Search Results: "reg"

6 August 2006

Steve Kemp: Just go on home

The Xen hosting is now setup, and complete. There were only two minor complications: As another achievement for the day (?!) the Debian Administration website now has exactly 5000 registered users. Finally I made the NMU of Apache2. Since mail to @debian.org seems to be broken (?!) I’ve not been able to file the patch. Interested people can find it here until I can file the bug.

5 August 2006

Aigars Mahinovs: Cobert takes on Latvia (future, hopefull)

I was just told that Steven Colbert is going to feature Latvia in it’s new sketch “Meet an ally”. On his show, he often does thematic multi-part sketches where he meets with all participants of some kind of group. The best example is his ongoing ‘434-part series’ “Better know a district” that even earned a Wikipedia article for itself. After talking with the representative of Pilau to UN, he found out that only military force they had was one single patrol boat and that it’s ambassador has barely any relation to the small island state from the Pacific. Hopefully we will look a bit better :) P.S. Regarding spelling - I have found that it is still more convenient to use gnome-blog package then to use the Wordpress on-line spelling plugins.

Steve Kemp: The foulest stench is in the air

I received a few interesting comments on my last post about mailing list software so I’m going to summerise my current thoughts. Before covering the available software I’ll say what I personally need from a mailing list manager: When it comes to the handling of spam I mostly don’t care. Messages are filtered via the mailserver at SMTP time (ditto for viruses) and although moderation is generally useful I prefer to either bounce or eat the messages which are not forwarded. (Either case is fine so long as logs are available). This simplifies things significantly since the pedning messages don’t need to be stored/queued. Here is a list of all the mailing list software which is available to users of Debian’s Sarge release along with some of my thoughts/comments/impressions. (Some of these details may be wrong, I’d happily be educated …):
ecartis
The Ecartis package for Debian GNU/Linux is mostly broken. In sid the package is essentially unmaintained, and that is a worrying sign. Ignoring that for the moment the software works reasonably well. It allows most of the kind of control I desire but the significant downside is that it is severaly broken with regard to character sets and encoding issues. For a cromulent example see this message.
enemies-of-carlotta
This software wins double-plus bonus points for a most excellent name. Naming software is hard, and although the relationship between the film and the purpose of the software is random I like it! eoc suffers from a virtually non-existant set of documentation. Whilst it might be simple to use I it isn’t documented except in a single manpage. I seem to recall I had difficulty getting my Exim4 configuration to pass relevent environment variables ($SENDER + $RECIPIENT) passed into the script properly. The lack of documentation just made this more irritating.
fml
There is a lot of documentation for this, which is half in English and half in Japanese. I admit I mostly didn’t explore this software - although my impression is that it doesn’t have support for virtual hosts.
mailman
Mailman is big, popular, and I dislike it with a passion. The admin interface has a billion configuration options, but even if you know they exist finding the damn things are an impossible job. The system requires about five python processes running even when it is “idle”. In my mind a mailing list software doesn’t need a daemon componant - just a program to spawn when a message “comes in”. The whole password system is broken and gains you zero additional security. Again to rail against mailman: it has integrated message archival, something i think should be distinct. (eg. mhonarc). Virtual hosting is possible, but I believe that mailing list names must be distinct regardless of domain name. That may not be correct honestly I’ve detested the softwware with a passion which suprises me and I may not be 100% objective here.
mlmmj
Looks nice. Looks clean. doesn’t look particularly joyful. (The name mlmmj means “mailing list managing made joyful”.) It doesn’t appear to support virtual hosting, and it doesn’t appear to support enough different list types.
quickml
Listens upon a network port (10025 by default) and not support different list types or virtual hosting.
smartlist
Complex. Icky.
sympa
Seems very featureful, but it is yet another system which has an integrated web-component like mailman == bad. It doesn’t support having the same named mailing list in multiple virtual hosts, although it appears to do everything else I desire.
In summery: There are several available packages, but none are good, and many are actively bad. I still believe that creating another list server would be a useful thing to do. I’ve written a brief design overview elsewhere which I will post for comment later. I’d like to support a couple of “advanced” features such as allowing the mailing list software to only accept GPG signed messages, or to act as a remailer such that messages posted to the list will be automatically GPG signed prior to delivery to all users. Looking around I think most of the individual bits of code are available (in Perl). eg. Mail::Message, Mail::GPG, etc. Its just a matter of gluing the bits together in a modular fashion.

Joey Hess: upstream planet debian relaunched

updo.debian.net is the new url for the upstream Planet Debian that I've been running for a while, aggregating some of the blogs of upstream software authors. Now it's a wiki so it's really easy to add new feeds to it. Oh and BTW, if jwz's posts get on your nerves, a jwz-free version is hidden in a link at the bottom of the page. :-) And other feeds could be pieced together if you're only interested in say, the linux hackers, since posts are tagged and can be filtered by software or author.

4 August 2006

Wouter Verhelst: Password expiration sucks!

