After fighting with i18n in QML, I've released GePeS 0.3.0. The only major change is that it now can be properly translated, for the first release Czech and Spanish translations were completed, however you are welcome to contribute translations! As usual, new version was submitted to Nokia store, hopefully it will pass QA review before Christmas. You can get sources from GePeS homepage or from Git.

Filed under: English Meego 0 comments Flattr this!

After using identi.ca microblogging patform for 2 years or so, I have recently decided to set up my own StatusNet instance to benefit from the power of federation. The setup is quite easy, but I still have some tuning left. Most of the plugins I have tried (XMPP, realtime and twitter bridge) were very resource intensive, especially for my tiny virtual server, I hence had to disable them. I can live without them. You can now follow my dents on sn.kirya.net. If you were following me on identi.ca, please update your subscription, the account will remain there but I do not expect to use it anymore. The current problems with identi.ca show how important federation and decentralization are. My timeline is very quiet for now though, I encourage more people to setup their own instances.

After using identi.ca microblogging patform for 2 years or so, I have recently decided to set up my own StatusNet instance to benefit from the power of federation. The setup is quite easy, but I still have some tuning left. Most of the plugins I have tried (XMPP, realtime and twitter bridge) were very resource intensive, especially for my tiny virtual server, I hence had to disable them. I can live without them. You can now follow my dents on sn.kirya.net. If you were following me on identi.ca, please update your subscription, the account will remain there but I do not expect to use it anymore. The current problems with identi.ca show how important federation and decentralization are. My timeline is very quiet for now though, I encourage more people to setup their own instances.

Here's the mail archiving script I was talking about: http://github.com/jmtd/detachment. Sorry about the name-pun. There's still a LOT of work to do, but it's useful enough to deploy, with modifications, now. If you set up a way of pushing stuff in a local directory to a remote webserver (ideally behind an SSL certificate and with access control configured) and you have a resolvable hostname for that site, then you can get at your files from most mail/web client combinations, including smartphones. Here's some stats from running it on a sample mailbox: Before

$ du -sh ncl/archive/2010
116M    ncl/archive/2010

After

$ du -sh ncl/archive/2010 bucket
41M     ncl/archive/2010
51M     bucket

Or, approximately 20% smaller. (That's the on-disk usage for the mail and the attachments, now not base64-encoded, and saved to disk). The above folder was a local Maildir copy of a folder on an Exchange mail system, synchronised via offlineimap. Here are the sizes reported by Exchange for the same folder:

• Before: 83991KB (82M)
• After: 25435KB (25M)

Or, approximately 70% smaller. (That's the mails without the attachments counted, which are not in the Exchange server any more). Lots of caveats:

• If you are using offlineimap, you will need to do more than just run this script, or offlineimap may not notice that the messages have changed. Stripping out the U=\d+,FMD5=[0-9a-f] 32 component of filenames seemed to do the trick.
• If you are using Exchange, a copy of the original messages will be retained in your Deleted Items folder. Beware if you are close to your mail quota.
• If you are using Exchange via IMAP, then syncing the results of such an operation might be very slow. The above operation took well over an hour to sync, and I'm only a few hops away from the Exchange server via 100M links.

Recently I had need to re-purpose a server and for convenience, I decided to do a complete wipe and reinstall since it had previously been used for all sorts of package testing, experiments, dak debugging, the list goes on. I took a careful backup and then cooked up some USB installation media, but it took so long to boot (USB1.1, yay) I ran out of time before the building was locked. Since this box has two hard disks, and not being one to back down from a challenge, I eventually reinstalled it over the weekend with nothing no install media, no reinstall robot or intelligent hands just a reliable internet connection and a healthy dose of courage. Here s how. Target: reinstalled machine with the same network settings, ssh host keys, and other minor configuration ported. The disk layout is to be RAID-1 containing LVM, with separate /var volume and separate /boot partition, also RAID-1.

