Search Results: "tar"

27 January 2012

Craig Small: Unlucky sometimes

Sometimes life throws little curves at you to see if you are still awake, today has been one of those days. fglrx is (apparently) fixed I ve had a long-running problem with fglrx on my laptop. The problem stems from ATI closed-source drivers with one of those laptops that has an ATI and Intel driver. It means I am basically using the slow Intel chip only. This morning I had enough and backed up my home and started to rebuild the laptop with debian 6.0.3. So I kicked off the very very slow process of reformatting the crypto drive (it has taken 5 hours and still going) let it gurgle on its merry way and started to read my email. One of the emails was that my bug about fglrx not working is closed, apparently it is fixed. If I had read that 10 minutes earlier, a simple apt-get install fglrx-driver would of perhaps fixed it; oh well. My problem is now is do I move to the latest driver and hope their fix is my fix or leave it with some ancient version? My preference is the former; I only hope it works! psmisc 22.15 and buffer overflows psmisc has a program called pstree which prints the set of processes in a tree fashion. It hasn t changed much for quite a while. I released version 22.15 and the Debian package 22.15-1. 22.15-1 I also adopted the harden CFLAGS as suggested for procps. I was a little surprised that I received an important bug. The report was saying I had a buffer overflow introduced in 22.15-1, but no relevant code had changed. The compiler options had done their job and stopped a buffer being overflowed. But where exactly was the overflow? Running gdb on pstree quickly showed that it was line 267 of pstree.c which uses strcpy(). That function set off warning bells. The relevant code is: 
    PROC *new;
 
    if (!(new = malloc(sizeof(PROC))))  
        perror("malloc");
        exit(1);
     
    strcpy(new->comm, comm);
Now comm is the short command name you find in /proc//stat. It is fixed in the kernel at 16 characters. The PROC structure has this field as 17 characters long, one extra for the NUL. I went and checked the Linux source and yes, it is still 16 characters long. The clue was in the name of the program that it died on. 
#6  new_proc (comm=0x6111b0 " console-kit-dae ", pid=1571, uid=0)
  at pstree.c:267
That string is 17 characters long. The problem is that 16 characters is for the name only. If the name is in brackets or braces, then that 16 character limit doesn t apply. The buffer overflow bug has been there for a long time, but only with the compiler flags did it become visible. Given you need to read names out of the /proc filesystem and if someone can fiddle with that you have bigger problems it doesn t seem to be too much of an issue. It should be (and is in Debian 22.15-2) fixed but is a nice example of the compiler catching bad things.
Related articles

Lior Kaplan: PHP 5.4 @ Zend

As a Linux integration guy at Zend, most of my time is spent in compiling PHP related code or dealing with the variety of Linux distributions we support. With the coming release for PHP 5.4, we (at Zend) had some interesting stuff going on. As part of the RC phase, I got to check the status of the 50-60 PHP extensions we provide, especially the PECL extensions which have different release cycles than the main PHP. With minor versions, this usually doesn t really matter, but for major versions this means that some extensions need a little bit of love and fixes to work well with the new PHP version. This of course with the help of our developers. The changes are usually one-liners due to a variable type change, or finding commits in the extension s SCM and applying/back-porting it to the current versions (e.g. pecl memcache). Our policy regarding the patches we have, is that they should at least be sent to upstream (a core member or a bug report, e.g. #55703). I think I m in the best position to enforce that patch policy, so in a few recent cases, I found myself asking one of our developers if the patch he sent me was already accepted upstream before willing to take it into the build process (in this case they are used temporarily, till we ll work with the next RC or final release).
While most people build PHP as a final and standalone product, we also test it against ZendServer (or the other way around, depends on your POV). This helps to discover problems related to and implications of the changes done in the major version. During the PHP 5.4 RC cycle (which is still not finished), we had, more than a few times, that an internal problem discovered led to debugging, code reviewing and sending feedback (and patches when relevant) to the PHP project. Providing fixes for the issues found, helps having PHP in a better shape for release. At least for me, that s one of the fun parts of work getting the chance to contribute back to the community (or at least making sure others do, as I don t write the patches myself).

