So it looks like I will have to use the other computer, and hope that Dell sorts things out quickly. I'm pretty disappointed, as I just purchased the machine (an Inspiron 1505 with Ubuntu) in July, and haven't really traveled with it much.

[440525.460000] ata2.00: configured for UDMA/33
[440525.460000] ata2: EH complete
[440942.908000] ata2.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x2 frozen
[440942.908000] ata2.00: cmd a0/01:00:00:00:00/00:00:00:00:00/a0 tag 0 cdb 0x43 data 12 in
[440942.908000]          res 50/00:01:00:00:00/00:00:00:00:00/a0 Emask 0x2 (HSM violation)
[440942.908000] ata2: soft resetting port

It required fsck'ing, and that was pretty much all she wrote. The disk itself, according to smartctl:

Device: ATA      ST980813AS       Version: 3.AD
Serial number:             5NH0301G

It doesn't support SMART though, so I don't know if the recent fuss about Ubuntu and Laptop HD's has anything to do with it. I never ran it much without power in any case, so I doubt it. It's especially frustrating, because I was making good progress on the Android port for Hecl, and will in the best of cases have to get a new computer "broken in", even though I do have good backups. My fingers are crossed that the money I spent for extra coverage will be worth something and that Dell Austria will be able to resolve the problem in a hurry, without requiring that I send the machine to the US or anything else that takes a lot of time. Sigh:-(

When advogato.org was still cool I signed up to it. It was an interesting research project in skill metrics (determining the rating of people’s coding skills by the votes of others and weighting the votes by the rating of each person), and it was nice to be rated Master soon after I joined. I still use it on occasion for the blog syndication feature (when I find a good blog on Advogato I add it to my Planet installation). When orkut.com was really cool (when every time I had dinner with a group of people someone would ask if they could be an “orkut friend”) I signed up to it. It was interesting for a while but then most people got bored with it. Now there is Facebook and MySpace for social networking for social purposes and LinkedIn.com for business related social networking. I periodically get invited to join those services but have not been interested in any other than LinkedIn. I can’t join LinkedIn because their mail server is regarded as a SPAM source by my mail server but their web server refuses to provide any information on why this is (the rejection was apparently long enough ago that it’s rolled off my logs). The problem with all these services is that I am expected to sign up with each of them and go to a moderate amount of effort in writing up all the data in the various web pages. Writing it is a pain, keeping it up to date is more pain, and dealing with spam in “scrap-book” entries in Orkut is still an annoyance which I don’t want to multiply by four! So far the only step I’ve seen towards addressing this issue is the XFN - XHTML Friends Network [1] project. But that seems to be of fairly limited scope (just referring to the friendship status of people in a <A HREF link). I believe that the requirements for social networking are:

1. Personal data about each person, some of which may only be available to friends or friends of friends.


2. The user owns their own data, has full control over where it’s sent and the ability to request people who receive it to keep some parts of it secret.


3. Ability to send email to friends of friends (determined by the wishes of each friend and FOAF).


4. Ability to get a list of friends of friends.


5. Incorporation of a standard format for CVs (for business social networking).

I think that the only way to go is to have a standard XML format for storing all personal data (including financial, career, and CV data) that can be used on any web site. Then someone who wants to be involved in social networking could create an XML file for a static web server (or multiple files with different content and password protected access), or they could have a server-side script generate an XML file on the fly with a set of data that is appropriate for the reader. The resulting social network would be entirely distributed and anyone could write software to join in. This covers item 1 and part of item 2. For sending email to friends of friends it would be good to avoid spam as much as possible. One way of doing would be requesting that friends publish a forwarding address on their own mail server in a manner similar to SRS [2]. SRS include the ability for such addresses to expire after a certain period of time (which would be convenient for this). In fact publishing SRS versions of friends email addresses would be a good option if you already use SPF [3] and SRS in your mail server. This covers item 3. The XML format could include information on how far the recipient could transfer it. For example if my server sent an XML file to a recruiting agency with my CV it could state that they could distribute it without restriction (so that they can give it to hiring managers) with the possibility of some fields being restricted (EG not tell the hiring manager what I used to get paid). For my mobile phone number I could send it to my friends with a request that they not send it on. This covers part of item 2. The URL for the friends file would of course be in the main XML file, and therefore you could have different friends lists published from different versions of your profile (EG the profile you send to recruiting agencies wouldn’t include drinking buddies etc). This completes the coverage of item 2. Then to have a friends list you have a single XML file on a web server that has the public parts of the XML files from all your friends. This means that getting a list of friends of friends would involve getting a single XML file for each friend (if you have 100 friends and each friend has 50 unique friends on average then you do 100 HTTP operations instead of 5,000). Minimising the number of web transfer operations is essential for performance and for reliability in the face of unreliable web servers (there is no chance of having 5,000 random web servers for individuals all up and accessible at the same time). This covers item 4. Item 5 is merely a nice thing to have which allows more easily replacing some of the recruiting infrastructure. As any such XML format will have several sections for arbitrary plain text (or maybe HTML) for describing various things the CV could of course be in HTML, but it would be good to have the data in XML. I posted this in the “blog” category because blogs are the only commonly used systems where end users do anything related to XML files (the RSS and ATOM feeds are XML). A blog server could easily be extended to do these social networking systems. As with a blog users could run their own social networking server (publishing their XML files) or they could use a service that is similar in concept to blogger which does it all for them (for the less technical users). Then an analogy to Planet, Technorati, etc in the blog space would be public aggregation services that compare people based on the number of friends they have etc, and attempts to map paths between people based on friends. This could also include GPG [4] data such that signing someone’s GPG key would cause your server to automatically list them in some friend category. The XML format should also have a field for a GPG signature (one option would be to use a GPG sub-key to sign the files and have the sub-key owned by the server). I don’t have any serious time to spend on implementing this at the moment. But if someone else starts coding such a project then I would certainly help test it, debug it, and contribute towards the XML design.

