt. That said it would be good if the authoritarian right-wing government that we (*) get at least has some decent policies in regard to IP law (which is the hope for Barak Obama). John Nichols has an interesting analysis of Ann Coulter’s support of Hillary Clinton over John McCain [7]. It would be interesting to see Jaldhar’s comments on this issue. (*) I use the term “we” when talking about US politics to acknowledge the fact that the Australian government will take orders from Washington. Some pundits predict that the Greens will be the second major party in Australian politics in a couple of elections time, so maybe in 8 years time we will have an Australian government that represents Australians instead of Americans. But for the entire duration in office of the next US president (be it 4 years or 8) they will be able to get the Australian government to do almost anything that they desire.

• [1] http://changelog.complete.org/posts/683-xkcd-author-endorses-Obama.html


• [2] http://blag.xkcd.com/2008/01/28/obama/


• [3] http://www.braincells.com/debian/index.cgi/search/item=181


• [4] http://en.wikipedia.org/wiki/William_S._Lind


• [5] http://dni2.wordpress.com/2008/01/23/on-war-247-crossing-the-channel/


• [6] http://www.politicalcompass.org/usprimaries2008


• [7] http://www.thenation.com/blogs/thebeat?bid=1&pid=278859


• [8] http://dni2.wordpress.com/2008/01/29/on-war-248-my-masters-voice/

Share This

I would like to suggest to my readers to ask airplane crews for explanations of their rules. If we can get a larger number of people to inquire about the reasons behind the do s and dont s on airplanes, maybe the airline companies will adopt the practice. In the context of a previous post on the lack of explanation of the motivations behind airline rules, I was utterly impressed when the steward on the Air New Zealand flight from Melbourne to Wellington asked me to turn off my music player so that I would hear when they asked us to evacuate the plane or similar. While I doubt that I would continue to listen to The Flower Kings in an exceptional event, his explanation actually got me to turn off the player, which I had previously never done (rebel me!). I know it s a bit ridiculous, but I was previously so set on the idea of small devices like a music player interfering with the airplane instruments that I failed to see this obvious bit of logic. The steward thus gets my best steward award. When you fly, ask the crew about the reasons for the rules they impose on you, the passengers! NP: The Flower Kings: Unfold the Future

I am 10 000 metres above sea level, on my way from Melbourne to Wellington. I am looking back at a very enjoyable week of conferencing, with LCA 2008 ending yesterday, followed by today s Open Day. The purpose of this final day is to invite the general public to learn about open-source. Individual projects present their work at booths and field questions by bypassers. Jacinta Richardson and the other organisers and helpers of the Open Day have done an amazing job. The place was buzzing and the selection of projects broad and interesting, even to me. Two talks and a series of lightning talks, as well as catered food for everyone rounded it off. I will try to have this event in mind as we organise a similar event in Buenos Aires after the forthcoming DebConf8 in Argentina. I had a splendid time at the conference and probably can t thank Donna Benjamin and her army of mignons enough for organising it. Compared to the other open-source conferences I previously attended, this one was the most professional. Good job, everyone!!! Here are the highlights:

• I opened the Debian mini-conf with the state of the project address.
• My second presentation on that day was on my packaging workflow (slides), including a live demonstration, which was received well even though I should have prepared it.
• At the keysigning, I (again) used my Transnational Republic identity card and reported on it in another post. I was pleased by the level of attention this got, and how many people approached me during the week to discuss the issue.
• I really enjoyed the talk by Adaora Oniya on communication challenges in Tuesday s LinuxChix mini-conf. Among other interesting points, she listed traits that are typical to males and females and stated how none is 100% on either side. Glancing over the adjectives, I started to wonder about my feminine nature.
• Later that afternoon, a bunch of us sat down to find similarities in packaging workflows of the Debian and Fedora projects.
• Bruce Schneier s keynote titled Reconceptualising Security didn t teach me anything new, but that was to be expected since I am a regular reader of his Cryptogram newsletter. He s a good speaker, but I think his talk would have benefitted from a few, simple slides to illustrate some of his points.
• A few of us met on Wednesday morning for a few games of the Asian board game Go. Paul Wayper and I played two non-competitive games, in which we talked about each others moves and strategies. I think I learnt quite a bit during that session.
• Jeff Waugh s mini-conf talk titled Disintermediating Distributions as well as Stormy Peters keynote Would you do it again for free? , as well as a few other sets of slides, taught me that I really need to work on my own presentation style and get rid of bullet points once and for all.
• The Penguin dinner, traditionally a catered event for conference attendees, took place at the Melbourne Night Market this year. Everyone got food tickets and went off to the dozens of stalls to get food and drinks. This was an excellent idea to deal with 600 people.
• I was very glad to have attended Jason White s presentation on braille and text-to-speech interfaces on Thursday.
• My presentation on [netconf](http://netconf.alioth.debian.org] was well attended and the audience had plenty of good questions. I was able to answer most of them with reference to the design of the netconf core, which is a good omen. The idea of on-demand dialing went into my notes. I screwed up once when I went off on a tangent while answering a question about firewalling and then forgot the original question, but my listeners showed mercy.
• Luke Kanies presentation of Puppet convinced me to allocate more time to this system administration tool. He did a very good job fielding questions and managing time, but he should try to slow down a bit.

Apart from the busy programme, I particularly enjoyed the hallway track , which is usually the reason why I attend these events. I really ought to practice remembering names and faces a bit better. I am not paying enough tribute to this week with this report, but I shall conclude it regardless. Unless something very unexpected comes up, I will attend next year s LCA in Tasmania. NP: Porcupine Tree: Futile

So, Christmas started at 4.30 AM this morning. After persuading the kids it was a false alarm (literally), we all managed to stay in bed again 'til 5. Then the chaos struck. Photos for the family available soon. But, its the children who turned out (surprise) to be less sleep deprived. Presents of new clothes and finger paints don't mix: who'd have thunk it? And in the afternoon, as the adults tried to sleep off the feasting, the kids notice that Santa is now at home asleep, not looking at who's naughty or nice ... Tags children, christmas, logic