Filed under: PHP

26 January 2012

Guido G nther: git-buildpackage in experimental

I've started uploading snapshots of git-buildpackage to experimental recently. Here's a short list of what changed over the version in wheezy and sid: This blog is flattr enabled.

Michal Čihař: Dictionaries for N9/N950

I was just about to start writing own viewer for StarDict dictionaries for Harmattan, when I noticed that somebody already took the effort and the application is available. It's called DictionaryStar and it's developed on gitorious. With the hard part done, I've adjusted packaging of various dictionaries I've made available for StarDict so that it works fine on Harmattan. For now only English-Czech one is completed, you hopefully be able to get it soon at Nokia store. The reason I've started with only one is that this pretty much does not fit into content guidelines for Nokia store and I expect problems when this will be passing their QA. So I've decided to push only one for now and once I get it through, adding others will be easy.

Filed under: English Meego Stardict 0 comments Flattr this!

Aigars Mahinovs: Zombies. Wait, don t run away, yet

I never got the craze for the zombie this and zombie that. I saw the premise as thinner than vampire storyline which in my book only had a good day with Buffy franchise. But then I got Kindle and run out of stuff to read and decided to pick up something less lively and more shambling. And you know what I found there are a few great books hiding behind the zombie label. I read them in the worng order, so to help you guys out, here is the way I would recommend to check out if the zombie genre is interesting to you: Start with World War Z: An Oral History of the Zombie War. It is written as a historical book documenting the memories of people that have survived the world wide zombie apocalipse is a series of escalating short stories. This is a perfect bathroom or bus reading. Each story focuses on how people react (or fail to react) to a radical change in their environment. Zombies are a tool to expose the human condition for this book. The next you could read (or you could even skip this if it get a bit boring for you) is The Zombie Survival Guide: Complete Protection from the Living Dead this is a problem solving book, it basically takes a problem ( ZOMBIES! ) a goal ( I want to survive! ) and describes the logical steps needed to reach the goal in the context of the problem. It is very educational on the issue of problem solving, especially with unusual problems. But it can get boring for people if so, don t give up, but just skip this book for now and move on the the best of them all The third is a trilogy, two books are already published, the third is coming soon first books is Feed (Newsflesh, Book 1) and the second is Deadline (Newsflesh, Book 2). This is a rare gem of modern literature. Basically this is a book set in the world long time after a zombie outbreak (with a good reason why and how it happened) where people have already lived a few decades with the problema and the kids are very used to it. So the book is written from a perspective of a young woman and her brother, who were born after Rising and are now into one of the most dangerous profession journalism. :) Early on they become the first bloggers to be picked to follow a presidential election campagn (book was written before Obama campaign really took off) and it only get wilder from there. I really liked these books. So much so, that I will now explore the other zombie fiction books to see if there possibly is something good there as well. Any recommendations?

Ian Wienand: pylint and hiding of attributes

I recently came across the pylint error: 
E:  3,4:Foo.foo: An attribute affected in foo line 12 hide this method
in code that boiled down to essentially: 
class Foo:
    def foo(self):
        return True
    def foo_override(self):
        return False
    def __init__(self, override=False):
        if override:
            self.foo = self.foo_override
Unfortunately that message isn't particularly helpful in figuring out what's going on. I still can't claim to be 100% sure what the message is intended to convey, but I can construct something that maybe it's talking about. Consider the following using the above class 
foo = Foo()
moo = Foo(override=True)
print "expect True  : %s" % foo.foo()
print "expect False : %s" % moo.foo()
print "expect True  : %s" % Foo.foo(foo)
print "expect False : %s" % Foo.foo(moo)
which gives output of: 
$ python ./foo.py 
expect True  : True
expect False : False
expect True  : True
expect False : True
Now, if you read just about any Python tutorial, it will say something along the lines of:
... the special thing about methods is that the object is passed as the first argument of the function. In our example, the call x.f() is exactly equivalent to MyClass.f(x). In general, calling a method with a list of n arguments is equivalent to calling the corresponding function with an argument list that is created by inserting the method s object before the first argument. [Official Python Tutorial]
The official tutorial above is careful to say in general; others often don't. The important point to remember is how python internally resolves attribute references as described by the data model. The moo.foo() call is really moo.__dict__["foo"](moo); examining the __dict__ for the moo object we can see that foo has been re-assigned: 
>>> print moo.__dict__
 'foo': <bound method Foo.foo_override of <__main__.Foo instance at 0xb72838ac>>
Our Foo.foo(moo) call is really Foo.__dict__["foo"](moo) -- the fact that we reassigned foo in moo is never noticed. If we were to do something like Foo.foo = Foo.foo_override we would modify the class __dict__, but that doesn't give us the original semantics. So I postulate that the main point of this warning is to suggest to you that you're creating an instance that now behaves differently to its class. Because the symmetry of calling an instance and calling a class is well understood you might end up getting some strange behaviour, especially if you start with heavy-duty introspection of classes. Thinking about various hacks and ways to re-write this construct is kind of interesting. I think I might have found a hook for a decent interview question :)

