... sounds like a joke, but the "certificate in technology management" I got yesterday for completing a two year extracurricular program is supported by eight professors from two of germanys best universities. It's an additional degree to my regular studies, and included courses like "Business Planning", taught by top managers from major communication companies here. I've definitely learned some thing there that will help me later when founding my own company or taking up a job with some management responsibilities.

After my despondant post the other day, Alexander Sack came through again with patches for the Bookmark regression. Please test them! If I don't get any negative feedback I'm sending this on to the security team. Positive feedback is also encouraged, just so I know that people care :)

A few days ago I blogged about liboil being in the way for gst-plugins-base0.10, which itself blocks xine-libs being built, which is needed for gnome to go in, and the old xorg-x11 to go out. Now, we made some fantastic success. Liboil is in testing. However, now we get to more issues: xine-lib FTBFS on sparc with the wonderful error /tmp/ccoqKu6u.s:6222: Error: Illegal operands: There are only 32 f registers; [0-31]. Gotcha. Also, totem now needs also the new version of rhythmnbox in testing - and rhythmbox does not only depend on totem, but also on dbus (0 days), gnome-media (which waits for nautilus-cd-burner, which has itself a bunch of issues open), and the libsexy transition. Let's see how long it takes to sort xorg-x11 out.

Tim Berners-Lee (whose blog has a curiously inconspicuous URL) has weighed in on the net neutrality debate with an entry entitled “Net Neutrality: This is serious.” Tim Berners-Lee seems to be fairly cautious about taking public positions on political issues, so when he does, it’s worth listening. His opinions carry a fair amount of credibility — he is probably the only person who can legitimately start blog entries with phrases like, “When I invented the web…”

When I invented the Web, I didn’t have to ask anyone’s permission. Now, hundreds of millions of people are using it freely. I am worried that that is going end in the USA. … Yes, regulation to keep the Internet open is regulation. And mostly, the Internet thrives on lack of regulation. But some basic values have to be preserved. For example, the market system depends on the rule that you can’t photocopy money. Democracy depends on freedom of speech. Freedom of connection, with any application, to any party, is the fundamental social basis of the Internet, and, now, the society based on it.

The Debian New Maintainer process (NM) is well-known to be strict and tedious. It tests the skills, aptitudes, and attitudes of candidates in a number of areas, including technical, philosophical, and license interpreation. The process keeps the minimum level of competency of new maintainers at a reasonably high level. We have, however, no process for ensuring that old farts don't stink. Take myself for an example. I have been with Debian for over a decade, but I still find new surprises in things that are from the early days. Just recently, I learned about dch, which has existed since 1997 or before. This discover made my life much easier: I had grown tired of updating debian/changelog dates by hand, so they tended to be rather inexact. Now, when I do an upload, the changelog date is no longer a lie. The problem is not that I am incapable of learning, or that I don't want to learn. It's just that I don't, unless I make an effort to do so. Given the small amount of free time I have, I tend to spend it on other things. Most Debian developers probably keep up with most changes to policy, tools, procedures, best practices, and such, without anyone prodding them. However, during the past year and a half, when I've been doing quality assurance work, I've noticed that there seems to be a number of people who don't give any indication of current competence. There's two approaches we can choose from to deal with this. We can educate, or we can re-test. Education means writing documentation, announcing important changes, maybe giving IRC or video tutorials over the Internet, and so on. It is quite a bit of work, but if done properly, it would have quite an impact. Re-testing means putting everyone through NM at regular intervals. Certainly not the entire NM, that would be way too annoying, but a quick slimmed down version would be possible. Something that ensures that every DD still has at least a minimal level of competence, but doesn't take more than an hour or two to do, unless one is a decade out of date. There is of course the problem of what to do with people who fail the test. The simple approach would be to give them, say, two months of time to get up to date, and then they are re-tested, and if that too fails, they're retired. I'm not sure whether we should do either. Perhaps we could try both.

... if only people would use SIP instead. But the new skype beta at least doesn't crash on startup anymore. The previous version needed a wrapper to work with my GNOME:

#!/bin/sh
unset SESSION_MANAGER
exec /usr/bin/skype

The current Linux version number is 1.3.0.30, so way behind the current windows version, though I have no idea which features are missing. I havn't actually made a call with it for a year. From time to time I use it for file transfers, since many Windows users don't have more comfortable applications ready... If you want to try internet telephony, I'd suggest getting a SIP software instead, for example Ekiga. (Windows users might want to try Gizmo). In fact, most DSL modems sold in germany include SIP internet telephony, and you can just hook up your regular analog or ISDN telephone to your DSL modem and use internet telephony. You could call me for free over the internet, and it will ring my regular phone. You can get a german phone number (01212/01213) for free at freephone.web.de among others, or 100 minutes for free to german landlines at iphone.freenet.de. Other providers (e.g. GMX, 1&1) offer telephony flatrates etc.

