It seems to me like basic business common sense not to attack your software’s users, because they’re people who might fund your future development work, when they want some new feature adding or some adaptation making. We should hope that this audience will become co-promoters, co-developers or co-producers of free and open source software in the future. Indeed, one of the basic lessons at our webmaster cooperative is to try to direct enquiries about software we’ve co-produced to somewhere useful, even if the question isn’t really much to do with us (because it’s about some part we didn’t produce or it’s something we’re no longer funded to work on), or even if we suspect the questioner has done something very silly. This approach has worked well so far. So, just don’t attack your users. It’s not on. Don’t do it. This basic lesson of not attacking users doesn’t seem to have been learned in software industries in general. Most software comes with a very restrictive “End User License Agreement” that seems to treat the user as if they are a potential criminal and grabs as many rights as possible for the software producer. I expect that Microsoft’s new post-Windows operating system will continue this approach and that the user-tracking possibilities of internet-centred operation will be exploited as far as legally possible. Hopefully, we’ll continue to see pre-installed Linux growing strongly in UK as Bristol Wireless describe. However, this pales into insignificance compared to many media companies. One of the worst offenders is Bristol-based TV Licensing who send us a “pay up or else, you potential criminal”-style letter each year. If there’s ever a reform that makes BBC subscription voluntary, they will probably reap the seeds of hatred that TVL have sown by attacking their audience. I have quite a lot of admiration for people like Martyn Drake who are fighting a noble fight in things like TV Licensing - the war begins! but I wonder whether media companies will learn not to attack their users before they cease to exist.

OpenSync update To give some update on the state of OpenSync in Debian, I have uploaded libsycml-0.4.7 to experimental a couple of days ago. This is significant in sofar as a lot of development and bug-fixing (mostly by Michael Bell) happened for this release, as well as some committment to maintaining an API and at least responsively versioning the library. In order to use libsyncml-0.4.7 with OpenSync, a newer libopensync than 0.36 is needed; however, current OpenSync trunk has seen a lot of changes in plugin handling and plugins need to get ported to the new API. So I uploaded the last known-working revision of OpenSync along with corresponing revisions of the file-sync and syncml plugins, the vformat module and a rebuild of msynctool to experimental for now. I did not have the time or energy to migrate/upload the other plugins yet, and as it seems that OpenSync-0.37 will only ship with ported file-sync and syncml plugins, it might not make much sense. I also took over maintainership of the related wbxml2 package, and upload a patch by Michael Bell which seem to fix a lot issues people are having with SyncML. The good news is that it seems all of the new features for a 0.40 stable OpenSync release have been finished according to the roadmap , most notably a common plugin configuration system and the machinery for a migration path from 0.22 to 0.40 configurations (plugins still need to support/implement that I believe), so no more big API changes are expected and the focus will be on bugfixing and plugin discovery from now on. This means developers will be able to start porting their plugins to the 0.40 API once 0.37 is out and front-end authors can start to take a look at the architectural changes which were made to facilitate their jobs. My hope is that conduit will be able to leverage the OpenSync technology and introduce a solid GUI for this (as kitchensync does for KDE), making syncronization finally work on the desktops. From the Debian packaging point of view, I have been mostly on my own now for the last couple of months. However, I recently registered an Alioth project in order to maintain the packages in a subversion repository (I have not yet decided whether it is worth importing the 0.22 packages targetted at lenny), and people who are interested in helping should contact me.

The versioned depends on tk8.5 has been removed in 1:1.5.6.3-1~bpo40+4, but still, this isn't enough:

$ gitk
/usr/bin/gitk: line 3: /usr/bin/wish8.5: No such file or directory
/usr/bin/gitk: line 3: exec: /usr/bin/wish8.5: cannot execute: No such file or directory

The irony is that you can simply workaround with:

