Search Results: "reg"

23 May 2006

Meike Reichle: Back home from DC6

So, I am back home. After a 24 hour journey we arrived at Tolimar's place Sunday night, after a journey that sadly was not as nice as the one to .mx. First we departed about 1/2hr late from Oaxtepec since the backpack of a fellow traveler was ridden over by a car. Than our taxi driver charged us 900MXN for the trip to the airport, although we had agreed on 800 before we left.
Once in the airplane our machine had an engine problem and could not take off. We waited for about 2.5hrs while the inside of the plane steadily got hotter and hotter. Due to this we also missed our connecting flight at Heathrow and were rebooked on a later flight. Probably due to this Tolimar's luggage didn't make it on the same flight and had to be delivered to his house on the next day. Once we had finally reached Frankfurt we went to bed and slept for 16hrs straight. Got back up at about 5pm today, took the train to Hildesheim and am now finally home! No DebConf6 conclusions yet. I am in full EndOfEvent/jet lag mode and feel deader than the frozen chicken (Chicken! Of all things!) I just dug out the icebox of my otherwise totally cleared out fridge. At the moment the predominant feeling is a mixture of "Wow, that was a trip!", profound tiredness and regret about all the things I had planned to do but found no time then. PS: Bubulle, flattery won't help you. I'll get you for this! PPS: Time to write postcards. ;) PPPS: I'm freezing!!

22 May 2006

Uwe Hermann: Podsploiting

The RedTeam, a penetration testing group, has released two security advisories which explain security holes in two podcast clients (podcatchers). Both exploits are possible because the input of the programs is not properly (or at all) sanitized. Basically, they call system($wget_cmd) where $wget_cmd is shell (/bin/sh) code which shall download a file via wget. As the $wget_cmd string contains contents from an untrusted source (HTML/XML on some random server), this results in an "arbitrary code execution" vulnerability, the worst-case scenario you could imagine. If someone is naive enough to even run such a podcatcher as root, this means a remote root exploit! Anyways, the RedTeam is definately correct in saying that more and more people start listening to podcasts, and more and more podcatchers are written. But few of them are written with security in mind, which leaves many listeners at risk... I wonder how popular closed-source podcatchers such as iTunes are affected here. Are there any published audits/audit-results (black-box auditing, obviously, as you don't have the source code) for iTunes? As for Free Software implementations... consider this a call for reviews and audits! If you know/use one of the many podcatchers (or an RSS feed aggregator, which are affected by similar issues), and have some knowledge on secure programming, get the source and review the application. Make the software you use, and the world at large, a little safer. I'll definately have a look at the programs I'm using soonish...

21 May 2006

Edd Dumbill: Emacs hate mail

Regular readers will know I'm keen on getting good-looking fonts in Emacs under Linux. And so are a lot of other people, judging by how popular my Emacs/Xft posts have been. I have found out this is enough to drive some people to me sending nastygrams.
To: Edd Dumbill
Subject: whoareyou I don't know who you are, but... Emacs is a programmers editor. Sure, scalable fonts would be good for GNUEmacs, but they are not a necessity. If you want the wysiwyg experience, try XEmacs, I don't like XEmacs, but you are welcome to try it. I have used GNU/Emacs for the last 12 years as a code editor.  I like it just fine, and that is an understatement.  Leave it alone.

Christian Perrier: Debconf 6 - day 6 - real content

So, really, here's now the full story of that 6th day of Debconf. It indeed began as early as usual, like 7:30 wake-up after being to bed at 02:30. It's amazing to see how I didn't yet burned out. I had to run a 2nd BOF about i18n infrastructure, which main point was indeed to begin summarizing all the ideas we exchanged during the first one, then later during the various private discussions. We had the very good suprise to finally see Javier Sola showing up at the meeting. For those who don't know about him, Javier is member and one of the heads of the Wordforge project, a project that attempts to simplify the process of localisation of Software and is developed with Free and Open Source software in mind. Wordforge is the project that now covers the development of Pootle and related tools such as the Translate Toolkit. Javier came especially for TWO days at Debconf, from Cambodia, where he lives, just to meet us. I tried, during this second BOF to summarize ideas we had already prepared, along with other people, the night before. It is really good to see people actually pusshing you up to achieve things you wouldn't have any idea being able to do when coming. Javier then improvised a general presentation of Wordforge, which has hopefully been taped along with the BOF so that interested people will be able to see it. I have to confess that I ended up this very long session (about 2h50) absolutely enthusiast about the idea of collaborating with Wordforge and this is the way to go if we want our i18n infrastructure. Just don't ask me why, I just know this...:-) The day then went at the speed of light. First, Javier (Fernandez Sanguino, that time) and I finally began to synchronize our thoughts for the talk of the next day. This quickly lead us to...the lunch time where we continued discussing together (not much occasions to talk with Javier during that Debconf even though we wrote a 25 pages paper together...). Too bad I missed the part about NM process by Christoph Berg which would have been deeply interesting to participate. Post lunch continued with still slides work with Javier, missing our fellow Josselin talking about shared libraries (I'm afraid I wouldn't have got a clue about this, but anyway....). My award for the "best Debconf6 talk" goes, this time, to Meike (who would have guessed?) for this so great talk about talks. And, no, you're not *that* jamming from one leg to another. The group photo and the keysigning are of course traditional events of a Debconf and both were one after the other...pretty tiring, but as usual good fun. I very slightly regretted that several of the usuall participants of the keysignings I've already been in weren't actually participating in that one. For sure, many of us have already exchanged keys but I see this also as a kind of "bienvenidos" to all participants in Latin America in this Debconf. For the same reason, I would also have, like Damog, been glad to see Anthony attend the Debian Latin America community BOF but I tend to believe that being in all the place people would like to see him and talk with everybody who wants to talk with him, is simply not humanly possible. Finally, after lunch, we i18n dudes continued with a huge discussion, again, to continue drawing ideas for that damn i18n infrastructure stuff. I ended up the "day" completely enthusiast (and, no, without any chemical help) and finishing my mail. Finally, at 02:00 the day finished liked a dream by a nice online chat with Elizabeth (my beloved wife, dudes) who was actually waking up to drive our daughter to the high school. To bed at 03:45...a bit crazy. I have a talk tomorrow...

