Aaron Swartz writes about what government might do to encourage entrepreneurship: http://www.aaronsw.com/weblog/prostartup As an American who has lived in Europe for a while, I've seen both sides of the coin (or pond, as it were), and feel qualified to add a few things to the conversation, even if many of these points merit a discussion of their own.

• He's right about health care. It's one of those things with a huge downside risk that people in Europe simply don't have to think about. You can change jobs, take a break from a job, start a company...whatever, and you never have to think about "what if". Even if you have the sort of preexisting condition that can hang like a stone around your neck in the US. How to implement such a system (which of course has potential disadvantages as well) is well beyond the scope of this journal.
• Universal education. I don't think it's as great as Aaron seems to think, but I don't think it's very influential one way or the other on startups. People get good educations in both places, although, by and large, the best Universities are in the US because they have more money, and have in the past attracted highly qualified people from all over the world. In both places, students manage to meet other like minded people with whom they can start companies. There are definitely improvements to be made to the US system, but that's really just a political discussion: like I said, differences in universities are not the limiting factor.
• Minimum income without having to work or even having to look for work sounds like an enormous can of worms. Might be good for startups, but has big risks associated with it, and wouldn't be politically feasible in the US. Even in most European countries with that sort of thing, you don't just get money: you have to look for work, do job training, or prove that you're just not capable of doing anything productive.

And here are some thoughts of my own: I think it's best to focus on the startup "curve", and costs associated with various points on it: when people are just getting started, keep state-imposed costs low. If someone makes a lot of money, worry about taxing it then. This is quite different than what has previously been the norm in many places in Europe, which have policies akin to slaughtering the goose before it lays any eggs, let alone golden ones. Italy is a particularly bad example, but it's the place I know best, and not too far off what happens elsewhere in terms of policy: fixed, sunk, startup costs are in the order of 10,000 Euro, which for most people is a lot of money. This creates a bias towards people who already have a lot of money, and away from random people who happen to have good ideas and a strong desire to execute on them. This is something that the US more or less gets right: it cost me $55 in state fees to start DedaSys LLC as a limited liability company (even throwing in money for lawyers and the like, you're still far under the thousands it costs in many European countries). Incidentally, it looks like Germany may be on the right track, if you look at the "Mini-GmbH" mentioned in the article. It's progress, if nothing else. Beyond that, there is a lot more red tape in Europe, and that, I think, rather than a bit higher taxes for companies that are profitable, is the thing that, outside of culture, probably weighs most heavily on European startups. Culture, however, is also a very key factor, and not something that will change soon or easily. In Italy, there's a lot of pressure to land a permanent job, from which you can basically never be fired. The idea of striking out on your own is probably simply not on most people's radar screens. I think culture is what means that Europe produces tons of great open source software, for example, but relatively fewer startups (if you're just counting open source startups though, Europe does ok). Perhaps this is slowly changing, but it will take a while, and without some policy changes, the incentives won't even materialize. Returning to things that government can do, something critical that many people don't get is that government funded startups are usually big failures (see the French "Google competitor") and a big waste of money that would probably simply be better to spend in lowering taxes, improving education, or other "level playing field" initiatives, rather than having government employees attempting to "pick winners". This is a common problem in Europe, but also in many areas of the US that want to replicate Silicon Valley's success. Going back to the US, which was Aaron's original point of focus, beyond health care, what could the US improve? At the moment, immigration seems to be the big problem: people from all over the world want to go to the US to work and start companies, but look at what kinds of hoops someone (who is coming to spend money and create jobs!) has to jump through to do so: http://www.techcrunch.com/2008/05/02/coming-to-america-getting-visas-to-do-business-in-silicon-valley/ Embarrassing and shameful. In conclusion, I think the common theme is that the government can't really do much to actively promote startups, but can certainly hinder them by setting too high a bar in terms of bureaucracy and fixed costs. Lowering those fixed costs for new companies, be it through at least basic health care for everyone, or lower taxes and less paperwork should be what governments aim for. Given the right conditions and incentives, bright, hard workers will do the rest.

Dear Bastian let's fix your blog post.

Philipp thinks, the fact that rng is not using the information in /usr/share/bug renders rng unfit for release and upgraded the corresponding bugreport from wishlist to serious. Moreover: since I dared to downgrade the report back to wishlist he decided to remove rng from testing and block it until the bug is fixed.

s/Philipp/the Release Team/g. And yes, we believe that reportbug-ng goes against the Maintainers wishes, and doesn't help users that don't know how to report a bug (and which are rng audience unless I'm mistaken).

