Anyone? Email me. I don't know when or where or who even lives here.

I have just read the Presentation Zen blog post about PowerPoint.

One of the interesting suggestions was that it's not effective to present the same information twice, so you don't have notes covering what you say. Having a diagram that gives the same information is effective though because it gives a different way of analyzing the data. I looked at a couple of sets of slides that I have written and noticed that the ratio of text slides to diagram slides was 6:1 and 3:1 in favor of text, and that wasn't counting the first and last slides that have the title of the talk and a set of URLs respectively.

So it seems that I need more and better diagrams. I'll include most of the diagrams I use in my current SE Linux talks in this post with some ideas on how to improve them. I would appreciate any suggestions that may be offered (either through blog comments or email).

The above diagram shows how the SE Linux identity limits the roles that may be selected, and how the role limits the domains that may be entered. Therefore the identity controls what the user may do and in this example the identity "root" means that the user has little access to the machine (a Play Machine configuration). I think that the above is reasonably effective and have been using it for a few years. I have considered a more complex diagram with the "staff_r" role included as well and possibly including the way that "newrole" can be used to change between roles. So I could have the above as slide #1 about identities and roles with a more detailed diagram following to replace a page of text about role transition.

The above diagram shows the domain transitions used in a typical system boot and login process. It includes the names of the types and a summary of the relevant policy rules used to implement the transitions. I also have another diagram that I have used which is the same but without the file types and policy. In the past I have never used both in the one talk - just used one of the two and had text to describe the information content of the other. To make greater use of diagrams I could start with the simple diagram and then have the following slide have all the detail.

The above diagram simply displays the MCS security model with ellipses representing processes and rectangles representing files.

The above diagram shows a simplified version of the MMCS policy. With MMCS each process has a range with the low level representing the minimum category set of files to which it is permitted to write and the high level representing the files that it may read and write. So to write to a file with the "HR" category the process must have a low level that's no higher than "HR" and a high level that is equal or greater than "HR". The full set of combinations of two categories with low and high levels means 10 different levels of access for processes which makes for a complex diagram. I need something other than plain text for this but the above diagram is overly complex and a full set is even more so. Maybe a table with process contexts on one axis, file contexts on another and access granted being one of "R", "RW" or nothing?

I also have a MLS diagram in the same manner, but I now think it's too awful to put on my blog. Any suggestions on how to effectively design a diagram for MLS? For those of you who don't know how MLS works the basic concept is that every process has an "Effective Clearance" (AKA low level) which determines what it can write, it can't write to anything below that because it might have read data from a file at it's own level and it can't read from a level higher than it's own level. MLS also uses a high level for ranged processes and filesystem objects (but that's when it gets really complex).

This last one is what I consider my most effective diagram. It shows the benefits of SE Linux in confining daemons in a clear and effective manner. Any suggestions for improvement (apart from fixing the varying text size which is due to a bug in Dia) would be appreciated.

The above diagrams are all on my SE Linux talks page, along with the Dia files that were used to create them. They may be used freely for non-commercial purposes.

If anyone has some SE Linux diagrams that they would like to share then please let me know, either through a blog comment, email, or a blog post syndicated on Planet SE Linux.

First day back at work was "fun", it involved phrases like "Internet connection down", "BT line fault" and the all time classic "My email isn't working". Do these faults always wait until just after a holiday to crop up? And the best part is that I get to go back tomorrow for more "fun".

Something went wrong with my mailserver (configuration?) today. So if you got a bounce or are wondering why I didn't answer a mail you sent today, feel free to resend the message as I changed the forwarding to another email address for the time being.

Via BBLUG I've heard about

"a monthly public demonstration of Free Open Source Software (FOSS), aimed primarily at beginners. It's not specifically for Linux, as the software will be demoed on a WinXP system to lure people in ;) -- however, I will make some live linux distro CDs for the event. Here's the details: Title: Introduction to Free Software
Date: Wednesday 18th April
Time: Lunchtime 1-2pm
Place: Cube Cinema, Dove Street South, Bristol BS2 8JS
Map
Price: Free
The website"

Anyone going?

Added: Banco R o, ING Bank l ski, mBank, Sparkasse I notice that Jonathan's earth.li presence: Planned bank outages notes Cahoot's good approach and asks about others. I've sometimes seen announcements on the web pages of NPBS and Co-operative Bank, but no email unless it appears in their routine email newsletters. How about others? (I've posted this comment here because the presence is a login-to-comment site.)

