Yesterday was general assembly of the Linux user group Aargau (a place in switzerland). The association hasn’t got enough money, this is a severel months old story already, and the person who managed the money was very inactive. The president also didn’t want to do his job anymore, so we had to search a new advisory board. Unfortunately there weren’t enough members who are interested in this job, so the association will be resolved. This is quite hard for me because I met there some cool people which became (some of them at least) good friends, I say “thank you very much” to G rkan, Daniel, David, Werewolfi, Harzi, Nils, B, Vany and last but not least also to the “swisscom idiot”…
Yeah, there isn’t much more to say about this, only that I will miss those cool evenings very much But from another point of view, yesterday was a very good day because Debian Etch is finally frozen, so we had to celebrate at the LUG-AG meeting and there are some pictures (the big ones are 403, if you want them just send me a mail and I will allow it for your IP). Thanks to all Debian people who helped getting Etch in shape and thanks to the releasemanagers…

The fight against terrorist has been mostly abandoned in favour of the fight for terrorist fighting money from the federal (U.S.) governement. And, it appears, the fight for the biggest silliness. But they still tell me the Ministry of Silly Walks doesn't exist...

[...] a mathematical value purporting to represent the square root of terrorist intent. The figure appears deep in the mind-numbingly complex risk-assessment formulas that the department used in 2006 to decide the likelihood that a place is or will become a terrorist target [...]

Needless to say, locations with more likely to-be-attacked locations get more money. And, as it turns out, frequently have more republican politicians.

Several years ago, Pinochet was prosecuted by the Spanish judge Baltasar Garz n:


On October 17, 1998, while traveling to the United Kingdom for medical treatment, Pinochet was arrested on a Spanish provisional warrant for the murder in Chile of Spanish citizens while he was president. Five days later, Pinochet was served with a second provisional arrest warrant from judge Baltasar Garz n of Spain charging him with systematic torture, murder, illegal detention, and disappearances. Pinochet was placed under house arrest in Britain while appealing the legal authority of the Spanish and British courts to try him, but eventually released on medical grounds by the then Home Secretary Jack Straw without facing trial. .

Garz n became my hero since that very moment.

Since then I have been repeating like crazy: Pinochet, al talego , which barely means Get Pinochet behind bars . Now I am smiling as I think Pinochet, al hoyo , which I will not even try to translate. I pity the worms his unpunished criminal corpse will breed.

Go take a look at the Valech Report.

Cheers!

It's been more than one year that I'm waiting on NM queue, waiting for an Applicant Manager, performing Philosophy & Procedure part 1 & 2, then Tasks & Skills.

When applying for NM, it's really appreciated to already maintain a few packages in the archive, so for T&S the AM can check them and appreciate the work done. I guess people applying for NM first start by taking care of some package, before submitting.

But for me, it was the opposite way. I joined pkg-xfce team more than 18 months ago, and got my first packages in the archive a few weeks later.

I only applied to NM 6 months later, because, as I was dedicating more time to pkg-xfce, it would be more efficient for me to be able to upload directly, without
bothering huggie or ema (the two DDs in the team). It wasn't really required, but
it interested me, and huggie said me that it'd take some time so the sooner, the better.

Now, due to personal reason, huggie and ema don't have time/motivation anymore to work on pkg-xfce. I'm currently the one in charge, as I spent some time on it, and tries to spent some time on debian-desktop team, so we have a nice and consistent look for desktop environments in Etch. But I can't upload my packages myself, I need to find a sponsor. Xfce represent more than 50 packages (including goodies), that's quite a lot, and we have scripts and procedure to be efficient when rebuilding everything. If I could do everything myself, Xfce 4.4rc2 (released 2006/11/05) would have been in Etch since a long time. But I can't, because I'm stuck in NM queue.

Most of 4.4rc2 packages have been uploaded by my AM, Dafydd Harries (which I want to thank, though), but not everything, and few packages won't be in Etch, now that it's frozen. Yeah, that means that Etch will have half rc1 and half rc2, which isn't really good. Not really bad either, but still... (ok, and not as bad as shipping broken svn snapshots...)

