In my first article about testing tuxpaint with xautomation, I mentioned that I wasn’t happy with hardwiring button positions. But before I could proceed, I discovered a bug in xautomation that prevented me from using visgrep to search for the “Yes” button in tuxpaint screenshots. Fortunately, the fix was straightforward enough after reading the libpng man page. At the same time, I also decided to borrow an idea from the example scripts in the xmacro package. Running the test script on the tester’s own display may be fine for developing the script, but it is nice to be able to run it on a virtual display after the kinks are worked out. For one thing, the test doesn’t get in the way of other things when you’re waiting for it to finish. For another, it is much easier to control the test environment. Xvfb is perfect for this. The resulting script requires tuxpaint, Xvfb, xautomation with the above patch applied, xbase-clients and Imagemagick.

I'm currently in (the really lovely) Philadelphia airport again, waiting for my connecting flight to San Francisco. I'm rapidly arriving at the conclusion that it is easier to enter the US once you've landed on US soil, than it is to depart from the country bound for the US. I had the most harrowing experience of my life this morning, trying to check in for my return flight. Due to the way various people's itineraries worked out, I ended up having to share a taxi from Badajoz to Madrid Airport at 12:30am. My flight didn't depart until something like 12:20pm, but the bus with the bulk of the people on it wasn't going to get me to the airport with less than 2 hours before departure, and I didn't want to risk missing my flight, especially given I'm feeling under the weather. So I got to the airport at about 4am, having had little sleep in the taxi. Terminal 1 has a real dearth of seating for people waiting to check in. I spent 4 hours trying to make myself as comfortable as possible on the hard floor, and didn't get a lot of sleep then either. For the record, check-ins (at least for US Airways) seem to open around 4 hours before the scheduled departure time. So I went to check in, and the way they were working it was there was a bunch of podiums out the front of what I would consider a conventional check-in counter. The people at these podiums then proceeded to give you your first Spanish Inquisition. I'd previously remarked to myself at how trivial it was to get into Spain... I was asked the purpose of my trip to Spain. I told the woman it was for a business meeting. She then asked where I'd spent my time I Spain. I told her Badajoz. She asked if I had a hotel receipt to show for it. I told her the accommodation was paid for my someone else. She then asked if I had any business cards to show for the business meeting. Sheesh, I thought. Luckily I still had all the copies of people's keys leftover from the keysigning we did, and some of them were in a business card format, so I pulled out a fistful of them and gave them to her. Oh, and she wanted to see a copy of my itinerary, and seemed satisfied that the flights were a reversal of what got me there in the first place. She wandered off with my passport, itinerary and the fistful of "business cards" and came back, seemingly satisfied that everything was in order. She stuck little blue stickers on my luggage and passport (the size of an Australian convenience-store price tag) and I was allowed to wait for the next check-in person. The rest of the checking-in process was fairly normal. I can appreciate the airline wanting to avoid having to deal with passengers being refused entry to the US, but I had a valid US visa in my passport, so that should make all of that a moot point. I don't know why I had to prove my trip's legitimacy to the airline. So I thought that was the end of it. Hardly. Terminal 1 of Madrid Airport seems to have heaps of gates, with a letter/number combination. Mine was in the B series, and I went through the security screening, and it became apparent that I had to go through another guard post looking thing to get from the A series to the B series. The signage looked like it said "Police". Anyway, the guy there had so-so English, and he initially was a little unhappy that I had an Australian passport and was flying to the US and not Australia. I pointed out the US visa, and he seemed less concerned. Then he asked me to say something in Spanish. I don't know if he was trying to be conversational, or I had to be able to speak some Spanish to get past or what the story was, but by this stage I was pretty tired, and this caught me totally off guard. I think I stammered out a Buenos d as or something. He then wanted to know how many hours it took to fly from Australia to Spain. I told him I had no idea, because I'd only flown from the US to Spain. He then begrudgingly gave me an exit stamp in my passport, and I was allowed on my way. I think the whole thing was made the more harrowing by the fact I was deadly tired, the Police guy didn't speak terribly fantastic English, and I wasn't expecting a second Spanish Inquisition (let alone the first). Oh, and closer to boarding time, they chucked everyone out of the lounge area closest to the gate, and rechecked everyone's passports and boarding passes. That was fair enough, and not unlike what happens in Sydney going to the US, but they don't even let you into the lounge area in the first place. That departure process was more what I would have expected an entry process to be like, and has put me off returning to Spain a little bit. The entry process was a joke. The guy barely looked at my passport long enough to give me the entry stamp. Fortunately I slept for the bulk of the flight from Madrid to Philly, and now I'm feeling a bit more human.

