I'm in the EVA Air Evergreen Lounge at the Taipei Airport. I got bumped up to first class again for no apparent reason -- they were going to stick me in a middle seat in economy, and I squawked, and the next thing I know I've got a first-class ticket and pass to the lounge. Cool. This has been a crazy week. As I mentioned before, we announced Wikitravel Press at Wikimania 2007. That was great: we even got mentioned in the China Times about it. The transliteration of my name in Chinese? : that's "Bulazhuomu" or cloth-Latin-eminent-wetnurse. (Thanks for the translation, Jani.) But my main focus of the conference was my talk -- Talks/Wikimania2007. I talked about Enhancing wiki with social networking tools -- by which I mean social software. We'd done a decent job with this with Wikitravel Extra, but I've been working on a new project called Keiki with some friends, and we decided it was the right time to demo the tool for people. So it was a lot of hacking and negotiating over IRC right up until the talk to get things right for our first debut. Per the Keiki About page: Keiki is a project to create a free, complete and reliable parenting guide covering all stages of development, from conception to college. It is written by people who care about kids and want them to thrive: parents, grandparents, and teachers and parenting professionals. The manual we create together is available under a liberal copyleft license to make it easy for people to get and share the guide. Keiki means "child" in Hawaiian. Since wiki is also a borrowed Hawaiian word, we thought it was a good fit. The project itself is the fruition of several years of work by myself and Maj and people we've met and like in the wiki world. When Wikitravel became my full-time work, we were just getting used to being new parents, and our needs for buying travel guides was far outweighed by our needs for good parenting books. Talking to other parents, we found out that there was a lot of great information out there, but it was hard to get in one place. So kei.ki was born: a source for great child-raising information, free as in freedom. I hope the site becomes as important as it should be: after all, we're creating the Free training manual for the hardest job there's ever been. tags: keiki wiki parenting wikimania2007

On Wikipedia Weekly I lucked out and got interviewed on the awesome podcast Wikipedia Weekly, too. Their http://wikipediaweekly.org/2007/08/05/interview-with-wikitravels-evan-prodromou/[ Interview with WikiTravel s Evan Prodromou] is pretty good. I'm pretty happy with it. tags: wikipediaweekly wiki wikitravel keiki

Many people think that white-box machines (IE the cheapest no-nam PCs you can buy) are suitable for use as servers. There are several factors that make white-box machines totally unsuitable for use as a server (and IMHO unsuitable for any other task). Firstly white-box machines are not designed. A set of parts are designed, some combinations of parts are tested, but most aren’t. For example a motherboard manufacturer will test their latest motherboard design with the current video cards and a video card manufacturer will test their new cardss with current motherboards. If you have a new video card and a new motherboard then there has probably been little testing of the combination. This compares to a name-brand machine where the entire unit has been tested and found to work together. White-box assemblers (they aren’t “designed” or “manufactured”) will often use different combinations of parts for each machine that they assemble. If a video card manufacturer sells two cards with the same part number that have different chips then they may be installed in two machines with the same description. So taking an image of one white-box machine and installing it on another that was described as being identical might not work. For these reasons I have ceased using white-box machines as desktop machines or as low-end servers (EG internet gateway machines). I use second-hand name-brand machines for low end servers and for desktop machines. When comparing servers the case for name-brand systems is even stronger. Real servers have ECC RAM as a standard feature, it is possible to get white-box servers with ECC RAM - I have seen such a machine on one occasion. But the vast majority of white-box machines lack such features. See my previous posts about getting ECC RAM in a cheap machine and desktop machines with ECC RAM about some of the issues in this regard. Another feature of servers is better storage options. There are white-box server machines with hot-swap hard drives, but they are significantly more expensive than regular white-box machines - if you are going to spend that much money then it’s better to get a refurbished HP server machine at auction (HP seems to be selling a lot of almost-new server gear at auction at quite reasonable prices with warrantee). A cheap machine (typical white-box or a very low end server from a company such as HP) will have hard drives that don’t support hot-swap. Lack of hot-swap means that a hard drive failure requires that the machine be disassembled to swap the dead disk - it also means that there is sometimes difficulty in identifying which disk has the problem (the error light on a hot-swap drive is quite handy). Then the process of swapping the disk will take at least 10 minutes of hardware work before the machine can be booted up again. With hot-swap disks you can identify the failed disk via a flashing light, remove it while the server is still running, and then initiate a RAID rebuild after installing the new disk. Hot-swap disks cost more and the mounting brackets etc are also expensive, but it’s a good option to have - especially considering that disks are more likely to fail at busy times which is when down-time is least acceptable. These features make disk expansion particularly expensive for servers, people often miss the benefits of servers and say “I just bought a 3000G disk for my home PC for $2, why can’t you just do the same for the server” (I am exaggerating slightly). Another advantage of name-brand servers is remote access. There have been a variety of remote access cards that you could install in a white-box PC and also a variety of devices to digitise a VGA signal for remote KVM access, but they are all rather expensive and remove the price advantage of white-box hardware. A final benefit of name-brand hardware is that you will be running the same hardware as other people. If I was to experience a problem running Linux on a HP DL380 G4 server then I can enter that text in to Google and get many hits. If I was to experience a similar problem with a white-box machine then I would need to perform searches on each of the parts that might have a problem - which would be particularly inconvenient if I couldn’t determine some of the part numbers through software and needed to disassemble the machine first!

Share This

Now for the real world applications. While internationalizing some programs with gettext, I found that some of them tend to use global defined variables for handling the menus (for example fluid, or hex-a-hop), usually defining some lists of structures globally, with the texts directly written on them. Something like:

const char *lines[] =  
"Line 1n",
"Line 2n",
NULL
 ;

In this case we have a problem, because if we just replace the strings by _(”string”), it won’t directly work. Remember that _ is a macro for the function gettext. In C, it just won’t let us call it from the constructor, because the string should have to be assigned statically. In C++ it will let us, but the resulting program will happen to call gettext() on them before our initialization in main(), and thus it will simply not work. I’ve made available an example on how those situations could be handled both in C and C++.