Just a few moments ago, I was trying to commit a minor fix to the NBD subversion repository. However, suddenly the server refused my commit; the password which I knew to be right wasn't working. So I loaded SourceForge.net in my browser and went to the admin link there to find out whether I had perhaps fucked up my own commit rights. I've been known to do that before. Doing so of course required me to log in. Which revealed the problem that was causing this in the first place: apparently my password had expired. I had been using the very same password since ages, but for some reason unknown to me, sourceforge has now decided that they want to introduce password expiry. Of course, good password management is very important if you want to avoid issues with people stealing your passwords. For that reason, I usually generate my passwords with pwgen -s 15, which generates passwords that are impossible to guess—one example of an actual password that I have used in the past (but that I do not have in use in any other system anymore today) is qChjZeWIbSDGON/. The hard part is, probably, to memorize that; for that, I have a pretty simple method: I enter 'gpg -o ~/foo' and enter my new password. Then I pick out some random .jpg file somewhere on my hard disk, and concatenate the gpg data to that file. It is usually still possible to view the file in a viewer with that extra data added to it; IME, most image viewers have the ability to view all data in a corrupt JPG-encoded image that occurs before the corruption—which in this case, will be all of the image. As such, if you don't know which file it is, and you don't know my GPG password, chances are low that you'll find it and steal my login data. Additionally, of course the .jpg file is either removed or restored to its original state when I memorized the password, and finally I also update my GPG key and the password of the system that contained the file with the encrypted password to be using the same new password, so chances of stomeone stealing it get even lower. However, even with this method, it still takes me a few days or weeks to memorize it. Also, synchronizing the new password to all the systems and websites on which I have an account takes a while. For that reason, I prefer not to do it too often. With that in light, it is slightly problematic to have an account on a system that has a password expiration policy in force, because a) this makes it impossible for me to use the highly secure passwords that I use "everywhere else" on these expiration-using systems, b) because the average expiration policy is 2 months, making it impractical for me to generate secure passwords for these sites as well (by the time I memorized the new password, we're already at least halfway through the two months if I need to use that password fairly regularly—or it might even be too short if I don't use the password regularly. The result of the above is that password expiration policies, in my case, force me to use less secure passwords of which I'm sure I can remember them—old passwords which I used before I had a GPG key or had learned about pwgen. I still use those on websites that require me to enter a password but which I do not trust to handle my passwords in a secure manner; I don't want to give these sites the password to unlock my gpg key, for example. The problem with these passwords is that they are easy to guess; they're usually not some unintelligible bit of random letters, but are six to eight characters that actually have a meaning. In fairness, I did have one of those old and insecure passwords in use at sourceforge, because I indeed didn't trust them with my secure passwords. If they base their password expiration policy on the strength of the password, then this whole blog post should be ignored. But in general, it is my point that password expiration policies do not improve security at all. It forces people to use passwords that they can quickly memorize (otherwise they're trying to memorize all the time), and it does not give people who usually pick easy to guess passwords any incentive to pick better, harder to guess passwords. On the contrary, in fact. Password expiration policies suck.

Andrew Pollock: [tech] I always seem to buy lemons

I wish hardware printed the PCI ID on it, so you could at least do some homework on what's what. Bought a HP branded four port USB 2.0 controller from Fry's tonight, and the sucker doesn't appear to work despite the page for a mighty similar device saying it should work. Here's the relevant bits for posterity: lspci output:
01:0a.0 USB Controller: NEC Corporation USB (rev 43) (prog-if 10 [OHCI])
        Subsystem: Unknown device 1631:0035
        Flags: bus master, medium devsel, latency 64, IRQ 10
        Memory at ff8f5000 (32-bit, non-prefetchable) [size=4K]
        Capabilities: [40] Power Management version 2
01:0a.1 USB Controller: NEC Corporation USB (rev 43) (prog-if 10 [OHCI])
        Subsystem: Unknown device 1631:0035
        Flags: bus master, medium devsel, latency 64, IRQ 9
        Memory at ff8f6000 (32-bit, non-prefetchable) [size=4K]
        Capabilities: [40] Power Management version 2
01:0a.2 USB Controller: NEC Corporation USB 2.0 (rev 04) (prog-if 20 [EHCI])
        Subsystem: Unknown device 1631:1600
        Flags: medium devsel, IRQ 11
        Memory at ff8f7c00 (32-bit, non-prefetchable) [size=256]
        Capabilities: [40] Power Management version 2
01:0a.0 0c03: 1033:0035 (rev 43)
01:0a.1 0c03: 1033:0035 (rev 43)
01:0a.2 0c03: 1033:00e0 (rev 04)
Relevant dmesg output:
0000:01:0a.2 EHCI: unrecognized capability 00
ACPI: PCI Interrupt 0000:01:0a.2[C] -> Link [LNKA] -> GSI 11 (level, low) -> IRQ 11
ehci_hcd 0000:01:0a.2: EHCI Host Controller
ehci_hcd 0000:01:0a.2: new USB bus registered, assigned bus number 1
ohci_hcd: 2005 April 22 USB 1.1 'Open' Host Controller (OHCI) Driver (PCI)
ehci_hcd 0000:01:0a.2: irq 11, io mem 0xff8f7c00
ehci_hcd 0000:01:0a.2: startup error -19
ehci_hcd 0000:01:0a.2: USB bus 1 deregistered
ACPI: PCI interrupt for device 0000:01:0a.2 disabled
ehci_hcd 0000:01:0a.2: init 0000:01:0a.2 fail, -19
ACPI: PCI Interrupt Link [LNKC] enabled at IRQ 10
PCI: setting IRQ 10 as level-triggered
ACPI: PCI Interrupt 0000:01:0a.0[A] -> Link [LNKC] -> GSI 10 (level, low) -> IRQ 10
ohci_hcd 0000:01:0a.0: OHCI Host Controller
ohci_hcd 0000:01:0a.0: new USB bus registered, assigned bus number 1
ohci_hcd 0000:01:0a.0: irq 10, io mem 0xff8f5000
ACPI: PCI Interrupt 0000:01:0a.1[B] -> Link [LNKD] -> GSI 9 (level, low) -> IRQ9
ohci_hcd 0000:01:0a.1: OHCI Host Controller
ohci_hcd 0000:01:0a.1: new USB bus registered, assigned bus number 2
ohci_hcd 0000:01:0a.1: irq 9, io mem 0xff8f6000
I knew I should have bought the VIA-based one instead. Red always goes faster.