Russ Allbery: Do symbols files make sense for C++?

I also posted this to debian-devel, which is where the discussion will be, but I wanted to post it on my journal as well so that others who may be interested will see it on Planet Debian. For those not familiar with Debian, this concerns the implications of a new feature for how Debian tracks shared library dependencies. I'm currently working on the Policy modification to document (and recommend) use of symbols instead of shlibs, but I'd only personally used symbols with C libraries. Today I decided that I should try adding a symbols file to a C++ library, particularly if I'm going to recommend everyone do it. I tried this exercise with xml-security-c, which is, I think, a reasonably typical C++ library. Not the sort of core C++ library that would sit at the center of the distribution, but a random software package that's in Debian because other things use it. The experience was rather interesting, and I ended up uploading the new version without a symbols file and continuing to just use shlibs. That's for the following reasons:
  1. The generated symbols file was HUGE. Hundreds of lines. This is a marked difference from the typical C symbols file, which is of quite manageable size. Some of that is that the library provides a lot of different classes, but some of it is that C++ just generates a lot of exported symbols. There's no way that I could do what I would do with a C library and understand those symbols, why they're there, and whether they are likely to have changed between revisions.
  2. Generating a reasonable symbols file was a pain. Generating an unreasonable symbols file that just contains all of the mangled symbols is largely mechanical and uninteresting, but that symbols file doesn't seem to me to convey useful information. So I did some scripting to translate the symbols back with c++filt, and add (c++) tags, and then try to understand what I was looking at and figure out whether I should sort the symbols list because the default sort is by mangled name, which is meaningless. This is a rather unappealing process. It's not particularly difficult, but it's very awkward and feels like it's missing vital tools.
  3. The resulting symbols file is incomprehensible to someone without strong knowledge of C++. It's full of opaque entries that don't make sense to the non-C++ programmer, which I suspect is a substantial number of people who package C++ libraries for Debian. I know enough C++ from school that I can evaluate security fixes, make simple patches, and review upstream changes, and I think that's all that should be needed to package things for Debian. But I'm deeply uncomfortable producing a symbols file on my own that contains entries for things that I know nothing about and cannot evaluate when they've last changed, like "non-virtual thunk to FooClass::~FooClass@Base".
  4. Once I had a symbols file that resulted in a successful build and that I could have uploaded, I started thinking about how I was going to maintain it. With a C program, I would change the symbols file versions when the underlying function implementation changes in a way that may not offer eqiuvalence, similar to bumping shlibs. I realized that I was going to have no idea when that happened, and the only way that I would maintain the symbols file would be to either trust upstream to maintain ABI equivalence and therefore only change the symbols file when upstream changes the SONAME, or not trust upstream to maintain ABI equivalence and therefore change all the versions with each new upstream release. That gives me exactly the same semantics as a shlibs file, so what's the point in having a symbols file?
  5. The exported symbols of the library contained many symbols that obviously weren't really from that library, but instead were artifacts of the C++ compilation process, things like instantiations of std::vector. Do those go into the symbols file? Do they change from architecture to architecture? If they disappear again, is that actually an ABI break? How do I know? It's all very mysterious, and while shlibs provides the same semantics as just ignoring this, at least I'm not then including in the package data, generated by me, things that I'm just blindly ignoring.
I came away from this experience thinking that I should revise the Policy amendment to say that symbols files are really for C libraries and for C++ libraries with either a tightly maintained symbol export list or maintained by a C++ expert, and that most C++ library maintainers should just not bother with this and use shlibs, bumping the shlibs version or not based on their impression of how good upstream is at maintaining ABI equivalence. But that feels like a result contrary to what I had previously thought was the intended direction, so I wanted to ask the Debian development community as a whole: am I missing something? Are these symbols files actually useful? Am I missing some trick to make them useful?

