Search Results: "ema"

17 January 2007

MJ Ray: koha 2.2.8 installer

This email in French asks after my ITP Koha bug and mentions using the list of debian package deps to build most of the dependencies which I only finished building like 3 days ago. You wait ages for a koha/debian developer, then two come along at once.

MJ Ray: SPI: Communications 2

Even less surprisingly, my request that the Software in the Public Interest board try to repair SPI's member communications was postponed. The request was submitted before the December 2006 meeting and now won't be heard until February at soonest. SPI president Bdale Garbee apologised. At least the Spanish resolution was decided (referred to board 2005-11, resolved 2007-01). Meanwhile, on the mailing lists, SPI board member Ian Jackson flamed me again and proposed a resolution which adds lots of red tape, unnecessarily links submissions to announcements and ignores SPI's email and web problems. On the previous post, Bruce Byfield commented:

"I'm sure my bias creeps into many stories, no matter how fair I try to be, but I really don't have much of an opinion on the domain name issue. My main interest is that it's newsworthy. Under these circumstances, I have a hard time seeing how I could have much of a different view from anyone."

I agree. It's hard to see how the newsforge article could have been much different. Is it newsworthy that SPI's board continued voting without discussion at yesterday's (2007-01-16) meeting? No-one wants meetings to last hours, but it's essential that the board put something of their views into the official proceedings. Votes should not be totally set in advance. Otherwise, how can SPI members oversee? How can they make a well-informed decision whether or not to re-elect a member? Now members have to hope they are on the right mailing lists (open or closed) at the right time because the public record is so incomplete.

Eddy Petrișor: disable the pcspkr - hacks

I blogged 5 days ago about the annoying beeper and different methods that were supposed to turn it off.

I asked for a clean solution, but I received suggestions for some hacks. Now I decided to make a new post since there was a comment added today and I remembered about a possible hack (dpkg-divert) I was thinking about.

Now here are some of those hacks and the reason behind rejecting them.

I thought at some point of using dpkg-divert, as opposed to deleting the module, but this is suboptimal. And I am not sure dpkg-divert would work for such a whacked "use case"
Using a hardware method is also suboptimal, for several reasons:

I will hear the beep if I don't plug in the dummy jack
the same goes when I am using a headset - the volume is loud and seems to not be affected by the general sound volume, so it would be disruptive and annoying while listening music and typing the wrong command;
the Intel HDA sound driver lacks headset jack detection in the current Debian kernel. This means there is no effect if I plug such a jack

The default beeping should be disabled by default, still, that would partly solve my problem. I could set that in my .inputrc file or system wide, still, that would mean a beep on some occasions (like gdm log in) - not sure if this would mean it would be more scarier, since it happens rarely or not :-)

Still, the question remains, why don't the originally proposed methods work, especially blacklisting?

Update: the headphones jack works with some small changes, bug submitted (#407252)

16 January 2007

Miriam Ruiz: I might not be able to go to DebConf7

I sent an email to my boss a couple of weeks ago, asking for some days in June to be able to go to DebConf7. I wanted to buy the plane tickets as soon as I could, to be able to get a lower price. Last year they weren’t very happy about us having our holidays whenever we wanted, so this year they’ll probably decide that we must take them in August, whether we want or not. They’re having a meeting one of these days, if they find some time to do it, to discuss about that stuff, so I might find out soon whether I’ll be able to go or not. Or maybe I won’t be able to know until some days before, who knows. I was very happy about going to EDI this year, so if I cannot go, and if the perspective is that I’ll never be able to go to a DebConf again, unless they’re in August, I might need to start thinking about finding a solution, even when it might be quite drastic. I’ll keep you informed.

Benjamin Mako Hill: Geography Lesson

I gave a talk at a the Boston Ruby group last Wednesday. The meeting was generously hosted by the Boston start-up Back Channel Media. On the way out, BCM offered attendees schwag in the form of branded inflatable globes and Slinkies. On Thursday, I suggested to SJ Klein and Seth Schoen that we might be able to use the globe as a research aid during the MIT Mystery Hunt. That seemed like a good idea until they pointed out that there were a few inaccuracies on the map. Sure enough, a quick glance revealed that:

Burkino Faso is marked as Upper Volta (it's only been 22 years) with a capital as Duagadougou.
Rwanda seems to be a small horizontal bar across a country marked both as Ucanda and Buhuno.
Zimbabn is labeled clearly while Morocco, clearly divided into two countries, is not marked in either of the resulting (and differently colored) states.
A missing border and a color identical to the ocean (!) renders Egypt completely underwater. Yemen, Iraq, Thailand, Romania, Austria, Croatia, Finland, (whose name is missing), and the eastern quarter of India are better off in that they blend into the ocean but have river colored borders demarcating them from the rest of the sea.
The Arabian peninsula is host to Qatah, the United Arab Emiraies, and the Saudi capital of Rivaiih.
A bit to the north, Jurdan borders Irae and Lebanaw.
The countries Czek and Slovak seem to be located just above Czechoslovakia which, in turn, is just above Huudatn.
A similar situation happens in Yugoslavia which seems to be next to Monienegro and other more familiar Slavic states.
Amstercam is right next to the the German city of Roro.
Swirzerlano sits in the middle of Europe.
England's Lworpool and Rirmingham are clearly, and clearly incorrectly, marked.
Both Russia and the Commonwealth of Independent States are clearly marked while China, despite having dozens of its cities labeled, is not.
St. Petersburg seems a full 1000+ kilometers from any body of water and closer to Bellarussian than to a port.
Lapan shows many cities including Tokya, Kyole, and others -- while most seem to be located somewhere off the coast of Lapan in the Pacific ocean.
The Korean peninsula contains N. Korea and S. Aurla.
Myanmar is marked as Burma (although I might forgive that one if I had reason to believe it was intentional).
Malaysia is labeled Malaskia.
The continent at the South Pole is proudly marked Tarctica.

Of course, this list is extremely incomplete. I've barely looked at cities, rivers, and even some country names and I've barely looked at the degree to which the cities and labels are correct but incorrectly placed. The full list of errata would, in a manner reminscent of English As She Is Spoke, be very, very, long. While the globe does not bear any markings of a producer (I wouldn't want to take credit for it either), a group of us suspected that we might be able to find the country of origin by locating the one country that was represented completely accurately. We couldn't find a single one.

Sam Hocevar: Exposing file parsing vulnerabilities

Binary file parsing is difficult. There is a lot of byte swapping, offset computation and magic bit mask handling involved. Add to that the fact that many binary formats were reverse-engineered and do not even have a public spec, are so convoluted that there is no way to write a decent parser, or have so many buggy writer implementations that the readers need to accommodate for that. Media players, web browsers and email clients are probably the most exposed ones. These programs are full of bugs, not more than any other program, but more dangerous bugs. Admit it, you just play any video you find on the Intarweb, click any image link and read your email (seriously, even mutt uses antiword to read .doc attachments). It is no longer necessary to have network listening services to be exposed to security issues, the users themselves listen to the world. Using my fuzzing tool zzuf that I eventually decided to release, I found more than 40 bugs in common Unix tools, popular media players and other utilities, simply by reading valid files and slightly corrupting them. The most scary ones are the media player bugs:

	VLC	MPlayer	xine	FFmpeg (ffplay)	GStreamer (gst-launch)	mpg321	ogg123
MP3	robust	`SIGSEGV`	robust	robust	robust	robust	N/A
Ogg Vorbis	robust	`SIGSEGV`	robust	`SIGSEGV`	`SIGSEGV`	N/A	robust
MPEG-1	`SIGSEGV`	`SIGSEGV`	`SIGSEGV`	`SIGSEGV`	robust	N/A	N/A
MPEG-2	`SIGSEGV`	`SIGSEGV`	robust	`SIGSEGV`	`SIGSEGV`	N/A	N/A
MPEG-4 AVI	`SIGSEGV`	`SIGSEGV`	`SIGSEGV`	`SIGSEGV`	deadlock?	N/A	N/A
FLAC	robust	`SIGSEGV`	robust	heap corruption	robust	N/A	`SIGFPE`
Ogg Theora	robust	`SIGSEGV`	robust	`SIGSEGV`	robust	N/A	N/A
WMV	`SIGSEGV`	`SIGSEGV`	N/A	`SIGSEGV`	robust	N/A	N/A
AAC	heap corruption	`SIGSEGV`	`SIGSEGV`	N/A	N/A	N/A	N/A
AC-3/A52	`SIGSEGV`	robust (I KID YOU NOT)	robust	`SIGSEGV`	N/A	N/A	N/A

Each of these segmentation fault bugs is a potential security hole in Debian. zzuf also found bugs in Firefox, Openoffice.org, antiword, ImageMagick and even objdump. And there is more to come.

