Search Results: "ana"

31 October 2007

Luciano Bello: captchas: The Good, the Bad and the Ugly

Some months ago, I commented about a weak implementation in a fancy captcha. Today I would like to comment about other bad implementations, but in other ways.
The goodA captcha should have big Shannon entropy, finite, but big. The session ID and the challenge must not be reused. The images must be resistant to OCR but should be understandable by a human.
The badHere is the first example:

Believe it or not.. This is a real case. So incredible eh?

The uglyThe victim, in this case, is this one:
This is an implementation of captchanumbers, by Hadar Porat. This captcha and many others generated by captchanumbers can be read with this script.

The idea is simple. As the numbers are nearly in the same place, they can be cut. Those parts can compared independently, reducing the entropy. May be the script and this image would be more enlightening than my limited English:

The 10,000 possibilities was reduced to 159. No OCR, 100% deterministic.

Second moral: Understand the fundamentals first, write code later.

Clint Adams: Ring-a-ring-a-rosey, as the light declines

Killing
HARIBO MACHT KINDER FROH UND ERWACHSENE EBENSO
Chocolates eying jealously that tub of avocado mush
Then you're just awed
By the awesomeness
Of the awesome powers displayed before you
It's pretty awesome
Struggle and conflict
Orbs of mercury rolling across space
While dogs battle in the darkness
Cable in pants at last for a hot bus ride
Woogie, woogie, woogie

30 October 2007

John Goerzen: Review: Terk TV38 Antenna

Last year, as we were planning our move, I knew we would need to buy a new TV antenna. According to AntennaWeb (a very useful site), we are in the violet (or "fat chance") zone for several TV stations. Add to that the fact that we have a tin-covered building pretty much in the direct path to several of the transmitter. Metal buildings often cause "multipathing", where a signal bounces off buildings and arrives multiple times at the antenna. This causes ghosting on analog signals and can cause problems getting a signal lock on digital ones. We also have a fairly long run from the antenna to the receiver (a MythTV box) and are wanting to receive digital signals. Not only that, but the TV transmitters are in different areas about 40 degrees apart, and most high-gain antennas are also highly directional. So it's a difficult situation.

So in our situation, an outdoor antenna is a must. At our old place, we had used the best outdoor antenna Radio Shack sold. Despite having more friendly reception conditions, it didn't work well.

After a good deal of research, I bought a Terk TV38 outdoor antenna from Amazon. It comes with:


It comes with the hardware you need to mount it in an attic or attach it to an exterior wall or chimney in most situations. However, we wanted to attach it to the roof directly, so we purchased a tripod mount from RadioShack for that purpose. I had also purchased some quad-shield RG6 coax from Cat5ECableGuy.Com.

I assembled the antenna on the ground. That took some time, but wasn't difficult. But this was in winter, a fairly wet winter, and I knew that weather wouldn't cooperate well enough for us to get the antenna up on our roof safely some Saturday for a few weeks. So I thought I'd just leave the antenna on the ground for a little while, hook it up, and see if we get anything. I put it on the ground, aimed it about in the middle of the TV transmitters, and went to set up the MythTV.

I was shocked to discover that, even with the antenna on the ground, I got a perfect digital picture on all channels but one. Once we got the antenna mounted on the roof, reception has been perfect. I've had no need for actuators (to rotate the antenna) or amplifiers. Just the antenna itself, even with the long coax run, has performed quite well.

For anyone that needs an outdoor antenna, I highly recommend the Terk TV38.