I don t want to heat the debate about this bug again, but Philipp s decision seems arbitrary for me and I wonder if the same standard is applied to every other Debian package.

It's not, it was discussed in the Release Team and was not Philipp on his own alone. And yes, the same standards of quality is wanted for every package in Debian.

I mean, rng has no release critical defects.

That's you claiming that, there have been really constructive remarks in both bug that we upgraded, and that I think explain wisely why the current reportbug-ng behaviour doesn't makes it a suitable reportbug tool right now. I think for example that Sam's and Michael Biebl contributions in both bugs are good explanations of what is wrong and why.

It just does not use the aforementioned scripts as additional information in bugreports does this really render the software unfit for release ?

Yes it does. Again, people that use rng are I think, less experienced users, who need guidance through the bug reporting process. The kind of users that often send annoying bug reports. Instead of lowering the annoyance factor, you aggravate it. In the end, rng makes the frustration higher, and totally fails to meet its primary goals: making bug reporting nicer, simpler, and more efficient for the Reporter and the Maintainer. While it's probably nicer for the reporter, you totally fail on the other part of the contract. And if you don't care about the Maintainer, then well, reportbug-ng is just a spam machine to them, and your careless attitude toward them is unfit for release for sure.

For some reason (maybe related to upgrading openssl recently), my Jabber client became unstable. Instead of fixing it the right way, I simply upgraded to Emacs 22.2 (which also got me the emacsclient --eval option mentioned on this blog previously). It still wouldn't make SSL connections at first, but a quick application of [jabber.el] Anybody using emacs-jabber with Emacs 22.2? fixed it. That's the wrong way to fix that bug, but it's not quite as wrong as misusing computers to try to fix copyright infringement. MediaDefender denial-of-service attacked a TV production company, as described in Inside the Attack that Crippled Revision3 on May 29th, 2008 at 07:49 am by Jim Louderback in Polemics MediaDefender or MediaDestroyer? That's the wrong way to fix that bug, but it's not quite as wrong as making treaties mostly in secret, under NDAs to try to evade local copyright law-makers. The US government, the European Commission, Japan, Switzerland, Australia and a handful of other countries are meeting in a secret negotiation on a new treaty

"that undermines civil rights and privacy, and which many say will change the substantive rights the public has to use copyrighted works or inventions."

Read more at Act On ACTA and then contact your law-making representatives.

Using org mode to write ikiwiki posts I have been much taken by org-mode in Emacs recently. Firstly, this has allowed me to actually effectively implement the tenets of Getting things done , which is amazing by itself. I always used to start with great enthusiasm, which rarely lasted longer than a week. Until org-mode. Then this is so amazingly flexible. It has better handling of tables and even a spreadsheet mode than anything I have used and it has a pretty decent HTML export function. I practically live in org-mode on work days now. I strongly recommend org-mode, from things like agendas, TODO lists, calendars, appointments, articles, and now Ikiwiki posts. I rarely ever use markdown, apart from blogging using Ikiwiki and thus, since I blog so infrequently, I rarely ever remember all the syntax. On the other hand, org-mode syntax is now at my finger tips so I decided it was time to write a Ikiwiki plugin so I can now write my blog posts using syntax I can actually remember. It is still rough around the edges firstly, this requires emacs23 (or, on Debian, there is the unofficial emacs-snapshot package), secondly, it uses hueristic hacks to prune away the bits of the stand alone HTML page that org-mode creates; all I can say is that it currently works for me, as you can see from this post. How git this is for mainlne inclusion is another matter. The code is here: org.pm. It can be dropped in to the Ikiwiki plug-in directory, and that s all you need. With this, Ikiwiki pre-process things in the input file, and then passes it to emacs to htmlize it.

Dear Recruiters,

While I appreciate being contacted with interesting opportunities (at the moment I'm not looking. It's a lovely cross between being happy in my current job and hoping for a particularly uneventful 12 months on the home front), emailing me from noreply@saic.com is just going to make me mock you. It's at moments like these that I with I could channel Matthew Garrett. When I try, I just sound like Overfiend from the good old days ;)

The family went up to the City today with some friends of ours and I had the most amazing thing: I walked into an Apple store, and the greater at the front solved my iPhone problem. The phone decided a week or so ago that there was always a headset plugged in. The greeter pulled up a clever tool that looks like an 1/8th inch to 1/4inch adapter with tiny holes milled in it for blowing air in. Seems they have this problem often. Being with 3 kids and two families, I couldn't reliably book a time to see someone at the Genius Bar, but he just blasted it out and it worked wonderfully.

Of course, I came home to plug it in and have discovered that the cord to connect to the charger appears to have corroded and won't charge the phone now. So, AppleEmployees++, AppleHardware--. I now will make the distinction.