I have the following problems with blog comments:

• The interfaces are all different, and all suck (unlike my blog posting interface, which works exactly as I wrote it to).
• The markup is all different and all sucks (unlike the one I use for my blog, which I carefully chose).
• Once I type my entry into the void of a blog's comment box, it's no longer mine, it's not well associated with me, my name is not provably on it (openid helps with this one), it's not archived somewhere I control.
• People posting comments to my blog don't help spread links to my blog the way that people blogging about my blog do.
• There's generally no rss feed to follow comments; if there is, it's too annoying to subscribe to it.
• Since comment systems are a nasty little appendix on the side of blogging, no neat new tech that's developed based on blogging is likely to improve them.

So if I have something important to say, I'm likely to blog it even if I do post it as a comment too. Compare and contrast with email..

So one of the darling drugs for bipolar disorder (and I believe schizophrenia) has been Zyprexa.. Marked by the pharmaceutical company as a wonder drug, for being safe and effective, it has just come out that Eli Lilly, maker of the drug, hid and downlplayed the severity of side-effects. This is big because critics from survivors to academics and journalists and have been attacking pharmaceutical science for this very reason… This explicit revelation is thus pretty gynormous. I am frantically getting ready to go to PR, so that is I can say but more later…

I’ve spent the last few days in Badajoz for the Debian QA meeting in Extremadura. It was my first Debian event, and it was really nice to finally meet all those developers I only knew over the Internet until then. The organisation was very good in general, and C sar G mez really deserves kudos and some rest now In addition to the usual mail processing, I worked on a few things:

• I processed some logs from a rebuilt of all packages in etch and filed about 20 RC bugs about FTBFS. I also did several libpng-related rebuilds, checking that etch packages that b-dep on it still build with the proposed new version. And I investigated a few bugs.
• I also worked on a dirty script to generate the List of packages with problems wrt release (packages in etch with RC bugs, or packages in unstable but not in testing). See the list sorted by maintainer, and the list sorted by popcon score. Despite the unavoidable high number of false positives, I think that some maintainers were actually unaware of the status of their packages, so the list was probably useful.
• I gave a talk about Collaborative QA. The idea is try to move from the current non-organisation (QA one by a bored developer, on his own, because the release is approaching) to a more organized structure (team ?), allowing to share the load and share information (blacklists, false positives lists, processes, etc). I’m not sure yet if this will work, because many people consider that the current way of working on QA is OK, but I’ve created the collab-qa alioth project, and will try to use it to store information about my archive rebuilds. More to come about this later.

In general, I was pleasantly surprised by the fact that all DDs there were very friendly, welcoming, etc. Quite different from the picture of the Debian project one can easily get by looking at the mailing list. It was really nice to have so many interesting discussions with interesting people.

A few weeks ago, some spammer sent out a spam wave abusing one of my domains (fortunately one I havn't been using much). I quickly reacted by rejecting all mail to this domain. However, I'm still seeing frequent mail delivery attempts. Apparently spammers have "discovered" the email address one of them invented, and are now spamming these addresses. Great... that's like... spammer masturbation? making up your own email addresses to spam to... And worse: apparently they're now trying to bypass greylisting. Looks like we've now hit the point where greylisting will lose much of it's effectiveness we all love it for. :-( thats really bad news. Here's an excerpt from my logs (addresses removed to protect the invented):

