So it would seem that the forces of "justice" in Canada might not be above a little shit-stirring to cast their opponents in a bad light. Considering all of the hoo-hah around the security of the upcoming APEC meetings in Sydney, I wonder if the local constabulary has any similar plans? Remember, if you're planning on protesting the senseless waste of money that is APEC, carry your ID at all times, to prove you're a legitimate protester and not a security shill! <grin>

A customer called me a while back, requesting whether I could help him set up asterisk. Since I hadn't previously played with asterisk, we agreed that I'd try out stuff, and then do a demo setup, so that he could decide whether that is okay for his needs. So I bought me a Linksys SPA-3102 ATA (with one FXO and one FXS port) and a Linksys SPA-921 IP phone, and started experimenting. Didn't take me long to figure out that the SPA-921 works, but that if I want to use a company-wide directory (which was a requirement for that customer), I have to use a Linksys proprietary protocol, which Asterisk obviously doesn't support. Someone then told me that Snom's hardware phones have LDAP support in their hardware phones; so I bought me the Snom 300 as well, and played a bit with the system. After experimenting for about two weeks or so, alltogether, I've now got a demo setup that fulfills most of his requirements, and I can show why others can't easily be implemented. Which is cool. Afterwards, I'll be stuck with an ATA and two IP phones that I have no immediate use for at the office, so I was thinking of taking them home and using them there. We've got way too many phones at home anyway (one upstairs, one downstairs, a fax, and a DECT basestation with no less than four handsets), so adding the ability to call eachother might be useful. Except that I can't seem to find a DECT basestation that appeals to me. The one we have doesn't have VoIP, so that'll need replacement. Just connecting it to the ATA could work, but then transferring a call from a regular phone to one of the DECT handsets would be troublesome, at best; what I would prefer is the ability to give each of my DECT handsets a separate asterisk extension; in effect, a DECT - SIP bridge. What I've found so far in DECT basestations that allow me to somehow link the DECT phones to a computer, is appaling.

• At first sight, the most interesting option is the Siemens Gigaset M34 USB, a USB dongle that speaks DECT. Unfortunately, there are no Linux drivers, as far as I could see. So this one is right out.
• There are several manufacturers who sell DECT base stations that speak SIP and/or H.323. Most of those, however, want to be a PBX as well; this gets me the same problem as the one above where transferring a call between a DECT handset and an "other" phone is troublesome. Some of the more expensive ones allow you to have two VoIP connections at the same time (<sarcasm>whoa!</sarcasm>), and I've seen one that allows to configure multiple SIP accounts, but it didn't say whether I could configure a SIP account as belonging to one specific handset -- which is what I'd really need. Most of them also come with at least one non-optional handset, but I'm not looking for more handsets...
• There are also a number of DECT - SIP gateways that are really built for connecting multiple handsets to a VoIP PBX, and are really what I'm looking for. Unfortunately, the prices I've seen suggest that these are only economically viable in case you're working with a large corporate DECT setup, such as the one they use at the hospital where my dad used to work. I don't feel like paying 1100+ for DECT connectivity.

So now basically I'm left to conclude that there is a gap in what's available in DECT basestation products; one that allows me to connect a low number of DECT handsets to a network through SIP, and has nothing more. It'd be cool if one existed...

Battle Tanks is a GPL’ed multiplayer game with original cartoon-like graphics, cool music and inspired in the old arcade games. You can choose one of three vehicles (tank, Shilka, and rocket launcher) to try to eliminate your enemy using the whole arsenal of weapons you have available (four types of ammo, six types of rockets, landing troops, mines and so on). The game supports keyboard as well as a gamepad. There are ten multiplayer maps (seven for deathmatch and three for cooperative mode) in different locations (city, village, forest, desert,…) and a game world that reacts on player. Roads have traffic, buildings can be destroyed, weather effects are simulated, etc. I’m not usually into packaging war games, but I think this is cute enought to make an exception, and in any case I don’t think playing it will hurt anyone, apart from some prides, if they find out they’re not as smart and quick as the enemy. I hope that the game enters Debian repositories soon, but meanwhile you can find some packages for the game already built for SID for i386, powerpc and amd64 architectures (the source for the packages is here).

I just ran into a rather funny problem. I’d like to use epiphany to open text/html attachments or mail parts. Mutt uses mailcap, so I added an entry in ~/.mailcap:
text/html; epiphany-browser '%s'; description=HTML Text; nametemplate=%s.html This should work fine, but the problem is that mutt creates a temporary file (/tmp/mutt.html) and removes it when the command terminates, which is nearly immediately with epiphany. And epiphany has a really nice feature: it monitors local files for changes and reload them when they change. Which results in seeing the page briefly, then a File "/tmp/mutt.html" not found. error page. Anyone using mutt and epiphany together successfully?

I was playing with loop unrolling, and decided to investigate it a little. The basis is this very simple program which looks like it could do with some loop unrolling. Firstly, lets have a look at what happens to the function when -funroll-loops is applied. Below is the de-compilation with some comments on what each line is doing.