• [1] http://gmpg.org/xfn/and/


• [2] http://www.openspf.org/SRS


• [3] http://www.openspf.org/


• [4] http://www.gnupg.org/

Share This

Bryan Cantrill recently wrote a blog entry, where among other things, he philosophized on the concept of “perfect code”. He compares software to math, arguing that Euclid’s greatest common denominator algorithm shows no sign of wearing out, and that when code achieves perfection (or gets close to perfection), “it sediments into the information infrastructure” and the abstractions defined by that code becomes “the bedrock that future generations may build upon”. Later, in the comments of his blogs, when pressed to give some examples of such perfection, he cites a clever algorithm coded by his mentor to divide a high resolution timestamp by a billion extremely efficiently, and Solaris’s “cyclic subsystem”, a timer dispatch function. Watching his talk at Google where his introduction and sidebar book review on Scott Rosenberg’s “On Dreaming in Code”, it’s clear that he very passionately believes that it is possible to write perfect code, and that one should strive for that at all times. Perhaps that’s because he mostly writes code for operating systems, where the requirements change slowly, and for one OS in particular, Solaris, which tries far harder than most software projects to keep published interfaces stable for as long as possible. In contrast, the OS I’ve spent a lot of time hacking around, Linux, quite proudly states that at least inside the kernel, interfaces can not and should not be stable. Greg Kroah-Hart’s “Stable API Nonsense” is perhaps one of the strongly and most passionate expositions of that philosophy. I can see both sides of the argument, and in their place, both have something to offer. To Bryan’s first point, it is absolutely true that interfaces can become “bedrock” upon which entire ecosystems are built. Perhaps one of the most enduring and impactful example would be the Unix programming interface, which has since become enshrined by POSIX.2 and successor standards. I would argue, though, that it is the interface that is important, and not the code which initially implemented it. If the interface is powerful enough, and if it appears at the right time, and the initial implementation is good enough (not perfect!), then it can establish itself by virtue of the software which uses it becoming large enough that it assumes an important all out of scale with its original intention. Of course, sometimes such an interface is not perfect. There is an apocryphal story that when S. Feldman at AT&T labs first wrote the ‘make’ utility, that he did so rather quickly, and then put it available for his fellow lab members to use, and then went home to sleep. In some versions of the story he had stayed up late and/or pulled an all-nighter to write it, so he slept a long time. When he came back to work, he had come up with a number of ways to improve the syntax of the Makefile. Unfortunately, (so goes the story) that too many teams were already using the ‘make’ utility, so he didn’t feel he could change the Makefile syntax. I have no evidence that this ever took place, and I suspect it is an urban myth that was invented to explain why Makefiles have a rather ugly and unfortunate syntax that many would call defects, including the use of syntactically significant tab characters which are indistinguishable from other forms of leading whitespace. Another example which is the bane of filesystem designers everywhere are the Unix readdir(2), telldir(2), and seekdir(2) interfaces. These interfaces fundamentally assume that directories are stored in linear linked lists, and filesystems that wish to use more sophisticated data structures, such as b-trees, have to go to extraordinary lengths in order support these interfaces. Very few programs use telldir(2) and seekdir(2), but some filesystems such as JFS maintain two b-trees instead of one just to cater to telldir/seekdir. And yet, it is absolutely true that interfaces can be the bedrock for an entire industry. Certainly no matter what its warts, the Unix/Posix interface has proven the test of time, and it has been responsible for the success of many a company and many billions of dollars of market capitalization. But is this the same as perfect code? No, but if billions of dollars of user applications are going to be depending on that code, it’s best if code which implement such an interface be high quality, and should attempt to achieve perfection. But what does it mean for code to be perfect? For a particular environment, if the requirements can be articulated clearly, I can accept that code can reach perfection, in that it becomes as fast as possible (for the given computer platform), and it handles all exception cases, etc., etc. Unfortunately, in the real world, the environment and the requirements inevitably change over time. For example, Bryan’s cyclic subsystem, which he proudly touts as being if not perfect, almost so, and which executes at least 100 times a second on every Solaris system in the world. I haven’t looked at the cyclic system in any detail, since I don’t want to get myself contaminated (the CDDL and GPLv2 licenses are intentionally incompatible, and given that companies — including Sun — have sued over IPR issues, well, one can’t be too careful), but waking up the CPU from its low-power state 100 times a second isn’t a good thing at all if you are worried about energy conservation in data centers — or in laptops. For example, on my laptop, it is possible to keep wakeups down to no more than 30-35 times a second and it would be possible to do more but for an abstraction limitation. Suppose for example an process wants to be sleep and then receive a wakeup 1 milliseconds later, and so requests this via usleep(). At the same time, another application wants to sleep until some file descriptor activity takes place, or after 1.2 milliseconds takes place. 0.3 milliseconds later, a third process requests a sleep, this time for 0.8 milliseconds. Now, it could be that in all of the above cases, the applications don’t actually need exact timing; if they all get their wakeups plus or minus some fraction of a millisecond, they would be quite cool with that. Unfortunately, the standard timer interfaces have no way of expressing this, and so the OS can’t combine the three wakeups at T+1.0, T+1.1, and T+1.2 milliseconds into one wakeup at T+1.1ms. So this is where Greg K-H’s “Stable API Nonsense” comes into play. We may not be able to solve this problem at the userspace level, but we darn well can solve this problem inside the kernel. Inside the kernel, we can change the timer abstraction to allow device drivers and kernel routines to provide a timer delta plus a notion of how much accuracy is required for a particular timer request. Doing so might change a timer structure that previously external device drivers had depended upon — but too bad, that’s why stable ABI/API’s are not supported for internal kernel interfaces. Is this that the interface could have been extended? Well, perhaps, and perhaps not; if an interface is well designed, it is possible it can be extended in an API and/or ABI compatible way. There usually is a performance cost to doing so, and sometimes it may make sense to pay that that cost, and sometimes it may not. I’ll talk more about that in a future essay. Yet note what happened to the timer implementation. We have a pretty sophisticated timer implementation inside Linux, that uses heap data structures and buckets of timers for efficiency. So while I might not call it perfect, it is pretty good. But, oops! Thanks to this new requirement of energy efficiency, it will likely need to get changed to support variable levels of accuracy and the ability to fire multiple timers that are (more or less) coming due in a single CPU wakeup cycle. Does that make it no longer perfect, or no longer pretty good? Well, it just had a new requirement impact the code, and if criteria for perfection is for the abstraction defined by the code to be “bedrock” and never-changing, and no need to make any changes in said code over multiple years, I would argue that little to no code, even OS code, can ever achieve perfection by that definition — unless that code is no longer being used. (This is the first of a multi-part series of essays on abstractions that I have planned. The next essay which I plan to write will be entitled “Layer surfing, or jumping between layers”, and will be coming soon to a blog near you….)