# ln -sf /usr/bin/wish8.4 /usr/bin/wish8.5


But the proper fix would be to apply this patch:


diff --git a/debian/rules b/debian/rules
index 7a1e771..7bd25cd 100755
--- a/debian/rules
+++ b/debian/rules
@@ -7,7 +7,7 @@ CFLAGS =-g -Wall
STRIP =strip
TEST =test
OPTS =NO_OPENSSL=1 prefix=/usr mandir=/usr/share/man INSTALLDIRS=vendor \
- WITH_P4IMPORT=1 PYTHON_PATH=/usr/bin/python TCLTK_PATH=/usr/bin/wish8.5 \
+ WITH_P4IMPORT=1 PYTHON_PATH=/usr/bin/python TCLTK_PATH=/usr/bin/wish \
THREADED_DELTA_SEARCH=1

ifneq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
--
1.5.6.3

Of course, trying to block the Brazilian Internet Surveillance Bill is something we are really focused on doing. But as more people with political skills join us on convincing the Deputies this bill is just plain wrong, the rest of us, geek guys, are investigating Tor deployment. I d have to study the bill deeper than I have already, and probably ask some lawyer about it, but I think that the bill effectively makes unlawful to deploy Tor in Brazil as an end router. Via article 22 of the bill, providing an end-point Tor router can be considered providing access to a worldwide computer network , thus would require to keep three years of logs, what would render pointless having a Tor router in the first place. What can save an end-point Tor router is the wording of this very article. It states that just commercial or public sector providers are entangled by it. What if I make a free (as in free beer) end-point Tor router available? It is not public sector , since it s not tied to the government It s not commercial, since I am not selling access to it. But then, someone can argue that it s commercial activity with zero-price Brazilian law is just so confuse Anyway if we can get it straight with the lawyers, I think we ll watch a proliferation of end-point Tor routers in Brazil. This would assure that, even if this bill passes, it will not be easy for the government to peek on the citizens traffic. Geeks always having to fix what politicians break so easily

In a discussion which covered some of the differences between Linux and Windows, a Windows using friend asked me if I felt compassion for Windows users. I feel some compassion for people who have bad working environments. While using an operating system that has poor support for the business tasks does decrease the quality of the working environment, there are bigger issues. For example a while ago I was doing some sys-admin work for a financial organisation. I had to use Windows for running the SSH client to connect to Linux servers, this was annoying and decreased my productivity due to the inability to script connections etc. My productivity was also decreased because of my unfamiliarity with the Windows environment, it seems reasonable to assume that when you hire a Linux sys-admin they will have some experience of Linux on the desktop and be quite productive with a Linux desktop system - while the same can not be said for a Windows desktop. But what really made the working environment awful was the paperwork and the procedures. If a server doesn’t work properly and someone says “please fix it now” and I only have a VT100 terminal then I’ll be reasonably happy with that work environment (really - I wouldn’t mind a contract where the only thing on my desk was a VT100 connected to a Linux server). But when a server process hangs in the same way several times a week, when the cause of the problem is known and the fix (restarting the process) is known it really pains me to have to wait for a management discussion about the scope of the problem before restarting it. But I don’t have a great deal of sympathy for people who end up in bad working environments such as the one I was briefly in. Anyone who is capable of getting such a job is capable of getting a job with a better working environment while still earning significantly more than the median income. The people I feel sorry for are the ones who work on the minimum wage. I don’t think that the difference between Linux and Windows on the desktop would matter much if you were getting the minimum wage, and people who are on the minimum wage don’t have a lot of choice in regard to employment (I think that all options for them suck). I don’t have much sympathy for adults who use Windows at home. I have to admit that there are some benefits to running Windows at home, mainly that the hardware vendors support it better (few companies sell PCs with Linux pre-loaded) and there are some commercial games which are in some ways better than the free games (of course there are more than enough free Linux games to waste all your time - and some games are best suited to a console). Linux has significantly lower hardware requirements than Windows (my main machine which I am using to write this blog post is more than three years old and has less power than any other machine on sale today apart from some ultra-mobile PCs), so any long-term Windows user can install Linux on one of their machines which lacks the resources to run the latest version of Windows. The only Windows users for whom I have much sympathy are children. When I was young every PC came with a BASIC interpreter and everyone shared source code. Books were published which taught children how to program in BASIC which included fairly complete example programs. For the cases where proprietary software was needed the prices used to be quite low (admittedly the programs were much less complex - so pricing is probably in line with the effort or writing the code). Now it seems that computers are often being provided to children as closed systems that they can’t manipulate, the web browser has replaced the TV. I believe that Linux is the ideal OS for a child to use. There is a wide range of free educational programs (including kturtle - the traditional Logo turtle) and there are also a range of free powerful programs which can be used by any child. Few parents would buy Photoshop or Adobe Illustrator for a child to play with, but anyone can give a child a $100 PC with GIMP and Inkscape installed. They might as well give 3yo children access to the GIMP - it will be less messy than fingerpainting! I expect that some parents would not consider Linux for their children because they don’t know how to use it. Fortunately Linux is easy enough to use that a child can install it without effort. Some time ago the 11yo daughter of a friend who was visiting asked if she could play some computer games. I gave her a Fedora CD and one of the PCs from my test lab and told her that she had to install the OS first. Within a small amount of time she had Fedora installed and was playing games. While the games she played were not particularly educational, the fact that she could install the OS on a computer was a useful lesson. It seems to me that children who are raised as Windows users are less likely to learn how computers work or be able to control them properly. I expect that on average a child who is raised in such a manner will have fewer career options in today’s environment than one who properly understands and controls computers.