3 August 2006

Biella Coleman: In between pride and anxiety: the state of South Africa

Writing blog entries in South Africa did not come so easily, mainly for technological reasons. While for the first 4 days of my trip I had steady Internet access, most of my time was spent enjoying the Law and Society Summer Institute. Once over, I headed from Joburg to Durban and my access became much spottier, not to mention that Bernard, my indefatigable host, made sure the days were filled seeing the gritty but beautiful urban beach town, hanging with the crew of University of Chicago students/graduates that descended upon the city, and having a go at sufring in the Indian Ocean. In the evenings, I did have some free time, but they were too chilly for me to do much of anything but burrow myself deep under a small mountain of covers and pass out after a day filled with plenty to do and see. The theme of the conference I attended was the intersection of rights and regulations and given the Summer Institute was held in South Africa, it was not all that surprising that much of the conversation centered on one class of rights, those of human rights. Since the end of apartheid, SA has become a particularly-impossible-to-ignore beacon for human rights, and acts as a sort of modern guiding light that has defined the meaning and institutionalization of human rights post-WWII. So if WWII and the Holocaust represent the generative genesis of human rights, South Africa represents a new era of human rights, a place that revisited, rejuvenated the discourse and implementation in a post-Apartheid Constitution that has been touted, world-wide, as exemplary for its generous commitment to equality and other rights. In this respect, one feels, quite everywhere, the collective pride of a nation who managed to end a brutal regime and it did so under the gaze of world who followed the drama on TV screens, college campuses, and newspaper headlines. As SA has moved to another era of picking up pieces and trying to build a more equitable society, many in the world are still eagerly watching. But pride does not stand alone, in isolation, for it mixes with other collective sentiments. The collective admiration and pride of a nation, like the sweet water of a river, visibly and freely mixes with a more salty frustration and anxiety to produce an in-between brackish state of affairs. Pride in other words sits alongside social anxiety, which palpably manifests at different registers and tones, to texture the cultural and political landscapes of SA. The frustration follows from the fact that many are still living in dire poverty and in the last ten years, many steady jobs have vanished. Shantytowns, the symbols and material conditions of apartheid, are still omnipresent (though very well hidden from the middle class and the rich). The ruling government, while having roots in communism and socialism, has to contend with a world-wide regime of neoliberal governance and, thus, must try to balance satisfying commitments with the outside world with delivering promised goods to its population, demands that often run uncomfortably counter to the neoliberal logic of deregulation and financial austerity. Alongside this or perhaps as a manifestation of it, the talk of the town, especially in Johannesburg, is of the rampant crime. As a sign of crime and fear, most middle-class and wealthy houses are adorned with metal fences, barbed wires, electric fences, and a simple sign from private security companies (Chubb being the most common in Johannesburg) that announce they provide armed response security to break-ins. This is serious stuff. And while some of the fear of crime is a self-perpetuation exaggeration of itself (and as my friends explained, before the end of Apartheid the monitoring of crime was not as common, so crime statistic can only go one direction, up), it has in certain parts of cities spiraled out of control. And if there comes a time when the crime abates, the architecture of barbed wire and security services is now really an architecture-in-place and will be hard to dislodge from the mental and physical spaces of SA. So more than anything else, I found that the vibe of SA seesaws between pride and anxiety. As a visitor, you are enveloped in this dyanmic duality. You can’t help share in the pride now enshrined in national monuments and museums. But at the same time, you also are not sure what path the nation is heading in and you too share in the fear of crime and move your body and belongings cautiously through the cities. There is no doubt of the governmental commitment to provide services like health care and housing, a commitment that in places like the United States seems to exist more like an endangered species on the brink of perpetual extinction. And so it was awfully refreshing to be in a place where talk of such things is not seen with a suspicious eye that in the US is often tagged as something that runs counter to the realization of freedom and a just society. But whether these important goals can be brought into the plane of existence is another question, one that is not unique to SA but is something that many other countries, especially Latin American countries, from Venezuela to Bolivia are also asking and trying to answer. Bernard and others reminded me that South Africa is number 4 in terms of producing new millionaires, which is quite a remarkable statistic given how many nations there are in the world. But despite the poverty of the place, this wealth is evident and there was one place in particular that symbolized this: Melorse Arch. Located in Johannesburg, this is a lifestyle compound/gated community that mixes posh residential condos with posh restaurants and bars. To tell you the truth, I have never seen anything like this and it was probably been the most extraordinary thing I saw in South Africa. The United States and Puerto Rico (where I am from) and undoubtedly many parts of the world are no strangers to gated communities. But Melrose Arch took the implementation of them to a whole new, somewhat disturbing, level, in part because the domestic sphere of expensive housing co-mingles so intimately with sites of accentuated consumption, reminding visitors that the point of life, (hence the name lifestyle) is to make money so as to consume, and to do so lavishly. And what brought this really home was that the South African Bond Market was also located here in Melrose Arch. In fact we could see the building clearly from our restaurant, which proudly displayed a large Elephant statute (which, I think, harkens to the large bull in Wall Street NYC). I guess if you are a bond trader, and dislike commuting, and like good places to eat, well this is the place for you as you don’t ever have to leave your complex. Work and play become seamless and thus this place is perhaps one of the most powerful signs that the point of work is to play, is to consume, so that a perfect cycle is reached in which making money is a path for self-pleasure (or at least nuclear-family self-pleasure), a form of life, that does not have to engage with the rest of society, literally. Of course, there are many layers of production that do exist and make a place like Melrose Arch possible yet are well hidden from the visitors and residents of the compound. But Melrose Arch is not fully gated. It is open to outsiders so they can enjoy the fine dining, and if you sit in one of the many outdoor tables, one can fully take in the glittering performance of this social cycle, and for some, undoubtedly it is a measure for and of the good life, the right life, that to which others will aspire. What I find interesting about the place is that it captures, with unmistakable clarity and precision, the point of much of neoliberal economy, especially the love for finance (in which money seemingly is made out of nothing), a robust service economy (the service in the restaurant was unlike anything I have seen, with people bring you ceramic jugs of water to wash your hands, live entertainment, outdoor fires, and blankets, henna painters etc), and consumptive pleasure. To drive home the point, in Melrose Arch, there is not even a supermarket; lest there be any mistake, this place was constructed as a place of consumption, through and through. There were many other posh areas in South Africa, and as I mentioned earlier, the impoverished areas were kept a distance from middle class neighborhoods, so much so, that in some areas, like Cape Town, you really had to go out of your way to see them (again this is very different from many parts of Latin America where, in an instant, poor neighborhoods switch to wealthy). On the other hand, quite visible were things like malls and there were a lot of them. Apparently South Africa has been a testing ground for the modern mall. To get to the malls, there are very good roads to travel (much better than most of Latin America) and other basic services like tap water, and infrastructure like airports and phones, are in excellent condition. So it was somewhat surprising and frustrating that Internet services outside of business are somewhat scant, expensive, and slow. Sure Internet services are the best in Africa and you can get Cable, ADSL etc. at home but you have to pay a pretty Rand for it and on top of it, the access is pretty slow. Now, there are many parts of the world where this is the case (though apparently in a study that compared 12 countries at a similar lever of development to SA, Internet access was 10 times more expensive in SA than the most expensive country which was Chile), but for me, it was the juxtaposition of having such solid infrastructure and wealth mixed with lackluster Internet access that made it somewhat odd. And it also made me realize how much the Internet and access to it had not only saturated my life, but how I have come to see it as a something creeping close (though not the same) as a basic right. Of course, security and self-determination, food, shelter, and health services are for me are the basic architecture of human rights. Without these, existence in the most basic sense becomes difficult. Access to the Internet, though in no way is indispensable to the basic conditions of living, can at least greatly facilitate the type of political work and organizing needed to demand other basic human rights. In this sense, it is more like an extension of or at least serious complement to basic services like clean water, and it seems like once there has been an investment in securing fiber optic (which I am sure is pricey), the cost of maintenance compared to physical infrastructures is so much smaller that it is really worth the initial costs. This bring up some difficult questions and vexing specters related to many of the human rights (in the Universal declaration), which are I think not so much so how to define them in a general sense (I think this has been laid out somewhat well) but how to specify them so as to realistically implement them . On the one hand, the flexibility and vagueness of human rights is what gives it tremendous currency. Folks around the world have wielded the discourse of human rights to make demands that resound strongly and profoundly. But once a proclamation of a human right has been made, like article 25:
Everyone has the right to a standard of living adequate for the health and well-being of himself and of his family, including food, clothing, housing and medical care and necessary social services, and the right to security in the event of unemployment, sickness, disability, widowhood, old age or other lack of livelihood in circumstances beyond his control..
it seems like the real hard work is about specifying and implementation. We may easily agree that an adequate standard of living may not be Melrose Arch but it still does need definition and a plan for implementation. And so there seems to be plenty of room in human rights politics to move from the state of declaration to that of strategies of implementation.

