I've been working a bit over a week on writing SmbGate, a simple and quite braindead Web app giving my users web access (read-only for now at least) their home shares in a Samba server from outside the Institute, which will be basically closed for vacations/moving to a new building for over a month. It went quite smoothly. Even using a quite ugly API (Filesys::SmbClient - It works, but in an ugly fashion), getting the basic app to work took me only two days, and I've been beautifying bits of it for around a week. I even got around to write a user manual, which -to my surprise and astonishement- has been followed by the users. Wow, I'm productive! I even think this can be useful to other people, so I'll put the code online soon - As soon as I get the workplace-specific things weeded out to a configuration file.
Of course, everything has its ups and downs. Yesterday, I found a bug. Today, a user reported the bug to me. And, of course, it seems to depend on MSIE's weirdness.
I really, really hate my users experiencing browser incompatibilities - That's why I installed W2k under qemu (which, when used with the non-free but downloable with no fee required kqemu kernel module is perfectly speed-comparable with the completely-non-free VMware - Go try qemu now!). I tested thoroughly the system from the guest W2k system to my development machine (which is, incidentally, the same physical box), and it worked perfectly. Of course, locally, I didn't care about setting it up in a SSL-protected area. For my users, of course, access to their files is SSL-protected. I tested the production system from Linux, using Firefox. Works like a charm.
So, why am I bitching? Because browsing the directories works correctly from MSIE, but downloading the files doesn't (it says, in such a Spanish that I don't really understand the error message, that the file does not exist or the site is unavailable). Of course, debugging a HTTP request over a SSL session is not feasible. I installed an instance of this system in my regular unencrypted HTTP server - But, surprise surprise, it now works fine under MSIE. Exactly the same URL, only with the https replaced by http
So... I am almost entirely non frustrated. I have hit a bug which does not like being debugged. Joy, joy. But, I promise, victory will be mine.

Yesterday I gave a presentation at OSDC in Melbourne about my Postal mail server benchmark suite. The paper was about my new benchmark program BHM for testing the performance of mail relay systems and some of the things I learned by running it. I will put the paper on my Postal site in the near future and also I'll release a new version of Postal with the code in question very soon.

Today at OSDC I gave a 5 minute talk on 5 things that need to be improved in the security of Linux distributions.

1. The fact that unprivileged programs often inherit the controlling tty of privileged programs which permits them to use the TIOCSTI ioctl to insert characters in the keyboard buffer. I noted that with runuser and a subtle change to su things have been significantly improved in this regard in Fedora, but other distributions need work (and Fedora can go further in this regard).
2. A polyinstantiated /tmp should be an option that is easy to configure for a novice sys-admin. There have been too many attacks on data confidentiality and system integrity based on file name race conditions in /tmp, this needs to be fixed and must be fixable by novice sys-admins.
3. The capability system needs to be extended. 31 capabilities is not enough and the significant number of operations that are permitted by CAP_SYS_ADMIN leads to granting excessive privilege to programs.
4. The use of Xen on servers such that a domU is always used for applications should become common. Then if a compromise is suspected there will be better options for investigation.
5. SE Linux needs to be used more, particularly the strict policy and MCS. Use of the strict policy often reveals security flaws in other programs.

I'll blog about each of these in detail at some future time.

It has been pointed out to me that membership in both a fraternity (that may safely be regarded as conservative, although not in the sense this word is misused today) and in the German Pirate Party could lead to a conflict of interest. I disagree. In my opinion, they share a lot of common interests, even if they don't realise it yet. A large percentage of the members in my fraternity are musicians (no surprise there, since it has a clear musical focus), so I'd expect them to be interested in licensing issues around artistic works (with a bias for artists' rights, of course), which plays into a field where the Pirates want to establish one of the "core competences", for which it will in return be necessary for the Pirates to talk to the artists.

After this blog entry, I thought for a while, and decided to take over Debian package a day. I’m well aware that it needs a lot of time, so I’ll try to make this a collaborative work:

• It should be as easy as possible for readers to submit entries
• There will be a team of editors, willing to dedicate some time to this on a regular basis, who will receive new entries from users, improve them and publish them.

The publishing rate should depend on the number of ready-to-go entries in the queue. Starting with publishing twice a week should be okay. I have already started to set up a wordpress blog (using drafts to prepare entries + mails to coordinate should be enough for now ; we can always switch to something more complex later). TODO List :

1. Get control over the debaday.debian.net domain. I couldn’t do it directly since DAMs seem to want to wait until Christmas to deliver my Debian account, so buxy did it for me. Should resolve soon.
2. Get added to Planet Debian and Planet Ubuntu. If the posting rate stays low, it shouldn’t be a problem, and we can always change this later.
3. Write the initial pages explaining how to contribute, etc.
4. Get the first entry online.
5. Recruit editors to share the load.
6. Wait for you to submit entries

Update (08/12/06) : Debian Package of the Day won’t be added on Planet Debian: a recent discussion concluded that non-personal blogs should not be on Planet Debian. So you have to subscribe directly to its feed (if you read Planet Ubuntu, you probably don’t need to, since it was added there).

