On the 20th of January (8 days before the start of linux.conf.au) I advertised contest to write blog posts related to computer security for the conference Planet [1]. The aim of the contest was to encourage (by money prizes) people who had no prior experience in computer security to get involved by writing blog posts. The rules permitted security professionals to enter but only for an honourable mention, the money was reserved for people without prior experience. The money that I initially advertised was a fraction of what was reserved for prizes, the idea being that if the contest went well then the prize pool could be easily increased but that if it didn’t go well then there would only be one small prize for someone to win by default. At the time I considered a single entry winning by default to be the worst case scenario. The eventual result was that there was only one entry, this was from Martin Krafft on the point of keysigning [2]. Martin has prior experience in the computer security field which excludes him from a money prize, but he gets the only honourable mention. From a quick conversation with him it seems that his desire from entering the contest was to get his ideas about weaknesses in the keysigning process spread more widely, so this seems like a fairly ideal result for him. I agree with Martin that there are significant issues related to the keysigning process, but my ideas about them are a little different (I’ll blog about it later). His point about people merely checking that the picture matches on the ID and not verifying what the ID means is significant, the fact is that the vast majority of people are not capable of recognising ID from other countries. Other than requiring passports (which differ little between countries) I can’t think of a good solution to this problem. Congratulations Martin! It is a good post and a worthy entry. Now as to why the contest failed. I spoke to some people at the end of the conference about this. One delegate (who I know has the skills needed to produce a winning entry) said that I advertised it too soon before the conference and didn’t give delegates time to write entries. While I can’t dispute his own reasons for not entering I find it difficult to believe that more than a small proportion of delegates had that motivation. The LCA Planet had some lengthy posts by other delegates, and the guy who won second prize in the hack-fest spent something like 20 hours coding on his entry during the conference time (I suspect that my contest had the potential for a better ratio of work to prize money). Also the 8 days before the conference started was a good time to write entries for the contest. One suggestion was that I propose that the conference organisers run such a contest next year. The problem with this is that it’s difficult to say “I tried this and failed, could you please try it too”. If nothing else I would need some significant reasons to believe that the contest has the potential to be more successful before attempting it on a larger scale. If the contest had been backed by the LCA organisers then it might have been more successful, but that possibility seems unlikely (and there is scope for an event to be more successful than mine while still being a failure). The reason that I consider it unlikely that official support would make it more successful is that I first advertised the event on my blog (syndicated to the conference Planet). Everyone who has a blog and attends the conference can be expected to have read about it. I then advertised it on the conference mailing list which I believe had as subscribers a large portion of the people who have enough spare time to create a blog specifically for the purpose of entering such a contest. A blogging contest related to a conference but which had a wider scope (IE not limited to one field but instead covering anything related to the conference) might be successful. If someone wants to run such a contest next year then it’s probably worth doing. Of course I have not given up on the plan of getting more people involved in computer security, expect to see some blog posts from me in the near future with other approaches to this. Suggestions would be appreciated.

• [1] http://etbe.coker.com.au/2008/01/20/lca-2008-security-blogging-contest/


• [2] http://madduck.net/blog/2008.01.28:on-the-point-of-keysigning/

Share This

On Sunday, the day before LCA 2008 officially started, Kelly and Rusty asked us first-timers to blog about events, specifically about what we liked and disliked. So far, this conference has been really enjoyable and busy, and I have not found the time to write about its content. The talk I just heard leaves me without an excuse, so there: I have recently had a very interesting and enlightening discussion with a blind Debian developer. When I saw on the conference schedule that Jason White would talk about using Linux with speech and Braille output interfaces, I passed up my opportunity to hear Andrew Tridgell talk about clustered Samba and attended his lecture instead. Jason covered a great number of aspects: from the history of the Braille system, and current, Free implementations thereof, via speech output, to strategies of integrating these techniques into existing programmes which are generally not designed with visually-impaired users in mind. He has a collection of references on his webpage, to which I shall refer for the technical content. His presentation left me very excited and impressed. Excited to see him giving a presentation with such enthusiasm and energy, and impressed because his talk (without notes or slides) was by far better than the job of the average presenter with access to notes and slides to display. Jason conveyed a lot of information in a very well-structured, capitivating report. I think he left most of the audience speechless (figuratively speaking; there were good questions). I feel uneasy with thanking Jason explicitly, or even writing this blog post. If you bear with me for a minute, then let me bridge to women involvement in open-source software. My position on this topic is quite clear: I make no distinctions where they are not obvious, and simultaneously I think it s awesome that more and more women are joining the predominantly male crowd (and their influence undeniably makes the community a more comfortable place). Every now and then, I would like to comment on that, such as I think it s awesome that you are working on this, being a woman (an oversimplified example). What I am trying to say is given how few women are involved with OSS, I appreciate all the more what you are doing. This is non-judgemental, I don t say this because I am trying to highlight someone s gender or sex. It s a communication issue, and I am learning, but I d also rather not limit what I say by making absolutely sure never to offend anyone. But when I utter such a comment, it might still greatly annoy someone or yield vicious returns. This is not always the case in fact, less than it used to be but I ve encountered it here and there, which made me more careful. So when I write about Jason s presentation and how great it was, I want to highlight how it s a greater achievement for him than it would be for me, because he is blind and I am not. I don t mean to single him out or put him on the spot. I am simply impressed, very impressed. And being who I am, I d like to say so. Thanks, Jason. Update: David Schmitt makes an interesting point:

The important question is now, why are we blind people doing great presentations more impressing than people with working eyes doing a great presentation? My personal answer isn t so great: because I didn t expect it. No wonder people get offended if you tell em to their face that I m impressed with his achievements, because I wouldn t have expected it.

I don t agree, or at least I fail to see it. I was impressed, I did not expect it (which isn t to say that I came in to Jason s talk expecting it to be any less than a good talk, I had no expectation! Please think for a second if this isn t immediately clear!) is that offensive? I didn t know Jason, had no way to know whether his presentations are great or less so, but then he pretty much blew me away. The presentation was better than what I am used to (from anyone), and the achievement is all the more greater because it seems to me that he has had to put much more effort into it, purely for accessibility reasons. I guess I should know better, but I still, after all these years, have a problem seeing through the end of it, understanding it. Kant to the rescue, my intentions are good (I claim), but this goes both ways regardless: in any communication, one ought to try hard never to offend. At the same time, one ought to try hard not to be offended until one can be reasonably sure that offence was intended. When I brought this up in Adaora Oniya s miniconf talk on communication challenges, Bdale Garbee recalled the policy in use when he was involved in protocol design work groups: send politely, receive with an open mind. I don t remember his exact words, but I think I got the gist. Update: I just talked to Jason and got his feedback on the issue. It boils down to a quote I ll transcribe: I want my work to be judged by its merit and not by who I am. It only leaves me wondering about the situation at hand: I was impressed by his very well-structured and presented talk and by the fact that he did such a good job given his visual impairment. In any case, I ll close the issue. Jason told me he d happily engage in further discussion and I stated that he is not offended. There is another lesson I learnt: the next time I blog about someone else in such a way, I should really get his/her clearance before publishing! Just to be sure

I speculate that most of what we do for Debian squares with what others do for their respective distro. Thus, it should be possible to identify a conceptual workflow applicable to all distros, consolidate individual workflows on a per-package basis, and profit from each other. Jonathan let me have the after-afternoon-coffee slot of the Distro Summit for an impromptu discussion on the various workflows used by distros for packaging. The discussion round was very short-notice and despite the announcement sent to the conference mailing list, only ten people showed up: two people familiar with Fedora, and ( versus ) eight Debianites. Regardless, I think the discussion was success- and fruitful. We were able to identify a one-to-one mapping between the Fedora and Debian workflows, even though we use different techniques:

• both distros separate original software ( orig tarball ) from modifications made to fit the software in with the rest of the distro.
• Fedora keeps the .spec file, which references the original tarball, alongside any patch files in a per-release directory in their CVS tree, e.g. /mdadm/fedora8 and /glibc/rawhide. To obtain a source tree, the contributor checks out the CVS subtree, downloads the tarball according to the .spec file, and merges the two. There is a tool to automate this, obviously. This process is regularly executed to produce source RPMs .
• Debian keeps the original tarball next to a diff.gz file on the mirrors, along with a dsc file which refers to them both. Tools like dget take the URL to the dsc file to download all three, then invoke dpkg-source to unpack the tarball and apply the diff. Individual patch files are either stored in ./debian/patches/ (and applied by the diff), or they don t exist (meaning that all modifications are concatenated in the diff.gz file.