Andrew McMillan: Getting Blood from a Stone

Last week I installed Ubuntu Gutsy onto Heather's laptop. While Gutsy seems to be an easy task for most situations, installing it onto a Pentium 366 laptop with 200M of RAM and (particularly) an 800x600 screen was harder than it perhaps should have been. I'm sure that most installations these days aren't 800x600, but the graphical installer in Gutsy seems determined to make this painful. I had to move the toolbars to the sides of the screen, and then I could see the top half of the buttons on each page. It was like the page was sized for 600 vertical pixels, but the designer had forgotten about toolbars and title bars - not that I could see any screens in the process I followed that needed more than 5/6 of that screen anyway. Eventually I got it installed, and it even seemed to run OK once we booted into it. That's "OK for a 200M P366 with an 800x600 screen" though. Looking around at the price of a new laptop made putting up with that sort of performance a whole lot less palatable. The Acer Aspire 5310 (with free RAM upgrade) was $898 at Dick Smith, with a $99 cashback offer. A quick google shows that it's using the Broadcom 43xx wireless which isn't even close to being the best, but can be made to work with Linux. Everything else seemed likely to work, so we bought it. Installing Gutsy on it was nearly trivial, though I had to install bcm43xx-fwcutter on a different PC (my laptop, which is running Debian, in fact) to get the firmware for the WLAN before I could get the wireless working. I'm surprised that Broadcom still don't make that firmware publicly available somewhere, rather than forcing people to jump through the sort of hoops that would get them wanting an Intel chipset next time. Anyway, everything installed very easily, and the laptop is working quite nicely. Strangely neither sound, nor suspend to ram are working out of the box, but perhaps I'll get them going in due course. They're not so important in this case fortunately, but perhaps in due course I'll try and get them working and post some details about it. Much harder has been getting the fabled 'cashback' from Acer. I think I now know what I'm being paid $99 for. Firstly the only way to get your cashback is by registering through a webpage. Heather's first attempt to do this resulted in an error from our proxy about a malformed request, so I got called in. I tried registering using on my laptop, but couldn't even get to the cashback page. I then tried using IE6, with similar results. So perhaps it's my PC? I tried using a different PC, with the same result again! We tried ringing them up, but they were absolutely determined that (even after 20 minutes on the phone) they were not going to accept that information over the phone. So the only way to get the cashback from Acer was via their thoroughly broken website. Even their Contact Acer page is broken in firefox just showing a blank. Firefox users need not apply. Eventually, while spending some time in front of Heather's main computer (which had made it all the way through to submitting their on-line form before failing) I realised that the error she was getting was a proxy error from some in-form javascript submitting an invalid request, so I disabled the proxy, the form finally worked, and I managed to apply for the cashback. Now we just have to send the printed form in, along with some blood from our firstborn, the ashes of my grandmother, various barcodes, receipts and toenail clippings and we're sweet. They say they'll send us some money within 30 days. I think we should maybe frame it or something. I just know I'm going to feel really inclined to take advantage of cashback offers in future. In Other News: DVD Slideshow Meanwhile I've been playing with DVD Slideshow which seems to be just what my parents have been after for a while, so they don't have to keep their favourite photos on the camera to be able to show them off on someone's TV. It's great! At least it is great now after I changed all the calls to ffmpeg to add a 'k' after the bitrate parameter. But that's Open Source Software, I guess. I'll send a patch to them... :-)

Theodore Ts'o: Tip o the hat, wag o the finger Linux power savings for laptop users