The winner is Pierre "Madcoder" Habouzit who first mentioned (Enrico Zini came a little bit later) xbacklight which works perfectly with the i915 card in my Dell X1 and can even fade the screen brightness to values I couldn't reach with the Dell's buttons. Once, again, Keith Packard save my life (my Watts in that case). He already did so with xrandr, allowing to easily play with screen output on the very same Dell and have nice ways to do my talks. That X.org and XSF team really rock!

Today, I made my first steps using the collab-maint repository on Alioth. I accidentally noticed that one of my packages, namely calife (a sudo-like utility which I use since more than 10 years and developed by Ollivier Robert, one of my very very very old friends in the FLOSS world), got a new release at the beginning of July. That was a good occasion to move calife package's maintenance to Alioth and then learn about collab-maint. Thanks to the pretty good documentation, this has been done "en un tournemain" and, that upload had then two benefits: a new calife and my first package in collab-maint. It's now probably time to move there some of my packages, the first being my pet package, geneweb (who has its own project on Alioth, which i certainly overkill). Thanks, again, to Alioth admins for that very efficient work.

I received a private email in response to my post about getting work in another country regarding hotel prices in London. The person who sent me the message had considered London but ended up moving to Japan instead partly due to living expenses (although Japan seems unlikely to be much cheaper). The first issue concerns security of hotels. When living in hotels (for almost a year in London and about 6 months in the Netherlands there were a few occasions (IE one brief occasion every 4+ months) when I left my laptop under my bed at a hotel, but almost all the time I took it with me. At that time I aimed to have a minimal set of luggage, one large suitcase containing clothes, books, etc (things that are generally not worth stealing) and one small case containing my laptop, digital camera, passport, and other small things that are valuable or which would cause excessive inconvenience if I lost them. Also in the small case I would take fragile items. Then when leaving my hotel I would pack most of the items from the small suitcase (pretty much everything apart from the digital camera) into my laptop bag and take it with me. This limited my losses from hotel thieves to a digital camera (no incriminating pictures and I could always buy a better one) and a couple of bottles of liquor. Good hotels have a hotel safe which you can use. But for a cheap (affordable) hotel there is no such option. Hotels in London ARE expensive, but if you are prepared to lower you standard of living they aren’t too expensive. One thing to note about UK hotels is that the idea of having a toilet and shower in every room is a new concept and all the cheaper hotels lack this. It’s a standard feature for a hotel to have a wash-basin in every room, a toilet is optional, and a bath or shower is another option. There are various types of shared bathroom in UK hotels. The better ones vaguely resemble the facilities you might expect to find at a public swimming pool (large spaces, clean tiles everywhere, and a changing area in addition to the toilet and shower cubicles). The worst ones are basically what you might expect to see in a private home but with less cleaning. To get the best deals on small hotels in London you have to find an area where there are many hotels and inspect them. It is quite acceptable to ask for the key to a room so that you can inspect it and determine if you want to rent it. One area where I lived for some time in London is near Victoria Station. Victoria is one of the largest stations in London, it has both a Tube (underground/metro for trains within the city) and a British Rail (for travel to other parts of the country) station. Victoria Station also had facilities for checking in to a flight and having your checked luggage delivered to Gatwick airport via the Gatwick Express. This was really convenient, you can check your luggage and then do some last minute shopping before going to the airport! I’m not sure if they still do this though (comments appreciated). Another good thing about Victoria Station is the large shopping area which included a tourist information centre and a store that sold freshly baked bread. Often in the morning I would buy bread from the section that had the most steam coming from it (which was the most freshly baked) before catching a train. Victoria Station is quite near many of the places you want to visit in London so I could walk to the British Museum and other places that are worth visiting (this depends on how fit you are). But the real reason for staying there is that the were many cheap hotels in the area. I could just walk down a street and know that I could find a room at one of the hotels. One feature of UK hotels is that they almost always include free breakfast as part of the deal (with no option to exclude it). Of course this means that if you are capable of eating a significant breakfast and then skipping lunch then you can save some money. A down-side to cheap hotels is that they almost never have a telephone in your room (just a pay phone in the hall), and if they do have a telephone then it will be wired in. Before wireless net access became common this was a problem as you couldn’t use a modem. More expensive hotels had an extra socket for a modem. In London there is a significant number of people who stay in hotels from Sunday night to Thursday night with their company paying (so they don’t stay in the cheap hotels). This means that most of the good hotels have cheap rooms on the weekend. So while living in London I would often stay at a good hotel on the weekend to get net access (and a few days in a luxury hotel at a cheap rate is a good change from a cheap hotel). Nowadays wireless net access is common so it would be easy to find a free access point anywhere in London and there would be no need for this. But the possibility of getting cheap hotel rooms on the weekend is something to keep in mind. One benefit of this was when I had an employer paying for my hotel bills from Sunday night to Thursday night (as part of a deal to placate my colleagues who complained about working at the other side of London). I spoke to the hotel manager and suggested that having me check out every Friday and have the room empty on the weekend was not good for them and that they should offer me a significant discount to stay 7 days a week - they made me a good deal! At that time I had the lowest cost of living apart from when I lived with my parents while the hotel in which I stayed was quite comfortable (a large comfortable room with toilet and shower and a good hotel breakfast). Moving to the Netherlands was quite easy for me as I was staying in hotels. All I had to do was to pack my suitcase, check out of the hotel, and catch the flight. One significant advantage of living in hotels is that you can easily move to another region or country. This gives the possibility of taking advantage of career opportunities that would not be possible if you owned a house and would be difficult if you rented an apartment. When in the Netherlands I ended up staying in hotels of the Bastion chain (a chain or franchise of business hotels). I stayed in a couple of other hotels first and wasn’t particularly happy but with Bastion hotels I was always happy. I arranged a deal of a small discount in exchange for not getting the breakfast that was normally included (I like to sleep in and the Dutch breakfast didn’t appeal to me). One significant benefit of the Bastion hotels over London hotels was the size. The smallest room had two single beds, a large Dutch-style bathroom, two chairs at a desk that spanned about 3M of a wall (with multiple power sockets and a phone socket), and a good TV. At the time the hotel would play two movies over the TV system every night from video cassette. The videos played on the TV in the restaurant and in the rooms (if you selected the appropriate channel). Once I became known to the staff they would do nice things such as playing the movie I requested (instead of the scheduled one) and pausing the movie when I finished dinner so I didn’t miss anything while walking to my room. Also instead of giving me a free newspaper every day (in Dutch) they gave me some free drinks vouchers every week. Once you become a regular customer at a hotel the staff are always willing to change the deal to make you happy - even when it’s a chain. One of the convenient factors of living in a business hotel is that they are located near business areas. I spent several months living in a Bastion hotel that was about 400M walk from the office where I worked. That was particularly convenient when the network broke at night - I could just walk back to the office to fix it! The deal I had with the Bastion hotels made them about 50% more expensive than the (fairly luxurious) two bedroom apartment that I later moved to. So hotels are expensive and living in them is only an option if your employer pays for it or if you work in an industry where pay is reasonably good. Given that the vast majority of people who read my blog work in the computer industry (and I suspect that they are better paid than average) this should be a viable option.