Non-optimised nop.m 0x0 r14=0 mov r14=r0 save the "loop counter" mov.i r2=ar.lc nop.m 0x0 one less than iterations movl r15=0x176fffff;; nop.m 0x0 initalise loop counter mov.i ar.lc=r15 nop.i 0x0;; loop: *buf = i, buf++ st4 [r32]=r14,4 i++ adds r14=1,r14 dec lc, branch if > 0 br.cloop.sptk.few .loop nop.m 0x0 restore loop counter mov.i ar.lc=r2

Loop unrolled nop.m 0x0 r26 = 0 mov r26=r0 save lc mov.i r2=ar.lc nop.m 0x0 iter / 32 movl r14=0x2edffff;; nop.m 0x0 setup loop counter mov.i ar.lc=r14 nop.i 0x0 loop: r3 = buf mov r3=r32 r8 = 1 adds r8=1,r26 r25 = 3 adds r25=3,r26 r23 = buf[3] adds r23=12,r32 r24 = 4 adds r24=4,r26 r22 = buf[4] adds r22=16,r32;; buf[0] = 0; r3=buf+1 st4 [r3]=r26,4 r21 = 5 adds r21=5,r26 r19 = buf[5] adds r19=20,r32 r20 = 6 adds r20=6,r26 r18 = buf[6] adds r18=24,r32 r16 = 7 adds r16=7,r26;; nop.m 0x0 buf[1] = 1, r3=buf+2 st4 [r3]=r8,4 r15 = buf[7] adds r15=28,r32 r17 = 2 adds r17=1,r8 r26 += 8 adds r26=8,r26 buf += 8 (for next iter) adds r32=32,r32;; buf[2] = 2 st4 [r3]=r17 buf[3] = 3 st4 [r23]=r25 nop.i 0x0 buf[4] = 4 st4 [r22]=r24 buf[5] = 5 st4 [r19]=r21 nop.i 0x0 buf[6] = 6 st4 [r18]=r20 buf[7] = 7 st4 [r15]=r16 loop, dec branch br.cloop.sptk.few .loop nop.m 0x0 restore lc mov.i ar.lc=r2 br.ret.sptk.many b0;;

We can see that in the first case the loop counter is setup to run 393216000 times (e.g. 1500*1024*1024/sizeof(int)) and a very simple loop of storing the value and incrementing is undertaken. In the second version, the code becomes more complex. We can see the loop now executes 49152000 times (e.g. 1500*1024*1024/sizeof(int)/8) so we can infer that for each loop iteration, 8 values have been unrolled to be written into our buf array. Indeed, when pulled apart we can see the 8 stores (numbers just reflect the first time through). So, is it faster? Yes! Great. We can suggest a number of reasons why, but it would be interesting to get some hard statistics on why this is so. Thanks to the Itanium performance counters, we can. Firstly, lets start by seeing how cycles are being spent. Now, the Itanium can issue up to six instructions (IA64_INST_RETIRED_THIS) in two bundles of three instructions per cycle (CPU_CYCLES). However, you can't have dependencies between registers within a 3-instruction bundle (and branches and interruptions play havoc) so sometimes you need to pad with no-ops (this is why you need a good compiler). We can work out some figures from this, namely the useful instructions per cycle (e.g. instructions retired - nop instructions / cycles).

Test	Useful instructions/cycle
loop	1179995250 - 104431 / 547923609 = 2.15
unroll	1327451286 - 147560435 / 311570590 = 3.78

This tells us that for each given cycle, the unrolled-loop version is doing more work (ideally we'd like that to be a the theoretical maximum of 6). So what is the unrolled version doing for all this time? Bubbles are where the CPU is waiting for something; a prime candidate is moving data from caches to registers. Bubbles make up (154285534/547823609) 28% of the cycles on the loop version, but only (16088889/311570590) 5% of the time for the unrolled version. This means the processor is spending a lot less time waiting for things to happen with the unrolled loop version. We can drill down further to see what bubbles are occurring. We are now breaking the stalls down to see where they are occuring. L1D_FPU_BUBBLES are essentially related to micro-architectural issues with the caches; things like the L1D cache being overwhelmend and interactions with the hardware page-table walker. BE_EXE bubbles are more simply described a waiting for data to come from caches (or even main memory) to registers. BE_RSE bubbles are related to the register stack engine, and "front end" bubbles (BACK_END_BUBBLE_FE) are where there are not enough instructions coming from the "front-end" for the "back-end" to issue out to functional units in the processor. In this case, the major cause of problems for the simple loop seems to be not being able to get enough instructions through to keep the processor busy. We can try to pin down what is happening in the front-end: What we can see here is that the increased code size of the unrolled version causes us a lot more i-cache misses, as expected. However, the problem for the unrolled version seems to be the time spent by the front-end dealing with the branch. This is not surprising since there is a rumor that there is a front-end buffer which fills up after 3 repeated cycles with branch instructions; apparently this is a problem addressed in the new Montecito chips (if anyone has one, I'll update this if you send me the numbers). Since we are doing 393216000 branches all within a single bundle its not surprising we've hit it! Just to confirm, we can break-down the BE_EXE bubbles. Remember, BE_EXE bubbles are caused by stalls in the execution phase primarily due to cache latencies or inter-register dependencies. Looking at our code, we don't re-use the same register over-and-over so we would not expect to spend a long time waiting for registers, and indeed this is what we see. Therefore in this case, the speed increase isn't coming from better cache behaviour as we might have expected, but greater ability to keep the processor busy with instructions between branches. We can also examine the major events happening with the unrolled case. Here we see BE_L1D_FPU bubbles being the major overhead. On Itanium floating-point avoids the L1 cache (it is too big, and not re-used enough to make it useful) hence the concatenation of the event acronym. These bubbles can be broken down into the following events (measured in two runs, since you can only do 4 at a time). These events expose micro-architectural details, the full extent of which is only gleaned by reading the processor manuals (a PhD in computer architecture probably helps too!). The store buffers are not an issue here -- the caches are more than able to keep up with our few writes. The TLB is also not involved; we have pretty good TLB coverage thanks to the virtual-linear page table and hardware page-table walker. The two clues are DCURECIR and L2BPRESS. Essentially DCURECIR happens when references have to "re-circulate"; this is a side-effect of the data not being available. The L2BPRESS figure suggests why this is so; this event happens when the L2 cache can not handle any more requests. The L2 cache keeps a queue of outstanding requests; when this queue is full (for example, full of long latency requests to get data from main memory) the L2 cache causes "back-pressure" which stops the L1 cache from issuing new requests. This suggests the program is chewing through a lot of data and not using the cache very effectively, which is exactly what we are doing. Pre-fetching hints can help (but as described in a previous entry on hacking Enigma may not always help), but in this case there probably isn't any spare bandwidth to pre-fetch in because essentially no processing is happening. What does all this mean? I don't know, but playing with performance monitors is fun!