So, I've been off blogging for almost three months now -- from about mid-August to now. It's been kind of guilt-ridden, and it's also been kind of a relief. Being a B-list blogebrity is a direful burden, and having some time away was restful and relaxing and energizing. But now I'm ready to come back! One of the reasons that I haven't been blogging is that once you fall behind, it's really hard to catch up. So I've decided to not do the entire task at once. Instead, I'm just going to start a page on my 2007 Hiatus and fill that up as time permits. For those of you who care greatly about exactly what I did each and every day for the last three months, you've got a spot to read it. And, truthfully, I dropped out of the B-list ranks on Technorati during my time away. I'm back to my natural position as a C-list blogger, and baby, it feels good. Get ready for some photos of my cats, coming up soon! tags: blogging blogs me c-list hiatus

Feelings of loss One of the other main reasons I haven't been blogging in the last few months is that I've been losing weight. A lot of weight. I've dropped from a high body mass index (BMI) of about 43 -- dangerously high -- to my current sane but still high 33.6. I'd like to get down to a more reasonable BMI of 30 ("overweight") by the end of the year, and be somewhere around 25 ("normal") by next summer. I can lose weight pretty easily when I put my mind to it. Well, actually, it's still insanely hard, but I'm so damn stubborn and obsessive about things, when I actually sink my teeth into them, that it seems easy to the casual observer. My recipe is simple: reduce the amount of food I eat, do low-intensity exercise about an hour a day, and measure everything as well as possible. I eat 3 good meals a day -- about 50% fruits and vegetables, 25% complex carbs like rice or bread, and 25% protein like beans, tofu, fish or cheese. I steer clear of sweets and I drink alcohol only on occasion, and seldom more than a glass or two of wine. For exercise, I've been running around Parc Lafontaine or on a treadmill three days in a row, then on the fourth day lifting weights at a local gym on rue Gilford. I still have a ways to go, but the results have been good so far, and I'm feeling like I'm getting close to the neighbourhood of what I "should" weigh. I've been getting a lot of compliments from friends and family, which is a great motivator. Most of all, I feel good running, jumping, and playing with my daughter, which is the biggest reward of all. All that said, the exercise is taking an extra 1-2 hours out of my day, and blogging has been the main thing cut out to make room. But I think I can work around that now. tags: weight loss BMI diet exercise

Road trip We're leaving Tuesday for a trip to New Jersey to visit my dad's family for American Thanksgiving. (Yeah, they're my family, too.) We're all looking forward to seeing aunts and uncles and cousins and other extended family, but we're also looking forward to spending our powerful Canadian loonies in the US. The Canadian dollar's gone up and up this last few months, and though it's no longer trading at its ridiculous high of US$1.10 (!), it's still above parity, which means our money stretches pretty well. Coupled with this is the fact that most products here in Canada are still priced as if the loonie were still worth US$0.62. It's not atypical to see a book priced for $7.99 US, $10.99 Canadian. So we're going to do some shopping for clothes, books, music and other goods while we're stateside. I plan on bringing an empty suitcase with me and bringing it back full. (The fact that I've lost a lot of weight makes shopping for clothes particularly enticing.) All within our legal limits for customs returning to Canada, of course! Not to worry, random customs official who's reading this blog for who knows what reason. I'm also looking forward to this trip because we haven't done a driving trip together in a while. Going to Thanksgiving in 2005 was Amita June's second long trip (our overnighter to Ottawa for our anniversary in Oct 2005 was her first), and I think she's going to enjoy it again this time. tags: road trip thanksgiving loonie parity shopping

Painful upgrade I just upgraded my main server, Antipater, from Debian "sarge" to Ubuntu "gutsy". I was getting pretty frustrated by being 3+ versions back from a lot of the important software running on the system. I wanted to get on Ubuntu for my server platform to have more frequent upgrades (about every 6 months). The upgrade went well, mostly. I updated /etc/apt/sources.list to use the Ubuntu archives, then got all the packages. The installation was pretty quick, even for something like 700 packages. However, when I rebooted to use the new 2.6.22 kernel (up from 2.6.8 or so), the server's responsiveness went way down. My guess is that somewhere in the 2.6.x series, one of the new schedulers is causing my particular configuration some grief. I've trimmed my cron jobs and background processes down to a minimum, but the server is still running a little too loaded. The great folks at iWeb have been really helpful, but they don't support Ubuntu, so I've got to brainstorm for myself. I'm going to have to go in over the next few days to reboot the server and experiment with other kernels -- not fun. tags: iweb ubuntu antipater

One-liners Some other odds and ends:

• It's getting cold! We had our first snow flurries a few days ago, and it's been regularly under freezing around here. Time to get winter coats out of the closet -- or, better, buy new ones in the US.
• My friends at Kokoromi are organizing an excellent games+art event called GAMMA 256 on November 28 at the SAT. Should be a lot of fun.
• One such friend, Heather Kelley is going to be talking at the Montreal Geek Girl Dinner on Tuesday. Good for her!