I bought a Sony DCR-HC24E for the purposes of recording my wedding ceremony. I could have borrowed my parents', but it's an ancient analogue thing and although I don't really have a use for a camcorder I talked it through with Katherine (making it clear that part of the appeal was just sheer toy value) and we went ahead with it. (I should point out the driver for recording any of the wedding came from my mother-in-law and I wasn't that fussed about the whole thing, but having experienced the "day was a blur" thing I'm glad we have it. Though I've watched it too many times as I'm about to explain.) The Sony comes with both USB and Firewire. My desktop doesn't do Firewire, but I figured USB would be fine. First issue is that Linux doesn't seem to support it in USB mode. I don't know if this is easily solved, as reading the manual I discovered that Sony claim USB isn't as good quality and Firewire is better. Huh? It's all digital. What gives? The best I could come up with is that Firewire is better at guaranteeing latency/bandwidth so you don't end up with dropped frames. Anyway. I buy a Firewire cable and dig out a Via EPIA-M board which has Firewire. Some poking about leads me to the conclusion that I want dvgrab. I fire it up, it seems to do the right thing, I end up with a huge file. Point mplayer at it and discover it's dropping frames. It appears raw DV is about 30Mb/s. The HD in the Via is an old 6GB one that only does ATA-33. So I find a newer ATA-133 capable one, double the RAM in the box (on Adam's recommendation) and try again. This goes better. So now I have a bunch of AVI files, all of them about 1G in size. avimerge is employed to combine them (I might have been able to just get dvgrab to output a big file, but I was wary of large file support). Then I did ffmpeg -i bigfile.avi -target dvd smallerfile.mpg resulting in a couple of DVD format MPEGs (one for the ceremony, one for the speeches). My first attempt at a DVD image was with DeVeDe. It seemed to work fine, but I ended up with something that the DVD player didn't like and neither did mplayer or xine. So I fell back to qdvdauthor, which I've used in the past but don't deem the most user friendly of programs. I finally end up with something that mplayer and xine seem happy with in terms of a menu and a pretty picture of us signing the register and working video. And so to burning a DVD. I used growisofs for this. Firstly with a DVD-R, which mostly worked but had annoying pauses on my real DVD player. So I tried with a DVD+R and this seems to be much better, however there are some minor pauses. This might be my ancient DVD player not coping well I guess. I'm sure DVD creation shouldn't be this painful. I bet if I ran Windows I could point and drool my way to a DVD with the software Sony supply with the camcorder. All I wanted was a basic menu with a background picture and some video attached to the menu options. I'm pondering doing a version with a picture gallery as well, but can I be bothered with the hassle?

Regular viewers may have noticed a reduced frequency of updates lately. This is due to unfortunate circumstances.

But anyway.

Fed up with Bruce Perens claiming to speak on your behalf? Object that someone who hasn't written any useful code in approximately forever wants to class you as being in the same category of people as him? Think it's a bit off for him to claim random things about the meaning of the GPL? Irritated that there's no way to make this clear to journalists?

Now there's a solution!

Visit Bruce Perens does not speak for me and let the world know that when Bruce says that the Open Source community is fighting the same sort of battle that Martin Luther King did, you'd rather not be included.

Multiple times we’ve talked about having a Debian-Developer-Gallery. That could be something like all the pictures from various conferences and events, to just having a mugshot of each registered developer. So :

1. Is this a good idea?
2. Do you have a picture you’d like to be included?

I’m volunteering to setup a simple site which will contain one photograph of each Debian Developer (ideally which they will submit themselves, I’m not sure how to handle the case of somebody saying “This pictures is foo@debian.org” when foo didn’t authorise/expect it to become public.) This simple site will be accessed via:

• http://mugshots.debian.net/foo/

Each page will contain:

• Link to the homepage of dd-foo, as found in LDAP.
• One single image of user foo. Thumbnail if “too big” linking to the full size version.
• (Optionally links to QA.d.org, etc, but that is secondary to this purpose.)

(No ratings, no tagging, possibly a “random user” link, or an index by username. Nothing complex or too dynamic) Suggestions for a better name would be appreciated. I figure either “faces” or “mugshots” - since the obvious “gallery.d.net” is already taken. So .. comment here if you think this is a good idea. Or feel free to mail me a link/attached image. Assuming I get say 50 developers thinking this is a good idea I will setup the DNS alias and put the site live. Bandwidth will be minimal, but I think having the friendly faces (?!) visible would be a good thing. And will make identification of people prior to meetings signficantly easier. (At times like this I wish I could host a real poll .. but ignoring that for a second.)

Not being one to stick with what I know, over the last few days I've been trying to put a RESTful sheen on a small app I'm toying with. It's quite simple -- there's really only one type of resource I need to deal with, and I've got a solid URI structure to refer to it all. So far, so good. I've read all the theoretical stuff about how URIs should be nouns, and the HTTP action should be the verb -- and I agree with the sentiment, at least for this system I'm writing[1]. I can even (I think) model all of that stuff using my framework of choice, the ever-hyped-but-good-despite-that Ruby on Rails. There's even fairly explicit support in Rails for a lot of what I want to do, with automatic Content-Type: and Accept: handling logic built-in. But this thing is, primarily, a web app, not a web service. I want the RESTful thing so I can interact with the app programmatically, but at the end of the day, I expect most interactions will be via the good ol' HTML. How, then, do I implement my HTML interface so that my user's browser does the right thing with my resources? My REST resource http://example.com/widgets/1337 will do the right thing if an appropriately-credentialled user issues a DELETE /widgets/1337 request, but how do I tell a browser to do that? The "traditional" way I've done that sort of thing, in Rails, is to encode the verb in the URL, like so: /widgets/delete/1337, but I completely agree with the idea that a GET request shouldn't modify data[2]. So I'm completely sold on the idea of not encoding actions into the URI itself. I'm also a DRY[3] kind of guy, and one of the things that has always slightly irritated me about web services is that, when you write them alongside a HTML-oriented webapp, you often have to duplicate logic (even if it's not very much) to get both versions working. Considering that both the webapp and the REST service are using URLs in pretty much the same fashion, it seems very wasteful to have to design two subtly different schemes to handle the two nearly-identical sets of requirements. So, having written this article without managing to figure the answer for myself, I invite comment (sent to mpalmer@hezmatt.org, and I'll summarise later). How do I tell a user's browser to issue a DELETE or PUT against a URL? Am I being overly idealistic to expect the two access methods to be somewhat comparable? Should I just give up and encode the action I want in my URL, or maybe the parameters to the POST request? Am I even completely misunderstanding REST, and trying to find answers in it that just aren't there?