I'm interested in beeing a Debian Developper because I *know* it'll make my work and my time more efficient. And not beeing able to push rc2 to Etch because of that really makes me sad...

I work at the Ministerio de Administraciones P blicas, the MAP. My main task there is to administer an email cluster for something between 8.000 and 10.000 users, based on free software (LDAP, Postfix, Amavis...) which has been pretty fulfilling so far.

The problem they have is a lot of consultants from external companies that come for big or small projects and they know of no easy way of being able to grant enough permissions to achieve certain tasks without giving away the root password and having to change it every other day. I am one of these external consultants, only I am there for a long term project. I have been there for more than a year and a half now, and our contract was just renovated for two more years. This basically means I am doing my job pretty well.

But a couple of months ago, the company I work for, Alanta, agreed with the MAP on me giving a 12h a training session on sudo. After spending 100 hours in preparing my slides on a sudo workshop (spanish only, sorry), starting from file permissions to ssh public-private key pairs, and ending with sudo, a high amount of stress, as I had to work full time as I prepared this in paralel, I bitterly complained to my boss. (That s when the cleaning started, BTW).

So we had a nice lunch in which I was given a 200 EUR 2GB 2nd Generation Silver Ipod Nano. Which is nice, but taking into account that when I worked for IBM as a certified trainer I made something between 24-60 EUR per hour, depending on the subject, and all the material (slides, exercises, TOC and Trainer material) was already done for me, so I just had to prepare and give my lessons, I felt patronized and a bit insulted, even if I did not expect any compensation for this extra effort that really damaged my (mental) health. Getting presents in exchange for hard work doesn t make sense for me, specially when I can hardly make it to the end of the month, constantly being in (small, to be honest) debt.

But you could be making more money, couldn t you? Yes, sure. But at what price? I like the relaxed work environment and the lack of sexism in my current project. I have plenty of spare time, and my life quality is overall great, I can walk home from work, I am not juiced and then disposed of, despite the punctual stressful periods everyone gets every once in a while (which are rare here, at MAP).

And this thing will never run IpodLinux or Rockbox. I feel like I want to throw it out the window. It lacks support for my favourite music file formats, UTF-8 and hangs up more than MS Windows 95.

The other day I had was tinkering with that cute little poster child of Web 2.0, Flickr. Looking for a lightweight way to incorporate some photos into a web site, I headed to their feeds page to find some XML to use.Before you read on, don't forget that the XTech 2007 call for participation ends this week. The result was interesting. Flickr have a variety of outputs in RSS dialects, but you just can't get at the raw data using XML. The bookmarking service del.icio.us is another case in point. My friend Matt Biddulph recently had to resort to screenscraping in order to write his tag stemmer, until some kind soul pointed out there's a JSON feed.Both of these services support XML output, but only with the semantics crammed awkwardly into RSS or Atom. Neither have plain XML for public consumption (some is available behind a registration protected API), but do support serialization via other formats. We don't really have "XML on the Web". We have RSS on the web, plus a bunch of mostly JSON and YAML for those who didn't care for pointy brackets.Did we as supporters of XML get it wrong somehow? I think we did. The success of the XML project and the W3C as a unifying forum was seductive, and we felt more bound to the edicts of the W3C than we thought. Our justified love of open standards inadvertently promoted a straitjacketed approach to using XML. XML was felt to need a schema language.What we missed was that settling on schemas for data serialization represented much more of an up-front commitment than most developers could really make. The rise of agile programming techniques further emphasizes the hazards of prematurely freezing a design.Schemas never really came with great evolution or migration strategies.
And of course it didn't help that both DTDs and W3C XML Schema are pretty darn obscure. Somehow we never got the word out, despite the "standalone" XML declaration, that it's OK to spread schema-less XML around.We had of course the Simple XML movement, but it came to little. Other voices pointed the way forward. Walter Perry notably promoted an agenda that required little a priori agreement between communicators, but it gained little ground in common thought. Ironically it took James Clark to push the agenda of developer convenience, with the RELAX NG compact syntax giving us all permission not to think in angle brackets.Meanwhile, busy developers with work to do on the web have created non-XML syntaxes such as JSON and YAML. Though I deliberately closeted myself in XML for a long time, I have come to appreciate the utility of these syntaxes.One of the more intriguing developments is that the Semantic Web crowd, while still very much W3C oriented, have really proved themselves more flexible in their attitude than the XML world at large. RDF/XML is hardly the only acceptable way to approach the throne of Tim, and the man himself threw out XML syntax pretty early on with the development of the N3 scribble format. More recently, the work on GRDDL to scrape semantics from HTML has shown the semweb folks' amenability to outside initiatives such as microformats.Maybe it's not such a bad world, as making an XML mapping of YAML, JSON and friends isn't really very hard. I'd just like to get the message out to web application developers that Plain Old XML is fine by me. I live in hope yet that the rise of REST will hit this home.So while markup has most definitely won on the web, it's a shame XML hasn't yet achieved as much as it could. It's not too late for an injection of pragmatism and a little less constraint.