DebianTimes: Debian GNU/Linux adopted in the Extremadura

The councillor for Infrastructure and Technological Development, Luis Mill n V zquez de Miguel, announced that within one year all the computers of the Junta of Extremadura (government of the autonomous region of Extremadura, Spain) will run Free Software office tools and gnuLinEx, the local flavour of Debian GNU/Linux 3.1, as mandatory operating system. It will be gradually introduced to all administrative organisations of the Junta of Extremadura. From now on, all workers of the public administration will also use Open Document Formats (ISO/IEC DIS 26300) for their office applications as well as PDF/A (Portable Document Format, ISO 19005-1:2005) for document exchange, when guaranteed unalterable visualisation is required. V zquez de Miguel explained that at the end of the period all additional software must be distributed under a free license. "This is an important initiative that the Junta of Extremadura has been working on for a long time, accumulating experience and analysing the impact on our organisation so as to guarantee its success", the councillor declared. According to V zquez de Miguel, Free Software also improves security, autonomy and rationalises public spending. Using Open Document Formats will guarantee the conservation of all the administrative documents for longer periods of time. It will also improve the relationship with the general public since it's not obliged to acquire proprietary software to access official documents. About Extremadura Extremadura is an autonomous region in the West of Spain, with a population of about 1 million. It is well known due to its innovative efforts to bring the information society to all citizens, recognised with distinctions such as the 2004 European prize for regional innovation, granted by the European Commission. About gnuLinEx gnuLinEx is based on Debian GNU/Linux 3.1, with GNOME as the default desktop. In 2004, it was already deployed in all public schools in Extremadura, and was in use in other environments, such as community centres. gnuLinEx closely follows the development of Debian, with a special focus on translation into Spanish, and easy of use and maintenance. About Debian Debian GNU/Linux is a free operating system, developed by more than a thousand volunteers from all over the world who collaborate via the Internet. Debian's dedication to Free Software, its non-profit nature, and its open development model make it unique among GNU/Linux distributions. The Debian project's key strengths are its volunteer base, its dedication to the Debian Social Contract, and its commitment to provide the best operating system possible.

