Continuing a trend of upstream control-freakery, the author of Ion has claimed Ion and Ion3 as trademarks and set out a trademark policy that will require Debian to rename it. I've created a poll for selecting a new name.

...like this one today, where you feel like just waking up is a bad idea. Reading about the so-called "triumph" of Sarkozy (53.06%), seeing the right-wing and capitalist newspapers "celebrate" it makes me sick and sad. Hearing about the french socialist "elephants" (Strauss-Kahn and the Laurent "just naming him makes me sick" Fabius) trying to place themselves in position to lead the French left makes me even more sick. The worst is probably hearing Sarkozy claim that he will "renovate" the French politics. He is president of the UMP party since 2004, UMP being the party of the former president (Chirac), the former two prime ministers and having the absolute majority in the parliament. He is Nr. 2 of the french government since two years. So, in short, he and his party had all opportunities to "renovate" since they are in power. Since 2002, UMP has the largest majority one has ever seen since 1968 in France. And of course, nothing was "renovated" in French politics and way of government since then. France just slowly turned towards hard-core liberalism and the power of money and stock exchange market. So, noone will make me believe one single second that anything will change. The opportunity to change things was clearly in the hands of Mrs Royal, not in the dirty hands of Sarkozy. This is why I'm sad today.....hopefully, I'll be able to share this with my friends in Free Software. I just hope that the french ones are prepared for very hard days.

Unfortunatelly, Mr Sarkozy winnig these elections does not come as a total surprise. Still it is not something you have to passively accept. You still have a democracy. What is needed now is a strong and watchful opposition, in and outside the parliaments. Remain alert, protect and defend your R publique and the rights its residents have! We're with you! Best,
Meike

Pete Nuttall rants about how online shopping sucks. I agree that it has problems, but the core ones are perhaps not the problems he identified. Pete argues that while "in a real shop, you hand them their goods and they carry it away", fulfilling an order is much harder for online retailers. It is, but it can also be much easier for a shopper, especially if you want to buy something not available locally. But a real benefit of online shopping is that delivery happens asynchronously; that you don't have to hand the customer their product on their way out the door. This lets my sister find native plants on her property, put them up for sale, and only dig them up when she gets an order. It lets Cafe press and many smaller outfits create customised products on demand. It lets me shop at 2 am. Asynchronousity is good. Pete thinks that needing to have a paypal account is a problem, comparing it to needing to open a new bank account to make a purchase. Of course, this ignores the fact that once you get the account, you won't want to buy from many online merchants who don't accept paypal. As someone who's worked on credit card processing backends for random online merchants, I know that I don't want to give my credit card account to a random merchant if I can avoid it. This, coupled with the ease of use of not needing to enter all my purchase information every time, means I'll chose a merchant who accepts paypal over one who doesn't, nearly every time. The real problem is that both online shopping and payment promote centralisation. There's a pull toward centralising as much shopping as possible in one mega-site, because customers come to trust that site, and understand how it works. That's why there is only one amazon, and only one ebay (effectively). Handling payment is even more centralised, with just a few credit card companies and paypal. And I think that the problem underlying that is that our model of payment is all wrong. It's based on money immediately changing hands, with an overlay of a promise of payment; it should instead be based simply on a binding promise of payment. A merchant expects to get money transfered to their account as soon as the credit card processing goes through. That money really comes from the credit card company, based on a customer's promise that they will pay back that credit. The customer indicates this promise in the most stupid way possible: By entering a sequence of numbers that only they are supposed to know, but that is not unique to that purchase. As I've said before, it should be technically possible to kick out the credit card middlemen, and make payment much simpler and secure by changing the buyer's promise of payment into a legally binding, unique, cryprographically signed message that's sent directly to the merchant. But for this to happen, we'd have to change the model of payment, so that merchants don't expect to get money immediately, but instead asynchronously (the same as they ship things out asynchronously). Even harder, we'd have to somehow interest companies in supporting that. Since companies almost always prefer making money by promoting centralised systems, I don't have much hope of this happening anytime soon.