---

1. I have some slight qualms about the idea that every possible interaction with any possible system could be modelled using an unlimited noun set and four verbs, but I'm happy to leave that debate alone for the moment, as I don't have anywhere near enough experience to speak intelligently, and I have more basic problems at the moment anyway. 2. I remember the common story of the website where the 'delete' hyperlinks are regular GET requests, and the first Google spidering of the website causes everything to be deleted, resulting in a very bare database. This is a result I'm keen to avoid. 3. Don't Repeat Yourself -- a phrase that should be tattooed on the inside of every developer's eyelids.

Back in June, I wrote about my switch to VPSLink for my virtual private server (VPS) host.

Now it's 6 months later, my initial contract is up, and it's time to consider whether to renew it.

Overall, VPSLink has worked out reasonably well. I have their Link-4 plan, which provides 512MB RAM, 20GB of disk storage, and 500GB of bandwidth for $40/mo (or down to $33/mo if you pay for 12 months in advance).

Reliability and Uptime

VPSLink has been reasonably reliable. I wouldn't say that they have been exceptionally reliable, though.

Some outages:

• Back in July, the server was down for more than 8 hours. vpslink support blamed it on filesystem corruption; they rebooted, the system came up, FS went into readonly mode, so they went back down for fsck. I don't know what FS they use.


• In October, an outage of about 30-60 minutes that apparently was due to load problems on the host. The control panel also was broken during this time. Apparently there is a reboot queue, and the system can only reboot one customer's VPS at a time, and everybody wanted to reboot. But the UI was not really designed for this situation and presented very confusing status messages.


• In November, a kernel panic caused an outage of about 60 minutes.


• Various other outages that were resolved fast enough that I never emailed them about it.

They have generally responded to support requests in a reasonable amount of time, and support has been approximately as helpful as I'd expect.

Overall, there've been a few issues but, aside from that 8-hour outage in July, nothing especially remarkable.

Automated Tools

VPSLink has a "control panel" where you can reboot, start, or stop your virtual machine. You can see how much bandwidth you've used in a month, your IPs, and billing information.

You can also create support requests and view the status of support requests there. You can also view all correspondence on a given ticket, and add new correspondence to it -- a nice touch that's useful if your email is down because your VPS is down.

The reboot/start/stop facility didn't work during one outage, though.

Resources

The 20GB of disk space is nice to have, though I never used it all. No complaints there.

But the memory setup is rather strange. This may be because VPSLink is using OpenVZ instead of its more popular (and featureful) commercial counterpart Virtuozzo, or something such as Xen.

Those that have used OpenVZ/Virtuozzo know there is a /proc/user_beancounters file in the virtual environment that reports on the limits of resources allocated to your virtual server. VZ lets the server admins regulate the amount of resident RAM, swap, inodes, pending IP connections, amount of virtual RAM, etc, etc. About 3 dozen items in total.

Unlike some companies like JohnCompanies, VPSLink was not willing to make any adjustments to this file for me. For instance, my mail server may need more simultaneous open files than they have by default, but they wouldn't work with me to make reasonable adjustments.

But the larger problem was with regard to RAM. This was particularly annoying. VPSLink does not permit any access to swap, so the 512MB is what you get. But tools like top show the entire memory allocation on the host, and are mostly useless in tracking down your own usage.

You can look at the privvmpages entry in /proc/user_beancounters to get an idea of your current usage, but that's it. There is a script on their wiki that will turn this into a more useful number, but again, it's not the most helpful.

The minute you try to allocate anything past 512MB, your processes start getting killed. According to /proc/user_beancounters, even though my system normally hovers around 70% of that 512MB allocated, I've had 290,567 instances where a process has been refused its request to allocate memory since the last reboot. Such instances usually cause a process to crash.

Other Virtuozzo companies like JohnCompanies will give you "burstable RAM", so if others aren't using their full RAM allocation at the moment that your machine goes over your regular limit, you can go over it to a certain extent. That was very effective at preventing crashes during times of higher than usual memory usage, and I never had trouble with this at JohnCompanies.

I've had a lot of trouble with VPSLink because of these hard, no-exceptions limits. Getting hit by the Google bot at the same time as the MSN bot could raise memory usage enough that processes would start getting killed. Depending on which process it is, it could take down cron, apache, the mail server, whatever. And there is no log of which processes die because of this.

In normal circumstances, this wouldn't pose even a noticeable impact to a server; inactive bits could be swapped out, etc.

I am also suspicious of exactly how OpenVZ calculates memory usage. Since moving to a physical Linux box, my memory usage seems to be much lower than the privvmpages would seem to indicate, even though it's running the exact same code.

So I had some outages on my server that were caused by OpenVZ memory limits, which didn't get listed in the overall outages above.

This problem is the #1 reason I'm leaving VPSLink.

Performance

Overall performance has been acceptable. The CPU speed appears to be reasonable and about as expected.

The disk performance has been more problematic, however. It tends to be rather slow. There have been times when I can type "ls" in a directory with about 10 files and it takes 5-10 seconds to respond. And I wasn't even using "-l".

Now that sort of thing is certainly the exception. But it makes databases -- and websites that rely on databases -- very slow.

The performance measurements over at RealMetrics also show VPSLink as being at the bottom of the pack for disk performance.

