While anyone who has had a 1) medical condition and 2) access to Internet in the last five years probably knows that patients are increasingly using the net (and now google) to diagnose medical conditions, it is only now that the medial establishment is starting to recognize or really admit to the reality of this widespread phenomenon and even doing studies on them, such as the one released a few days ago by the BJP Googling for a diagnosis use of Google as a diagnostic aid: internet
based study. The study sought to ascertain how effective google was as an aid in medical diagnosis. As various new outfits are reporting it is moderately high. What I love about this study and the corollary reporting is the naive tone they have to assume, transmitting the news as if the public knew very little about this, and would in fact, be induced into surprise!!!!!!!!!! when first facing the new. But in fact, I think it works in the opposite way. The surprise is that they took so long to admit to what was in front of us for many years now. While the news articles reporting on the study stay within the province of doctors, the report acknowledges, in fact opens with, the fact that patients may be forging the path in Internet-diagnosis. The authors write in their second paragraph:

It seems that patients use Google to diagnose their own medical disorders too. After evaluating a 16 year old water polo player who presented with acute subclavain vein thrombosis, one of us (HT) started to explain that the cuase of the thrombosis was uncertain when the patients father blurted out But of course, he has paget-von Schrotter symdnome. Having previously googled the symptoms, he gave us a mini-tutorial.. and the correct treatment for the syndrome. This experience led us to ask How googe is google in helping doctors to reach the right diagnosis

Again, what I love about the tone of this opening is that it is as if these doctors stumbled on a great but deeply hidden fact to make a breath-taking discovery, one that, however, since is it is SO very emergent and thus still not *really* verified by Science, they must proceed with great caution, qualifying with phrasees like It seems that patients use Google to diagnose their own medical disorders too . I am sure they and most doctors are personally are not so na ve but since this has been something virtually without no official acknowledgment among professionals and in the journals, the genre of writing just requires it to be framed cautiously. As fun to read are the comments, for they stretch from moral panic:

The implication that ‘googling’ be an adjunct to proper medical school training, continuing medical education through courses and reading peer reviewed journals is laughable and bordering on dangerous. I am shocked that this has been published by the BMJ.

to celebration:

For the modern dermatologist, the internet is indispensible and google is only the start, and for this reason a desktop computer with high speed internet access is an essential tool for all clinicians. Long live the information superhighway!

While others muse on the broader emacipatory possibilities

One can imagine the benefit to young doctor in developing country who now have access to a grand medical library in their hands.

I am especially interested in this very dynamic because it is one pillar propping my next project on psychiatric survivors, which exceeds the particular topic of challenges to psychiatry in its general focus on medical/patient reconfigurations following from Intent-based activism, self-help, diagnosis, and critique. And for those who think I have made a radical departure from my last project, here is where I see one (of two or three) threads of continuity: for patients are generating an enormous amount of amateur knowledge, that I think is not unlike the peer-to-peer production of software hacking, and it is a form labor usually accompanied by a strong critique of expertise and other medical practices. I am now reading some literature on patient activism, like the issue from the February 2006 in Social Science and Medicine that collects 11 articles on patient organization movements. For those who work on this topic, the collection is worth your while and the editorial introduction by Kyra Landzelius is stellar. It is not only written beautifully (which I think is rare for these openings because it is often a rote, unimaginative regurgitation but this was a pleasure to read) but provides an engrossing overview of some new trends and some of the diverging forms of politics that arise from what is really a motley bunch of organizations and contests in patient and anti-patient activsm. She opens by defining four spheres that shape and inform the forms of contents that are part and parcel of these patient movements, the four being: 1. Revolutionary feats in technoscientific engineering
2. Restructuring of healthcare systems across industrialized nations
3. A Revised contract between science and the public stemming from a criss of confidence in science
4. An upsurge in the articulation and diversification of health activisms (p. 530) These four are key but I was shocked that there was no specific inclusion—though it comes out plenty in the introduction in other ways of the Internet. For while I am no techno-determinist, the Internet I think, can’t be ignored for it has fundamentally changed the map and tenor of patient activism, allowing for more rapid connections between various stakeholders, providing a medium by which those officially unrecognized illnesses are given shape and form, and where an ethical cultivation of self-help, self-diagnosis, self-medication, along with copious critique and forging of alternatives is happening, right before our eyes, virtually in real time. It is the medium by which a new chapter of patient activism is being written and I think it is a real mistake not to give it serious attention and credit. And perhaps one of the most interesting things about it is that it without it, it would leave many otherwise home-bound, sick folks, without a medium by which to engage in political activity or even community self-help, for let’s face it, these take a lot time and energy. When you are sick and home-bound, for example, there may be a limited number of types of engagements you literally have the energy to partiicpate in and the Internet lowers the barrier of political entry because of its ease and because you can still type away, even when feeling otherwise totally awful… This may be a brute material point but nonetheless, key to understanding the political power of the Internet. Now of course the question left is will Google capitalize on this and create “Google Diagnosis”?