15 January 2007

Biella Coleman: Absence makes the heart grow fonder

So so so so I am in the airport in Minneapolis, about 2/3 into my mega-trip from PR to Edmonton and decided to jump online since I have over 3 hrs in the airport. And today is the first day in about a month I have used high speed Internet access and it is, well, beautiful, at least compared to the dial-up I was using at home, which was pretty painful, especially because the slowness was compounded by the mosquitoes flying above me, reminding me of how annoying it was to be online. So I usually ditched the whole experience in favor of the more reliable meat world. Here and nw the speed almost feels magnified. It is like faster, better.. plainly hotter. It reminds me of the time that I quit coffee for months and then I started again. It was like drinking coffee and caffeine for the first time all over again. So I gues what I should try next is to quit coffee and high speed internet together for a few months and then start them together.

Steve Kemp: Would you choose to walk or stay

Once upon a time I wrote a collection of shell scripts for managing virtual hosting. Combined these allow me to “easily”:

Add/Remove/List Apache2 virtual hosts.
Add/Remove/List virtual domains for use by Exim4.

These work well, but every now and again I think “I want a web-based control panel”. After mulling this over for a while and remembering how many of the existing control panels are tricky I’m actually going to do it. There are two hard parts:

The user-interface is key.
The format I’m using for domains isn’t appropriate.

The last point is the part I’m worrying about right now. So far I have a list of mail domains, and a list of web domains - and the two are unrelated. This becomes obvious when they are listed:

Domain	Facilities
steve.org.uk	MAIL
bar.steve.org.uk	WEB
foo.steve.org.uk	WEB

See? No link - I’d expect to see the domains listed as just “steve.org.uk” with links to “Mail” showing the mail setup, and “web” showing the subdomains. Or maybe they really should be listed seperately - I can’t decide. (For reference here is my live listing of domains - where the problem becomes obvious. Note that you’ll not have permissions to see my server stats…) So I need to decide how to handle this - I also need to be "inspired" by OSWD. I think the plan right now is to store all data in a database, then regenerate the plain text configuration files on demand. That should give me the best approach - if I restrict myself to running HTTPS on a custom port and avoid the ability to modify the files by hand… Feel free to tell me this is misguided, or inspired. Although I remember the last time I talked about control panels and I’m still not seeing a good solution. I want to be able to:

Add/Remove/Enable/Disable apache2 virtual hosting setups.
Add/Remove/Enable/Disable exim4 virtual domains - with optional mailing lists (ecartis)
Have only “server admin” vs. “nobody” - no resellors etc.
Avoid PHP like the plague.
Have it be utterly secure. (Ha!)

Meike Reichle: Difficult nicks and a new domain

When I was home for christmas there was also a class reunion. As it is with such occasions I had to give out my email address a number of times. Now, when I chose my domain I decided to use my online nick (alphascorpii) since it was adequately unique to be still available and could easily be associated with me. However, my nick is almost only used in writing and thus mostly copy-pasted or entered using tab-completion. Those who do use it in real life too know how it's spelled (or at least pronounced). At the reunion though I had to spell it out for a few people and the 'ph' and even more the 'ii' often caused confusion. As a result of this, alphascorpii.net can now also be reached via a10i.net! I hope this will simplify things for those who are not familiar with Alpha Scorpii.

Russell Coker: LCA talk

This afternoon I gave a talk at the Debian mini-conf of LCA on security improvements that are needed in Debian, the notes are online here.

The talk didn't go quite as well as I had desired, I ended up covering most of the material in about half the allotted time and I could tell that the talk was too technical for many audience members (perhaps 1/4 of the audience lost interest). But the people who were interested asked good questions (and used the remainder of the time). Some of the people who are involved in serious Debian coding were interested (and I'll file a bug report based on information from one of them after making this post).

I believe that I was quite successful in my main aim of giving Debian developers ideas for improving the security of Debian. My second aim of educating the users about options that are available now (with some inconvenience) and will be available shortly in a more convenient form was partially successful.

The main content of my talk was based on the lightning talk I gave for OSDC, but was more detailed.

After my talk I spoke to Crispin Cowan from Novell about some of these issues. He agrees with me about the need for more capabilities which I take as a very positive sign.

Russell Coker: top 10 girl geeks

We have a list of 10 (famous) girl geeks from CNET and one from someone else.