A few month ago, I blogged a way to spread Free Software effectively, especially in developing countries: By deploying Free Software in internet caf s, where most people learn their way around computers. Most of them (and there are a lot, much more than in Europe) have a buisness plan that relies on software for free, but currently they achieve that through pirating Windows and software like Cybercafe Pro. Back than, I wrote this more or less theoretically, but it happend that I ended up having some time to actually start working on it.While Free Software, especially Debian, provides a very good base to build internet caf s from, one key component is more or less missing: Software to hand out these codes ( timecodes ) to the customer, to let them log in and surf for the time they bought. Very recently, Zybacafe was released, but I did not really like it, nor felt like maintaining a Pascal/Lazarus based Debian package. So I went ahead and implemented my own ideas.The Idea is to keep it very simple, very modularized and integrate deeply with normal unix ideas. So what we have now is a PostgreSQL database (one table so far), and all communication just goes via this table, so we don t have to design or implement complicated protocols. A python gtk application for the front desk generates the timecodes that are then, on paper, passed to the customer. The workstations greet the user with standard GDM, but our pam modules authenticates the timecode instead of a username/password pair. While using the system, a small floating window informs the user about the remaining time. If he does not log out voluntarily, a system daemon will kill all his processes eventually.The long term mission is to form that into a Custom Debian Distribution that will install the server hassle-less, and besides being pre-configured for the internet caf s needs, also immediately serves as an automated installation server for the workstations (think FAI), all useing stock Debian packages, as far as possible. Another pam module could, upon login, mount the homedirectory as a copy-on-write overlay of a template user s home directory, and through away the changes afterwards. The goal is to offer easier installation, less maintenance, better robustness and more flexibility than the current common non-free systems.But, of course, this project needs help. First of all: Users! If you have any use for time-limited logins (Internet caf , school surf terminaly, parents with otherwise not to bed going kids), you can be an earliy adaptor. Developers are very welcome as well, and due to the modular structure, cooperation should be quite smooth.The development happens on alioth, where we have the subversion repositry, as well as on the Debian wiki page. Alpha packages for these components can be found on the alioth group s webspace. We do not have a mailing list yet, but feel free to e-mail me. We will set up a mailing list once there is a need for it. Thank s to the KACE for supporting this.

People who have following our release update mails have seen that we are tracking different numbers this time. There is the total number of RC bugs relevant for etch, which is currently 122. And there is the number of RC bugs relevant for both etch and sid (i.e. "not handled yet"-bugs), which is currently 78 - and that number was basically the only number we could track for release of sarge. (Then there are also the numbers of bugs only in etch, and the number of aged bugs relevant for etch and sid - please see http://bts.turmzimmer.net/graph-small.png for the full stats.) So, if you look back we have written "RC bugs below 80" as precondition in our timeline. We copied that from the sarge release, were we had "~85 RC bugs" at time of freeze. During detailed planing, it became obvious that if we want to basically "go by the same numbers", that is (and can only be) the number of RC bugs applying to both etch and sid - as that was the only stats we really had during sarge release planing (please remember, we didn't had version tracking at that time, at the moment where a bug fix was uploaded to sid, the bug disappeared at all, unless someone reopened the bug report and tagged it sarge). So, we agreed that we can and should freeze Etch as soon as the combined number is below 80, and the number of fixes waiting for transition is not out of control (and a few other issues are resolved, please see the previous mail to debian-devel-announce for that). Please allow me also a personal remark: It is really sad when somone tries to hurt active Developers working on the release, while not contributing anything except spite. I don't think that is adequate behaviour.