tags: gamma kokoromi weather heatherkelley montrealgirlgeekdinner

Adeodato mentioned using ctrlproxy, so I thought I'd ramble a bit about my experience w/ IRC proxies in general. dircproxy was the first IRC proxy software I tried. It did the job, but the thing that annoyed me the most was that only one client could connect at a time. I'd get home and realize I was still connected at work, and then have to login and send a kill signal to xchat. When I found out about ctrlproxy, and that it supports multiple clients, I was very excited. It did the job, but occasionally it would hang and need to manually killed/restarted, and it had this weird problem of writing logs for one channel to the log file of another. Most recently (and for probably a year now) I've been using bip. I immediately hit an issue with one server - bip would constantly reconnect/disconnect. Upstream immediately went to work on the problem, determined it was a bug in the server itself, and (iirc) sent the server maintainers a patch. Now that's support! bip has been stable for me for nearly 2 years now. I'd also suggest comparing the bug pages for dircproxy, ctrlproxy, and bip. That's not always a good way to measure relative stability, but it resembles my experience in this instance.

What’s up with myself? I ask me this question myself after many of you asked me about what’s going on with me. I have a quite difficult time right now - ok - more precisely: Already for about a month or so. Several people who were very important for me let me hang. I have a lot of personal troubles at my workplace, different troubles in my circle of friends and also have worries about my girlfriend who considers to move to Germany in January. I do even miss my personal energy and motivation. I look forward to solve my situation at work, look forward to the QA meeting in ~2 weeks and hope to have some real holidays in december to relax a little bit. In that case… Regards,

Is it possible to secure Internet banking with SMS? As secure tokens are too expensive ($10 or more in bulk) and considered to be too difficult to use by many (most?) customers banks have sought out other options. One option that has been implemented by the National Australia Bank and will soon be available from the Commonwealth Bank is SMS authentication of transfers. The idea is that when you issue an online banking request you receive an SMS with a password and then have to enter that password to authenticate it. If you receive an unexpected password then you know you have been attacked. I wonder how much information is in the SMS, does it include the amount and where the money is to be transferred (in the case of a funds transfer - the operation most likely to be used by attackers)? If the full details are not included then an attacker could hijack an active session, get the user to enter the password, and then act as if the user entered the password incorrectly. The user would then request a new SMS and complete their desired transfer without realising that they just authorised a transfer to Russia… If the full details are recorded will the user look at them? Online banking fraud often involves transferring the funds to an idiot in the same country as the victim. Then the idiot sends the money to the attacker in some other manner which is more difficult to track. I wonder whether an attacker could divert the funds transfer to one of the idiots in question and have the victim not realise that the wrong account number was used. Another issue is that of SMS interception. Anyone who can hack the network of a phone company could steal money from any bank account in the country! For wealthy people there is also the possibility of stealing their mobile phone and making funds transfers before they report the theft. Another possibility is to register for a new phone company. Last time I changed phone companies it took about an hour for the new company to have the phone number and I don’t recall the phone company doing anything to verify that I owned the number in question. If an attacker had a credit card with the same name as the victim (names are not unique so this is not impossible or even inherently illegal) they could open a new phone service and steal the number. Someone who’s mobile phone stops working probably wouldn’t assume that it was part of a bank fraud scheme and act accordingly, in fact if they don’t use their mobile phone later it might be several days before someone contacts them in some other manner and mentions that they weren’t answering their mobile phone. A final possibility is the situation where a mobile phone is connected to a computer. Devices that combine mobile phone and PDA functionality are becoming common. A trojan horse program that offered to do something useful when a mobile phone was connected to the PC via a USB cable might fool some users. All that would be required is a few minutes of the phone being connected if the attacker already has the password for online banking. Maybe they could even make it appear that the bank was demanding that the phone be connected to the PC - that should fool users who don’t understand how SMS authentication works. It seems to me that SMS authentication is an improvement (it adds an external device which usually can’t be directly manipulated by the attacker) but is far from perfect security. I previously wrote about the bad idea that you can bank with an infected computer [1]. SMS authentication is a good step towards making things more difficult for attackers (which is always a good idea) but doesn’t really secure the system. Also it costs 5 cents for each SMS, I expect that the banks will want their customers to pay for this - I would rather pay for a $10 token up-front.

• [1] http://etbe.coker.com.au/2007/10/19/banking-with-an-infected-computer/

Share This

On Self-Reflection I have a need to write some things down recently, I don’t really know why or so. I have acquired a few new (and great) friends recently, mostly here in Brno. Also, I have more motivation than ever to try hard to live a good life. It has always been a hard way to follow for me, to be all those things that I find great in other people. How they can handle situations smoothly, what they know and what they can do. And it is great to see such people, and yet it is hard to not envy them. But envy not, since it is a great evil. One never knows what the other people have to go through, and it is just plain unfair to envy them. But I am drifting away from the subject at hand. What I have noticed as well, that I have changed in subtle ways, patterns of thinking. Self-reflection is somewhat cautiously sneaking into my mind. Two independent events have reminded me of that today. Recently, I have been participating in online discussion more than I have used to, especially with people I do not know, and with which I often tend to disagree, and this is putting me in a new kind of situation. And to be honest, I am not really handling it all that well. What has made me think about this was Boudewijn Rempt’s comment on the dot. He handled the task at hand so much better than myself, even if it was his ego that was in the line, that has made me actually stop and think about it. And as I have written in that thread, I admire Boudewijn greatly for that calm reaction, of which I would be almost surely not capable. So here I am, trying to learn from that. My memory is indeed very short, but I also take this writing as a way to train that. The second event was that a friend of mine (I do not know him long, but I call him a friend nevertheless, although I know not whether I actually deserve that) has told us something to the effect that one should learn. Meaning that one should learn from own mistakes, and no, I no more see the empty phrase behind those words. There is something in that, and it is a very interesting experience. Going through situations you have encountered and realize where you have made mistakes and what you could have done better. Actually admit, that even though the outcome was fairly good, that you have made some silly things. It is indeed a very interesting experience, to admit a failure when you are not pressed to by any external means. Liberating, maybe. Same goes for things long forgotten. Where you have made mistakes, even though you have been always righteous and positively convinced about always doing the right things. You may be wondering whether I have been on crack all the time, but, well, that is not the case. I cannot tell how this came about, and yes, I have realized those mistakes and again forgotten them and so on and so forth. But hey, I think it may be better this time. If only a little…

