Paul Russell writes about his 3-yearly laptop replacement at IBM [1]. It probably makes some sense to replace laptops periodically for a large company, but if you are buying for personal use then it makes sense to try and get a longer life out of an expensive machine. I think that aiming for 6 years is quite reasonable with today’s hardware - you should be able to buy a new machine now and have it last 6 years or buy a 3yo second-hand machine and hope to have it last 3 years (most second-hand laptops on sale in every place other than Ebay were trophies for managers and never had any serious use). If you are going to buy a second-hand laptop the first thing to consider is PAE support. If you get a laptop without PAE support (I think that means all Pentium-M CPUs) then you will not have proper Xen support (it seems that all distributions have abandoned Xen support for PAE for the moment). This may not be a big deal if you don’t want Xen, but if you are a programmer then you probably do want Xen (even if you don’t realise it yet). The next issue is support for the AMD64 instruction set. 32bit laptops are going cheap at the moment but if you buy one you will be significantly limited as to what software you can run at some future time (my 32bit laptop is doing well at the moment apart from the lack of PAE support). If you are buying a new laptop then the first thing to consider when planning a long life is the warranty. In my experience most computer gear does not need a long warranty, if it survives 3 months then it’ll probably last until it’s well obsolete. Laptops however periodically wear out if used seriously, I average one warranty replacement of a Thinkpad keyboard every two years and I have had a few motherboard replacements (the lighter Thinkpads flex and they eventually break inside if you use them on enough trains, trams, buses, planes, etc). On one of the Lenovo T series Thinkpads that I saw advertised (one that I would consider if I wanted a new laptop now) there was an offer to spend an extra $350AU to get extend the warrantee from 1 year to 5 years (according to my understanding of the confusing text on the web site) on a laptop that cost $3050. An increase in the purchase price of 12% for the extra warranty is a bargain (I know that for my use they would lose money on the deal). Repair of a laptop is generally very expensive, any serious damage to a laptop that is more than 18 months old will generally mean that the replacement cost is less than the repair cost. The next thing to consider is the screen resolution. After purchasing a laptop you can upgrade the RAM and the hard drive, the CPU power of all modern machines is great enough that for most typical use it’s difficult to imagine any need to upgrade. But screen resolution is something that can never be good enough and can never be improved after purchase. Lenovo is offering T series Thinkpads with 1920×1200 resolution for $4000AU and 1680×1050 resolution for $3050AU. That’s 31% more pixels for 31% more money and seems like a good deal to me. I believe that a larger display can significantly increase productivity [2] so it seems that the extra expense would be a good investment if you plan to earn money from work you do on your laptop. As a point of reference a desktop monitor from Dell (who seems to be the cheapest supplier for such gear) with resolution of 1920×1200 will cost at least $1000AU. The hard drive capacity should not be an issue, it seems that 100G is about the minimum size. The 60G drive in my current Thinkpad is adequate for my development work (including several Xen instances and some ISO files for a couple of distributions) so unless you plan to collect MPEG4 files of TV series and store them on your laptop I can’t imagine 100G being much of a limit. Also external storage is getting quite cheap, 2GB USB flash devices are now in the bargain bin of my local electronics store and USB attached hard drives with capacities of 40G or more are getting cheap. Also with a Thinkpad replacing a hard drive is really easy and does not risk damage to the drive or the rest of the laptop (I don’t know how well other brands rate in this regard). For RAM you can buy a model with a large memory module in socket 0 (or attached to the motherboard). Adding new RAM later is easy to do. Just try and avoid purchasing a memory capacity that involves having all sockets filled with modules that are not of the maximum size - it’s annoying if you have to try and sell modules on Ebay after you buy a memory upgrade. Finally one mistake I made in the past was to not get all the options for the motherboard. Make sure that every option for Ethernet ports and 802.11 type protocols is selected. It might sound like a good idea to save $100 or so on not getting one of those options, but if you end up repeatedly plugging a CardBus or USB device for many years you will regret it. Also external devices tend to break or get lost. Rusty documents his laptop replacement as a time for spring-cleaning. I use LVM for the root filesytem on my Thinkpad so that I can easily install a new distribution (or a new version of a distribution) at any time. I’ve been through that spring-cleaning a couple of times on my current Thinkpad without needing new hardware. From a quick view of the Lenovo site it seems that an ideal new Thinkpad that would last me 6 years would cost about $4500 while one that would last me 2 years would cost $1600 (and have a significantly lower screen resolution). A Thinkpad that would last 6 years and not be so great (but still better than the cheap option) would cost about $3500. Update: One significant issue is the life expectancy of laptop batteries. If you use a laptop for mobile use (as opposed to just moving between desks occasionally) then you are probably familiar with the problem of laptop batteries that discharge after 10 minutes. Last time I checked the warranty on Thinkpad batteries was 1 year or 300 charges (whichever comes first). My experience is that after 300 full cycles a Thinkpad battery will only last for a small fraction of the original charge time. When buying a laptop I suggest getting a spare battery at the time of purchase. The spare battery may last longer than the battery that is shipped with the laptop and two batteries means that you have twice the number of charge cycles before they are both useless. Batteries apparently don’t last long if completely discharged, so charge them up before storing them and periodically charge them if they have been left unused for any length of time (maybe every second or third month). With a Thinkpad it seems quite safe to change the battery while the machine is plugged in to mains power and running (I expect that Lenovo doesn’t recommend this though). You should probably plan to have a battery die every three years of use (or sooner if you do a lot of travelling). So one spare battery may last you 6 years of use but you will need two spare batteries if you travel a lot.