1. One disk in the box contained old data, so I cleared that out and wiped it (including the MBR for good measure) and partitioned it.
2. I set up a degraded RAID-1 array for a small /boot partition, a large RAID-1 array for the LVM and a swap partition.
3. I mounted the new partitions in the correct layout in /mnt and used debootstrap(8) to get a very basic root set up. I also bind-mounted /sys, /proc, /dev and /dev/pts for now, they can be done properly when the root is a bit more mature.
4. Next, I copied into the new root /etc/apt/sources.list and chroot(8)ed into it. Now I could apt-get update and tasksel install standard to get an almost fully-functional base system. At this point it is also sensible to install locales, tzdata and console-data and dpkg-reconfigure them, followed by mdadm and lvm2 if required and openssh-server so you can get back in after rebooting. Some or all of these may already be installed by tasksel.
5. Time to install a kernel before leaving the chroot: apt-get install linux-image-2.6, followed by grub-pc which should detect both installations and set up menu entries for them.
6. Back in the old system, I copied in the network, hosts, resolv and hostname configuration files, and set up /etc/fstab to my liking.
7. Install grub to both hard disks if it isn t already so (dpkg-reconfigure grub-pc) and again check that it detects both installations and creates the right menu entries. At this stage, booting from either hard disk will allow the loading of either the new or old installations, which is exactly what we want. It s now time to umount the new installation.
8. Now I followed the excellent guide for remote kernel upgrades at http://ariekanarie.nl, except in this case we are using the same method to try booting the new system and fall back to the old one if it s a disaster.
9. Reboot and hope!

At this point I rebooted to find myself back in the old kernel, which was disappointing this means the new kernel has panicked and rebooted, and grub has fallen back to the old system (exactly as planned). It turned out there was nothing in /dev at boot time, and udev doesn t start early enough to populate it before panic. That s easily solved by mounting the installation again and using MAKEDEV as a seed.

10. With a bit of luck, you re now in the new installation and can dpkg-reconfigure grub-pc again to install grub to both hard disks again. This isn t strictly necessary, but it records this choice in debconf so future upgrades will automatically upgrade the bootloader everywhere it s needed.
11. Now I could do some tidying up, mount the old installation and copy over all the data I wanted, and after careful checking wipe the first disk clean ready to be added into the RAID arrays.
12. Finally, add the old disk to the RAID arrays so they are fully redundant.

Sources:
http://www.michael-hammer.at/server_config/debootstrap/
http://d-i.alioth.debian.org/tmp/en.i386/apds03.html
http://www.debian.org/releases/stable/amd64/apds03.html.en
https://wiki.archlinux.org/index.php/Convert_a_single_drive_system_to_RAID
http://ariekanarie.nl/archives/211/remote-kernel-upgrade-with-debianubuntu-and-grub2

---

Reinstalling at arm s length is a post from: jwiltshire.org.uk Flattr

29 and counting

Time flies... and very fast.

There are so many things I'd like to share and tell you about but that would make a long and boring post, so I'll divide it in future entries, so I can keep this diary alive, keep people informed and tell a little bit about my story. Eventually, I may split this diary into a technical and a non-technical blog, but for now, I will stick around mixing topics. :-) Last time I wrote was back in 2009 at DebConf9 in Spain and a lot of things happened that year. Not only for Debian, but also for me.


My last year studying Computer Science was 2009 and that same year I was working full time, I helped organizing a large event for Computer Students (ENECOMP 2009), we had some troubles and side effects with Influenza A (H1N1) in my city (Curitiba, PR) and towards the end of the year I got really sick (not from Influenza) and it took a while to know what was going, during this process I did hurt some people I really love and I'm truly sorry. The past, 2010 went on as busy and unstable as 2009, my laptop's hard disk broke twice (January and October) and I survived thanks to backup and recovery procedures. I took some wrong decisions but fixed it later and learned a lot from my mistakes, decisions and choices.