Should you use software or hardware RAID? Many people claim that Hardware RAID is needed for performance (which can be true) but then claim that it’s because of the CPU use of the RAID calculations. Here is the data logged by the Linux kernel then the RAID-5 and RAID-6 drivers are loaded on a 1GHz Pentium-3 system: raid5: automatically using best checksumming function: pIII_sse
  pIII_sse  :  2044.000 MB/sec
raid5: using function: pIII_sse (2044.000 MB/sec)
raid6: int32×1    269 MB/s
raid6: int32×2    316 MB/s
raid6: int32×4    308 MB/s
raid6: int32×8    281 MB/s
raid6: mmxx1      914 MB/s
raid6: mmxx2    1000 MB/s
raid6: sse1×1    800 MB/s
raid6: sse1×2    1046 MB/s
raid6: using algorithm sse1×2 (1046 MB/s) There are few P3 systems that have enough IO capacity to support anywhere near 2000MB/s of disk IO and modern systems give even better CPU performance. The fastest disks available can sustain about 80MB/s when performing contiguous disk IO (which incidentally is a fairly rare operation). So if you had ten fast disks performing contiguous IO then you might be using 800MB/s of disk IO bandwidth, but that would hardly stretch your CPU performance. It’s obvious that CPU performance of the XOR calculations for RAID-5 (and the slightly more complex calculations for RAID-6) is not a bottleneck. Hardware RAID-5 often significantly outperforms software RAID-5 (in fact it should always outperform software RAID-5) even though in almost every case the RAID processor has significantly less CPU power than the main CPU. The benefit for hardware RAID-5 is in caching. A standard feature in a hardware RAID controller is a write-back disk cache in non-volatile RAM (RAM that has a battery backup and can typically keep it’s data for more than 24 hours without power). All RAID levels benefit from this but RAID-5 and RAID-6 gain particular benefits. In RAID-5 a small write (less than the stripe size) requires either that all the blocks other than the ones to be written are read or that the original content of the block to be written and the parity block are read - in either case writing less than a full stripe to a RAID-5 requires some reads. If the write-back cache can store the data for long enough that a second write is performed to the same stripe (EG to files being created in the same Inode block) then performance may double. There is one situation where software RAID will give better performance (often significantly better performance), that is for low-end hardware RAID devices. I suspect that some hardware RAID vendors deliberately cripple the performance of low-end RAID devices (by using an extremely under-powered CPU among other things) to drive sales of the more expensive devices. In 2001 I benchmarked one hardware RAID controller as being able to only sustain 10MB/s for contiguous read and write operations (software RAID on lesser hardware would deliver 100MB/s or more). But for random synchronous writes the performance was great and that’s what mattered for the application in question. Also there are reliability issues related to write-back caching. In a well designed system an update of an entire RAID-5 stripe (one block to each disk including the parity block) will first be performed to the cache and then the cache will be written back. If the power fails while the write is in progress then it will be attempted again when power is restored thus ensuring that all disks have the same data. With any RAID implementation without such a NVRAM cache a write to the entire stripe could be partially successful. This means that the parity block would not match the data! In such a situation the machine would probably work well (fsck would ensure that the filesystem state was consistent) until a disk failed. When the RAID-5 recovery procedure is used after a disk is failed it uses the parity block to re-generate the missing data, but if the parity doesn’t match then the re-generated data will be different. A disk failure may happen while the machine is online and this could potentially result in filesystem and/or database meta-data changing on a running system - this is a bad situation that most filesystems and databases will not handle well. A further benefit of a well designed NVRAM cache is that it can be used on multiple systems. For their servers HP makes some guarantees about which replacement machines will accept the NVRAM module. So if you have a HP server running RAID-5 with an NVRAM cache then you could have the entire motherboard die, have HP support provide a replacement server, then when the replacement machine is booted with the old hard drives and NVRAM module installed the data in the write-back cache will be written! This is a significant feature for improving reliability in bad corner cases. NB I’m not saying that HP is better than all other RAID vendors in this regard, merely that I know what HP equipment will do and don’t know about the rest. It would be good if there was a commodity standard for NVRAM on a PC motherboard. Perhaps a standard socket design that Intel could specify and that every motherboard manufacturer would eventually support. Then to implement such things on a typical PC all that would be required would be the NVRAM module, which while still being expensive would be significantly cheaper than current prices due to the increase in volume. If there was a significant quantity of PCs with such NVRAM (or which could be upgraded to it without excessive cost) then there would be an incentive for people to modify the Linux sotware RAID code to use it and thus give benefits for performance and reliability. Then it could be possible to install a NVRAM module and drives in a replacement server with Linux software RAID and have the data integrity preserved. But unless/until such things happen write-back caching that preserves the data integrity requires hardware RAID. Another limitation of Linux software RAID is expanding RAID groups. A HP server that I work on had two disks in a RAID-1 array, one of my colleagues added an extra disk and made it a RAID-5, the hardware RAID device moved the data around as appropriate while the machine was running and the disk space was expanded without any down-time. Some similar things can be done with Linux, for example here is documentation on converting RAID-1 to RAID-5 with Linux software RAID [1]. But that conversion operation requires some down-time and is not something that’s officially supported, while converting RAID-1 to RAID-5 with HP hardware RAID is a standard supported feature.

• [1] http://scott.wallace.sh/node/1521

Share This

Update: problem fixed, thanks for the comments; it was MTU related issues.

