Generating missing tangogps tiles TangoGPS is nice, but it wants to download tiles. However, I already have a working mapnik setup, so why bother the OpenStreetMap servers with tile requests?

1. Set up a mapnik environment like I explained with gpsdrive, but use the -m switch to osb2pgsql.
2. svn co http://svn.openstreetmap.org/applications/rendering/mapnik/
3. Edit set-mapnik-env to configure it. Make sure that MAPNIK_TILE_DIR points to Maps/OSM as used by TangoGPS.
4. ./set-mapnik-env ./customize-mapnik-map > osm.xml
5. Edit generate_tiles.py to customise the area that you want to generate. Make sure that when setting bbox the first latitude is smaller than the second latitude, and the same for longitude.
6. Run ./set-mapnik-env ./generate_tiles.py and watch it paint your tiles. Note that if a tile has already been downloaded, it will not download it again.

Upstream just announced the release of Xfce 4.6 Alpha (codenamed “Pinkie”). I've already prepared some packages, which I won't upload to experimental yet, because the packaging is not yet ready for upload (mainly copyright stuff) and because it's alpha quality, and as we are in testing freeze period, and about (:) to release Lenny, I don't want to mess with that. So, in case you'd like to test them, they are available from my personal repository. As usual, be advised there won't be any official support for those packages. Don't report bugs on Debian BTS, and report software bugs on Xfce bugzilla. Feel free to pass on #debian-xfce on freenode if you need some help, but be prepared to front problems :) Basically there are some new packages:

• xfconf (configuration framework)
• xfce4-settings (xsettings and internal settings daemon)
• libxfce4menu (menu library)

Use apt-get dist-upgrade after updating your apt sources, It'll remove part of Xfce 4.4.2 (and especially xfce-mcs-manager, replaced by xfconf/xfce4-settings) and upgrade another part. Some packages may stay, like libxfce4mcs for example, which is still needed if you use notification-daemon-xfce. This one will be replaced by xfnotifyd at some point in the future (maybe for beta 1). It's advised to do the upgrade from outside of Xfce 4.4.2, just in case. Most settings will be migrated at first run. Look at the new announce for links to know issues, bug reports etc. Happy testing, and remember: don't do that on production boxes.

So, does anybody know of a command-line RSS reader? I want something that will save state and output recent entries in a nicely parsable manner. Maybe URL\tTitle\tDecscription\n or somesuch.

So here's why I'm asking.

I got to thinking that it might be nice to automatically post to Twitter when I've got a new blog post up, rather than manually have to say "just wrote a blog post."

Then I also got to thinking that when I see an interesting URL that I'm going to Twitter about, I'm also almost always adding it as a bookmark to Delicious. Why not make a fortwitter tag on Delicious, and automatically post my comments about them to Twitter, saving me having to do it twice?

So I've got Twidge that can be nicely used in a shell script to do this stuff. I'm hoping to avoid having to write a shell script-friendly RSS aggregator. But I'm just prone to do it if nobody else has already, though I'd really like to avoid reinventing the wheel.

After reading on Jimmy Schementi's weblog that IronPython, the .NET implementation of Python, is just an apt-get install ironpython away, I thought I'd give it a whirl. Here's what I got. Huh? Maybe Microsoft took that "significant whitespace" thing a little too literally... It turns out that IronPython really wants you to use a dark background (bug report). Ah, so that's why the background of Jimmy's blog is black! As you can see from the screenshot, it's also a bit difficult to quit from the Ubuntu version of IronPython. That weird symbol is a result of pressing Ctrl+D. Even Ctrl+\, which usually helps in such cases, only produces a nasty .NET CLR traceback with no ill effects to the interpreter. On the bright side, this is a good start. IronPython seems to be more or less functional, with speed comparable to CPython, even though the example code included in Debian looks a little "heavy" (see /usr/share/doc/ironpython/Tutorial).

I saw the interview on ABC last night and tonight. It surprised me that she quite clearly didn't understand what the Bush Doctrine is (Charlie Gibson had to explain it to her). She dodged and evaded too many questions to count. Every foreign policy question she turned into an oil question, citing Alaska, as if somehow Alaska has played a key part in international conflict in the last decade.

Charlie asked her about the budget deficit, the economy. He got her implied assent that Bush hadn't done well, and asked her to name three concrete ways she'd change. She dodged for a minute. He tried again. She cited lower taxes, better oversight, and I forget the third. Anyhow, it didn't sound very different to me -- and not very specific either. It's so general that everybody from Ron Paul to the green party can agree to it.

He asked her about the deficit, and what she and McCain would do to fix it. She stumbled for a minute, then said "I certainly wouldn't cut veterans benefits" and spent the next minute talking about how important veterans are. Which is a whole other topic. She never did say how they'd cut the deficit, just that in some magical way, they'd find inefficiencies. McCain's had over a year to name them, and I haven't seen the specifics yet.

I came away feeling more concerned about her than I expected. She reminds me of Bush in 2000. Cocky, self-confident, a shallow thinker on every topic, and utterly unprepared.

This process of getting to know McCain's unknown pick is not going so well, I think.