So a few folks left some interesting comments in response to my link to the article on the rise of the alpha-girl based on the research of Harvard psychologist, Dan Kindlon. My response to both Joe and Karl is that it is worthy to lower the barriers to entry not because girls will change the cultural ecology of geekdom in positive ways (though they may) or because geekdom is inherently “omg totally awesome!!!!!!!!!!!!!!!!!!!!” but for a much more mundane reason: it may allow girls to follow interests and eventually discover a passion. I think it is a great idea if more women were involved in geekdom and open source development not because it is inherently great but because I am sure there a lot of women out there who would enjoy it (and by extension, I am sure a lot who would not). By highlighting this article I am not advocating some forced hacker-female-labor-migration-policy but pointing to the fact that social conditions outside of geekdom play a role in ensuring more participation among women. But let me explain a few things before I argue my position a little further. First a little clarification, especially now that I have read the article. By alpha the author does not mean dominant, aggressive, and totally jerky, which is what might immediately come to mind when you read/hear alpha (especially if one knows any alpha-geeks or alpha-lawyers for that matter, who are much worse, imho). And I certainly don’t want any more alpha-anything (alpha-women, alpha-dogs, alpha-cats, alpha-hamsters ) given our world is already chock-full of alpha-jerks. By using the term, the author basically means confidence, which apparently is on the rise among girls, leaving them much more likely to be go-getters, undaunted by explicit and implicit barriers and obstacles and thus more likely then ever to enter arenas that have been thought of as traditionally male or in fact totally dominated by males. If this trend is indeed in place, I think it is great and I hope that this eventually translates into more girls/women populating traditionally male areas whether it is neurology, movie directing, hacking, or surfing. What I appreciate about the article is that his research can help us question the idea that women are naturally averse to competition due to their estrogenic hormones while boys, brimming with testosterone, just love it and exude it. I never identified with that conventional well-worn script, in part because I guess I am fairly confident and somewhat competitive. Being in academia for the last 10 years, I have witnessed a lot of really confident women that have helped inspire me and keep me going, especially when times got rough. What is fascinating about the article (and by extension probably his book) is that gender parity and equity and changes in the psychological makeup of women have not changed overnight but have taken a much longer time to settle in place. We are only now bearing the fruits of structural and educational changes first instituted decades ago and that tackled some serious forms of discrimination. As a result, we are seeing girls and women donning a deeper confidence that may help them participate with more success in the arenas they want to whether it be sports or in the workplaces (though there are certainly still major barriers and issues, which are addressed in the article). So why would someone want to participate in the world of free software and hacking in particular? My first answer is there may be any number of reasons why anyone, female or male or transgender or whatever, may want to do so for the love of technology, to feel an intense belonging to a community who share your passions and who work together to create something with a lot of value, to enjoy the challenge of learning, to spread freedom to every corner of the earth, etc… It is not that geekdom is inherently fun and exciting but that it will be interesting to some slice of the population men or women (or other) and what is the harm in lowering the barriers to entry, especially if it brings enjoyment and frankly a lot of economic security too? There are a number of girls/women who already find it worthwhile and I am sure many more who would. And the point is not to create some policy to make sure that we shuttle women into hackerdom but as a society we should equip them with the necessary psychological tools so that if they think this is worthwhile, and discover that they love it, etc, they will dare to venture in there and more importantly, stay if they want to. In terms of Karls point that a lot of people are professional geeks in part because they d have trouble being anything else; like being gay, it s not a choice, I think that is far too narrow of an assessment, not to mention an outdated caricature of geeks. While there is certainly a class of socially awkward geeks (if that is what you mean??), I would say they are in the minority though they may certainly stand out precisely because they are the odd ducks and because the stereotype is so entrenched. Many geeks I have met, while they may pretty darn focused on geekdom, also have full and rich lives/personalities that cannot be easily collapsed into one immutable personality type. Yes they may be obsessed with tech but aren’t doctors, academics, musicians, lawyers sort of fanatical too? I spend like my whole week working on academic stuff (part of necessity, part out of love). And at least hacking has way better conferences and economic perks, which may help explain why people stay Finally, I think you assume a little to strongly that we do what we do because we have a pre-formed existing desired to do so. While I think this is the case for many things (and I knew the minute I learned about anthropology, I wanted to be one, which was odd but it proved to be correct), I think desire is also formed as much through experience and hence the importance of exposure to different worlds and experiences. I know that there are many things I could have never imagined I would have loved–karoake and sailing are two things that come to mind—until I tried them about both took some degree of courage. In the later case, it took a lot of guts to move onto some ship at the age of 18 instead of going to college and I am so glad I did. This is an instance where confidence and an initial curiosity led to discovering a love and passion I never knew I had. So if desire can be formed and not just expressed, I think it is key to make sure people have all sorts of opportunities to cultivate the passions they never knew they had.

This week I have been primarily looking over ticketing systems. So far I've looked at the following:

roundup

Initially this was the package that I liked best. It is small, self-contained, and easy both to install and manage. The significant downside was that it expected all users to create an account first, prior to submitting a ticket. If they didn't and they mailed submit@example.org they'd receive a reply back which read "Unknown user: sender@example.net". Shame because it was reasonably featureful.

otrs2

This was a little fiddly to get going with, but actually suprisingly good. Had I not experimented with roundup I'd have said it were the best I looked at.

request-tracker

Big. Heavy. Intense. It looks ugly, but provides a bamillion (metric) configuration options and can be used to do almost anything you'd like. If it didn't such up so many resources I'd have had no qualms about using it. Even the mail-gateway was nice and simple to get working.

I'm going to take a look around some more and see if there are any non-packaged systems to look at. Pointers welcome. All I want is for incoming emails to appear in some sort of queue where they may be assigned to an owner. If the original submitter can view the ticket online great, but no big deal if not. I'd expect that replies sent to the ticket would be routed back to the submitter, and that replies to those would similarly update the ticket. I guess thats standard though?