Next technology FixIt: Convince my Bluetooth headset and Bluetooth stereo to go into pairing mode again. Both seem to have decided they won't do this anymore.

There is a bit of discussion on Planet Debian on dbus and HAL and how to handle the daemon restarting. Basically, our "hardware abstraction" layer is actually more like a policy layer: the kernel provides the real hardware abstraction, but its access control features are not fine grained enough, and there is no revocation of privileges. Right now, there are two systems in use: X11 for keyboard/video/mouse, and dbus/hal for the rest. X11 has no problems with access control, because any process that wants to talk to the X server is owned by the user sitting at that terminal, and when that user logged off, the X server got uninteresting for us. For other hardware, that model doesn't entirely work. KVM is unique in that it only affects one user, and there is a clear definition of that user going away. To summarize my desired policies:

Sound

is similar, but I often log out in the evening and have something playing while I fall asleep, so the policy on the sound device is that access is prolonged even after logging out.

USB drives

should be accessible to the user that plugged them in, and stay with them, even after they logged out, until they are disconnected. I'd like to have block level access to them and run my file system drivers in user space (so I can format a pen drive without administrative access to the machine). That does not apply to all USB drives, though, so I'd like to be able to "recognize" certain volumes and handle them differently, not so much as a security but as a safety measure.

Smart cards

should be like KVM, really. No one but me should ever be able to talk to my cards, because causing a DoS is just so easy — enter the wrong code three times, and I have a big problem. Obviously, that is part of the security that my card provides (if you want to upload Debian packages in my name, you have to steal my wallet and get my PIN right in the first three attempts).

USB phone handset

I'd like that phone to be able to receive calls anytime, even when no one is logged in, and the currently logged on user should be able to make a call (but not over my account).

Specialty hardware

like the JTAG adapter hanging off USB on my box need a different policy too.

Any of these (except for the smart card) might mean that the device could be connected and used for a very long time, longer than I can sit at the console. Unlike humans, who get only mildly annoyed if the display closes and applications need to be restarted, there are serious data consistency issues if connections break and need to be rebuilt — and the policy needs to allow for rebuilding the connection securely. If we want to allow for handing over a resource to a new instance of the server or the client, then the protocol needs to be aware of this, as we need to synchronize server and client state after a connection breakdown. It might be possible to create a session management layer for certain services (analogous to X11 toolkits that transparently handle rebuilding the widgets on restart without bothering the application about it), but it'd probably be difficult to do without a full protocol redesign, as data loss is simply not as acceptable as when talking to a human who can pick up the pieces and go from there.

I recently noticed that a very good way to safely read webcomics in the bath tub is an old laptop with a big screen (e.g. a IBM ThinkPad A-series like my 15” A31 which has a nice 1400×1050 resolution), a water proof keyboard, the screen-alike, keyboard only driven (hence the name) window manager ratpoison (other keyboard driven window managers like wmii or awesome probably will do as well as ratpoison) and a good keyboard driven web browser which can bind or by default has bound a key to follow <link rel="next" ... /> tags. Like Opera. Opera has bound the space bar to scroll one page down and if you reach the bottom of the page to go to the next page as labeled in the link tag. Additionally the full screen mode is helpful, too. Or the dream browser of all Emacs addicts, Conkeror, which has bound the function browser-follow-next to ]]. (Conkeror packages will hit Debian Experimental quite soon.) Or the GNOME feed reader Liferea which has bound Ctrl-Space by default to scroll down the content by one page and if you reach the bottom of the content go to the next unread item. With that equipment I can read my favourite web comics like Questionable Content (whose content seldomly is questionable :-) or Ozy and Millie (Think of a mixture of Calvin & Hobbes, Peanuts and Kevin & Kell) in the bath tub without drying my hands before reading the next comic or fearing water or health damage by the combination of water and computer. I just press one or two keys on the keyboard floating over my lap and have a good time. BTW: I’ve got a blue, non-branded one (packaging reveals it as “AirTouch Keyboard”, probably manufactured by SanChuan Electronics, China) with swiss-german layout from ARP Datacom (whose website offers no permanent links and insists on session cookies *puke*), but those from Keysonic or from ROCK seem to be very similar — nowadays they are also available in illuminated, miscellaneous colors and wireless, but only IP65, probably because of the necessarily accessible battery compartment. But this kind of having fun still has optimisation potential: non-flexibel water-proof keyboard (IP67 recommended, so those IP66 keyboards and mice recently posted at UF LOTD are probably not tight enough), flat screen mounted above the bath tub, etc. ;-) Or maybe a completely water proof laptop if such thing exists — Does it? One more note: In Debian Sid and Lenny recently a new tool called keynav has been added, which allows you to control the mouse quickly using the keyboard only. So with Sid or Lenny, I don’t even need an waterproof mouse or trackball if an application insists on mouse usage. ;-)

Stage 1 : working whilst tired, missed a critical dot in a command, removed system /etc/ instead of the local test ./etc/ of a root filesystem test build. Come home early to try to rescue the machine using /etc/ data from machines on the home network (same kernel, same users, same config).