Antiamericanism is a more and more widespread feeling, not only in eastern countries, but also here in Europe. Despite all the admiration for the achievements of americans throughout history, I have to confess that I increasingly share that feeling. (I've blogged about the USA before, so you probably already know this.) Most recently:

Es h ufen sich Klagen von Gesch ftsreisenden ber Zollbeamte, die Daten auf Mobilcomputern einsehen wollen. [ ] Regierungsbeamte haben das Recht, nicht nur das Reisegep ck, sondern auch elektronische Datentr ger zu durchsuchen. W hrend es konkreter Verdachtsmomente und einer richterlichen Anordnung bedarf, damit Beamte private E-Mails oder vertrauliche Computerdateien lesen d rfen, [haben] Z llner das Recht, die Computer auch unverd chtiger Reisender ohne Angabe von Gr nden zu durchsuchen oder gar zu konfiszieren. [Neue Z rcher Zeitung, 10.11.2006, edited]

(Complaints of business travelers about customs officers, who want to investigate data on mobile computers are accumulating. [ ] Government officials have the right, to search not only the luggage, but also electronic Data media. While specific suspiciouns and judicial orders are required, for governement officials to read private emails or confidential computer files, customs officers have the right, to scan or even confiscate computers of any traveler without giving any reasons.) This is not complaining about travel to China, Africa, Belorussia or whatever, but is a warning issued by the Association of Corporate Travel Executives about crossing the U.S. border. The ACTE is, by the way, an international organisation based in the U.S.A., so they should know.

My post about securing an office received many comments, so many that I had to write another blog entry to respond to them and also add some other things I didn't think of before.

One suggestion was to use pam_usb to store passwords on a USB device. It sounds like it's worth considering, but really we need public key encryption. I don't want to have a USB device full of keys, I want a USB device that runs GPG and can decrypt data on demand - the data it decrypts could be a key to unlock an entire filesystem. One thing to note is that USB 2.0 has a bandwidth of 30MB/s while the IDE hard drive in my Thinkpad can sustain 38MB/s reads (at the start - it would be slower near the end). This means that I would approximately halve the throughput on large IOs by sending all the data to a USB device for encryption or decryption. Given that such bulk IO is rare this is feasible. There are a number of devices on the market that support public-key encryption, I would be surprised if any of them can deliver the performance required to encrypt all the data on a hard drive. But this will happen eventually.

Bill made a really good point about firewire. I had considered mentioning it in my post but refrained due to a lack of knowledge of the technology (it's something that I would disable on my own machines but in the past I couldn't recommend that others disable without more information). Could someone please describe precisely which 1394 (AKA Firewire) modules should be disabled for a secure system? If you don't need Firewire then it's probably best to just disable it entirely.

To enable encryption in Fedora Core 6 you need something like the following in /etc/crypttab:

home_crypt /dev/hdaX /path/to/key
swap /dev/hdaX /dev/random swap

Debian uses the same format for /etc/crypttab.

The Peregrine blog entry in response to my entry made some really good points. I wasn't aware of what SUSE had done as I haven't done much with SUSE in the past. I'm currently being paid to do some SUSE work so I will learn more about what SUSE offers, but given the SUSE/MS deal I'm unlikely to use it when I don't have to. Before anyone asks, I don't work for SUSE and given what they have just done I will have to reject any offer of employment that might come from them.

I had forgotten about rsh and telnet. Surely those protocols are dead now? I use telnet as a convenient TCP server test tool (netcat isn't installed on all machines) and never use rsh. But Lamont was correct to mention them as there may be some people still doing such things.

The Peregrine blog made an interesting point about Kerberised NFS being encrypted, I wasn't aware of this and I will have to investigate it. I haven't used Kerberos in the past because most networks I work on don't have a central list of accounts, and often there is no one trusted host.

I strongly disagree with the comment about iSCSI and AoE "Neither protocol provides security mechanisms, which is a good thing. If they did, the additional overhead would affect their performance". Lack of security mechanisms allows replay attacks. For example if an attacker compromises a non-root account on a machine that uses such a protocol for it's root filesystem, the victim might change their password but the attacker could change the data back to it's original values even it if was encrypted. Encryption needs to have sequence numbers embedded to be effective, this is well known - the current dmcrypt code (used by cryptsetup) encrypts each block with the block ID number so that blocks can not be re-arranged by someone who can't decrypt them (a weakness of some earlier disk encryption systems). When block encryption is extended to a network storage system I believe that the block ID number needs to be used as well as a sequence ID number to prevent reordering of requests. CPU performance has been increasing more rapidly than hard drive performance for a long time. Some fairly expensive SAN hardware is limited to 40MB/s (I won't name the vendor here but please note that it's not a company that I have worked for), while there is faster SAN hardware out there I think it's reasonable to consider 40MB/s as adequate IO performance. A quick test indicates that the 1.7GHz Pentium-M CPU in my Thinkpad can decrypt data at a rate of 23MB/s. So to get reasonable speed with encryption from a SAN you might require a CPU which is twice as fast as in my Thinkpad for every client (which means most desktop machines sold for the last two years and probably all new laptops now other than the OLPC machine). You would also require a significant amount of CPU power at the server if multiple clients were to sustain such speeds. This might be justification for making encryption optional or for having faster (and therefore less effective) algorithms as an option.