The CNET list has Ada Byron, Grace Hopper, Mary Shelly, and Marie Curie. Mary Shelly isn't someone who I'd have listed, but it does seem appropriate now I think about it. Marie Curie is one of the top geeks of all time (killing yourself through science experiments has to score bonus geek points). I hope that there are better alternatives to items 4, 7, 9, and 10 on the Cnet list.

The list from someone else has 9 women I've never heard of. If we are going to ignore historical figures (as done in the second list) but want to actually list famous women then the list seems to be short. If we were to make a list of women who are known globally (which would mean excluding women who are locally famous in Australia, or in Debian for example). The only really famous female geek that I can think of is Pamela from Groklaw.

The process of listing the top female geeks might have been started as an attempt to give a positive list of the contributions made by women. Unfortunately it seems to highlight the fact that women are lacking from leadership positions. There seem to be no current women who are in positions comparable to Linus, Alan, RMS, ESR, Andrew Tanenbaum, or Rusty (note that I produced a list of 6 famous male geeks with little thought or effort).

Kirrily has written an interesting article on potential ways of changing this.

Martin F. Krafft: Status of my book

The wait for Debian sarge was long and painful for me, because I was trying hard to synchronise the publication of my Debian book with it, and much to my own surprise, the book was done before sarge was ready, and I had to wait. In the end, the tome left the presses only a little more than 24 hours after our release managers announced Debian 3.1 in July 2005, bundled with the second release of the official DVD, 3.1r0a. Since then, the volume has been reviewed numerous times and praised by many readers. I was especially honoured to find the title in the top ten list of most favourably reviewed books by one of my most respected reviewers, Richard Bejtlich. We are now approaching the release of Debian etch, version number 4.0, and a lot of stuff has been added or changed in Debian. I have received more than 150 emails since the etch freeze announcement, asking about an updated edition for etch, and while I am most gratious for all the feedback (and can't deny a certain amount of pride), I have to disappoint my readers, at least for now. I have not had the time to update my text, and thus cannot synchronise a new edition with the release of etch. There are a number of reasons: first, shortly after the publication of the original edition, I suffered from several physical problems, which in the end all pointed to severe muscle deformations in my back from years of wrong posture sitting at the desk. Now, one and a half years after the first symptoms appeared, I've been through numerous therapies and even though the net result is positive, I am not over the problems yet. Thus, I still try to minimise the time spent on a computer, and getting a second edition of the book out would achieve quite the opposite. Second, I am busy with my Ph.D. research, so I cannot work on the book much. It has been suggested to me to allocate minimal resources to an update, getting the text ready for etch and postponing new content to another edition. However, I would feel uncomfortable doing that. On the one hand, I'd much rather see my work be relicenced under a Creative Commons licence. So long as that is not possible, I'd rather not make people spend money without getting much in return. My book's to-do list is growing and there are many new topics which I would like to cover in the next edition (for instance: fonts, xen, more packaging topics, including modules, kernel patches, pbuilder, and packaging with version control systems). Thus, with the release of a new edition, I want to provide not only an updated version, but also one with enough content to give a fair return for people's money. I have always thought that updated-but-no-new-content editions are ripping the customers off, so I don't want to go into that direction. I am thus currently looking at the relase of the second edition together with Debian lenny, the Debian release following etch. I am looking forward to much more feedback between now and then. NP: Solar Project / Force Majeure

Ben Hutchings: Mould: not just a flavour of cheese

BoingBoing linked to a previous story about Quorn being allergenic, which I've not heard claimed before. Supposedly about 5% of people have unpleasant reactions to it, which I find a bit hard to believe. I'm curious, though, so I shall make the most of my remaining days of paid account with a not particularly scientific poll:

View Poll: Mould: not just a flavour of cheese

14 January 2007

David Welton: Stuff To Do updates

After two weeks of being operational, Stuff To Do has been a big success at work, because it lets people keep track of what they're doing with a minimum of hassle. Truth be told, I've never been that wild about "productivity" software, but I'm pretty happy with the system I've created. I really have attempted to make something that stays out of your way as much as possible. That has involved making some choices - for instance, instead of buttons to start or stop time tracking for a given task, Stuff To Do [aside: it would be much faster to write 'STD', but I think that might not be such a good idea in terms of marketing] uses some javascript to see if you've moused over (or blurred, or typed, or done anything, basically) to the window where it lives in the last 15 minutes. This will certainly reduce the accuracy a little bit, and if you get 'in the zone' and don't hit the browser for a while, it won't count your time, but all things considered, this is better than having to hit a stupid button every time you do anything, because you will invariably forget to hit the button, and leave it going overnight, and then have to go back and manually edit everything, and.... yuck. I also have some ideas about how to further improve the javascript in order to make it even easier to track whether you're active or not (with your consent, of course!). In any case, I've fixed up a number of small bugs, and added a few new features:

You can now only drag tasks with their title so that you can cut and past text from the 'notes' section.
The notes now use 'markdown' so that you can mark them up some.