Then 2011 came, my laptop's hard disk broke again and I lost almost 6 months of emails, I find out that after the second crash in 2010 part of my backup got b0rk3d. Fine, I didn't die, everything seems to be fine, but I'm still catching up with a lot of work and backlog. At different times one of my parents also got really sick and I learned quite a bit on how to deal with it.


Due to the laptop and the different things going on in my life I didn't work for Debian as much as I want and I still feel guilty. :-( But that's fine, this is a kind of public apologize for my peers in Debian (i18n, mirrors, release), I still want to help all of you, but I still have quite a bit of backlog to clean and quite a few things to learn in the process. And in general, I'm really sorry if I didn't (or I couldn't) work for Debian as much as I want.


Although I'm taking the chance to apologize in this post, I still want to make clear that I'm quite happy. This last year was pretty good, I had the opportunity to attend DebConf again and also got to know Sarajevo and Zagreb. New lessons were learned, better work cycles, nicer solutions. Today I'm completing 29 years old. 29. This is quite some time, not a long ride, but for one reason or another, I have high hopes for 2012 and what awaits me. And I do plan to learn more, to help more and whenever possible, to contribute back.

Last time I wrote here I mentioned about my graduation and another post to talk about that, I'll write about it as soon as I get my diploma (because of different printing problems it was delayed for almost 2 years). And I do plan to write more frequently. :-)

Google Maps is now mapping the indoors. I saw an ad for this while passing through MSP yesterday (given how much time I spend on the Internet, it's strange and a little embarrassing to learn about new things on the Internet from airport billboards), since one of their initial targets is the infamous Mall of America.

Detailed floor plans automatically appear when you re viewing the map and zoomed in on a building where indoor map data is available. The familiar blue dot icon indicates your location within several meters, and when you move up or down a level in a building with multiple floors, the interface will automatically update to display which floor you re on. All this is achieved by using an approach similar to that of My Location for outdoor spaces, but fine tuned for indoors.

Thoughts about this:

• Okay, having a map of Ikea or an airport on my phone might be kind of nice.
• Shouldn't they have launched this years ago when people still went to malls?
• Shouldn't they have launched this at least earlier in the year, in time for people to know about it and have it before the one time each year when people who don't go to malls still maybe go to the mall?
• How does it know where you are, when cell and GPS so often don't work in these places? "fine tuned for indoors" is a very mysterious phrase. Based on nearby access points?
• Is your location also being transmitted if you use this service? In other words, will Google now know which stores you shop at, how many times you use the restroom, and whether you were actually shopping for gifts for other people?
• Relatedly, will this be free software? Or will it rely on proprietaryness in order to do things users would prefer it didn't do? (Answer: It's proprietary software, part of the existing proprietary Google Maps mobile application.)
• Will they sell data to the stores and malls?
• Will they start indicating various promotions on the maps?
• Will these promotions be targeted based on your past meandering behavior?
• Are they mapping less-commercial spaces, like museums?
• Are they making the map data available for others to use? Especially for truly public spaces?
• How do we get the functional part of this into OpenStreetMap?
• Is Google secretly working on computer-piloted mobility scooters?
• Where am I?

Title from John Ashbery

FOSDEM is one of the largest gatherings of Free Software contributors in the world and happens each February in Brussels (Belgium). One of the developer rooms will be the CrossDesktop DevRoom, which will host Desktop-related talks. Are you interested in giving a talk about open source and Qt, KDE, Enlightenment, Gnome, XFCE, Windows, Mac OS X, general desktop matters, mobile development, applications that enhance desktops and/or web? Hurry up and submit your proposal, deadline is December 20th! There is more information in the Call for Talks we published one month ago. If you are interested in Qt/KDE, come visit us at the KDE booth. If you add yourself to the KDE FOSDEM 2012 wiki page, we will be able to better organize the usual dinner on Sunday and/or smaller meetings for special interest groups .

NoSpamNX and OpenID wordpress plugins don t work properly with each other. Sorry people for calling you spammers, and many thanks for your comments. I ve manually approved everything that NoSpamNX incorrectly filtered, and disabled NoSpamNX for now. Will look for a good replacement.