Joey Hess: ikiwiki flood prevention

Let's say you're just getting started using ikiwiki as your blog, switching from something else and converting the data over from it, as more and more people seem to be. Which is great, but you don't want to flood your aggregator. You probably set up the blog with a line like this on a page named "blog" of your wiki:
[[inline pages="blog/*" show=30]]
Problem is all the links and guids and other less than stellar things that rss agregators use to prevent dups and flooding have changed and now all 30 pages are going to flood aggregators. As of version 1.16, ikiwiki has a nice new feature that can help deal with this:
[[inline pages="blog/* and created_after(blog)" show=30]]
Now only pages created after the blog page itself will show up on it, while all the old ones will still be available as archives. If you flooded your aggregator before this, I suppose you're forgiven. Though it was even possible to avoid flooding before this feature, with some difficulty. :-)

Alexander Sack: It's mozilla patch-day!

... I have backported security fixes recently announced by mozilla for firefox and thunderbird to the old branch – which we have in debian stable. You can grab the patchset I produced from http://people.debian.org/~asac/patchset_109b.tar.gz. In it you find patches that fix:
Good news is that a bunch of critical flaws have been identified to not affect debian stable, namely:
CODE:
  + CVE-2006-3801, MFSA 2006-44
  + CVE-2006-3677, MFSA 2006-45
  + CVE-2006-3113, MFSA 2006-46
  + CVE-2006-3802, MFSA 2006-47
  + CVE-2006-3803, MFSA 2006-48
  + CVE-2006-3804, MFSA 2006-49
  + CVE-2006-3810, MFSA 2006-54
  + CVE-2006-3812, MFSA 2006-56
Another good news is that MFSA2006-45 – which was recently /.ed with a working exploit – is in that list too. So debian stable users are not affected by that issue. In order to get feedback and testing I am now preparing packages. Testing this is critical, because upstream has abandoned 1.0.x development. So please help to test and report regressions … otherwise those might go unseen and finally slip through to our users. I will announce new packages available for testing on my site and on the pkg-mozilla-maintainers mailing-list. Thanks for your support!

2 August 2006

Neil McGovern: How ironic...

On the same day that Nominet signs up to ICANN, it's announced that the US government is doing a full consultation on the future of ICANN, possibly fundimentally changing how ICANN operates.

Roland Mas: RSS aggregators again

I am once again the victim of overzealous RSS readers. Especially one called "RSS Popper", which from what I can gather is a plug-in for Outlook. I have no idea how (or even if) it can be configured, but from what I can guess from my logs, it defaults to refresh the RSS feeds every one minute and a half. Which is far too often, especially considering the capacity of my server. Apparently there are only a few people subscribed to my RSS feed using that reader, but when their Outlook is running, my poor old webserver gets noticeably loaded. I am tempted to ban this user-agent from accessing my RSS feeds, but not immediately and without notice though. So if you read this through RSS Popper, please decrease your refresh rate to something reasonable. One refresh every day should be plenty enough. Thanks. Update (2006-02-25): There, it's done. The ban is as restricted as I could make it, but it does affect all users of RSS Popper in aorleans-*.abo.wanadoo.fr, as well as one particular 195.33.x.y address, apparently in Germany.

Roland Mas: New blog categories

After large amounts of peer pressure from Rapha l Hertzog and other French Debian Developers, I finally created a new geek-fr category in this blog. The old geek category was renamed to geek-en for consistency, and both are now subcategories of a new geek category. I think that means you'll get articles in both French and English if you just read geek. Same applies for the RSS feeds, so you may like to update your feed readers and aggregators (I already updated Planet Debian). The new geek-fr subcategory will contain articles in French, as you'd expect, and will probably be more related to French-specific events. I'll post another announcement in French in a few minutes.

Jordi Mallach: Asturies

Tomorrow I'll be going with Bel n to Asturies, one of the northern regions of the Spanish state. The plan is to spend the weekend in Ribadesella during the celebration of the Descenso Internacional del Sella and then move around the area and walk all over the beautiful Asturian mountains, during four days, until Friday. The plan for those four days is pretty loose right now, so if anyone has suggestions about must see places, I'm very interested in hearing them in comments. My idea is to do daytrips of several hours (6 or 7), coming back to our base camp to sleep, but if there's something we really should visit and it involves a two day stage, we'll probably bear with carrying the heavy tent around too.