Many Debian package maintainers use version control systems to maintain the ./debian directory, and if patch files are stored in ./debian/patches/, then Debian and Fedora both store patch files in a version control repository, which seems awful. Just as I am only one of many who are experimenting with VCS-based workflows for Debian packaging, the Fedora people are also considering the use of version control for packaging. Unlike Fedora, who seem to try to standardise on bzr, I try to cater for the plethora of version control systems in use in Debian, anticipating the impossibility of standardising/converging on a single tool across the entire project. It seems that our two projects are both at the start of a new phase in packaging, a paradigm shift . What better time could there be for us to listen to each other and come up with a workflow that works for both projects? My suggestion currently centres around a common repository for each package across all (participating) distros, and feature branches. Specifically, given an upstream source tree, modifications made during packaging for a given distro fall into four categories:

• upstream changes, such as bug fixes in the original code, or simple things like manpage typos.
• (Linux) distro stuff, such as init.d scripts or Linux-ifications, which upstream doesn t care about or doesn t want.
• .deb/.rpm-specific changes, like the ./debian directory or the .spec file.
• distro-specific modifications, like policy compliance and the like.

Given a version control system with sufficient branching support, I imagine having different namespaces for branches: upstream-patches/*, distro/*, rpm/* or debian/*. Now, when building the Debian package, I d apply upstream-patches/*, distro/*, deb/* and debian/* in order, while my colleague from the Fedora project would apply upstream-patches/*, distro/*, rpm/* and fedora/*, before calling the build tools and uploading the package. There are surely problems to be overcome. Pascal Hakim mentioned patch dependencies, and I can t necessarily say with a clear conscience that my workflow isn t too complicated to be unleashed into the public yet. But if we find a conceptual workflow applicable to more than one distro, it should be possible to implement a higher-level tool to implement it. Also, the above is basically patch maintenance, not the entire workflow. Bug tracking system integration is going to play a role, as well as other aspects of daily distro packaging. I ll leave those for future time. For me, this is the start of a potentially fruitful cooperation and I hope that interested parties from other distros jump on. For now, I suggest my mailing list for discussion. You can also find some links on the Debian wiki.

As during previous keysigning events, such as DebConf7 and DebConf6, I turned up to the LCA 2008 keysigning event with my ID card issued by the Transnational Republic. Previously, this act has caused people to to get rather upset. I have explained my motivation and rationale in response to the thread; yet, my reputation as keysigning subverter precedes me. I maintain that I am not subverting the web of trust in any way. I conduct this experiment mainly out of interest, and to sensibilise participants of the web of trust. Even though I stated previously that I would no longer attend keysigning events, I couldn t pass up this opportunity on the other side of the planet. Fifty-seven people exchanged data and glances at ID cards with me. In total, 9 people asked about this ID card, mostly out of curiosity, but only one person flat out refused to sign my key. This leaves 47 who apparently accepted it. If you disagree with my approach, please do not sign my keys, 0x330c4a75 and 0x667c7088 (but do read my arguments, please). I will not import signatures I receive for a while, so if you have already sent your signatures by the time you read this, send me a note and I ll delete them. Keep in mind that you are not authenticating the ID. You are authenticating my identity. And unless we ve interacted or you otherwise know who I am and that I am the same person as is using this key for the work through which you know me, you should not sign my key. Also note that I continue to stick to my policy and will only sign keys of people that I know . Thus, if you want my signature and we have not previously interacted, you have four more days until the conference is over. Update: a couple of people replied, including Paul Wayper. I ve since had an interesting discussion with him but still want to address two points in his post here: The ID presented is not fake , it is simply issued by an entity that is not considered official . Its data are all correct, which I am happy to prove to anyone who cares. Second: if the web of trust were to die if everyone did what I was doing, would it live forever and improve continuously if we continue such mass signings based entirely on IDs? Noone can know how to verify IDs from all countries that issue them, introducing fakes is trivial (as my experiment and this message hopefully show). I think it s a case of quality versus quantity. Whether you buy my point that you need to ask yourself what you are actually proving to the web of trust with your signature (and sign (or not) accordingly), or whether you are signing an identity (what is identity?), I would suggest to concentrate more on educating people. At the keysigning at DebConf7 in Edinburgh, we split people into smaller groups around well-connected keys. Within each group, prior to the keysigning, experienced key owners would take a short time to talk about the process and explain its goals. Specifically, they would make it explicit that there is no obligation to sign ones key, similar to what Jonathan said in this message prior to the LCA keysigning. My experiment yielded a small discussion on the LCA chat mailing list, which is worth a read if you haven t seen it yet.