Sixty-six years ago was a dark day for the human age: thousands of innocent died when the RMS Laconia (1921) was (allegedly erroneously) torpedoed and the desperate rescue attempts by the offenders were (allegedly erroneously) foiled by a bomber plane. NP: Gazpacho: Night

Logging on the Freerunner By default, the FreeRunner comes without a system log daemon, and rightfully so, because you don't want a daemon filling up /var, and a nightly cron job to rotate logs, on a mobile phone. However, I do not want to give up logging. If there are bugs I want to investigate, I like to be able to look at the logs. The solution: remote logging. Configure the phone to send all log info via UDP to my laptop, and configure my laptop to listen for UDP syslog messages from the phone only. How to do it:

1. apt-get install rsyslog (see below how other logging daemons fail)
2. Add a /etc/hosts entry for the laptop on the phone: 192.168.0.200 base
3. Add a /etc/hosts entry for the phone on the laptop: 192.168.0.202 openmoko
4. Replace the phone's rsyslog rules to send everything to the laptop:

   ################
   ##### RULES ####
   ################
   # Everything goes to the main computer, via UDP, if available
   *.*     @base
   #
   # Emergencies are sent to everybody logged in.
   #
   *.emerg                         *
   
   

5. Tell the laptop's rsyslog to accept UDP messages from the phone only:

   # provides UDP syslog reception
   $ModLoad imudp
   $UDPServerRun 514
   $UDPServerAddress 192.168.0.200
   
   

That is all. When the phone is not connected, the UDP packets from the logger will go nowhere. When it gets connected to the laptop, a script is triggered that creates the 192.168.0.200 interface, rsyslogd will listen on that interface and the UDP packets will be logged. This has the extra potential to be able to get error messages in case of bugs in the SD card driver, which I seem to hit from time to time. Why rsyslog sysklogd could receive the messages from the phone, but can only listen on all interfaces, and therefore requires me to set up firewall on my laptop in order to get packets from the phone only. syslog-ng can and can be told to listen on a given interface, but it will refuse to start if that interface isn't available. Since the phone is on an hotplugged interface that comes and goes, this is totally unacceptable. And finally, rsyslog is going to replace sysklogd both in Debian and in Fedora, so it's just as well a good excuse to switch.

Following with the meme on Planet Ubuntu and started somehow in Planet Debian here it comes my machine names:
Current ones:
Laptop: Buster
Netbook: GogoDodo
Old Machines
Old Laptop: Marvin
Desktop: LePew
Work: LaFume
Palm: Tweety Did you already guessed what’s the patron? If not, i always take those names from here. Thank you Wikipedia for having the complete list of the Looney Tunes Characters.

Sometimes you're just flat out wrong. While I can understand your position of 'all fear-mongerers and religious fanatics should just commit suicide', I do not agree with it. However, this time, the girl you refer to didn't actually commit suicide because she fell in any of those categories. Had you actually read that BBC story you link to in some detail, you'd have found that:

• The girl was sixteen years old. While old enough to understand danger, it usually isn't old enough to understand the intricacies of science.
• She took her own life after watching a sensationalist TV channel that was spreading the lie that the LHC would cause the earth to crack up

Now I agree that ignorance to science is something that should be advocated against; but if the facts of science are misrepresented through a TV channel that is only interested in its own profits, are those who do believe their only source of information then to be blamed? If the only data you get are outright lies, is the world then indeed a better place because it got rid of one "mis"believer? I think not.

I've long had the sneaking suspicion that, from the "free software" point of view, the most "threatening" proprietary software systems were not the most tightly locked down ones, where it's difficult to do anything without paying a fortune and control is absolute, but rather those that coopt as much as they can from the open source world. You get source code, you get an open and hackable system, you get to talk with the people who wrote the code, who will tell you all about it if you want to know. You can recompile it for different platforms, or tweak it how you want. You get to talk with other users of it, and maybe even share hacks and additions you've created. Just that you still may have to pay for it, and you don't get the rights to redistribute as you see fit. Gianugo Rabellino, CEO of SourceSense, speaks very well of Atlassian and what they're doing with systems like JIRA, which is a very open commercial offering: http://boldlyopen.com/2008/09/11/sustainable-software-look-down-under/ With the challenge "Can your Open Source vendor do this?". I don't think he's far off the mark; the fundamental problem with open source businesses is finding a way to introduce scarcity, as I've talked about before: http://journal.dedasys.com/articles/2007/02/03/in-thrall-to-scarcity That's not to say it's not possible (it is, obviously), or that open source doesn't work (it has, beyond my wildest dreams), just that we still haven't figured out the part that connects developers with money. One of the most successful (in terms of making Linux user friendly) companies to date is basically running on the "find a guy who already made a bundle elsewhere and is a good patron" model.