Some other things I'm considering for the near future:

Enable sending tasks via email with one or two clicks - this would make it so you could add a default email address (of a bug tracking system, for instance) and automatically submit the stuff you're working on.
"Warp" a task to the top of the list of things to do via a link for each task. You can currently move a task around by clicking, holding, and them moving the mouse scroller, but that's kind of cumbersome.

In the process, I also happened upon Active Merchant, which is some cool code by the fine folks at jadedpixel.com, which was quite handy for integrating Paypal. Being somewhat of a perfectionist, I found a few things that I wanted to do just slightly differently, and sent in a patch.

Adam Rosi-Kessel: iPhone Annotation

Excellent little annotation on the Trademark Blog regarding the iPhone trademark dust-up. Schwimmer concludes:

DISCLOSURE: I HAVE NEVER REPRESENTED EITHER PARTY. I HAVE CLIENTS WHO ARE EITHER ADVERSE TO OR HAVE DEALINGS WITH APPLE (SOMETIMES BOTH). I AM TYPING THIS ON A POWERBOOK. I DOWNLOAD MUSIC FROM iTUNES. MY PHOTOS ARE STORED ON iPHOTO. I WANT TO BUY AN iPHONE.

Ian Murdock: On the importance of backward compatibility

I’m often asked why I’m so obsessed with backward compatibility and, as a result, why I’ve made the issue such a central part of the LSB over the past year. Yes, it’s hard, particularly in the Linux world, because there are thousands of developers building the components that make up the platform, and it just takes one to break compatibility and make our lives difficult. Even worse, the idea of keeping extraneous stuff around for the long term “just” for the sake of compatibility is anathema to most engineers. Elegance of design is a much higher calling than the pedestrian task of making sure things don’t break. Why is backward compatibility important? Here’s a great example, via Joel Spolsky (note: from 2004):

Raymond Chen is a developer on the Windows team at Microsoft. He’s been there since 1992, and his weblog The Old New Thing is chock-full of detailed technical stories about why certain things are the way they are in Windows, even silly things, which turn out to have very good reasons. The most impressive things to read on Raymond’s weblog are the stories of the incredible efforts the Windows team has made over the years to support backwards compatibility: “Look at the scenario from the customer’s standpoint. You bought programs X, Y and Z. You then upgraded to Windows XP. Your computer now crashes randomly, and program Z doesn’t work at all. You’re going to tell your friends, ‘Don’t upgrade to Windows XP. It crashes randomly, and it’s not compatible with program Z.’ Are you going to debug your system to determine that program X is causing the crashes, and that program Z doesn’t work because it is using undocumented window messages? Of course not. You’re going to return the Windows XP box for a refund. (You bought programs X, Y, and Z some months ago. The 30-day return policy no longer applies to them. The only thing you can return is Windows XP.)” I first heard about this from one of the developers of the hit game SimCity, who told me that there was a critical bug in his application: it used memory right after freeing it, a major no-no that happened to work OK on DOS but would not work under Windows where memory that is freed is likely to be snatched up by another running application right away. The testers on the Windows team were going through various popular applications, testing them to make sure they worked OK, but SimCity kept crashing. They reported this to the Windows developers, who disassembled SimCity, stepped through it in a debugger, found the bug, and added special code that checked if SimCity was running, and if it did, ran the memory allocator in a special mode in which you could still use memory after freeing it. This was not an unusual case. The Windows testing team is huge and one of their most important responsibilities is guaranteeing that everyone can safely upgrade their operating system, no matter what applications they have installed, and those applications will continue to run, even if those applications do bad things or use undocumented functions or rely on buggy behavior that happens to be buggy in Windows n but is no longer buggy in Windows n+1… A lot of developers and engineers don’t agree with this way of working. If the application did something bad, or relied on some undocumented behavior, they think, it should just break when the OS gets upgraded. The developers of the Macintosh OS at Apple have always been in this camp. It’s why so few applications from the early days of the Macintosh still work… To contrast, I’ve got DOS applications that I wrote in 1983 for the very original IBM PC that still run flawlessly, thanks to the Raymond Chen Camp at Microsoft.