I filed an HP support request on 22 January. On 23 January, I received the following mail: Your support request regarding,HP LaserJet 3052 All-In-One E-Mail Support, was received 1/22/2008, 9:41:14 AM. Your unique ID is 532458. A support engineer will be getting back to you, via email, within the next business day to address your issue. We appreciate your patience. By 28 January I had not heard back from them. Why do they even bother to send such auto-replies?

The first of my talks at LCA 2008 gave me a chance to talk about the current state of the Debian project, which got me my first LWN.net coverage with a photo, even (subscribers only for now, the article will become public on 7 February). Thank you, Jonathan Corbet, for a very good article which nailed all the main points! Slides are here. I agreed to this talk on short notice because I like to talk about Debian and was honoured by the chance to represent the project in this form. I would not have been able to do it without plenty of helpful input from colleagues in the last few days. Since I didn t get a chance to display the final slide with the acknowledgements during the talk, I would herewith like to thank specifically Andreas Tille, Michael Banck, Kevin Mark, Josip Rodin, MJ Ray, Cyril Brulebois, Stefano Zacchiroli, Frans Pop, Moritz M hlenhoff, Russ Allbery, Steve Langasek, Luk Class, Andreas Schuldei, and Christian Perrier. No guarantees for the completeness of the list. The talk ended in an open discussion on how Debian could improve. I took notes and shall forward them to the project mailing list, once I get a chance. Thanks to all the participants, as well. Update: during the talk, I mentioned that there was no security support around the time of the etch release. Thanks to Moritz M hlenhoff, who spotted my error: that should have been sarge . The problems with security support had long been resolved by the time etch was being prepared, and this was in (large?) part thanks to Moritz. Sorry for the screwup! I also called Linux to tend towards multimedia more than one might like. I should not have made this comment as a representative of the Debian project, and I probably did unjust to the Linux kernel in whole. This is entirely a personal issue, I have a number of problems with Linux memory management, scheduling, and some other points relevant to production use. I ve had some of these problems for years, but they seem never to get fixed, while development is fast-paced. Then I look at some of the work being done and I wonder what the priorities are. Regardless, I should not have made this comment and I apologise for it.

Maybe someone can shed some light on these outstanding questions about airplane safety. The Thai steward earlier made it perfectly clear, with a straight face, that our safety is their priority, but so far, no-one of the crew could give me the answers:

• why do window shades have to be opened during take-off and landing?
• why do tables and leg rests have to be stowed away during take-off and landing?
• why can t I recline my seat during take-off and landing?
• why do they shut down the in-flight entertainment during take-off and landing and force you to watch advertisements and map views? Are those less likely to cause interference?

I ll stick to those airplane-specific ones for now. I have another set of questions about certain airport rules on the ground. I feel that the world would be a much better (and safer) place, if those making the rules would actually let us know what these rules are trying to accomplish. Update: I ve received plenty of responses. Thanks! Most responses explain questions 1-3 wit reference to the critical nature of take-off and landing. Leaving the windows open helps people orient themselves in case of an emergency and that people from the outside can get in at the right spot, tables and leg-rests are obstacles during an evacuation, and the seats are designed to absorb shocks, but won t work so well if they aren t upright. One person argued that entertainment during the critical phase of take-off and landing is distracting in case of a problem, but I am somewhat unconvinced. I have not received another I must say that none of these responses are surprises. I guess my main point is that airlines might want to consider making these things public, rather than just instructing people about the rules. It would make me happier to comply anyway.