People frequently ask me what I am doing typing on my Palm right before logging in one of my remote systems. The answer is quite simple: generating my next password . People always seem puzzled by that answer Maybe I am just too old to have had only telnet sessions available to remote connections (that was the time before SSH took over)... or maybe I am just too paranoid regarding the access to my systems Anyway, I like One Time Passwords, and here is an article I can refer to when I get asked again ;-) One Time Passwords are just that: passwords that are good for one time use. They never repeat and once used you can throw it away securely. They were quite common when the authentication was done in clear text (so that any man-in-the-middle could steal your passwords), back in the r-tools age (rcp, rsh, rlogin, rexec, etc). After the SSH-related tools took over, providing easy tunneling and remote access, MITM attacks were of much concern, so OTPs became less relevant. What a shame, for they even have a couple of standards for those! But there s still room for OTPs Question: Is it easier to deploy a MITM attack or a keylogger? That s right We are always connecting to our remote systems in public terminals (well at least I am right now typing from the hospital computer), and a keylogger is so easily installed in one of those terminals, even remotely, that no one would ever get close to deploy a refined MITM attack just to steal someone s password. One would just install a keylogger! All the security SSH provides would just be gone by then. That s why I use SSH to connect to my remote machines, but use OTPs to authenticate myself. It s so easy to deploy it. In Debian you ll find packages opie-server and libpam-opie and those are the only things you ll need on the server side (besides SSH, obviously). OPIE means One-time Passwords In Everything , and combined with PAM, one can really use it everywhere. After installing it, you ll have to generate the password file for your account:

spectra@home:~$ opiepasswd -c
Adding spectra:
Only use this method from the console; NEVER from remote. If you are using
telnet, xterm, or a dial-in, type ^C now or exit with no password.
Then run opiepasswd without the -c parameter.
Using MD5 to compute responses.
Enter new secret pass phrase:
Again new secret pass phrase:
ID spectra OTP key is 499 ho6484
HAVE COOK LOLA AIRY NEIL ROAM

The pass phrase will be used to generate the passwords in a step before your login. Please, try not to forget it (specially if you re following this article and playing with some remote system at the same time). Now you can edit /etc/pam.d/ssh file (or its equivalent in non-Debian systems) to require that kind of authentication. Mine just looks like this:

# /etc/pam.d/ssh
auth       required     pam_env.so
auth       required     pam_env.so envfile=/etc/default/locale
auth       required     pam_opie.so

First two lines are unrelated and just load the environment variables. Last line is where the fun is. Please, note two things: (1) I removed references to pam_unix.so, which is what would ask for my real password, that I want to disable (no login is allowed with that password). And (2), I declared it as required, meaning that failing it will keep one out of the system. We are not ready yet! SSH will work by now, but will not present you the OTP challenge. Probably you could still login, but you d have to remember which is the current password (Trust me, you would not!). To get the challenge you ll need to enable it in /etc/ssh/sshd_config change the following line:

ChallengeResponseAuthentication yes

That s it. Now to login to your remote machine, that s what will usually happen:

spectra@hospital:~$ ssh home
otp-md5 498 ho6484 ext, Response:
spectra@home:~$

Voil ! It asks for password #498. By default, it starts with 500 passwords and goes down from that. Password #498 were asked, so the next will be #497. After that, #498 is not useable anymore, and #496 is not useable yet. You can generate a list of those passwords (let s say 10), print it and keep it in your pocket. This is the command you d use for that:

spectra@home:~$ opiekey -n 10 498 ho6484
Using the MD5 algorithm to compute response.
Reminder: Don't use opiekey from telnet or dial-in sessions.
Sorry, but you don't seem to be on the console or a secure terminal.
Warning: Continuing could disclose your secret pass phrase to an attacker!
Enter secret pass phrase:
489: CALM INTO WEEK APS LOON VIE
490: HASH GYM RAID GOSH HOYT DUAL
491: BELL GIN RIFT HELM GUY BUNK
492: HEBE OBOE SUP LEG LULU LANG
493: HOYT JOT ASK JOG GIBE BETH
494: NASH MOOT HIND YEAH  YAP CARL
495: MATE OF BARD LAVA LEAK AHOY
496: TAB BAG KEY GILT AVID VEAL
497: MOLE FORM NIB LEER ROSS HAVE
498: SING WERE OVEN SOD VEIN NIBS

That is not so secure, since you can loose the paper and be doomed Luckily there are lots of small softwares that does this generation for you. Some you can use from your Palm or from some J2ME-enabled phone (such as N95). Some your can use from another (trusted) computer. Some are even online, written in javascript! There are at least one other side-benefit of using OPIE as above: You can give away your user password (even root password OK, probably not a Good Thing^TM), that the system would still be secure, since it only allows SSH authentications via OPIE! If the session is started with a username whose opiepasswd was not activated (first step scroll back to the beginning of the article), SSH will greet you with a bogus challenge only opie-activated users will be allowed to login with the above configuration. Easy enough, isn t it? Now, next time you see me typing on my Palm before opening an SSH connection you ll know what I am doing ;-)