Note: This is a long post, but I expect it to bring in some questions for many Linux people; I advise you to read this when you have enough time.


After the last events related to connectivity at home which have been lasting since Thursday evening and the weird fact that it seems that NAT doesn't work at home, but does at work for the same setup, I called the ISP's support and wasted 15 minutes trying to convince them at least to send a technical team with another modem just to test if that is the reason for the breakage.

Of course, talking to the ISP support and trying to convince them that there might be a problem on their side since NAT works with another provider but doesn't with them, was fruitless.

Tonight I was stuck and tried another approach, convinced I would confirm my suspicion that there is something wrong on ISP's side. Still I am not yet sure what to conclude from what happened.


So, to get a better view of what is going on, I'll describe the setup I have and what are its limitations and characteristics. People in a hurry can skip to the paragraph starting with "I tested" and stare in wonder at will.


So the connection I have is done through a DSL modem which gets the MAC of the network card connected to it and exposes that as its own to the ISP's network. This MAC seems to be quite persistent and special measures must be taken in order to be able to use another NIC to connect. The modem (or probably some machine in ISP's; the IP is 10.10.0.1) offers a DHCP address and everything should work fine.

Because of this "your MAC is my MAC" issue, when I connected the first time, I used an USB NIC since a broken router or some temporary failure would have allowed me to use the Internet connection directly from my laptop. I can say this decision has proven in time to be wise.

The router I used until now is a NSLU2 with Debian installed on it. The built in network interface always faced the internal network.

The router (which I call ritter) served as a NAT router for two machines inside the network, my laptop and my apartment mate's laptop. All until last Thursday, after which it never got back properly.



I tested (doing NAT on my laptop; the laptop shouldn't have been affected by the power problems):

• with ritter behind the laptop NAT, at home
  
• with two different virtual machines as NAT "clients", at home
  
• with ritter behind the laptop NAT, at work
• with a virtual machine as NAT client, at home
• directly from the laptop
• NAT made through a SNAT rule
• NAT made through a MASQUERADING rule
• with TTL mangled (increased by one, although is was never in the ballpark of a low TTL)

Of course, I have n-checked that /proc/sys/net/ipv4/ip_forward was set to 1, the tables had policy ACCEPT and there were no extra rules, except the basic NAT-ting stuff, the routes were correctly set on both the clients and the machine doing the NAT.


All I could see is that:

1. the machine doing the NAT was always working fine
2. at work all NAT clients worked fine
   
3. at home any of the NAT "clients" were
1. able to resolve addresses while the DNS server was in ISP territory and another LAN
2. ping the outside world (if ping was available - in D-I is not)
3. hanging when trying to get a http page
4. telnet-ting directly to the port 80 was ok (but I didn't try to "GET / HTTP/1.0")

So after all of this, I was thinking of trying to see if a new client (the laptop of my apartment mate, a Windows XP machine) would work using the connection at home. It didn't work.

Then I thought of trying to do "Internet Connection Sharing" as is called in Windows. Of course, there was some pain to find Windows XP drivers for the ASIX AX88172 network card (remember, the modem needed to see the MAC of that NIC), but I managed to find the proper one.


And, almost sure the NAT wouldn't work for this case either, I configured the new connection as a shared one. I didn't even disabled the firewall, as I was thinking I could take those down gradually.

I wasn't expecting this, not even by pure chance, but my laptop which was a NAT "client" now was able to browse, ping and do whatever was normal through NAT, while the Windows machine was doing the "Connection sharing".

I was utterly flabbergasted. And that was just the beginning.

I was expecting that the problem coincidentally went away, but after a minute I was proven otherwise. It still didn't work with Linux as the NAT-ting machine. I connected back the USB NIC to the Windows machine and I saw the same thing. NAT was just working.


At that point I was to observe an even more shocking fact: the IP that the Windows machine got was different from the one the Linux machine received, in spite of the fact that the network card was the same, so it would have made sense to get the same one. More than that, the IP that the Windows machine got was from an entirely different network, although it was a valid IP belonging to my ISP.

I was thinking that one reason why it works with Windows might be that there could be some TCP protocol twist that is differently implemented in Windows and the equipment from my ISP gets along better with the Windows network stack.


As a way to test that, I am thinking of forcing somehow the IP on the Linux machine to see if anything changes. But before doing that, I felt the urge to post these, maybe some kind soul will shed some light on this issue for me or drop a hint.

Another reason might be different DHCP servers answering, but I don't know how I can see in Windows who offered the lease.


If anyone has any clue why these weird things happen, please drop a line. I would greatly appreciate it. TIA.

My relearned lesson for the day: when Linux networking weirdness occurs in a NAT environment, remember to try MTU clamping.

Thanks to the comments by Justin and Sesse, I was fast-tracked to the core of the problems I have been experiencing since Thursday, MTU issues. What's worse (from my pov) is that I have encountered this issue before with the provider I had in Timi oara, but, since that ISP was using PPPoE and my current ISP in Bucharest doesn't, I never really made the connection. I even had a commented out iptables rule for MTU clamping in my firewall script.

The rule I am talking about looks like this:

iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o $EXT_IF -j TCPMSS --clamp-mss-to-pmtu

or like the one I have been using (seems more logical to me):

iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu


Note that this is not a fix, but a workaround and the real problem is over-zealous admins or weird setups[1] which think that banning TCP fragmentation (or the entire ICMP traffic) is a way to secure networks.


Once again, thanks to everybody who read and/or commented about my issue.

[1] Sesse told me that in his case there was a transparent proxy involved when he exeprienced MTU weirdness.