It’s interesting to see how far, and yet how much more work we need to do on power management for Linux. I recently got a new laptop — a Lenovo Thinkpad X61s — and using the powertop tool, I was able to configure my system to the point where in what I can “airplane mail reading mode” (mailbox preloaded into memory, USB disabled, wireless and ethernet disabled, backlight down to 30% brightness, sloppily written power hogs like Firefox and Notes — every single application writer should be forced to run powertap and explain why their program feels it necessary to constantly wake up the CPU), I can get my usage down to about 9.8 watts. Using the 8 hours extended battery, that’s 8 hours of battery life, although granted doing very little. On the flip side, if I’m doing a major kernel compile, I can drive up utilization up to almost 30 watts, which means less than 3 hours of battery life. So that’s definitely the good news; Linux can sharply reduce its power consumption to the point where it is highly competitive with Windows. (And probably better than Vista, just because that OS is so heavy and bloated.) So thanks and and a tip of the hat to Intel and to Arjan van de Ven for making such a useful tool like Powertop available. So now for the bad news. Getting down to this level of power saving thriftness, where the laptop is carefully sipping only the minimal amounts of power from the battery, is definitely a work in progress. First of all, you can only get this level of power savings by unloading a specific USB driver, uhci_hcd. This will disable low speed devices (including unfortunately the fingerprint reader and the EVDO WWAN device if you were silly enough to buy one that was built into the laptop as opposed to a stand-alone card that you can swap between laptops and lend out to friends as necessary). But how many users are going to open up a terminal window, su to root and type the command “rmmod uhci_hcd”? And know how to reload the driver using “modprobe uhci_hcd” when they need to use the USB devices again? A similar problem exists for Network Manager; when the user disables the network by right-clicking on the applet, why doesn’t it automatically bring down the interface, instead of forcing the user to manually su to root and then type the command “ifconfig eth0 down; ifconfig wlan0 down”? A more serious problem is the Intel Wireless driver for the 4965. Even with the wlan0 interface configured down, and with the RF kill switch enabled, keeping the iwl4965 driver loaded will still cost you an extra full watt of power. When you’re down to 9.6 watts, that means that keeping the iwl4965 driver loaded when you don’t need it will cost you a 10% reduction in your battery life! That’s just sloppy, and hopefully it will be fixed in a future update to the iwl4965 driver, but as long as you don’t mind manually removing and reloading it, you can work around this power-saving oversight. A bigger issue, though, one for which no workaround exists, is that unlike the ipw3945 drivers, which at least had private, non-standard iwpriv commands to engage the 802.11’s power-saving features, the iwl4965 driver has neither the non-standard Intel iwpriv interfaces, nor the standard iwconfig interfaces for enabling any kind of powersaving features, including changing the transmit power of the card. So while powertop deserves plenty of kudos, iwl4965 deserves a wag of the finger from a power saving viewpoint. No doubt Intel just needs to allocate more money to its Open Source Technology Center so it get more of its crack developers to work improving Linux support for their processors and chipsets. Speaking of which, I’m still waiting for an Intel x.org 965GM driver that can support compiz/beryl and simultaneously show video clips at the same time… And being able turn off the 50 interrupts/second generated by the video card when they aren’t needed because 3-d graphics aren’t currently in use, without requiring a restart of the X server, would also be a nice touch. The bottom line is that Linux power savings and Linux support for laptops in general is much better than it was a year ago, and a lot of credit has to go to the efforts of Intel’s teams producing such good work as powertop, their wireless drivers, and their open X server drivers. We still have a lot of work left to be done, though!