Share This

So, depending on who you talk to, we've got about 9 weeks to go, or maybe 8 weeks. It all depends on whether we can have our way and have a caesarean on the 8th of October. Of course, the baby may have other thoughts on the matter as well... We've had our last planned house guest until Sarah's Mum and Aunty arrive, so we've put the mattress in storage and donated the bed frame to Goodwill. We've acquired a crib (I keep wanting to call it a cot) and a changing table/chest of drawers and put them in place in the baby's room. Last night we bought a car seat. I think the only major item left to get is a stroller. Sarah's pregnancy is still going well. The baby's still extremely active, and has had the hiccups quite a few times in the last week. Apparently that's him trying to breathe. I'm somewhat surprised they don't drown in there trying to do that... Speaking of breathing, our overly cautious obstetrician wanted Sarah to have two shots of steroids, to aid in the baby's lung development "just in case" he was born (or had to be delivered) very early. We felt it was somewhat unnecessary, but thought we'd be kicking ourselves if something happened and we didn't do it. There didn't seem to be any outrageous adverse effects from doing so, so we went along with it. Twice in a week (the second time today) Sarah's had blurry vision followed by a headache, so she called up the hospital today when it happened, and they told her to come in and get checked out. We spent about 4 hours in labor and delivery this afternoon. It turns out the reason they wanted us to come in was because the symptoms could be a sign of preeclampsia. The tests proved otherwise, and they couldn't really offer an explanation for what was going on other than migraines, so they eventually sent us home again. It was nice to get a preview of hospital's labor and delivery ward.

Last thursday and friday, I spent around eleven hours in the InterCity Express (ICE) of Deutsche Bahn. I was online, using Simyo GPRS, during this entire time. Thanks to the cellular network repeaters in ICE’s coach 3 and 23, this has worked reasonably well and has cost me EUR 5,27 - in a tariff with no basic charge and no commitment. I really like that, because this usage of the mobile cellular network would have cost about fifty times more just a year ago. Thanks, Simyo, E Plus and the other E Plus resellers who have made the first step to reducing the cost of mobile Internet in Germany. A few technical notes:

• The repeaters in the ICE coaches do only repeat GSM and thus GPRS, but not UMTS. It is advised to lock the UMTS card to GPRS when using Internet from inside the ICE, since the card will otherwise move back and forth between UMTS and GPRS millions of times, which will always result in more than just a few seconds outage. It is much better to live with GPRS’ abysmally large latency.
• I took the opportunity to empty my still-active, old, GPRS only, Simyo SIM which still holds like fifteen Euros. I suspect that I’ll need two more trips of this magnitude to successfully get rid of the amount on that prepaid card.
• I need an external antenna for my UMTS card - it worked really really bad in my mom’s apartment right in the middle of Hamburg.
• There seem to be a number of independent issues in Debian sid (the reason why I am blogging this in English): The connection occasionally hangs (a couple of times an hour) and does not come back by itself. Often, poff/pon is enough, but sometimes it is necessary to pull the UMTS card (an Option 3G PC-Card Datacard) and to re-insert it since there was no answer any more on ttyUSB0. Very annoying.
• The Option 3G Datacard behaves differently depending on the SIM that is inserted. With my older, GPRS-only Simyo SIM, the response to AT+CPIN? is “SIM PUK2” after sending the PIN to the card, while it is “SIM PIN2” in the same situation with the newer UMTS-enabled Simyo SIM.
• chat(8) sucks badly, because it doesn’t seem to elegantly handle this case - no regexps, no if/then, every command sent needs to generate exactly one answer from the card, everything else is an error after timeout.
• When I do this more often, one of the now available flat rates (or, for starters, a 5 GB commitment tariff) for like 20 Euros becomes attractive.

This afternoon we had a Debian meeting in Melbourne (Australia) arranged through the Debian-Melb mailing list. We met under the clocks at Flinders St station, had lunch at a good Japanese restaurant, decided not to play LASER games (like paintball but with LASER guns instead of paint guns) due to the queue. The LASER games are at the Crown Casino, some people object to it on principle, but when you only use free tickets… One noteworthy thing about the casino is that they have a free cloak-room that stores bags (back-packs etc are not allowed on the gaming floor). I expect their cloak-room to be a little more secure than most places that you might stash your stuff (they have a reputation for security to uphold) so I felt safe leaving a back-pack containing a laptop in their care (it didn’t have any secret data and was a really old one). After leaving the casino we had Gelati/Gelato ice-cream (Gelati is the plural of Gelato and either word may be used to describe Italian style ice-cream). The general plan for the next meeting is to meet in the city at about 10AM on a weekend, play the LASER games, and then have lunch. Of course that would make it a greater requirement for people to arrive on time. ;) While at the meeting we discussed in concept the idea of a Bug Squashing Party (BSP). I can get a free venue for up to 12 people outside business hours which is not far from the center of Melbourne and which has good net access and a good supply of keyboards, monitors, and other misc computer bits (even possibly some PCs that can have their hard drives temporarily replaced to test Debian stuff). One guy who is rather keen on this idea asked if it would be possible to bring sleeping-bags and sleep on the floor. I hesitate to ask the guy who owns the office about that, it might make him reject the idea entirely. So probably starting at about 10AM and going to 10PM would be enough. We could do that both Saturday and Sunday on some weekend or maybe even start on Friday night. I’ve been planning to run a similar meeting to play Linux games which may end up as a games hacking party. I might get around to running that soon.