Dec 10 14:58:54 postfix/smtpd[25738]: NOQUEUE: reject: RCPT from unknown[89.129.198.153]: 550 <agricolaapocalyptic@mydomain.tld>: Recipient address rejected: Spammers invented this address, it does not exist.; from=<random@random.tld> to=<agricolaapocalyptic@mydomain.tld> proto=ESMTP helo=<mail.001sm.com>
Dec 10 15:00:25 postfix/smtpd[15969]: NOQUEUE: reject: RCPT from unknown[89.129.198.153]: 550 <agricolaapocalyptic@mydomain.tld>: Recipient address rejected: Spammers invented this address, it does not exist.; from=<random2@random2.tld> to=<agricolaapocalyptic@mydomain.tld> proto=ESMTP helo=<mx1.cnm.cn>
Dec 10 15:02:35 postfix/smtpd[15139]: NOQUEUE: reject: RCPT from unknown[89.129.198.153]: 550 <agricolaapocalyptic@mydomain.tld>: Recipient address rejected: Spammers invented this address, it does not exist.; from=<random3@random3.tld> to=<agricolaapocalyptic@mydomain.tld> proto=ESMTP helo=<mx2.fr.clara.net>
Dec 10 15:04:40 postfix/smtpd[10646]: NOQUEUE: reject: RCPT from unknown[89.129.198.153]: 550 <agricolaapocalyptic@mydomain.tld>: Recipient address rejected: Spammers invented this address, it does not exist.; from=<random4@random4.tld> to=<agricolaapocalyptic@mydomain.tld> proto=ESMTP helo=<mail.1-shops.com>
Dec 10 15:06:46 postfix/smtpd[20414]: NOQUEUE: reject: RCPT from unknown[89.129.198.153]: 550 <agricolaapocalyptic@mydomain.tld>: Recipient address rejected: Spammers invented this address, it does not exist.; from=<hisyn@0reality.com> to=<agricolaapocalyptic@mydomain.tld> proto=ESMTP helo=<aspmx2.googlemail.com>
Dec 10 15:09:48 postfix/smtpd[20608]: NOQUEUE: reject: RCPT from efi235.internetdsl.tpnet.pl[83.14.242.235]: 550 <agricolaapocalyptic@mydomain.tld>: Recipient address rejected: Spammers invented this address, it does not exist.; from=<random5@random5.tld> to=<agricolaapocalyptic@mydomain.tld> proto=ESMTP helo=<efi235.internetdsl.tpnet.pl>

Yes, that is one host retrying for 8 minutes (usually enough to bypass a greylist), another one a few minutes later, and a third one 5 days later (not included in the log); hosts that didn't make it past the RBL are not included. All in all I count 148 email delivery attemts to this address. And all on a random email in my domain that never existed, and is not a dictionary address like sales@domain.tld; but this probably means I won't be able to enable a catchall for this domain ever again or face loads of spam. OTOH, my spam filter can probably learn that "agricolaapocalyptic" is a sure indicator for spam and just discard all of it. P.S. this effect makes it more plausible that spammers are grabbing the Outlook address books of Windows users to use for spam; it's plausible the spam-address was auto-collected by outlook and then in turn collected by the next spammer. Maybe we really need to create random addresses until they give up on having sane databases sometime? Or at least blacklist our domains for their email collectors...

The last few days I attended a Debian QA meeting in Badajoz in the Spanish region of Extremadura. I worked on a number of QA tasks, like cleaning out bug reports for removed packages and tidying up some WNPP bugs. I also started another compilation run of the archive using GCC 4.2. In general, I worked on a number of TODO items I had, such as updating my Debian on Cobalt pages for etch, and responded to some email. My inbox is actually empty right now and there are few specific things I need to do, even though there's a lot in general, just like always. Tomorrow I'll head back to Madrid to meet up with some friends. Apparently we'll go bowling. On Monday I'll briefly visit the Universidad Rey Juan Carlos where I stayed for three months earlier this year before catching a flight to Austria where I'll spend New Year.

If, like me, you use the mutt mailreader, you may at some point have tried out the urlview program to quickly jump to URLs in emails. urlview is a nice concept, but it has a few limitations, the worst of which is it doesn't decode quoted-printable emails (so, e.g., CGI urls containing equal signs get escaped and become useless).