If you use grep-dctrl, sort-dctrl or tbl-dctrl, I’d like to see your use cases! I’m building a system test automaton for dctrl-tools, and I’d like to include as much real-world examples as possible so that any regressions get found before uploading. You can send example command lines (and preferably also a test file, unless it’s one of the standard Debian files like Packages) to me by email at <ajk@debian.org>, as a wishlist bug report against dctrl-tools or by a Darcs patch against the experimental repository (see instructions).

I'm not sure if you have heard about Xing (formerly known as OpenBC) yet. It is meant to be a platform to keep in touch with your business contacts, by having them update their contact data on them own. It also offers additional services, including discussion groups, because since Orkut we know that such a platform won't work without. (But I don't want to rant about Orkut here, thanks for asking.) I stumbled upon a group called GayBC. I guess from the name of it everyone is able to find out what it's about. And it is a closed group, so people who are afraid of discrimination because of stating there preferences publically can feel save. I though that might be the group I'd like to join, having no real problem with my own sexuality of being Bi. (Although, I say it myself that my poem "Mermaids" isn't about the sexual part at all and people who seem to read this in it are not understanding it.) Given that there wasn't too much information on the group page about what they want in the join info I didn't provide too much informations and was rejected of course. I say of course, because that just gave me the impression that the moderators do really care. Alright, I told myself, I'll answer their mail with all informations I could provide. I'm not sure if my fault was that I did that offsite per email or what, but it was never responded to, at all. So I tried to look on the site again for the group page, only I wasn't able to find it anymore through the search. After some digging around through the system and other groups I found out the schema of how the URL has to look to see that I just see on the page that I was rejected. No informations on how to contact the moderators anymore, no information on if this is permanent or whatsnot. So I tried to contact the site support, asking if there is a timeout to such a reject and posibility to reapply, or any idea how to go on. Well, they first tried to tell me to contact the moderators (and ignored the other question). After I told them that that's not possible and teaching them about their own system, they finally forwarded a mail from me with more informations to the moderators. After a while I got a response from one of their moderators saying that as a Bi person I'm not gay enough to join the group... I was like... Uh! A group, that is about people facing discrimination in quite different ways is discriminating themself. I wasn't able to think straight for a while after I read that, trying to find out about what's going on... Well, I thought to myself, the group is German language, and doesn't want to have Bi people in it—so I thought I should turn the anger into something productive. Turning emotions into something productive/creative is the way quite a lot of conflicts can be avoided and good things happen. I applied for creating a group called LesBiGay with the intended purpose of being a closed group too, but not discriminating against Bi people and being English language, and explicitly stated in the comments that the existing GayBC group doesn't want Bi people amongst them. Guess once what happened. The staff from OpenBC rejected the request with the reasoning that GayBC exists already and that I should get in contact with them. Interestingly that message was sent in a way that doesn't allow a reply... The much I like the feature of having all the contact informations for the people available in a nice way and having them current the much I have to make you aware that the rest of the system stinks. Keep away from it, it works against you, doesn't offer minimal informations or features and flexibility. On a sidenote—a dear friend of me showed me Venus Envy after my last blog entry and it really made my last days. Read it all! :D It gives me quite a lot of strength, and there I found this beauty that I dedicate to the GayBC group on OpenBC. Enjoy.

It happened again. The linux-2.6 2.6.20-1 release failed for arches which we don't build snapshots for. This means that none of them was ever built in the time after I commited the whole stuff. As this happens over and over again I consider this a real problem now. So the following arches needs new debian-kernel maintainers: alpha, hppa, and mips.

The Debian Technical Committee has recently decided three outstanding issues, and at least one question still before the committee is moot now that etch is released. So, I spent a little time this evening updating the committee's web page , and closing the bugs related to the issues decided so that we can better focus on the remaining open issues .

I sufferred a disk failure today involving the /home partion of my main communication/development system. Fortunately, I keep my home directory in subversion, so I didn't loose any files that I keep updated in my respository. This, however, does not include my email files. Normally, this would not be a problem at all since all my systems are backed up nightly on a network backup server. Unfortunately, the partition that backs up my failed drive filled to 100% in mid-Februrary, so my email was restored to only mid-February. The main reason for this post is to give notification that if you sent any email to me over the last 2 months, it's been lost, so please do resend. Especially, resending of patches would be appreciated.

So, one of the reasons I've been a bit uncommunicative the last few weeks is that I've been getting my head around Coq, maybe one of the most fascinating pieces of software I've played with in a long time.