Share This

One thing that I would like to get fixed for Lenny is the shared objects which can reduce the security of a system. Almost a year ago I blogged about the libsmpeg0 library which is listed as requiring an executable stack [1]. I submitted a two-line patch which fixes the problem while making no code changes (the patch gives the same result as running “execstack -c” on the resulting shared object). My previous post documents the results of the problem when running SE Linux (a process is not permitted to run and an AVC message is logged). Some people might incorrectly think that this is merely a SE Linux functionality issue. The program paxtest (which is in Debian but is i386 only) tests for a variety of kernel security features in terms of memory management. To demonstrate the problem that is caused by this issue I ran the commands “paxtest kiddie” and “LD_PRELOAD=/usr/lib/libsmpeg-0.4.so.0 paxtest kiddie“. The difference is that the test named “Executable stack” returns a result of Vulnerable when the object is loaded. This means for example that attacks which rely on an executable stack will be permitted if the libsmpeg-0.4.so.0 shared object is loaded. So for example a program that loads the library and which takes data from the Internet (EG FreeCiv in network mode) will become vulnerable to attacks which rely on an executable stack because of this bug! My Etch SE Linux repository has had a libsmpeg0 package which fixes this bug on i386 for almost a year [2] (the AMD64 packages are more recent). I have now added packages to fix this bug to my Lenny SE Linux repository [3]. I have also volunteered to NMU the package for Lenny. It seems that it would be rather embarrassing for everyone concerned systems were vulnerable to attack because of a two-line patch not being applied for almost a year. I expect that the Release Team will be very accepting of package updates for Lenny which have patches to address this issue. A patch that has one line per assembler file (in the worst-case) to mark the object code is very easy to review. The results of the patch can be tested easily, and failure to have such a patch opens potential security holes. Package maintainers who can’t fix the assembly code can always run “execstack -c” in the build scripts to give the same result. Lintian performs checks for executable stacks and the results are archived here [4]. There are currently 36 packages which contain binaries listed as needing executable stacks, I would be surprised if more than 6 of them actually contain shared objects that need an executable stack. If you use a package that is on that list then please test whether an executable stack is required by running “execstack -c” on the shared object and see if it still works. If a test of most of the high-level operations of the program in question can be completed successfully without an executable stack then it’s a strong indication that it’s not needed. Note that execstack is in the prelink package. I am happy to help with writing the patches to the packages and using my repositories to distribute the packages, but am not going to do so unless I can work with someone who uses the program in question and can test it’s functions. As an example of such testing I played a game of Frozen Bubble to test out the libsmpeg0 patch.