MJ Ray: Phones, Privacy and Co-ops

And now a slightly longer than usual rant: The problem with the o2 network disclosing mobile browsers phone numbers that I repeated 2 days ago (and it appeared on our co-op website) snowballed yesterday to the point that it was on the short bulletins from ITN, BBC, IRN and probably many more. And then o2 fixed it. Good! The reply claims that it s only since 10th January which is rather at odds with other claims that it has been happening since at least March 2010 in some situations. I started buying from o2 in December. I was using Three, but their network where I stay in Norfolk isn t reliable and you can t just buy a device in a shop for The Phone Co-op. The dongle from o2 is a recent Huawei USB device that just worked in debian and was fairly easy for me to get working in Ubuntu. There s space in it for a memory card, so maybe I could boot from it but that s an idea for later. The o2 deal is OK but not great, and the included wifi is nowhere near as good as it looked: when it says it includes BT Openzone that doesn t include any of the BT Openzone-H hotspots that are much more common. You re only allowed to register one device for wifi, so no using your phone, tablet and laptop at different times! I can t believe it s legal to advertise that as unlimited wifi , but o2 is still a better offer than access to BT Openzone-H hotspots at 39/month (yes, that s the price for wifi-only ). Ultimately, I think the problem is that there s a rubbish choice of mobile (wifi or 3G) internet access providers in the UK. It s a completely and utterly failed market, so you need to use Virtual Private Networks and similar tricks to protect yourself from the dysfunctional networks. My VPN meant my mobile number was safe: how about yours? As luck would have it, I had already proposed a resolution about protecting customer privacy to The Phone Co-op (affiliate link) for our AGM on Saturday 4 February (if you re a member, let me know). We were trying to find a compromise wording and I don t think this little o2 scandal has hurt my proposal at all! At least the phone co-op s mobile service is based on Orange s network, which wasn t affected. How does your network perform? There s an Internet Service Provider evilness test which might tell you.

Russell Coker: Links January 2012

Cops in Tennessee routinely steal cash from citizens [1]. They are ordered to do so and in some cases their salary is paid from the cash that they take. So they have a good reason to imagine that any large sum of money is drug money and take it. David Frum wrote an insightful article for NY Mag about the problems with the US Republican Party [2]. TreeHugger.com has an interesting article about eco-friendly features on some modern cruise ships [3]. Dan Walsh describes how to get the RSA SecureID PAM module working on a SE Linux system [4]. It s interesting that RSA was telling everyone to turn off SE Linux and shipping a program that was falsely marked as needing an executable stack and which uses netstat instead of /dev/urandom for entropy. Really the only way RSA could do worse could be to fall victim to an Advanced Persistent Attack :-# The Long Now has an interesting summary of a presentation about archive.org [5]. I never realised the range of things that archive.org stores, I will have to explore that if I find some spare time! Jonah Lehrer wrote a detailed and informative article about the way that American high school students receive head injuries playing football[6]. He suggests that it might eventually be the end of the game as we know it. Fran ois Marier wrote an informative article about optimising PNG files [7], optipng is apparently the best option at the moment but it doesn t do everything you might want. Helen Keeble wrote an interesting review of Twilight [8]. The most noteworthy thing about it IMHO is that she tries to understand teenage girls who like the books and movies. Trying to understand young people is quite rare. Jon Masters wrote a critique of the concept of citizen journalism and described how he has two subscriptions to the NYT as a way of donating to support quality journalism [9]. The only comment on his post indicates a desire for biased news (such as Fox) which shows the reason why most US media is failing at journalism. Luis von Ahn gave an interesting TED talk about crowd-sourced translation [10]. He starts by describing CAPTCHAs and the way that his company ReCAPTCHA provides the CAPTCHA service while also using people s time to digitise books. Then he describes his online translation service and language education system DuoLingo which allows people to learn a second language for free while translating text between languages [11]. One of the benefits of this is that people don t have to pay to learn a new language and thus poor people can learn other languages great for people in developing countries that want to learn first-world languages! DuoLingo is in a beta phase at the moment but they are taking some volunteers. Cory Doctorow wrote an insightful article for the Publishers Weekly titles Copyrights vs Human Rights [12] which is primarily about SOPA. Naomi Wolf wrote an insightful article for The Guardian about the Occupy movement, among other things the highest levels of the US government are using the DHS as part of the crackdown [13]. Naomi s claim is that the right-wing and government attacks on the Occupy movement are due to the fact that they want to reform the political process and prevent corruption. John Bohannon gave an interesting and entertaining TED talk about using dance as part of a presentation [14]. He gave an example of using dancerts to illustrate some concepts related to physics and then spoke about the waste of PowerPoint. Joe Sabia gave an amusing and inspiring TED talk about the technology of storytelling [15]. He gave the presentation with live actions on his iPad to match his words, a difficult task to perform successfully. Thomas Koch wrote an informative post about some of the issues related to binary distribution of software [16]. I think the problem is evenm worse than Thomas describes. Related posts:
  1. Links January 2011 Halla Tomasdottir gave an interesting TED talk about her financial...
  2. Links January 2010 Magnus Larsson gave an interesting TED talk about using bacteria...
  3. Links January 2009 Jennifer 8 Lee gave an interesting TED talk about the...