Dan has been complaining I haven't been ranting enough lately. I have been waiting for the Scottish elections to sort themselves out, because thats a nice mess and easily due some ranting. However, given the need for a placeholder, I wrote this little moan on the subject of internet shopping. Everyone knows that the future of shopping is online. Every year, more money is spent online. Christmas last year was marked by getting a few parcels a day from amazon. However, I find it fraught with all things of annoying problems. Over the last few days, I have attempted to buy a t-shirt and a bottle of whisky online, while buying a pair of sandals and a book offline. While the wo aren't the same, it was still instructive as to the problems of internet shopping. Taking money from shoppers. To actually take money from people has to be the most important part of running any sort of shop. However, it is someone hard for me, the shopper, to give websites my money. Consider the example of Geekz Shop. To pay them, it appears I need to have a paypal account[0]. On examining the paypal signup page, I see references to the FSA. While its good that Paypal are actually registered and regulated these days, it does strongly suggest that they are a bank, and as such opening a account with them is the same as opening a bank account with HSBC or someone. In other words, I need to open a new bank account just to buy a t-shirt. Thats a lot of hoops to jump though. In their defense, they did offer a collection of other ways to pay when emailed about it, but its still a lot more work than walking into a shop and giving them cash. In more general terms, as a shop, its important to make it as easy as possible for your customers to give you money. Its common to outsource this to someone else, but any general solution serving lots of sites will suck[2]. Of course, doing it yourself means you are stuck dealing with credit cards - which is a pain, or BACS which is a joke. Oh well. The next issue you have is giving people their goods. In a real shop, you hand them their goods and they carry it away (massive generalization). Unless you are selling somthing completely electronic, for example domains, then you have to get the goods to the person. Once again, running your own service is hard - far harder than your own online payment system. However, it and your website is the thing people see of your shop. The classic problem is late delivery. You have to make some sort of claim as to when goods will arrive, but getting it wrong will result in arguments. My best example of this is a christmas present bought off amazon last year - it arrived in January, despite amazon's claim of having it to me before christmas day. The other classic example of getting it wrong is the apple store. It doesn't quote a delivery time - instead it quotes a "ready to ship" time. This is the time needed for apple to put your purchase in a box and stick a label on it. The problem with this is that your poor customer thinks that his new mac is going to show up in a couple of days. It doesn't, so he is massively disapointed. You've disapointed the guy before your product has left your warehouse. Thats one step aay from employing a bouncer to beat your customers when they leave your store. Having thought that delivery problems are an issue, consider people returning stuff. If its hard, they just moan at their credit card company. If your support and sales folk are in a call centre and can't be reached, then they spend the next week explaining to their mates about how dire you are and why they would sooner deal with the devil than you. Oh, and neither email nor rt is a way to deal with this. The final problem with most online shops is usability. Usability is hard - full stop. Its harder to sell something when the customer can't pick it up and feel it. While some shops are quite good, the number that force me to think when filling out the checkout forms or looking for products is amazing. Its like they don't want my custom. From this, I have claimed that a good online store needs a good way to take money off customers, a good way to get goods to customers, a sane way to deal with problems and a usable website (Next week, I'm going to blog about how water is wet). However, lots of sites, including big ones, fail at this. I don't think internet shopping is going away, but I do think that the shops that fail to take money off folk, that have sites that can't be navigated, that give goods to couriers who "lose" them, will go out of business. I hope that most shops steadily improve on these areas, just so I spend less time being pissed off at them BTW: this post was inspired by my mother's attempts to buy photos of my graduation online (no - it hasn't happened yet). The site in question was apparently so confusing that she has given up and has asked me to buy them. Sorry for ranting.

• [0]: Yes, I know it says you don't need one. Try making a purchase. I did mail them about this problem.
• [2]: Show me a payement site that doesn't suck and I'll show you one that you don't use.

Learn to bake!



Chicks dig it! On popular demand: The (German) recipe. Special hints from the baker: don't make the milk too hot, that'll kill the yeast. Also put the yeast-milk-flour mixture in a sufficiently large dish to avoid extra cleaning work. (A regular coffee cup is too small!)