Share This

Julien's blog entry and some spare time lead me to try this powertop utility which I never heard about before. As a consequence, I ended up tine tuning a few parameters on my laptop, mostly sound card and wireless card energy saving parameters. I also finally turned "noatime" ON on my mounted partitions when the laptop runs on battery (I use laptop-mode for such automation). I was prevented to do so util now because mutt relies on access times to define whether mailboxes got new mail or not. However, recent mutt version now have "set check_mbox_size" which make mutt rely on the mailboxes sizes I still have fine tuning to do, mostly trying to get my hard disk really spin down in some occasions (mail reading, mostly) as well as automate the screen brightness, but this powertop utility is really worth it in the hunt for wasted energy. And, of course, installing it is just a matter of "aptitude install powertop", thanks to Patrick Winnertz who packages it. And thanks to Julien who blogged about Powertop, even for ranting about it...:-)

Anyway, back to pure Linux stuff. A while ago, the Ubuntu Technical Board were asked to take a look at Automatix. I've finally got around to doing so, and here are my initial conclusions. I'd appreciate any factual corrections, and note that at this point this is my individual opinion rather than any sort of official statement.

Automatix is a combination system configuration/package installation
tool, aimed at making it easy for users to install features like
graphics drivers, media codecs and software not distributed as part of
the Ubuntu distribution. It is provided as a .deb file containing a
python GUI frontend that calls out to a shell backend. The frontend
parses an XML file which contains module descriptions and function
names for installing and uninstalling modules, with these functions
being part of the shell backend. An install module will typically
check whether another package manager is running, and if not either
install a set of debs or download and manually install a
tarball. Uninstall modules generally remove the same software or clean
up the manually installed files.

The following is a list of identified issues with the current version
of Automatix - it is the result of a few hours of investigation, so
may not be complete.

• Automatix is, in itself, a poor quality package which fails to
  conform to Debian or Ubuntu policy.
  
  
  • It is inappropriately flagged as belonging to base
    
  • Depends on essential packages
    
  • Has a short description of more than 80 characters and no long
    description
    
  • Provides no email address in the maintainer field
    
  • Contains no copyright information in the standard locations
    
  • Ships a TODO file as a control file
    
  • Provides no man pages
    
  • Ships files in /usr/etc
    
  • Contains many files inappropriately flagged as executable
    
  • Changelog is in /usr/etc/automatix2/ax_data ?
  
  These issues are primarily cosmetic and in themselves are unlikely to
  cause any harm to the system.
  
• In debug mode, automatix will write files to your home directory as
  root. Again, more of an irritation than anything dangerous.
  
• Provides platform-specific data in /usr/share. Potentially an issue
  if /usr/share is shared between multiple architectures, but since
  Automatix is x86/amd64 only probably not a real problem.
  

• #!/bin/bash
  #created by arnieboy 
  foo= gksudo -u root -k -m "enter your password for gedit root access" /bin/echo "Do you have root access?" 
  sudo gedit $NAUTILUS_SCRIPT_SELECTED_URIS

  appears to be an attempt to ensure that the user has sudo rights. This
  will break if timestamp_timeout is set to 0 in sudoers - gedit should
  be run directly from gksudo. This is repeated in more than one
  place. The assumption that sudo will not need to prompt appears
  prevalent throughout the code.
  
• catagory_data.xml - nitpick, but should be category
  
• "Please NOTE that downloading and installing w32codecs, libdvdcss2
  and other non-free codecs without paying a fee to the concerned
  authorities constitutes a CRIME in the United States of America"
  
  Somewhat dubious legal advice - the issue has nothing to do with fees,
  and isn't just limited to the USA.
  
• Automatix checks that other package managers aren't running at
  startup (by grepping for a static list of application names in the
  proces list), but doesn't enforce this by carrying out any locking of
  its own. This leaves Automatix open to race conditions.
  

• if ps -U root -u root u   grep "dpkg"   grep -v grep;
     then
       killall -9 dpkg

  May well leave the system in an inconsistent and unbootable state, and
  is carried out without warning. This is entirely unacceptable and will
  leave a stale lockfile in any case.
  

• function reloadnautilus  
         killall -9 nautilus
   

  Not actually used anywhere, but could potentially lose user
  information without warning.
  
• Most install functions contain a sleep statement for no obvious
  reason. They then call dpkg_check, which sleeps again. It's not at all
  clear what this is meant to be doing.
  
• Passes --assume-yes to apt-get, which will (as a result) happily
  remove packages without giving the user an opportunity to
  intervene. This is especially bad when removing Automatix modules -
  any package that depends on one of the packages being removed will
  also be uninstalled, even if the package was originally installed via
  something other than Automatix!
  
• Has no internal dependency management. Unable to keep track of why
  packages were installed, so prevents the removal of the multimedia
  module because that would remove sections of other modules without
  explicitly removing that module. Installing swiftfoxplugins will pull
  in several plugin packages, but removing swiftfoxplugins will not
  remove them even if nothing else depends on them. Also means that
  package installation and uninstallation have to be manually kept in
  sync - uninstall will not always remove all packages that were
  installed.
  
• Has no concept of file tracking, so will just remove entire
  directories. Makes no attempt to ensure that a user-installed version
  is not already installed in the same location, so effectively assumes
  that the /opt namespace belongs to it.
  
• Will remove Ubuntu repository packages in favour of tarballs with
  no warning.
  