Overall

VPSLink is a reasonable value, and if monthly cost is important to you, probably a good choice. Don't expect it to be spotless, though. I would call the overall experience pretty average. Nothing too spectacular in either direction in any respect.

The "high definition audio" in my laptop is rather minimal. Apart from the mic not yet working, it has a line out and a single volume control. Thats it. However, I'd like to have multiple applications use the sound card, for example my music player, eventually some video player or flash, and some system events. ALSA to the rescue. It's not easy to configure, but really powerful: Yes, that is a separate volume slider in my regular mixer for MPD, my music player. Here's how to do that: First we'll need to create a huge /etc/asound.conf:

# the real device
pcm.realdev  
        type hw
        card 0
        device 0
 
# software mixing
pcm.dmixer  
        type dmix
        ipc_key 3129397
        ipc_key_add_uid false
        ipc_perm 0666
        slave.pcm "realdev"
        slave  
                period_time 0
                period_size 1024
                buffer_size 8192
                # we're enforcing 44100, since thats what most apps use
                rate 44100
         
        bindings  
                0 0
                1 1
         
 
# software volume
pcm.softvol  
        type softvol
        slave.pcm "dmixer"
        control  
                name "Software"
                card 0
         
 
pcm.mpdvol  
        type softvol
        slave.pcm "dmixer"
        control  
                name "MPD"
                card 0
         
 
# input
pcm.input  
        type dsnoop
        ipc_key 3129398
        ipc_key_add_uid false
        ipc_perm 0660
        slave.pcm "realdev"
 
# duplex device
pcm.duplex  
        type asym
        playback.pcm "softvol"
        capture.pcm "input"
 
# default devices
pcm.!default  
        type plug
        slave.pcm "duplex"
 
pcm.dsp0  
        type plug
        slave.pcm "duplex"
 

I won't go into all the details (I don't know all of them either), but the basic idea is that I setup the dmixer plugin for software mixing, and attach two software volume controls to it. I'm keeping the permissions to 0666, since my MPD is running as a different user, and I didn't find a way to say I'd like to have the permission set to group "audio". The default device is the regular microphone jack (untested, since there are driver issues with my chipset and recording) and the "Software" volume control. If you have an ~/.asoundrc you might want to move it out of the way. Next I need to configure MPD to use its own volume control via /etc/mpd.conf:

audio_output  
        type            "alsa"
        name            "my ALSA device"
        # 'mpdvol' is the device name I used in asound.conf
        device          "mpdvol"
 

You'll probably need to restart all applications currently accessing your audio devices to have them pick up the new config. The new volume control will also only appear after you've started an application using it AFAICT. Sometimes you need to restart them twice for the new volume control to be effective. When alsa-utils restores the volume controls after reboot it should work right away. The "Software" volume control is optional, but that way I can tune down the default applications volumes below the MPD volume if ever needed. Oh, and I think you can safely keep one or all of the software volume controls to maximum without distortion happening (this doesn't hold for all sound cards, where it's often best to keep the sliders at ~75% max to avoid distortion)

One of my projects here at the KACE in Accra, Ghana, is to make the live programming game Infon a useful tool to teach programming. Until now, programmers had to upload their code to the server over a telnet or netcat connection. To lower the initial threshold for new users, I wrote an editor for infon bugs, using python and gtk. The features are:

• lua syntax highlighting
• easy connecting and program uploading
• telnet session view, to see what s going on under the hood
• special bonus: A little bug on the margin indicates what line of code is run by the server at the moment.

You can find a screenshot on the webpage for infon-devel.I also created Debian packages for the infon server, the infon viewer and my GUI, which you can find on my people.d.o page. The server and viewer packages are currently waiting for inclusion in Debian s experimental branch in the NEW queue and infon-devel will follow that path after some positive feedback (or lack of negative, we ll see).Further plans include a comprehensive documentation of the bug s API and maybe some hints for teachers how to use the program in classes. Comments with regard to the GUI, the debian packaging or the game in general are highly appreciated. You are also invited so swing by #infon on freenode.