Since post about lost n900 was on the top of this blog for almost a year, I should probably write a few words about what was next. Since I do need mobile phone every day, I had to get some replacement quickly. Given Maemo was dead and Meego device not available, I decided to go Android. Since after n900 hardware keyboard became a must for me, I decided to try HTC Desire Z. That device made me angry every day, both because of hardware (what a silly idea to place volume buttons such that they are below hardware keyboard when it s opened? they got pressed almost every time when I used keyboard!) and Android itself. I think quite a few things are broken in Android, but most annoying is broken multitasking. I can t live with dialog elements content get lost when I switch to other app and back. Please don t tell me that it s app fault: maybe technically it is, however too many apps have it so I have to generalize. I will likely write more about this later. At the same time, exciting things have been happening in Maemo community. It was the time when Community SSU raised, also several mapping applications went out of dark, and more. I was still subscribed to Maemo resources so I read about all that and got more and more frustrated with my new Android device. And on one sunday evening, after reading more exciting news from Maemo side, I decided that enough is enough. And ordered a new n900. Few days later, I ve sold HTC for about 80% of it s original price. That was an emotional solution, and of course it could not play well in the long term. Despite of individual exciting news, Maemo community was becoming weaker. Device itself had major usability issues (e.g. it could occasionally unlock while being in my pocket, and call a random number from address book and I have quite a few addresses abroad so such calls not only bother people, but also are expensive). There was not many applications, and those available had problems. There was a visible difference between my friends who could just take a phone and quickly do something, and myself who had to struggle with incomplete and buggy software. Also skype quality was very bad. Also when I was planning a 2-week trip to location without mobile network, I tried to preload map of planned route, but it preloaded only part and I was unable to make it preload the rest. Also many similar issues. So it became clear that if I want usability, I have to go to a standard platform. And as such, Android still is the only option. I searched for a device that runs more or less modern Android version, has hardware keyboard, and is not HTC Desire Z. There was not much to choose from. I ordered SonyEricsson sk17i. I m already using it for about 4 months. For common use cases, such as locating a business nearby, or routing to a given address, or quickly browsing a web page, it works. However, all Android flaws including broken multitasking and no-undo-in-text-fields are here, causing everyday frustration. My conclusion is that no smartphone-like devices without major usability issues are available today. What is available probably could be used to somehow satisfy immediate communication needs, but nothing above that. Bells and whistles are there, but I m not interested in those. I want a linux-based pocket-sized mobile computer that will handle both my communication needs and other interests. That could be hacked when I want to, but just works at the rest of time. Something like my Debian desktop. Openmoko was a big hope but it failed. Maemo was a big hope but incompetence of Nokia killed it. Meego was dead before it was born. There is still some life around several mobile linux projects (GTA04, Maemo, Meego, some others), but hopes for it to grow into something that could be used without huge hacking are little.

This year is in its last throes and a few things, that don't really warrant their own blog post, have piled up here. To get them out of the door before 2012 starts, I'd like to go over them in the next few lines. First: there seem to be a group of rather cheap people who want to have the Humble Indie Bundle #4, but don't like to give at least 0.01 USD. Really guys, you seem to have enough money for a fast-enough computer and a (broadband) internet connection (otherwise downloading the circa 2.8 GB of games won't be a lot of fun), but you don't have the 0.01 USD to spare? If you don't like closed-source games (a sentiment I can truly understand, in fact, that was something I really pondered before buying) then just don't play them. But searching for a torrent for the HIB#4 while it is still being sold to just avoid paying the minimal fee, I can't understand. Now, some might wonder how I know this. The easy answer is, I blogged about buying the HIB#4 and mentioned, that I downloaded the games through a torrent (you can choose between direct downloads and torrents on your "login page") and a lot of people started hitting the blog entry with a referrer from a search engine, showing they'd searched for "humble indie bundle 4 torrent". Please make a decision: don't play the games or if you wish to, then pay something. The people behind those games make it easy and, in comparison to many other game studios, a fair offer. That should be worth something. For those of you who loved Josephine, there is a new awesome piece of art, Creative Commons licensed, by An-U (German homepage). The title (and the drawing) are derived from the equally awesome Katzenjammer song "On the Devil's Back" (in case you're still looking for a present, you might want to consider one of their CDs or a ticket to their next concert near you). Then, I wanted to thank all those people, who donated something over the course of 2011! Thanks a lot, especially for showing me, that you liked my services/work enough to even consider a donation! It means a lot to me, to know this. At year's end everybody is doing statistics and while I won't bore you with long in-depth analysis, I thought I throw out, what the top posts/things where (so far). Maybe you find yourself represented in there or maybe you find something new. In no particular order:

• My unofficial wine-unstable packages generated a lot of traffic and back links.
• The mini-tips series had many hits.
• My two posts (1, 2) about the Linux graphics stack garnered a lot of attention.
• The note about removing Sun's Java implementation was the first post to be mentioned in a Debian Project News issue.
• Right after my wine-unstable packages, my post about OSM and OpenLayers generated the most e-mails.
• The YouTube playlist fetcher is also pretty popular, though the Greasemonkey script collection has been picking up speed recently.

I hope your 2011 was a good year and I wish you all the best for 2012! I'm pretty sure Debian will continue to grow, but there is also a lot of work ahead, maybe you can join the effort and make Debian that much more awesome!

DRBD is a system for replicating a block device across multiple systems. It s most commonly used for having one system write to the DRBD block device such that all writes are written to a local disk and a remote disk. In the default configuration a write is not complete until it s committed to disk locally and remotely. There is support for having multiple systems write to disk at the same time, but naturally that only works if the filesystem drivers are aware of this. I m installing DRBD on some Debian/Squeeze servers for the purpose of mirroring a mail store across multiple systems. For the virtual machines which run mail queues I m not using DRBD because the failure conditions that I m planning for don t include two disks entirely failing. I m planning for a system having an outage for a while so it s OK to have some inbound and outbound mail delayed but it s not OK for the mail store to be unavailable. Global changes I ve made in /etc/drbd.d/global_common.conf In the common section I changed the protocol from C to B , this means that a write() system call returns after data is committed locally and sent to the other node. This means that if the primary node goes permanently offline AND if the secondary node has a transient power failure or kernel crash causing the buffer contents to be lost then writes can be lost. I don t think that this scenario is likely enough to make it worth choosing protocol C and requiring that all writes go to disk on both nodes before they are considered to be complete. In the net section I added the following: sndbuf-size 512k;
data-integrity-alg sha1; This uses a larger network sending buffer (apparently good for fast local networks although I d have expected that the low delay on a local Gig-E would give a low bandwidth delay product) and to use sha1 hashes on all packets (why does it default to no data integrity). Reserved Numbers The default port number that is used is 7789. I think it s best to use ports below 1024 for system services so I ve setup some systems starting with port 100 and going up from there. I use a different port for every DRBD instance, so if I have two clustered resources on a LAN then I ll use different ports even if they aren t configured to ever run on the same system. You never know when the cluster assignment will change and DRBD port numbers seems like something that could potentially cause real problems if there was a port conflict. Most of the documentation assumes that the DRBD device nodes on a system will start at /dev/drbd0 and increment, but this is not a requirement. I am configuring things such that there will only ever be one /dev/drbd0 on a network. This means that there is no possibility of a cut/paste error in a /etc/fstab file or a Xen configuration file causing data loss. As an aside I recently discovered that a Xen Dom0 can do a read-write mount of a block device that is being used read-write by a Xen DomU, there is some degree of protection against a DomU using a block device that is already being used in the Dom0 but no protection against the Dom0 messing with the DomU s resources. It would be nice if there was an option of using some device name other than /dev/drbdX where X is a number. Using meaningful names would reduce the incidence of doing things to the wrong device. As an aside it would be nice if there was some sort of mount helper for determining which devices shouldn t be mounted locally and which mount options are permitted it MIGHT be OK to do a read-only mount of a DomU s filesystem in the Dom0 but probably all mounting should be prevented. Also a mount helper for such things would ideally be able to change the default mount options, for example it could make the defaults be nosuid,nodev (or even noexec,nodev) when mounting filesystems from removable devices. Initial Synchronisation After a few trials it seems to me that things generally work if you create DRBD on two nodes at the same time and then immediately make one of them primary. If you don t then it will probably refuse to accept one copy of the data as primary as it can t seem to realise that both are inconsistent. I can t understand why it does this in the case where there are two nodes with inconsistent data, you know for sure that there is no good data so there should be an operation to zero both devices and make them equal. Instead there The solution sometimes seems to be to run drbdsetup /dev/drbd0 primary - (where drbd0 is replaced with the appropriate device). This seems to work well and allowed me to create a DRBD installation before I had installed the second server. If the servers have been connected in Inconsistent/Inconsistent state then the solution seems to involve running drbdadm -- --overwrite-data-of-peer primary db0-mysql (for the case of a resource named db0-mysql defined in /etc/drbd.d/db0-mysql.res). Also it seems that some commands can only be run from one node. So if you have a primary node that s in service and another node in Secondary/Unknown state (IE disconnected) with data state Inconsistent/DUnknown then while you would expect to be able to connect from the secondary node is appears that nothing other than a drbdadm connect command run from the primary node will get things going.