Some people think that you can recognise a good restaurant by the presence of obscure dishes on the menu or having high prices. The reality is that there are two ways of quickly identifying a good restaurant, one is the Michelin Guide [1] (or a comparable guide - if such a thing exists), the other is how quiet the restaurant is. By a quiet restaurant I certainly don’t mean a restaurant with no customers (which may become very noisy once customers arrive). I mean a restaurant which when full will still be reasonably quiet. Making a restaurant quiet is not in itself a sufficient criteria to be a good restaurant - but it’s something that is usually done after the other criteria (such as hiring good staff and preparing a good menu) are met. The first thing to do to make a room quiet is to have good carpet. Floor boards are easy to clean and the ratio of investment to lifetime is very good (particularly for hard wood), but they reflect sound and the movement of chairs and feet makes noise. A thick carpet with a good underlay is necessary to absorb sound. Booths are also good for containing sound if the walls extend above head height. Decorations on the walls such as curtains and thick wallpaper also absorb sound. A quiet environment allows people to talk at a normal volume which improves the dining experience. It seems to me that the same benefits apply to server rooms and offices, with the benefit being more efficient work. I found it exciting when I first had my desk in a server room (surrounded by tens of millions of pounds worth of computer gear). But as I got older I found it less interesting to work in that type of environment just as I found it less interesting to have dinner in a noisy bar - and for the same reasons. For a server room there is no escaping the fact that it will be noisy. But if the noise can be minimised then it will allow better communication between the people who are there and less distraction which should result in higher quality of work - which matters if you want good uptime! One thing I have observed is that physically larger servers tend to make less noise per volume and per compute power. For example a 2RU server with four CPUs seems to always make less noise than two 1RU servers that each have two CPUs. I believe that this is because a fan with a larger diameter can operate at a lower rotational speed which results in less bearing noise and the larger fans also give less turbulence. While it’s obvious that using fewer servers via virtualisation has the potential to avoid noise (both directly through fans and disks and indirectly through the cooling system for the server room [2]). A less obvious way of reducing noise is to swap two 1RU servers for one 2RU server - although my experience is that for machines in a similar price band, a 2RU server often has comparable compute power (in terms of RAM and disk capacity) to three or four 1RU servers. To reduce noise both directly and indirectly it is a requirement to increase disk IO capacity (in terms of the number of random IOs per second) without increasing the number of spindles (disks). I just read an interesting Sun blog covering some concepts related to using Solid State Disks (SSDs) on ZFS for best performance [3]. It seems that using such techniques is one way of significantly increasing the IO capacity per server (and thus allowing more virtual servers on one physical machine) - it’s a pity that we currently don’t have access to ZFS or a similar filesystem for Linux servers (ZFS has license issues and the GPL alternatives are all in a beta state AFAIK). Another possibility that seems to have some potential is the use of NetApp Filers [4] for the main storage of virtual machines. A NetApp Filer gives a better ratio of IO requests per second to the number of spindles used than most storage array products due to the way they use NVRAM caching and their advanced filesystem features (which also incidentally gives some good options for backups and for detecting and correcting errors). So a set of 2RU servers that have the maximum amount of RAM installed and which use a NetApp Filer (or two if you want redundancy) for the storage with the greatest performance requirements should give the greatest density of virtual machines. Blade servers also have potential to reduce noise in the server room. The most significant way that they do this is by reducing the number of power supplies, instead of having one PSU per server (or two if you want redundancy) you might have three or five PSUs for a blade enclosure that has 8 or more blades. HP blade enclosures support shutting down some PSUs when the blades are idling and don’t need much power (I don’t know whether blade enclosures from other vendors do this - I expect that some do). A bigger problem however is the noise in offices where people work. It seems that the major responsible for this is the cheap cubicles that are used in most offices (and almost all computer companies). More expensive cubicles that are at almost head-height (for someone who is standing) and which have a cloth surface absorb sound better significantly improve the office environment, and separate offices are better still. One thing I would like to see is more use of shared desktop computers, it’s not difficult to set up a desktop machine with multiple video cards, so with appropriate software support (which is really difficult) you could have one desktop machine for two, or even four users which would save electricity and reduce noise. Better quality carpet on the floors would also be a good thing. While office carpet wears out fast adding some underlay would not increase the long-term cost (it can remain as the top layer gets replaced). Better windows in offices are necessary to provide a quiet working environment. The use of double-glazed windows with reflective plastic film significantly decreases the amount of heating and cooling that is required in the office. This would permit a lower speed of air flow for heating and cooling which means less noise. Also an office in a central city area will have a noise problem outside the building, again double (or even triple) glazed windows help a lot. Some people seem to believe that an operations room should have no obstacles (one ops room where I once worked had all desks facing a set of large screens that displayed network statistics and the desks were like school desks with no dividers), I think that even for an ops room there should be some effort made to reduce the ambient noise. If the room is generally reasonably quiet then it should be easy to shout the news of an outage so that everyone can hear it. Let’s assume for the sake of discussion that a quieter working environment can increase productivity by 5% (I think this is a conservative assumption). For an office full of skilled people who are doing computer work the average salary may be about $70,000, and it’s widely regarded that to factor in the management costs etc you should double the salary - so the average cost of an employee would be about $140,000. If there are 50 people in the office then the work of those employees has a cost of $7,000,000 per annum. A 5% increase in that would be worth $350,000 per annum - you could buy a lot of windows for that!