It looks like November-December are the most popular months for people coming to visit me, or crashing at my place in their way to their final destination.

In November I had the pleasure to host Sulamita, while she was on her way to India. One of the most interesting girls I have met this year.

Baby Jesus left yesterday, after spending several days at my place. He brought Salmiakki, smoked salmon and smoked reindeer with him, which I used to like before I became vegan (and later pescatarian). The salmon was incredible, though.

Just as I was writing these lines, Luk, who was also going to stay at my place before The Extremadura QA Meeting called me from BRU airport claiming his ticket had been cancelled :( I called C sar and found out that the travel agent they work with had not bothered to confirm several people s flights, so he will be coming to Spain on the 13th, just like everyone else. He will not be staying at my place, and will miss out on the smoked reindeer, that will be eaten by some other carnivore, I guess .

The great man I got the Linksys from lies sick in my bed, and spends almost as much time at my place than at his own, so I guess he doesn t count.

Saw this on Baen’s Bar

Loser- INTP 46% Extraversion, 53% Intuition, 66% Thinking, 33% Judging

Talked to another human being lately? I’m serious. You value knowledge above ALL else. You love new ideas, and become very excited over abstractions and theories. The fact that nobody else cares still hasn’t become apparent to you… Nerd’s a great word to describe you, and I seriously couldn’t care less about the different definitions of the word and why you’re actually more of a geek than a nerd. Don’t pretend you weren’t thinking that. You want every single miniscule fact and theory to be presented correctly. Critical? Sarcastic? Cynical? Pessimistic? Just a few words to describe you when you’re at your very best…*cough* Sorry, I mean worst. Picking up the dudes or dudettes isn’t something you find easy, but don’t worry too much about it. You can blame it on your personality type now. On top of all this, you’re shy. Nice one, wench. No wonder you’re on OKCupid! Now, quickly go and delete everything about “theoretical questions” from your profile page. As long as nobody tries to start a conversation with you, just MAYBE you’ll now have a chance of picking up a date. But don’t get your hopes up. I am interested though. If a tree fell over in a forest, would it really make a sound? ***************** If you want to learn more about your personality type in a slightly less negative way, check out this. ***************** The other personality types are as follows… Loner - Introverted Sensing Feeling Perceiving Pushover - Introverted Sensing Feeling Judging Criminal - Introverted Sensing Thinking Perceiving Borefest - Introverted Sensing Thinking Judging Almost Perfect - Introverted iNtuitive Feeling Perceiving Freak - Introverted iNtuitive Feeling Judging Crackpot - Introverted iNtuitive Thinking Judging Clown - Extraverted Sensing Feeling Perceiving Sap - Extraverted Sensing Feeling Judging Commander - Extraverted Sensing Thinking Perceiving Do Gooder - Extraverted Sensing Thinking Judging Scumbag - Extraverted iNtuitive Feeling Perceiving Busybody - Extraverted iNtuitive Feeling Judging Prick - Extraverted iNtuitive Thinking Perceiving Dictator - Extraverted iNtuitive Thinking Judging

My test tracked 4 variables How you compared to other people your age and gender: You scored higher than 53% on Extraversion You scored higher than 25% on Intuition You scored higher than 52% on Thinking You scored higher than 15% on Judging

Link: The Brutally Honest Personality Test written by UltimateMaster on OkCupid Free Online Dating, home of the The Dating Persona Test