I just tried to see if I could order a laptop with Dell without Windows. So I went to the Dell Linux page. Which totally sucked. I'm using flashblock (since flash usually sucks), and the Dell Linux page has huge flash movies on them - the regular Dell site doesn't. Why for heavens sake does Dell use Flash on their Linux page? It's not as if Linux users care about their fancy animations. On contrary, some will probably not have Flash installed, or filtered (like me). And some will be annoyed by not being able to copy and paste the product description from that pointless flash. Even more so: all one flash does is display a table. You know, that has been possible in HTML for like ever, absolutely no reason to use flash here. Oh, and their "large text" button doesn't work either. Nor will screenreaders. Nor does google see the text in the flash. The reason you choose Linux is the reason you not choose Dell. To me this is Dell displaying that they have no clue about Linux admins. I still haven't found, what I'm looking for - a lightweight notebook, with a high resolution display, and good battery life (i.e. no nvidia or ATI graphics, preferrably no built-in CD to save weight and size) - best candidates so far: Fujitsu Siemens P7120 and Samsung X11-T2300 Culesa. Sony Vaio VGN-TX2HP/B is interesting, but I still have some reservations against Sony (they try too hard to do tech lockin, e.g. memory stick; and a friend had bad service experiences, their Rootkit, GPL violations with InstantOn...) and it's a bit too tiny for me. [Update: Thinkpad X series is not an option for me, too low screen resolution and according to the specs low battery life; Apple MacBook isn't an option because of their heat and battery issues, and I don't like the hype around it and any other Apple product]

I haven't written about it yet, but we adopted a cat recently. We've (temporarily) fostered a few animals in our time in the US so far, but this time Sarah fell in love, and we had to keep it. Genevieve (aka "Stumpy") came to us as a cat that had been in a car accident, had a broken pelvis, and an amputated tail, and needed a quiet home to recuperate in before going up for adoption. When she first arrived, she'd walk funny, with her back legs splayed out all over the place, and she'd lie on one side rather than sit on her haunches. Aside from this, she was very affectionate, and tried to follow us around everywhere, and purred incessantly. She's improved a lot in the month or so that we've had her (fostering time included). She walks a lot better, her tail stump has healed pretty well, and she's been desexed. It turns out that she was probably pregnant at the time of the car accident, but had miscarried. Anyway, onto the reason for this post. Sarah bought a $10 laser pointer today, and it has been such good value for money. Stumpy's been chasing it all over the place, racing around in circles, climbing the walls, tearing up and down the stairs. It's good exercise for her, and hopefully it's helping her get good use of her back legs (and not aggravating her busted pelvis).

Since Freenode has been compromised my nickserv password might be too. Unless they had the good sense to hash the passwords, which isn’t common. So after checking my 121 line long vim encrypted “accounts” file, I noticed that this particular weak password is used in 17 other systems. Woops. You know what be good? Web standards in regards to user accounts. Now I have to fiddle with umpteen annoyingly different systems to change my password. Pain and suffering. It would be far better is I could do this task with a CLI tool or some handy trusted Web application that would implement such a standard. Though would such a standard make it easier for “crackers” to script attacks to change your password and really screw you over? Actually after thinking about it, the best option would just be to reset the password via email. Though that process can be sniffed… If the cracker tried to change your email address too, the user management system should send you an email to the old address to confirm the change. If the user management system had any doubt, it should just send you email a link to proceed. Btw, I’ve made the move to the OFTC IRC network. I also found lilo’s “money badgering” a bit too annoying.

So apparently last night, Freenode was compromised. Even worse, there’s the potential that passwords were compromised. Freenode’s policy of requiring you to register via Nickserv created a nice policy of forcing people to use passwords for IRC (of all things), which makes this even sadder. Then again, it also finally chased me off that godawful network (which is a good thing).