• [1] http://www.michelinguide.com/


• [2] http://etbe.coker.com.au/2008/09/10/efficiency-of-cooling-servers/


• [3] http://blogs.sun.com/studler/entry/why_you_should_avoid_placing


• [4] http://en.wikipedia.org/wiki/Netapp

Share This

I recently wasted a bit of time reading some right-wing blogs. One thing I noted was the repeated references to news reports about young women from an Islamic background being beaten (and in some cases killed) by their fathers (and other male relatives) for not conforming to some weird cultural ideas that some people associate with Islam. These are spun as examples of Islam being bad and therefore opposing immigration policies that allow Muslims into countries identified as “Christendom” or “The West” (never mind the fact that the vast majority of the population in “Christendom” don’t even attend church twice a year and the fact that Australia is directly south of China, Russia, and North Korea). It seems to me that when young people follow the cultural standards of the country where they live rather than the standards of the country that their parents came from then it’s evidence of “multiculturalism” working. When young Muslim women are beaten by their fathers whether it’s considered an example of Muslims being bad (and who therefore should be excluded) or an example of Muslims as victims who should be protected is a matter of interpretation. It’s not as if there is any shortage of domestic violence cases from any religious or cultural group. It’s often claimed that fundamentalist Muslims hate our culture, strangely the same people seem to claim that our culture will be destroyed by radical Islam. These two ideas seem to conflict, if our culture (the pro-science, free-speech, few inhibitions on clothing standards, do what you want but don’t hurt others culture that most readers of my blog enjoy) can be destroyed by radical Islam then they wouldn’t hate it. I think that the reason why fundamentalist religious people (Christians and Muslims) dislike our culture is because it is so strong. Our culture offers a way of life that is simply better than that which fundamentalist religious groups offer. Any religious person can choose to take a liberal approach to their religion (emphasising the positive aspects of giving to charity, being nice to others, etc) and enjoy our culture. Our culture is based around wide-spread communication, mass media, mobile phones, the Internet, custom clothing design, etc. It can do to religions what the sea does to rocks. It seems that the strongest efforts at attacking our culture come from Christian groups. For example the Exclusive Bretheren [1] runs a high school in my area, according to a local paper it distinguishes itself by having no students enter a university course! The Exclusive Bretheren (and some other radical Christian groups) have a deliberate policy of keeping children stupid with the idea that people who think may decide to change their religion. Some time ago I had a taxi driver start an unsolicited discussion of religion by telling me how much he hated Muslims. I pointed out the fact that there are Muslims of all races and asked why he thought that I was not a Muslim. After that the rest of the journey was very quiet. The mainstream media would have us believe that Muslims have some sort of monopoly on terrorism. Noam Chomsky’s paper “Terror and Just Response” [2] is one of many that he has written on this issue. I realise that many people don’t want to acknowledge the involvement of the US government (and it’s allies such as Australia) in international terrorism. But please read Noam’s position (which is compelling) or read his wikipedia page which lists his extensive accomplishments [3] (if it’s the background of an author that impresses you).

• [1] http://en.wikipedia.org/wiki/Exclusive_Bretheren


• [2] http://www.chomsky.info/articles/20020702.htm


• [3] http://en.wikipedia.org/wiki/Noam_chomsky

Share This

I have previously written about the execmod permission check in SE Linux [1] and in a post about SE Linux on the desktop I linked to some bug reports about it [2] (which probably won’t be fixed in Debian). One thing I didn’t mention is the proof of the implication of this. When running a program in the unconfined_t domain on a SE Linux system (the domain for login sessions on a default configuration), if you set the boolean allow_execmod then the following four tests from paxtest will be listed as vulnerable: Executable bss (mprotect)
Executable data (mprotect)
Executable shared library bss (mprotect)
Executable shared library data (mprotect) This means that if you have a single shared object which uses text relocations and therefore needs the execmod permission then the range of possible vectors for attack against bugs in the application has just increased by four. This doesn’t necessarily require that the library in question is actually being used either! If a program is linked against many shared objects that it might use, then even if it is not going to ever use the library in question it will still need execmod access to start and thus give extra possibilities to the attacker. For reference when comparing a Debian system that doesn’t run SE Linux (or has SE Linux in permissive mode) to a SE Linux system with execmod enabled the following tests fail (are reported as vulnerable): Executable anonymous mapping (mprotect)
Executable heap (mprotect)
Executable stack (mprotect)
Writable text segments If you set the booleans allow_execstack and allow_execheap then you lose those protections. But if you use the default settings of all three booleans then a program running in the unconfined_t domain will be protected against 8 different memory based attacks. Based on discussions with other programmers I get the impression that fixing all the execmod issues on i386 is not going to be possible. The desire for a 15% performance boost (the expected result of using an extra register) is greater than the desire for secure systems among the people who matter most (the developers). Of course we could solve some of these issues by using statically linked programs and have statically linked versions of the libraries in question which can use the extra register without any issues. This does of course mean that updates to the libraries (including security updates) will require rebuilding the statically linked applications in question - if a rebuild was missed then this could be reduce the security of the system. To totally resolve that issue we need to have i386 machines (the cause of the problem due to their lack of registers) go away. Fortunately in the mainstream server, desktop, and laptop markets that is already pretty much done. I’m still running a bunch of P3 servers (and I know many other people who have similar servers), but they are not used for tasks that involve running programs that are partially written in assembly code (mplayer etc). One problem is that there are still new machines being released with the i386 ISA as the only instruction set. For example the AMD Geode CPU [2] is used by the One Laptop Per Child (OLPC) project [3] and the new Intel Atom line of CPUs [4] apparently only supports the AMD64 ISA on the “desktop” models and the versions used in ultra-mobile PCs are i386 only. I think that these issues are particularly difficult in regard to the OLPC. It’s usually not difficult to run “yum upgrade” or “apt-get dist-upgrade” on an EeePC or similar ultra-mobile PC. But getting an OLPC machine upgraded in some of the remote places where they may be deployed might be more difficult. Past experience has shown that viruses and trojans can get to machines that are supposed to be on isolated networks, so it seems that malware can get access to machines that can not communicate with servers that contain security patches… One mitigating factor however is that the OLPC OS is based on Fedora, and Fedora seems to be taking the strongest efforts to improve security of any mainstream distribution, a choice between 15% performance and security seems to be a no-brainer for the Fedora developers.