What is Coq? I don't know if I understand it well enough yet to give a complete description (the Coq tome only arrived in the mail on Friday and I have yet to make it past the introduction, what with taxes and so on). Here's my best shot:

Coq is a programming language where you write proofs as functions taking proofs of their preconditions and producing proofs of their results. That is, a proof that "If X is an integer, then X-1 X" becomes a function that accepts a proof of "X is an integer" and produces a proof of "X-1 X".

You can manipulate logical expressions more or less the way you expect. For instance, if you have in your hands a set S of natural numbers and a proof that "forall nonempty sets T of naturals, T has a least element", then you can bang these together to produce the least element of S (or rather, a proof that it exists).

I don't think this describes the theoretical underpinnings of Coq, but it does describe my experience of actually using it to prove stuff.

To get the hang of Coq, I'm working my way through basic automata theory -- regexps are done, but I couldn't work out how to express some finiteness constraints on FSMs without generating a lot of extra typing; hopefully the Coq book will have some hints. Once that's done, I'm actually tempted to try something more ambitious. [snip long digression] We'll see ... watch this space :).

It was a real rush, though, to code up these theorems and watch the computer verify them. What really fascinated me was how close to being a practical tool this is. Coq isn't at all a toy -- without quite getting all the theory yet, my intuition is that it can probably cover anything you can express in the predicate calculus (with sufficient amounts of typing, anyway), and while there are a few shortcomings, it's almost (IMO) at the point where anyone who knows some formal logic and has a little patience can prove interesting stuff. Even more suggestive of possibilities, there's a project (which I sadly haven't had time to look at) that integrates Coq with OCaml, so you can have proofs about your OCaml code verified at compile-time!

I could go on and on ... anyway, this is a really cool tool and I'd encourage any mathematically-minded person to give it a spin. The only sad thing is that I doubt I'll ever have the opportunity to explore this stuff in my day job unless/until I go back to school :-(.

Shortcomings of Coq specifically and the whole concept of correctness proofs on programs generally have been moved to a future blog post that may never appear depending on how ambitious I'm feeling this week. Rest assured that I'm aware of (some of) them, I just hit my self-imposed length limit.

[0] the reason being that I could only prove correct the formal underpinnings of the resolver; in practice, a lot of the bugs are in the interface to apt, or in apt itself, and I can hardly prove that code correct.

Don't use the browser name for capability detection. I'd like to emphasize that. For example Google Groups won't let me upload an image to my profile, because I'm not running Firefox or Internet Exploder. Well, I tried both Epiphany (which has a very clean and fast UI, unlike Firefox which is totally cluttered) and Iceweasel (which is Firefox, but with the trademark replaced). Both are using Gecko, Gecko/20070324 for Epiphany and Gecko/20070310 for Iceweasel. So I'm very sure they have the same capabilites as Firefox 2 when it comes to web sites. If you want to test for Firefox's capabilities, use the Gecko version number.. Thank you. [Update: it was suggested I point people to GeckoIsGecko.org, which has links on how to properly detect the Gecko engine, instead of relying on the browser name.] [Update: Mike Hommey pointed out that the 'Gecko/date' string is mostly meaningless, and largely is the build date; it doesn't contain tree information. Instead you should be using the "rv: 1.8.0.11" part of the User-Agent. This is also what the getGeckoRv function on the howto linked from GeckoIsGecko.org does. Oh, and Firefox 2 is not gecko 2, but IIRC uses gecko 1.8.x, just like my Epiphany.]

Ingo Juergensmann has blogged in detail about the new release and the new DPL.

Sam Hocevar ran for DPL on a platform based on some significant new changes. It will be interesting to see what happens over the next year.

The release of Etch is an exciting milestone in Debian development. Among other things it has SE Linux working!

I'm going to try and arrange a party in Melbourne, Australia to celebrate. We also have a mailing list for Debian people in Melbourne, to subscribe send a message to debian-melb-request@taz.net.au with the subject subscribe. I'll use that list for arranging the party, send me private email if you are not subscribed but want to attend.

A little remembered fact is that the Debian Jr. project had a directory in the subversion repository of the CDD project at Alioth. Aside from Andreas Tille’s experimental conversion of Debian Jr. to use cdd-dev¹, there was nothing else there until today. While I was in the process of populating this directory with the junior-* metapackages and adding an external reference to the live CD config, it seemed to me that it would be better to move the whole thing to our own repository at Alioth, which I promptly did. So now you can check it out:

$ svn co svn://svn.debian.org/debianjr

As well, I registered Debian Jr. at http://cia.vc/ and configured svn so that the CIA bot will report on the #debian-jr channel at irc.debian.org for every commit. And finally, I applied for the creation of a debian-commits@lists.alioth.debian.org list. As soon as the list is created, I will hook it up to the repository so you can subscribe to commit emails.