Last week, I finally becamed annoyed enough by the huge amount of spam I receive, mostly on my @debian.org address. So, I decided that my current anti-spam measures (SpamAssassin running on my home server, which receives all my mail, as well as my laptop, which collects it) are probably not enough. In the same time, I was seeing a few people talking about CRM114 in various occasions. It seemed easy to setup enough for me to try doing somethign with it (I usually give up on stuff that requires too much effort....). Installing it on my laptop was fairly easy, as a Debian package exists for it. Using it through procmail recipes required some documentation reading, but no more than 1 hour. The most important part has been training it. I did so for about one week by feeding undetected spam to it and teach it that it is actually spam...and of course doing the opposite with false positives on ham. One week later, I feel safe enough to actually filter all mails detected by CRM114 as spam to a dedicated mailbox, which I of course will have to investigate once a day to sort out remaining false positives. But now, my incoming mailbox is clean again and it really seems that the time I invested in learning CRM114 and teaching it about spam/ham will very quickly be worth it. In short, just try it: there are chances that you won't regret it. PS: of course, things would probably be better if Debian mail machines were using some measures similar to those finally adopted on Alioth with the help of Pierre Habouzit (RBL+greylisting, IIRC). Old debate in the project....let's hope it will happen some day if nothing I'm unaware of does prevent it.

The german version of the official motto "A time to make friends" is when translated literally "the world for a visit with friends". So far, people have been taking that literally, as far as I can tell. Everybody is a friend here. And there are tons of people at the public viewing places (which are currently being extended, after there were 700.000 people in Berlin's fan mile during the GER-ECU game, and 72.000 in the stadium, not counting all the other viewing places, pubs etc.). There is a cool pun on this motto: Friends for a visit with the world champion. So I made some t-shirts with a free (for making, not ordering...) service. I hope they can ship them in reasonable time (especially before germany loses a game, that is): Now I only have to hope that noone has registered this motto as a trademark. I checked the EU, German and international databases; nothing in there yet.

I'm willing to start a bounty for someone to fix/port/implement the required pieces of GStreamer so that Sound Juicer can rip a whole CD, fully tagged (all tags SJ writes must be correctly encoded), to MPEG4 AAC (as used natively by iTunes). A requirement is that a music player that support MPEG4 files can see the tags without any extra work: the primary test for this will be importing the ripped files into iTunes. I think there are many people out there who would like this to happen, so I want to arrange a group bounty. Bounty County looked promising but I have to specify how much the bounty is up front, I can't just let the fund grow as people donate what they can. The Bounties section on Launchpad has the same limitation. Does anyone know a reputable site for managing donations like this, or should I just get register a new email address on PayPal and get people to donate there? Also to gauge how much interest there is in this, can anyone who would consider donating leave a comment? NP: Vertigo, Groove Armada

[...] listened to the Morning Report for the first time. It seems a better way to [...] channel4radio kept asking me to register, which involves reading reams of legal bull - far too much for a test download. So, I went to channel4.com/news and found the download [...] the Daily Mail Picnic, which is crisp and biting. It also let [continues with links on my site]

I got some bounces today from Nationwide (no doubt spam backscatter), but the interesting thing about them was that they were PGP signed. Some digging reveals that Nationwide seem to sign their outgoing mail, which is nice to see. Further digging fails to find any nationwide.co.uk keys on pgp.net, keyserver.net or pgp.com. Well that's useful, isn't it? They're not the only people who do this - I regularly see posts to mailing lists that are signed but the key isn't available. Why bother signing mails if your public key isn't out there? It doesn't really give the impression you understand why you're signing things.

Typeahead find in gvim’s GTK+ open dialog box is driving me bananas, but today I discovered a trick I hadn’t seen before that will help work around it with a bit of relearning. For those who aren’t familiar with the problem, John Goerzen describes how painful this feature is for large directories. Just imagine, then, having to regularly deal with large directories on particularly slow, remote filesystems. Argh. Unusable! The trick I came up with to work around the problem is to first enter the path incorrectly and then fix it afterwards. Type a blank first, then the whole filepath, then [Home] to return to the beginning of the line, and finally [Delete] to fix the path, and [Enter] to open the file. It still takes an awfully long time for gvim to read the file, but it’s a great improvement over either trying to type the filename blind, or waiting for each directory to be scanned. Ultimately, these files should be moved off the remote filesystem and into subversion, but there are cross-platform compatibility issues that prevent me from doing this at this time (OpenVMS + Linux + win32). I’m still looking for a real solution. In the comments to John’s post, someone suggested there is a gconf setting that controls this, but so far I haven’t been able to find it. So for now, I’ll have to live with this hack.

Today’s news: I’m now a scary biker type person, just like Martin, Michael, David, Bruce, and James along with once and future bikers like Sarah or Pia, but only dreaming of approaching the glory days of the munificent Greg. As of yesterday, my ride is a gorgeous blue 2005-model Honda VTR250, picked up from the dealer with a whole 1km already on the odometer (apparently they rode it to the service station to get some fuel). Read the rest ...