• [1] http://etbe.coker.com.au/2007/02/10/execmod/


• [2] http://en.wikipedia.org/wiki/AMD_Geode


• [3] http://en.wikipedia.org/wiki/One_Laptop_per_Child


• [4] http://en.wikipedia.org/wiki/Intel_Atom

Share This

My primary e-mail domain deuxchevaux.org was offline for one and a half week due to my (former) domain provider Korypet went bankrupt and probably hadn’t paid the registrar’s invoice for deuxchevaux.org although I had paid Korypet’s invoice. (The domain wasn’t expired. Its expiration date was somewhen in 2009.) Korypet itself just told its customers (and told it only on request) that they a) will shut down their business because it doesn’t pay off and that b) their service won’t be as good as usual since their head is currently in hospital. I should have noticed that there is something fishy and some details were missing at lastest when they told customers (also only on request) that they have to shut down some services earlier than announced because one of their providers has terminated their agreement with Korypet at short notice. I also should have expected that they couldn’t keep their promise to continue domains and DNS until May 2009 as they couldn’t keep other promised grace periods. I’m quite sad about how Korypet went down and how bad blood they caused — not only for me — since they offered not only good services for money but also had really good (and personal) support. But I guess that this quality at very low prices was also one of the reasons why they couldn’t keep up their business for longer. I had one of their UML based, low-end virtual “VD” servers for about six years, and used it as secondary DNS server and IRC client host. I also often thought about getting a second one at some other geographical location (they offered virtual servers in three German cities). That was the reason why I started to move my domains to them a while ago. They even could fully answer me domain registration questions for which the eDNS and the Hetzner staff only had partial and therefore confusing answers. Since it was the easiest way, I tried to transfer the domains I had registered with Korypet to the B2C division of their registrar Key Systems, to DomainDiscount24. The web interface isn’t as bad as the name “DomainDiscount24” suggests, but they seem to have communication problems if – as in this case – more than one of their business divisions are involved. It took at least two phone calls until they did the all the necessary things to get the domains transferred from Korypet’s business customer account to my newly created end customer account although they have a special form for former Korypet customers. Domains I registered after Korypet stopped accepting new domains (well, they just didn’t answer on my domain registration requests anymore) I have registered via eDNS which was a recommendation form someone on the DaLUG mailing list. My conclusion after these hassles: No more domain registration resellers, only directly interacting with registrars. Never register all domains at the same company. Have more than two DNS servers at different hosters. Don’t have domain registrations and DNS servers at the same company. So I now register my domains either at DomainDiscount24 or at eDNS. And .ch domains of course directly at SWITCH. (If only all domain registrations would be so simple and uncomplicated as with SWITCH!) And my DNS servers are currently hosted at x encon in Hannover (Yes, it’s a Xen DomU :-) and Hetzner in Erlangen. And a third one in Switzerland is already planned.

I wonder what would have happened if Obama had put lipstick on a pitbull would there be any less of this circus put up by the Republican monkeys? Are we back in Kindergarten? Mom! Mom! He hit me! . Is the next thing we ll see tears on stage? Or some sort of fake emotional outbreak? Anything goes in America, I say Both, Obama and McCain have used the lipstick analogy in the past (see previously linked article, and this AP writeup), so why are the Republican monkeys trying to nail him on sexism? They are (trying to) play the gender card (thanks to Erinn Clark for the link). Sexism surely is a word to grab attention, especially in the Excited States of America. By shifting attention to sexism, the Republican monkeys are not only stealing Obama s show and dragging the short-attention-span media (and populace) away from any Palin-related scandals, they are also covering up that they don t have anything else to say. Finally, sexism is an emotional topic, unlike the other political and policy crap the entertainment-hungry television crowd has to put up with, so hooray for excitement! I am disgusted by this American election circus. And I wish we d get about as much coverage of American news in these times as international news gets airtime on American TV. Even though I hope Obama wins for no other reason than that he s not in the same political camp as George W. International Terrorist and War Criminal Bush, I couldn t really care less and don t have any reason to believe that things will improve when the Democrats move back into the White House. And neither do lobbyists care who s sitting at the top. Idiots exist on every level and all over the globe. The rich will still pull the strings. The capitalist avalanche (euphemistically called the strive for democracy ) doesn t slow down. Other countries political monkeys have tasted totalitarianism and lost their senses, and no US government will get them back on track. And the media, who controls it all anyway, is just cashing in on the whole spectacle, which is why I have to continue to be subjected to it. Which brings us back to the rich I wouldn t be surprised to find the likes of Haliburton in the financial support list of the Republican monkeys. PS: I know and respect many American citizens, and I know most of them think like me. Nevertheless, I feel it necessary to point out that none of the above is an attack on those of you with a clue. I feel sympathy at the same time as I feel the rage expressed in the above, but this rage is solely with the political monkeys, the media, and merciless capitalists. None of those are US-specific, it just happens that you seem to have the most pronounced combinations. NP: Mogwai: Come On Die Young