With the increasing number of dynamic URLs and quoted-printable emails out there, this has rendered urlview more or less useless for me. A couple weekends ago, I got annoyed enough to do something: I wrote a quick-and-dirty Python replacement for urlview, called urlscan. I'm not proud of all the code, but thanks to Python's great standard library, it can decode just about anything you throw at it; it also extracts some context around each URL, so there's less guesswork involved in picking URLs.

I've uploaded urlscan to unstable (it just went in today), in the hopes that someone out there will find it useful. Enjoy. :-)

Scott commented on my attempt to upgrade the Ogg player from GNU/Linux:

"I bought my YP-U2 in the US where the installed firmware doesn't do OGG at all. I actually had to flash it to international firmware before I could even mount it in Linux. I found the firmware on the Samsung web site after much searching, and actually installed firmware for a slightly different version of the player to get it to play OGG. Sadly I don't have the URL handy, but I may have the firmware files I used. Additionally, I was required to use Windows to upgrade the flash."

I extracted some sb files that I think may be the firmware, but I don't know what to put where or how to persuade the YP-U2 to load them. Also, I don't own a computer with Windows installed - I may have a valid licence key somewhere, but I really don't know where. Still no sign of the email Samsung promised yesterday.

So, phone call today went something like this

• Hello Robert [voice I dont recognise]
• Hi, who is this.
• This is a courtesy call from Telstra mobile, is that ok?
• Maybe, what do you want?
• Are you aware that Telstra a running a special right now - 400 dollars credit and a BRAND NEW PHONE absolutely FREE if you bring your number over to Telstra today?
• Are, so you are calling me unsolicted even though I'm not a customer of yours?
• <starts to say something>
• Let me make this clear, <shouting>FUCK OFF</shouting>
• dead phone..

Yeah, I was seriously cranky - after the amount of email spam I cleaned out this morning, it was -not- a good day to be spamming my mobile phone number. I feel somewhat guilty about the abusive (its not my normal persona!) language to the poor shmuck (who sounded like they come from an Indian call centre by accent) whose job it is to spam people, but not very: they are willing to do so - so I dont feel guilty. I do feel quite a sense of satisfaction though : imagine having one of the pharma spammers on the phone - what would you choose to say to them ?

Anyone know how to upgrade a Samsung YP-U2 Ogg player's firmware from GNU/Linux? Nick at Samsung support says they'll email me some details, but they seemed pretty confused on the phone. The supplier said it was supported in Linux, although now I notice the box doesn't say so and I'm on the other side of the country to them. It seems happy enough as a USB Mass Storage device, right down to backing up the settings, but this is my first firmware update. Unzip, Cabextract and Unshield have extracted lots of files and I guess some or all should go into the system directory, but I've no idea which and how. Help would be very much appreciated. Even better would be some free-as-in-freedom firmware... I knew enough to buy an Ogg player, but I think the firmware debate and my awareness of free firmware for some digital audio players came after I got this one. Simon Brown asked in a comment:

"Why do you want to upgrade the firmware? Mine just works"

Mine is running firmware 1.30 EU which seems to misinterpret some low-bitrate Ogg files and I wanted to see whether that's fixed.

Makers of Dojo, Prototype, jQuery and Mochikit, I salute you.It is immensely gratifying that there are those with the courage and sense to make JavaScript in the browser workable for the rest of us. Like many busy developers, I've steered myself away from hacking JavaScript for many years. Cross-browser incompatibilities, the troubles of debugging and the relatively small reward for effort have kept me focusing on the server side (not to mention the temptation JavaScript poses to those prone to stray from the REST religion).This is now starting to change. The immense efforts of JavaScript developers are providing frameworks that allow developers to work on the client side with something approaching the elegance and concision that we can now wield on the server side.One of the wonderful things about the web is that it has become the forum for its own improvement. JavaScript has ensured that this is now true of the browser too. New techniques can be proved in script before they ever need baking into a markup language.Even the most ardent of declarative programming hacks will appreciate the way toolkits such as jQuery allow painting of behaviour onto pages rather than littering semantic markup with snippets of script.The problem that faces us now is: which JavaScript framework to choose?As is my habit in programming languages, I've found myself move from framework to framework depending on the actual tools available. Starting off in Prototype as it came with Rails, paying a happy visit to jQuery because of Thickbox, considering Dojo because of its rich text editor, and now being wowed by Plotkit and thus checking out Mochikit.So, here's an idea for aspiring XTech presenters: we'd love to hear more about these toolkits. Experiences, future plans for the kits themselves, and how developers should choose between them.