First of all: no, I'm not a huge fan of the genre. In fact, when I don't feel too good, I tend to avoid them, since they can depress me at times. But once in a while, a romantic comedy doesn't hurt, and I do kindof like them at times. Early last week, I picked up a DVD of the first movie at a low-price DVD shop nearby, and watched it. The prince and me isn't my favourite movie in the genre; the plot surely is interesting, but I can't shake the feeling that things work out too easily in the end. Compare with Notting Hill, for example, where the two protagonists need to go through (I believe) three cycles of relationship/no relationship before the end of the movie; this, in my opinion, makes for far more interesting cinema. But, all in all, it certainly was an interesting watch. I might think the plot could've used some improvement; but that doesn't mean it's bad. The entire visual aura of the movie is great; they went through quite some effort to make it look well. For instance, in a number of scenes it's obvious that they made the clothing of the characters blend in with the background; and yet they still managed to create diversity in those colors during scenes, by making the clothing differ just that tiny bit, and different parts of the background as well; the entire scene would be built up of one painting-like shot after another, yet all of them slightly different. Impressive. And then I haven't even mentioned the casting, which was magnificent. Anyway. Since I kindof liked the movie, and since the sequel DVD wasn't expensive, either, I got that DVD as well. Boy. I've never quite seen a movie's sequel be so completely and utterly out of touch with its original. What horror. Except for the male protagonist, not a single actor of the original cast returned for the sequel. They had good reason, so it seems. The plot is utterly stupid. It revolves around an ancient law that made it somehow illegal for the couple to get married. Hello? Do you really think a king wouldn't have the influence to convince parliament to get rid of that law? Of course not, but then you wouldn't have a plot anymore. Now if the rest of the movie would make up for this silliness, then it wouldn't be so bad. Except it doesn't. This movie is bad in... let me count the ways.

1. The plot error, as explained above. Also, the plot was quite incoherent, for the most part.
2. The casting is terrible. The original King Haraald, father of the male protagonist, managed to create a believable king, with that somewhat eccentric and strange flair that most European royals seem to have these days. The queen had a bit of an iciness over her, warming up to an interesting character once she started to like Paige. Even the minor roles were so well played. In the sequel, none of this returned. The queen was just tight; an empty shell. The new Paige had a problem with overacting in some of the scenes. In fact, that was a common issue; I don't think I've ever quite seen this much overacting in one movie. Also, King Haraald didn't even remotely look like the original; not physically, and not in his acting.
3. Speaking of the King, and given the plot of the original movie, he shouldn't even have returned for the sequel; he abdicated because he was terribly ill; he should've been dead, for crying out loud!
4. The CGI was horrible. In the original movie, there were a few scenes where I'll bet CGI was used; not because it showed, but because I don't think it were possible to create that scene otherwise. In the sequel, you could tell when CGI was used due to the utter lack of natural feeling. Ever heard of a randomizer? It's what you use to avoid having a full room of butterflies all shake their wings at the exact same speed. Shudder.
5. The "painting" feeling and attention to detail of the original movie was nowhere to be found. In fact, at some point they show a castle which supposedly is in Denmark somewhere, but it shows the Czech flag, instead. Ugh.
6. Some of the gags were funny, but not as intended; because they were so silly. I've seen 3-year-olds make better jokes.

... I guess I could go on forever, but then there isn't much point in boring my audience. The short version: the original "The prince and me" is an interesting watch, but please forget about the horrible sequel... ... I guess there's a reason why they put it directly on DVD and skipped the theatres.

In the past I was not blogging small things if they were not worth a full blog entry on their own (or if I did not have the time to make up a full entry of it :). Inspired by the example of Raphaël Hertzog <hertzog@debian.org> with "News for Debian developers" for <debian-devel-announce@lists.debian.org>, I am intending to do the same on a monthly basis about my own Debian related work. This first entry about January 2008 also covers a few things from the last month of 2007. General News

• Trusted Computing
  
  After having taken over some rotting ITP bugs, Debian has now all the important packages to support Trusted Computing on platforms containing a TPM chip. The packages are not in good enough quality for release, but there is still some time left to fix that. Looking forward to make lenny supporting TPM properly out of the box, as well as aiming for making Debian the best TPM enabled distribution available.
  