• [1] http://ozlabs.org/~rusty/index.cgi/2007/10/07#2007-10-07


• [2] http://etbe.coker.com.au/2007/01/04/monitors-for-developers/

Share This

Curse you Debian! Your programs are too secure... So I was looking over some setgid binaries last night, seeing if there were any obvious security bugs. Up popped omega-rpg - a fun game I've recently been playing. Unfortunately it is mostly OK:

• The insecure support for save-game-compression is disabled for Debian.
• The use of environmental variables is safe.
• The use of low-memory detection is disabled on non-MSDOS systems.
• The console-based input doesn't succumb to badness if you resize your terminal to allow >80 character input.

The only thing that I can is persuade the game to die with a SIGSEG if I manaully edit a save-game file, then load it. I'm sure with care and patience it could be coerced into running shellcode. In theory this is a security hole. In practise it is hard to take seriously! On the other hand I'm not convinced the game should be setgid(games)..

Bruce Schneier has just written about the Storm Worm [1] which has apparently been quietly 0wning some Windows machines for most of this year (see the Wikipedia page for more information [2]). I have just been asked whether SE Linux would stop such a worm from the Linux environment. SE Linux does prevent many possible methods of getting local root. If a user who does not have the root password (or is not going to enter it from a user session) has their account taken over by a hostile party then the attacker is not going to get local root (unless there is a kernel vulnerability). Without local root access the activities of the attacker can be seen by a user logged in on another account - processes will be seen by all user sessions if using the SE Linux targeted policy and files and processes can be seen by the sys-admin. If while a user account is 0wned the user runs “su -” (or an equivalent command) then in theory at least the attacker can sniff this and gain local root access (whether enough users do this to make attackers feel that it’s worth their effort to write the code in question is something I couldn’t even guess about). If the user is clueless then the attacker could immediately display a dialog with some message that sound urgent and demand the root password - some users would give it. If the user is even moderately smart the attacker could fake the GUI dialogues for installing updated packages (which have been in Red Hat distributions for ages and have appeared in Debian more recently) and tell the user that they need to enter the root password to install an important security update (oh the irony). In conclusion I think that if a user is ill-educated enough to want to run a program that was sent to them in email by a random person then I expect that the program would have a good chance of coercing them into giving it local root access if the user in question had the capability of doing so. Even if a Linux trojan did not have local root access then it could still do a lot of damage. Any server operations that don’t require ports 1024 (which means most things other than running a web, DNS, or mail server) can still be performed and client access will always work (including sending email). The trojan would have access to all of the user's data (which for a corporate desktop machine usually means a huge network share of secret documents). If a trojan only attempts to perform actions that SE Linux permits (running programs from the user's home directory, accessing servers for DNS, HTTP, IRC, SMTP, and other protocols - a reasonable set of options for a trojan) then the default configuration of SE Linux (targeted policy) won't stop it or even log anything. This is not a problem with SE Linux, just a direct result of the fact that in every situation a trojan can perform all operations that the user can perform - and if the trojan only wants to receive commands via web and IRC servers and send spam via the user's regular mail server then it will be a small sub-set of the permitted operations for the user! If however the trojan tries more aggressive methods then SE Linux will log some AVC messages about access being denied. If the sys-admin has good procedures for analysing log files they will notice such things, understand what they mean, and be able to contain the damage. Also there have been at least two cases where SE Linux prevented local root exploits. Finally, in answer to the original question: SE Linux will stop some of the more aggressive methods that trojans might use. But there are still plenty of things that a trojan could do to cause harm which won't be stopped or audited by SE Linux policy. When Linux gets more market share among users with a small amount of skill and no competent person to do sys-admin work for them we will see some Linux trojans and more Linux worms. It will be interesting to see what methods the trojan authors decide to use.