Isaac Clerencia: Beach, driving license exam, books, Akademy

So I was having these great holidays in the beach with some friends, getting a tan, swimming in the sea, chasing some fish wearing really-big-nose water goggles, drinking beer by the seaside, … but I had to come back to Zaragoza to take my driving license exam. I’ve gone to the driving school today to ask what time was the exam taking place exactly, and I’ve been told that the exam has been moved to Monday (can this happen in any other European country besides Spain?). As I only have holidays this week, I can’t attend my exam next Monday, and thus, the whole thing sucks, specially the getting-back-from-holidays-sooner bit. To keep my karma up and given the fact that I’d some free time to spare as I no longer needed to study for the exam, I’ve visited some bookshops and purchased some books (namely, The Ages of Lulu, Fahrenheit 451, The adventures of Huckleberry Finn and Notes from a Small Island), and then I’ve gone to the park and read for a while (actually, I’ve finished reading Wilt, by Tom Sharpe, which I started reading yesterday in my way back from the beach). I’ve thought about blogging about the books I read, although I’m not sure if I’ll manage to do it. In the end, it has been a nice day and I’ve come home quite relaxed again. With regard to free software stuff, Wesnoth 1.2 is going to be released really soon now, as well as KOffice 1.5.2, I’ve already registered for Akademy 2006 in Dublin, I created my first attempt of flake plugin some days ago, …

Wouter Verhelst: Interesting things to do with an electronic ID card and a cardreader

So, now that I finally feel that belpic in Debian is in working order (in unstable), let's talk about the interesting things one can do with it. You have an eID, run Debian, just bought yourself a cardreader, and feel "now what"? This is the blog post for you ;-) Note that there are still some rough edges; but I still have time to fix those before etch releases, so that's not much of an issue. First, you need some support packages. If you bought a cardreader from Zetes or got one from the Government somehow, then you have an ACR38 reader and you need a hardware support package to be able to use it; the package in question is called libacr38u. Obviously you will also need the belpic packages. For now, just install all of them—there still appears to be a dependency issue which I will need to fix; I'll announce on this blog when that has been done. Just run
aptitude install $(apt-cache showsrc belpic sed -e '/^Binary/!d;s/^Binary: //;s/,//g')
and you will install them. I uploaded these packages to backports.org, too, where they'll hopefully show up some time soon (the current packages are still at 2.3.13 for some weird reason). This will give you:
beidgui
a graphical application that will allow you to view the data on the card, and to change your PIN code (as long as you still know your current PIN code and don't need to unblock it with the PUK; for the latter, you need to go to your local town or city or district hall).
beid-pkcs11-tool
a command-line tool that will allow you to change your pin and do some other interesting things. Note that while this is a command-line tool, you still need a GUI environment to be able to run it; there are cases where the libbeidlibopensc2 library will open a dialog window to ask you for your pin, without going through the application.
beid-tool
a command-line tool with not much options; it doesn't allow for much more than to test whether your installation works.
beidcrld
a daemon that will update the CRLs (Certificate Revocation Lists) when there is a network connection, so that you can verify the validity of the card in your reader. If you have a permanent Internet connection, there is also OCSP (Online Certificate something Protocol) which will verify the validity of your certificates against an online server, and which the preferred way to do this. Future versions of the belpic packages will have a /etc/default/beid which will allow you to disable beidcrld.
beidpcscd
a daemon that is used if you need libpcsclite to talk to your cardreader. If you have an ACR38 cardreader, you need this. I personally have a different one, which uses openct, so I don't...
a whole bunch of libraries
However, only three are really interesting: libbeidlibopensc2, for low-level operations on the card (such as "read a file", "sign some data"; libbeid2, for high-level operations on the card (such as "read identity data", "read a picture"), and libbeidlibjni (JNI library, if you want to use the eID from Java). Libbeidlibopensc2 and libbeid2 are packaged separately; libbeidlibjni is packaged together with libbeid2 (though that might change in the future, not sure).
Some files to support mozilla, firefox, and other browsers.
The most interesting ones from a user point of view are /usr/share/beid/beid-pkcs11-register.html and /usr/share/beid/beid-pkcs11-unregister.html. Note that registering the module isn't enough to be able to use it; you will have to perform some additional steps which are outlined on eid.belgium.be, the government website about the eID.
Additionally, there is also OpenSC which you may want to install. The point there is that things like OpenSC's pkcs15-tool and pkcs15-crypt do not have a counterpart in the eID toolkit, so if you want that, you need to install it. So, that's the software in the eID toolkit. But what can you do with it? There are a number of things. For starters, of course, there's the beidgui, which allows you to view, save, print out, and do other interesting things with data on a card. If you work on a place where you regularly need to work with eID data, this may just be the appliation for you. If you have set up your browser to support the eID, you may want to go to mijndossier.rrn.fgov.be, a website set up so that everyone can view their own information in the Rijksregister. I'm sure there is a French version of that URL, but don't ask me—I don't know it. You probably already know about tax-on-web, where you can do your tax application online. It is possible to install a signing module into Mozilla Thunderbird, and to sign your emails using S/MIME and the eID card. This will give you a signed email which is legally binding; might be interesting for those of you out there interested in not having to use as much paper signatures. Details, again, on eid.belgium.be. The same is true for signing documents in OpenOffice.org. I haven't tried doing any of this myself yet, though. Of course, you can sign any text file as well, using pkcs15-crypt from OpenSC, or extract the certificates on the card using pkcs15-tool. Just run them with the --help parameter to find out about their options. And that's about it, I guess. More interesting links can be found on a a portal maintained by Danny 'godot' Decock on the eID.

1 August 2006

Roland Mas: Migrated to Ikiwiki

I finally took some time to migrate my blog from a (very old) Wordpress to a fairly new Ikiwiki. As I write these lines, the version of Ikiwiki I'm using isn't even released, and it includes two patches made by yours truly (and submitted upstream, of course, as bugs #380680 and #380743), allowing the creation of monthly archives and the possibility of making these archives RSS-less (it doesn't make much sense to have an RSS feed for something that's supposed to be static). The whole blog is now static, since I haven't investigated the comments system. I will probably enable the comments eventually, and I will of course migrate the existing ones (much like I migrated the existing articles, with a combination of a Perl script and some hand-tuning). In the meantime, I'll enjoy a spamless blog. The other regression is the lack of a search facility, but from what I can see it was hardly ever used anyway. Note to readers: old URLs should still work (thanks to Apache's magic mod_rewrite), but please update your bookmarks and feed readers and agregators and so on to use the new ones, since I'll probably disable URLs at some point. Update: I also hacked a new plugin, linkbar.pm, which appends a static Markdown string to all *.mdwn pages before they are rendered. So you should now see the lovely navigation menu on all pages, including the article pages.