25 January 2012

Bartosz Fe&#324;ski: Sentelic touchpad

With the latest changes in driver for Sentelic touchpad I m eventually able to use two-finger scrolling, and disable touchpad while typing. Middle-button emulation and on pad click & drag doesn t work yet, though. Edge scrolling either. Anyway it starts to be really usable and there is some progress to merge this driver with mainline kernel. I believe last time I was compiling kernel was around 2.4.18 and only because at that time I was maintaining router for some network and needed some special iptables extensions. Happily it hasn t changed too much since then and I can compile 3.2.1 without problem ;)

Pietro Abate: new thinkpad x220

This summer my beloved thinkpad x301 died in a cloud of smoke. It was exactly 3 years and 20 days old while my warranty was valid only for 3 years. Now, don't tell me this is a coincidence. Anyway. After about 5 months, I finally managed to convince my employer to get me a new thinkpad, the x220. My specs includes a 128G SSD , 4G of RAM, 2.4Gz processor, camera and fingerprint reader. It's a pity that the x300 series is not in production anymore. They were light, with a solid battery and a large screen. The X1 just don't cut it. Even though it can be consider the successor of the x300, its battery life is just not enough for my needs. On the other hand, the x220 is a very nice machine : the screen is a bit smaller then the X300, but it is light, with a very powerful processor, good battery and it feels very solid. In my opinion lenovo should have packed the new hw of the x220 in the chassis of the x300, maybe with small compromise on the battery life (I got the big battery and I can squeeze almost 7 hs with a single charge) but clearly this was not a good business choice... Installing debian on this laptop is not immediate because none of the official debian installers are shipped with a recent kernel (as in 3.x series). Since with the official debian installer I cannot have neither the driver for the Ethernet card or the driver for the wirelles card, I opted to use a custom installer built by kmuto (http://kmuto.jp/debian/d-i/ ) . Using this installer the ethernet card is recognized immediately and it's easy to proceed with the installation as usual. Another option would have been to add the binary blog for the wireless chip, but apparently the deb installer supports only WEP auth, while all my access point are WPA. I didn't spend too much time on the wireless setup, so it might well be that is indeed possible to install using a WPA access point. Last time I installed a laptop, I used the automatic partition option to have lvm on top of a lucks encrypted partition, only to discover later that the default dimensions of the partitions were a bit too small for me. For example, by default the boot partition is only 256Mb. This is plenty if you want to have only one kernel image installed at each given time, but if you want more then one kernel, memtest and for example a grml rescue iso, it's easy to run out of space. So I proceed to manually partition the disc creating a boot partition of 512M, and using the rest as a luks encrypted device with lvm on top and 3 logical volumes : sys (15G), swap (4G) and home (the rest). For my daily use having 15G on my laptop for /usr, /var, etc should more the enough... Next step was to install the system. Since in recent times I got extremely pissed off with gnome 3, I've decided to dump it completely and go back to awesome. But since awesome all by itself is a bit sad, I paired it up with xfce. Everything works, except the automount, and I'm still trying to figure out how to make it work. Apparently is a consolkit problem... I'll write another post about the xfce4 + awsome setup soon... Today I've also started playing with the finger print reader. It seems working, but I haven't managed yet to use it in conjunction with pam for authentication ... more to come. And... On last closing remark : during the last 5 months I've used a dell latitude e6410 ... Gosh. I feel I'm on anther planet. The keyboard of a thinkpad give you pleasure, not pain, from 2 to 4G of RAM is a big jump and from a conventional HD to a SSD ... well... it seems I'm flyinggggg :) I've the impression my productivity just went up 50% !!! If you work with your laptop everyday get a good laptop. It is well worth the investment ...