• [1] http://www.schneier.com/blog/archives/2007/10/the_storm_worm.html


• [2] http://en.wikipedia.org/wiki/Storm_Worm

Share This

I've been at the gnome summit for most of the past two days. Not actually working on gnome makes this a little strange, but it's kinda fun anyway. I saw demos of both the online desktop and hotwire. I'm not sold on the online desktop yet, but hotwire looks promising and fun. I chatted with ajax about all the cool stuff I missed at XDS this year, and also managed to write some code that lets automatically loading drivers override each other (say, have intel override i810). I'll be putting that code in to the xserver as soon as I get some time, probably this week, so I guess I managed to be productive.

Hmm. Quick update of life: Last weekend Leif pushed out a third tooth. This weekend, I fed him for the first time. So far it's been Angie actually putting things in his mouth, but on a visit to Cha Ya, I fed him some miso soup. Totally fun. Our current experiment with him is to get him to sleep at night without nursing to sleep. It used to be that I could get him to sleep just by lying next to him in a dark room, and lately I haven't been able to. So, he's now nursing just before and then switching to cuddling to sleep. It's not ideal but it at least moves us from something only Angie can do to something both of us or a babysitter can do.

That's right, we're starting to think about babysitters. We don't know people here well enough that we can leave him with, but when we do, baby, there's a bottle of port with our name on it. (Yes, it's the same bottle of port I got for my 30th birthday. I didn't want to pass a sip for each of the 100 people that were there at the time, and the next major event that came along was Angie getting pregnant)

A quick geek moment: current Ubuntu Gutsy now suspends and resumes on both of my laptops with reasonable consistency. For a long time, I could suspend my Toshiba once, and the second time, it would lose keyboard but that seems to be fixed. My work laptop has suspended and resumed generally fine all along, but Network Manager still occasionally forgets the settings. This is really annoying when there's a pile of 802.1x stuff to key in. I can't reliably reproduce it, but maybe during the next Gnome cycle, I'll try to figure out why it does that. Other than that it's working really well. The wine that's in Gutsy claims to support iTunes, but it doesn't. Even if it did, it probably wouldn't work with the iPhone, but I'm sure that'll get fixed sometime. Or perhaps the lawsuit will yield something useful and make hacking it safe. Given that it's pretty trivial to get the browser into a state where it's worth power cycling the phone, I'm not willing to forgo updates in the meantime. Assuming I could do one, that is.

Lastly a happy Thanksgiving to everyone! We were attempting to meet a pile of people this weekend, but amazingly enough 4 different people ran into trouble getting here. It'll be a cozy event then.

The Haskell Hackathon in Freiburg is nearly over now. For me, it turned out to be a xmonad hackathon, as of a few days ago, xmonad is able to handle dock applications such as the gnome-panel properly (that has prevented me from looking at xmonad before).Now that the panel worked, I also wanted it s window list and workspace switcher to at least show me the state of my workspaces. This resulted in the EwmhDesktops extension. I also noted that the dock handling provided in the default Config.hs was not sufficient, as it would even treat dialogs from gnome-panel as a dock. This is fixed with the extension ManageDocks, which later got additional support to increase xmonad s border gap if an window (such as gnome-panel) has the STRUT attribute set. To closer match my old metacity keys I added support to CycleWS for going to the next/previous workspace and for moving the current window there.I had some ideas how to make the hook interface for xmonad nice, and now started to work on debian packges for xmonad: You can get and test prelimary ones.