• Setting ctrl-alt-del to open gnome system monitor will destroy any
  existing user configuration for run_command_9
  
• Installing streamtuner will create a world writable directory in
  /opt/ripped with no sticky bit, allowing users to interfere with other
  users' files.
  
• mplayerplugin moves totem plugin files to a backup, but does
  nothing to prevent package upgrades of totem replacing them.
  
• Only updates the java link after installing new java, not the rest
  of the java alternatives
  
• amsninstall installs tls libs that are never removed, copying over
  the ones in the tcltls package. This means that the md5sums in the
  tcltls package will no longer validate.
  

• sudo ln -s /usr/lib/libesd.so.0 /usr/lib/libesd.so.1

  is really not
  such a good idea.
  

• ln -s /tmp/.esd-1000 /tmp/.esd

  looks like it'll only ever work for
  the first user on the system, and there's nothing to recreate it on
  boot.
  

• sudo sed -i "s/^vboxusers\(.*\):$/vboxusers\1:$AXUSER/" /etc/group

  - assumes that the system isn't using some sort of user directory
  service.
  
• installs truecrypt suid root - not ideal, given its less than
  stellar security record
  
• Unmounts filesystems without checking to ensure that the unmount
  succeeded.
  
• Deletes lines from fstab and replaces them with device nodes
  rather than uuids.
  
• Includes acroread 7.0.9, despite the new Acrobat license appearing
  to grant no right to redistribute.

Conclusion:

Automatix exists to satisfy a genuine need, and further work should be
carried out to determine whether these user requirements can be
satisfied within the distribution as a whole. However, in its current
form Automatix is actively dangerous to systems - ranging from damage
to small items of user configuration, through removing user-installed
packages without adequate prompting or warning and up to the (small
but existing) potential to leave a system in an unbootable state.

The current design of Automatix precludes any reasonable way to fix
some of these problems. It is attempting to fulfil the role of a
high-level package manager without actually handling any sort of
dependency resolution itself.

A more reasonable method of integrating Automatix's functionality into
Ubuntu would be for the Automatix team to provide deb files to act as
installers for the software currently provided. These could then be
installed through the existing package manager interfaces. This would
solve many of the above problems while still providing the same level
of functionality.

In its current form Automatix is unsupportable, and a mechanism for
flagging bugs from machines with Automatix installed may provide a
valuable aid for determining whether issues are due to supported
distribution packages or third party software installers.

Often there are possibilities to earn more money or gain valuable experience by working in another country. I learned (and earned) a lot while working in London and Amsterdam and recommend travelling if you get the opportunity. There are two ways of getting work in another country. One way is to work for a multi-national company and get transferred, this gives benefits of having the company sort everything out for you (creating a bank account etc). But it isn’t an option that is open to many people. Getting a job directly in another country is in some ways more difficult than expected and in some ways easier. Here are some of the factors that make it easier:

• Once you arrive in your destination country it’s usually easy to get work if the economic conditions are good. When choosing a country to migrate to and a time to migrate you will generally make sure that the economic conditions are reasonably good (or at least demand is greater than supply for your industry sector).


• It’s widely believed by employers that employees from other countries have valuable experience to bring, due to working conditions being different in other countries. I am doubtful of this (but I don’t complain when it helps me get a job).


• Employers often believe that employees from a long way away are very highly motivated and work really hard. I believe that this is correct as it applies to the employees that they get (EG Australians in the EU work really hard). Not that Australians in general would work harder than Europeans, but people who are willing to travel so far for their career will be motivated and people who have recently arrived in a country where they have few friends and no relatives have less things to distract them from work.

Here are some of the problems that you will face:

• Different expectations of employers. For example in Australia a university degree is not really required while European employers demand it.


• Getting a bank account. When I arrived in the UK I had trouble getting a bank account due to money-laundering laws. A passport was not sufficient and I needed proof of address, but renting an apartment without having a bank account was difficult too… I ended up getting an accountant to recommend me to a bank. Apparently the easiest way of doing this is to get an Australian bank that is part of a multi-national banking group to get their UK equivalent to set up an account before you leave Australia. Also I know people who had problems getting a Dutch bank account (fortunately there is the PostBank which deals with everyone). The UK laws may have changed in the last 8 years, but it’s the sort of problem that can get you in any country - as you can’t get paid without a bank account it’s serious!


• Renting an apartment. I think it’s best to plan to live in hotels until you get a job that will last a while, then you can live reasonably close to your work. Also landlords will often want to know where you work before deciding whether to accept you as a tenant. I lived in hotels in the UK for almost a year and never rented an apartment because of this. It’s not a problem if the stuff you need can fit into a couple of suitcases.


• Learning how to save money. Little things like bulk purchases of train tickets can save significant amounts of money. It’s the sort of thing that locals learn by osmosis but foreigners can take months or years to learn them. This is especially a problem when you don’t speak the local language and discount vouchers have fine print.


• Catching a taxi. Taxi drivers generally only speak the local language and if you don’t speak it then you will have problems. Showing a taxi driver a laptop screen with printed directions and a map helps.

Share This

The main reason for the lack of activity during this week was that I had some problems with my router, a NSLU2 running the debian arm port. This was the machine I wanted the softfloat rrdtool I was talking about in these 2 posts.

It turns out that for some weird reason the USB controller of the slug resets when there is too much traffic going on. I got lots and lots of messages like:


$ grep reset -A 1 /var/log/syslog grep -E '(reset repeated)'
Aug 3 07:02:27 ritter kernel: usb 3-1: reset high speed USB device using ehci_hcd and address 2
...
Aug 3 11:50:29 ritter kernel: usb 3-1: reset high speed USB device using ehci_hcd and address 2
Aug 3 11:51:03 ritter last message repeated 4 times
Aug 3 11:53:15 ritter kernel: usb 3-1: reset high speed USB device using ehci_hcd and address 2
Aug 3 11:53:46 ritter kernel: usb 3-1: reset high speed USB device using ehci_hcd and address 2
Aug 3 11:55:48 ritter kernel: usb 3-1: reset high speed USB device using ehci_hcd and address 2
Aug 3 11:56:07 ritter last message repeated 2 times
Aug 3 11:56:52 ritter kernel: usb 3-1: reset high speed USB device using ehci_hcd and address 2
Aug 3 11:56:57 ritter kernel: usb 3-1: reset high speed USB device using ehci_hcd and address 2


That wouldn't have been a problem as long as the damn thing worked, but in some cases after the reset the root filesystem was lost and all the services running on the machine died (except the networking itself since all of that is part of the kernel and is loaded in memory).