I’ve been thinking about music videos recently while compiling a list of my favourite videos of all time. It seems that YouTube has changed things through the re-mixes of videos and the ability of anyone to publish for a mass-market (although without the possibility of directly making money from it). Also today all new PCs (and most PCs that are in use) are capable of being used for video editing and the compute power needed for 80’s and 90’s quality special effects is also commonly available (in most cases good art doesn’t need more technical quality than that). So anyone can produce videos (and a quick search of YouTube reveals that many people are producing videos for their favourite songs). I think that we need a music video for the Free Software Song. One possibility is to base it on the 1984 Apple advert (because it’s the free software community that is opposing Big Brother not Apple). I think it would be good to have multiple versions of the Free Software Song (with matching videos), there could be the version for young children, the Hip-Hop version, the Punk version, etc. Also I think that there is potential for the creation of other songs for the free software community. One possible way of doing this would be to have a contest for producing music and videos. Maybe a conference such as LCA or OLS could have the judging for such a contest. I would be prepared to donate some money towards the prize pool and I’m sure that other individuals and organisations would also be prepared to do so. If I get some positive feedback on this idea I’ll investigate how to run such a contest. Here are my favourite videos of the moment. Please let me know of any videos that you think I would like based on this list.

• Placebo:
  
  • 
    Infra-Red - I love the Haxor ants (I Lied to You - We Are the Enemy says the CEO), I first saw that idea in the book City by Clifford D. Simak’s
  
  
  • A Song to Say Goodbye - strange and sad. Like much good art it can be interpreted in several ways.
  
  
  • Pure Morning - strange video that seems to have nothing to do with the music, but still good
  
  
  • Slave to the Wage - interesting and not strange by Placebo standards. I’ve recently decided that I don’t like working in a corporate environment so I can relate to this.
  
  

Smashing Pumpkins:
Ava Adore, interesting way of changing scenes, and a very artistic and strange video (matches the song)

Duran Duran (who incidentally named their group after a character in Barbarella: Queen of the Galaxy - strangely the spelling is different though):

• Come Undone, interesting aquarium scenes

Too Much Information - they should re-do this and include a reference to the Internet in the lyrics. ;)

Wild Boys - Mad Max 3 as a film clip

UNKLE:

• Eye for an Eye - strange and disturbing, as any serious art that is related to war must be

Rabbit in Your Headlights - surprising end, I wonder if anyone was injured trying to emulate this clip

Nine Inch Nails:
Head Like a Hole, strange and a bit bizarre at times. Not the greatest of my favourite clips but the music makes up for it.

Queen:

• I Want to Break Free, strangely amusing and very artistic

Chemical Brothers:

• Let Forever Be - my favourite clip of all time. Fractally weird, you can watch it dozens of times and still be missing things.

Setting Sun - the world would be a better place if more cops could dance like that! Also is it just me or does the drummer guy look like a Narn from Babylon 5?

Out of Control - surprise ending. I would appreciate it if someone who knows the non-English language (probably Spanish) in the clip could point me to a translation.

Star Guitar - a real work of art but no plot and I didn’t enjoy the music, I recommend watching it once

The Golden Path - I used to wonder whether office work was really so grim in the 60s and 70s, but then I worked for a financial company recently…

Fat Boy Slim:
Praise You - why can’t reality TV be this good?

Falco:
Rock Me Amadeus - let’s represent two totally diffent cultures (bikers and Austraian high society) in a film clip, silly but amusing

Madonna:
Like A Prayer - I wonder how many racist organizations banned that

A-Ha:
Take On Me - mixing multiple art forms (in this case film and animation) can work really well. Beat Kill Bill to the idea by a couple of decades.

Robert Palmer:
Simply Irresistable - pity that they didn’t hire more women who can dance or at least put the dancers in front of the models. It’s interesting to note that one of the models appears to be actually playing a guitar.

Garbage:

• MegaTokyo and Temptation Waits mash-up.


• Push It - one of the strangest videos I’ve seen

Michael Jackson:
Billie Jean - class is timeless.

Share This

I just had a hard time finding this excellent procmail resource on the web. I am thus blogging it for posterity, in case anyone is looking for procmail documentation, tips, tricks, a how-to, or anything else related to procmail. And if you procmail and have not read the document, I suggest you do. It's truly outstanding. NP: A Silver Mt. Zion: He Has Left us Alone, but Shafts of Light Sometimes Grace the Corner of our Rooms