24 January 2012

James Morrison: Appengine

I've been working with appengine for a few months now. I've managed to find out the hard way that appcfg.py rollback is useless. I've learned to create a git branch for each refactoring I start on. The git branch also includes a new app version for the branch. When push all my changes to my live site, I upload one last time to the new app. Merge my branch into the master then change the live version from the old one to the new one.

I haven't learned how this work flow translates to having multiple developers. Hopefully, it is simple enough that other people can follow.

I also use make since it's an easy way to automate tasks. I hear redo is good, but for python, I'm not really compiling anything, I'm simply writing shell scripts and make is a great shell script dispatcher.

James Morrison: Make is still my friend


The following is a makefile fragment I seem to start each of my appengine projects with.

GAEPATH = $(HOME)/bin/google_appengine
PORT=8081

PYLINTS = $(wildcard *.py */*.py */*/*.py)
PYLINTFILES = $(patsubst %.py,.%.lint,$(notdir $(PYLINTS)))
PYLINT = $(join $(dir $(PYLINTS)),$(PYLINTFILES))

PYTHONPATH=$(GAEPATH):$(GAEPATH)/lib/yaml/lib:$(GAEPATH)/lib/webob:$(GAEPATH)/lib/django_0_96:.

APP=new-app

run:
$(GAEPATH)/dev_appserver.py ./ --port=$(PORT) --datastore_path=/tmp/$(APP).dev_appserver.datastore


.%.lint: %.py
@PYTHONPATH=$(PYTHONPATH) pychecker --only --no-miximport $?
@touch $@


lint: $(PYLINT)


clean:
-rm $ PYLINT


.PHONY: run lint clean


Tim Retout: Lenovo X121e 3G with ModemManager

Recently, I tried to get 3G working on my Lenovo ThinkPad X121e - it has an Ericsson F5521gw mobile broadband card. This is supported by ModemManager, but all I got were unknown errors (276 and 272). Searching online, there were very few results (hence this short note) - just previous unrelated Linux kernel issues. I found someone with the same problem on Fedora, but no solution, so I started off by filing a bug report with Debian. Of course, then I found the Arch user who had filed the same bug on Launchpad, and had discovered that resetting the BIOS to its default settings fixes the issue. If only that page mentioned the keywords "Ericsson", or "Lenovo"... So after all that, it was just some weird BIOS issue. I hate hardware.

Sylvain Beucler: OpenGL ES 2.0 using Android NDK

Teapot on Android I got myself a second-hand Samsung Galaxy S at last, and started hacking on it! The very first thing I wanted to try was porting the OpenGL wikibook C++ samples, that we wrote with OpenGL ES 2 in mind. I started writing a minimal GLUT-compatible wrapper to run the samples as-is, using the Android NDK, and I'm making progress :) The Android NDK is getting nicer with Android 2.3, though it still feels less supported than Java apps (e.g. the resize events seem buggy and the keycodes header is incomplete...). Nonetheless, it's nice to be able to write C++ portable apps. You can see how to use the wrapper, and how it works internally, at: http://en.wikibooks.org/wiki/OpenGL_Programming/Installation/Android One of the limitations is that GLES2 is not a true subset of OpenGL 2.1, in particular: I needed to pre-process these differences away, checking on GL_ES_VERSION_2_0 in the C++ source code to define a GLES2 macro in the shaders: 
#ifdef GLES2
varying lowp vec4 f_color;
# else
varying vec4 f_color;
#endif
Is there a better way?