¹ Although this seemed like a good idea at the time, for various reasons I ended up sticking with the single metapackage per category model Debian Jr. uses to this day. But I have retained this experiment in the repository under svn://svn.debian.org/debianjr/branches/EXP-cdd-dev in case we ever reverse that decision.

Today - as many of you have already noticed - is/was a big day for Debian:

• Sam Hocevar won the DPL election


• Debian (old)stable 3.1 released a new version


• Debian Etch 4.0 was released

Well, I could add another topic:

• Debian is no longer Debian for me because not all of my archs are supported anymore

In a more detailed view:
Sam Hocevar won the DPL election
Congrats to Sam! I can agree with most of the points he made in his DPL platform, e.g. a sexier website, sexier distribution, remaing the universal OS, etc.
sexier website: Really, the current design of Debians website is awful. It's really something back from the 90s. Bad look, bad design and stuff you're looking for is difficult to find, because it's badly structured and stuff is spread all over the place. I think, it would be good to have some decent CMS and some good designers/graphic artists - a good package maintainier doesn't make a good webdesigner.
sexier distribution: Many people are using Ubuntu because they're desktop users. The current release cycles are way too long and drive people away from Debian. It's a different matter, of course, for servers or managed systems like Terminal Servers or such. Those are fine with longer release cycles. Splitting up the release in some core and sub releases is a quite common proposal. Yes, this split is difficult, but I think it's the way to go.
remaing the universal OS: As of the release of Etch, Debian became the no-more-universal OS - just because m68k wasn't released for obscure reasons. I'm a great m68k user and now I'm left behind by Debian with the problem that my pet arch is not supported anymore. Running testing/unstable is not an option for m68k IMHO. Because the m68k porters didn't come up with an alternative release plan so far, I think it's the best to shutdown my 3 m68k machines - all of them are m68k buildds - within the next weeks or months. They're producing (well, some little) heat, some disturbing noise and consume a lot of power of course. Currently I accept those drawbacks in order to help the m68k port by donating CPU power running some buildds for about 7 years now. I've spent much more money on this purpose - not only for paying the electricity bills - for phone calls to get crashed remote machines rebooted, sending replacement parts for other buildds or even driving by car to bring machines or other parts to other persons (like crest.debian.org to Michael Schmitz or accel boards to the Netherlands for porting stuff. Anyway, I will happily reactivate the machines when it's up to make a new release for the m68k architecture again! :)

Some other point Sam mentioned in his platform is this:

There are very useful services around, such as http://www.buildd.net/, http://bts.turmzimmer.net/ or http://bjorn.haxx.se/debian/. I cannot understand why they are not Debian services.

I already had a conversation with Sam about this in which I expressed my general intention to develop at least Buildd.Net beyond its current state - it's quite frustrating for me to see Buildd.Net being stuck in development just because I've no more time and skill to develop Buildd.Net further. Sadly, my call for help wasn't as successful as I wanted. Only two persons wanted to help: faw and joey - and both are quite busy with other stuff.
Apparently, Buildd.Net will most likely suffer from shutting down my m68ks due to the missing m68k Etch release as well, because it was always a frontend to my m68k buildds in my eyes. All other stuff on Buildd.Net is just a nice addition to that. And when I don't operate m68k buildds on a daily basis, it's obvious that I won't invest much more time into the development of Buildd.Net. This is already true for the past year where I haven't found the time to fix some serious problems in the backend scripts and database of Buildd.Net, which basically breaks store_packages2.py (source and therefor ptracker.cgi(example) as well. I even haven't found the time to setup trac and svn again after the move to the new server during last autumn.
Erm, anyway.. back to the topic: I wish Sam the best for his period - but I don't think that he can make a big change. I doubt in general that any DPL is able to push big changes in Debian. One reason for this is the short period of just one year. Another reason is that many DDs won't let big changes to be made.