My work permit in Canada expired on December 1 (that's 10 Frimaire for you French Revolutionary Calendar fanatics), so I needed to renew it. It's possible to renew these things by mail, which is worrisome and time-consuming, or even to go into an office in Montreal (near-mythical, crowded, reportedly ineffective). I've never liked doing either, so whenever we have to deal with immigration, our family drives the 50km down to the border with the US. They have a big immigration facility there, and if you drive out of Canada and back in again, they have lots of nice officers in bullet-proof vests to deal with any immigration issues on the spot. It's called "driving around the flagpole" here, but Maj and I try to make a trip out of it when we have to go. So we drove down to Lake Placid in the Adirondacks last Friday morning -- sufficiently distant and different to seem exotic, without being too far away for a weekend trip. Plattsburgh, the nearest American town to us, is, well, kinda boring. We've spent a day in Burlington (Vermont) before, and that was pretty fun, but we wanted to try something different -- so Lake Placid it was. Friday was a crummy day for a drive, though -- there was snow and freezing rain in equal measures, so the roads were a little dangerous. The hood of our car kept building up this several-inches-thick icy-snowy mass that I was afraid would rip off the hood and go careening into the dark, so I kept stopping to chip it off with my handy ice scraper. Once we got down to the Adirondack park, though, the rain was just a regular drizzly non-freezing kind, and we could actually enjoy the scenery. The roads in were remarkably small -- hard to believe that not one but two Winter Olympics were held at this remote location. When we got to town, we took a look around at the main drag -- a single street that fronts onto Mirror Lake and points directly into the Olympic centre. We stopped at the Great Adirondack Brewing Company for a late lunch, and had a nice crabcake and caesar salad with roasted shrimp. Maj is a little squeamish about eating seafood in the mountains -- with good reason, since she's been burnt before -- but we both ate up anyways, and it was real good. Amita June had a grilled-cheese sandwich that came with french fries shaped like little happy faces. Awww. We then went to check into our motel, the Wildwood Inn. I've got a weakness for a certain kind of woodsy mountain motel -- lots of wood paneling and alpine flavor -- and I especially like paying motel prices. The Wildwood was just what I like -- clean, inexpensive ($65/night), and charming, with a nice view from our room out onto Lake Placid proper. It also had a nice big indoor heated pool complex and free WiFi. (On that subject -- why is it that so many motels in North America now have perfectly acceptable free WiFi, but major hotels in big cities charge you $30/night for crummy WiFi with complicated authentication schemes that take half an hour to configure? Is it just because the big hotels charge too much for everything, or is it because they know they can rake business travelers over the coals and it all will go on the expense report? It makes me really mad to pay for WiFi, and it makes me extra-mad that it's usually so complicated and of such poor quality. Anyways.) We took a big nap and went out after dark (4:30PM) to look at the town and get some dinner. Unfortunately, it was still raining big fat cold raindrops all over downtown. The ski season was supposed to start this weekend in the Adirondacks, but with all the rain they canceled opening the runs, and with the bad weather and no skiing the town was pretty empty. Most of the restaurants we passed were closed, and when we eventually got to one, the Black Bear, we were the only people there. The Black Bear turned out to be really nice. They had a good selection of organic vegetables and seafood nicely prepared but not too fancy -- what we Californians call "California cuisine". I dunno what anyone else calls it. Amita liked it because they had a big chalkboard on the wall and she spent most of her time running between our table and the board or drawing big jagged marks on the wall. That night the wind and storm howled outside our motel room -- I dreamed the place was falling down. When we got up in the morning, though, there was a light dusting of snow on the ground outside -- the first one of the season! Maj and Amita June went outside on the motel lawn to play around -- Amita doesn't remember last winter, I don't think, so snow is new all over again for her -- and I went to clear off the car. Then we went downtown to get some breakfast. We shopped for books (I bought James Fenimore Cooper's The Pathfinder) and winter gear (Maj almost but didn't buy some boots) walking up and down the main street in the light snow, then piled into the Soulshine Bagel shop for some bagel sandwiches and coffee. The food was good -- the bagels were thick and doughy, not like the little Montreal bagels I've grown fond of -- but the place only took cash, and we hadn't gotten out any American money yet. Oops. They were nice enough to take our Canadian cash, which earned them a decent tip, and then the three of us walked back to the car in the snow, Amita trying for the first time to catch snowflakes on her tongue. After our nap, we went out with good intentions to go visit the Olympic Centre and get ourselves a little bit of cultural value from the trip, but the early dark and our darker natures drove us instead to the Lake Placid Pub in a residential area right by Mirror Lake. The Pub was great -- really good beers (I liked the 7% Ubu Ale) and fine pub-grub. There was a table of kids next to our table, and they had a little table barbecue on which they were making s'mores. They kept handing Amita their extra graham crackers, which she noshed contentedly. This morning we went to the Saranac Sourdough deli and bakery for an early breakfast. It was right across highway 86 from our motel, and they had great pancakes. I had a big spinach-crab frittata with sourdough rye toast -- really satisfying. We took the long route back to Montreal -- west through Saranac Lake then north up to Malone (New York), a little town on the Salmon River with a big collapsed mill in the middle of downtown. By the time we got down to Malone, all the snow was gone, and it was back to that bitter snowless winter look all over the place. Malone had some nice architecture, but we ducked into the homey Nancy's Village Diner for some lunch. Then out onto the road again, through Chateaugay and Mooers and back to the border after a brief stop at duty-free. Our immigration issues took about an hour -- that was pretty good turnaround -- and we were on autoroute 15 back home to Montreal pretty quick. Not far from the border, though, the snow started coming down hard, and by the time we got to the St. Laurent river it was sticking to the road, making driving a little hazardous. But we managed to get home OK, glad for a nice little weekender. tags: lake placid montreal new york saranac lake adirondacks immigration snow maj amitajune

OFBiz passed its vote to exit the "incubator" at the Apache Software Foundation. For those not up on the inner workings and jargon, this means that it should soon (as of the next board meeting) become a regular project at the ASF, like httpd, Tomcat, and so on Si Chen, one of the core team, sums up the whole process here, which is an interesting read for those considering approaching the ASF. Having helped set things in motion via an out of the blue question on their mailing list, I'm pleased to see that things are working out well, and continue to be impressed with the progress they are making, as well as the dedication with which they pursued integration with the ASF (and the bureaucracy that entailed). It would have been nice to use OFBiz where I'm working, but unfortunately that was not to be. In any case, I do glance at the code and data models from time to time, because they encapsulate a lot of good ideas.

WTF IS THIS SHIT? Ok, that above would be what a newly-baptized “FOSS advocate-slash-zealot” would say upon seeing Federico Pascual Jr.’s PostScript regarding the FOSS bill. I suppose I could have said that myself a couple of lifetimes ago. But, there is more than meets the eye. While I would like to think of myself as a “FOSS veteran”–believe me, I have still so much to learn about it–I would like to step into the shoes of such a person when approaching an article as sensational as Mr. Pascual’s. Despite what seems to be a most interesting article on the mechanics of government software usage, it fails to address the one particular bit that is just as important as the proposed bill itself: the real Free and Open Source Software. Let me nitpick this article bit by bit:

FREE RIDE: A bill is being pushed in Congress forbidding all government agencies and state-controlled firms from buying and using any of the computer software sold in the market!