Recently someone asked on IRC whether they should use SE Linux on a web server machine (that is being used for no other purpose) and then went on to add “since the webserver is installed as root anyway“. If a machine is used to run a single non-root application then the potential benefits of using SE Linux are significantly reduced, the issue will be whether the application could exploit a setuid program to gain root access if SE Linux was not there to prevent it. The interesting point in this case is that the user notes that the webserver runs as root. It was not made clear whether the entire service ran as root or whether the parent ran as root while child processes ran as a different UID (a typical Apache configuration). In the case where the child processes run as non-root it is still potentially possible for a bug in Apache to be used to exploit the parent process and assume it’s privileges. So it’s reasonable to consider that SE Linux will protect the integrity of the base OS from a web server running as root - even for the most basic configuration (without cgi-bin scripts). If a root owned process that is confined by SE Linux is compromised then as long as there is no kernel vulnerability the base OS should keep it’s integrity and the sys-admin should be able to login and discover what happened. If the web server is more complex and runs cgi-bin scripts then there is a further benefit for system integrity in that a cgi-bin script could be compromised but the main Apache process (which runs in a different domain) would run without interruption. When a daemon that runs as non-root is cracked on a non-SE system it will have the ability to execute setuid programs - some of which may have exploitable bugs. Also on a non-SE system every daemon has unrestricted network access in a typical configuration (there is a Net Filter module to control access by UID and GID, but it is very rarely used and won’t work in the case of multiple programs running with the same UID/GID). With SE Linux a non-root daemon will usually have no access to run setuid programs (and if it can run them it will be without a domain transition so they gain no extra privileges). Also SE Linux permits controls over which network ports an application may talk to. So the ability of a compromised server process to attack other programs is significantly reduced on a SE Linux system. In summary the more complex your installation is and the more privileges that are required by various server processes the more potential there is to increase the security of your system by using SE Linux. But even on a simple server running only a single daemon as non-root there is potential for SE Linux to provide real benefits to system security.

Share This

Roger Binkley, leader of Sun's Mobile and Embedded community, interviewed me after my talk at OSCON. It went ok, given how tired I was: http://today.java.net/pub/a/today/2007/08/20/javamobility-podcast16.html

All the version control systems I am familiar with run scripts on checkout and commit to take additional site specific actions, and arch is no different. Well, actually, arch is perhaps different in the sense that arch runs a script on almost all actions, namely, ~/.arch-params/hook script. Enough information is passed in to make this mechanism one of the most flexible I have had the pleasure to work with. In my hook script, I do the following things:

• On a commit, or an initial import
  • For my publicly replicated repositories (and only for my public repositories), the script creates a full source tree in the repository for every 20th commit. This can speed up subsequent calls to get for that and subsequent revisions, since users do not have to get the base version and all patches.
  • For the public repositories, the script removes older cached versions, keeping two cached versions in place. I assume there is not much demand for versions more than 40 patches out of date; and so having to download a few extra patches in that uncommon case is not a big issue.
  • If it is an ikiwiki commit, the script makes sure that it updates the checked out sources of the wiki on the webserver, and rebuilds the wiki.
  • If this is a commit to an archive for which I have a corresponding -MIRROR defined, the script updates the mirror now, and logs an informational message to the screen.
  • There is special handling for my Debian packages.
    • If the category matches one of my packages, the script looks to see if any bugs have been closed in this commit, and, if so, sends the log to the bug, and tags it fixed.
    • If the category being checked in is one that corresponds to one of my Debian packages, or to the ./debian directory that belongs to one of my packages, then the script sends a cleaned up change log by mail to the packages.qa.debian.org. People can subscribe to the mailing list setup for each package to get commit logs, if they so desire.
    • Arch has the concept of a grab file, and people can get all the components of a software package by just feeding arch either the grab file (either locally, or via a http URL). The script makes sure that a arch config file is created , as well as a grab file (using the script arch_create_config), and uploads the grab file to to a public location (using the script arch_upload_grab) mentioned in ./debian/control for all my packages.
    • For commits to the Debian policy package, the script also sends mail to the policy list with full commit logs. This is a group maintained package, so changes to this are disseminated slightly more volubly.
    • Whenever a new category, branch, or version is added to the repository corresponding to the Debian policy package, the script sends mail to the policy list. Again, changes to the Policy repository are fairly visible.
  • The scripts send myself mail, for archival purposes, whenever a new category or branch is created in any of my repositories (but not for every revision).
  • Additional action is taken to ensure that versions are cached in the local revision library. I am no longer sure if this is strictly needed.

I d be happy to hear about what other people add to their commit scripts, to see if I have missed out on anything.