Damn those unshaven yaks I m trying to write a Nagios plugin for work that will comprehensively monitor network interfaces and make sure they re up, passing traffic, all those sorts of things. Of course, I m doing it all in Ruby, because that s how I roll. So, I need to Know Things about the interface. Everyone does that with ethtool. Right? Sure, if your eyeballs are parsing it. But have you ever tried to machine parse it? To put it as eloquently as possible:

# ethtool eth0
Settings for eth0:
 Supported ports: [ TP MII ]
 Supported link modes:   10baseT/Half 10baseT/Full 
                         100baseT/Half 100baseT/Full 
                         1000baseT/Half 1000baseT/Full 
 Supports auto-negotiation: Yes
 Advertised link modes:  10baseT/Half 10baseT/Full 
                         100baseT/Half 100baseT/Full 
                         1000baseT/Half 1000baseT/Full 
 Advertised pause frame use: No
 Advertised auto-negotiation: Yes
 Link partner advertised link modes:  10baseT/Half 10baseT/Full 
                                      100baseT/Half 100baseT/Full 
                                      1000baseT/Half 1000baseT/Full 
 Link partner advertised pause frame use: No
 Link partner advertised auto-negotiation: Yes
 Speed: 1000Mb/s
 Duplex: Full
 Port: MII
 PHYAD: 0
 Transceiver: internal
 Auto-negotiation: on
 Supports Wake-on: pumbg
 Wake-on: g
 Current message level: 0x00000033 (51)
 Link detected: yes

Parse that, bitch!

Or perhaps not. At any rate, I decided that it would be most advantageous if I went straight to the source and twiddle the ioctl until it did my bidding. And thus, about 5 hours later, was Rethtool born. Once I worked out a less-than-entirely-crackful way of dealing with C structs in Ruby (after a bit of digging around, I went with the appallingly-undocumented-but-sufficiently-featureful CStruct), and after I finally worked out I was passing the wrong damned struct to ioctl(SIOCETHTOOL) (speaking of appallingly-undocumented: fuck you, ioctl, and all your twisty-passages children), it was smooth sailing. So, if you re one of the eight or so people on earth who will ever need to get at the grubby internals of your network interfaces using Ruby (and can t do it via some sysfs magic), Rethtool is for you.