• [1] http://etbe.coker.com.au/2007/10/07/executable-stack-and-shared-objects/


• [2] http://etbe.coker.com.au/2007/10/19/my-se-linux-etch-repository/


• [3] http://doc.coker.com.au/computers/installing-se-linux-on-lenny/


• [4] http://lintian.debian.org/tags/shlib-with-executable-stack.html

Share This

The command “xm list” displays the number of seconds of CPU time used by each Xen domain. This makes it easy to compare the CPU use of the various domains if they were all started at the same time (usually system boot). But is not very helpful if they were started at different times. I wrote a little Perl program to display the percentage of one CPU that has been used by each domain, here is a sample of the output: Domain-0 uses 7.70% of one CPU
demo uses 0.06% of one CPU
lenny32 uses 2.07% of one CPU
unstable uses 0.30% of one CPU Now the command “xm top” can give you the amount of CPU time used at any moment (which is very useful). But it’s also good to be able to see how much is being used over the course of some days of operation. For example if a domain is using the equivalent of 34% of one CPU over the course of a week (as one domain that I run is doing) then it makes sense to allocate more than one VCPU to it so that things don’t slow down at peak times or when cron jobs are running. I believe that it’s best to limit the number of CPUs allocated to Xen domains. For example I am running a Xen server with 8 CPU cores. I could grant each domain access to 8 VCPUs, but then any domain could use all that CPU power if it ran wild. While if I give no domain more than 2 VCPUs then one domain could use all the CPU resources allocated to it without the other domains being impacted. I realise that there are scheduling algorithms in the Xen kernel that are designed to deal with such situations, but I believe that simply denying access to excessive resource use is more effective and reliable. I have not filed a bug report requesting that my script be added to one of the Xen packages as I’m not sure which one it would belong in (and also it’s a bit of a hack). It’s licensed under the GPL so anyone who wants to use it can do what they want. Any distribution package maintainer who wants to include it in a Xen utilities package is welcome to do so. The code is below.
#!/usr/bin/perl
use strict; open(LIST, "xm list --long ") or die "Can't get list"; my $name = "Dom0";
my $uptime = 0.0;
my $cpu_time = 0.0; open(UPTIME, "</proc/uptime") or die "Can't open /proc/uptime";
my @arr = split(/ /, <UPTIME>);
$uptime = $arr[0];
close(UPTIME); while(<LIST>)

  chomp;
  if($_ =~ /^\)/)
 
    my $cpu = $cpu_time / $uptime * 100.0;
    printf("%s uses %.2f%% of one CPU\n", $name, $cpu);
    next;
 
  $_ =~ s/\).*$//;
  if($_ =~ /up_time /)
 
    $_ =~ s/^.*up_time //;
    $uptime = $_;
    next;
 
  if($_ =~ /cpu_time /)
 
    $_ =~ s/^.*cpu_time //;
    $cpu_time = $_;
    next;
 
  if($_ =~ /\(name /)
 
    $_ =~ s/^.*name //;
    $name = $_;
    next;
 

close(LIST);

Share This

A recent post reminded me of a problem I once had; determine the glibc version and its support for various things. There's actually a little known but useful confstr call defined for just this sort of thing. Here's a minimal example: man confstr has all the details. If you don't need it in your program, you can also just run /lib/libc/so.6 and it will print out it's version info, e.g. There's also another glibc trick that often comes in useful; the LD_DEBUG environment variable. Start with help and you can get more details from there.

So it is currently possible to use simple library calls in glib-based code to run something as root, by taking advantage of the gksu policykit mechanism: GksuProcess* gksu_process_new(const gchar *working_directory, const gchar **arguments);
gboolean gksu_process_spawn_async(GksuProcess *process, GError **error); The DBus service already works; it is able to setup the environment and X authorization correctly. There is still lots to do; startup notification is still not handled, and dealing with the application’s stdandard output and error messages, as well as providing a way for the caller to send stuff into the processe’s standard input. It is already possible to start an application and know that it has been finished, though. As for the code: $ git clone git://kov.eti.br/srv/git/gksu-polkit.git/ Criticism is welcome! In other news… I’d like to ask our dear lazy web if anyone is using some nice way of providing only posts tagged in specific categories in a feed in wordpress. I’d like to use that to provide my posts to planet debian from my wordpress install.