It took me about three evenings to get to this conclusion (imagine being locked out of a machine which advertised running ssh, http, and dns services, being able to telnet and getting a respons, but the full protocol failed).

It all became more clear when, while being connected via ssh I got his result:

eddy@ritter ~ $ ls
-bash: ls: command not found

"WHAT?" was the first reaction, then I figured that life without ls is unbearable and came up with this bit:

alias ls='for I in * ; do echo $I ; done'

Quite cool to understand a little bit about the system. Still, cat was unavailable so having /proc and /sys available did not help that much. At some point I was thinking about a busybox shell, tried that, it didn't work since it wanted to remove some important bits like the initramfs tools.


I googled again and found a good starting point for a discussion of the same problem someone else was having. I ended up trying all the proposed solutions: rmmod-ing ehci-hcd, blacklisting the module, regenerating a initrd image with the blacklisted module... None of these worked (individually) and I ended up having an even more unstable system when ehci was not present (I was loosing the root FS after aprox. 1 min after logging in remotely immediately after start). Restoring the image with ehci was a pain (not to mention the time spent trying to figure a way to revert the change safely, since bricking the machine was not out of the question - imagine loosing the FS while flashing the ram drive image).

I finally managed to revert the ehci enabled image and tried the workaround proposed in this gentoo BR. I tried 128 and now I am at 64 and I am still getting those resets; Still something good came out of this, I followed Michael Prokop's Use root=UUID on NSLU2 article and I think I have now a stable root file system just thanks to him.

Now I am stuck:


grep -E '(max_sect reset)' /var/log/syslog
Aug 3 07:02:27 ritter kernel: usb 3-1: reset high speed USB device using ehci_hcd and address 2
Aug 3 08:27:38 ritter kernel: usb 3-1: reset high speed USB device using ehci_hcd and address 2
Aug 3 08:38:43 ritter manual message: max_sectors was set to 128
Aug 3 08:55:25 ritter kernel: usb 3-1: reset high speed USB device using ehci_hcd and address 2
Aug 3 09:31:47 ritter kernel: usb 3-1: reset high speed USB device using ehci_hcd and address 2
Aug 3 09:54:11 ritter set_max_sectors: max_sectors was set to 128
Aug 3 10:09:32 ritter set_max_sectors: max_sectors was set to 128
Aug 3 10:15:27 ritter set_max_sectors: sda's max_sectors was set to 128
Aug 3 10:24:24 ritter set_max_sectors: sda's max_sectors was set to 128
Aug 3 10:38:12 ritter set_max_sectors: sda's max_sectors was set to 128
Aug 3 10:47:04 ritter kernel: usb 3-1: reset high speed USB device using ehci_hcd and address 2
Aug 3 10:48:27 ritter set_max_sectors: sda's max_sectors was set to 64
Aug 3 11:04:36 ritter kernel: usb 3-1: reset high speed USB device using ehci_hcd and address 2
Aug 3 11:06:16 ritter kernel: usb 3-1: reset high speed USB device using ehci_hcd and address 2
....
Aug 3 15:05:58 ritter kernel: usb 3-1: reset high speed USB device using ehci_hcd and address 2

Should I try setting to 32?

In case you're wondering, I am doing the setting with this script:

#!/bin/sh

MAX_SECTORS=64
DISK=$(ls -l grep 'uuid.* / ' /etc/fstab awk ' print $1; ' sed 's#.*/\(.*\)$#\1#' tr -d '[0-9]')

[ -z "$DISK" ] && logger -t 'set_max_sectors' "error: could not detect root disk" && exit

echo "$MAX_SECTORS" > /sys/block/$DISK/device/max_sectors
logger -t 'set_max_sectors' "$ DISK 's max_sectors was set to $ MAX_SECTORS "

exit 0


Dear (not at all) lazy web, what can I do to fix/workaround this issue? Any help would be gratly appreciated (personal mail or comments).

Note: I am reluctant to try the fix proposed in the last comment that claims to fix the issue since compiling an arm kernel natively is a pain and I would like to have an official kernel from Debian Etch, as I do now.

Following many months of faff, today Katherine and I completed on a house in Castlerock. I say Katherine and I, but really I did very little. She started looking after she'd started at UU, before we knew Black Cat was going to be sold. My sole involvement was to be dragged round a few places (including this one) when I was back in April. The initial plan was that Norwich would remain our "home" and this would be somewhere that Katherine would be able to live during term time, that I could also work from now and then. Given recent events it'll no doubt become "home" and we'll leave Norwich. To that end I've been looking at the job market back in NI. I've found (and applied for) a few things in Belfast, all software development roles. I may even have an interview; had a phone call today that felt very much like a phone interview and ended with talk of getting a formal interview sorted for when I'm next over. All scary stuff. Belfast is a bit far for a commute, so I may end up living there during the week. Or I might not get anything in NI and have to look further afield. Anyone know anything going in Derry? That may be a more managable daily journey.