One problem with the blog space is that there is a lot of negativity. Many people seem to think that if they don’t like a blog post then the thing to do is to write a post complaining about it - or even worse a complaint that lacks specific details to such an extent that the subject of the complaint would be unable to change their writing in response. The absolute worst thing to do is to post a complaint in a forum that the blog author is unlikely to read - which would be a pointless whinge that benefits no-one. Of course an alternate way for the recipient to takeg such complaints as suggested by Paul Graham is “you’re on the right track when people complain that you’re unqualified, or that you’ve done something inappropriate” and “if they’re driven to such empty forms of complaint, that means you’ve probably done something good” (Paul was talking about writing essays not blogs, but I’m pretty sure that he intended it to apply to blogs too). If you want to actually get a blog author (or probably any author) to make a change in their material in response to your comments then trying to avoid empty complaints is a good idea. Another useful point Paul makes in the same essay is ““Inappropriate” is the null criticism. It’s merely the adjective form of “I don’t like it.”” - something that’s worth considering given the common criticism of particular blog content as being “inappropriate” for an aggregation feed that is syndicating it. Before criticising blog posts you should consider that badly written criticism may result in more of whatever it is that you object to. If you find some specific objective problem in the content or presentation of a blog the first thing to do is to determine the correct way of notifying the author. I believe that it’s a good idea for the author to have an about page which either has a mailto URL or a web form for sending feedback, I have a mailto on my about page - (here’s the link). Another possible method of contact is a comment on a blog post, if it’s an issue for multiple posts on the blog then writing a comment on the most recent post will do (unless of course it’s a comment about the comment system being broken). For those who are new to blogging, the blog author has full control over what happens to comments. If they decide that your comment about the blog color scheme doesn’t belong on a post about C programming then they can respond to the comment in the way that they think best (making a change or not and maybe sending you an email about it) and then delete the comment if they wish. If there is an issue that occurs on multiple blogs then a good option is to write a post about the general concept as I did in the case of column width in blogs where I wrote about one blog as an example of a problem that affects many blogs. I also described how I fixed my own blog in this regard (in sufficient detail to allow others to do the same). Note that most blogs have some degree of support for Linkback so any time you link to someone else’s blog post they will usually get notified in some way. On my blog I have a page for future posts where I invite comments from readers as to what I plan to write about next. Someone who prefers that I not write about topic A could write a comment requesting that I write about topic B instead. Wordpress supports pages as a separate type of item to posts. A post is a dated entry while pages are not sorted in date order and in most themes are displayed prominently on the front page (mine are displayed at the top). I suggest that other bloggers consider doing something comparable. One thing I considered is running a wiki page for the future posts. One of the problems with a wiki page is that I would need to maintain my own private list which is separate, while a page with comments allows only me to edit the page in response to comments and then use the page as my own to-do list. I may experiment with such a wiki page at some future time. One possibility that might be worth considering is a wiki for post requests for any blog that is syndicated by a Planet. For example a wiki related to Planet Debian might request a post about running Debian on the latest SPARC systems, the first blogger to write a post on this topic could then remove the entry from the wish-list (maybe adding the URL to a list of satisfied requests). If the person who made the original request wanted a more detailed post covering some specific area they could then add such a request to the wish-list page. If I get positive feedback on this idea I’ll create the wiki pages and add a few requests for articles that would interest me to start it up. Finally to encourage the production of content that you enjoy reading I suggest publicly thanking people who write posts that you consider to be particularly good. One way of thanking people is to cite their posts in articles on your own blog (taking care to include a link to at least one page to increase their Technorati rank) or web site. Another is to include a periodic (I suggest monthly at most) links post that contains URLs of blog posts you like along with brief descriptions of the content. If you really like a post then thank the author by not only giving a links with a description (to encourage other people to read it) but also describe why you think it’s a great post. Also if recommending a blog make sure you give a feed URL so that anyone who wants to subscribe can do it as easily as possible (particularly for the blogs with a bad HTML layout). Here are some recent blog posts that I particularly liked:

• Security Anti-Pattern: Path based access control from Joshua Brindle (feed). A fairly strong criticism of path based access control (as used in AppArmor). I’d have written something about this myself but Joshua did it so well that there’s no need. His post about Status Quo Encapsulation is also a good read. It’s a pity that Joshua doesn’t write more than two posts a month.


• Federico’s post about concrete for housing. Some technical data and some good pictures. (feed)


• Tim Connor’s blog posts about Australian politics (feed), particularly this post about interest rates (especially his latest comment). It’s a pity that Livejournal seems to offer no good options for searching and the comment in question has broken links. I would be happy to offer advice if Tim wanted to switch to a self-hosted Wordpress installation (as would some other bloggers who are members of our local LUG).

Here are some blogs that I read regularly:

• Problogger (feed), I don’t think that I’ll be a full-time blogger in the forseeable future, but his posts have lots of good ideas for anyone who wants to blog effectively. I particulaly appreciate the short posts with simple suggestions.


• Mega Tokyo (feed) - A manga comic on the web. The amusing portrayal of computer gaming fanatics will probably remind most people in the computer industry of some of their friends.


• Defence and the National Interest (feed). The most interesting part of this (and the only reason I regularly read it) is the blog of William S. Lind (titled On War. William writes some very insightful posts about military strategy and tactics but some things about politics will offend most people who aren’t white Christian conservatives.
  
  It’s a pity that there is not a more traditional blog feed for the data, the individual archives contain all posts and there seems to be no possibility of viewing the posts for the last month (for people who read it regularly in a browser and don’t use an RSS feed) and no search functionality built in.


• WorseThanFailure.com (was TheDailyWTF.com) (feed) subtitled Curious Perversions in Information Technology. Many amusing anecdotes that illustrate how IT projects can go wrong. This is useful for education, amusement, and as a threat (if you do THAT then we could submit to WorseThanFailure.com).


• XKCD - a stick-figure web comic, often criticised for the drawing quality by people who just don’t get it, some people read comics for amusement and insightful commentry not drawings. It’s yet another example of content beating presentation when there’s a level playing field.

Finally I don’t read it myself, but CuteOverload.com is a good site to refer people to when they claim that the Internet is too nasty for children - the Internet has lots of pictures of cute animals!

Share This

Normally I don't like them, because the people using them write non-portable code. In some cases however (mostly when writing stuff other people would write in perl), I'd like things like __attribute__((mode(QI))) to work, and not claim that while the compiler perfectly well understood what I was trying to do, it can nonetheless not help me around writing my own support for 128 bit types. At least MSVC is no better, __int128 has the exact same behaviour. Bleh.

A little bit ago I blogged about how I was using Remember The Milk in order to get some things done around the house and to remind me about stuff that I want to do. Things have been going pretty well on that account, I have been using it to great effect for basically everything that I need to do outside of things that I need to get done at Honeywell (I keep a separate todo list for there). However, when using it these past weeks, I have noticed a few things that I wish it would have or things that could be improved upon, I think in a big way.

I think the twitter interface should have some enhancements. For example, it is impossible currently to mark off an item that repeats through twitter, because you always have more than one of them on your list. I would love to do this with daily tasks so that I can mark them off as soon as I finish them with a few button presses on my cell phone. Also it would be nice to be able to add things to lists and not just the INBOX through twitter. Possibly another command starting with '!' that takes a keyword.

Remember the milk has as a major component the map of locations that items in a list can be placed at. There are a couple improvements that I would like in this area. The first is to have multiple locations that are all just as valid in order to complete the task. Remembering the Milk (the actual task) is a great example. There are literally hundreds of places that I could get milk, and two or three of them that I use regularly, depending on which one I am driving by at the moment. If you could place these three markets in a group of some sort, then they could all be associated with the item and you could see it on your mobile or however you're viewing the map.