  Currently, the TSS software stack consists of trousers, tpm-tools, opencryptoki, libengine-tpm-openssl, and ecryptfs-utils.
  
  
• Smartcards
  
  I am using smartcards since a while to hold GnuPG, LUKS, and OpenSSL keys/certificates. Thanks to Jonas Meurer <mejo@debian.org> for applying a fix and a patch of mine to cryptsetup. Together with my uploads of gnupg-pkcs11-scd, pam-pkcs11 and pcsc-omnikey, I can now use Debian out of the box with smartcards for authentification, not relaying on patched or private packages anymore.
  
  The next aim is to integrate smartcard support into debian-installer. It should be possible to use/store keys or certificates for encrypted filesystems directly from/to a smartcard during installation time.
  

Package News

• botan-devel
  
  The Botan library is maintained upstream in a stable release branch and a development release branch. Before, I was uploading as versioned source packages, botan1.4 and botan1.5. To be a bit more consistent, the two source packages are named botan and botan-devel now.
  
  
• gitosis
  
  Tommi Virtanen <tv@eagain.net> has written a marvelous tool to securely manage hosted git repositories, named gitosis. Having always looked for an elegant sollution to maintain git repositories through push/pull over SSH only, this package made an excellent addition to the Debian archive.
  
  
• gnunet
  
  GNUnet, more precisely the gnunet, gnunet-gtk and gnunet-qt packages where mainly maintained the last years by Arnaud Kyheng <Arnaud.Kyheng@free.fr> with me playing co-maintainer.
  
  Arnaud has become busy within the last months, so I took over a more active role on its maintenance. Currently, all gnunet related packages are in sync and in its latest upstream version available in the archive. There is even a new sibling, gnunet-fuse.
  
  
• icedove-l10n
  
  After one and a half year of pushing its maintainer without any effect at all, I finally took over the unmaintained icedove-locales package in October 2007. I immediately changed the package to the proper naming scheme (icedove-l10n-*) which was an outstanding issue since August 2006.
  
  In the last weeks, I have added unofficial localizations for Galizian, Nepali and Ukrainian, now supporting 38 localizations in total. Icedove localizations are now in good shape again, always matching the Icedove version and no longer lagging behind.
  
  
• iceowl-l10n
  
  Following iceweasel-l10n and icedove-l10n, there are finally also localizations for iceowl (Mozilla Sunbird) available. Populating packages for iceowl-extension (Mozilla Lightning) from the same source package is a bit trickier package-wise, but will be available soon too.
  
  
• iceweasel-l10n
  
  In September 2007, Robert Milan <rmh@debian.org> on behalf of the Catalan/Valencian Debian translator team asked me to remove the iceweasel-l10n-roa-es-val package. Unfortunately, this localization is related to a long standing cultural and political dispute between the Catalan speaking Spanish people and the City of Valencia. Additionally, the localization itself is of poor quality. Of course, I removed the package in unstable immediately and prepared an upload for stable at the same time.
  
  As usual, me asking something on debian-release results in first beeing ignored, then denied and third, two month after my request, beeing privately asked to upload nevertheless. This is one of the reasons I sometimes fully understand fellow maintainers not carring about stable at all anymore, it has become indeed too much of a hassle.
  
  
• traceroute
  
  For the last decade, Debian was shipping an implementation of traceroute originating from BSD. After I took over the package in late 2006, it became clear to me that Debian should not maintain its very own version of traceroute. Therefore, I replaced traceroute in August 2007 with an implementation from Dmitry K. Butskoy <Dmitry@Butskoy.name>. Apart from the fact, that this modern implementation is better in every way (faster, cleaner, less bugs), it has an active upstream maintainer and is used by different other Linux distributions too.
  
  
• syslinux
  
  Thanks to the work of Robert Milan <rmh@debian.org>, syslinux has now 64-bit CPU detection in unstable (2:3.55-2) and experimental (2:3.60-2) again.
  