Russel Coker has posted a SELinux on Debian etch in 5 Minutes guide. Some small things to note:

• This is for etch, which has Linux 2.6.18 - there are SELinux changes in 2.6.19 which require policy version 21, whereas 2.6.18 has policy version 20. Changing it in /etc/selinux/semanage.conf may or may not be enough.
• rjc posted this Policy fix you'll likely need for running enforcing
• strict, while being more secure, will likely require you to write some policy modules on your own
• policy is a snapshot from october, you might want to get an updated policy. However I currently don't have time to work on it, and I just heard that etch was frozen. But maybe Manoj has still time to update the policy and get it into etch...

Or, more accurately, this is what you get when you watch The Matrix while sucking down bottles of Nitrous Oxide. (Thanks to Two Second Memory for the link)

The last couple of days have resulted in a number of fun things.

• An OLPC turned up. They're ridiculously neat devices , and it's impossible to describe just how amazing the transflective screen is in black and white mode. Even for an early prototype, the device feels remarkably solid - giving it to people rather larger than the intended market still didn't result in it being turned into a thin paste. We've already been able to get video and sound off it and broadcast to another machine thanks to the wonders of gstreamer's pipeline magic - even with a fairly puny processor, it's easily able to manage bidirectional conversation at QCIF resolutions.
  
• Canola has been released in beta form. No source yet, which is a shame, since it's probably the most useful application for the 770 since Maemo Mapper. A bit of poking revealed that fuppes currently seems to be more stable than gmediastreamer, and it's now possible to wander around the house streaming music, pictures and video off another machine. It's alarmingly like the future has arrived, especially since it'll happily do the same thing off the Internet. When experimenting with it we were a bit disturbed to find that it had found a share called "Rob's Music" before we tried setting anything up, but the presence of Croft No. 5 made it pretty clear that it had picked up Rob's Rhythmbox setup via DAAP. It also interacts fairly well with:
  
• The patching I've done to gnome-obex-server. The patch is here. Pretty straightforward - it looks at the file extension of incoming files and then saves them to different locations depending on the filetype. It'll also then execute a default command on each of the files. After adding a bluetooth adapter to my TV machine, I can now send pictures to it from my phone and have them displayed on the TV automatically. I've also got it hacked up so it pokes fuppes into refreshing the database, which means I can then also view them on the 770 using Canola. Mad convergence action. There's no sort of configuration UI for this yet, so you need to set the image_savedir, video_savedir and music_savedir gconf fields under /apps/gnome-obex-sever/. Default actions use image_action, video_action and music_action.
  

In other news, I hate fruitflies.

checkmodule -m -o local.mod local.te
semodule_package -o local.pp -m local.mod
semodule -u local.pp

Save the following policy as local.te and then run the above commands to make semodule work correctly and to also allow restorecon to access the console on boot.

module local 1.0;

require  
        class chr_file   read write  ;
        class fd use;
        type restorecon_t;
        type tmpfs_t;
        type initrc_t;
        type semanage_t;
        role system_r;
 ;

allow restorecon_t tmpfs_t:chr_file   read write  ;
allow semanage_t initrc_t:fd use;

Following from my 5 minute OSDC talk yesterday on 5 security improvements needed in Linux distributions I gave a 5 minute talk on installing SE Linux on Debian etch. To display the notes I formatted them such that they were in 24 line pages and used less at a virtual console to display them. The ultra-light laptop I was using has only 64M of RAM which isn't enough for a modern X environment and I couldn't be bothered getting something like Familiar going on it.

After base install you install the policy and the selinux-basics package:

# apt-get install selinux-basics selinux-policy-refpolicy-targeted
The following extra packages will be installed:
checkpolicy libsemanage1 mime-support policycoreutils python python-minimal
python-selinux python-semanage python-support python2.4 python2.4-minimal
selinux-utils
Suggested packages:
python-doc python-tk python-profiler python2.4-doc logcheck syslog-summary
The following NEW packages will be installed:
checkpolicy libsemanage1 mime-support policycoreutils python python-minimal
python-selinux python-semanage python-support python2.4 python2.4-minimal
selinux-basics selinux-policy-refpolicy-targeted selinux-utils
0 upgraded, 14 newly installed, 0 to remove and 0 not upgraded.
Need to get 6362kB of archives.
After unpacking 41.5MB of additional disk space will be used.
Do you want to continue [Y/n]?