31 July 2006

Jordi Mallach: Qana, Lebanon

I've been watching the Lebanese bloodshed since it started. It really makes me sick. I have discussed this with many friends. There was little discussion though: we all thought this is a plain war against civilian targets. I tried discussing with people who could maybe be more supportive of the Israeli points of view. I tried talking to some of my right-winger relatives... and I haven't been able to find anyone that can say a word of support of what Israel is doing in Lebanon. In three weeks, I have seen how Hizbullah killed some Israeli soldiers in some area around the border between Lebanon and Israel. As far as my (as an international online paper reader) judgement can tell, the location where this happened is disputed. Some say it was inside Lebanese territory, the others say it was an Hizbullah incursion into Israeli soldiers. I really don't care. The immediate result of this action was a campaign of air strikes against Beirut and other Lebanese cities aiming to give a measured response (cache, and beware this is explicit) to Hizbulla's aggression. This, apparently, included destroying any vital infrastructure in heavily populated areas of Beirut, including bridges, power plants, hospitals and apparently random buildings. While the Israeli army said the military operations were aimed to get rid of the Hizbullah camps and infrastructures around the border where they fire their rockets against Haifa and other Israeli cities, and their headquarters in Beirut and other southern cities, what the world espectated during the first three or four days of air strikes was pure horror. Hizbullah-controlled areas were like ghost quarters, so any bombing of those were very unlikely to take any Hizbullah victims. On the other hand, the rising number of civilian victims was the first bits of news that I could hear in my radio as I woke up every morning. All of this, with a great amount of cinism and unlimitted cruelty. The Israeli army declared that the civilian population in the South should be leaving their homes (measured response), while they knew they were doing exactly what was needed to prevent this, by locking them up around destroyed bridges, harbours, airport and roads. The first columns of the lucky refugees who could afford fleeing to the North were greeted by Israeli bombs, leaving a good number of scattered bodies. In Spain, the news shocked the public opinion and Zapatero, along with Chirac (IIRC), declared those actions were untolerable and unproportionate, and should be stopped immediately. This brought some local politics fun, when on one side the Israel ambassador in Spain accussed Zapatero of being antisemitic, and the right-wing leader Rajoy called the thousands of people who spontaneously demonstrated against the war in a few cities "clowns" and "ignorant". Watching what the UN has done to stop these warcrimes, I really think it's a great moment to shut down that useless organisation and let some big corporation buy their nice building in New York City to build their offices in it. Once again, when some countries tried to come up with some resolution that forced Israel to stop, the United States waived their vetto flag. Once again, the Security Council has done nothing to put an end to another chapter of violence in the Middle East. The vettoing powers of some of the members is so ridiculous that it makes it totally inoperative. So, as the UK and US governments were not going to do anything to stop the air strikes, Israel had carte blanche to do whatever they wanted for a week. And then, Israel's measured response destroyed one of the UN's buildings in Lebanon, killing four annoying observers, despite their calls warning that the bombs were falling too near their location. Only then, the United States decided to send Condie to have a look around the area, surprise visit to Beirut included. I wonder, what phone number must the innocent women and children who cannot escape their cities and towns dial in order to warn the Israeli army about the proximity of their bombed targets? After two visits of Condie to the region, nothing has changed, as the fourth week of operations starts. This is getting on my nerves. I don't, and won't, justify any of the Hizbullah attacks on civilian targets using Katyushas, or the kidnapping of soldiers, or whatever. What I see is that unless Israel takes a radically different approach to their problem, nothing will change either. Violence isn't at least. Apparently, their military operation isn't going well at all, and is not damaging much of Hizbullah's military capacity. What are they going to do? Will they occupy southern Lebanon for 20 more years? The social movements this kind of actions are generating is also very, very worrying. On one hand, I read that around 85% of the Israeli population approve this war and think this is what their government needs to do to make them safe. This is pretty shocking. On the other hand, everyone still in Lebanon, even the Christian community, are united against the attack, helping each other in their survival quest, while the popular support to Hizbullah is rising, with big concentrations of people cheering them in the streets. This is just two years after similar demonstrations in Beirut forced the Syrian military out of the country. While the Israeli war against Lebanon (I won't buy the "It's against Hizbullah" bullshit), sadly all the media, cameras and journalists have given their back on Gaza, which is under similar, but probably more brutal and savage military operations by Israel, as another soldier was kidnapped just one week before all of the Lebanon stuff started. The press doesn't have any news of how things are going in Gaza. The last thing I remember is that the UN was warning about the threat of a humanitarian disaster due to the lack of any kind of supplies in Palestine. If Palestinian kids are starving, the media are not letting us know. Yesterday, 54 civilians were killed in an improvised underground bomb shelter in Qana, most of them being children. The Lebanese civilian death toll must be well over 500 as of this writing, with a ratio of at least 1:10 compared to Israeli military victims. When will Olmert have enough? The only way I see this will end up for good is when the Israeli public realises being at war in three fronts is quite expensive and damages their home economies. Maybe, at that point, people start hearing what the Meretz party minority in the country have been saying for years. Israel has the right to defend itself. This is the official motto of Israeli and American leaders. When this right is extended and abused to the point the main targets and victims are civilians, Israel walks quickly away from a perdurable solution. Today, hostility against the state of Israel is even greater than last month. Hizbullah in Lebanon, Hamas in Palestine, will probably be the winners of the conflict when the bombings end. Not the best recipe for a peaceful future.