I have just configured IPVS on a Xen server for load balancing between multiple virtual hosts. The benefit is not load balancing but management. With two virtual machines providing a service I can gracefully shut one down for maintenance and have the other take the load. When there are two machines providing a service a load balancing configuration is much better than a hot-spare, one reason is the fact that there may be application scaling issues that prevent one machine with twice the resources from giving as much performance as two smaller machines. Another is the fact that if you have a machine configured but never used there will always be some doubt as to whether it would work… The first thing to do is to assign the IP address of the service to the front-end machine so that other machines on the segment (IE routers) will be able to send data to it. If the address for the service is 10.0.0.5 then the command “ip addr add dev eth0 10.0.0.5/24 broadcast +” will make it a secondary address on the eth0 interface. On a Debian system you would add the line “up ip addr add dev eth0 10.0.0.5/24 broadcast + true” to the appropriate section of /etc/network/interfaces, for a Red Hat system it seems that /etc/rc.local is the best place for it. I expect that it would be possible to merely advertise the IP address via ARP without adding it to the interface, but the ability to ping the IPVS server on the service address seems useful and there seems no benefit in not assigning the address. There are three methods used by IPVS for forwarding packets, gatewaying/routing (the default), IPIP encapsulation (tunneling), and masquerading. The gatewaying/routing method requires the back-end server to respond to requests on the service address. That would mean assigning the address to the back-end server without advertising it via ARP (which seems likely to have some issues for managing the system). The IPIP encapsulation method requires setting up IPIP which seemed like it would be excessively difficult (although maybe not more than required to set up masquerading). The masquerading option (which I initially chose) rewrites the packets to have the IP address of the real server. So for example if the service address is 10.0.0.5 and the back-end server has the address 10.0.1.5 then it will see packets addresses to 10.0.1.5. A benefit of masquerading is that it allows you to use different ports, so for example you could have a non-virtualised mail server listening on port 25 and a back-end server for a virtual service listening on port 26. While there is no practical limit to the number of private IP addresses that you might use it seems easier to manage servers listening on different ports with the same IP address - and there is the issue of server programs that are not written to support binding to an IP address. ipvsadm -A -t 10.0.0.5:25 -s lblc -p
ipvsadm -a -t 10.0.0.5:25 -r 10.0.1.5 -m The above two commands create an IPVS configuration that listens on port 25 of IP address 10.0.0.5 and then masquerades connections to 10.0.1.5 on port 25 (the default is to use the same port). Now the problem is in getting the packets to return via the IPVS server. If the IPVS server happens to be your default gateway then it’s not a problem and it will already be working after the above two commands (if a service is listening on 10.0.1.5 port 25). If the IPVS server is not the default gateway and you have only one IP address on the back-end server then this will require using netfilter to mark the packets and then route based on the packet matching. Marking via netfilter also seems to be the only well documented way of doing similar things. I spent some time working on this and didn’t get it working. However having multiple IP addresses per server is a recommended practice anyway (a back-end interface for communication between servers as well as a front-end interface for public data). ip rule add from 10.0.1.5 table 1
ip route add default via 10.0.0.1 table 1 I use the above two commands to set up a new routing table for the data for the virtual service. The first line causes any packets from 10.0.1.5 to be sent to routing table 1 (I currently have a rough plan to have table numbers match ethernet device numbers, the data in question is going out device eth1). The second line adds a default router to table 1 which sends all packets to 10.0.0.1 (the private IP address of the IPVS server). Then it SHOULD all be working, but in the network that I’m using (RHEL4 DomU and RHEL5 Dom0 and IPVS) it doesn’t. For some reason the data packets from the DomU are not seen as part of the same TCP stream (both in Net Filter connection tracking and by the TCP code in the kernel). So I get an established connection (3 way handshake completed) but no data transfer. The server sends the SMTP greeting repeatedly but nothing is received. At this stage I’m not sure whether there is something missing in my configuration or whether there’s a bug in IPVS. I would be happy to send tcpdump output to anyone who wants to try and figure it out. My next attempt at this was via routing. I removed the “-m” option from the ipvsadm command and added the service IP address to the back-end with the command “ifconfig lo:0 10.0.0.5 netmask 255.255.255.255” and configured the mail server to bind to port 25 on address 10.0.0.5. Success at last! Now I just have to get Piranha working to remove back-end servers from the list when they fail. Update: It’s quite important that when adding a single IP address to device lo:0 you use a netmask of 255.255.255.255. If you use the same netmask as the front-end device (which would seem like a reasonable thing to do) then (with RHEL4 kernels at least) you get proxy ARPs by default. For example you used netmask 255.255.255.0 to add address 10.0.0.5 to device lo:0 then on device eth0 the machine will start answering ARP requests for 10.0.0.6 etc. Havoc then ensues.