The other map improvement is fairly simple - offer to give me directions from one place to another. I don't know how to drive to a random location I've just put in because it is where I need to drop my car or pick someone up or whatever, and a small link to a google maps directions would be nice. Even just a link to google maps (where I could then click on the "directions from..." link) would be a big improvement.

The last improvement that would be nice is to be able to click on the URL or visit the site in the URL field for tasks in some way. Currently the URL field is pretty useless as a URL, because there is no way to click it and actually visit the site. If I click on it, the editing field pops up and I have to do all the hard work myself of cutting and pasting the URL into the location field. It's also a mis-cue because the URL looks like a link before I click it, just like I could click on it as I want to. A keyboard shortcut for visiting the site would be nice as well since I do use the keyboard interface quite a bit.

These improvements I think would make a big difference to RTM users. The map improvements alone would be a big upgrade in my opinion. As for now, I will continue to use RTM whether these are implemented or not - it's a good way to keep an online list in any case. It's kept me writing blog posts at the rate of about once every two days. Not sure if that's a good thing or not yet..

One situation that you will occasionally encounter when running a Heartbeat cluster is a need to prevent a STONITH of a node. As documented in my previous post about testing STONITH the ability to STONITH nodes is very important in an operating cluster. However when the sys-admin is performing maintenance on the system or programmers are working on a development or test system it can be rather annoying. One example of where STONITH is undesired is when upgrading packages of software related to the cluster services. If during a package upgrade the data files and programs related to the OCF script are not synchronised (EG you have two programs that interact and upgrading one requires upgrading the other) at the moment that the status operation is run then an error may occur which may trigger a STONITH. Another possibility is that if using small systems for testing or development (EG running a cluster under Xen with minimal RAM assigned to each node) then a package upgrade may cause the system to thrash which might then cause a timeout of the status scripts (a problem I encounter when upgrading my Xen test instances that have 64M of RAM). If a STONITH occurs during the process of a package upgrade then you are likely to have consistency problems with the OS due to RPM and DPKG not correctly calling fsync(), this can cause the OCF scripts to always fail to run the status command which can cause an infinite loop of the cluster nodes in question being STONITHed. Incidentally the best way to test for this (given the problems of a STONITH sometimes losing log data) is to boot the node in question without Heartbeat running and then run the OCF status commands manually (I previously documented three ways of doing this). Of course the ideal (and recommended) way of solving this problem is to migrate all services from a node using the crm_resource program. But in a test or development situation you may forget to migrate all services or simply forget to run the migration before the package upgrade starts. In that case the best thing to do is to be able to remove the ability to call STONITH . For my testing I use Xen and have the nodes ssh to the Dom0 to call STONITH, so all I have to do to remove the STONITH ability is to stop the ssh daemon on the Dom0. For a more serious test network (EG using IPMI or an equivalent technology to perform a hardware STONITH as well as ssh for OS level STONITH on a private network) a viable option might be to shut down the switch port used for such operations - shutting down switch ports is not a nice thing to do, but to allow you to continue work on a development environment without hassle it’s a reasonable hack. When choosing your method of STONITH it’s probably worth considering what the possibilities are for temporarily disabling it - preferably without having to walk to the server room.

Share This

As many readers of this blog know, I tend not to shy away from writing about my mother s struggle with Alzheimers. But in the last 6 months and especially since I paid my last visit to my mother, I have found it much harder to sit and write about her current state of affairs. If we think of Alzheimers as a journey to a new place, she is almost at the point of reaching that place of great loneliness and inhospitality, which is not only new and different both for her and those around her but is a virtual prison, for it rarely allows you to leave and visit the places of your past. More than ever, her memory and understanding of her life as she (as I and many others), once knew it, is fading fast; Of course, this was to be expected but it is quite difficult to imagine what it will be like until the actual experience unmistakably knocks on the door of present time and unfortunately, when it knocks, you can t do anything but open the door and let it in. Unsurprisingly, it is incredibly difficult to witness and interact with a person who is losing most all recollections, the stuff of which, you come to realize, is what defines a person and allows you to more or less have the opportunity to seamlessly interact with him or her. In the last number of months, I have perhaps been more silent than usual because there is only so much I can and want to think about when it comes to my mother s decline. I talk to her nearly every day and I have decided for now, that is enough. But I am retreating out of my silence after reading a refreshingly honest, though still somewhat timid piece on Alzheimer in the NYTimes, entitled Zen and the Art of Coping With Alzheimer s
The piece is striking because it offers a more realistic portrayal of the disease than most mainstream media accounts and it provides some really sound advice about the importance of just letting go and going with the flow when interacting with those with Alzheimers. At the same time, it lacks a certain window into just how disheartening and hard it can be to witness the decline, and how hard it can be to manage those conversations and interactions. On the whole, I try to go with the flow. For example, I recently returned from a visit and soon after I left, my mother forgot I was even there. She started to ask me over and over again when I was coming home for a visit and when I told her I was just there, her semi-humorous reaction was well, why didn t anyone tell me? (and then proceeded to castigate her caretaker for not telling her!!). Perhaps I did not stay long enough, or perhaps her lack of recall would happen no matter what. To hear she forgot shook me hard and deeply. The first time I realized she could not remember I had just visited, I was able to jog her memory by listing off all that we did together. Finally, when I mentioned that I bought a new refrigerator while in PR, something clicked. She is still worried about money, so buying a refrigerator was enough to remind her I had spent a lot of money. But after it was clear that she felt quite bad about not remembering, I knew that was the first and last time I would try to jog her memory. Instead, I will merge and mold my reality to her reality, as much as I can and assure her that I will soon visit.
(more…)

NDR are broadcasting the Hamburg Classic in DVB (digital) and PAL (analogue) at 19 east at 11-14 GMT today, while ARD at 19 east and 13 east overlaps at 12.30-15.00 GMT, presumably including the closing stages. Notably, this race has excluded Tour de France winner Contador, apparently as well as everyone else even mentioned in connection with the Fuentes affair. Yesterday's last stages of the Burgos and the Deutschland-Tour seemed surprisingly unsurprising, with Juan Mauricio Soler and Jens Voigt kept their respective leads.