Ian Murdock: Two-way email synchronization without Blackberry Enterprise Server?

I’ve been thinking a lot about software above the level of a single device lately, so I set out this weekend to finally get two-way email synchronization working on my Blackberry. My main goal is to have a single inbox I can access from multiple devices without having to ever deal with the same message twice (i.e., if the message is read/filed/deleted/etc. on one client, it’s marked read/filed/deleted/etc. on all clients), with full support for disconnected operation. (I care much less about the oft ballyhooed push email feature—I’m perfectly content to wait 15-20 minutes for email to be delivered.) Since what I want more or less perfectly describes IMAP, I figured Blackberry Internet Service, which uses standard Internet protocols for mail delivery and supports IMAP, would be sufficient, and that I wouldn’t need Blackberry Enterprise Server, which hooks into Exchange and other “enterprise” messaging systems. Unfortunately, I appear to have been wrong. While messages read and deleted on the Blackberry are reflected on the IMAP server, the reverse is, surprisingly, not true (surprisingly because, unlike POP, which behaves similarly in BIS, IMAP is a bidirectional protocol). In other words, when messages are read or deleted on another client (e.g., the Thunderbird running on my laptop), those changes aren’t reflected on the Blackberry; so, as a result, the Blackberry accumulates every message I receive when it’s not in use, making a periodic “Delete Prior” necessary to get rid of all the accumulated junk (which obviously deletes the useful messages too, like, ahem, the ones with my flight information in it). Worst of all, after several days of trying to figure out why IMAP wasn’t working the way I was expecting it to, I discovered this is the expected behavior (see note 5—”Messages deleted from the source mailbox are not automatically deleted from the device”), rather than a bug. What to do? I could obviously break down and upgrade to Blackberry Enterprise Server. I’m not too keen on setting up an Exchange server just for this (which would cost hundreds of dollars, particularly after the cascading upgrades typical of Microsoft products, e.g., I’d need to get Windows Server too). As an alternative, there appear to be a number of companies that offer a BES hosting service. However, the costs add up pretty quickly—another $10/mo. to T-Mobile to allow BES traffic through (the “business tax”), $10/mo. for BES hosting, and $10-15/mo. for Exchange hosting on top of that (BES hosting is an add-on to Exchange hosting in every plan I’ve seen). That’s a grand total of $35/mo. just to get email marked read or deleted on my Blackberry when I read or delete it in Thunderbird. Hrmmph. Another idea is to find a Blackberry IMAP client, but there seem to be a dearth of these. The main one that comes up both in web searches and that’s described in Blackberry Hacks is from a company called Reqwireless which, tantalizingly, was acquired by Google last year but whose products, frustratingly, are no longer available. In any event, I want something that integrates with the Blackberry’s excellent inbox, which aggregates email, SMS, missed calls, Google Talk messages, etc. in a single stream, and I’m not sure if a separate IMAP client will be able to do that. Other observations: This page says that “two-way [Blackberry] sync is coming soon” to Yahoo Mail. However, “coming soon” doesn’t really help me. Funambol looks very promising, but it’s going to take me a little while to wrap my head around what exactly I need to do to deploy it. Not exactly point and click. Scalix offers Scalix Wireless Solution that works with Blackberry and is integrated with the Enterprise and Small Business Editions. At $60/user with no minimum number of users and a free trial, this looks promising too. Zimbra offers Zimbra Mobile, which “includes the ability to leverage Zimbra’s third party mobile partners that offer two-way sync to Blackberry and other devices” (whatever that means). However, I’m assuming this comes bundled with the Network Edition, which is sold with a minimum of 25 users, and that probably makes it unaffordable to an individual user like me. Any other suggestions?

30 July 2006

Joey Hess: ikiwiki as a planet

Well, I did it: I shoehorned feed aggregation support into an ikiwiki plugin. So now it can run as a cron job, pulling in updated from feeds, turning them into wiki pages, and saving the pages to disk, then rebuilding the wiki. Turning a wiki that grew blog support into a Planet engine has some interesting consequences. One of which is that the aggregated posts can be edited in the wiki unless locked, but more interesting is that the posts are first-class wiki pages that can be linked to from elsewhere in the wiki, and that can stick around even after they've fallen off the Planet's front page (although I do need to code up the support for eventually expiring them). Another interesting thing is how the feeds are configured: By directives embedded in the wiki pages themselves. So no need for config files, and the wiki page that configures the feeds builds into the web page that lists and shows the status of the feeds. The nicest thing about it though, is how little code I had to write, and how targeted it was. 300 lines exactly for it all. No need to deal with RSS generation, page formatting, full text search, any of that, it was all already there and works with the new source of pages like it would with any other pages. Very happy with this. If you want to check it out, I've imported the data from Planet Debian upstream into updo.kitenet.net. Now if you find a new blog for a Debian upstream author, you can just edit the feeds page and add it yourself.
PS: No, I don't know why Jeff Waugh is flooding it, but it's probably a minor bug in the page creation date parsing. Too late to check. (Update: Bug in the atom parser, bug filed w/patch.) PPS: I know about the problem with Lennart Poettering's blog encoding; a patch is in the BTS.

Next.

Previous.