Originally posted on 2006-04-16. Clarification 2006-04-19: The misfeature discussed below applies to feeds only, as far as I know, not to regular HTML serving. Update 2007-05-06: I have just learned that the option in question is Activate strict RFC2616 RSS-Feed compliance. I have no idea when it was added. While investigating (wearing my hat as the Planet Haskell editor/technician) John Goerzen’s Planet floods, I stumbled on a very strange misfeature in Serendipity. A HTTP/1.1 client can ask a server to send a file over only if the file has been modified since some date. What Serendipity does is send only those entries dated after the provided timestamp. Now, this might seem like a triviality, but it isn’t. The HTTP/1.1 feature is there to make proxy caching work. It is very important for caching that the file sent is the same, regardless whether the request is “since this timestamp”, or a regular request. Serendipity’s behaviour breaks this very important caching invariant! What’s more is that Serendipity’s developers seem rather proud of this misfeature. While the feature this misuse of HTTP/1.1 is intended to create is certainly useful, it should be implemented as a separate mechanism, and not by misusing HTTP/1.1 caching! (A separate protocol is probably necessary, perhaps specifying a URI query syntax for this is enough; obviously, one needs to get the aggregators to support this.) Serendipity will apparently have a configuration option to fix this, but it will be off by default. Serendipity users, upgrade (as soon as it is possible) and mark that option On, to remain compatible with the rest of the Internet.

Traveling on the road? Want food off the interstate highways? Check out road food.

It looks like there are still a few spare beds in the hostel block booking for DebConf. So if you don’t have sponsored accommodation for DebConf, but would like to stay with other DebConf attendees, write to accommodation@debconf.org now. The spare beds will be allocated to people in the order emails are received; the price per night will be £12 (currently €17.60), which is a special reduced rate due to our large bookings.

/usr/arm-linux-gnu/arm-linux-uclibc/include is the place where the party is at, it seems. Time to hack dpkg-cross. Also, preferences for the name schema for MMUless systems are solicited. My favourite is "armelnommu" & co.

A couple of hours of today went on dealing with the effects of a big spam attack on a managed server. One user had installed the Joomla ExtCal component on their web site, while another reported that email was running slowly. The attacker was exploiting com_extcalendar/admin_events.php to send spam and trying to send 9000 emails meant they hit the maximum permitted sending rate quite quickly. As soon as I spotted it, I shut down outgoing mail, killed the sending process, disabled the exploited site and component, cleaned the spam from the queue and restarted mail. I'm searching the rest of the server for any other com_extcalendar installations and then I should contact the other exploited servers I've seen during this attack. It looks like there's an entire class of evil "Mambots" out there, using exploitable Mambo and Joomla sites to crawl in search of others. I don't think the exploited site's owner will be billed for the clean-up, because I can't find a security advisory for this. Neither the mambo site (whose site search doesn't work for me) nor the joomla site seems clear about security alerts. I didn't find a third-party advisory that was clearly about this (but there were a few maybe-relevant ones). The homepage at Mambo last released in 2005 and doesn't mention this in its release notes, while the homepage listed by Joomla 404s (and I don't enjoy using the Joomla site because, as it says,

"we are aware, and regret, that our website does not comply with many WCAG/508 requirements"

). If you are using com_extcalendar on your site, check whether it's safe, or replace it with a better calendar.