Stage 2 : Get home, start up the office network, UPS alarm goes off, sparks and bang from my main machine, familiar smell of burnt electronics (again) and UPS seems now unable to provide any mains power, battery only.

Stage 3 : despite having the config, the broken laptop is still not fixed. Lots of packages are completely bust, resurrecting /etc/passwd, /etc/group and /etc/shadow from other machines at least provided login and chroot operation via the Lenny Debian installer. I don't want to have to reinstall this box but it is questionable whether setting everything up again after reinstalling is actually less work than fixing the broken config.

Result: My semi-VAC is ongoing, I'm back on my iBook laptop and I'm looking for a new UPS.

So I am giving a talk this Friday at the University and here is the English introduction to my talk/paper and below is the Portuguese one. It starts at 9 am in Porto Alegre, Brazil and is being streamed.

*O Departamento de P s-Gradua o da Antropologia e a Associa o Software
Livre.org convidam:
*_*
Palestra com a antrop loga Gabriella Coleman*_
professora da New York University (NYU) *Quando:* Sexta-feira, dia 13 de junho, s 9h
*Onde:* Audit rio do ILEA, Campus do Vale - UFRGS
*Entrada:* Gratuita
*Transmiss o web: *tv.softwarelivre.org *
_Revolu es Silenciosas:_*
*O Ir nico Surgimento do Software Livre e de C digo Aberto
**e a Constru o de uma Consci ncia Legal Hacker* A palestra oferece uma an lise antropol gica e hist rica do
surgimento da comunidade de software livre e de c digo aberto,
procurando mostrar como, ao longo de duas d cadas, hackers e
entusiastas do software livre garantiram para si um dom nio de
autonomia legal para a produ o de software. Em uma poca
marcada por profundas transforma es no regime de Propriedade
Intelectual, a comunidade de software e de c digo aberto se
organiza cultivando uma acentuada consci ncia das transforma es
no mbito legal. O objetivo da palestra o de demonstrar como e
quando se cruzaram as trajet rias parcialmente independentes das
transforma es nas leis de propriedade intelectual com a
consolida o do “movimento” de software livre, para se tornarem
hist rias insepar veis voltadas disputa pelo futuro das
tecnologias - especialmente o computador pessoal e a Internet.
Com este foco, ser discutida uma nova pr tica social de
produ o de tecnologia que fornece uma nova vis o de mundo
insurgente e que desafia as justificativas neoliberais que
animam a expans o das leis de propriedade intelectual. Nesta
discuss o, ao inv s de oferecer hist rico abrangente, ser o
apresentados exemplos selecionados da hist ria do movimento de
software livre e da globaliza o das leis de propriedade
intelectual, com vistas caracteriza o da pr tica de produ o,
distribui o e utiliza o de Software Livre e de C digo aberto
nos Estados Unidos.

I finally got around to dropping four old computers off to recycling. Triton, a community college nearby, had a recycling event where students volunteered, and so I finally got around to dropping two generations of old computers off. Old computers, I hear you ask, well how old? Real old. The older two were from an age where the bios didn't yet boot off cdroms -- circa 1995. We had bought those in Kingston just off the Queen's campus. These were respectively a pentium 90 and a pentium 100, which still have traces on the web as miles.econ.queensu.ca (e.g. in a number of Debian changelogs) and rosebud.sps.queensu.ca which was of course Lisa's office machine and for a while the only internet address showing SPS. The next two were purchased around 1999 in Toronto on College St just north of U of T's main St George campus. Those, an AMD k6-2 300 and a Celeron overclocked to 450 MHz (woot :) lived happily in the basement of our Toronto home, forming the first lan I built. If I recall they were initially connected using a crossed ethernet cable and a second nic to the ISP. Oh boy. At least those latter two still boot off Knoppix. And do they ever feel slow. To think now just how many Debian packages I must have built on at least three of these over the years... And each machine must have gotten at least five decent years of usage out of them. One of the second generation computers eventually morphed into the kids play computer but even retired from that a while ago. In any event, it was good to have them recycled, and also good to have been able to do so without paying a fee as is increasingly common. So cheers to Triton. I may be back in a few years as there are still a few computers spread across the house.