19 May 2006

Romain Francoise: Official emacs-snapshot backport for sarge

In case anyone's interested I maintain an official sarge backport of my emacs-snapshot packages, available from here. It's updated frequently, but not as often as in sid.

Note that quite a few Emacs-related packages in sarge don't have support for emacs-snapshot, but in most cases you can safely install the version from etch or sid since they have weak dependencies on the rest of the system. One regrettable exception is dictionaries-common, so you might want to forcibly prevent it from interfering with emacs-snapshot otherwise it'll shadow flyspell and ispell with old versions. (You might not even need external Emacs packages at all since emacs-snapshot already includes Gnus 5.11, MH-E, ERC, rcirc, Calc, Tramp, ido, python-mode, tumme, Org, etc etc.)

If you find bugs in the backport please don't report them in the BTS but email me directly (rfrancoise@d.o).

I've also been wondering if I should reconsider my 'sid-only' policy for emacs-snapshot, I keep getting requests from users to let it trickle into testing, and given that the past few months have shown that Emacs 22 is as stable as Emacs 21 (if not more), the idea has credit.

The only problem (if one ignores the fact that it would go against existing Debian policies) is that emacs-snapshot is updated weekly, and the minimum delay for low-urgency uploads is ten days. But I guess I could delay updates every once in a while to let the packages become eligible for migration...

(Also, even though it's not in testing, emacs-snapshot is included in Ubuntu dapper. So whether I like it or not, outdated snapshots will end up on people's systems sooner or later, and I'll have to deal with it...)

Christian Perrier: Debconf - Day 5

Strange day today. It began pretty badly for me, being quite sick after a bad night. Even some swimming in the pool didn't really help and I was feeling pretty bad to begin the day. I first went to Jim Getty's BOF about the One Laptop Per Child project. Interesting talk, but maybe a bit quick and a bit too fast talking for me (Jim should attend Meike sessions about talks even with his great background in doing talks, I'm afraid). Then I moved at about 11:00 to the Tower where I actually stayed up to 19:00. There I attended a few deep and dense talks and BOFs. Keith Packard about X.org was good, though here again I would advise native speakers of English to pace a little bit down and think about their non native audience, especially when using few slides. Interesting questions and discussion in this BOF, really. Steve and Andi about release management were perfect. They made their points very clear and we now exactly know what we have to do to releas on time. I woul dlike to deserve a special mention to Andi who made huge efforts to improve his talk skills, slow down when talking and all that kind of stuff he probably did benefit (again) from our wonderful alphascorpii speaker training sessions. While everybody was going to lunch, I quietly stayed in the tower, visiting the local bathroom at regular intervals. I used this occasion to try my laptop setup for the video beamers. Actually, in short, it sucks. It appears that I'm only able to do 1024x768 at 60Hz if I want to have both my laptop display and the beamer. In that case, the beamer display sucks. Otherwise, with only the beamer, it's perfetc, but of course not really convenient. I think I'll use Javier's laptop for our talk. The afternoon was filled with two workshops. The first by Frans Pop about D-I internals did obviously not teach me many things but I was of course proud, just like he was, to see the graphical installer receive a big applause from the audience. His demo went well (I know that Frans likes really well done work) and He kept his audience fairly well awaken ! We ended with Javier's workshop about security bugs. Here, a perfect knowledge of the topic and a very well prepared demo (having tried that once, I'm really admirative). Javier was sometimes a bit fast on some topics and I will certainly have to slow him down for out Saturday's talk but indeed he made it well. Kudos ! After many hesitations, I finally decided to come at the "formal dinner", a Debconf tradition (and I can't miss stuff like that). Even though I'm not a party man, I enjoy these moments where all Debconfers share fun. Of course, as many have already written in their blogs, this was a really special dinner with many events, most of them being good stuff...and one of them being a real shame (the person responsible for starting that one does not even deserve to be mentioned and, no, I'm not talking about Holger or Ana in case someone would have worry). We came back quite early (Feeling better, I didn't want to play with my luck and try all the dishes) and I even had an opportunity to exchange a few words with Erinn, which I most often have no occasion to do. Back to the hacklab and a very intense hacking session, mostly talking with Otavio, Grisu and Nicolas to prepare this morning's BOF about i18n infrastructure....which will happen in 1h now, so I should stop blogging..:-) Strange...but great day. This is Debconf, dudes...