• XTech 2007 call for participation. Closes this weekend, so hurry! 

On my way to the QA meeting in Extremadura today, where I am now using the hotels wireless, "secured" by very poor obscurity, I thought about my blog post of earlier today, and I would like to add two things now:

16 million ip addresses for continents of 0.5 to 2 billion people per continent is *really* little,

ipv6 will give us roughly 667 quadrillion addresses per square millimeter of the earth's surface - but I believe the digital divide will become worse. Two words: net neutrality.

There are only a few days left until the close of the XTech 2007 call for participation. XTech 2007 will be held 15-18 May 2007 in Paris, France.
As I wrote last month, the theme for this year's conference is "The Ubiquitous Web", reflecting the many ways, places and devices through which we now interact with and are affected by the web. XTech 2007 will be comprised of four thematic tracks:

• Applications: web applications, vocabularies, publishing, content management, case studies
• Browser Technologies: browsers, mobile, user interface, related issues and standards.
• Core Technology: the heart of web technology, markup, protocols, semantics and more.
• Open Data: technology, experiences and policy behind open access to data.

All these topic suggestions are of course just that; don't feel you are limited to topics mentioned explicitly in the call.XTech is always topical, so to take that angle, we'll be expecting to hear about things such as Second Life, mobile and geolocative services, progress in open standards, Ajax toolkits, OpenDocument vs Microsoft Open XML, copyright, identity, best design practices and more.Just a few more tips based on submissions so far:

• Don't worry if you can't decide which track your submission falls into: just say so in the notes, and the programme committee can place it appropriately.
• If you have something super-secret you can't talk about yet, but can do by May 2007, write to me personally and we'll try to come to a suitable arrangement.
• If you have a great excuse why you need just a few more days to respond to the call, also let me know.

Otherwise, propose away!

Sexism Amaya was right to point out an example of sexism at a recent open source developers conference. She makes reference to the Debian Women group as an example of a good thing. I was talking to Erinn recently and told her that my impression was that the Women project had stalled/ceased. Mostly because there didn’t seem to be anything happening. I think that this is both a good thing, and a bad thing. Good in the sense that the idea of female developers isn’t a suprise (as it shouldn’t be) and that the previously overt sexist hostility is going away. But bad in the sense that there should be ongoing work so that we don’t start to take it for granted and ignore other newcomers and women. There are several reasons why projects like this stall; one of the most obvious is that writing documentation is hard. Really. You don’t know how hard it is until you try to do a little every day for week after week after week. (And there are times when I think of writing a book. Ha!) There are other reasons too; such as the difficulty in attracting volunteers who are matched to their jobs, and who in turn have the time to do useful things. So Planet Debian how are you going to help our women today? I’ll make sure I avoid sexist lyrics in my titles from here on out.. not a huge change since I tend to avoid it generally, much as I would love to fill entries with Depeche Mode lyrics I guess I have better places for emo-rants. One small step ..

My face is covered in egg. Antti-Juhani Kaijanaho found a security problem in EoC, both the 1.0.3 and the 1.2.3 versions. The problem is that EoC did not quote shell arguments properly. I have fixed the problem in 1.2.4, which contains no other changes relative to 1.2.3. This problem has the code CVE-2006-5875. You can find the 1.2.4 version from the EoC website: http://liw.iki.fi/liw/eoc/ and I have also uploaded it to Debian's unstable. Debian's stable contains 1.0.3, and I have prepared a patch for that. It is actually essentially the same patch as was used to create 1.2.4. The Debian security team has uploaded a fixed version of the 1.0.3 package to security.debian.org. I've attached it to this message in case anyone not running Debian wants to stay with 1.0.3, but I won't be releasing a 1.0.4 unless someone really needs it (if you do, please tell me immediately). For risk assessment: I was unable to come up with an exploit. Doing so would require getting a certain kind of construct through the SMTP level to EoC, and I wasn't able to make that happen, but I would not rely on it being impossible. Therefore, please upgrade immediately. I apologize for this problem. It was amateurish to let the problematic code into a released version of the program, I knew better than do that.