This looks like random blabbering, right? A very specific random blabbering that has somehow appeared in blogs of at least tens (if not hundreds, maybe even more) blogs of techies all over the place. What is it?
For the more tech-friendly readers, it has some resemlance to a number - a long number, a 32128 bit one. And for those of you who are not Computer Science minded, you might actually prefer to see it as a simple base-10 (that means, decimal system) number: 13'256,278'887,989'457,651'018,865'901,401'704,640. I don't know how to spell it in English, but I do in Spanish (why? Because we have this difference: In Spanish, a billion is a million millions, and a trillion is a million billions - unlike English, where a billion is a thousand millions and a trillion is a thousand billions). So, lets do the excercise in Spanish:
Trece sextillones, doscientos cinuenta y seis mil doscientos setenta y ocho quintillones, ochocientos ochenta y siete mil novecientos ochenta y nueve cuatrillones, cuatrocientos cincuenta y siete mil seiscientos cincuenta y un trillones, dieciochomil ochocientos sesenta y cinco billones, novecientos un mil cuatrocientos un millones, setecientos cuatromil seiscientos cuarenta
Hah! I guess my fifth-grade teacher would be quite proud of me!
Now, I hereby pronounce my transcription of this utterly long and basically random-generated number into the beautiful Spanish language copyrighted by me, and publicly available under the Creative Commons Attribution-ShareAlike 3.0 Unported License, as it is a very valuable and hard literary work.
But, really, what is it? Well, this mindboggingly long number is the key with which most HD-DVD movies processed so far is encrypted with. Of course, the Motion Picture Ass. of America (MPAA) does not want this (again, randomly generated) number to be out there in the wild, so they say the number is copyrighted by them - This does not hold up, as it has been widely shown before (i.e. Intel dropped its 286/386/486 numbering scheme because a number is not copyrightable or trademarkable - and AMD was perfectly able to legally sell 386/486 chips). So, I have put more work into this number than what they have. I deserve the credit - the transcription is mine. Use it freely.
Oh, and of course, some more examples:

• Spell it with pictures!
• Bumper stickers!
• You like Flash-based content, or you use youtube-dl like I do? Enjoy the forbidden number song - Oh-nine Eff-nine!

[update]: Yes, sorry, I was counting with half of my brain shut down and the other half brain trying to fetch some coffeine, or something like that. It's a 128 bit number, not 32!

Alex Krupp talks about cell phone software and why it's not working These are good points, but I remain pretty certain that it will be an area that takes off. I think that, as things stand right now, some of the ingredients are:

• Discard what you know about what an application should be like. I think a lot of people approach things with an idea that might work on the web or a desktop, and "whittle it down" some. I think the best cell phone apps will be things that are created from the ground up with the cell phone environment in mind. For example:
• Radically simple. It has to be super simple and easy to use. You should get the basic functionality from it within one or two clicks of opening it (consider that the user already had to click 3 or 4 times just to open your application in many cases).
• By making an application that's radically simple, it becomes easier to port it to all the many phone platforms out there. If you aren't doing much that's fancy, you're not likely to run into strange limitations.
• The advantages will come from what makes mobile phones convenient: the fact that they are portable and can basically do simple network access all the time.
• Since it's networked, build applications that are half mobile, half on the web. Complicated interaction goes on the web, and the mobile portion does "the simplest thing that could possibly work".

My own simple example of an application that basically meets these requirements is a mobile shopping list (with the highly original name of ShopList that doesn't suck. By that I mean that you would either be already insane or be insane in short order if you tried to enter a shopping list into a phone via its keypad, so that is taken care of on the web. Sure, it's not a billion dollar startup idea, but I think I'm on the right track with how to create applications and what sorts of things to create.

There is a lot of graffiti in Edmonton I like and this is one is one of my favorites. (Oilers are the local hocker team that have, in the past, kicked some serious NHL butt).

When reading this number

09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0

I thought it was the fingerprint of a GPG key.The first time I came across it, it was encoded in a puzzle; not a particularly difficult one (what key is inbetween of F8 and F10 on your keyboard?).Turns out that this number can be used to decrypt most HD-DVDs produced so far.No, you can't really think you have a copyright on this number? You could have it as a registered trademark, I guess. But I think everybody will be using it to refer to you. :-)From a crypto point of view, it was just a matter of time until this number leaked out. And in fact, the HD-DVD encryption was designed to handle this cases (but it wasn't used correctly). Face it: cryptographers have been telling you right from the beginning that your encryption will be broken by it's very nature (remember: you are shipping decryption keys worldwide in your HD-DVD player devices).[Update: others thought it might be an IPv6 address maybe?][Update #2: Google thinks there are about 300k pages with this number. Maybe we can stop this meme now? :-)][Update #3: it was pointed out to me that nobody claimed to have copyright on this number, but that it is a device to cirumvent encryption and thus violates the DMCA. And that this is similar to distributing magic markers that could be used to 'crack' a famous CD protection used by Sony some time ago...]