Alas, when I first heard of the FOSS bill sometime before September, I also had a bad impression of it. Perhaps I was just too politically allergic at that time (yeah right,) but I tried to adopt a wait-and-see’ approach first and let the dice roll. Perhaps because this bill was to be introduced by a very visible congressman with alleged leftist ties made me feel uncomfortable, but then, so was (and still is) with the current administration. Or perhaps I just felt it wasn’t damn right to legislate FOSS as an end-all solution, preferring instead of presenting is as a process for reforming the local software industry. Looks like first impressions definitely make a difference.

The proposed law to be called “Free/Open Source Software (FOSS) Act of 2006″ commands government offices to use only information and communications software that are given away for free and have no restrictions as to their use. The objectives appear to be to save money for the government and to encourage the making of free (non-commercial) software.

So? What’s wrong with these objectives? FWIW, the early FOSS bill draft did seem to have such a Draconian section as forcing the government and allied offices to use, and use only, FOSS. IMHO that by itself ran against the very fundamental ideal of FOSS: the freedom of choice. Not Hobson’s choice, but real choice. The current bill IIRC now allows this true choice; unless there is an extreme case where FOSS cannot be applied without becoming non-self-sustaining (not to mention self-liquidating,) agencies may implement their infrastructure using FOSS as their primary instrument, with the application of open standards (that is, open document formats, open communications protocols, etc) unifying the disparate components. Perhaps right now, this situation may seem kind of far-fetched, but its not really that far-off, considering what other nations and cities have done (or not done) with FOSS. Munich, Extremadura, Beijing… the list is not yet that long, but its bound to go a long way Now, while the government may now adopt open standards and open-everything, does not mean that the openness’ forgoes security, either; the government may opt to use well-known encryption protocols and even base their own security infrastructure on them. In fact, they are free to even look inside the source of these well-known standards, to study them, and to branch off new implementation that may even change the way these standards work. In fact, even without this bill in place, the government can participate in the production and development of FOSS!!! Wait a minute, wasn’t I supposed to defend this bill? Eh, well. I suppose this bill is good and all, but like I said earlier, there are those first impressions made by the parties involved in the making of this bill which unsettles me. IMHO I would rather see applications of this first in key cities (the happy works in Munich and in Extremadura are no accident, believe me) which in turn, would allow both local the national government to see just exactly how this FOSS magic works. Then, when the observations have been made, the papers are in, and the workers get hired, then, maybe, we’ll have a nation where FOSS can be mandated as a very strong preference, but never a forced one. Its all about growing up, really. I’m being reminded of Tom DeMarco’s The Deadline, where a newly-retrenched guy from a telco literally lands into the fantastic job of his life, managing an entire nation of software engineers and architects to develop several killer apps within a year (or so; raid you nearest Book Sale and be lucky Its a great experiment: when it succeeds, you’ll be the first to be present, but when it fails, you’ll be the first to be nowhere.

But I can also hear in the background a call to an unholy war against multinationals whose popular software run virtually all maybe 95 percent? of the computers of the world.

Now this is a low blow. Maybe partly because of the prevailing images of the advocates–geeks and leftists, my, what a c-c-c-combo!–is what drives Mr. Pascual to make this point. But really, multinationals are not the main concern. FWIW, FOSS is multinational in nature: it is even multi-denominational and multidisciplinary. FOSS is one of the things that make anonymous people like you and me Internet superheroes. FOSS connects the Internet’s tubes and keeps away the trucks. FOSS makes the Internet serious business, yet also drives them crazy. The Linux distros that I have worked, am working, and continue to work on, are all multinational: Debian and Ubuntu. People from all over the world, from all 7 continents, participate and work on what would arguably be the biggest software distribution the human world may ever produce, freely, regardless of motivation or goal. I suppose all the folks involved have only one common goal, and that is to see a work created for the benefit of the community by the community. I suppose the background howl comes from somewhere altogether, but its hardly just from FOSS. FOSS is the epitome of what is truly multinational, and one thing that is not truly controlled by any one single person, corporation or not.

Venkatesh Hariharan recently wrote an article on Indias traditions of knowledge and how Open Source meshes with them. Now having met him at foss.in and knowing of his work, I am 100% convinced he is on the side of the angels and their is no malice in what he wrote. However, his interpretation (really not his, but the conventional wisdom amongst the Indian elite.) of Indian history and culture is so monumentally wrong it bears correction. While I admit my hackles were raised by the cultural and theological mistakes made, there are implications for Open Source advocacy in India and the world at large too. He starts by giving the example of Nalanda, supposedly "the first university in the world." but more accurately a Buddhist vihara (monastery.) Its' very name indicated sharing. I use the past tense because Nalanda doesn't exist anymore. In fact except in a few border areas influenced by Tibet or Burma, Buddhism itself is so thoroughly extinct in the land of its birth, the place where it flourished for over 1500 years, that the only reason people like Hariharan or myself only know that there ever was such a thing due to the work of 19th century Western Indologists. How could this be? One theory is that a resurgent Hinduism coopted or persecuted the Buddhists into oblivion. However this is unsatisfactory. It does not explain why Jainism (a religion as old as Buddhism and equally heretical for exactly the same reasons from the Hindu point of view) still survives to this day and it doesn't explain how it could have happened for even the most advanced genocidal regimes of the 20th century have been unable to "disappear" undesirables to the extent which Buddhism disappeared. A more plausible explanation revolves around the fact that, as I mentioned before, places like Nalanda were Viharas. This doesn't mean that they can't have university-like properties too; after all the great academic institutions of Europe also had religious foundations but the monastic nature of a vihara is salient. A monastery is not a place you go to engage the world, its a place you go to escape it. To mix metaphors a bit, the viharas were cathedrals not bazaars. While there may have been a lively intellectual life within its walls, there is no evidence that Nalanda and its denizens interacted much with the surrounding culture. An economically unproductive institution of such vast size (15,000 monks at its peak) could only survive by the patronage of kings and other rich people. When that patronage dried up as for example when the medieval Muslim invasions swept away the old royalty, Nalanda and its sisters couldn't survive. Just as when a proprietary software company dies, its "intellectual property" often dies with it, when centralized Buddhism died, Buddhist ideas died with it. (Luckily Buddhism had spread to other countries by then and developed new, less monolithic forms so it was not lost to the world altogether.) In contrast Hinduism (and for that matter Jainism) while having all due respect for monks were and are primarily lay movements. The pursuit of morality (Dharma), wealth (artha) and pleasure (kama) in this world are equally valid human goals alongside liberation from the world (moksha.) and this manifested as the much maligned institution of caste. Hariharan quotes the conventional view probably familiar to Westerners from Anthropology 101, a lock-step hierarchy of four classes (varna is the Sanskrt word) with fixed occupations, with knowledge and privilege on top and ignorance and oppression at the bottom. The thing is, this view bears no relationship whatsoever with social reality in India now or historically. There is another Sanskrit word, jati, which can be translated as caste. There are thousands of these jatis and while Indian thinkers have periodically attempted to try and shoehorn them into the varna framework, they have had little success and varna is for all practical purposes just a theory. And this is not just a fall from some putative golden age (Like the canard that once caste was flexible and merit based and only later became rigid.) but the state of affairs throughout recorded history.