What are the biggest security threats to my laptop? Almost all the software I install is vetted and signed by a member of the Debian team. I run reliable virus software on our mail server. My disk is encrypted and xscreensaver locks my screen after a few minutes of inactivity. What else? The two biggest threats I've recently considered are: web browsing and non-free software or software that doesn't come from Debian (I regularly have to use skype and zimbra, for example). To mitigate these risks, I've configured these programs to run as their own users, thus adding a layer of separation between the programs and my primary user account, which has access to my gpg/ssh keys and email. With a program like zimbra it's fairly easy. I created a zimbra user, added my primary account's public ssh key to /home/zimbra/.ssh/authorized_keys, and add the following stanza to ~/.ssh/config:

Host zimbra 
Hostname localhost 
User zimbra 
ForwardX11 yes

Now I can start zimbra with:

ssh zimbra ./zdesktop-launch

Skype was a little harder, since the skype client has to access the audio system. With pulseaudio, though, it's a snap. I copied /etc/pulse/default.pa to ~/.pulse/ and added the line:

load-module module-native-protocol-tcp auth-ip-acl=127.0.0.1

Then, I added /home/skype/.pulse/client.conf with the contents:

default-server = 127.0.0.1

[Note: Jamie Rollins and dkg have pointed out that this arrangement allows any user on my laptop to send arbitrary data to pulseaudio, running as my primay account. They suggested configuring pulseaudio to listen on a unix-domain socket, and then configuring pulseaudio to only permit access to users in a particular group.] iceweasel is the most complicated. In addition to the pulseaudio trick, I had to make two other allowances. First, there are a lot of processes that launch a web browser in a number of different ways (sometimes asking for a new session, other times adding a tab to an existing one, sometimes passing an URL as an argument, etc). The one that I got the most stuck on was mutt. Sometimes I want to see how an HTML message looks in iceweasel. Via mailcap, mutt creates a temp file with the html content and then launches a web browser to view the file. As can be reasonably expected, this temp file is owned by my primary user, and only read-able by the owner. That means my iceweasel user can't read it. Eventually, I decided the easiest way to deal with these various scenarios was to write a simple bash script to launch my web browser (see below). I registered it via update-alternatives, so most reasonable programs that want to launch a web browser will use it. The second issue is that I use the monkeysphere xul plugin to verify TLS certificates, which requires iceweasel to communicate with my monkeysphere validation agent. My agent runs as my primary user and by default only responds to queries from my primary user. Fortunately, monkeysphere is well-designed and can handle this situation. As you can see from my web launcher script, I pass MONKEYSPHEREVALIDATIONAGENTSOCKET=$MONKEYSPHEREVALIDATIONAGENTSOCKET when calling iceweasel. In addition, I added the following before I exec monkeysphere-validation-agent:

export MSVA_ALLOWED_USERS="iceweasel jamie"

With this simple infrastructure setup, it's possible to easily isolate future programs as well. Lastly... here's the script for launching iceweasel.

#!/bin/bash
stdin=
new_session=no
url=
for arg in "$@"; do
  if <span class="createlink"> &#34;&#36;arg&#34; &#61;&#126; &#94;-- </span>; then 
    if [ "$arg" = "--new-session" ]; then
      new_session=yes
    elif [ "$arg" = "--from-stdin" ]; then
      stdin=yes
    fi
  else
    url="$1"
  fi
done
if [ "$stdin" = "yes" ]; then
  temp=$(mktemp)
  while read line; do
    echo "$line" >> "$temp"
  done
  # it must be readable by the iceweasel user
  chmod 755 "$temp"
  url="file:///$temp"
fi
args=
if [ "$new_session" = "yes" ]; then
  args="--no-remote -ProfileManager"
fi
if [ -n "$url" ]; then
  args="$args '$url'"
fi
ssh iceweasel "MONKEYSPHERE_VALIDATION_AGENT_SOCKET=$MONKEYSPHERE_VALIDATION_AGENT_SOCKET iceweasel $args" &
[ -f "$temp" ] && sleep 5 && rm "$temp"