To solve performance problems I've now started to switch my SMTP servers from using the "forkserver" version of qpsmtpd to using the "prefork" version. Under testing qpsmtpd-prefork performed significantly better than the qpsmtpd-forkserver for handling incoming SMTP connections. The loadavg of one machine has dropped from a constant 2.xx to 0.4x! I'd love to see what the asynchronous server would behave like, but that would require re-writing all my plugins to work in an asynchronous manner which would be a significant undertaking. (It would be nice if the qpsmtpd package available to Debian would allow you to choose between the two version of the server - I will file a wishlist bug.) ObQuote: Dune

Ultimate Debian Database (UDD) is a GSoC project (now finished) which aimed at importing all different data sources that we have in Debian in a single SQL database, to make it easy to combine that data. Currently, we import information about source and binary packages, all bugs (both archived and unarchived), lintian, carnivore, popcon, history of uploads, history of migrations to testing, and orphaned packages. The goal is really to have that data, without really thinking of a specific use cases: there will be lots of use cases. Buildstat is a project by Gon ri Le Bouder, that provides a framework for running QA tests (rebuilds and lintian currently, but buildstat is built in a very extensible way) on packages, using both packages in the archive, and packages in the VCS repositories of teams. This is pretty cool: it allows teams to get an overview of the status of their packages, not using the archive as reference, but using their VCS. Buildstat schedules and runs the tests, store the data in an SQL database, and allows to browse the data using a web interface. Buildstat also import some data from other sources (only the BTS currently, using the LDAP dump) to display it on the web interface. Since both projects are using an SQL DB, people have been asking why we don’t simply merge them. The big advantage would be that the data is synchronized: buildstat would display more up-to-date info about the data sources it doesn’t generate locally (like bugs), and UDD would get fresh buildstat data. We have been talking a lot with Gon ri, considering the different possibilities. But I don’t think it’s a good idea. I think that both projects should try to do one thing, but do it very well, instead of trying to fix the world. UDD focuses on importing data that exists elsewhere. Sometimes it means doing some complex processing. But data should be be generated by UDD. Merging the projects would mean having a very big piece of software that does everything (or tries to do everything). Both databases were designed differently, with different goals. UDD tries to stay close to the data it imports. There might be some incoherences in the data sources, but that’s fine: one of the goal of UDD is to make it easy to find them (and fix them), so we need them in the DB. In buildstat, since the goal of importing data is to display it on the web interface, with a strict use case, you can freely “simplify” data if it helps. Another big difference is that UDD is designed to be easy to use (ie write and run queries) by a human user: UDD uses multi-column primary keys, while buildstat uses surrogate keys (integer “id” keys), that ORM tools usually require. There are also more technical concerns: currently UDD makes a compromise, for each data source, on what it imports: it tries to import the data that is useful, not all the data available. Merging buildstat and UDD would mean increasing the DB size significantly, by adding all the “private” data that buildstat needs. Another problem is the stable API problem: if buildstat and UDD are merged, it means that buildstat cannot change its DB schema without making sure that it wouldn’t break what UDD users are doing. So, what should we do, from my POV, instead of merging? - Continue to talk, and get Gon ri into the UDD “team”. He gathered a lot of experience working on buildstat, and he probably would be able to help a lot. - Data that is not generated by buildstat (bugs data) should be imported from UDD. Doing SQL->SQL will probably make things easier there. - A summary of buildstat’s infos should be imported into UDD. There’s also the issue of providing the data through a web interface, to the DDs, which buildstat tries to address partially. The Debian Developer Packages Overview (DDPO)’s main limitations are: - lack of knowledge about VCS (what buildstat solves) - lack of knowledge about complex organizations (you can’t get any list of packages, or list of packages maintained by teams not using a consistant Maintainer/Uploaders scheme, or list of packages from tasks, etc) - poor handling of large amount of packages. In teams with lots of packages, it’s useful to have restricted views, such as “packages outdated compared to upstream”, “packages which have bugs/RC bugs”, “packages which are newer in the VCS than in the archive”. The perl team’s work on PET clearly shows the kind of things that are needed. At this point, I think that DDPO would benefit from a full rewrite (using the existing code as a source of inspiration, and making sure that there are no regressions, of course). Using UDD as the data source, it should be easy to get something done (even if UDD still lacks some of the data DDPO has currently). But it still requires web developer skills, which I don’t have. If you are interested, contact me!