The C standards committee is apparently preparing to revise the C standard. The proposed C1x charter sets the goal of the committee draft’s completion in 2009, with publication of the new standard in 2012. The proposed charter adds security as a significant new goal for the standard:

Trust the programmer, as a goal, is outdated in respect to the security and safety programming communities.

The proposed charter also sets the requirement that all new features must have a history in non-experimental compilers and be in common use.

The following companies, or people, are using xen-shell with their Xen hosting product(s):

• xen kibbutz
• xen hosting (me!)
• bit folk
• Datarealm internet services
• Chris Lamb
• Cernio

I'm sure there are more, but I've been lax at keeping track. I do want a list, if only for advertising purposes. I'll update the list here if/when people point out omissions. In other news yesterday I managed to release security updates for KDM & fetchmail which were missing i386 builds. Not good. The problem was fixed fairly quickly once it was actually noticed, with the help of Noah. But I did get several angry emails during the wait. *sigh* It looks like people are starting the notice the downside to having broken security buildd machines which frequently cause these kind of problems for us - so hopefully these kind of errors will diminish in time. (Who am I kidding?)

Let's say you're a French person who has EXTENDED_GLOB on and types HEAD^ all the time, but can't be bothered to type a backslash before the caret. Personally, I have no problem typing HEAD\^, but I probably only do that twice a day. Here are a few/several/many (depending on how you count) solutions . They all have their downsides. Finding out their side effects is an exercise for the reader. Number one: setopt noextendedglob Number two: setopt nonomatch Number three: alias git='noglob git' Number four: custom ZLE widget:

accept_line_with_headcaret ()  
  if [[ $ BUFFER  = git*HEAD\^* ]]; then
    BUFFER="$ BUFFER//HEAD\^/HEAD\\^ "
  fi
    
  zle .accept-line
 
zle -N accept-line accept_line_with_headcaret

I'll just keep hitting the backslash key.