29 October 2007

Andreas Schuldei: Random Acts of Kindness

Some time ago a friend of my sister in law contacted me and offered his services as a courier for gifts. I had told him that I knew someone in Israel and he was traveling to Sweden. So I contacted Lior with the strange proposal to give me a gift (and I promised to return the favour). A few days later I got a book about Israel from Lior, was very happy and started to ponder what kind of present could be fun and entertaining for him. I ended up going to the supermarket and bought all kinds of special swedish food (and obviously skipped some). I wrote some short notes with cooking instructions and explanations and sent the whole lot back to Israel.

I enjoyed both getting the present, reading the book and picking a present for someone I regard highly. I would like to recomment this as a fun game within Debian: If you know someone traveling abroad find out if there is a DD (or Debian contributor) around at the destination and send a present to that person. This kind of love bombing is low cost and lots of fun and creates bonds parallel to those of the Web of Trust. Try It!

Yves-Alexis Perez: Two years

Today, it's been two years I'm stuck in the NM queue. I've registered on oct 24, 2005, because Sam Hocevar told me that it could last a little, so if I was interested I should register early. I wondered for a long time if I should resign on this two years birthday, but I dropped this eventuality. I still want to be a Debian Developer, and if I resign I don't think I'll really want to still work on Xfce packages. But on the other hand I wouldn't really like to use an Xfce not packaged by me (no offense, but I guess I'd still want to hack on it) and I don't think I would be able to be on another distro. So I'm still there, sitting in NM queue, waiting for the next step. The only required step to be accepted as a Debian Developer is to have its gpg key added to the debian keyring (then an account is created on debian boxes, there's a -private subscription etc.). This is done by a team, called DAM, "Debian Accounts Managers". Because at one time they had a lot of work, they could not examine each candidate and decide if he was a potential good Debian Developer, so people imagined the NM Process: some volunteers would help them asking questions to candidates, then write a report, so DAM would only have to read it and decide if it was ok or not to create an account. I've already passed this step. I am "DAM Approved". One could imagine that, if the Debian *Accounts* Managers reviewed and approved my application, the account creation should follow. But no, the next step (according to NM pages) is "DAM creates account or rejects application". The problem here is that there is no "DAM Team", responsible for Debian accounts, but various people which are not really equivalent in this team. This is really a problem in Debian, where teams aren't really a "team". Not every team I guess, but in some cases one can trust a team to do a job. Debian is a volunteer organisation, so people think nobody can be forced to do a job if he doesn't have time to it. I'm fine with that, real life can be really time-consuming sometime. But my opinion is that teams may have to be forced to do their job. If nobody in the team has time, fine, it means somebody should join the team. But the team itself shouldn't fail, and this should be the only thing visible from outside: the "team", and the team actions. There are some proposition about this on lists at the moment, but I don't really know how it'll end. It's not easy doing social stuff, there's a lot of people involved, with many different views. But sometimes the consensus is *not* findable, and sometimes, somebody has to decide. That's why why need team leaders, and that's the project leader role. I guess people are quite opposed to have a "strong" leader in a volunteer organization, and I don't have concrete proposals but I really thing team management is not really perfect and a lot of people (users and developers) suffer from that (not only NM applicants, I mean) and from "elephants". As I said, I have no good solution, nor even concrete proposals (except "sometimes we need a leader to make decisions") but I really think there are things Debian (as a project) needs to improve.