Your new door to the world the slogan for Bangkok s new Suvarnabhumi airport tries to get people to stop-over on their trips between Europe and Asia. The airport s webpage claims that the airport currently handles 45 million passengers per year, but that it would scale up to 110 million. I don t see this happening, at all. Today, leaving for Melbourne, I waited for an hour in the security queue, as four flights were leaving concourse E (which has 10 gates) at once: around 500 passengers were queueing to be scrutinised for explosive liquids and other stuff a real terrorist would never consider smuggling on a plane via the standard passenger processing theatre in four lines behind four security checkpoints (in fact, that s how I confirmed my estimate: around 30 seconds per passenger (I timed it), it took me one hour, that s 120 passengers per queue, so about 500 total, at once). Four lines, one hour? 45 million passengers. 110 million passengers? Six lines (there isn t much more space), so 200 passengers per line, 1:40 hours? My new door to the world? Bangkok? Of course, this is in large part because of idiot passengers. While I was waiting in line, they came three times (every 20 minutes) to empty the garbage can where potential terrorists have to dump their drinkable explosive fluids. We ve had this ban for over 1 years, for crying out loud! Sure, some people don t (get to) fly a lot and a few may really not have heard about dangerous liquids yet (I felt really sorry for an elderly couple who had to ditch pretty much all their toiletries leaving Zurich for Madrid and wondering how they would survive there), but then at least open your eyes and turn on your brain, please. Unfortunately, the typical Bangkok/Southern Thailand tourist probably hasn t got brain cycles left between walking and carrying luggage. If you don t believe me, stop-over in Bangkok and look around: anything with legs in shorts and flip-flops probably fits right in, any obscenely and annoyingly loud group as well. For instance, this circus of 10 en route to London, who joined the end of the queue (read: about 1 hour to go) after their flight s final call with millions of shopping bags. They furiously tried to raise hell, but failed and probably missed their flight. Observing all such episodes around me made the hour go by fast I also had ample time left before my gate would close. There was one situation, however, that made walk over and complain to the supervisor (the one with the walkie-talkie): a couple from Canada were similarly faced with the final call for their flight to Toronto and walked straight up to the top of the lines outside the ropes. After a short discussion, one of the security attendants escorted them to the gate without subjecting either their bags or bodies to the ever-secure screening process. The supervisor (the one with the walkie-talkie) didn t speak English. All she did was smile and make motions with her hands which suggested that I should join the end of the queue. As I said before, I don t believe that the (minimal) added security we have at airports today corresponds to or justifies in the slightest bit the shit we have to go through these days to be airborne. However, if you make rules, then stick to them and don t open gaping (= inviting) security holes. Fortunately, the Canadians later had to surrender their weapons of plane destruction since, on every gate, another party of security attendants glove-hand-searched every bag a second time, with the previous security checkpoint no 100 metres behind. I don t see Suvarnabhumi as a successful or scalable airport. If Bangkok wasn t such a great place ?to kill a few hours (especially compared to e.g. Singapore), or the (best) entrance to Southeast Asia, I d probably avoid it in the future.

Here s an important lesson I learnt today: if you are in Thailand and still feel the effects of a not-so-recent knee and wrist injury, you should, before the massage, learn how to say in Thai: please, go easy on my knee and my wrist. The rest of my body likes brutal Thai massages (well, learnt to like them), but when the knee is bent and twisted and my face inadvertedly morphes in agony, the typical massagist will apologise furiously and take it easier from now on not what I want, at all. Three Thai hanging out on the street, asked individually, could not translate I like it rough but my knee does not. Instead, they just giggled and wanted to know where I was from and where I was going and whether I wanted a massage or attend porn shows or buy drugs or well, that about lists it all. No blame for the average Thai s broken English, it s still better than my command of their language.

After a few amazingly efficient days at home, working on netconf (but not getting to where I wanted) and preparing the presentation I deliver on Thursday at LCA 2008, and tying up other loose ends, I found myself in front of a television set Friday morning to witness the beginning of Federer s defeat in the Australian Open half finals. Unfortunately, I had to leave at the start of the third set and no-one in the airport knew of the game, so I had to call a friend from the plane to get the final result: 7:5, 6:3, 7:6, Djokovic won. I like Federer, and enjoy the Swiss fandom from everywhere, but his tennis wasn t up to his normal level, a true shame. Djokovic has been my favourite for about a year now, so I am excited by the result, but it would have been better to see a bit more of a battle between the two. I trust he ll win on Sunday and cross my fingers! It kind of bites to arrive in Melbourne on the day of the finals, knowing that I would have had a chance to get a ticket and could have travelled a day earlier. Oh well So I am sitting here in a crap Bangkok Internet cafe, finishing off my presentations. In addition to the netconf talk, I am also talking twice at the Debian Miniconf on Monday: first, the State of the Debian project address , which I agreed to do very short notice but knew that I could count on my colleagues to help (don t read the thread before the talk ); second, I also have a slot to talk about version control systems and Debian packaging, a topic that has been on my mind for almost three years now, resulting in elaborate workflows and many discussions. It s also becoming more and more of a hot topic for the entire project. I am tired. We landed at 5:30 and I was shattered, not having been able to shut an eye throughout the ten hours of flight. Fortunately, they let me into the lounge in the arrival area, where I crashed in one of their slumber rooms and got close to four hours of sleep, successfully ignoring the chatter from outside why did Thai Airways lay out their lounge in such a way that the slumber rooms are right next to the staff rooms with the squeaky doors? One thing about living in Asia, where space is scarce, is that people here never seem to mind about noise and sleep through anything. So I did too. I took a shower, ate some breakfast and headed into the city. I was impressed by the new Bangkok airport Suvarnabhumi , which definitely is a step up from the old, horrific one. However, I tend to doubt their claim that they could scale from the current 45 million passengers per year to 110 million. The walkways are too narrow, there are way too few toilets around, and immigration is painfully slow despite the large number of open alleys. Now in downtown Bangkok, I am biding my time. I have been here a few times before and have a number of routine stops, such as visiting the retail manager of the Jim Thompson Company, a loveable lady who speaks fluent English and is very fun to talk to. I met her during my last trip to Southeast Asia, but have since not been in touch. I now plan to head to a massage place, where they deliver merciless (and thus excellent) Thai massages, and then on to some market or Chinatown for food. I ve been training myself on chili ( Thai chocolate ) consumption for this moment: to walk up to a food stall, order a curry, and answer Thai hot when they ask for the degree of spicyness, given that I m a foreigner. At midnight, my plane leaves for Melbourne to arrive on Sunday afternoon. I have little clue as to what awaits me. I ve been to quite a number of conferences, but always perceived LCA to be somewhat special. I am definitely looking forward!