A jati consists of people who share a common (or fictive) kinship, who have particular food and ritual choices, and marry endogamously. While many jatis are associated with a particular occupation, many others are not. This is what caste means to a typical Indian (it is also the social organization prevalent amongst Jains, Sikhs, Muslims and Christians even if they don't accept its theological basis.) Yes, hierarchy and concommitantly oppression, are in some cases a byproduct of casteist thinking but they are hardly its raison d'etre. A comparison can be made to the Western nuclear family system. Some people think it is superior to any other form of social organization. Most people wouldn't go that far but go along with it as "the way it is." Some of those of a liberal persuasion might want tweaks of certain aspects of it. A very small fringe think it is nothing more than a nefarious plot to spread patriarchy, subjugation and racism etc. They are mostly considered kooks by the other groups. (Unfortunately when India and caste are concerned, the kooks are ruling the roost.) The diversity of jatis like the diversity of open source creates a certain resistence to disruption that a monoculture cannot. Thus though Hinduism also suffered grievously from invasions, it was able to hold on where Indian Buddhism could not. Brahmin (sic. That's an English mispronounciation.) is also misinterpreted as one who knows Brahma (masculine noun. The Creator God.) instead of Brahman (neuter noun. The supreme spirit pervading the Universe.) though even then it would be wrong because Brahmin, Brahma, and Brahman all come from a common root word brhati (feminine noun. Sacred speech.) as any Sanskrit dictionary will attest. Hariharan cites the example of the sacred scriptures (Sic. He means the Vedas) and the notorious statement of the Manusmrti saying that an unqualified person who hears them should have molten lead poured into their ears as examples of the proprietarization of knowledge. Now the long-suffering untouchables may have been afraid of many things but having lead earplugs was not one of them. There is no historical evidence that any such action was ever attempted. You can criticize the Manusmrti for even saying such a thing but that is a far cry from using it as evidence of historical attitudes. You see, the Manusmrti is not even in the most orthodox conception Hindu Sharia and the Vedas are not "Sacred Scriptures" in the sense that the Bible or Koran are. Rather they are part of a wide range of significant literary works respected in Hinduism of which other important examples are the two Epics the Mahabharata (which includes the Bhagavadgita), and the Ramayana, and the vast compendia of geneologies, philosophy, lore and legend called the Puranas. Hariharan actually missed a good chance to make his point here because while the Vedas are indeed "proprietary" the other works I mentioned are not and have in fact permeated all over India and even beyond its borders. Many Indian languages owe their literary existence to translation of the epics or Puranas. For instance one of the earliest monuments of Hindi literature is the Ramacharitamanasa, Saint Tulsidas's translation of the Ramayana. When he wrote it in the 16th century, he did face some opposition from those who didn't think such an august work should be rendered into a "vulgar" tongue, he also received encouragement from equally orthodox people (including those who believed the Vedas should be restricted to Brahmins) Today it is by many accounts the most popular Hindu holy book in existence. So really the whole idea that the Hindu canon shows a fall from open grace to rigidly controlled private property is just bogus. To those who have slogged their way though all this verbiage wondering what it has do with Linux and Open Source, let me assure you I am getting to the point :-) It's bad enough from my point of view as a devout Hindu that my religion would be misrepresented this way but from my point of view as a supporter of Free Software ideals, it is catastrophic. Linux and Open Source in India has spread, as in most parts of the world, primararily as a hobby amongst computer enthusiasts and for a hobby it's doing ok. However if you think of it as more than that, as a tool to enhance society and empower peoples lives, that is not nearly good enough. But how can one serve a society if one apparently has no clue about that societies history and mores? The developing world is littered with failed projects that were carried out with the purest of motives but no regard to what the putative clients actually wanted. Do we want Linux and Open Source deployments to go the same way? For a couple of years now I've been trying to get Indian and NRI programmers to get involved in localization in debian-installer and elsewhere but even with the small minority that are sympathetic to Open Source (a scandal in itself.) it is like pulling teeth. To their credit, Red Hat India pays people to work on such things but volunteerism is the heart of the Open Source movement as we all know so the apathy of Indian IT professionals is deeply troubling. Hariharan is trying to increase interest by appealing to the Indians' sense of cultural pride which is a good tactic--it has been successfuly applied by many non-western or minority cultures--but he is not going to be very successful if the vision of Indian culture he is presenting is as alien as Eskimo culture to the vast majority of the people. Western Open Source advocates also run into difficulties due to being tone-deaf in their understanding of how third-world cultures actually operate. When India declined to participate in the One Laptop Per Child (OLPC) project, some commentators on places like Slashdot were perplexed. Wouldn't a poor country want an inexpensive yet efficient pc using free software instead of high-priced imports? The thing they missed is that while people in India may be poor, thanks to a more-or-less democratic polity and more-or-less open communications, their frame of reference is no longer their village. Their trends are increasingly set in Mumbai, New York, Paris, and London. The forward-thinking amongst them know that computers are the key to the future. They also know Bill Gates is the richest man in the world thanks to something called "Windows" knowing which can get you a green card and your own chance of becoming rich. So if Linux comes along, presented as a cheap alternative which is "just as good", the fake Gucci handbag of IT if you will, it is not going to impress. Thinkpads and Dells appeal to the upwardly-mobile persons vanity, a third-world hand-cranked laptop does not. (This incidently is what is behind the "Nalanda university" meme too. Monasteries are yesterday. Universities are the in thing so we have to have some in our past and not just any but by golly, the first university in the world.) When they venture from pure technology into the realm of culture, Open Source advocates need to be a lot more sophisticated, not to mention accurate, in their arguments lest they fall on deaf ears. Platitudes and sentimentality about "spiritual" versus "material" culture aren't enough. There must be concrete demonstrations of the benefits of why the Open Source approach to knowledge is better. They must be more sensitive in their presentation to avoid needlessly antagonizing people who might otherwise be natural allies. I believe the Open Source ideal is good for India and the whole world, not just in software but for society at large and I wish Venkatesh Hariharan and all the others on the frontlines of the fight for openness the best of luck. But good intentions cannot excuse sloppy thinking.