David Moreno Garza: Saturday

Last Saturday, we attended a party at stew and rcox’ place in Brooklyn. Biella, Micah, Clint and a bunch of other people were also there. It was very nice and we had a lot of fun. I had the chance to tell Clint that some of his blog postings really intrigue me; I now feel relieved. Besides, I’ve learned that boxing against Micah on the Wii is so tiring that even days after, my arms and back still hurt :-( We left at around 1:45 am.
On our way back to Harlem, we stopped to have some tacos at El dolo on the 8th Ave and the 14th St, as Kevin suggested me before; for our surprise, they were amazing and have been so far, the best Mexican food we’ve had in NYC :-) So, after getting off on the 145th station and walked nine blocks, we arrived to our warm place at 4:30 am.

28 October 2007

Eddy Petrișor: gpg signatures sent

I finally managed to resend the signatures to the few people I decided to send them a while back after debconf7.

I actually resent all the signatures I thought I should sign (if I didn't socialize at all with you during debconf or before you shouldn't receive a signature from me).

So, please:
Now I can cross one more item on my long todo list. Yay!

This message has emerged thanks to: caff, dato, python's smtplib and rfc822, vi, gpg, exim, linksys, dell, todo(the application from openhand) and blogger :-)

Russell Coker: Xen and Security

I have previously posted about the difference between using a chroot and using SE Linux [1]. Theo de Raadt claims that virtualisation does not provide security benefits [2] based on the idea that the Xen hypervisor may have security related bugs. From my understanding of Xen a successful exploit of a Xen system with a Dom0 that is strictly used for running the DomU’s would usually start by gaining local root on one of the DomU instances. From there it is possible to launch an attack on the Xen Dom0. One example of this is the recent Xen exploit (CVE-2007-4993) [3] where hostile data in a grub.conf in a DomU could be used to execute privileged commands in the Dom0. Another possibility would be to gain root access to a DomU and then exploit a bug in the Xen API to take over the hypervisor (I am not aware of an example of this being implemented). A final possibility is available when using QEMU code to provide virtual hardware where an attacker could exploit QEMU bugs, an example of this is CVE-2007-0998 where a local user in a guest VM could read arbitrary files in the host [4] - it’s not clear from the advisory what level of access is required to exploit it (DomU-user, DomU-root, or remote VNC access). VNC is different from other virtual hardware in that the sys-admin of the virtual machine (who might be untrusted) needs to access it. Virtual block devices etc are only accessed by the DomU and Xen manages the back-end. The best reference in regard to these issues seems to be Tavis Ormandy’s paper about hostile virtualised environments [5]. Tavis found some vulnerabilities in the QEMU hardware emulation, and as QEMU code is used for a fully virtualised Xen installation it seems likely that Xen has some vulnerabilities in this regard. I think that it is generally recommended that for best security you don’t run fully virtualised systems. The remote-console type management tools are another potential avenue of attack for virtualised servers in the case where multiple users run virtual machines on the same host (hardware). I don’t think that this is an inherent weakness of virtualisation systems. When security is most important you have one sys-admin running all virtual machines - which incidentally seems to be the case for most implementations of Xen at the moment (although for management not security reasons). In ISP hosting type environments I doubt that a remote console system based on managing Xen DomU’s is going to be inherently any less secure than a typical remote console system for managing multiple discrete computers or blades. I have just scanned the Xen hypervisor source, the file include/asm-x86/hypercall.h has 18 entries for AMD64 and 17 for i386 while include/xen/hypercall.h has 18 entries. So it seems that there are 35 or 36 entry points to call the hypervisor, compared to 296 system calls on the i386 version of Linux (which includes the sys_socketcall system call which expands to many system calls). This seems to be one clear indication that the Linux kernel is inherently more complex (and therefore likely to have a higher incidence of security flaws) than the Xen hypervisor. Theo’s main claim seems to be that Xen is written by people who aren’t OpenBSD developers and who therefore aren’t able to write secure code. While I don’t agree with his strong position I have to note the fact that OpenBSD seems to have a better security history than any other multi-user kernel for which data is available. But consider a system running Xen with Linux in Dom0 and multiple para-virtualised OpenBSD DomU’s. If the Linux Dom0 has OpenSSH as the only service being run then the risk of compromise would be from OpenSSH, IP based bugs in the Linux kernel (either through the IP address used for SSH connections or for routing/bridging to the OpenBSD instances), and from someone who has cracked root on one of the OpenBSD instances and is attacking the hypervisor directly. Given that OpenSSH comes from the OpenBSD project it seems that the above scenario would only add the additional risk of an IP based Linux kernel attack. While a root compromise of an OpenBSD instance (consider that a typical OpenBSD system will run a lot of software that doesn’t come from the OpenBSD project - much of which won’t have a great security history) would only lose that instance unless the attacker can also exploit the hypervisor (which would be a much more difficult task than merely cracking some random daemon running as root that the sys-admin is forced to install). Is the benefit of having only one instance of OpenBSD cracked due to a bad daemon enough to outweigh the risk of a Linux IP stack? I’m sure that the OpenBSD people would consider that a better option would be OpenBSD in the Dom0 and in the DomU. In which case the risk of damage from a root compromise due to one badly written daemon that didn’t come from OpenBSD is limited to a single DomU unless the attacker also compromises the hypervisor. When working as a sys-admin I have been forced by management to install some daemons as root which were great risks to the security of the system, if I had the ability to install them in separate DomU’s I would have been able to significantly improve the security of the system. Another flaw in Theo’s position is that he seems to consider running a virtual machine as the replacement of multiple machines - which would be an obvious decrease in security. However in many cases the situation is that no more or less hardware is purchased, it is just used differently. If instead of a single server running several complex applications you have a Xen server running multiple DomU’s which each have a single application then things become much simpler and more secure. Upgrades can be performed on one DomU at a time which decreases the scope of failure (which often means that you only need one business unit to sign-off on the upgrade) and upgrades can be performed on an LVM snapshot (and rolled back with ease if they don’t succeed). A major problem with computer security is when managers fear problems caused by upgrades and prohibit their staff from applying security fixes. This combined with the fact that on a multiple DomU installation one application can be compromised without immediate loss of the others (which run in different DomU’s and require further effort by the attacker for a Xen compromise) provides a significant security benefit. It would be nice for security if every application could run on separate hardware, but even with blades this is not economically viable - not even for the biggest companies. I have converted several installations from a single overloaded and badly managed server to a Xen installation with multiple DomU’s. In all cases the DomU’s were easier to upgrade (and were upgraded more often) and the different applications and users were more isolated. Finally there is the possibility of using virtualisation to monitor the integrity of the system, Bill Broadley’s presentation from the 2007 IT Security Symposium [6] provides some interesting ideas about what can be done. It seems that having a single OpenBSD DomU running under a hypervisor (maybe Xen audited by the OpenBSD people) with an OpenBSD Dom0 would offer some significant benefits over a single OpenBSD instance.