I previously wrote that:

The next step is to produce patches against the X server 1.4 in Debian/Sid and Ubuntu/Hardy, and then get the fix merged into the upstream X.org tree before X server 1.5 is released.

Good news: Bryce Harrington produced patched X server 1.4 packages for Ubuntu/Hardy! The LTSP and OLPC communities are hereby invited to test this ASAP. If nothing major is reported, this will be become the standard X server 1.4 for the Ubuntu/Hardy LTS release, following which the patch will also be merged into Debian/Sid.

At the dayjob, we're currently clearing our warehouse of previous hardware to make room for upcoming new models, so here's a shameless plug for those who want cool Linux hardware at a discount:

ThinCan DBE60 Hardware: AMD Geode SC2200, 64MB RAM, 32MB DiskOnChip Flash, 3x USB 1.1 ports, 1/8" audio out, Centronics port, VGA port, 10/100baseT network port. Firmware: Etherboot or WinCE 4.1 RDP client. Price: 50 EUR/each - less shipping costs - Minimum order: 10 pieces. PS: we also have about 50 pieces of DBE60 motherboards (without case) that can be used as embedded controllers. People with good soldering skills can add a CompactFlash socket to the unpopulated pads, as desired. ThinCan DBE61C Hardware: AMD Geode LX700 with CS5536 companion chip, 256MB RAM, 4x USB 2.0 ports, 1/8" audio in and out, VGA port, 10/100baseT network port. Firmware: Etherboot on LinuxBIOS. Supported natively since Ubuntu/Gutsy. Price: 150 EUR/each - less shipping costs - Minimum order: 2 pieces.

Interested parties can contact us via the request form.

Benjamin Kosnik of Red Hat put together a guide on the GCC web site with information on porting applications to the upcoming GCC 4.3 release. He integrated some information from my blog and added a number of new items. If you run into any issues while moving to GCC 4.3, I suggest you consult this guide.

Great news: After several weeks of investigating, Bart finally figured out what made the driver for the AMD Geode GX/LX chipset fail on recent X.org servers: it turns out that, starting with X server 1.3, changes under the hood took place that affect a number of products booting off a General Software BIOS, making the whole hardware freeze as soon as a DDC probe is attempted. Bart promptly produced two patches against the x86emu component of X server 1.3 that fix the issue. Hurray! Ubuntu/Gutsy packages of the patched X server 1.3, plus current AMD 2.7.7.5 drivers, are available in my PPA. For Debian/Lenny, the same packages compile from Ubuntu sources as-is. Meanwhile, those of you running Debian/Etch only need to compile the Ubuntu sources for the above AMD driver against the X server 1.1 available in Etch. This should finally allow people developing distributions for LTSP or for the OLPC to use standard Debian packages. The next step is to produce patches against the X server 1.4 in Debian/Sid and Ubuntu/Hardy, and then get the fix merged into the upstream X.org tree before X server 1.5 is released. We're already working on it, but help is always welcome.

Holger reported in his blog that he uploaded a backport of the AMD Geode GX/LX X.org module to Debian. He also points out that what he has backported is from a non-Debian source. In case it wasn't obvious to him, there are good reasons why the official Debian module is not from the OLPC branch: the OLPC branch includes OLPC-only code that breaks operation for non-OLPC hardware. This means that the backport package is completely useless for the vast majority of GX/LX hardware on the market. Well done, Holger!