So apparently we hit $138/barrel on oil futures on Friday. Reading a CBC Post on the subject I think there are a couple interesting quotes:

Matt Simmons, chairman of an energy financing company in Houston, believes oil prices are still too low. He told CBC News there are "very strong signs" that the global supply of crude oil has leveled out and is probably now in a gentle decline.

Simmons said he finds it interesting that so many people blame speculators and a weak U.S. dollar for rising prices. "These same lame excuses have been going on for the last nine years, since [the price of oil] has gone up 13-fold," he said

I commented earlier that I'm looking forward to $10/litre (The CBC article shows petrol in Montr al at $1.40). A number of commenters brought up economic accessibility - which is a real concern. So, dear lazyweb: I remember seeing once that there were orgs doing carbon offsets by going into low-income areas and doing volunteer work on houses to fix up insulation, replace aging furnaces and major appliances. I haven't been able to find a reference to it again, though. Given that $10/litre seems inevitable (Heya Brits! Any of you still driving cars at ~ 1.15 according to the Daily Mail), what do we do to prepare for it? We got Angie's bike up and running yesterday, and she went to her day's visits that way. I'm finally cleared to ride a bike, but am not yet up to tackling Rengstorff. I'm practicing by biking around the campus at work and getting used to the changes in my body. The biggest disappointment in going back to Vancouver is just the apathy about smog and fuel consumption there. We saw a total of 2 Prius' (Prii?) on the road across the entire 12 days versus a half-dozen Hummers. I remember in the early 90's being downtown and everyone being shocked when there was a bit of brown haze in the air around the Sears Tower (Sorry, I can never remember WTH it's called now). Now the city is not only permanently like that, but people just expect it to get worse without any real feeling that they could do anything about it. I find myself starting to think again about hacking and what differences I can make. It's unexpected but logical that efficiency results in greater consumption: You can afford to do more, and have time to do more. Is the trick, then, to develop something efficient that takes up time? (Should I work on a text adventure?) Or perhaps the answer is to get away from computers for entertainment. Jim Morrison (Phython) and I have been talking about taking up bagpipes as a fun pre-work activity in the field by the office. But now he's moved to the San Francisco office. Anyone else at in Mountain View interested? =)