Michal &#268;iha&#345;: It's too early for GSoC 2012

It looks like with start of the new year, people started to ask for phpMyAdmin's projects for GSoC 2012. Given that we have no information whether there will be Google Summer of Code this year and whether we will be chosen to participate, these questions look quite premature. On the other side you can start contributing any time and if you are already known in the community, you might have better chance being accepted. So forget speaking about hypothetical GSoC projects for now and start fixing some bugs, which is something much more needed right now (given that 3.5 is in alpha state). If you are looking for more information, we have basic facts for developers on our website, there is also a wiki page mentioning some tasks for junior developers.

Filed under: English Phpmyadmin 0 comments Flattr this!

Gunnar Wolf: BugCon friends, are you trying to scare away 50%+ of the target audience?

You are scaring away much more than that. I just came across an invitation for BugCon 2012. BugCon is a Mexican conference devoted to computer security I cannot comment on its level or value because, although it's a topic that has long interested me, I must recognize each day I feel less of an expert, nowadays finding myself at the level of a "sysadmin who tries not to be too dumb for his own job security". Oh, and also because it would be completely off-topic for this post. If you look at Vendetta's (the main organizer) blog post, it will probably give you the impression that the conference is just an excuse for the afterparty: Lets go see some b00bs! Do you think your fellow female hackers will have any interest in joining a bunch of sex-starved, hormone-infested teenagers who only want to pwn a website and grab more pr0n? Do you think females will feel welcome (or even mildly safe) between you? I would not think so. And I also think you are alienating any professional who might have any interest in joining your community, be it as a member, as a mentor, or whatnot. I cannot right now do a coherent post on this topic, but I can reference you to what I have seen (and read) over the last almost 10 years, when the issue was first brought up to our attention. I am very glad to see that, at least in the Free Software area, there has been a real change of mindset. I hope you are in time to think about it and rectify. Oh, and not the description of an incident, but a very interesting and thoughtful take on this: [pdf] Interesting analysis by Hannah Wallach on the numbers and motivations of women in Free Software groups. I don't know if Hannah has published this in article form, but many interesting points can be understood by looking at the presentation. My good friend Vendetta: I don't mean this post (longer than what I originally intended) as a way to say you and the conference you are organizing for the third year (IIRC) already is unprofessional or targetted to pimply teenagers. I know the work you have put in it. I hope you see the points I'm trying to drive You are of course free to have whatever afterparty you have. But, if as the main organizer, you are giving the images of nice chicks at Hooters more weight and relevance than to the conference itself... you are doing yourself a disservice. I hope you can rectify it, and make BugCon attractive to hacker women as well.

Rapha&#235;l Hertzog: Answering questions of Debian users on various support channels

When you start your journey with Debian, you tend to have lots of questions. You ll find some answers in various documentations but there always are remaining questions. Those can be asked on various support channels: Those are the places where you can also start your journey as a Debian contributor instead of asking questions, you just have to answer questions of other users! Let me share some advice if you want to do some user support. User support is difficult It s not always an easy task. Some users are more skilled than others and there might be difficulties related to the language, English is not always the native language of a user who asks a question in English. Be respectful and courteous when you answer user questions, even if they made mistakes. You re effectively representing Debian and you should give out a good image of the project. If you don t have the patience or the time needed to do a good answer, don t reply and let someone else take care of this user. I invite you to read (and follow!) the Debian Community Guidelines. Avoid RTFM answers, instead you should show the users how they could have found (alone) the solution to their problem. We don t want to scare people away, we want to grow our community. But it s also rewarding In some cases, the problem reported by the user will be a real problem and you ll have an opportunity to file a good bug report, thus helping to improve Debian for everybody. Often, you don t even have the answer to the user s question. But you re more skilled than him/her to do researches on the web, or you know of a good documentation that might contain the relevant bits of information, in any case you re doing further research to help this user. In this process, you also grow your own skills since you re learning stuff that you didn t know yet. At least that s how I learned many things during my first year in the Debian community there s no reason why you couldn t learn lots of stuff that way, in particular if you also read the answers of other skilled people on those channels (it takes a bit of training to learn who are the skilled people though). I still believe that doing user support is one of the best ways to join the Debian community and to start contributing. It helps you to grow your skills, and to slowly progress from average user to advanced user .
If you want to start contributing to Debian, click here to subscribe to my newsletter and get future updates for new contributors. You can also follow me on Identi.ca, Google+, Twitter and Facebook.