I've upgraded an old woody box to etch these days. Live - I've been telling people they need to find a replacement for this machine for years now, but it's still around and playing an important role. And with 'woody' I mean 'a woody heavily played around with, with a couple of backports and exotic stuff like XFS, a custom 2.4.25 kernel with grsecurity'. Especially the latter was why I was afraid of doing the upgrade. In a first step, I incrementally upgraded everything to sarge (well, at least where the backports weren't already newer than sarge). I installed the stock sarge kernel, and prepared a reboot. The reboot was then done out of schedule, because the machine died on it's own - it has been crashing about 1-2 times a year, and it hadn't happened for some time. Judging from the logs, it was that old problem again. At second try it came up with the new kernel: I always forget to enable init ramdisks in the bootloader when switching from a custom kernel with every needed module built-in. I then continued upgrading to etch, pretty much one service at a time. Some things (I didn't do a full list; the box was running to many modified versions of packages of this being useful as upgrade reports to the release team, and it's a bit late in the schedule, too) where upgrading didn't work out of the box:

• Incompatible configuration file changes: amavis, courier, monit
• OpenLDAP refusing to load one of the third-party schemas
• Newer Courier POP/IMAP is incompatible to drac, breaking SMTP-after-POP
• Configuration changes of saslauthd breaking SMTP-AUTH
• IMP3, a webmail interface, doesn't work with PHP5. It has been replaced by IMP4 in sarge, however I'd like my users to be able to keep on using it for some while (and I need to find a way to migrate e.g. the address book over). I consider this a major upgrade annoyance with PHP5, that it no longer allows "return false;" in some situations (if you want to return by reference, you need to use a named variable). The behaviour of "get_class" also has changed in an incompatible way.

But other than that, the upgrade was mostly a job for apt-get, not for me. The bad news: there is still something wrong with the machine. It doesn't crash, but spits e.g. the following to dmesg:

amavisd-new: page allocation failure. order:5, mode:0xd0
 [] __alloc_pages+0x2f8/0x370
 [] __get_free_pages+0x25/0x40
 [] kmem_getpages+0x22/0xc0
 [] cache_grow+0xba/0x180
 [] xfs_bmap_read_extents+0x36e/0x540 [xfs]
 [] cache_alloc_refill+0x16a/0x220
 [] xfs_bmap_alloc+0xe0d/0x1c60 [xfs]
 [] __kmalloc+0x74/0x80
 [] kmem_alloc+0x59/0xc0 [xfs]
...

So there is something wrong with the XFS malloc handling. This has happened twice now since the reboot. I've been suspecting XFS of being related to the servers' crashes before (which tend to occur during load; the crash which 'allowed' me to switch to 2.6 actually showed the OOM killer of that old kernel killing some inappropriate processes). After the easter holidays, I'll reboot the machine with the etch kernel, maybe this is gone then.

I'm so please to see that this feature has finally launched. For quite a while now, I've wanted to be able to just say, "here's home", "here's work", "here's where we do the grocery shopping", etc, on Google Maps, so I could show mainly the family back home where everything was relative to everywhere else. I'd started looking into the Google Map API, but lost interest because it wasn't easy to do quickly. Too much lat/long stuff for my liking. So the "My Maps" thing is great, just what I've always wanted.

I have seen buses used for tours that contain bunk beds. If one or more such buses were hired then a group of Linux people could go on a moving Linux conference. This would have to take place in an area with many reasonable size cities in a close area and where there is a good number of Linux people in such cities. Probably the EU is the only area.

A bus (or several buses depending on demand) would then take a group of Linux people through the major cities and have a conference in each one.

Currently there are conferences such as the Debian conference DebConf which receive sufficient sponsorship money to pay for many speakers to attend. Having a similar conference traveling around Europe shouldn't cost any more money and will give plenty of time for the people in the bus to do some coding along the way.

We already have the Geek Cruises, my idea is to do a similar thing but on the road. Also it isn't practical to transport an entire conference, so it would probably just be speakers on buses and the audiences would vary from city to city.

As usual, Ed Felten offers a well-conceived analysis of the Cablevision decision from a technologist’s perspective (for a lawyer’s perspective, see William Patry). The money quote:

The question, in other words, was who was recording the programming. Was Cablevision doing the recording, or were its customers doing the recording? The customers, by using their remote controls to navigate through on-screen menus, directed the technology to record certain programs, and controlled the playback. But the equipment that carried out those commands was owned by Cablevision and (mostly) located in Cablevision buildings. So who was doing the recording? The question doesn t have a simple answer that I can see. This general issue of who is responsible for the actions of complex computer systems crops up surprisingly often in law and policy disputes. There doesn t seem to be a coherent theory about it, which is too bad, because it will only become more important as systems get more complicated and more tightly intereconnected.

Agency, intent/scienter, and responsibility are indeed tricky issues with software and the law. I’ve experienced the problem in my own practice. Although it arises particularly frequently in copyright disputes, it is also common in patent and trademark cases (and of course contract disputes inasmuch as clickwrap-type agreements are implicated). I don’t have any coherent theory to propose, but a more uniform framework would certainly introduce some predictability into these sorts of cases (and thus perhaps avoid litigation). Update: Mike Madison also has some interesting comments on the case.