The package install process also configures the policy for the machine. The next step is to label the filesystems, this took 26 seconds on my Celeron 500MHz laptop with 20,000 files on an old IDE disk. The time is in proportion to number of files, often bottlenecked on CPU. A more common install might have 5* as many files with a 5* faster CPU so 30 seconds is probably common for labelling. See the following:

# fixfiles relabel

Files in the /tmp directory may be labeled incorrectly, this command
can remove all files in /tmp.  If you choose to remove files from /tmp,
a reboot will be required after completion.

Do you wish to clean out the /tmp directory [N]? y
Cleaning out /tmp
/sbin/setfiles:  labeling files under /
matchpathcon_filespec_eval:  hash table stats: 14599 elements, 14245/65536 buckets used, longest chain length 2
/sbin/setfiles:  labeling files under /boot
matchpathcon_filespec_eval:  hash table stats: 19 elements, 19/65536 buckets used, longest chain length 1
/sbin/setfiles:  Done.

The next step is to edit /boot/grub/menu.list to enable SE Linux, auditing, and put it in enforcing mode:

title   Debian GNU/Linux, kernel 2.6.17-2-686
root    (hd0,1)
kernel  /vmlinuz-2.6.17-2-686 root=/dev/x selinux=1 audit=1 ro enforcing=1
initrd  /initrd.img-2.6.17-2-686

Then reboot.

After rebooting view the context of your shell, note that the login shell will have a domain of unconfined_t when the targeted policy is used:

# id -Z
system_u:system_r:unconfined_t

Now let's view all processes that are confined:

# ps axZ  grep -v unconfined_t grep -v kernel_t grep -v initrc_t
LABEL                             PID TTY   STAT   TIME COMMAND
system_u:system_r:init_t            1 ?     Ss     0:02 init [2]
system_u:system_r:udev_t         1999 ?     S.s    0:01 udevd --daemon
system_u:system_r:syslogd_t      3306 ?     Ss     0:00 /sbin/syslogd
system_u:system_r:klogd_t        3312 ?     Ss     0:00 /sbin/klogd -x
system_u:system_r:apmd_t         3372 ?     Ss     0:00 /usr/sbin/acpid -c /etc
system_u:system_r:gpm_t          3376 ?     Ss     0:00 /usr/sbin/gpm -m /dev/i
system_u:system_r:crond_t        3402 ?     Ss     0:00 /usr/sbin/cron
system_u:system_r:local_login_t  3423 tty1  Ss     0:00 /bin/login --
system_u:system_r:local_login_t  3424 tty2  Ss     0:00 /bin/login --
system_u:system_r:getty_t        3425 tty3  Ss+    0:00 /sbin/getty 38400 tty3
system_u:system_r:getty_t        3426 tty4  Ss+    0:00 /sbin/getty 38400 tty4
system_u:system_r:getty_t        3429 tty5  Ss+    0:00 /sbin/getty 38400 tty5
system_u:system_r:getty_t        3430 tty6  Ss+    0:00 /sbin/getty 38400 tty6
system_u:system_r:dhcpc_t        3672 ?     S.s    0:00 dhclient3 -pf /var/run/

The initial install of policy inserts modules to match installed software, if you install new software then you need to add new modules with the semodule command:

# semodule -i /usr/share/selinux/refpolicy-targeted/apache.pp
security:  3 users, 7 roles, 824 types, 67 bools
security:  58 classes, 11813 rules
audit(1165532434.664:21): policy loaded auid=4294967295
# semodule -i /usr/share/selinux/refpolicy-targeted/bind.pp
security:  3 users, 7 roles, 836 types, 68 bools
security:  58 classes, 12240 rules
audit(1165532467.874:22): policy loaded auid=4294967295