I just received a fund raising email from Lawrence Lessig who is trying to raise money to support the isummit conference to be held in mid-June in Croatia. The goal is to raise $ 100,000 which will be matched by some anonymous donor. I hope that they are also trying to meet the challenge of getting a few ladies on board as keynote speakers because so far they don’t even have one and there are barely any as workshop organizers. Oh hey, but at least someone noticed on their website. Along with the cash, maybe they need to raise some “awareness.” I know I sound like a broken record when it comes to this issue, but the record is broken…

Phil Sung's A guided tour of Emacs is now up on the Emacs homepage at gnu.org. It's a nice introduction to the many faces of Emacs and it also shows off several new features in Emacs 22.

By the way, if you were wondering why emacs-snapshot isn't being updated in sid anymore, it's because it's now maintained outside Debian; I asked for its removal from the archive a while ago.

Blogging Feminism: (Web)Sites of Resistance

As blogging has more widespread interest, especially vis- -vis electoral politics, feminist activity on the internet has remained marginal to the mainstream. Thus, we were thrilled when Gwendolyn Beetham and Jessica Valenti proposed “Blogging Feminism: (Web)sites of Resistance” as a Scholar and Feminist Online journal topic, as well as a theme for a Barnard Center for Research on Women panel discussion. As Beetham and Valenti point out in their introduction, all too much feminist activity exists in the blogosphere invisibly. This theme runs through many of this journal’s contributions, and is taken up directly by Clancy Ratliff and Tedra Osell in the section entitled “Women and Politics in the Blogosphere.”

A couple of months ago I was sitting in a north Sydney pub cradling a beer with the ineluctable jdub, the decidedly unparsimonious rusty and (if I’m accurately remembering who’d left and who hadn’t by this point) the irremediable mrd. As you might imagine, these sort of conditions are a perfect breeding ground for a particular type of discussion, and with Jeff’s departure from Canonical not that long beforehand accompanied by the then ongoing DPL elections, talk turned to the future of Debian, and in particular Jeff’s views on that future. Obviously more than a few weeks have passed since then, so please imagine this as a dream sequence with a stylish TV fade-in accompanied by appropriate fine print caveats about paraphrasing and the perfidy of memory. I think it’s fair to sum Jeff’s main point about the future of distros as one of “disintermediation” – that is removing, or at least minimising, the barriers between the authors and users of a piece of software, and in general getting closer and quicker collaboration between everyone involved and interested in developing and maintaining that software. Which means things like trying to remove the line between the Debian bug tracker and upstream bug trackers entirely, so that Debian users end up talking directly with the upstream maintainers, rather than having a Debian maintainer relaying information between the two. It also means making the path for updated packages to get to users quicker and smoother – so that as soon as a developer commits a new version of the software to version control, the next time users of that software “apt-get update” they see it, download it, and start using it. Or at least, they do if they’ve chosen to follow the bleeding edge. Jeff had a bunch more ideas in that vein – like not bothering with a central archive, but having users collect the packages they’re interested in from upstream sites all over the place, standardising, reducing or removing the “control” information for packages so that creating the correct packages for 80% of free software (that uses ./configure in the usual way, eg) was a complete no-brainer, and perhaps viewing distributions not so much as the gatekeepers and central players of the open source world, but perhaps more as systems of providing resources, assistance and opportunities to software authors who deal with their users directly – and in so doing have more of an opportunity for their users to actively participate in the project’s development, and have more feedback (and control) of how their project is perceived by its users. I’m not sure if I’m doing it justice – it’s a pretty radical notion, and as an upstream-type hacker, Rusty was pretty enthralled by it. As a distro-type hacker, on the other hand, I’d have to say I was daunted: getting rid of the middleman here means getting rid of Debian, which I must admit I have something of an attachment for… and yet, in principle at least, I can’t see anything but good sense in the idea – getting users and developers interacting more closely is important to improving the free software community, and while distros have historically been a force for making free software more accessible to people, it’s entirely possible we can now make it even more accessible now by, in some sense, doing away with distros. And if that’s the case, then we definitely should, because it’ll benefit both users and developers of free software, which is what we’re all about. On the other hand, distributions (at least currently) aren’t just about collecting and compiling software which could be automated; it’s also about integrating it, standardising interactions between software, and in some cases acting as a buffer between users who want to use a bit of software and developers who for one reason or another don’t actually want to deal with those users (perhaps due to lack of a shared language or political or philosophical disagreements). I think it’s also pretty interesting to view Gentoo through this light; that is, not so much as a distro that makes you compile everything from source, but rather as a distro that gives its users a system based on exactly what the developers produce, with the addition of only a comparably tiny amount of Gentoo-derived content. Maybe it’s just me, but Gentoo sounds a lot more interesting to me in that light. So is that a foretaste of the future of binary free software distributions too? There’s a lot of things that would stand in the way of Debian managing that, but so far all I can think of is a thousand problems that should probably be solved anyway, and not even one that can’t. I think, btw, that jdub had been reading Accelerando (also available as a Creative Commons licensed ebook) somewhat concurrently with thinking about this stuff, so perhaps it should be called “Distributions 2.0” or something. Accelerando’s a crazy-awesome near-future/singularity book by Charles Stross, who happens to live in the city that will host the forthcoming DebConf 7…