Aigars Mahinovs: Debconf6 day 4: The Daytrip + some hard liquor

May 17th. Just before the daytrip an idea to go for a breakfast came, so at around 8:30 a small group went off to the local market in search for some food. We were seated by a counter and the food was prepared on a large coal heated metal sheet just in front of us. Learning from the last experience of such kind I ordered two tortilias, but I barely ate one of them - it just did not feel right. (Later I was kind of glad that I didn't because my stomach felt a bit funny until the next morning. I guess the body can feel what is good for it.) After we came back to hotel, the buses arrived - large, metallic buses of the GMC (General Motors Company, I assume) that looked like they came straight from 1960s - 1970s. I expected that they will fell like frying pans in the hot midday sun, but in the end the buses turned out to be very nice and comfortable. A half an hour before the leaving time people started to group up. Some took the time to chat, some took the time to take random group photos. The drive to the place was two hours long. The guide told us a bit about the region where we are and its history. I do not remember much of it except that this state has always been the rich farming valley that provided food to many other regions. We also found out the name of the volcano whose picture I took earlier - it was the active Popocatepetl. I have heard that name before. That is the first name that I know here. On arrival to the Xochicalco archaeological site we left our buses and wen into the on-site museum. The museum was built in a barren place without electricity and any water installations, so it was decided to make the museum to be very ecological - sunlight is used wherever possible, electricity is gathered by solar panels, rain water is gathered, collected and purified using natural treatment methods. ALso the building materials are very strange - the buildings look very green. The museum was of the classical site with texts and scenes and bunches of artifacts and a "no flash" requirement. That kind of impacts the pictures. Additionally the glass behind which the artifacts were was way too reflective. After we were done with the museum we went on a 5 minute walk under the midday sun to the site itself. It was really, really hot. People got sunburns later But the view was great. On the site there were some kind of containers that were masked as stones. They might be local trash containers or something else. The whole excursion on the site took around two hours and was spent slowly walking from one shade to another while listening to the explanations of our guide. There were 6 groups in total, our group (the Pink 3) had around 20 people. The ancient city was a well protected multilayer city where people of certain social status were basically locked inside on of the levels and people of the higher level governed them. At all levels there were pyramids and temples and places for parties. Our guide said that having a party almost every week is traditional for people of this region, it is a tradition derived from calendars of the ancient times. There were several ball courts on the territory. Very fascinating game (judging from the available data). The winner was seen as becoming closer to godliness. We have no idea what happened to the loser. But there was a sauna where players went before the game. The excavations at Acropolis section (the rich people section) is still going on. But the main religious place - the temple of the feathered serpent was restored magnificently. It is relatively small (compared to my previously visited pyramids), but very well preserved and restored. Most of the carvings were fully visible. In the end the site was nowhere near as impressive as Teotichuan. Not even close. The final temple was a nice piece, but the rest ... After that we went for a lunch at an all-you-can-eat Mexican buffet. They were obviously notified of our arrival because seating and feeding 300+ people otherwise would be very hard. We sat in our seats and then went for the food at table by table basis. Th food was nice and simple. I had a lot and really considered skipping dinner when we came back. There was also some local fauna at the place: a extremely friendly and lovely chameleon, a meat eating parrot, a hamster, a dog and a pair of pigeons. Apparently all of them were up for adoption. A lot of cuteness ensued. After lunch we drove for an hour to the capital of the Morero state and went to the local market for souvenirs. The shopping was fast and productive even despite the soft rain. In the evening after the daytrip and after the dinner there was a hard liquor party. Hard liquor from multiple countries was presented. I could not evaluate it properly, but I could evaluate the properly prepared Japanese green tea. It was really magnificent. This party was slower then the wine and cheese party - you can't rush with hard liquors. In parallel a pancake party was also taking place in the hotel's kitchen. I looked very nice but I was very full by then.

Erich Schubert: Worldcup songs (aka: the four letter f-word: F*FA)

FIFA sucks. It's so much about commerce... Don't buy their stuff. Buy your soccer balls at e.g. Transfair. These were bought at fair prices and not made by exploiting people in third world regions. Check out the 'Wilde Fu ballkerle' design. Very sweet. Much better than this annoying worldcup logo just about everywhere. But back to my original topic. These annoying 'official' worldcup songs. Dear FIFA, how about letting people decide which songs they like? I hate your choice... It makes me think of Titanic! And actually I hope that this happens to FIFA, that they go down like titanic because of some corruption scandal or so. If you want to compare them, check out Voices from the Fifa World Cup at Amazon (with realplayer samples). My current favourite is 1. FC Sommer, played by the Bananafishbones (last.fm), an indie band. They're cool. They do a festival and support new indie bands. If you want to listen to an excerpt, point your browser to the 1. FC Sommer page, there is a realplayer stream available again, klick that audio button. That song has some great wordplays in there, too bad that you can't translate them in all details into english. The refrain is "Der Sommer geh rt dem, der den Weltmeister schafft" which translates to "The summer belongs to who wins the worldcup"; the world play is "Weltmeister schafft" (becomes the world champion) and "Weltmeisterschaft" (Worldcup). And there is also a nice song by Sportfreunde Stiller, who did a whole CD full of soccer songs. So just ignore FIFA and don't buy their branded stuff.

Uwe Hermann: OS Install Experiences - Part 1: Debian stable + unstable [Update]