Back when I had a computer 24/7 at home, I would irc from there, using irssi inside screen. Using the laptop at home worked fine, since there was no noticeable lag when typing, and I wasn’t away from home that often, so lag in such occasions was acceptable. Later on, I changed flats and the 24/7 computer could no longer run 24/7, so I moved irssi to a remote computer. Used as I was to no lag at all, this turned out too painful. I ended up with one remote irssi to read backlog, and one local irssi from the laptop, joining and parting as I turned it on and off, or changed networks. This was, er, suboptimal. Finally, Holger recommended me using an IRC proxy, ctrlproxy in particular. Basically you run it in any 24/7 computer, and then your irc client (not necessarily irssi, mind you) connects to it, instead of directly to the irc server. On connect, ctrlproxy sends you backlog since the last time you quit (but this can be disabled), and after that is transparent. For me, there’s no looking back, since I hate lag when typing, and I didn’t want to be joining and parting all the time. If you don’t mind lag, or always connect from networks with very low latency, well, consider yourself lucky.

In the past I have spent about 18 months living in hotels with a couple of months of breaks in between. I have previously written about it in terms of living in London hotels [1], but I have been asked for more generic advice. Firstly the amount of possessions that you may have when living in hotels is seriously limited. For ease of travel you want to restrict yourself to one suitcase for checked luggage and one for carry-on luggage. Hotels often have short-term storage space for possessions of guests, so having a second suitcase of items that are not worth stealing (clothes and books) may be an option. But consumer electronics devices other than a single laptop computer are not an option. I read an interesting blog post on ZenHabits.net titled Minimalist Fun: The 100 Things Challenge [2] which advocates counting and limiting the number of possessions you own. When living in hotels if I considered my books as one collection and my clothes as another (having never been interested in trendy clothes they count as utilitarian items for work or leisure not objects that I seek to own) and as my mobile phone was a tool for work and my computer gear was strictly limited to items that were needed for work (and thus “tools”) my only possessions were a digital camera and some bottles of liquor! The lack of ability to accumulate possessions may be considered as an advantage or a disadvantage depending on what your aims are. If you are moving to another country for work there are three ways of doing it. The easiest is to be a permanent employee of a company that assigns you to work there - in which case they will probably pay to transport your stuff when you buy or rent a house. If you are a looking for new employment (either contract or permanent) in another country then you can either find the work before moving or after arriving there. Finding work before arriving in the country is difficult and generally only works for short-term contracts. So it’s most likely that you will either be looking for work immediately after arriving or after a short contract. In either case having better mobility increases your employment options - why restrict yourself to one city or region when you can choose from all jobs in an entire country or (in the case of the EU) half of a continent! The career benefits of being able to accept any job anywhere in the world at short notice are significant! There are situations where an employer will pay hotel bills. One example was when I was working for a London based company and they assigned us to work at the other side of London. My colleagues complained and the company paid for hotel bills for everyone Sunday night to Thursday night inclusive as well as an extra hour of pay per day as compensation for the inconvenience. For me of course one hotel was as good as another so it just meant that my employer was covering 5/7 of my living expenses. Then I had a meeting with the hotel manager and pointed out that having me check out every Friday would be bad for them as the hotel was mostly empty on the weekend and suggested that they make me a deal for the other two days - I ended up paying something like one night of hotel fees per week! If I had rented an apartment I would have still been paying the full rent (which while less than 30 days hotel fees per month would have been considerably more than 4 or 5 days of hotel fees per month). If you live in a hotel then there is always some sort of deal that can be arranged. Apart from certain busy days (such as around the Christmas and new-year time) they always want long-term guests and will be willing to reduce the price, give free dinner or drinks from the bar, etc. The cost of living in a hotel at times such as Christmas may be as much as five times the regular rate. That is a further incentive to visit friends or relatives at Christmas. If you can’t visit your family (which may be difficult if they live on the other side of the world) then finding a friend who has a spare room might be an option.

• [1] http://etbe.coker.com.au/2007/08/05/living-in-hotels/


• [2] http://zenhabits.net/2007/09/minimalist-fun-the-100-things-challenge/

Share This

This morning’s SuperComputing’07 keynote was a talk by Neil Gershenfeld, director of the Center for Bits and Atoms at the MIT. He mentioned the MIT Fab Labs, a project to bring “Personal Fabrication” to people around the around. At our own level, that’s something I find very exciting with Free Software: it empowers people to do things with their computers that they couldn’t do if they were using proprietary software, simply because proprietary software is built to fit most people’s needs, not very specific goals some people could have. (and this is similar to the Long Tail stuff, in some ways) Also, if you are at SC07 and reading this, feel free to ping me! I haven’t seen a lot of Debian/Ubuntuers here, even if the Free/Proprietary software ratio is very high.

Some of you might notice that I've been somewhat inactive as a Debian developer or hacker in general for a while. There were several reasons, but at least one of my free-time-suckers these days has been MIAU (Movements for the Internet Active Users). I'm one of the founders, and recently we held the kick-off press conference and are steadily gaining supporters. Oh yeah, we know this acronym is quite awkward...we simply love that sound (in case you don't get, see our symbol mark). Our organization is intended to be a Japanese counterpart of EFF or ORG, and possibly includes some elements of what Prof. Lessig & Co. are doing in the U.S. We would like to defend our freedom and build/preserve the nurturing environment for innovation, especially in the Net. We would also like to be a political voice for Japanese Internet users. Currently we are focusing to fight with (IMHO) ill-conceived Japanese copyright "reform"s, such as extending the copyright term to 70 years or making downloading (in a sense) questionably-uploaded materials (like BitTorrent downloads) illegal. In case you want to know what's going on in the Japanese copyright war front now, I recommend this recently-published Techdirt article: Japan Is The Latest Country To Explore Copyright Term Extension. Unfortunately, for the time being, most of the MIAU Web contents are available only in Japanese. Yes, *I* got to translate the MIAU articles into English but need some more time...and I should admit MIAU as an organization is still tottering in many aspects. I'm not sure how we can gain greater momentum. If you have some experience to run this kind of initiative in your countries, please share your experience with us.

Tag this post with del.icio.us!