Share This

Andrew Stribblehill: Ryanair unstrangeness

I wrote a few months ago about how Ryanair had started charging for web check-in despite it being a cost saving for them — and how this was not the Ryanair that I understood. Well, I was proved right last week when they switched surcharges. Now you have to pay if you want to check in at the desk, and you get priority boarding and online check-in for free. If only they would start putting some effort into maintaining the uptime of the web check-in site, I would be happy. That said, it beats Aer Lingus which refuses to let you print out a replacement boarding pass if (for example), Firefox crashes on getting the PDF the first time around.

27 October 2007

Russell Coker: Senator Online

I’ve been asked for my opinion of senatoronline.org.au which claims to be Australia’s only internet-based political party. The claim may be correct depending on what you consider to be “Internet based“. Here is a copy of their platform from their web site:
Senator On-Line is not aligned to any other political party it is neither Liberal nor Labor. Senator On-Line ( SOL ) is a truly democratic party which will allow everyone on the Australian Electoral roll who has access to the internet to vote on every Bill put to Parliament and have its Senators vote in accordance with a clear majority view. We will be running candidates for the upcoming federal Upper House (Senate) elections. When a SOL senator is elected a web site will be developed which will provide: Each person on the Australian Electoral roll will be entitled to one vote and only be allowed to vote once on each bill or issue. SOL senators will have committed in writing to voting in line with the clear majority view of the SOL on-line voters. Senator On-Line will enable broader community involvement in the political process and the shaping of our country. If you like the concept, please register your details and tell others about SOL.
Now at first glance it sounds like a good idea, the Liberal party (which is similar in all the bad ways to the US Republican party) has demonstrated what happens when a party gets away with entirely ignoring the wishes of the voters. But there are three significant problems with the Senator Online idea. The first is the issue of providing “Accurate information and balanced argument on each Bill“. We have seen many media outlets claiming that there is a debate about global warming (the debate ended years ago, the vast majority of scientists have agreed that global warming existed for a long time) and now the same media outlets are claiming that there is a debate about whether it will cause any harm to us in the near future (ignoring all the dams that are running low). One of the aims of the democratic process is that representatives who spend all their time working on politics can fully analyse the issues and also gain access to resources that are not available to the average citizen, thus being able to make better informed decisions. The next problem is that it can degenerate into mob-rule. The idea of having a tabloid TV show being able to directly control votes in the senate is not an exciting one. The final problem is how to ensure that each citizen gets the opportunity to have exactly one vote, solving this requires good security and identity checks involving viewing photo-id. The checks used for voting (merely asserting your name and residential address) might be considered adequate for an election, but are grossly inadequate for online voting where one false registration allows many false votes. I think it would be more interesting to have a populist party started that campaigns for the issues that have the most impact on the majority of citizens. Issues such as the fact that a couple on the median income can’t afford the median house price [1], the lack of job security that is caused by recent industrial relations legislation, the price of health-care, and the fact that any car which is affordable on a single median income (after money is spent on rent and other basic living expenses) will lack basic safety features such as air-bags. While the Green party has decent policies on these issues they have many other policies to consider. A party that solely concentrated on allowing more people to have decent health care, not risk losing their job, own their own home, and drive a safe car would get a lot of interest from people who don’t normally take much notice of politics.

Share This

Enrico Zini: axi-query-tags

apt-xapian-index: smart way of querying tags I've recently posted: Note that I've rewritten all the old posts to only show the main code snippets: if you were put off by the large lumps of code, you may want to give it another go. Today I'll show how to implement a really good way of searching for Debtags tags. When I say really good, I mean the sort of good that after you run it you wonder how could it possibly manage to do it. The idea is simple: you run a package search, but instead of showing the resulting packages, you ask Xapian to suggest tags like we saw in axi-query-expand.py. For extra points, I'll use an adaptive cutoff in chosing the packages that go in the rset. So, let's ask the user to enter some keywords to look for tags, and use them to run a normal package query: 
# Build the base query
query = xapian.Query(xapian.Query.OP_OR, termsForSimpleQuery(args))
# Perform the query
enquire = xapian.Enquire(db)
enquire.set_query(query)
Now, instead of showing the results of the query, we ask Xapian what are the tags in the index that are most relevant to this search. First, we pick some representative packages for the expand: 
# Use an adaptive cutoff to avoid to pick bad results as references
matches = enquire.get_mset(0, 1)
topWeight = matches[0].weight
enquire.set_cutoff(0, topWeight * 0.7)
# Select the first 10 documents as the key ones to use to compute relevant
# terms
rset = xapian.RSet()
for m in enquire.get_mset(0, 10):
    rset.add_document(m[xapian.MSET_DID])
Then we define the filter that only keeps tags: 
# Filter out all the keywords that are not tags
class Filter(xapian.ExpandDecider):
    def __call__(self, term):
        "Return true if we want the term, else false"
        return term[:2] == "XT"
Then we print the tags: 
# This is the "Expansion set" for the search: the 10 most relevant terms that
# match the filter
eset = enquire.get_eset(10, rset, Filter())
# Print out the results
for res in eset:
    print "%.2f %s" % (res.weight, res.term[2:])
That's it. We turned a package search into a tag search, and this allows us to search for tags using keywords that are not present in the tag descriptions at all: 
$ ./axi-query-tags.py explore the dungeons
27.50 game::rpg:rogue
26.14 use::gameplaying
17.53 game::rpg
10.27 uitoolkit::ncurses
...
$ ./axi-query-tags.py total world domination
7.55 use::gameplaying
5.68 x11::application
5.35 interface::x11
5.05 game::strategy
...
You can use the wsvn interface to get to the full source code and the module it uses. You can see a similar technique working in the Debtags tag editor: enter a package, then choose "Available tags: search".

Antti-Juhani Kaijanaho: RFH: dctrl-tools Command-line tools to process Debian package information

I request assistance with maintaining the dctrl-tools package. There are several tasks that could use more manpower (in no particular order): Eventually I’d like to pass the package on to competent successors, but I have too much emotional attachment to the package to do that without a transitional period where I still retain a veto on what goes in the package. I also have some ideas for future tools that I’d like to be
able to concentrate on, and having co-maintainers might allow that. The package is now under Git in collab-maint. See the new README.Debian for information and a push-access code of conduct.