(Playing Kraftwerk - The Telephone Call.) Warning: This is a long-wound complaint post. The only reason this is going to the Planet is because I have no method yet of disabling individual posts for syndication. Please skip, with my apologees for the noise, if you don’t want to listen to complaining. May contain nuts. May drive you nuts. Drove me nuts. Mmm, pistachio. When I was around 11, I got my first cellphone. I was very proud. This was back when being 11 and having a cellphone was a real novelty; pagers were still being sold, and the NMT network was still running. Like many things I appreciate, I found it in a dumpster. It was ancient, even then: a Motorola MicroTAC brick, missing its antenna. I borrowed one of my grandmother’s hairpins, and voila, working phone - as long as you didn’t leave Oslo. It had a certain cyberpunk look to it, even then: I loved it. I remember that I first bought a NetCom pay-as-you-go card; I don’t quite remember the number, but it had “283″ in it at the end, if you want to wardial. For some reason, Dad needed a SIM card so I gave him mine. So I bought myself a new one, a Telenor card, pay-as-you-go, number 91 85 95 08. I must have been around 12 at the time. And that number served me very well. Fast-forward 6 years, to late March, 2006. I had just turned 18, and one of the first things I wanted to do was get a massively cheaper, proper subscription. I’d been procrastinating it for a bit - as I am wont to - but when a nice gentleman at the subway station told me about a nice new company called SEA Norway and their wonderful prices, I accepted. Big mistake. Here begins the saga of woe… For a good while, I was very happy with their service - even though GPRS data never worked, I never used it anyway. Their name changed to Vitel somewhere along the way. I received a phone call from an enthusiastic salesman who told me how much cheaper Vitel’s power subscription is. It seemed very reasonable, so I went for it. One of the arguments he gave me was that I could collect all those utilities into one bill. I told him that I couldn’t have this: Since I’m a live-alone student, my power bill is covered entirely by the city council, so I need a proper bill to hand over every month. “Sure, that’s no problem”. I check and double-check that, and I stress it. Sure, no problem. OK, deal. Big, big mistake. They draw 2700 Kroner from my account, using the automated pay system (AvtaleGiro) that I had set up for the phone bill. 2700 Kroner (530 US Dollars) is a lot of money, especially when your monthly income, 5000 Kroner (1000 US Dollars) barely covers the necessities. So I cancel the autopay system. (I still have not received that money!) 23rd of January, my subscription is cut, since I hadn’t paid the bill. They hadn’t mailed it to me, and I’d told them I’d cut the AvtaleGiro, but I simply did not receive the bill. So I call them up in February some time and try to figure out a solution. “You didn’t pay the bill, so the subscription is closed.” -”So if I pay the bill, will you reopen it?” -”No, sorry. It is closed now.” -”So then I’ll have to transfer the number to another provider?” -”No, you can’t do that; it’s closed now.” -”You can’t refuse to transfer the number, that’s simply not legal.” -”Sure it is, the subscription’s been closed.” Urgh. So some time in the middle of March, before The Gathering, I call NetCom up: I want to transfer my number to them, please. Sure, no problem. No, this number is registered as active in our system. All is well. We’ll make the switchover on March 28th, and you will get your SIM card in the mail: It should be in your box by then. Fantastic! The 28th of March came and went with no great ceremony, not even a SIM card. No switchover occurred. I give them the benefit of the doubt for more than a fortnight. Some time in April, then, I get sufficiently annoyed to call them up and ask what had happened. “Oh, no, it seems Vitel is using the old transferral system”. -”OK?” -”Yes, you will have to send us a form with your signature by fax to carry this transfer out.” -”Sigh, alright. Where can I get this form?” -”I’ll email it to you.” Great. So I get the form. May was very busy, so I didn’t get an opportunity to fill the form out, and by now I was getting fairly tired of the whole thing anyway! The thing that finally got me, however, was a bill from Vitel - on the “closed” subscription - for not only the monthly fee, but also several kroner of SMS “content services” (Read: ring tones) and GPRS data (Which never even worked even when the subscription did!) So last Tuesday, June 3rd, I send them the damned fax. Wednesday, June 4th, I call NetCom up and ask what the status is of my subscription. “Oh, yes, this is now active with us.” -”Really?!” (I was happy in the way that only someone who’s gone 5 months without a working phone could be.) -”Sure, we’ve sent the SIM card to Bekkeveien (something).” -”…Bekkeveien? But I’ve never lived at any Bekkeveien. My last name is Bekkedal, but..” -”Alright, then that’s probably a mistake. What you can do, though, is go to a NetCom dealer and pick up a new SIM card.” -”Perfect! I’ll do that, then.” (I stress “pick up” for a reason which will later become apparent.) Goodie. I’ll get a working phone! I was very happy as I took the tram down to Aker Brygge and looked everywhere for the damned NetCom dealer. Having finally found it, I happily stride inside and ask for a SIM card for my subscription. “Sure. That’ll be 200 Kroner.” Argh! I hadn’t brought enough money! She did say pick up. Oh well. Aker Brygge is a center of business, I’m sure there are other shops. So I ask to use one of their phones to call NetCom. Sorry, no phones you can use. Sigh. Fine. Do you know of any phone booths around? They didn’t, but I found one anyway, finally. I deposit the necessary $1 for a local call (See, this is the problem with having a cellphone company run the phone booths!) and dial NetCom customer service. They take my number and - Sorry, that number isn’t yet active, it’s still registered to Vitel. ARGH! Fine. So what’s standing in the way? Well, Vitel can’t refuse it - (thanks, I know that already) - but the form that I was sent wasn’t the right form. The form I need to send is from Vitel to Vitel, authorizing the transfer.While I’m trying to hold a conversation with the customer support guy, some drunk guy is accusing me of stealing phones, and begins reading out loud the sponsor company names on the back of my DebConf T-shirt. But Vitel has already told me that I cannot transfer this number, under any circumstance! They consider it closed! “Yes, but you have to talk to Vitel.” -”I have!” -”Well, we can’t really do anything…” Alright. So I hang up and I try to call Vitel. But that doesn’t work: They closed at 3 PM!. So finally tired of Netcom failing to port my number for a while, I call Telenor. I talk to a very cheerful and helpful lady who admits to not knowing about the particulars of that situation. Fantastic! At least she isn’t going to fib it! She says that she has a vacation Thursday, but she can call me back on Friday after discussing the matter with the number transfers department. Wow! She’s actually going to confer with the relevant expertise! This is too good to be true! So she said she’d call me back Friday at 1PM with a status update. As I am writing, it is Friday at 11:01, I am anxiously awaiting the telephone call. But now I get a funny SMS message:

From: NetCom Message from NetCom: Your number has been ordered by another operator. We would like to remind you that violation of the commitment period will be billed to the order of 1500 kroner. For questions, call 05050.