Share This

Sure, that sounds fairly formal to send a report for holidays, doesn't it? Anyway, as I have a few (often Debian/FLOSS related) friends around the world who are reading my blog entries, this might interest them so that's indeed a report..:-)...and I have time for it, so... I'm currently going back from Cahors to Maurepas (home), on my way to Debconf. We spent 10 days in Cahors with Elizabeth and the girls, finally joined by Jean-Baptiste on Sunday. We had great time over there, enjoying the richness of Quercy:

• heat (I need that before MDQ winter)
• nice running spots: for once, I could run by starting from the bottom of hills, climbing *up* and finishing down. I ran a lot, sometimes on very hard tours such as 18km with 300m positive height difference. I also did a few "fast" runs ("fast" here would make a few Debian friends laugh a lot, isn't it Ralf, Dirk.....)
• medieval architecture in Gourdon, Martel, St-Cirq Lapopie, Cahors...
• peace of the Lot valley
• Cahors wine: strong and tasty, of course
• Rocamadour and Trappe d'Echourgnac cheese (I won't bring Rocamadour at Debconf as it wouldn't survive)
• rest, sleep
• McDonald's parking lot for network connectivity
• very little hacking

So, I'm now heading back home, assemble stuff and will take off for Debconf on Thursday 7th (Paris Orly to Madrid, then Buenos Aires via Air Europa: IIRC nobody from Debconf is in the same flight). "Assemble stuff" here also means collecting cheese for the now famous Debconf Cheese&Wine party. That one will be tricky to achieve as most of us are coming from quite far away and...there are only 6 French citizens who attend DC8..:-)). Anyway, I already know that my fellow Nicolas Fran ois (namely nominated as Assistance CheeseMaster recently) will bring some good stuff. I haven't decided yet what to bring. I might be influenced by my holidays, so cheeses from South-West France are highly probable. Cahors wine will be the choice (prepare yourself: that is strong stuff). At Debconf itself, we'll have a quite busy schedule. I intend to mostly work along with Felipe, Nicolas, Grisu and others on i18n.debian.net. I'll have to animate the i18n sessions for which I want to prepare some schedule instead of just "lat's gather and talk" which didn't work so well last year, IMHO. And I have that bloody keynote lecture which, BTW, could be rescheduled if I properly read debconf-discuss as, finally 9am for keynotes seems to be considered too early for the late birds at DC8...:-)... We'll see: I will certainly have something that's not very well cooked and prepared. Expect some improvisation: this year I didn't want to stress myself with a talk, slides and blahblah. Elizabeth will come back from Cahors on Saturday with the kids. She'll have a holiday week at her father's place whil ethe kids will....do their stuff at Maurepas (this is what happens when kids are grown up). We'll gather together again on Aug 18th and I go back to work on 19th. Crazy, I know but I have a very busy and full work schedule for the upcoming next 2 months. September will be a hard time to go through: Jean-Baptiste will start his "Licence Profesionnelle" in Automated and Embarked Systems. He'll do it in shared time: half-time at university for classes and half-time working in a company (which turns out to be Essilor, the world leader for progressive glasses....and the company which Elizabeth is working for). He'll stay at my sister-in-law place during the week (30km away from our place but closer from university and work). Sophie, our 18-year old daughter, will spend the year in Toulouse, to prepare the admission in a Social Workers school. She'll have her own apartment, in the very center of the city, 20 meters away from Place du Capitole. Annoying, isn't it ? :-) So, we'll mostly stay with our "little" Magali, our 16 y.o. who will be attending High School, on her way to Baccalaur at. Tell us about shrinking families.... Now time to work on some slides for the Debconf keynote. Damn.