A recent thread which started on the Debian Release mailing list caught my eye this week. I attempted to aid the migration of this thread to the debian-ipv6 mailing list, which is really a better place for this and sorely in need of controversial topics for discussion. It is interesting how people can so blindly decide that broken things should be destroyed. Repair often appears not to be an option, even for a long-term, wide-reaching effort like this, though we are all working on open-source software! In this case there are an unknown number of less fortunate people in the world who are located behind some kinds of broken DNS infrastructure which discards 'AAAA' lookups. Of course 'AAAA' lookups are attempts to resolve a name to an IPv6 address, and the resolver in a 'modern' libc (i.e. one from the last five years or so :-) will try to retrieve an IPv6 address before it attempts to resolve a name as IPv4 with an 'A' lookup. That is how the standard is written, so if you want to comply with the standard you have to do it that way. Other things also interfere, but this element of the specified behaviour seems to cause the most annoying and pointless whingeing I have heard. I suppose that the people who want working IPv6 make it so, and do not have problems with this behaviour. But it seems that people who are behind this kind of broken DNS either disable IPv6, or they have to whine about IPv6 being turned on by default, and can't we please all go back to the good old days. What's wrong with IPv4 anyway? Doesn't NAT solve all of it's problems? Are we sure this new (heh!) technology is safe? Fortunately some people are so good at making their pain felt by other people that they can get other people to do their work for them. So Mithrandir has written a nice elegant patch for libc6 so that it won't do the IPv6 lookups unless you have a usable IPv6 configuration. I've filed bug #435646 against Debian to get this included, but Aurelian Jarno justifiably wants a few people to test it a bit harder... So I've taken the original patch and tweaked it to apply against current libc6 sources (2.6-5) and tested it for myself. It works as desired, as far as I can see, when comparing behaviour with an unpatched system. The patch is attached to the bug report, of course. Perhaps some other people out there can put a wee bit of CPU into testing this for other environments so that we can make life easier for those people with no time / inclination to use IPv6, to ensure that they don't just disable it because it is making life too painful for them in it's current form? How to build libc6 for fun and proft If you have appropriate deb-src URLs configured, and are running Sid, then the following will let you build a local copy of libc6 with the patch. This is probably better testing than if I just make my packages available (which are only i386 in any case).

apt-get build-dep glibc
apt-get source glibc
cd glibc-2.6
debian/rules unpack
cd build-tree/glibc-2.6
wget http://tinyurl.com/3xzm3o
patch -p0 <glibc-only-lookup-ipv6-if-it-makes-sense-debian.patch
cd -
dch --newversion 2.6-5+v6 "Apply IPv6 Resolver Sanity"
fakeroot debian/rules binary

Wait a few hours for it to build... Install... And then confirm that this only does 'AAAA' lookups if (when) you actually have a global or site scoped IPv6 address. When you only have a loopback or link local IPv6 address then you should only see 'A' record lookups. Step 3: profit! Whoops! I forgot the fun bit: please update the bug report :-) What the patch does In my opinion this is quite an elegant solution from Tolleff. He has picked a single characteristic of the IPv6 interfaces to further refine whether the IPv6 configuration of some interface is actually usable. With IPv6 it is much more common to have multiple addresses assigned to a single interface. Interfaces are automatically configured with a link-local address which is not globally routable, and the loopback interface is also configured with the IPv6 equivalent of 127.0.0.1 (which is "::1"). To get a usable IPv6 setup you will also end up with a more widely usable address. In most cases this will be a global address, meaning that it is (in theory) globally routable from other people who also have global addresses, or you could have a "site" address, which is the IPv6 equivalent of RFC1918 addressing. The patch considers that for the purposes of name resolution, it will be pointless to do AAAA lookups unless you have an address of the second kind. This means that people behind broken DNS won't be impacted unless the try and set up IPv6, and people who don't try and set up IPv6 won't get the 'hesitation' while their system attempts to resolve each address in IPv6 space first. It will also mean that when people start to enable IPv6 around them, their setup will continue to work correctly.

In case you think that greylisting might have some disadvantages but give you also some benefits, you probably have thought about to use greylisting with some conditions. For example if you checked some parameters of the mail and you (or better your mailsystem) guess it may be spam, greylisting could be very usefull.
Until now, I was using plain policyd-weight. But mails with $REJECTLEVEL <= score <= $DEFER_LEVEL where in some conditions defered (see policyd-weight default) and if they come back with the same conditions, they will be defered twice. So it makes sence to me to greylist them and if they return within $DEFER_LEVEL, they will pass cause the greylist will allow them.
At first let’s create a restriction class which we can call from policyd-weight within main.cf of postfix:

# restriction class for use with polw (DEFER_ACTION)
smtpd_restriction_classes = greylist
greylist = check_policy_service inet:127.0.0.1:60000 To call postgrey for $REJECTLEVEL <= score <= $DEFER_LEVEL you need to make use of the restriction class “greylist” and let $DEFER_STRING match all defer strings, to get them all greylisted:

# echo “\$DEFER_STRING = ‘NOT’;” >> /etc/policyd-weight.conf
# echo “\$DEFER_ACTION = ‘rc:greylist’;” >> /etc/policyd-weight.conf
# /etc/init.d/postgrey restart Also you may have a look into The DNSBL countries.nerd.dk. This might be a way to score connections comming from well known spamming countries. But keep in mind, that there may also legitim mails comming from those! ;) planet, policyd weight, Postfix, spam

In case you're wondering why my blog has become so silent (3 posts in July, 2 posts in June - yes, my posting frequency is down by a magnitude!):About a year ago I started dancing, and this has by now become my main leisure time activity. And since I'm now off dancing (and meeting friends I know from dancing) like 5-7 days a week, that also means I'm spending much less of my free time on the computer.It's not just that I'm not blogging as much anymore; I'm also spending much less work on my opensource projects. Sorry about that; but all the dancing has recently been very fulfilling, whereas sometimes opensource work can be somewhat demotivating (especially when you fail to attract people to join your project).This especially means that some of the projects I started or played a bigger role in (e.g. SELinux on Debian) now need to find someone else to take over my work. Especially SELinux could definitely use some fresh hackers.