I got a call from one of the researchers from ABC news this evening. Apparently they are planning on doing a segment on Hans Reiser on their 20/20 show, and the researcher knew enough that there were some serious technical inaccuracies with the script (at the level of “so when Hans was creating reiser4, was that software; was he writing a program?” and “does the program run on the hard drive?”), and so they were looking for help on some technical issues on a background basis. She didn’t take any quotes from me; what she needed was help understanding the technical issues around filesystems and Linux. I tried to help explain what a filesystem was that would make sense to a lay person in 15 seconds; I have no idea whether the researcher got it, and whether she’ll be able to make changes in the script that will be vaguely coherent. We’ll see. I spent a lot of time working with Joshua Davis, providing background material for his Wired article, and he still got a bunch of the technical details wrong. The 20/20 researcher did ask me some silly questions such as “whether we were surprised when murder charges were filed against Hans?” Well, yes. What did she expect me to say? “Oh, yes, were always worried someone would get hurt…” Not! Sigh…. I might not agree with Hans’s filesystem design principles or his tactics in trying to get reiser4 accepted, but I always respected him as a fellow open source programmer. The researcher mentioned to me that Hans had done a talk at Google that was available at the Google Video site. Out of curiosity, I took a look at it. It was interesting; the last time I had seen Hans was in 1999, at the Linux Storage Management Workshop in Darmstadt, Germany that was organized by Matthew O’Keefe at Sistina Software. Compared to how he looked back then, and the picture of him in the Wired article, taken a 10-12 months after his talk at Google in February, 2006, I was struck by how much heavier (and older at least compared to my memory of him, which was much closer to this picture from his resume) in the Google Video. I also remember him as being a much more dynamic and energetic speaker, and I was struck by how slowly he spoke, with lots of long pauses and “umms” and “ahhs”. He seemed to be a much better public speaker in Darmstadt, but in the Google talk he seemed very tired as he gave the talk. One of the questions that the researcher asked me was whether I thought he was a genius or not. I told her that I thought he was quite bright in terms of raw intelligence, but that his Social IQ wasn’t as high as you might want for someone to be successful in gathering volunteers to work on an Open Source project, and in working with others in an Open Source development community. Looking at the video, I think that is very much true. He was a terrible public speaker, but some of the points he made about optimizing B-tree algorithms made sense. I might disagree with his philosophy over filesystem design and benchmarking, and I might not be terribly impressed by his social skills, but in terms of being a talented computer scientist, he was and is that. Is he guilty of the crime that he has been accused of? I have no idea. But from looking at his talk and knowing what I know of him, I have the sense of a greek tragedy. He’s been working on some of his ideas since his undergraduate days in UC Berkely in the early eighties — which he entered after finishing his 8th grade. And as research ideas, I think he might have gotten some very interesting results out of trying some of the things that he wants to do around operating system namespaces. (I think they are doomed in a production system descended from Unix, since application programmers are unlikely to rewrite their programs to take advantage of reiserfs’s performance characteristics — which would mean instead of using a Unix-like configuration file, treating a directory hierarchy containing the configuration information like a Windows registry. Still, as an academic, Plan 9-like system, I could have seen it has being a potentially very interesting Systems Research effort.) Unfortunately, his skills at public speaking and his ability to work with other people have handicapped him, and I know that has frustrated him deeply. So I have a lot of sympathy for him, and I hope that he is innocent, and will be found innocent. But only time will tell…. Anyway, according to the researcher, they are currently scheduling their segment about Hans on 20/20 on October 19th. I’m sure that schedule is subject to change, but it’ll be interesting to see how they treat Hans in their coverage. Hopefully it will be fair, and not overly sensationalistic, but unfortunately my faith in today’s TV edutainment-focused news program isn’t terribly high. My impression was that the research wanted to do a good job, but she was burdened by a very tight deadline, and in the end, the decision of what goes on the air and what doesn’t won’t be up to her. So we’ll see.

I am currently considering what to do regarding a Zope server that I have converted to Xen. To best manage the servers I want to split the Zope instances into different DomU’s based on organisational boundaries. One reason for doing this is so that each sys-admin will only be granted access to the Zope instance that they run so that they can’t accidentally break anyone else’s configuration. Another reason is to give the same benefit in the situation where one sys-admin runs multiple instances, if a sys-admin is asked to do some work by user A and breaks something else running for user A then I think that user A will understand that when you request changes there is a small risk of things going wrong. If a sys-admin is doing work for user A and accidentally breaks something for user B then they won’t expect any great understanding because user B wanted nothing to be touched! Some people who are involved with the server are hesitant about my ideas because the machine has limited RAM (12G maximum for the server before memory upgrades become unreasonably expensive) and they believe that Zope needs a lot of RAM and will run inefficiently without it. Currently it seems that every Zope instance has 100M of memory allocated by a parent process running as root (of which 5.5M is resident) and ~500M allocated by a child process running as user “zope” (of which ~250M is resident). So it seems that each DomU would need a minimum of 255M of RAM plus the memory required for Apache and other system services with the ideal being about 600M. This means that I could (in theory at least) have something like 18 DomU’s for running Zope instances with Squid running as a front-end cache for all of them in Dom0. What I am wondering about is how much memory Zope really needs, could I get better performance out of Zope if I allowed it to use more RAM? The next issue is regarding Squid. I need to have multiple IP addresses used for the services due to administrative issues (each group wants to have their own IP), having Squid listen on multiple addresses should not be a big deal (but I’ve never set up Squid in a front-end proxy manner so there may be hidden problems). I also need to have some https operations on the same IP addresses. I am considering giving none of the Xen DomU’s public IP addresses and just using Net Filter to DNAT the connections to the right machines (a quick test indicates that if the DomU in question has no publicly visible IP address and routes the packets to the Dom0 then a simple DNAT in the PREROUTING table does the job). Is there anything else I should be considering when dividing a server for running Zope under Xen? Is it worth considering a single Apache instance that talks to multiple Zope instances in different DomU’s?