Growing up in Eugene, Oregon, which like Berkeley or Boulder could have the label "People's Republic of" applied to it, I always thought of "business friendly", as something along the lines of helping huge corporations avoid laws against pollution, or other antisocial behavior. Only after moving to Europe did I begin to get an idea of what the very positive side of "business friendly" is in the US. Truth be told, all countries tend to protect their 'big players' to some degree, be it the US propping up creaking airlines after September 11th, Italy finding various clever ways to get around rules about funding Fiat and Alitalia, or France finding it in their 'national interests' to discourage a potential bid for Danone (yogurt!) by PepsiCo. Some are better or worse (the UK has been pretty good about not interfering), but there is a tendency to want to intervene. Leaving be the discussion over whether those sorts of policies are good, bad, or ugly, the biggest difference between continental Europe and the US is the ease with which new companies - 'startups' can be created and enter a market. As a first hand example, I decided this summer to create DedaSys as a real company in order to better separate my business and personal financial dealings. Were I to do that in Italy or Austria, we would be talking about fees upwards of 3000 Euros (about 4000 dollars at market rates), which is a great deal of money for something that is not making a lot of it at this point in time. Contrast this with what it took to create a Limited Liability Company (LLC) in Oregon, my home state. To have things done up professionally, it's certainly possible to lay down a bit of cash there too, but by trading my time for money, and with the assistance of some nolo.com books about the creation and maintenance of an LLC, I was able to register DedaSys with the state of Oregon for the grand total of 55 dollars, and was actually able to complete the process remotely from Austria prior to going home on vacation, where I did the only thing I needed to do in person: open a bank account. So it costs 1% of what it costs in Italy or Austria to open a company that provides limited liability... a very impressive difference, especially to a small, new company that does not have the connections a Ford or a Fiat will likely have to enable it to deal with all the other paperwork, rules, and regulations to deal with. Add to that a culture of greater risk taking (meaning also more acceptance of failure), better funding opportunities, and... one comes to the conclusion that Paul Graham is right. It's a pity, because the people in Europe are top notch. In Italy alone, I know a bunch of really bright hackers. Granted, some of them aren't interested, and are probably better off not starting a company or otherwise dealing with the business side of the equation, but it's always nice to have that opportunity. In closing, here is another example of bureaucracy in action, from my personal on line journal about life in Italy, and now Austria, which I recently revamped by moving it to the Typo platform: Confronting the bureaucratic beast - registering an Italian domain Two months to accomplish what can be done in ten minutes with a .com!

Joey complains about users filing aggressive or otherwise inappropriate bug reports. Well, in this case I must say I bit the bullet.
Yesterday, somebody complained about the maintenance statuse of libapache2-mod-perl2. Usually, I would have sadly nodded and said that, yes, since the API change between mod_perl for Apache 1.x and mod_perl2 for Apache 2.x (which was a long time ago - with perfect timing not to be accepted in the last weeks of Sarge's hard-freeze period, causing many of us to have to maintain two or even three versions of our code depending on the API used - But that's a different story I won't go into details now). But this time, the bug report was sent with Severity: critical.
I replied to this report, intending just to lower its priority and get the attention of the maintainers by sending it to a couple of Debian lists - But soon afterwards, it became obvious that I was probably the person most interested in this package in Debian - At least, me and some other pkg-perl fellows who -as foolishly as myself- volunteered to step forward when needed.
Well, in short: I am now the proud owner of one of the packages most vital for many of the systems I've written for my work. It's also more complex than most of the other packages I maintain. From an undermaintained and quite full of warnings build process and resulting package set, I managed to make it linda- and lintian- clean, and... Well, now we have to dig through its open bugs. Its build system is far from orthodox from a Perl point of view, and that took me most of the day, but hey - TIMTOWTDI, right? :)

As the new version of Gnash (0.8.1) is probably going to be released in some weeks, I decided it was time to make some newer packages available. I’ve done a lot of changes on them, first of all I’ve removed all the library packages, as they don’t seem to make a lot of sense right now. There is still no gnash-dev package and will probably not be at least for a while. I’ve also made available different options of the program, right now one compiled with GTK+ and AGG, and another one with KDE and OpenGL. I might add newer ones in the future. I’m not really sure if those packages, or this approach, will end up in Debian’s repository yet, anyway, due to some reasons I cannot say here, but in any case it’s the first release of packages of Gnash I’m proud of, so I thought someone might be interested.

Something I often hear from people that talk about Linux on the desktop is this: people want to be able to go to the store, buy hardware, and be confident that it will Just Work.

I would like to point out that things are rarely this simple on Windows. And, in fact, things are often simpler on Linux these days.

Here's the example that prompted this post.

I have a computer that's about 4 years old. It's my main desktop machine at home. It was still fast enough for me, but has been developing all sorts of weird behaviors. Certain USB ports stopped working altogether a few months ago. Then it started hanging during POST whenever I'd try to reboot -- but would still boot OK about 80% of the time after a power cycle. Then it started randomly losing contact with my USB mouse until a reboot. And the last straw was when the display started randomly going out. I've told everyone that my machine has cancer and is slowly dying.