Marc 'HE' Brockschmidt: "What to do when I've collected all left socks" or "what I want to change in Debian"

It's this time of the year again: The one where I look back at my involvement in the project and decide that I've been a member long enough, so I should probably get out. For Debian, there are two ways to do it: Either become MIA or become DPL. As I have too many real life connections to other DDs, I guess I can't really do the MIA thing, so I should probably get elected as DPL. Whenever I consider this way out, I think about all the issues that make me unhappy about Debian. This time, I've written them down. So, here's a list of things I would like to see and would work on if I had the power to do so:


Besides those things that I really miss in Debian, there are also a few things I would simply like to see done in the near future:


So, what do you think? Are all of those ideas crap or should we perhaps try to implement them? Have I missed something important?

Russell Coker: A Traditional Approach to an IT Career

I have just read Career Development for Geeks [1] by Erik de Castro Lopo [2]. It makes some interesting points about a traditional approach to an IT career. The path I followed for most of my career (after I had a few years experience) was to work as a contractor and happily leave jobs without having anything else lined up. Erik suggests getting Engineers rather than managers to give references, it’s an interesting idea. Engineers can give better references about quality of work, while managers can speak on behalf of their employer (in theory). In practice a sane manager won’t give a bad review for legal reasons so the value of a reference from a manager is probably limited. Of course one problem with reviews is that I have never heard of a recruiting agent or employer actually verifying the ID of a reference. I could be listed on a friend’s CV as a senior manager in a multi-national company (which doesn’t have a major Australian presence) and give a good review and it seems unlikely that the typical recruiter would work it out. For someone with plenty of spare time and no significant assets (no risk of being sued) it could be entertaining to apply for a bunch of positions that they are not qualified for with friends using pre-paid mobile phones to give references. This could be done as a documentary on corporate hiring practices, or to simply try and get the highest paid job possible. Based on observing some former colleagues it seems that little skill is required to get a job and that when people do really badly they get paid for at least a few months. I am constantly amazed when reading reports about so-called “con artists” who commit crimes for what are often small amounts of money. Getting an income significantly greater than average without knowing anything about how to do the work is very common and is never treated as fraud (the classic example was a former colleague who wanted to write his own encryption algorithm but who didn’t even know about binary and therefore couldn’t use operations such as XOR). Erik’s main suggestion for dealing with recruiting agents is to talk about projet management issues (recruiters don’t understand technology). My way of dealing with them has been to assure them that I know it all and tell them to forward my CV to the client. Another suggestion is to learn new skills and diversify your skills. I don’t supoprt this because I believe that the majority of people who read my blog are significantly more skillful than the typical programmer. If an area of technology starts to go out of fashion then it’s the people with the least skills who suffer the most. If you are good at your work and enjoy it then it shouldn’t matter much if people around you are being laid off. Of course to rely on this you have to be working in a reasonably large field. For example if you develop software in a language which has hundreds of programmers then you may be at risk, but if there are tens of thousands of programmers using the language then you only need to be in the most skillful 10% to be assured of employment for the next decade or two. That said there are benefits to moving around, meeting new people, and working on new contracts. One thing you don’t want is to have 10 years of experience which are the same year repeated 10 times! Update: Here is a paper Erik submitted to OSDC on the same topic [3]. Mostly the advice is the same but with more detail and in a better format for reading.

Share This

Michael Prokop: Could not set non-blocking flag

Looks like many people didn’t manage to solve this problem, so let’s feed google… If you notice the following error message when running apt-get:
# apt-get update
[…]
98% [Working]FATAL -> Could not set non-blocking flag Bad file descriptor
E: Method http has died unexpectedly!
# echo $?
100
… you forgot to mount the according partition using the dev mount option. So fix it via running something like:
mount -o remount,dev /path/to/filesystem

26 October 2007

Biella Coleman: Should it stay or should it go?