This past weekend, I took my Canon EF 24-105mm f/4L lens to take some indoor pictures. I had been using it previously to take outdoor pictures, and had used my polarizer, and left it on the lens when I was done. So this weekend, I tried taking it off, and couldn’t. That’s the first time this had happened to me. I wasn’t sure what to do. Fortunately for me, before I did anything too extreme, Adam suggested I get a filter wrench. So I headed over to Wolf Camera to get one. Wolf didn’t have one, so I asked where I could get one, and they suggested someone else who also didn’t have one, but they suggested Keeble & Shuchat Photography, who I had been to before. They did have wrenches, but not in the size that I needed. They suggested I just bring the lens to their repair department, which I did. Fifteen minutes later, the filter still wasn’t off the lens, and they had given up. My lens is now on its way to Canon USA for a repair, and hopefully I’ll get both parts back, separated, and in usable condition. They estimated the cost would be somewhere between two and three hundred dollars. I guess that’s what happens when a lens that costs $1000 and a filter that costs $100 decide to misbehave in tandem. And I was hoping the repair would be a simple $5 filter wrench!

As far as debcamp work plans go, my own has been making me quite happy. I started the week trying to start implementing gksu policykit mostly in vala, and failing miserably. Vala isn't ready to help me do some of the more weird things I had in mind. The good news is falling back to C worked pretty smoothly, and I have the basic foundation working. There is plenty to be implemented still, but moving forward always feels good. If anyone is interested in discussing the gksu replacement that is being built on top of the PolicyKit framework come talk to me in the hack lab =D. Take a look at this gratuitous screenshot.

Hi, it’s that time again: new alpha version of Adept hits the block. For the unaware, Adept is an APT front-end for KDE. You can do all the cool stuff with it that the other kids can’t. Join the fun! New features since Alpha 5 (the list is a little less staggering than the last time, sorry about that, but it’s only been a week)

• Tags are back! Enhance your searches with tags. Very cloudy, very buzzword-compliant, so very web two-oh. It actually works, too! (No irony intended. Maybe…)
• Status-based filtering,
• improved search in installer,
• much better error handling for dpkg and download errors,
• lost icons are back and a load of other bugfixes.

Where to get I have again prepared binary packages, this time even more of them (a Hardy backport is included). Traditionally, in Debian, you can install alpha 6 from experimental:

apt-get install -t experimental adept

The sources.list goes:

deb http://ftp.debian.org/debian experimental main

If you are on Kubuntu Intrepid, the line is:

deb http://ppa.launchpad.net/mornfall/ubuntu intrepid main

and finally, on Kubuntu Hardy, the lines are (BUT: read below!)

deb http://ppa.launchpad.net/kubuntu-members-kde4/ubuntu hardy main
deb http://ppa.launchpad.net/mornfall/ubuntu hardy main

Big fat warning: Due to somewhat unexpected difficulties, Adept requires newer APT than available in Hardy. This means, adding the above sources.list lines will upgrade your apt to a version from Intrepid, that’s also completely untested on anything resembling a Hardy installation. Be wary. Moreover, installing Adept means means KDE 4.1 for Hardy users. (This does not apply to Intrepid users, they are already on the cutting edge and no extra dangers lie this way.) (For all Kubuntu users, there are more instructions to be found on https://launchpad.net/~mornfall/+archive.) Heroes of Alpha 6 I hereby nominate the “Heroes of Alpha 6”, for their deeds that helped Adept move forward:

• Yuriy Kozlov, for early pre-release testing and numerous patch contributions throughout the 3.0 alpha series
• Jonathan Thomas (JontheEchidna), for discovering two bugs:
  • failed downloads resulted in a cryptic internal errors
  • an installer crash when using the search
• Samuel James Sarette (lunarcloud), for discovering that you could start apply changes twice in a row, by switching back to changes and hitting apply again (not surprisingly screwing up Adept)
• and finally, Jonathan Riddell, as there’d be no 3.0 alpha series without him…