Share This

Today I received the replacement hard drives for the two that failed the other week. Despite me not ticking the box (or paying the $10 for the upgrade), they gave me 500Gb drives to replace the 400Gb drives that I'd shipped them. I was a little dismayed to find that they were labelled as refurbished drives though. Oh well. I plugged the first drive in, and it started exhibiting the same behaviour as the one that had failed, and I immediately thought "oh, they've shipped me a dud refurbished drive". So I tried the other one. It also did the same thing. I started to smell a rat. I have a slightly convoluted power setup for these four disks. They're all connected to minotaur via IDE-USB adapters, and they have external DC power supplies. They're just sitting on top of minotaur, which is a Pentium III 1-RU server, in the bottom of my linen cupboard. In order to reduce the number of plugs involved, I have an IEC Y-cable, which goes to two of these DC power supplies (which take an IEC cable in one end and has a Molex connector on the other end), and the Molex cable from the DC power supply has a Molex splitter cable on it. So I'm powering two drives from each DC power supply, and each DC power supply is connected to an IEC Y-cable. There's no redundancy whatsoever, and I'm not that concerned. I don't have a UPS anyway, and the whole thing has worked fine for months, and it reduces the rats nest of cables a little bit, which is good. I already have way too many things plugged into my linen cupboard. Anyway, so after both new drives appeared to be faulty, I discovered that both drives that had failed within a day of each other were connected to the same DC power supply. The plot thickened. So I dug out a standalone IDE-USB hard drive enclosure (with a separate power supply) and tried that. Everything worked. I tried it with just the enclosure's power supply and either of the IDE-USB adapters I'd been using previously. Everything worked. So I'd managed to narrow it down to the power supply. Most unusual. So fortunately I have four of these DC power supplies, as they came with the IDE-USB adapters, and I freed up two of them when I went for the aforementioned crazy power splitting setup, so I dug out one of the two spares, and tried that, and everything worked. So I've no idea why the power supply decided to go dicky after months of working. I've yet to introduce my multimeter to it to try and work out what's going on. I'm a bit embarrassed that I didn't do more homework before I declared the drives to be faulty. To be honest, they were clicking and generally looking "failed", and I've had a lot going on lately, so I just jumped to the conclusion. Oh well, at least I still haven't lost any data. Too bad I have 200 Gb that is going to go to waste.

Another nice new feature with debtree 0.7.0. The new version supports an option max-depth that can be used to limit the depth of a graph. I think debtree now supports all the ways to reduce the complexity of dependency graphs that can realistically be implemented in shell. A nice side-effect of this change is that it made it possible to also render other nodes in the graphs more consistently. Suggested packages now also have the diamond shape. And in sets of alternative dependencies "end" packages and unknown packages are now always marked as such. I also moved the previously hardcoded lists of "end" and "skip" packages to configuration files. These are managed using ucf which means that merging local changes with "upstream" updates in new releases will hopefully be relatively painless. If you have suggestions of packages to add to these lists, feel free to submit them. Please mail me both the command for the graph you'd like to reduce and the packages you're proposing to add to the lists. I have one issue left I'd like to implement: displaying alternative "Provides". And then I think its time to try to get debtree ported to C++.

---

P.S. You may encounter #443179 when using ucf. I've submitted a patch (several actually; the first two had a high "brown paper bag" ratio) that makes use of debconf's Choices-C feature, which should avoid this particular issue for future releases. Besides the mentioned advantage for substitution in templates of variables that need to be translated, Choices-C also allows developers to define a set of short aliases for choices that make the values used in a configuration script independent of the actual strings that are displayed to users. I doubt this feature is well known outside the D-I team. It was implemented in both debconf and cdebconf.

Phil and I managed to catch up with Linus when he was at the kernel summit in Cambridge last month. We gave him a Debian T-shirt at the time, as Phil blogged at the time. Barton George was one of a number of Sun people who came along to Debconf, and he picked up an Etch T-shirt while he was there too. Apparently he's quite keen to wear it in public too... :-) Any more action shots out there?