Video introducing it: http://youtube.com/watch?v=1FJHYqE0RDg SDK is available, and all free software (or will be shortly, at least): http://code.google.com/android/ The GUI API is not like MIDP2.0, so it's not compatible with existing J2ME apps, like Hecl. Hrmph. Seems like Java 5 constructs are supported (I also wonder what those hex addresses are doing in there): http://code.google.com/android/intro/hello-android.html In any case, very interesting, and very cool. It certainly changes things a lot, though - until this becomes commonplace, it will just add to the number of platforms that need to be supported, which might actually make life tougher for a while. All things considered, though, you can't complain about getting something that cool under an open source license!

Kicking ass in an unflat world is The Economist's take on recent efforts in the world of business books. As the creator of Squeezed Books, their opinion was of interest to me. As is often the case, they don't disappoint, with lines like

Things to bear in mind as you do, he says, include the need for your company to have purpose, to seek out ideas from the fringes, and to embrace the democratising power of the internet none of which will be news to anyone who has been in business for more than a few minutes.

What really caught me eye, though, was this:

There is also growing demand from overloaded executives for shorter books. So in January Harvard will launch a new hardback series, Memo to the CEO , covering subjects such as lessons from private equity and the future of strategy. Each book will be about 100 pages long and will cost $20. In a similar vein, Harvard has adopted the approach taken by iTunes to pop albums, and has started to sell individual chapters of books online an idea that has been a hit with academics in particular.

A lot of good business books take a sensible central idea, and then proceed to fluff it up to a length where it can be published as a book. Often, this makes for a good read, as the anecdotes and case studies and whatnot are interesting, but for those in a hurry, or simply wanting to know what the basic point of the book is about, it's just padding. So, it looks as if the idea behind Squeezed Books is a good one, now I just need to get better at attracting more people to contribute summaries, and discuss the books on the site. One thing I've done to that end is stipulate that the summaries are available, unless otherwise noted, under a creative commons license.

I’m currently evaluating Olivier Sessinks jailkit to maintain a small cvsd CHROOT with an included SSH server. The cvsd-buildroot command e.g. doesn’t handle the libpam-modules dependency in the CHROOT. So I tried to update the Debian packaging files included in the jailkit source. During this work I found some issues with the build environment - e.g. no DESTDIR support and some other stuff (another user already complained, that there might be problems with the SUID installation part for jk_chrootsh, jk_uchroot and jk_procmailwrapper of the Makefiles). So I began to check and “fix” the Makefiles and the configure script and then sent everything to Olivier. I did not only add the DESTDIR variables. I also made use of built-in rules, common variables (also for implicit rules), … and such stuff to make the Makefiles shorter and easier to maintain. My fault: I tested everything with GNU make. Now Olivier complained, that BSDs make doesn’t work anymore. So we began a short hack session to check for the problems. My first issue: I had to find some BSD make to test it myself. I found it in the freebsd5-buildutils, that contains the freebsd-make command. Then we began to check for incompatibilities and that’s the result:

1. ifdef statements differ in syntax
   • GNU make uses ifdef VAR
   • BSD make uses .ifdef VAR
   solution: We replaced the statement with a construct similar to AM_CONDITIONAL. But we do not use this macro, because it would need to be shipped in aclocal.m4, which is currently not necessary. The code simply sets a variable foo_TRUE to ‘# ‘, if the condition is wrong, or the variable is left empty, if the condition is true:

   if test "x$my_condition" != "xno" ; then
       AC_SUBST([foo_TRUE], [])
   else
       AC_SUBST([foo_TRUE], [# ])
   fi

   FILES = bar
   @foo_TRUE@FILES += foo

2. prerequisite variables differ in syntax
   • GNU make uses $<, $^, $@, …
   • BSD make uses $ .IMPSRC , $ .ALLSRC , $ .TARGET , … (note, that both *SRC variables hold a list of source files)
   Unfortunately both make implementations doesn’t seem to share a variable for the list of prerequisites. So the only solution is to list all prerequisites in the rule again. A variable would be much more comfortable. Maybe one could write a function, that first tests $ .IMPSRC and falls back to $^. Maybe that’s an alternative, but it’s IMHO not a very good solution. We’ve chosen to write down all prerequisites in a rule instead of using a variable. This is a little bit “harder” to maintain, but it works.
3. built-in rules are not shared and do not use the same variables
   • GNU make ships built-in rules to build objects from sources and link them; rules consider CPPFLAGS
   • BSD make ships built-in rules to build objects from sources, but there are no rules to link them; rules do not consider CPPFLAGS
   In the case of GNU make, one can simply write:

   myprog: foo.o bar.o

   and GNU make will automatically create foo.o from foo.c (.c.o:, ditto for bar.o) and at least link myprog (.o:). But BSD make will only create the object files. There is no final link-step. So we had to include the rule to link the program in the Makefile.

Finally we got it and it looks good now. I/We learned a lot of new things (I learnd a lot about BSD make) ;), but it took us 1-2 hours to understand and fix the problems. Here a list of URLs, that might give some more information about the programs, their syntax and limitations:

• GNU make’ manual
• FreeBSDs make
• Autoconf: Limitations of make

I’ve been playing around with Gallery and wpg2. I’m still a bit puzzled attempting to integrate Gallery and Wordpress. I’ve resolved most issues; the main remaining issue is to display images in the Ajaxian theme without running over the borders in the Ajax/slideshow views. Also, the embedded image apparently doesn’t render in the RSS feed. Update: I’ve given up on the G2 tinymce plugin and the WPG2 tag for now and just hardcoded the image and album URL. Update 2: now the embedded image is working again for no good reason. Suggestions on the entire configuration are welcome. In any case, I took some pretty photos today in our back yard (use left and right arrow keys to scroll through images after clicking on the one below — I still can’t get the navigation icons to appear): Before: Proof of Spring 2007. Technorati Tags: Autumn, Foliage, Trees, Wordpress, WPG2, Gallery

Share This