Debian Open Use Logo
Note: This article is part of my OS Install Experiences series.
OK, so let's start with something simple: Debian. Simple in the sense that there probably won't be too many surprises for me as a Debian developer (or for most readers of Planet Debian). For other people this might be interesting, though, and some facts are probably interesting to one or the other experienced Debian user/developer, too... Hardware A few words on the hardware I'll be installing all these OSes on. It's a cheapo (200 Euros) x86 PC (Intel Celeron, 2 GHz), 80 GB IDE hard drive, 256 MB RAM, ATI Radeon 9200 SE graphics adapter, Realtek PCI ethernet controller, CDROM, USB, and all the other standard stuff. Nothing fancy, really. Install
  1. First, I downloaded a Debian sarge 3.1r2 CD image, burned it on a CD, and booted from that.
  2. An installer menu showed up, where you can press F3 for boot options. I chose "expert26", which will ask me more questions and give me a 2.6 Linux kernel instead of 2.4.
  3. The installer (newt-based, i.e. not graphical) will now start to boot a base Linux system.
  4. Now, you can choose your language (used in the installer), country, region, and keyboard layout.
  5. You'll be asked which additional kernel modules you want to load (default: all), and whether you want PCMCIA support. Also, you can choose which extra installer components should be loaded (LVM, PPP, serial, IrDA, ...).
  6. Your hardware can be automatically detected (my Realtek card was successfully detected, the "8139too" kernel module was then loaded).
  7. The network was successfully auto-configured via DHCP within seconds.
  8. Now you can choose a hostname and domain name for the box. I used "hydra" as hostname (guess why), and "local.domain" as domain name.
Partitioning Now the funny part starts: partitioning the disk. As I will be installing >= 10 OSes, this needs a bit of consideration. I have chosen to create a 10 GB (primary) partition for a Redmond OS I'll be installing later (for games, testing, proprietary software I'm forced to use, and similar things). This will be the first partition and I marked it bootable, as Windows might choke otherwise. For the rest, I reserved 5 GB for each OS — that should do. So the next two (primary) partitions are 5 GB each. I'll leave these empty for now, as I might encounter obscure OSes which must be installed on primary partitions. Let's hope it won't be more than two ;-) As you can only have four primary partitions, I then had to create a logical partition, which will "contain" any further partitions. The next three (secondary) partitions are 1 GB each, intended to be used as swap. One of those I marked as swap in order to use it for Debian. Other Linux installations will be able to reuse this one. The other two are reserved in case I encounter OSes which have another form of swap and cannot use Linux swap partitions... The rest is easy: create twelve 5 GB partitions => lots of space for more OSes. Here's the resulting fdisk output:
Disk /dev/hda: 81.9 GB, 81964302336 bytes
255 heads, 63 sectors/track, 9964 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
      Device Boot      Start         End      Blocks   Id  System
   /dev/hda1   *           1        1216     9767488+  83  Linux
   /dev/hda2            1217        1824     4883760   83  Linux
   /dev/hda3            1825        2432     4883760   83  Linux
   /dev/hda4            2433        9964    60500790    5  Extended
   /dev/hda5            2433        2554      979933+  82  Linux swap / Solaris
   /dev/hda6            2555        2676      979933+  83  Linux
   /dev/hda7            2677        2798      979933+  83  Linux
   /dev/hda8            2799        3406     4883728+  83  Linux
   /dev/hda9            3407        4014     4883728+  83  Linux
   /dev/hda10           4015        4622     4883728+  83  Linux
   /dev/hda11           4623        5230     4883728+  83  Linux
   /dev/hda12           5231        5838     4883728+  83  Linux
   /dev/hda13           5839        6446     4883728+  83  Linux
   /dev/hda14           6447        7054     4883728+  83  Linux
   /dev/hda15           7055        7662     4883728+  83  Linux
   /dev/hda16           7663        8270     4883728+  83  Linux
   /dev/hda17           8271        8878     4883728+  83  Linux
   /dev/hda18           8879        9486     4883728+  83  Linux
   /dev/hda19           9487        9964     3839503+  83  Linux
Install, continued
  1. The Debian partitioning tool allowed me to do all of the above via a friendly menu. As it does not modify the partition table until you say "done", I could revert many changes, and play around with different layout ideas until I was satisfied.
  2. Next thing you can choose is the Kernel flavor (386, 686, smp).
  3. You may now configure and install GRUB, the bootloader. I installed it at "(hd0)", the master boot record of the hard disk.
  4. Soon the CD ejects, and you have to reboot.
  5. After a restart (which also shows whether GRUB works fine), you can now choose your timezone, and decide whether you want shadow passwords (say yes!).
  6. Now enter the root password, and decide whether you want to create an additional user account (say yes, and enter a different password here).
  7. You can now configure apt, e.g. tell it which sources you'd like to use (CDROM, FTP, HTTP, ...). You'll be asked whether you want to install software from Debian's "non-free" archive. After choosing a mirror (and proxy settings, if you like), you can (should!) also say yes to the question whether you want security updates...
  8. Finally, you may now choose "tasks" (desktop, web server, file server, ...) your machine should be able to perform; this will influence which packages will be installed. You may choose "manual package selection", of course, if you want more control. I used "desktop".
  9. That's about it. You'll see a few more application-specific questions (configuration of MTA, ssh, fonts, X11, gdm, and others), and after that you'll be left with a GNOME login window.
Security I collected some (partly) security-relevant information after that. Ok, so that's it for Debian stable. Unstable is 99% the same, except that you do a "vi /etc/apt/sources.list; apt-get update; apt-get dist-upgrade". I'll do that later maybe, compare the findings, and report notable differences here, but it shouldn't be too many (I guess). Not today, though, I need some sleep now. Comments, suggestions, flames? Update 2006-05-19: Updated "why is Debian-exim capitalized?" info as per comments, thanks!

18 May 2006

Peter Van Eynde: clc v6 and debconf6

I released common-lisp-controller 6 which has one major change: if you now compile a lisp file not under clc (or slime) control then the resulting fasl file will end up in /var/cache/common-lisp/<uid>/<implementation>/local/<full path of the source file> so that on upgrade of the implementation all cached fasl files will be removed. To give an example compiling /home/luser/cl-world-control/mind-beam.lisp will result (on sbcl) in /var/cache/common-lisp/1001/sbcl/home/luser/cl-world-control/mind-beam.fasl

The only problem with this is that is you remove the source-tree the cached fasl files will not get removed, but I guess people do upgrades with regularity (for sbcl every month or so) and sysadmins know that anything in /var/cache may be nuked at any moment.

For debconf6 I'm blogging about it on my non-debian and lisp blog (so that my non-debian friends read it) and uploading pictures to a special debconf6 flickr set.

Adam Rosi-Kessel: Webloyalty Call Center Reps

My blog has apparently become a canonical source (at least by PageRank) for the Webloyalty Scam (see also this update). It’s been about 18 months since I first posted about it—since then that page has gotten over 40,000 hits and over 1,000 comments. Perhaps the best testimony about this company comes from its own employees. At least two people purporting to be Webloyalty Call Center Representatives have posted comments to that entry; in both cases, the IP addresses resolved to a Connecticut location, so it is at least plausible that these people really work for Webloyalty. Here’s the most recent comment, posted from 69.183.205.129:
WOW!! The level of stupidity on this board is incredible. You people don’t get it, do you?? Webloyalty didn’t sign you up for anything. You signed yourselves up. The details are right there, in plain sight, in normal sized text, right in front of your faces. It details EVERYTHING, including the cost of the service and the billing cycle. The problem is that all of you idiots chose not to read it. You saw “free”, and figured “gee, something free for me? golly, I must be special”. WRONG!! YOU’RE NOT SPECIAL, YOU’RE JUST FUCKING LAZY AND STUPID!! YOU SIGNED YOURSELF UP! NOTHING HAPPENED AUTOMATICALLY!! THERE WAS NO SLIGHT OF HAND OR MISLEADING WORDING!! The bottom line is you’re all a bunch of stupid, lazy, crybabies who don’t want to take any responsability for your actions. NONE! Well, thats what you get for being stupid and lazy. LEARN TO TAKE RESPONSABILITY FOR YOUR OWN ACTIONS. DON’T POINT THE FINGER AT OTHERS AND CALL THEM “THEIVES” AND “SCAM ARTISTS” AND BLAME THEM FOR YOUR OWN STUPIDITY. YOU ALL MAKE ME SICK!! FUCKING CRYBABIES!!!!
And here’s another for a few months ago:
comment: I’m a rep in the call center at Webloyalty. I have no pity for any of you people. You’re all suckers, plain and simple. Didn’t anybody ever teach you that nothing is free? When all of you idiots made your purchases on whatever website you did business on at the end of your transaction there was an offer asking if you wanted to save $10, or get award miles, or whatever. When you clicked on that link you were not automatically signed up. What happens is that you’re brought to the Reservations Rewards website. On that website it tells you that you are on the website for Reservations Rewards. You see, you can tell that because the banner at the top of the site says “Reservations Rewards”. Unfortunately you were too stupid to notice or remember. It then gives you instructions on how to redeem your “reward”. At that point you are instructed to enter you email address in twice and click accept. Now you have to manually type in the email twice in those boxes. No cut and paste is allowed. Then it tells you to click accept. Now, if you had any fucking brains in your head you would have noticed that right above the box where you enter your email mail address its says, in regular sized type, in plain sight, right out in the open, that entering your email twice will act as an electronic signature and that by clicking accept you are accepting that the website you just made a purchase on can share the billing information with Reservation Rewards. Also in the big box next all of this it gives the exact details of what you are signing up for, again in regular sized print, in plain sight, right out in the open. If you are too stupid to take the time to notice all of that then you deserve what you got. which was a membership in a overpriced bullshit ptogram.
>