Madduck wondered why a package using revision control needed pristine tarballs at all. Firstly, the example he gave of tagging an upstream release and creating a tarball of it to build the package against is exactly what pristine-tar does. Except it preserves permissions and timestamps and other tar cruft. Sometimes timestamp or permissions issues do cause issues with package builds, so being able to build against the original files from the pristine tarball is potentially useful to catch and fix such problems. As to other uses of pristine tarballs... It's hard to list the advantages to using pristine tarballs, since Debian (rpm too) has had them forever, and lots of people may depend on them in ways that we don't anticipate. For example, I've seen FreeBSD point at ftp.debian.org to get tarballs for their packages, since they don't archive tarballs on their own, and sometimes the tarball isn't available upstream (or ftp,debian.org is the upstream). That's a wacky example, but I've seen it more often than I've seen pristine tarballs used for the often-cited md5sum comparison case. Rather than try to enumerate all the possible reasons for pristine tarballs, and then try to whittle the list down to reasons that actually make sense, and cost-benefit analise those, it seemed better to just try to write a solution to the problem. (Or at least, to most of it -- a hopefully small subset of the set of reasons for pristine tarballs are not satisfied by pristine-tar.) I've also been theoretically interested in this problem of generating pristine tarballs from version controlled source ever since Scott Remnant mentioned at a meeting (140 mb video of meeting here) that he had a tool to do it -- and AFAIK never shared the tool! So the challange factor was another reason to write it. However, pristine-tar has already saved me hundreds of megabytes of disk space, sped up my release process (avoiding bug #225483) and simplified the way I work, so it's already a net win for me, even if it turns out we don't need pristine tarballs for anything at all!

* One of the best ever event Freed.in is over (although, some people are enjoying at Manali right now!). I came back on last night. * I reached Delhi on Thursday night. Grepping JNU was easy due to pre-paid taxi from airport. Got my room at Aravali Hostel and found none of the known person at first site. Oldmonk’s reply to my call, ‘where are you?’ was hilarious one. Finally, I found Karunakar and we enjoyed ‘Maggie’ at 12 AM. * Both days were entirely full of fun. I talked about ‘Debian-IN‘ project. Unfortunately, my talk got last place on schedule (I think due to track allocation etc) and so, number of people was less. The fun thing was that whole #linux-india channel (almost, except famous Lap_64) was there. And channel was so quite during 2 days.. * With very limited time in our hand, we (me and tuxmaniac) visited Qutub Minar, India Gate and famous Delhi Metro (by traveling to/from random station!). Flickr photos are up.

In the last few days we (as in DebConf admins Steve Gran, Mark Hymers and myself) have been doing some DebConf maintenance work. Some time ago one of DebConf’s permanent sponsors, ByteMark sponsored a new machine, krabappel, which we use as a replacement for the older machine we have from them, cmburns. It was neccessary, as good old cmburns had a lot of stuff running and so was always pretty loaded. Imagine it running most of our websites, main mail and dns server and then also having 4 vserver instances on it. Those vserver itself where also running things that do use some resources, like our wiki and the main DebConf7 site, the PentaBarf test-host and our LedgerSMB instance. While it was long decided to move stuff our - we just had to find time to do it. This weekend seems to be it, everything is migrated except cmburns itself, as that needs a fix in the reverse dns entries for the new /28 we got. We are using xen-tools to make installation of new images easy. For that I wrote a script that is used as a role script, automating all that various setup tasks that one can automate easily. Which means that it takes about 5 minutes to get a complete new XEN domain up and running. (Add some minutes to add it to nagios2, munin, our mail setup and to sync the userdatabase.) Mark and Steve also did another migration: gallery.debconf.org is now using gallery2. Still needs a nice layout designed looking similar to our normal DebConf website, but that shouldn’t be too hard to get. While they have been on it they also integrated gallery.debian.net, so that it is back up again. Feel free to use both of them! gallery.debconf.org offers space for all DebConf related pictures, be it the main yearly DebConf (and related) or regional DebConfs, like the one planned for Panama soon. gallery.debian.net is a place where pictures from all Debian related events/parties/whatever can be put. Basically - whenever people working on Debian meet (like a BSP, a work meeting, etc) - feel free to put pictures up there. Just put them into a folder matching the year it happened in… Basic goal is to get a huge set of pictures from people involved in Debian.