Things have been rather hectic lately, so I haven't found much time to blog. Here's why: DBE62 The Gigabit Ethernet version of our thin client took more time to produce than I expected, for a number of reasons mostly related to a few improvements we decided to squeeze into the design at the last minute. However, today, we finally reached a point where LinuxBIOS runs as well as it did on our previous DBE61 model and where we no longer need any DOS tool to flash the MAC address into the VIA velocity Gigabit chip we selected. Hurray! Production will only commence in one month, but I'm already excited by the new model's potential, both as a thin client and as an embedded platform. Another good thing is that, thanks to Ubuntu developer Scott Balneaves, we managed to get all the necessary tools to support thin clients based on LinuxBIOS into LTSP, so our Etherboot model works out of the box on Ubuntu, since Gutsy. Hurray! There is one remaining issue related to recent changes in X.org core functionalities that make the AMD driver we need unstable but, again, various AMD, Debian and Ubuntu developers are looking into fixing this, so we should soon have spotless Geode support into Debian and Ubuntu again. T rkiye I visited Turkey twice over the last few months, because I'm putting together a pilot project to better promote the Estonian high-tech sector abroad, in collaboration with the Estonian government. I have to say that the more I visit Turkey, the more I like the place and the more understand why these people see themselves as Europeans because, you know what? They are: practically every significant civilization and religion that is at the core of European culture had major events taking place in in Anatolia or Thrace and, also, a devastatingly huge percentage of the consumer goods sold in Europe are designed and manufactured in Turkey. Learning the rudiments of Turkish has also proven to be a lot of fun. While I'm nowhere near as fluent in Turkish as in Finnish or even in Estonian, the learning curve isn't as steep as I initially expected: Altaic and Ugric languages share a surprising amount of grammatical concepts, while Turkish itself borrowed a lot of vocabulary from French, because the founder of modern Turkey, Atat rk, was very fond of the language. I'll venture that proximity with nearby Middle-Eastern countries that were formerly under French influence has something to do with it too. Identity crisis To me, the most challenging part of these business missions abroad is to represent a whole economic sector from a country of which I'm not a citizen or even a resident. Case in point: Being invited to dinner by a Turkish investor, I noticed the waiter asking my host where his foreign guest might be from. A few minutes later, as the waiter put down a gigantic pita bread with the word "Estonia" spelled in roasted sesame seeds, my host asked, reading my business card:

• Actually, your name doesn't sound Estonian. France?
• Qu bec.
• And your mobile number ... 358 ... is that Finland?
• Yup. I've been living there for the past 10 years.
• Ah! So you don't live in Tallinn?
• Nope. Helsinki.

Looking at the waiter and pointing at the gigantic pita, he continues:

• Actually, make that Canada ... no, Finland ... Ah, sorry, never mind. Just keep it as Estonia.

Honestly, trying to keep a straight face while saying "We" about a country of which I'm not a citizen and where I don't even reside becomes unbearable. At some point, some European bureaucrats will have to admit that I need a new citizenship, to reduce the confusion and to let me find myself a proper national identity again; the sooner, the better. Besides, the absurdity of the situation keeps on jumping at everyone's face: during the second mission to Turkey, I kept on bumping into Finnish diplomats who took personal offense at me for living in their country and yet representing the interests of a competing, neighboring country. If you ask me, I cannot entirely blame them for it. However, as far as I'm concerned, I've done my homeworks: I've been here 10 years, I speak the language and I don't have a criminal record. Given this, you'd think that acquiring citizenship would be a mere formality, but the Ulkomaalaisvirasto doesn't see it that way. If you ask me, this country's very first Minister of Immigration, Mrs.Astrid Thors, ought to unilaterally grant citizenship to anyone who's lived here for at least 5 years, just for the asking, regardless of what circumstances brought them here or of what absurd decisions the Ulkomaalaisvirasto might have previously made on their residence permit status. Doing this would go a long way towards undoing the mess of her predecessors at the Ministry of Interior and it would speak volumes about how much Finnish society has evolved from the days when any foreigner was a commie they had to push over the Eastern border.

Update: Why don't I learn my lesson and stop working too late? Making a fool of myself in public isn't something to be proud of.

Ignore this post if you're seeing it for the first time.