Webloyalty depends on idiots like you to not notice this stuff. To be blinded by the idea that you are getting something for “free”. To not look at you credit card statement so charges go through every month. Its unbelievable the amount of dummies out there that fall for this stuff. Even if you do catch the charges eventually, and get a refund they still made money off of you by collecting interest on your money when they had possesion of it. Stay a member or cancel its win-win for webloyalty.
>



So, anyway I hope all you dummies learned a valuable lesson and wont fall for this again. I’m sure many of you will, though. You’d be shocked at how many people are repeat members where they canceled the service a while back but fell for the scam again a few months later.
>



Perhaps the funniest thing about my Reservation Rewards entry is that I get emails every day or two from people asking me how to get them to stop taking their money. There are, in fact, over 1,000 testimonials (including my own entry) explaining exactly how to get them to stop charging. Every few months, I receive an email from someone furious at me for charging them all this money. I wonder who these people are who get as far as doing a Google search to find my entry, but can’t seem to figure out that I have nothing to do with the company.

Edd Dumbill: Live from XTech

Well, it's finally arrived and here I am in the middle of it all.
Rails fun

The week kicked off with Matt and I teaching our tutorial on Ruby on Rails. It was the first time we've taught on that topic, so we were interested to hear the opinions of the attendees. We embarked on a fast-paced day-long tour of Rails features, with a large amount of live coding on screen.The aim was to give attendees an understanding of Rails as an environment for developing web applications, to let them see how fun it was to code (especially tests) and provide a bucket full of jumping off points for them to pursue their own investigations. With six or seven deployed Rails applications between us, we're in a good position to talk as real-world developers.
I think we pretty much succeeded. During the day we saw many places to improve the material and the flow, but the concept was sound. Teaching together meant we gave each other energy, humour and support. From the feedback, everybody was kept entertained and engaged as well as educated. Folks went away with the slides and the source code for the application we developed over the day. We thought about making our own course notes, but really there's nothing better than the Pragmatic Rails book, so there didn't seem much point in duplicating that effort.
We'd certainly like to do it again, and we're interested in visiting companies interested in Rails to bring their developer teams up to speed: we've already heard from one company attending the conference about that. So do get in touch if that interests you.KeynotesPaul Graham kicked off the conference with a provocative keynote comparing the conditions in the EU and US, and their suitability for stimulating startup companies. This has already sparked off a lot of discussion on the web, which is great to see. I'm really grateful to Paul for travelling a long distance to speak to us.We also heard from Jeffrey McManus of Yahoo! (I can never write "Yahoo!'s Jeffrey McManus" because the consequent train-wreck of punctuation upsets me). He shared the remarkable number of APIs and places where Yahoo! lets developers hook into their data and services. There's so much in there, I resolved to put some serious time aside to investigate what I could make use of.
CoverageThe site I set up for last year's conference, Planet XTech, is doing a great job aggregating blog coverage of XTech again this year. It's a great way for people here, and those following from a distance, to keep up with what's going on. Some folks are blogging really detailed notes, which is fantastic for the talks I've not been able to get to.Next yearIn a couple of weeks' time, I'll start thinking about next year's conference. I'll try to pull together what we've learned this year to make XTech even better. One thing we know already is that this year is our last in Amsterdam. We've been here three years and had a lot of fun. Next year, we're heading to Paris, which will be wonderful.Please do write to me with any comments and suggestions about XTech. One idea I'm playing with is the idea of a smaller related event later in the year, focused on educating people about web technologies.

Andrew Pollock: [debian] Hacking on d-i again

It feels like (probably because it is) about 2 years since I last had a good fiddle around with Debian's installer. It's been fun to have another play in the last week or so. I've been on a mission to vanquish the ISC DHCPv2 packages, and I can't do this until the installer stops needing to use the udeb for dhclient. Previously, the dhcp3-client udeb had been way too big for the job (apparently it's the OMAPI stuff that gets linked in, I'm told by David Hankins from the ISC). Matt Zimmerman had thrown around the idea of using ipconfig from klibc-utils quite some time ago, but it's taken me this long to get the spare time to look into it further. Hacking the netcfg udeb to support ipconfig as a DHCP client was relatively trivial. dhcp.c wasn't too hair raising, and so I rebuilt the installer with my modified netcfg udeb and a udeb I made from the klibc source package, and it worked. However, it's not as simple as that (it never is). There's a couple of special cases as I discovered when hacking dhcp.c in netcfg:
  1. with the DHCPv2 client, it adds a dhcp-class-identifier attribute (vendor-class-identifier in DHCPv3) set to "d-i". ipconfig is extremely lightweight. It can't add custom attributes, and apparently this attribute does cool stuff in relation to preseeding (although I haven't got a good handle on exactly what yet).
  2. The other problem is related to a bug (I even remember it - #239591), where the hostname is optionally sent in the DHCP request. ipconfig doesn't appear to support that either, although in theory it should. One of the ways of invoking it includes providing the hostname, so I filed a wishlist bug regarding that, after emailing the upstream author.
So, my work in this instance is probably all for naught, but it was fun anyway, and it's something I've been meaning to do for absolutely ages. It is also hopefully a moot point, as apparently the space issues aren't so bad any more, so in theory the dhcp3-client udeb will now fit. The next dhcp3 upload will provide a dhcp3-client udeb again, so we'll see what happens on that front...