I'm currently setting up a drupal-based site. While it's working pretty well and has allowed me to get most things done that I needed doing, there's one remaining issue that would need resolving. I tried asking for suggestions on the drupal support mailniglist and on the #drupal-support channel on freenode, but I haven't received a solution thus far. Hopefully someone reading one of the planets I'm on knows the answer. The site would need to be multilingual. That is to say, not just the interface, but also all static content and some of the nonstatic content would need to be translated in two (at first) languages (perhaps more will follow in the future). Using the i18n drupal module, I have been able to create alternate-language versions of some nodes, and enable a language chooser, allowing a visitor to choose a different content language for the site and seeing the site translated. However, there is one issue that needs to be resolved: the menu. The i18n.module does not create an alternate version of a translated node; rather, it creates a new node. This node then is linked to the original node by way of some extra table that the i18n.module installs. As such, both versions of the same content will have a different node number. To give a concrete example, the Dutch version of the "about" page on the site I'm creating is node/2, whereas the English version is node/10. Since you might want to review the English version of a node even if you request the site in Dutch, you do not unexpectedly get the Dutch version anyway if you request node/10. Since the node number is part of the URL of the node, this makes it impossible to create a link to "the about node, in whatever language is appropriate". The i18n module also comes with a "i18nmenu" module, which allows one to translate a menu item's description using gettext. This works, but it has one fatal flaw: it does not allow to change the target of the link. As a result, and given the above, it's impossible to create a menu item for "the about node in the current language, whatever that means". In an effort trying to work around that issue, I've come up with a number of things. Unfortunately, none of them seem to work to satisfaction.

• Create a URL alias, including the language prefix that gets added by the i18n module, and then link to the version without that language prefix from the menu: suggested by the i18n module's documentation, this does work, but has the problem that the menu system then doesn't detect that you're viewing the content which the menu has linked to. As a result, child menu entries don't get expanded, which I would need (my menu would get too convoluted if everything would be visible from the onset).
• Create a custom_url_rewrite function to change the target of the URL alias depending on the value of the $locale variable (which contains the current interface language). Turns out that this breaks the language prefix (i18n.module installs its own custom_url_rewrite function). Efforts to change my function or the i18n version of that function to change in such a way that both translations are done have failed; they seem to confuse drupal in some way. This is possibly due to the fact that the custom_url_rewrite function in i18n.module only performs one end of the translation, while my needs require both ends; I don't know enough about drupal to figure out how i18n's other side is implemented.
• Create something which will actually search for articles, in such a way that it is guaranteed that it will only return one article (e.g., by using a special taxonomy term or some such), and link to that search from the menu. This works, but only returns the teaser version of the page, requiring users to click a "read more"-type of link, which is not what you'd expect from a menu system. Ensuring that nodes to which we'll link from the menu are created so that they don't have a teaser isn't desirable, either.

At this point, I'm effectively out of ideas. If anyone has a solution (or can tell me why it isn't possible), I'll gladly hear it, either as a comment on my blog or by mail on w@uter.be.