---

Martin, David, this script is broken. When trying to set kernel parameters, there should be a new line, it shouldn't be explicitly removed. I know it looks weird, but this seems to be proven by this output:

kinder:/etc/init.d# ./params4flash start
kinder:/etc/init.d# cat params4flash
#! /bin/sh

exit 0

PATH=/sbin:/bin

# Max time to wait for writeout
MAX_AGE=120
CENT_AGE=$((100 * $MAX_AGE))
# Max percent of mem to use for dirty pages
DRATIO=10
# Once we write, do so until this many percent of mem is still in use
DBRATIO=1

case "$1" in
start)
   echo -n 0         >> /proc/sys/vm/swappiness
   echo -n $MAX_AGE  >> /proc/sys/vm/laptop_mode
   echo -n $CENT_AGE >> /proc/sys/vm/dirty_writeback_centisecs
   echo -n $CENT_AGE >> /proc/sys/vm/dirty_expire_centisecs
   echo -n $DRATIO   >> /proc/sys/vm/dirty_ratio
   echo -n $DBRATIO  >> /proc/sys/vm/dirty_background_ratio
   ;;
restart reload force-reload)
   echo "Error: argument '$1' not supported" >&2
   exit 3
   ;;
stop)
   # No-op
   ;;
*)
   echo "Usage: $0 start stop" >&2
   exit 3
   ;;
esac
exit 0
kinder:/etc/init.d# cat /proc/sys/vm/swappiness
60

I’ve climbed up above the tagclouds and appear to be back in the “blogosphere” whatever that is. I hate that “blog” word. I also hate the word “prosumer.” Spent last weekend in Raleigh at FUDCon which was a lot of fun. I doff my fedora to the organizers. It was great to finally have the opportunity to meet a lot of my coworkers who I haven’t yet had a chance to run into at conferences. Poked a bit at btrfs in my idle cycles… managed to make it fall-over-go-boom on parisc64. Fixing that up should keep me busy in my spare time for the next little while… Oh. And if anyone would like to make me a new disembodied head^W^Whackergotchi, I’d very much appreciate it.

You are probably using DHCP on the machine currently in front of you. The Dynamic Host Configuration Protocol is a way for your computer to obtain an Internet address from a pool of available addresses, and to return it to the pool when you no longer need it. Basically every Internet service provider uses DHCP, or something similar. As a network operating system, Linux has DHCP support (and had it for ages). In true Unix fashion, Debian sports at least four DHCP clients. Debian s default is dhcp3-client, also known as dhclient. The theory is that the client requests an address lease from the server and periodically renews it. This process yields a number of events, to which the operating system can react. For instance, initially, the client issues a PREINIT event to get the interface into a state where it can talk on the network, and a BOUND event as soon as it acquired a lease, or FAIL if it, uh, failed. After a certain period of time, the client tries to renew the lease. If it succeeds, it issues a RENEW event; if it fails, it yields EXPIRE. So much for the theory. It seems that dhclient is rather stupid, which I tried to document in bug #459813 it does things differently: given a lease, after a certain period of time, it just issues an EXPIRE event, which causes the operating system to deconfigure the interface and take down connectivity. Then, the client spits out a PREINIT event, followed by BOUND or FAIL, as appropriate. I have not quite investigated what all this means, but this much is for sure: periodically, your machine goes offline, only to come back online a second later. If this were Windows, one would probably knock on wood and be glad that it works at all. But we re on Linux here, Debian even, so this cannot be. I d love to be proven wrong, so if you have a minute, please try to verify. One way of doing so is to insert

echo "$(date) got $reason" >> /tmp/dhclient-script.reasons

towards the top of /sbin/dhclient-script and monitor the output file. Once your client renews, it should read:

Wed Jan  9 11:53:27 CET 2008 got RENEW

but instead you ll see

Wed Jan  9 11:53:27 CET 2008 got EXPIRE
Wed Jan  9 11:53:28 CET 2008 got PREINIT
Wed Jan  9 11:53:33 CET 2008 got BOUND

and if you look closely enough, your interface will be unconfigured those seconds between EXPIRE and BOUND. I only spent about 2 hours with dhclient last night, as part of my efforts on netconf, but I already found bug #459813 and bug #459818, two bugs which don t suggest that dhclient is quality software. If I find more, I ll have to consider a different client, hoping that there are others which separate the DHCP client from the operating system calls in a similar way as dhclient does. NP: The Flower Kings: @Live Recording, Uppsala City Theatre, Sweden, 10 February 2003