Ted Walther: Why didn't King Solomon kill the two prostitutes?

On the long bus ride back from the Mexican pyramids, I got to think about a long standing problem. If Israel's laws forbade prostitution, why didn't Israel's greatest judge enforce those laws? We've all heard the story of King Solomon and the two harlot's, where he finds the real mother by threatening to chop the baby in two. Since the laws of Israel carried a death penalty for adultery, why didn't Solomon enforce it? People today equate prostitution with adultery, but the Bible does not. Not always. As the wisest man who ever lived, a walking embodiment of true justice, Solomons judgement deserves a deeper look. Here is the text of the whole incident:
1 Kings 3:16-28 Then came there two women, that were harlots, unto the king, and stood before him. And the one woman said, O my lord, I and this woman dwell in one house; and I was delivered of a child with her in the house. And it came to pass the third day after that I was delivered, that this woman was delivered also: and we were together; there was no stranger with us in the house, save we two in the house. And this woman's child died in the night; because she overlaid it. And she arose at midnight, and took my son from beside me, while thine handmaid slept, and laid it in her bosom, and laid her dead child in my bosom. And when I rose in the morning to give my child suck, behold, it was dead: but when I had considered it in the morning, behold, it was not my son, which I did bear. And the other woman said, Nay; but the living is my son, and the dead is thy son. And this said, No; but the dead is thy son, and the living is my son. Thus they spake before the king. Then said the king, The one saith, This is my son that liveth, and thy son is the dead: and the other saith, Nay; but thy son is the dead, and my son is the living. And the king said, Bring me a sword. And they brought a sword before the king. And the king said, Divide the living child in two, and give half to the one, and half to the other. Then spake the woman whose the living child was unto the king, for her bowels yearned upon her son, and she said, O my lord, give her the living child, and in no wise slay it. But the other said, Let it be neither mine nor thine, but divide it. Then the king answered and said, Give her the living child, and in no wise slay it: she is the mother thereof. And all Israel heard of the judgment which the king had judged; and they feared the king: for they saw that the wisdom of God was in him, to do judgment.
Whoredom, harlotry, prostitution; they defile the land. When Judah thought his daughter-in-law Tamar had become a harlot, he ordered her to be burnt. The problem was not with the sex for pay, but with violation of Judah's property rights. Tamar had been bought and paid for, and belonged to his family for the purpose of increasing their manpower. Biblically, sex for pay is fine. A ketubah (marriage contract) guarantees a woman a certain financial allowance in return for performing her sexual duties. The problem is that prostitution lowers the birthrate of the population, thus reducing its manpower, thus reducing its brainpower, thus reducing its ability to protect and defend itself. The connection between prostitution and lower birth rates isn't obvious to the layman, so just take it for granted right now.
Leviticus 18:20,28 Moreover thou shalt not lie carnally with thy neighbour's wife, to defile thyself with her. That the land spue not you out also, when ye defile it, as it spued out the nations that were before you. Leviticus 19:29 Do not prostitute thy daughter, to cause her to be a whore; lest the land fall to whoredom, and the land become full of wickedness.
Prostitution can fall into two categories; the woman is still the property of her father, or she belongs to a husband. Widows, divorced, and single women fall into the category of belonging to their fathers; they have a right to return to the family home and be supported there. How would a father prostitute his daughter? If he treats her harshly, refuses to marry her off to a suitable husband, does not feed or clothe her, train her or discipline her, she may well turn to whoredom to support herself. Look closely at the story of the two harlots. They say they have no man. They fall into the category of single women. Sex with a single woman is not adultery. Adultery carries the death penalty, but as single women, their prostitution was to be regulated by different laws. If a girl took up the prostitution trade, and then got married under false pretenses, pretending to be a virgin, the penalty was death. However no death penalty is indicated for the circumstance where the woman and her family were up front about her past. A man taking a wife needs to be able to accurately assess the risks of disease and future infidelity.
Deuteronomy 22:13-21 If any man take a wife, and go in unto her, and hate her, And give occasions of speech against her, and bring up an evil name upon her, and say, I took this woman, and when I came to her, I found her not a maid: Then shall the father of the damsel, and her mother, take and bring forth the tokens of the damsel's virginity unto the elders of the city in the gate: And the damsel's father shall say unto the elders, I gave my daughter unto this man to wife, and he hateth her; And, lo, he hath given occasions of speech against her, saying, I found not thy daughter a maid; and yet these are the tokens of my daughter's virginity. And they shall spread the cloth before the elders of the city. And the elders of that city shall take that man and chastise him; And they shall amerce him in an hundred shekels of silver, and give them unto the father of the damsel, because he hath brought up an evil name upon a virgin of Israel: and she shall be his wife; he may not put her away all his days. But if this thing be true, and the tokens of virginity be not found for the damsel: Then they shall bring out the damsel to the door of her father's house, and the men of her city shall stone her with stones that she die: because she hath wrought folly in Israel, to play the whore in her father's house: so shalt thou put evil away from among you.
Suppose a single woman was to work as a whore. What is the penalty? For the girl, no penalty at all. If she is a virgin turning her first trick, the man has to pay a hefty fine of fifty shekels to her father, who has the choice of giving her in marriage or not.
Exodus 22:16,17 And if a man entice a maid that is not betrothed, and lie with her, he shall surely endow her to be his wife. If her father utterly refuse to give her unto him, he shall pay money according to the dowry of virgins. Deuteronomy 22:28,29 If a man find a damsel that is a virgin, which is not betrothed, and lay hold on her, and lie with her, and they be found; Then the man that lay with her shall give unto the damsel's father fifty shekels of silver, and she shall be his wife; because he hath humbled her, he may not put her away all his days.
When she is no longer a virgin, her father either allows her to be a prostitute, violating the law at Leviticus 19:29, or he doesn't allow her. If her father allows her, then he becomes liable for her behavior and she is not punished, as described in Hosea 4:13,14 quoted below. If her father doesn't allow her, she is again subject to the death penalty, as set forth in the next set of verses:
Deuteronomy 21:18-21 If a man have a stubborn and rebellious son, which will not obey the voice of his father, or the voice of his mother, and that, when they have chastened him, will not hearken unto them: Then shall his father and his mother lay hold on him, and bring him out unto the elders of his city, and unto the gate of his place; And they shall say unto the elders of his city, This our son is stubborn and rebellious, he will not obey our voice; he is a glutton, and a drunkard. And all the men of his city shall stone him with stones, that he die: so shalt thou put evil away from among you; and all Israel shall hear, and fear.
In the case of Solomon's two harlots, there is no evidence at all that their father disciplined or otherwise acted to prevent them from their trade. Perhaps their father was dead, but in that case his responsibility to his daughters would have fallen on his next of kin. It really is a matter of family responsibility, not of persecuting individuals. There is one remaining corner case; what of the married woman who becomes a prostitute? What if the two harlots had been married after all? It is a principle of the Torah that it must be applied equally. You cannot hit one party with the full penalty then let another get off free for the same crime. It is better to err on the side of mercy, so if you do not convict one, you should not convict another. This is violated daily by un-Godly governments who selectively enforce their laws to "make examples" of people. Such selective enforcement is neither fair or just. In Solomon's case, assuming the women were married, the other parties to the crime of adultery were missing. Without them, there was no way to proceed. This is why Jesus was able to say "Let he who is without sin cast the first stone." The two witnesses rule also comes into it; before a person can be put to death two witnesses to the crime are required. Solomon's two harlots had no witnesses against them. When people engage in false worship, and use the services of whores, God will not punish the women who turn to adultery and infidelity. He will punish those who are responsible; the men, who failed to take their patriarchal prerogative in setting a good example of just, fair, respectful, and temperate behavior.
Hosea 4:13,14 They sacrifice upon the tops of the mountains, and burn incense upon the hills, under oaks and poplars and elms, because the shadow thereof is good: therefore your daughters shall commit whoredom, and your spouses shall commit adultery. I will not punish your daughters when they commit whoredom, nor your spouses when they commit adultery: for themselves are separated with whores, and they sacrifice with harlots: therefore the people that doth not understand shall fall.
If you have any Torah questions, feel free to write in to ted AT reactor-core DOT org.