I can almost feel the revulsion among my readership right about now. However, next time you’re in Best Buy or CompUSA, look at the shelf of Windows applications, then compare it to the shelf of Mac applications, and perhaps you’ll better understand why it’s important. Beyond the results speaking for themselves, I’ll argue that it takes a better engineer to move a platform forward while at the same time making sure things don’t break. It’s pretty easy to wash your hands of something and declare it to be someone else’s problem.

Jordi Mallach: Phone-before-SMTP

Today I woke up with a strong determination to do some badly needed house cleaning. A series of rushed travels have left a few rooms full of stuff all over the place, after I emptied a bag or two to be able to pack on time. Just before going to Tunisia, I decided my wallet was way too fat so I got rid of shopping receipts and other random shit I had in it. That included quite a few PGP keys from people I had been collecting in previous travels, and I had forgotten about. So, armed with my willingness to get rid of all of those dust puppies, first thing I find in the living room is the pile of wallet papers, and my clever procrastinating mind apparently thought it was time to postpone real cleaning; instead I needed to sit down and sign all of those really old PGP keys. Many of you reading this will have got a few emails from me this morning. It was about time! Some of the silly strips of paper dated back to the Open Source World Conference 2004 in M laga, when a decent group of Debian Developers gathered in a really small hacking room and talked about some Debian topics. Signing the keys has let me identify a few non-revoked ids which really should be, as the accounts are no longer valid, etc.; many others have greylisted me for a while and finally accepted my email. There was one mail recipient which may have gone a bit too far with the anti-spam policies, though:

9323170A74B     4007 Sun Jan 14 17:55:38  jordi@nubol.oskuro.net
(host mail-dtag.reichmann.net[62.104.43.214] said: 421 call 09001000057 for admin support (in reply to MAIL FROM command))
                                         alexander@schmehl.info

Alexander, I'm not doing calls to Germany to send your key, but I can resend if you want, once you open up your mail server... (my tries to knoepix.org also failed). It seems I have misplaced a few keys from the Ubuntu Summit in Sydney, but I think I know where to find that sheet. More in 2 or 3 years! PS: dust puppies are alive and well, they managed to survive yet another tough day.

Martin F. Krafft: Firefox handing mailto links to mutt

If you like the mutt email client and have to use Mozilla Firefox, you might like to be able to click mailto: links and have mutt handle them. There are various extensions that promise to take care of this, but none of them worked for me. So I wrote a little script to handle the interfacing. Instructions how to tie it in with Firefox are included in the header comments. Enjoy! Comments, patches, and suggestions welcome. NP: Dream Theater / Awake Update: thanks to the suggestion by Nelson A. de Oliveira, the script now supports the setting of arbitrary headers, including In-Reply-To. This means you can now use it to answer list mail from the Debian list archive pages (but see #406866 and #406867).

Erich Schubert: Config files

Our top-10 female geek "helix" (congrats!) suggested (jokingly) we could do an Ajax interface for configuration files. Well, if you want, you can run a tomcat as root, and have it access your configuration files. If you're crazy enough. :-) No, there are actually secure ways of doing such things, if you want even with Ajax. Just have a secure web server for administration, which will then push the updated configuration file to the actual hosts e.g. via cfengine. Since people still tend do read "all configuration files should be XML", and "but I hate XML": please get down. We already have quite some XML-lookalike configuration files (e.g. apache). We have S-Expressions. We have some deeply nested INI files. We have true XML config files (e.g. /etc/fonts/fonts.conf). All I'm asking is that we should maybe use one single format for all applications that have similar requirements for their configuration. And no, not every application can be sanely configured with a linear, flat configuration file. Sometimes, a tree-based data model is much cleaner. You know, thats why we're using a tree directory structure, and not flat files. And face it, if you like it or not: XML is the most widely accepted choice for exchanging (tree structured) data. And if you manage systems, you want to be able to sanely exchange data between e.g. a configuration management tool and the service you're configuring.

Erich Schubert: DoSing spammers?

Has anyone experience with DoSing spammers by deliberately flooding them with incorrect email addresses? I mean, it should be easily possible to put new (fake) email addreses up on web pages in a huge scale (actually this is an old idea of deterring spammers). Any spammer grabbing them will have his database grow somewhat out of control. At some point they'll probably notice that you have been providing them with bad data, and maybe drop all of your domains' email addresses harvested? Or do they just not care?

Next.

Previous.