My subscription with Vitel was made in 2006, more than the 12 months I and knowledgeable friends believe to be the maximum legal commitment period (I doubt I would have agreed to more anyway!). Besides, the text message keeps saying that it’s from NetCom. So my deduction is: It’s from NetCom, who I have registered an active subscription and are now complaining that I’ve moved the subscription I’ve opened with them (but which they have not successfully moved from Vitel), over to Telenor. I don’t think this is an unfair conclusion. So I call NetCom customer service - which to NetComs infinite credit is a number you always can call, almost like 112 (technically it’s accomplished completely differently, but you get my point. The number is never blocked in a blocked subscription.) And they say it’s not from NetCom, even though it says it’s from NetCom. So I’ll keep both of my readers posted on the developing situation. At least the text message indicates that something is happening with my subscription. I just want the dialtone!

Regular readers of this blog (ed: oxymoron alert) may recall tales of woe with our beloved (ha!) cable internet provider such as this; then there are of course minor tales like this or this or this or the other stories on on this page but I am probably forgetting others. Anyway, yesterday's highlight was initiated with a mail, seemingly sent to all customers, informing me that

ACTION REQUIRED: Comcast has determined that your computer(s) have been used to send unsolicited email ("spam"), which is generally an indicator of a virus. For your own protection and that of other Comcast customers, we have taken steps to prevent further transmission of spam from your computer(s).

and the email went on to recommend some Windows anti-spam measures, including a reference to a page I could only open with IE at work and one URL to a page that doesn't exist. Nice. Not. Needless to say, there are now Windows computers sending mail (via Comcast) here (as the lone windows box, my wife's work laptop goes straight to her university webmail). And obviously, they blocked port 25, so no more mail sending from home. So I grumpily logged a compaint having been on hold and in telephony menu hell for fifteen or twenty minutes. I was promised to hear back in 72 hours. Hasn't happened yet, naturally, but we're only half way through... Anyway, to make a long story short and this post constructive: Here is what you do on a Debian or Ubuntu system running exim as your mail transport:

• sudo editor /etc/exim4/conf.d/transport/30_exim4-config_remote_smtp_smarthost and add a line port = submission in the remote_smtp_smarthost block (assumming you have the split configuration chosen for the exim4-config package). Setting port to 'submission' switches from plain old STMP to the authenticated version running on port 587; submission is mapped to 587 in /etc/services.
• sudo editor /etc/exim4/passwd.client and add your user and password id as e.g. for comcast web-login
• sudo update-exim4.conf to update the configuration
• sudo /etc/init.d/exim4 restart to restart exim

And it may pay to check /var/log/exim4/mainlog for any irregularities. Barring those, you should now be sending mail to you smarthost using authenticated transfer over port 587. In the meantime, it looks like they unblocked port 25 at some point today...

In May 2002 I had an idea for securing access to GNUPG [1]. What I did was to write SE Linux policy to only permit the gpg program to access the secret key (and other files in ~/.gnupg). This meant that the most trivial ways of stealing the secret key would be prevented. However an attacker could still use gpg to encrypt it’s secret key and write the data to some place that is accessible, for example the command “gpg -c --output /tmp/foo.gpg ~/.gnupg/secring.gpg“. So what we needed was for gpg to either refuse to encrypt such files, or to spawn a child process for accessing such files (which could be granted different access to the filesystem). I filed the Debian bug report 146345 [2] requesting this feature. In March upstream added this feature, the Debian package is currently not built with --enable-selinux-support so this feature isn’t enabled yet, but hopefully it will be soon. Incidentally the feature as currently implemented is not really SE Linux specific, it seems to me that there are many potential situations where it could be useful without SE Linux. For example if you were using one of the path-name based MAC systems (which I dislike - see what my friend Joshua Brindle wrote about them for an explanation [3]) then you could gain some benefits from this. A situation where there is even smaller potential for benefit is in the case of an automated system which runs gpg which could allow an attacker to pass bogus commands to it. When exploiting a shell script it might be easier to specify the wrong file to encrypt than to perform more sophisticated attacks. When the feature in question is enabled the command “gpg -c --output /tmp/foo.gpg ~/.gnupg/secring.gpg” will abort with the following error:
gpg: can’t open /root/.gnupg/secring.gpg’: Operation not permitted
gpg: symmetric encryption of /root/.gnupg/secring.gpg’ failed: file open error Of course the command “gpg --export-secret-keys” will abort with the following error:
gpg: exporting secret keys not allowed
gpg: WARNING: nothing exported Now we need to determine the correct way of exporting secret keys and modifying the GPG configuration. It might be best to allow exporting the secret keys when not running SE Linux (or other supported MAC systems), or when running in permissive mode (as in those situations merely copying the files will work). Although we could have an option in gpg.conf for this for the case where we want to prevent shell-script quoting hacks. For editing the gpg.conf file and exporting the secret keys we could have a program similar in concept to crontab(1) which has PAM support to determine when it should perform it’s actions. Also it seems to me that crontab(1) could do with PAM support (I’ve filed Debian bug report 484743 [4] requesting this). Finally one thing that should be noted is that the targeted policy for SE Linux does not restrict GPG (which runs in the unconfined_t domain). Thus most people who use SE Linux at the moment aren’t getting any benefits from such things. This will change eventually.