Eric Warmenhoven: Cingular sucks.

Lisa has been thinking for a short while that she’d like to get a Motorola RAZR phone. We were AT&T Wireless customers, which now makes us a weird type of Cingular customer where we not only have our AT&T plan, but also special AT&T customer service representatives (which I’ll get to in a bit). So we went into our local Cingular store and she asked about getting the shiny new black RAZR, and they said that it wouldn’t be a problem, they’d just need to upgrade our service, and since we’re on the same plan and the service is changing, I’d need to upgrade my phone as well. AT&T Wireless has a email-to-SMS gateway and gives every phone its own email address, yournumber@mmode.com. Since AT&TWS only charges if you send a message but not if you receive a message, I use it all the time (mostly for stock quotes but also for various other things). So in an average month I probably receive 30-50 emails on my phone, as well as the occasional spam, all of them free. Cingular has the same service, yournumber@cingularme.com. But unlike AT&TWS, Cingular charges you both for sending and receiving messages. (”Text, Instant, and Multimedia messages are charged when sent or received, whether read or unread, solicited or unsolicited.”) So my 30-50 messages a month are going to cost me $3.00-$5.00 a month. Of course, I could always get a package, which will limit those 50 messages to just $3.00. Or I could get a $20 package that lets me receive 2500 messages. That’s not the point. The point is that once that limit is hit, it goes back to $0.10 per message, regardless of the plan. That means that some evil person can send you thousands of messages and you could end up owing hundreds of dollars. The only way to prevent that is to call Cingular and turn off the E-Mail Messaging feature from your service. (You can use the Message Center to “Create block and allow lists to limit e-mail messages received” and “Control what times of day your phone can receive e-mail messages.” Also it looks like you can block email containing some spam attributes. But none of those things guarantee that you’re not going to get a bunch of junk.) I tried calling Cingular to confirm this, and when I entered my phone number, it redirected me to AT&TWS customer service, who confirmed that AT&TWS does not charge for receiving text messages, and confirmed that Cingular does charge for receiving messages, but did not have an answer for how Cingular deals with spam. In fact, they didn’t seem to have a lot of information about the Cingular service at all, other than how to “upgrade” my account to a Cingular account. I had to call Cingular sales, who also didn’t know the answer to how to prevent abuse; but they were able to transfer me to Cingular customer service, who confirmed that yes, I really do have the potential to get screwed if I don’t turn off E-Mail Messaging.

17 May 2006

Bernhard R. Link: When things suddenly go very fast

or in other words:
     grep -s -q 'dn\.regexp' /etc/ldap/slapd.conf && cat <<EOF
     Ha ha, sucker! Ever asked yourself why your ldap database is so fsck'ing
     slow despite all the caches and indices you added?
     EOF
     

Jonathan McDowell: Silver vs White Gold vs Platinum

So I need to get a wedding ring. Given I hope to wear it for the next 50+ years and that I've worn a ring in the past I figured something more interesting than a plain band would be nice. Many years ago Kathy bought me a silver Celtic style ring I was fond of, but unfortunately I lost it a while ago, which was upsetting, so I thought it would be nice to get a wedding ring that was similar to the lost ring. However. I don't like gold. So the logical choice seemed to be white gold. Until a jeweller told me that it was plated which would wear over time and require replating every few years. Which is a bit offputting. Anyone any experience of this? I've seen mention of getting it replated with a thicker than normal coating, which makes it less likely to require regular updating? The other options seem to be silver or platinum. Does anyone have silver wedding rings? Does it last well enough? It's a lot cheaper; is that the only reason why they're not common or is there something more fundemental? Platinum is more expensive than white gold, but that's not a huge issue for the last ring I plan to wear. Is it harder to work though, making it less likely that I'll find what I want? I found a ring at Ortak that I like, but no platinum option and I'd want to see it before buying, so online is out. Can anyone suggest a decent jeweller to talk to in Norwich? I've had a look around but not seen anything matching what I want. Alternatively I guess I can look in London.