The case is a pretty nice full tower -- solid and sturdy. I have an 160GB IDE drive in it. So I figured I will upgrade the motherboard, CPU, RAM, and add a 500GB SATA drive since they're so cheap these days and I'm running out of space. I'd also have to buy a new video card since my old one was AGP and the new motherboard only has PCI Express for video. So about $700 later from Newegg (I got a Core 2 Duo E6750), the parts arrived.

I spent some time installing it all. The motherboard had only one IDE channel, and I didn't have any IDE cable long enough to connect both the IDE hard disk and the optical drive, so I popped in an old Maxtor/Promise PCI Ultra133 controller I had sitting around to use with the DVD burner.

Now, to recap, the hardware that the OS would see as new/different is: CPU, RAM, IDE controller, SATA controller, Promise IDE controller, integrated NIC, sound, video.

Then the magic smoke test.

I turned on the machine. Grub appeared. Linux started booting.

Even though I had switched from the default Debian "supports everything" kernel to a K7 kernel, it still booted.

And every single piece of hardware was supported immediately. There was no "add new hardware" wizard that popped up, no "I've found new hardware" boxes. It just worked, silently, with no need to tell me anything or have me click on anything.

Only one piece required configuration: the NIC, thanks to some udev design flaws (it got renamed from eth0 to eth1 by udev). That took 20 seconds. Debian saw the IDE HDD, the SATA drive, the Promise controller, the DVD burner, the video card, the sound, and it all worked automatically. And Debian is not even a distro that occurs to a lot of people when they think of great hardware support.

Now let's turn to Windows.

The Windows Nightmare

I have a legal copy of Windows XP Home that was preinstalled on the machine when I got it. I resized its partition down to about 20GB so that I could use 140GB for Linux. I use it rarely, primarily for gaming, and I've bought about 3 games in the last 4 years. I usually disconnect the network when I boot to Windows, though I do keep it current with updates.

I did some research on what Windows was going to do when I replace the hardware. The general consensus from people on the 'net is that you can't just replace a motherboard and expect everything to be happy. There were generally three different approaches suggested: 1) don't even try, just reinstall; 2) do a rescue install after you move over; and 3) use sysprep. The rescue install has to be done by booting from an XP install CD, then picking a rescue install option somewhere. It will overwrite your installed Windows with the version from the CD. That means that I'd have to re-apply SP2, though bits of it that didn't get overwritten would still be on the hard disk, and who knows what would happen to the registry.

Option #3 was to download sysprep (must have the Genuine Disadvantage ActiveX to get the free download from MS). Sysprep is designed to be used just prior to taking an image with ghost for replication. It removes the hardware-specific config (but not the drivers), as well as the product key, from the machine, but otherwise leaves it untouched. On the next boot, you get the "Welcome to XP" wizard.

One other strike against #2 is that Compaq "helpfully" didn't ship any install CDs with the machine. Under Windows, they did have a "create rescue CD" tool, which burned 7 CDs for me. But they are full Compaq-specific CDs, not one of them an XP CD, *AND* they check on boot to see if you're using the same Compaq motherboard, and exit if not. Highly useless.

So I went with sysprep. Before my new hardware even arrived, I downloaded the Windows drivers for all of it. I burned them to a CD, and installed as many as I could on the system in advance. About half of them refused to install since the new hardware wasn't there yet. I then took a raw image of the partition with dd, just in case. Finally, right before I swapped the hardware, I ran sysprep and let it shut down the machine.

So after the new hardware was installed came the adventure.

Windows booted to the "welcome to XP" thingy. The video, keyboard, mouse, and IDE HDD worked. That's about it.

I went through the "welcome to XP wizard". But the network didn't work yet, so I couldn't activate it. So I popped my handy driver CD in the drive. But what's this? Windows doesn't recognize the DVD drive because it doesn't have drivers for this Promise controller that came out in, what, 2001? Sigh. Downloaded the drivers with the imac, copy them to a CF card, plug the USB CF reader into Windows.

While I was doing that, about 6 "found new hardware" dialogs got queued up. Not one of them could actually find a driver for my hardware, but that didn't prevent Windows from making me click through them all.

So, install Promise driver from CF card, reboot. Click through new hardware dialogs again. Install network driver, reboot, click through dialogs. Install sound driver. Install Intel "chipset" driver, click through dialogs. Reboot. Install SATA driver. Reboot.

So the hardware appears to all be working by this point, though I have a Creative volume control (from the old hardware) and a Realtek one in the tray. Minor annoyance to deal with later.

Now I have to re-activate XP. I dutifully key in the magic string from the sticker on my case. Surprise surprise, the Internet-based activation fails because my hardware is different. So I have to call the 800 number. I have to read in 7 blocks of 6 digits, one block at a time. Then I answer some questions: have I activated Windows before, have I changed hardware, was the old hardware defective (yes, yes, and yes). Then I get 7 blocks of 6 digits read to me. Finally Windows is activated. PHEW! Why they couldn't ask those questions with the online tool is beyond me.

Anyhow. Linux took me 20 seconds to get working. Windows, about 2 hours, plus another 2 hours for prep and research.

I did zero prep for Linux. I made one config change (GUI users could have just configured their machine to use eth1).

Other cool Linux HW features

Say you buy a new printer and want to get it set up. On Windows, you insert the CD, let it install 200MB of print drivers plus ads plus crap plus add something to your taskbar plus who knows what else. Probably reboot. Then the printer might actually print.

On Debian, you plug in the printer to the USB port. You type printconf. 5 seconds later, your printer works.

I have been unpleasantly surprised lately by just how difficult hardware support in Windows really is, especially since everyone keeps saying how good it is. It's not good. Debian's is better, in my opinion.