What a week. Most notably, I am still in a state of partial disbelief that my case with Blue Cross Blue Shield is now on a path toward resolution and I don t have do battle with them, or at least in the same vigorous, soul-crushing way I have been engaged in since May (they still have not paid all the bills but at least part of them are resolved). But the very same day that I received the good news about BCBS, I received not so good news from my dermatologist about the black-blue mole that lies right under my left eye. He wants it gone, removed. So my whole fight with BCBS concerned claims over pre-existing conditions related to my moles. My claim was that I never had a problem with them until I had BCBS insurance and that is indeed the case. Soon after I first started having problems, I went on mole patrol and found a suspicious mole on my sister, which turned out to be melanoma. Now whenever I see a dermatologist, they all say, given my family history, given I grew up in the tropics, and given the odd size and very dark color of my mole, that it has to go. In fact the last dermatologist said with the firmest of tones: there is no doubt in my mind that it must be removed. The words stung because, well, I am pretty attached to the mole. I have lived with it for my whole life and it is fundamentally, even if somewhat mysteriously, linked to my sense of self. If it goes, I would feel like a very important part of me would also vanish. On more prosaic grounds, I can t help think that part of the drive to remove such a spot is just part of somewhat unhealthy social trend toward measuring most everything in finer and finder gradations of risk. Given that this mole is on my face and I see my face at least 2x a day in the mirror, I would probably catch anything if it started to change but given our risk society it is unsurprising that every American dermatologist keeps saying it is time to bid adieu to it. Given my background in medical anthropology I can t help conceptualize all this advice within these much larger social trends and then I go back and forth endlessly in my head as to whether I should remove it because it is safe and right and sound or whether I am caving in to somewhat irrational trend toward the risk management of everything. Finally I fear my insurance company again. Though I have a good job and decent insurance, I may not have good enough insurance for what this procedure entails.
Because of the size and location of the mole (large and close to my eye), if removed it must be done by a plastic surgeon. And plastic surgery in the US and plastic surgery in NYC costs a very pretty penny. While I would plan on getting pre-approval for the surgery, I somehow have the feeling that they will not pay the full cost and I am going to be left with another bill. And I am trying to stop the unnecessary onslaught of bills. So should it stay or should it go? I bet that I will lean toward the latter but not without a lot more thoughts, internal cries of resistance, and sense that even if I decide it is the best thing, I will lose a small piece of myself once removed

Clint Adams: zrockboxing out

Someone gave me an MP3 player. He did so for somewhat devious reasons, but that's outside the scope of this post. It is a SanDisk Sansa stop thinking of pulp fantasy and it has roughly 500 gigs too little storage space. The FAQ says such cute things as The original firmware is recommended for charging at this time, and Rockbox does not currently provide either functionality so you will need to continue using the original firmware (for now) in MSC (UMS) mode to add music to the Sansa. Please don't tell my Sansa about this FAQ because it thinks that both of those claims are false. I want my newfangled device to participate in the spyware fiesta known as last.fm, and Rockbox has an option for supporting that; if you turn it on, it fills a /.scrobbler.log file with tab-delimited lines for your parsing pleasure. Rather than download additional software to cope with my new lifestyle, I whipped up the following script (released under the gnocchi-ng license) which converts the log to something you can just stuff into your ~/.zomg/cache file and send up to the submission server at your next appropriate invocation of zomg. I'm afraid you'll have to handle any timestamp sorting by hand, but if you script it, be a dear and implement some kind of cache file locking. 
#!/bin/zsh
# Copyright (C) 2007  Clint Adams.  All rights reserved.
# This program has no name and is released under the terms of
# the gnocchi-ng license.
audioscrobbler_urlencode()  
  if (( $+options[multibyte] )); then
    setopt localoptions extendedglob nomultibyte
  else
    setopt localoptions extendedglob
  fi
  input=( $ (s::)1  )
  print -- $ (j::)input/(#b)([^A-Za-z0-9_.!~*\'\(\)-])/%$(([##16]#match)) 
 
audioscrobbler_constructquery()  
  local sid="$1"
  local artist=$(audioscrobbler_urlencode "$2")
  local track=$(audioscrobbler_urlencode "$3")
  local album=$(audioscrobbler_urlencode "$4")
  local mbid=$(audioscrobbler_urlencode "$5")
  local length=$(audioscrobbler_urlencode "$6")
  local ttime=$(audioscrobbler_urlencode "$7")
  local source="$8"
  local tracknum="$9"
  reply=("&s=$ sid " "&a[0]=$ artist &t[0]=$ track &i[0]=$ ttime &o[0]=$ source &r[0]=&l[0]=$ length &b[0]=$ album &n[0]=$ tracknum &m[0]=$ mbid "$'\0')
 
while read -r line
do
  local -a field
  field=($ (ps:\t:)"$ line " )
  if [[ $field[6] == L ]]; then
    audioscrobbler_constructquery "" "$field[1]" "$field[3]" "$field[2]" "" "$field[5]" "$field[7]" P "$field[4]"
    print "$reply[2]"
  fi
done <<(grep -v '^#' .scrobbler.log)

Clint Adams: Should I short JAVA or NTAP?

Dear Lazyweb (and Andres): Why are Ian Murdock, Eben Moglen, and Pamela Jones supporting a company that tries to extort another company? Is it because actually filing suit is more evil than threats? Why shouldn't they both burn in hell? kthx.

Next.

Previous.