Note that the security and audit messages come from the kernel via printk, it is displayed on console login but you need to view the system log if logged in via ssh or running an xterm. Now you have to relabel the files that are related to the new policy:

# restorecon -R -v /etc /usr/sbin /var/run /var/log
restorecon reset /etc/bind context system_u:object_r:etc_t->system_u:object_r:named_zone_t
restorecon reset /etc/bind/named.conf context system_u:object_r:etc_t->system_u:object_r:named_conf_t
[...]
restorecon reset /etc/apache2 context system_u:object_r:etc_t->system_u:object_r:httpd_config_t
restorecon reset /etc/apache2/httpd.conf context system_u:object_r:etc_runtime_t->system_u:object_r:httpd_config_t
[...]
restorecon reset /usr/sbin/named context system_u:object_r:sbin_t->system_u:object_r:named_exec_t
restorecon reset /usr/sbin/apache2 context system_u:object_r:sbin_t->system_u:object_r:httpd_exec_t
restorecon reset /usr/sbin/rndc context system_u:object_r:sbin_t->system_u:object_r:ndc_exec_t
restorecon reset /usr/sbin/named-checkconf context system_u:object_r:sbin_t->system_u:object_r:named_checkconf_exec_t
[...]
restorecon reset /var/run/bind context system_u:object_r:var_run_t->system_u:object_r:named_var_run_t
restorecon reset /var/run/bind/run context system_u:object_r:var_run_t->system_u:object_r:named_var_run_t
restorecon reset /var/run/bind/run/named.pid context system_u:object_r:initrc_var_run_t->system_u:object_r:named_var_run_t
restorecon reset /var/run/motd context system_u:object_r:initrc_var_run_t->system_u:object_r:var_run_t
restorecon reset /var/run/apache2 context system_u:object_r:var_run_t->system_u:object_r:httpd_var_run_t
restorecon reset /var/run/apache2/cgisock.3558 context system_u:object_r:var_run_t->system_u:object_r:httpd_var_run_t
restorecon reset /var/run/apache2.pid context system_u:object_r:initrc_var_run_t->system_u:object_r:httpd_var_run_t
restorecon reset /var/log/apache2 context system_u:object_r:var_log_t->system_u:object_r:httpd_log_t
restorecon reset /var/log/apache2/error.log context system_u:object_r:var_log_t->system_u:object_r:httpd_log_t
restorecon reset /var/log/apache2/access.log context system_u:object_r:var_log_t->system_u:object_r:httpd_log_t

The -v option to restorecon causes it to give verbose output concerning it's operations. Often you won't do it in real use, but it's good to illustrate the use.

Now you have to restart the daemons:

# killall -9 apache2
# /etc/init.d/apache2 start
Starting web server (apache2)....
# /etc/init.d/bind9 restart
Stopping domain name service...: bind.
Starting domain name service...: bind.

Apache and BIND now run in confined domains, see the following ps output:

system_u:system_r:httpd_t   3833 ?     Ss     0:00 /usr/sbin/apache2 -k start
system_u:system_r:httpd_t   3834 ?     S      0:00 /usr/sbin/apache2 -k start
system_u:system_r:httpd_t   3839 ?     Sl     0:00 /usr/sbin/apache2 -k start
system_u:system_r:httpd_t   3841 ?     Sl     0:00 /usr/sbin/apache2 -k start
system_u:system_r:named_t   3917 ?     Ssl    0:00 /usr/sbin/named -u bind

It's not particularly difficult. I covered the actual install of SE Linux in about 1.5 minutes. I had considered just ending my talk there on a note of "it's so easy I don't need 5 minutes to talk about it" but decided that it was best to cover something that you need to do once it's installed.

If you want to know more about SE Linux then ask on the mailing list (see http://www.nsa.gov/selinux for subscription details), or ask on #selinux on freenode.

If you ever said to someone (not deeply involved in free software), you shouldn't use KDE, it sux, Gnome is much better, or if you said, you shouldn't use Gnome, it sux, KDE is much better, then please read this email about hazardous or good arguments about desktop usability from Knut Yrvin.