Comments by email... Hi, http://current.workingdirectory.net/posts/2011/privilege-separation/ has good intentions but afaik it does not improve security much. X applications can sniff your passwords and inject commands to your terminal emulators. I personally use xpra to get a similar solution without the hazards of X. I've been using it for two months now both at work and home. There are still bugs but svn version is getting better all the time. See for example my reply to https://grepular.com/ProtectingaLaptopfromSimpleandSophisticated_Attacks Timo

Yesterday I bought my copy of the Humble Indie Bundle #4. And while the donation part is a good thing, I directed most of my payment to the developers of the games to allow them to make more games, which run natively on Linux. I haven't played much yet (no time) and just tried out the game for which the Torrent finished first (Bit.Trip.Runner). The nice thing about that game is, it is available as a Debian package, the not-so-nice thing about said package is, that it installs stuff in places where it shouldn't and has tons of wrong file properties like ownership of the files... The Depends line is also more or less pointless, as it just lists the needed packages, but not the minimal versions. Hopefully these things will be fixed in a future package version. Apart from that, the game in its retro look is sort of addictive. Yes, it's "just" simple Jump'n'Run, but it is a lot of fun to play. Partly because you "play" a simple melody, when you clear obstacles and collect the gold and other goodies. Anyway, long story short, if you want a few nice DRM-free games running natively on Linux (in my case with the Mesa3D drivers for my Radeon), I can recommend this bundle. And maybe the games get open-sourced in the future as has been done previously. None of these games are so called AAA titles, but that doesn't mean they can't provide some fun hours. And to top it off you don't need Wine or something else to run them on your Linux system.

Today QApt was accepted into Debian's archives. It took me some time, in fact a lot more than I hoped it'd take, to get the final pieces into place [UPDATE](the inital work was done by Jos , the co-maintainer of QApt)[/UPDATE], but now you're able to use QApt as a simple-to-use wrapper around the whole APT, DPKG and Xapian stack. The target users are C++ programs using the Qt framework. The use cases range from graphical package manager to allowing easy updates of certain packages from within another program. My interest in QApt comes from me being co-maintainer of Kingston, the update notification Plasmoid for KDE. We have a wishlist bug open against Kingston, requesting the addition of a "do update" button. We could have used the update-manager infrastructure, but both Sune and myself weren't too thrilled with that. Luckily there is an alternative in the form of QApt. I'll hope I find some time during the next weeks to implement the update mechanism for Kingston. The next things to come for QApt will be minor cleanups, already waiting in Git, a new upstream bug fix release (no date is set yet) and a multiarchification (already partly done in a local branch).

Hello Following the suggestions provided after my post What name for Config::Model s new command line ? cfg or something else ? , I ve considered cmc and cme as a good candidates. But, cmc is used by a C mol compiler software (don t ask me what it is ). cme is also a very good name. So the winner is cme Next version of Config::Model will provide /usr/bin/cme. The old config-edit command will be provided for a few months to preserve backward compatibility. Thanks to all people who took the time to reply All the best

When I started using Linux, I started with a desktop environment (KDE) and then tried a lot of (standalone) window managers, including but not limited to Enlightenment, Blackbox, Fluxbox and Sawfish. But I was never really satisfied as it felt as if something was missing.
It then came, that I became a user of a desktop environment again. Now I have been a GNOME user for at least five years.

gsettings set org.gnome.desktop.session session-name 'gnome-fallback'

This is not about any real or alleged might of (private) rating agencies you know, the ones roughening up the financial markets these days. Given the recent influx of news about downgrades of banks and nations, I simply start to wonder what will happen when the triple-A category empties out (which it will the last few nations will be ejected as a consequence of currency explosions (CHF) and forced bailouts of others (EU). Will the whole circus start anew? And if so, why do we even pay any attention?? Gosh do I wish that people started to form their own opinions again. NP: Fila Brazillia: Power Clown

Etherpad is an excellent Open Source web application for collaborative text editing. Like Google Docs, it allows you to share documents with others through a secret URL or to set up private documents for which people need a login.