  

Team News

• Debian Forensics
  
  Unfortunately, Debian has at the moment very few forensic related packages in the archive.
  
  Christophe Monniez <dfence.242@gmail.com> maintains a lot of forensic related packages on behalf of his Debian based forensic LiveCD. Beeing interested to see them in Debian, I am mentoring him now how to merge them properly into Debian where possible, and maintain them in the official archive. We have formed an Alioth project for this purpose. Packages are maintained in git, everyone is welcome to join.
  
  
• Debian Website
  
  After having offered my help to maintain the Debian Consultants list, I got added to the webwml team. Doing Debian consultancy myself, this is just another way of helping out Debian from time to time by adding, removing and updating some entries of like-minded people in a list.
  
  

Well I've had a busy weekend, but I'm sober now. I made a new release of xen-tools, which has a couple of minor bugfixes and not much else. I also released a new update for Debian of the xen-shell which fixes a couple of bashisms. Finally I've managed to sign up two new users to my anti-spam proxy. Hopefully they're very happy. In real news I painted about 1 square meter of my flat, (we're now into week three of painting a single room...), and replaced five light bulbs:

My eyes! The goggles do nothing!

Now I need to install a request tracking system (otrs2) and catch up on significantly outstanding RT status updates. I'm getting hopeless again. Maybe I should just give it all up and become a plumber. Plumbing is easy: Water goes downhill. The rest is just regulations and a willingness to get dirty...

On January 26th 2008, the OCaml community has its first meeting in Europe. There was 5 different talks, including one from me. The meeting was pretty constructive and i think some great things should come out of it. In this post, i will focus on the Debian maintainer point of view. The meeting was organized by me, with the help of Garbriel Kerneis and Vincent Balat. I wish to thank Mme Turgis from ENST/ParisTech who has made possible all this to happen. Introduction: I announce the creation of OCamlCore, a SS2L. It will provide commercial support for OCaml and related products. It will also provide community with some resources (including a GForge, a planet, some SCM repository...) For now, i will open administration to Debian people who wish to help (for root rights) and from the whole community for other task (gforge and general administration). For now, i will choose alone who can administrate and who cannot... This is not a very open position, but this server is also for my company. Xavier Leroy give us a nice talk that has let us see some future direction:

• OCaml 3.11 will have native dynlink
• hope to integrate GHC like type system (GADT: Generalized Algebraic Data Types)
• need to work on parallelism, following different paradigm

But above all, Xavier talked about the fact that there is a lack of manpower at INRIA and invited the community to build tools and other things (including a CPAN like distribution) to make the language more widespread. He also stated that a lot of things will stay in place in the name of backward compatibility. OCsigen Vincent Balat has given us a nice talk about OCsigen, a new framework for programming web application. This program is already in Debian and it is at the root of Debian discussion about moving .cm[ao] into libxxx-ocaml package. This new framework allows to program web application using continuation, which should ease a lot of aspect. It also features static type checking, including static verification of the generated HTML pages. GODI I was impressed to see G. Stolpmann coming to the meeting. Unfortunately, i cannot follow the whole talk, since i have some phone call to make, in order to book the restaurant. From what i have seen, it seems that GODI is growing, in term of manpower. They have some issues with OCaml 3.10, because of camlp4 and some packages. At the end of the conference, he was pushing for a more general use of GODIVA. In particular, it requires to have a very uniform way of building software. It should be the foundation of a build standard for OCaml software. In my humble opinion, i don't agree on this point. Basically, its proposal was based on configure/make all, which is too C style way of doing. It is not bad, but just exclude ocamlbuild enabled software. ocamlbuild Nicolas Pouillard has made an introduction on how to use ocamlbuild. I have discovered how it was working, since i didn't have time to work on this topic. It seems a good thing. I hope to be able to try it at some point. The conclusion was about modifying ocamlbuild to allow the use of multiple plugins. For now, the plugin is a separate file which is compiled first and then loaded, as a special case. Nicolas is looking for a full OCaml way to handle this for multiple plugins. OCaml in Debian I have spoken about different aspect of Debian packaging. After a short introduction and some history about OCaml in Debian, I come to some conclusions/problems:

• we have an early integration, which makes Debian handle a lot of packages, but this is due to a long history
• we still are not able to cope with libraries incompatibilities when rebuilding, we only have addressed ocaml package ABI problem
• the debian package management system is not really compliant with the OCaml way of creating libraries, which is our main problem
• native compilation is broken on 3 arches (Xavier Leroy told us that this should be solved for ARM)
• use of Alioth has made us more efficient to integrate packages
• Debian team are working by step: from time to time we begin to integrate a lot of packages, mostly because of some maintainers wishing to integrate a software with a lot of dependencies

Talking with Xavier give me some additional informations:

• ARM is fixed, it should compile with Debian stable on ARM, he explains that the problem is related to the multi ABI flavor of ARM
• he says that we should not have any problem concerning bytecode stripping of executable, if there is still some we should find the OCaml library that triggers this behavior
• I realize that this behavior can be triggered by ocamlmakefile, that still have a "-custom" option
• he promises me that he will send me a simple test to find custom bytecode application (combination of "file X" and a specific string at the end of the file)

At the end of the presentation, there were some questions. I discover that many people are ignoring the ABI problem with OCaml and its libraries. They seem to discover that it requires regular rebuild of our packages. I also have a discussion about the fact that Debian binary distribution doesn't fit developers need. It seems that developers prefer to have the source of libraries they compile and also the most recent release. But at the same time, people avoid using GODI, which also have the problem of needing to wait for a particular library to be released... After some discussion, I point that some companies prefer to live in a frozen world, which Debian stable can provide. Living in a frozen world helps company developers to have the same environment from the beginning to the end of a project - which can last years. It also help to avoid build environment de-synchronization between company developers. There was also a question about interaction between installed OCaml package and GODI software. I cannot answer it, expect with a "patches are welcome". OCaml on a JVM using OCaml-Java Xavier Clerc explained us how he has achieved running a full OCaml environment on a JVM. This work was pretty impressive, because he was able to compile OCaml top level and provide it as an applet. This is something amazing (and working). He stated also that this should allow to do some binding with java graphical user interface from OCaml. I was pretty busy with a phone call (to a restaurant for the dinner), so i don't have attend the whole conference. Anyway, the project is promising, but it needs to recompile every library using its compiler. I think this is not suited for Debian for now. Workshop The workshop was shorter than it should have been. This is due to accumulated time shift during the day. However, it was pretty interesting, because everybody can talked almost freely. The initial discussion was about the "Unicode situation". This was a question about Unicode in Unison, but there is no real solution about it. For reader information, unison has problem with filename containing UTF-8 char. In particular when syncing two directories which are on two file system with a different encoding on each. Even if the file can be represented on the two file systems, the comparison (between UTF-8 and ISO8859-15) fails. This is because the comparison is a byte to byte comparison. We discuss further the idea of OSR (OCaml standard recommendation) which was briefly discussed in the morning. I think David Teller (who have also done a great part of the IRC retranscription) was very keen on this idea. I invited Nicolas Pouillard to discuss the three following subjects. About camlp4 documentation, Nicolas told people about the he set up. About ocamlfind and ocamlbuild, he went back to the multiple plugin problems. About ocamlbuild and GODI, Gerd, Nicolas and Xavier tried to build a list of what metadata can be shared. This includes list of files to be installed (PLIST in GODI). Concerning the "feedback from the Gallium", Xavier explains that he has done this in the morning (which is true). I think that Xavier implicitly agreed on the fact that if this kind of event happens again, he can do another talk about future of OCaml. Concerning Summer of Code, I just remind that people can write description of Google Summer of Code project in the cocan wiki. Another one remind about Jane St Capital summer of code. Points concerning common interfaces raise the discussion about OSR. The organization of next year events doesn't raise particular interest. I think people would be interested to have one next year, if something comes out of this meeting.