• [1] http://www.gnupg.org/


• [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=146345


• [3] http://securityblog.org/brindle/2006/04/19/security-anti-pattern-path-based-access-control/


• [4] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=484743

Share This

So, I’ve been trying to figure out inheritance in Python. In Lisp (and even C++ and Java), derived objects will have the cons of their parent called. For example, look at the following C++ snippet:

#include <iostream>
using namespace std;
class B  
public:
	B()  
		cout << __PRETTY_FUNCTION__ << endl;
	 
 ;
class A : public B  
public:
	A()  
		cout << __PRETTY_FUNCTION__ << endl;
	 
 ;
int
main(int argc, const char **argv)
 
	A *foo = new A();
	delete foo;
	return 0;
 

This outputs the following:

B::B()
A::A()

As you can tell, the parent object’s constructor is called and then your derived object’s constructor is called. But, in this Python code, the parent object’s constructor is not:

class B:
    def __init__(self):
        print "B.__init__(self)"
class A(B):
    def __init__(self):
        print "A.__init__(self)"
A()

This outputs:

A.__init__(self)

Instead you have to do:

class B:
    def __init__(self):
        print "B.__init__(self)"
class A(B):
    def __init__(self):
	B.__init__(self)
        print "A.__init__(self)"
A()

To get the right output:

B.__init__(self)
A.__init__(self)

This seems broken to me. But maybe I’m not understanding something. The way I got bit by this was by trying to design a new replacement to debian/rules which used subclassing. (More on this later.) Oh, and I intend to try to keep my blog updated more often.

Errors were encountered while processing:
 debian-policy
E: Sub-process /usr/bin/dpkg returned an error code (1)

(I haven't looked closer yet, but I had to laugh.)

Today is World Environment Day 2008 and also Recycle Week in the UK. Locally, our poor recycling record has attracted attention. The main Somerset CC area averages 50% recycling and composting, while North Somerset only does 36%. This will cost us money, as explained under the subtly-titled local newspaper article 'REDUCE WASTE NOW OR FACE A 12M FINE' It's very annoying to read a Conservative councillor say

"The message we really have to get out to people is that this is their problem too."

We know it's a bloody problem. Have you tried to use your stupid recycling system? Criticism of the stupid collections is strangely absent from the local Lib-Dem's Mid table place shouldn't be good enough when it comes to recycling (Mike Bell) and I can't even find recycling mentioned on local Labour sites - I think those two groups may have been in coalition when the stupid system was introduced. It's left to local residents to explain the problem. Local waste collections have been simplified recently but it still seems bloody awkward, taking different types of waste to different places. The most recent edition of the council's North Somerset Life magazine explained that they don't collect plastic bottles from the doorstep because it would add 10 per year to our local tax. I'm damn sure it already costs me more than that to store them and ferry them into town over a year. The only people rewarded by saving that 10 seem to be those who live near the town centre collection point, drive to that Tesco anyway, or don't recycle plastics. Why reward them? Speaking of Tesco... those national and local favourites have applied to build Two more Tesco stores for Weston [The Weston Mercury] including one directly opposite another supermarket. The application number is 08/P/1230/F if you want to respond. The planning system seems my main chance to protect my local environment at the moment. Next Monday evening at 7.30pm, 08/P/1070/F - Erection of 5 storey building to provide 14 flats, restaurant and office with basement parking following demolition of restaurant will be considered by a Kewstoke village council planning meeting in the village hall. As I understand it, the public may make statements at the start of the meeting and 2 Kewstoke Road is currently the Castle.

Beh! Looks like it is currently not possible to use debsign from etch to sign packages built in a sid cowbuilder environment. Update: Adam just pointed out that this was already announced on debian-devel-announce. He proposed to get an updated version of devscripts from etch-backports. I wonder if we shouldn’t provide a fixed version of devscripts in etch officially, just in case someone who maintains packages actually *erm* uses it.