(And a totally flirtless wink towards Blauzahl, who somehow inspired me to actually do some bugzilla sorting…) And now, it’s easy to join the ranks of these heroes — just test the new alpha version and find bugs. Immortality won’t escape your grasp. Also, please don’t forget to read the next section. Jobs for Alpha 6 Sorting through Launchpad for bugs that have been fixed in alpha 6 (compared to 2.1) would be really awesome. It is a big list and many of them are likely to need testing. (I can take care of that for the KDE bugzilla, but launchpad is a task just too daunting for me and my time possibilities, so help would be very much appreciated). Notifier is still not included. The components to test are (if you have sudo, kdesu for the rest):

sudo adept
sudo adept installer
sudo adept updater

Please give a go to all of them, report rough edges, crashes and all that, either through IRC (mornfall at freenode, oftc) or mail me-at-mornfall-dot-net or use KDE Bugzilla. Known Issues

• Sometimes, it seems that the installer search manages to break the layout. Change the search text and try again, it might fix itself. If you find a way to reproduce, please let me know!
• The installer search is still a little wonky at times (and maybe slow, dunno). And when there are no results, it keeps whatever groups there were before, they are just all empty. Oops.
• Icons fail to load on Kubuntu Hardy.
• Search seems to crash Adept just after installation on Hardy (could be related to xapian database update). Starting it again seems to help though. UPDATE: this does happen on other distributions as well. You run into the problem if you don’t have apt-xapian-index installed, you install it together with adept and then run adept right away. Then you get a crash on first search. Just restart adept and all should work just fine.
• UPDATE: When recovery fails, Adept will crash instead of reporting the error and closing gracefully. Run dpkg —configure -a.
• UPDATE: Don’t run adept through kdesudo on Kubuntu. It seems to cause mysterious issues with dpkg (and especially hal upgrades). No insight so far as to what is the problem.

Today’s Signifying Nothing public service announcement follows. Unless you plan to keep your clothes on, or are in the process of producing your one-person dramatic reenactment of Dr. Horrible’s Sing-Along Blog, don’t sit in front of your MacBook if the little green light above the screen is on. This concludes today’s Signifying Nothing public service announcement.

It’s been almost a week already since I arrived to Adelsried. I am going to work here for two weeks and a half (according to the initial contract at least). That means I can’t go to Akademy in the end, too bad The town is quite small, with around 2000 inhabitants, and not much social life, except for the hotel where we are hosted. The hotel is great, probably the best I have ever been to. Great swimming pool and jacuzzi, really friendly staff, nice rooms with big and comfy beds, a magnificent “biergarten” where we have some drinks and dinner every night, delicious food, bikes to ride for free, … Despite the lack of social life, the town is beautiful, first of all it’s in the middle of a natural reservation, with dense forests completely surrounding the city. Every house has a gorgeous garden with loads of flowers and some interesting decorations. The highlight is this really high pole in the city center with loads of coats of arms, and a pine on top of it. Hilarious The work is pretty good too, bleeding edge stuff, really good working environment, nice and international workmates and free drinks And today I uttered my first full sentence in German since lots of years ago!!!

After my post yesterday about locales and my problems, I got some comments. Bryan, Simon and Wouter all pointed out what eventually figured out too but didn't mention in the post (I actually had to re-read the post to see what I wrote) that LC_ALL overrides all of the settings. Even though I figured it out eventually, with these comments it finally me that the purpose is actually to temporarily override the locale. Another thing that didn't occur to me while figuring out the correct locale for my system was that I'm thinking about it all wrong. Since I've already gotten used to broken locales I kept thinking that I want en_US locale with some Finnish settings, but in reality I wanted fi_FI locale with English language. I have to admit that I was pretty sceptical about the solution but decided to try it out. And to my surprise, it actually worked! So the final solution is this: LANG="fi_FI.UTF-8"
LANGUAGE="en"
LC_MESSAGES="en_US.UTF-8"
LC_TIME="en_US.UTF-8" It is a pretty clean solution and I'm happy to live with it. And as Simon pointed out, administrator changes should be preserved through upgrades. If not, one should file a bug for it. There we go, another problem solved. Thanks for the comments and suggestions.