5 comments Liked this article? Click here. My blog is Flattr-enabled.

Paul Tagliamonte: Hey look! Openstates data!

Sweet! npr s site is using some OpenStates data, the project I m currently working on at sunlight labs. If you feel like affecting change in US politics, and know Python, we could use some help (it s a F/OSS project!) over on github Keep being awesome!

23 January 2012

Neil Williams: Emdebian Grip automated dependency resolution

The script isn't fully automated yet, I'm running it manually and watching for errors, but I do now have a simple script (~100 lines of perl) which runs edos-debcheck against each of the supported Emdebian architectures for unstable-grip and picks out those packages which are missing from the subset of packages which Emdebian monitors for Grip.

I was hoping to make these scripts into a normal Debian package but there are some limitations in that the scripts need to assume various pieces of Debian infrastructure. e.g. I started off using rsync to pull in the Packages files (along with Release and Sources) because apt has annoying behaviours with multiple architectures. (Emdebian Grip processes 7 architectures simultaneously on blavet.debian.org). Peter Palfrader kindly arranged for a local mirror to be available and now the entire Packages processing can be done using symlinks. Much, much better.

Actual package movement data comes directly from dak via projectb - something else which makes packaging these scripts for use on non debian.org boxes a bit hard.

Once again, I am indebted to the EDOS team (please, please keep working on edos-debcheck - it hasn't had uploads recently) because I tried to get this working with germinate but failed. (Colin - I'll be looking to borrow some of your time to work out what was going wrong.)

The dependency resolution script now means that I can meet release team requirements that when foo is updated in sid to depend on libbar2 but Emdebian Grip only has libbar1, the scripts will automatically pick up libbar2 and add it to Emdebian Grip. The current sid version gets pulled in and (the theory goes) will migrate into testing-grip as an almost automatically valid candidate. Processing of the dependency can happen within hours of the updated version of foo arriving in Emdebian Grip but as long as it happens within a few days I think everyone will be fine with it.

I've got a sync script too which can periodically run across the entire suite and check for packages which have slipped the net. I'll have to see how often that needs to run but once a week doesn't sound too painful.

Processing for Emdebian Grip is very fast. Most of the time is taken uploading: 


2012-01-23 22:24:42 add sid-grip deb main armhf libfltk-images1.3 1.3.0-5em1

2012-01-23 22:24:52 add sid-grip deb main i386 libfltk-images1.3 1.3.0-5em1

2012-01-23 22:25:07 add sid-grip deb main mips libfltk-images1.3 1.3.0-5em1

2012-01-23 22:25:25 add sid-grip deb main powerpc libfltk-images1.3 1.3.0-5em1

2012-01-23 22:26:00 add sid-grip deb main amd64 libstdc++6-4.5-dev 4.5.3-12em1

2012-01-23 22:26:34 add sid-grip deb main armel libstdc++6-4.5-dev 4.5.3-12em1


(It was a lot longer, comparatively, when I was having to rsync and then dget instead of just read from the local filesystem.)

I've also been working on an init script which will gradually work through the subset of packages by order of Priority - approximately what a new architecture (like armhf) would do. Note that Emdebian Grip supports armhf already. The only slight concern is whether the init script needs to be throttled back to not flood the queues with hundreds of uploads an hour (which it could end up doing, at least for the first 24 hours).

Logs of package movements are available: http://www.emdebian.org/grip/logs.php

Packages can be searched too: http://www.emdebian.org/grip/search.php

More on Emdebian Integration on the Debian wiki: http://wiki.debian.org/EmdebianIntegration

Now all I need is a fix for #655919 :-) FTP team?

Next.

Previous.