I don t have a TV here in Ghana (and I don t miss it at all), but some audio-visual content consumption from time to time is nice. Therefore, I started to subscribe to various Podcasts, using the comfortable Democracy Player. Here are my regulars , also see my list of German podcasts.BrickfilmsSome like lego. Some like stop motion animation. I like both. Therefore, I am a big fan of lego movies, and the brickfilms blogcast delivers the best ones directly to me. Unfortunately, does not get posted to very often.Olde EnglishMy sense of humer is not every one else s. Therefore, I guess not everyone will enjoy the sketches of the Olde English comedy group. I could try to list some of my favorites episodes, like One picture every day , but discover that for yourself.BSODInteresting, highly technical hour-long podcast covering interesting topics such as how the telefone system works (and what funny things you can do with it), bulding a infra-red remote control gun that will control your (or anyone s) TV from quite a distance and similar topics. It could cover a bit more software topics, and less Windows based things and personally, I think the Bastard Sons of Dial-Up put slightly too much emphasize on bad language and underground-activists-like appearance. But that might be genuine, and the content is of good quality, so it is worth watching.The Tech JunkiesOnly three episodes so far, but these two guy are doing great and funny things with electronics (such as testing what happens when you plug a speaker into the power outlet). They also have covered lock picking, and I especially enjoyed seeing a bump key in action, as so far I only read about that technique.Player 1 vs. Player 2A two-guy talk show about computer games. Slightly oriented towards old and console games, but still interesting for most gamers, I d say. They have not released a new episode for almost a year now, I hope that they will start sending again some day.

I don t have a TV here in Ghana (and I don t miss it at all), but some audio-visual content consumption from time to time is nice. Therefore, I started to subscribe to various Videocasts, using the comfortable Democracy Player. Here are my regulars , also see my list of German podcasts.BrickfilmsSome like lego. Some like stop motion animation. I like both. Therefore, I am a big fan of lego movies, and the brickfilms bodcast delivers the best ones directly to me. Unfortunately, does not get posted to very often.Olde EnglishMy sense of humer is not every one else s. Therefore, I guess not everyone will enjoy the sketches of the Olde English comedy group. I could try to list some of my favorites episodes, like One picture every day , but discover that for yourself.BSODInteresting, highly technical hour-long videocast covering interesting topics such as how the telefone system works (and what funny things you can do with it), bulding a infra-red remote control gun that will control your (or anyone s) TV from quite a distance and similar topics. It could cover a bit more software topics, and less Windows based things and personally, I think the Bastard Sons of Dial-Up put slightly too much emphasize on bad language and underground-activists-like appearance. But that might be genuine, and the content is of good quality, so it is worth watching.The Tech JunkiesOnly three episodes so far, but these two guy are doing great and funny things with electronics (such as testing what happens when you plug a speaker into the power outlet). They also have covered lock picking, and I especially enjoyed seeing a bump key in action, as so far I only read about that technique.Player 1 vs. Player 2A two-guy talk show about computer games. Slightly oriented towards old and console games, but still interesting for most gamers, I d say. They have not released a new episode for almost a year now, I hope that they will start sending again some day.

A long time ago (until Nov 2004), there was this good blog which described one cool Debian package every day. It allowed to discover a lot of interesting software, but it suddenly stopped being updated. It would be nice to resurrect this. A team of editors could work on this, and readers could submit new entries. Editors wouldn’t need to be Debian users : we could have Ubuntu users too, and it would be a nice way to determine what are the things that have been packaged in Ubuntu that we should (but don’t) have in Debian yet. Leave a comment if you would like to dedicate some time to this (either as an editor, or as a regular submitter of entries). If there’s enough manpower, I’ll try to setup a mailing list or something to discuss the minimum infrastructure we would need.