I prefer the study of the law over being personally embroiled with the law in the real world, but if indeed Blue Cross Blue Shield does not pony up the money to cover my recent mole surgeries, I think I am going to take them to small claims court, which I know nothing of, except that it is a cheap way to try to get something done when you are getting screwed by a large faceless organization or some facefull twit. So the basic story is that since I had a lapse in my insurance (thanks to good Old Rutgers University!!), when I decided that I should buy my own just in case, I fell into a “pre-existing” clause, which means basically the insurance company can make your life a living bureaucratic hell because they have to review and approve every single procedure or doctor visit for over a year. Super. So of course when I got my mole diagnosis (dysplastic) and then the surgeries (the total cost being almost 3500) they went for review, but of course Blue Cross is taking their sweet time… The derm office has called for me to get involved so I spent the morning talking to a Ms. Flood from Blue Cross/Blue Shield and she explained to me that all the documentation from the doctor’s office was only received November 1st and then they will take 60-90 days to review the case before making the decision. Now, the insurance coordinator at the dermatology office told me that Blue Cross told her that Blue Cross can take up to FIVE years (not months, Years) to make a decision which seems, well just like they type of thing they would do, but somewhat illegal, maybe, no???!!! Anyway, my plan is to wait those 90 days and then if they deny my coverage or keep flip flopping around saying they need more info, I think I am going to proceed to the small claims court option. Honestly I don’t know if this is a realistic option (though I hope my lawyer friends write back soon) and it is a pain in the neck but I refuse refuse refuse to let this go…. because well, my mole condition was not pre-existing! Sure I had them, but they were happy healthy moles… And I even had seen another dermatologist with my Blue Cross Blue Shield insurance about 6 months earlier and all was good!! Yes I am upset Anyone else ever fought the insurance industrial complex along these lines? Or have used small claims courts? This makes me want to stay in Canada… forever.. but actually I am due back in NYC by August for a permanent job but more on that later.

Just in case you haven't heard of this yet: GnuPG = 1.4.5 contains a remotely exploitable security issue which has been fixed in 1.4.6. You should really upgrade ASAP, as this problem can (theoretically) occur when GnuPG decrypts/checks encrypted email messages/signatures (for example). If you're running Debian unstable: apt-get install gnupg

Erich Schubert writes:

[A rather erroneous rebuttal of Anderson s new tool]

Please. If you are going to use maths to refute a paper, at least read the paper, not the BBC news article.

• You cannot directly write 2 (0/0) = (2 0)/0, no axiom allows that; you cannot prove that 2 = , it is a result given by axiom A15.
• You cannot directly write (0/0)+(1/1) = (0 1+1 0)/(0 1), again, no axiom expresses this kind of distributivity. Axiom A4 however states that +1 = .
• Same for (0/0) / (0/0) = (0/0) (0/0) and (0/0) (0/0) = (0 0)/(0 0). To prove that / = you should use axioms A22 and A15.
• An equation cannot equal nullity, you probably meant expression .
• In the last step of your simple calculation why you must not be allowed to divide by zero , you divide both expressions by , which is allowed by axioms A22 and A15, but the final statement is wrong, you wrote 2 = 1 instead of = .

In fact, dividing by zero can be useful in calculus. What the guy did is design a consistent system (I trust him at least on this) that resembles the IEEE floating point algebra, except that in his system = while NaN NaN. Such a distinction makes it possible to write and solve equations where may be involved. Of course the final result may yield but the important part is that it is consistent, proven, and remains valid whatever the input values. What should be really questioned is:

• The usefulness of it all, of course. As a mathematic tool, since many simple theorems and tools (which often go far beyond what we learn in school, such as simple recursion) do not directly apply and need to be proven again, which is a tedious task. As a computer science tool, the benefits of having = versus NaN NaN remain yet to be explained.
• Teaching that to kids.
• The lack of a serious peer-reviewed publication. At the moment it s in the proceedings of the Vision Geometry conference.