I flooded the Planet just by upgrading WordPress. So this weekend it’s happening in Caracas. The National Free Software Congress (CNSL) arrives to the capital in the second edition of the only nation-wide Free Software event. It will take place on Colegio Universitario de Caracas, in La Floresta, near the Indian Embassy, France Square and other nice landmarks of the city. The event is promoted by GLoVE, a national NGO which is currently organizing the CNSL and hosting several Linux User Groups (the whole list here in spanish, follow the links) including CHASLUG, the Free Software Users Group for the Young. I’m part of the group, but it’s currently run by three guys under 18. As in FLISOL Caracas, this will be a themed event featuring two days of conferences, keynote speakers, workgroups, expositions, installation festival and security related events. The first day is aimed to Free Software in Society, including presentations from government officials related to recent activities towards the Country migration. As Enrico pointed it in debconf-discuss and debian-project, some recent activities have been turning stronger the Free Software migration process in Venezuela. The announcement from the Department of Science and Technology of the mass capacitation of the citizens in the usage of computers featuring the Gnome Desktop Environment took everyone by surprise. Numbers are varying, being the more conservative around 400.000 people having their first computer relationship with Free Software, GNU/Linux and Gnome. Distribution? I haven’t see it yet, but most likely it will be Debian (the whole Department is using Debian) Saturday will also feature some conferences from community members about their experience on Free Software usage and how they can change the way people communicate and act with each other, specially noting the nationwide speech from Octavio Rossell about Free Software and GNU/Linux and the interesting presentation from Efra m M rquez-Arreaza on Business Models. Finally, on saturday, renowned economist Felipe P rez-Mart will be presenting his work Game Theory Applied to the Free Software Development Model. Sunday will be a hands-on day, like in FLISOL Caracas. The main speeches focus on development, featuring experienced programmers on PHP, Perl and Mono presenting Web and Desktop development tendencies in those programming languages. We will also feature an Ajax presentation and three workgroups about Linux Distributions, Web Development and Free Software and Education. On special guests, CNSL Caracas is proud to announce the visit of two fellow partners from IEEE Colombia: Erika Luque and Jeffrey Borb n from the District University of Bogot , and the special conference from Rafael N ez, who was apprehended in Miami, FL (US) for the massive attack of 679 servers in 2001, one of whom was the Air Force Training System in Colorado. He was also accused of attacking the Department of Defense servers and stealing confidential data from NASA. He made seven months of prision in Denver after declaring himself guilty of all charges and having the Judge to look on evidence of his work against child pornography with the Venezuelan CICPC. (more info in spanish) On the security side, Sunday will host the second Key Signing Party (guidelines in spanish here) and the first CACert assurance in Venezuela. We made the first KSP in CNSL Aragua (where I had the opportunity to speak about Debian and make a hands-on session on Marvelous Debian) with about 10 people. This time we’re aiming to something between 25 and 50 people. This is the first event promoting security culture in our Country and hopefully it will have a warm welcome in the public. Caracas will also be the inflexion point of the Congress, which will now travel to the Eastern part of the Country, usually forgotten by all the hacktivists in Venezuela. In states Sucre, Monagas and Bol var people is ready to have their first contact with free software through this Congress and hopefully next year the Congress will have a venue in each state of the Country (including the two most inhabited by natives, Delta Amacura and Amazonas) If you’re in Caracas, you’re welcome to pass by after registering (it’s free as in who cares) and if you’re not, you’re welcome to listen to the streaming that will be announced here. See you there!

The Latin American Free Software Install Party (FLISOL) will take place in 12 countries of the continent, including Cuba, and featuring Argentina and Colombia. In Venezuela, it’s happening in ten cities in several regions of the Country, including Los Andes, Los Llanos, the Central Region and the Paraguan Peninsula. I’m organizing the event in Caracas, which already has a webpage (in spanish) FLISOL will take place on March 25th, a Saturday, but in several cities of Venezuela we will have a two-day event. In Caracas, it will happen on Friday and Saturday. We will feature hands-on workshops and demonstrations (featuring a Debian GNU/Linux hands-on workshop), a Keysigning Party (it won’t be massive, though) and a Web Frameworks and Application Servers Forum, featuring Rails, Catalyst, J2EE, and Zope. I expected David to be in Caracas for the FLISOL, but he’s gonna travel to San Crist bal to participate in their FLISOL. I don’t expect a big attendance to the event (the Auditorium of the Science and Technology Ministry, the main sponsor, has capacity for circa 200 people) but I hope it becomes a fresh event, different from those we’re used to. This will be, also, a good preparation for the World Forum on Free Knowledge, the National Free Software Congress and the DebConf. I hope the main topic on the FLISOL will be the recent, terrible, awful, and completely disgusting Ubuntu security flaw.