I think I want a netbook. Although I'm still happy with my R200 (especially since I replaced the battery) something smaller would be handy for the train and general carting about. With the R200 being 12" I'm more drawn to the 8.9" variants; 10" isn't a lot smaller and at the cheaper end doesn't appear to result in any higher a resolution than 8.9"

Really I'd like something with built in 3G/HSDPA, but only the Dell Inspiron Mini 9 seems to have this, and the Linux model isn't even on sale yet in the UK, let alone the 3G version.

If I can't get 3G then I'm drawn to the EEE 901. It seems to have the best battery life, has bluetooth and isn't too expensive (though at the higher end of what I'd want to pay for a 2nd machine). Plus it has the appeal that I should be able to walk into a shop and pick one up. Main drawback is that I've read the Ralink RT2860 wifi ain't great (and the driver isn't in mainline yet, though there is one kicking around). Any truth in this? Any other gotchas?

Thoughts, people? I've seen an MSI Wind in the flesh and it was a bit big. The Acer Aspire One looks nice enough, but not great battery life and no bluetooth. Any others I should be looking at instead of the 901? Must be easily available in the UK. I will, of course, be running Debian on it.

One thing I had wondered was why home air-conditioning systems are more efficient than air-conditioning systems for server rooms. I received some advice on this matter from the manager of a small server room (which houses about 30 racks of very powerful and power hungry servers). The first issue is terminology, the efficiency of a “chiller” is regarded as the number of Watts of heat energy removed divided by the number of Watts of electricity consumed by the chiller. For example when using a 200% efficient air cooling plant, a 100W light bulb is rated as being a 150W heat source. 100W to Heat it, 50W from the cooling plant to cool it. For domestic cooling I believe that 300% is fairly common for modern “split systems” (it’s the specifications for the air-conditioning on my house and the other air-conditioners on display had similar ratings). For high-density server rooms with free air cooling I have been told that a typical efficiency range is between 80% and 110%! So it’s possible to use MORE electricity on cooling than on running the servers! One difficulty in cooling a server room is that the air often can’t flow freely (unlike a big open space such as the lounge room of your house). Another is the range of temperatures and the density of heat production in some parts (a 2RU server can dissipate 1000W of heat in a small space). These factors can be minimised by extracting hot air at the top and/or rear of racks and forcing cold air in the bottom and/or the front and by being very careful when planning where to place equipment. HP offers some services related to designing a server room to increase cooling efficiency, one of the services is using computational fluid dynamics to simulate the air-flow in the server-room [1]! CFD is difficult and expensive (the complete package from HP for a small server room costs more than some new cars), I believe that the fact that it is necessary for correct operation of some server rooms is an indication of the difficulty of the problem. The most effective ways of cooling servers involve tight coupling of chillers and servers. This often means using chilled water or another liquid to extract the heat. Chilled water refrigeration systems largely remove the problem of being unable to extract the heat from the right places, but instead you have some inefficiency in pumping the water and the servers are fixed in place. I have not seen or heard of chilled water being used for 2RU servers (I’m not saying that it doesn’t get used or that it wouldn’t make sense - merely that I haven’t seen it). When installing smaller servers (2RU and below) there is often a desire to move them and attaching a chilled-water cooling system would make such a move more difficult and expensive. When a server weighs a ton or more then you aren’t going to move it in a hurry (big servers have to be mostly disassembled before the shell can be moved, and the shell might require the efforts of four men to move it). Another issue related to water cooling is the weight. Managing a moderate amount of water involves a lot of heavy pipes (a leak would be really bad) and the water itself can weigh a lot. A server room that is based around 20Kg servers might have some issues with the extra weight of water cooling (particularly the older rooms), but a server room designed for a single rack that weighs a ton can probably cope. I have been told that the cooling systems for low density server rooms are typically as efficient as those used for houses, and may even be more efficient. I expect that when designing an air-conditioner the engineering trade-offs when designing for home use favor low purchase price. But someone who approves the purchase of an industrial cooling system will be more concerned about the overall cost of operations and will be prepared to spend some extra money up-front and recover it over the course of a few years. The fact that server rooms run 24*7 also gives more opportunity to recover the money spent on the purchase (my home A-C system runs for about 3 months a year for considerably less than 24 hours a day). So it seems that the way to cool servers efficiently is to have low density server rooms (to the largest extent possible). One step towards this goal would be to have servers nearer the end users. For example having workgroup servers near the workgroup (instead of in the server room). Of course physical security of those servers would be more challenging - but if all the users have regular desktop PCs that can be easily 0wned then having the server for them in the same room probably doesn’t make things any worse. Modern tower servers are more powerful than rack mounted servers that were available a few years ago while also being very quiet. A typical rack-mounted server is not something you would want near your desk, but one of the quiet tower servers works quite well.

• [1] http://en.wikipedia.org/wiki/Computational_fluid_dynamics

Share This