July 31st was my last day working for Sixbell-Nekotec Solutions (formerly known as Nekotec Tecnolog a). I lasted there three years. It seems like a life was spent there, heh: I entered after turning 20 and I’m leaving some days before I turn 23. Our future is still a bit fuzzy, but we are working on it. In the meantime, I’m getting back full-time to Mathematics next 13rd. But if our plans succeed and if everything goes right, we’ll be moving by the end of August or early September. Heh, yes, leaving school temporarily, again! Anyway, I’m unemployed right now. Listening to music most part of the day, taking Raquel to work, coding a bit here, there, doing some Debian labor, etc. Meh. An End Has A Start is one of the albums by the English band, The Editors, it makes a great title for my post now :-). I just listened to Taraf de Ha douks’ Maskarada, it’s not that great as the masterpiece as The Continuing Adventures. I’m getting addicted to the Cold War Kids.

The command crm_resource allows you to do basic editing of resources in the Heartbeat configuration database. But sometimes you need to do different things and the tool xmlstarlet is a good option. The below script can be used for testing Heartbeat OCF resource scripts. It uses the Heartbeat management program cibadmin to get the XML configuration data and then uses xmlstarlet to process it. The sel option for xmlstarlet selects some data from an XML file, the -t -m options instruct it to match data from a template. The template is the /resources/primitive part. The --value-of expression will print the values of some labels from the XML. The script will concatenate the name and value tags and export them as environment variables (see my post about Configuring a Heartbeat Service for an explanation of the use of the variables). The TYPE variable is the name of the script under the /usr/lib/ocf/resource.d/heartbeat directory. In recent versions of Heartbeat (2.1.x) the OCF_ROOT environment variable must be set before an OCF script is called. Setting it on older versions of Heartbeat doesn’t do any harm so I unconditionally set it in this script (which should work for all 2.x.x versions of Heartbeat). The first parameter for the script is the id of the service to be operated on and the second parameter is the operation to perform (start, stop, and status are the only interesting values). The script will echo the exit code to the screen (0 means success, 7 means that the service is not running or the operation failed, and any other number means a serious error that will trigger a STONITH if Heartbeat gets it). #!/bin/sh
$(cibadmin -Q -o resources xmlstarlet sel -t -m \
"/resources/primitive [@id='$1']/instance_attributes/attributes/nvpair" \
--value-of "concat('export OCF_RESKEY_',@name,'=',@value,'&#010;','TYPE=',../../../@type,'&#010;')")
OCF_ROOT=/usr/lib/ocf /usr/lib/ocf/resource.d/heartbeat/$TYPE $2
echo $? Below is another version of the same script that instead uses crm_resource to get the XML data. The output of crm_resource has a couple of lines of non-XML data at the start (removed by the grep) and also only gives the XML tree related to the primitive in question (so the /resources part is removed from the xmlstarlet command-line). #!/bin/sh
$(crm_resource -r $1 -x grep -v ^[a-z] xmlstarlet sel -t -m \
  "/primitive/instance_attributes/attributes/nvpair" --value-of \
  "concat('export OCF_RESKEY_',@name,'=',@value,'&#010;','TYPE=',../../../@type,'&#010;')")
OCF_ROOT=/usr/lib/ocf /usr/lib/ocf/resource.d/heartbeat/$TYPE $2
echo $? The problem with both of those scripts is that they rely on Heartbeat being operational. Performing any operations other than a status check while Heartbeat is running is a risky thing to do. If Heartbeat starts a service at the same time as you start it via such a script then the results will probably be undesired. One situation where it is safe to run this is when a service fails to start. After it has failed repeatedly Heartbeat may stop trying to restart it (depending on the configuration) in which case it will be safe to try and start it. Also you can put in temporary constraints to stop the resource from running by repeatedly running crm_resource -M -r ID until all nodes have been prohibited from running it (make sure you run crm_resource -U -r ID afterwards to remove the temporary constraints). The following script does the same thing but directly reads the XML file for the Heartbeat configuration. This is designed to be used when Heartbeat is not running. For example you could copy the XML file from a running cluster to a test machine and then test your OCF resource scripts. #!/bin/sh
$(cat /var/lib/heartbeat/crm/cib.xml xmlstarlet sel -t -m \
  "/cib/configuration/resources/primitive [@id='$1']/instance_attributes/attributes/nvpair" \
  --value-of \
  "concat('export OCF_RESKEY_',@name,'=',@value,'&#010;','TYPE=',../../../@type,'&#010;')")
OCF_ROOT=/usr/lib/ocf /usr/lib/ocf/resource.d/heartbeat/$TYPE $2
echo $?

Share This

A couple of days ago the hardware that is used to host this blog was upgraded - doubling the amount of RAM in the machine. To do this the machine was halted, memtest86+ was run to ensure that the new RAM worked correctly, and then it was booted up again. During that process my ssh session was not stopped! I merely refrained from typing anything until the upgrade was complete. This is one feature I really like about Xen. It can save the memory image of a running domain to a file and then restart it later. TCP sessions remain open if timeouts have not elapsed. The command xm save can be used to save the state to a file and the command xm restore will restore it. In Debian the location of the save files is stored in the file /etc/default/xendomains with the variable name XENDOMAINS_SAVE and defaults to /var/lib/xen/save. A quick experiment with one test domain (running Debian/unstable in 128M of RAM and had just run apt-get dist-upgrade so the memory contents would not be all zeros) showed that gzip -9 would decrease the file to 35% of it’s size at a cost of just over 1 minute of CPU time on a Pentium-M 1.7GHz. But gzip -3 compresses it to 37% and only takes 9 seconds. 9 seconds of CPU time to save 80M of disk space seems a reasonable trade-off. In my particular case it saves CPU time as the encryption I use for my root filesystem takes more CPU time than gzip -3 so compressing the data saves time. But I don’t expect my case to be common. Now when Xen is used on a more modern machine with a faster CPU gzip -3 has the potential to save time as well as disk space. A machine with a CPU that is in aggregate 10x faster than my laptop (I think that means most 64bit multi-core CPUs) running with a single S-ATA disk (that will have a sustained contiguous read speed of 80MB/s and write speed that is less) will save time when saving multiple Xen DomU’s if it runs them in parallel and compresses them. Also gzip is not the fastest compression program. There may be other options that are better suited to the needs of Xen. I have filed a Debian bug 435406 requesting that compression be supported.

Share This