Ted Walther: Report from Debconf, Day Three, Part II

X Window security. Wandered outside the hack lab to sip a drink and cool down. There I saw Keith Packard and Bdale Garbee. Quickly introduced myself to them both, then asked Keith what his take was on the recent OpenBSD complaints that X11 is insecure by design [1] [2]. Keith said he wasn't going to respond to those complaints, because DRI/DRM already provides what Theo de Raadt says he wants in the way of kernel control over dma and register access on video cards. Many X11 video drivers are not yet converted over to doing things the DRI/DRM way, and so Theo is correct that X11 has huge security holes. But they are not permanent; the future is already arriving. Although DRI/DRM is positioned as a 3d technology, it is intended that even 2d drivers in the future will conform themselves to its API. Keith also said that OpenBSD's representative on the X11 team is easy to work with and cooperates well with the team, so there is hope that if OpenBSD turns its attention to X11 support, everyone will soon benefit from the comprehensive security audit. Although the DRI/DRM design solves the security problems, it is a bitch to implement. Mode switching alone is so finicky and is so tied into both the video hardware and x11 server optimizations, that it has never successfully been implemented in the kernel. Keith said he supported the idea of isolating the mode switching code out into a small, privilege separated userland utility. There were many other things said, which sounded positive, but without the aid of a tape recorder, I can't remember them. Putting packages out of main. Learnt a trick today, courtesy of Phil Hands and Ralph Amissah. If you want to upload a package into a part of the distribution other than main, you alter the Section: field of the debian/control file in your package. Suppose your package fits into the text section, because you use it to process text. Maybe you reimplemented awk. If you put Section: text the package will go into the text portion of the main repository. If your version of awk depends on a library that is in the non-free section, you would put it in the contrib section. So you would put this in your debian/control file: Section: contrib/text and Bob's your uncle. Politics. I find myself doing vastly more politics at this conference than coding, although I am getting some of that done too. When people are deep inside their own worlds, it takes a lot of work to bridge between the worlds. So far it seems like time well invested. Embedded. If anyone needs any embedded work done, Wookey is your guy. Send him an email with a proposal.
  1. 2006-05-11 22:00:04 Re: security bug in x86 hardware (thanks to X WIndows)
  2. 2006-05-13 20:07:35 Re: security bug in x86 hardware (thanks to X WIndows)

16 May 2006

Benjamin Seidenberg: Hello, World!

So, thanks to Wouter Verhelst, I am now syndicated on Planet Debian, a site that aggregates the blogs of various people involved in Debian. To those who don’t know me yet, I am an 18 year old high school student (for a couple more weeks anyway) in the United States. I go by ‘astronut’ on IRC, and have completed my part of NM and am now patiently waiting for FD/DAM approval. I maintain easyh10 (manages the databases on the iRiver H10 music player), dav-text (simple ncurses based text editor), graphmonkey (a somewhat pointless graphing calculator that somehow has at least a few users according to popcon) and recently adopted pork (console AIM client). I also am an active member on the Debian Cyrus Packaging team (Cyrus is a pop/imap/nntp server). Comments are currently enabled, but moderated on the blog. I may have to go to some kind of turing test based system if planet opens me up to a flood of spam. So… Hello, to the word of Debian!

Ted Walther: Report from Debconf, Day Three

Laundry day. New roommate Thaddeus Black is really on the ball; today is the first laundry day we've had at the conference, and he was prepared for it, and reminded the rest of us when we woke up. I think I'll wait until the Thursday laundry day. To get your laundry done here, you put it in a plastic bag, and mark it somehow. Then the bags go into a pile, and some company hired by the hotel comes and washes them, and returns the bags of clean clothes to you the same or next day. You can even choose between regular drying and sun drying the clothes. Debian. Yesterday someone filed a bug against my expect package; today Alec Berryman sent in a patch that fixed it. Thank you Alec! The fixed package is now uploaded and should be available to everyone tomorrow. Food. Ville Vuorela brought a big bag of candies from Finland for Simon Richter, who shared them with the table here in the hack lab. They were salty and sweet, with mild licorice flavor. They were quite good. My friend Jesus Monroy, a food columnist in the San Francisco Bay Area, had a few comments on my food adventures yesterday, which I will quote here:
Pancita is Spanish for stomach. Most likely you had a type of menudo, or soup dish. This is a very common and popular dish. Usually used for hangovers. Check the chicken vendor's spices when you can. With some hope he did not use MSG. MSG, as you may know, can be toxic in large amounts. It's not unheard of in Mexico, but they don't know that MSG can be toxic. My mother has refused to eat at some friends houses because they use so much the chicken tastes extremely over-salted. MSG toxic effects are lathargy, nausea, headaches, all the way to death (very extreme). Then again too much salt, or just water, can be toxic. As for the church, they have not changed much in 500+ years in Mexico. Most likely what you saw was what was built.
Conference. Today I attended the one presentation that motivated me to attend Debconf; Peter van Eyndes Common Lisp presentation. Common Lisp, of course, is the best programming language ever, in terms of developer time. Haskell is similar, but is designed more for machines to run fast, than for developers to develop fast. The LISP community has almost universally switched to using darcs for their revision control system, which is not only the easiest to use I have ever found, but is also written in Haskell. Nine people attended Peters presentation. He showed us how to drive the Lisp compiler from inside emacs using slime, with its advanced auto-completion features. He demonstrated the common lisp controller which has advanced dramatically in the past five years. It is now simple and intuitive to load libraries into your Lisp program. He showed us how to package lisp libraries using asdf, which has long been an opaque mystery to me. Luca Capello fom Switzeland, the maintainer of the stumpwm window manager was present, and he promised to demonstrate stumpwm later tonight. stumpwm is not yet as advanced as ratpoison, but it could become far more advanced and whiz-bang than ratpoison could ever be. It has potential. I also met Erick Lopez of Mexico, who wants to package cl-wiki, but is looking for a sponsor. As a Lisp developer, he will be an asset to Debian. After the presentation Peter opened the floor, and every question I'd had about Lisp for the past few years was answered very satisfactorily. At the end, Peter showed us a book called Practical Common Lisp, by Peter Seibel, which he praised highly for those who want to use Lisp for "real" things. Such as a streaming MP3 server. I'm sold! But if you are poor (povre), you can read it for free at Gigamonkeys.

Next.

Previous.