By informing us of a new list, WikiChix Joe Reagle offer’s some insight as to why gendered spaces don’t always sit easily alongside or with liberal ideologies of equality:

Formally excluding anyone from the larger community prompts questions of: is this fair?, is this discriminatory?, shouldn’t we ensure the common space is accessible rather than spinning off groups?

Of course, much of liberal theory since it hones in on “formal” dimensions of equality, does not do so well with accounting for or accomodating those forms of biases and exlcusions that are either informal (i.e. cultural) or often structural (i.e. economic).

Well this is all a bit exciting. This is my first real foray into a country that doesn't speak English. Hong Kong was so bilingual it wasn't really a challenge. Here Hablas ingl s? is the first order of the day, otherwise I have to fumble my way through C mo consigo al terminal cuatro? with my head stuck in the Lonely Planet. The flight to Madrid was fairly uneventful. US Airways doesn't suck any more or less than United. No luggage lost or damaged. I bounced of Philadelphia, and that's a pretty cool airport. Lots of white rocking chairs littered in the middle of the concourse for general consumption, and a veritable shopping mall within the airport. Terminal 4 of Madrid Airport is a spiffy new looking thing. Very architectural, I like it. I've got a few hours to kill here while I wait for the European contingent to arrive, so I can catch up on my post-vacation work email backlog... Certainly a different way to spend a birthday.

So I am back to le study of le hackers, trying to write a super-secret paper that I will present in January and then of course I am back with and to my beloved book (which for now has the following title: “Freedom’s Pleasures: Hacker Practice And The Limits of Liberalism” but I am sure it will morph, endlessly). As part of my transition I just finished re-reading one of my favorite articles on the history of Usenet: If I want it, it s OK: Usenet and the (outer) limits of free speech by B. Pfaffenberger (available here for download. When I released one of my dissertation chapters where I addressed the phenomenon of the Cabal, Bryan was nice enough to write me and point me to his article, which also examines the existence of Backbone Usenet Cabal. The artile, which provides just the right mix of history and commentary, analyzes how a free speech ethic came to be valued on Usenet and the ways in which technological and social factors co-mingled to facilitate and dampen the free flow of expression. You are provided with classic Usenet quotes like:

Usenet is like a herd of performing elephants with diarrhea–massive, diffi-
cult to redirect, awe-inspiring, entertaining, and a source of mind-boggling
amounts of excrement when you least expect it. (Spafford, 1993b)

You learn about the early attempts to control spam by the likes of “CancelMoose:”

In 1995, a secret, shadowy figure known as the CancelMoose
devised a spam-canceling program called a cancelbot.”

And then in the end, he provides his challeng to one of the dominant STS theories of the time, SCOT: “It should be noted that this picture is at odds with the predictions of the social construc-
tion of technology (SCOT) theory (Pinch & Bijker, 1987), in which the outcome of a period
of technical controversy is ascribed solely to social factors. Underlying SCOT s dogmatism
is a justifiable aversion to technological determinism, the doctrine that a technology s con-
tent leads irresistably to predictable social consequences a doctrine that is simply the re-
verse of SCOT s insistence on social causation. Two wrongs, as we were taught in kinder-
garten, do not make a right. What we see in the history of Usenet is a contingent outcome
that is shaped neither exclusively by social nor by technical factors, but rather is best under-
stood as a long process in which contesting groups attempt to mold and shape the technol-
ogy to suit their ends sometimes successfully, and sometimes not. They are as likely to be
blindsided by technological developments as they were to succeed in changing the system
to meet their ends. As this article attests, it is one thing to create new technologies with a
coherent social vision, and it is quite another to control the way it grows and develops.” I could not agree with him more. I think what he is highlighting is that if we dip into the historical record, we have instances in which technology can trump the social and vice-versa (and often instead it is a co-mixture), so in the end, understanding the impact of technologies is less about theories of technology and more of a historical question…