I believe that the lack of built-in security in the AoE and iSCSI protocols gives a significant weakness to the security of the system which can't be fully addressed. The CPU requirements for such encryption can be met with current hardware even when using a strong algorithm such as AES. There are iSCSI accellerator cards being developed, such cards could also have built in encryption if there was a standard algorithm. This would allow good performance on both the client and the server without requiring the main CPU.

Finally the Peregrine blog entry recommended Counterpane. Bruce Schneier is possibly the most widely respected computer security expert. Everything he does is good. I didn't mention his company in my previous post because it was aimed at people who are on a strict budget. I didn't bother mentioning any item that requires much money, and I don't expect Counterpane to be cheap.

Simon noted that developing a clear threat model is the first step. This is absolutely correct, however most organizations don't have any real idea. When advising such organizations I usually just invent a few possible ways that someone with the same resources and knowledge as I might attack them and ask whether such threats seem reasonable, generally they agree that such things should be prevented and I give further advice based on that. It's not ideal, but advising clients who don't know what they want will never give an ideal result.

One thing that I forgot to mention is the fact that good security relies on something you have as well as something you know. For logging in it's ideal to use a hardware security token. RSA sells tokens that display a pseudo-random number every minute, the server knows the algorithm used to generate the numbers and can verify that the number entered was generated in the last minute or two. Such tokens are sold at low prices to large corporations (I can't quote prices, but one of my clients had prices that made them affordable for securing home networks), I will have to discover what their prices are to small companies and individuals (I have applied to evaluate the RSA hardware). Another option is a GPG smart-card, I already have a GPG card and just need to get a reader (this has been on my to-do list for a while). The GPG card has the advantage of being based on free software.

One thing I have believed for some time is that Debian should issue such tokens to all developers, I'm sure that purchasing ~1200 tokens would get a good price for Debian and the security benefits are worth it. The use of such tokens might have prevented the Debian server crack of 2003 or the Debian server crack of 2006. The Free Software Foundation Fellowship of Europe issues GPG cards to it's members, incidentally the FSFE is a worthy organisation that I am considering joining.

There are basically two kinds of setups for mailing lists managed using Mailman, regarding posts from non-members :

• Accept posts from non-members. This lead to quite a lot of spam on the list, but also to no work for the moderators.
• Put posts from non-members in a moderation queue. This result in a spam-free mailing list, but also in a lot of work for moderators, and in posts delayed for days.

It would be great if Mailman could ask the sender for confirmation (either email-based or web-based) before accepting the mail or putting it in the moderation queue. This would greatly reduce the amount of spam on the list or in the moderation queue. This is also known as Mailman feature request #673265. A similar feature has apparently been in Sympa for nearly 4 years.

More Functional Programming in Python 2.5, where's the Syntax? I'm glad to read that more functional stuff is coming with Python 2.5, especially for the introduction of partial application, the heart of functional programming. Still, FP is not only about semantics, is also about fostering code reuse and implementing stuff in more elegant and concise way. For such stuff to be effective though, a nice and handy syntax is (IMO) mandatory. Anyone knowing i J. Random Functional Language (whatever Lisp dialect, ML, Haskell, ...) should be able to guess how to apply function partially in Python. Considering that Python has a long history of syntactic extensions via PEPs (think about list comp or generator expressions) I fail to understand why to apply a function partially I have to write something as ugly as:

all_evens = functools.partial(all_divided_by, x=2)

It's only me or the most natural syntax, that everyone would be able to guess out of the box, would have been:

all_evens = all_divided_by(x=2)

?

Read and perhaps sign the letter urging discussion for open access in Anthropology!

One of the benefits of following the various web standards and guidelines is that most browsers will show something on the screen before the page has finished loading. Avoiding unnecessary rubbish in your html and optimising graphic files can make it look like your site loads faster. This may be getting more important as networks get busier and more sites place more demands on computers. Web users may be finally getting fed up. Today's news reports: "Shoppers are likely to abandon a website if it takes longer than four seconds to load, a survey suggests" (from Websites face four-second cut-off [BBC], Akamai/Jupiter Research full report).

According to turmzimmer, there are 53 RC bugs remaining in testing that are not fixed in unstable and are over 20 days old. This is great, because that number is down from about 80 a week or so ago; but that leaves a good number of harder bugs open that could probably use some attention from NMUers given that these are the bugs that are specifically not seeing turnaround from maintainers. Just think, if every developer fixed just one of these bugs, we would have 19 NMUs for each package, the ftp team would be pissed, and we could release just two weeks from now once ftp-master.d.o was able to clear the backlog! And remember, any bug not found in a standard 52-bug deck is a spare portabella mushroom.

Wie ein Mitbewohner von mir gerade erfahren musste, sind DHL und DHL Express so "disjunkt", dass man bei der DHL insbesondere kein Paket abgeben kann, dass per DHL Express verschickt werden soll. Was jetzt besonders lästig ist, weil man ein Paket bei der DHL ja dann in der Filiale vorbeibringen kann, wenn es gerade passt. Und an den Packstationen wohl sogar 24h am Tag. Und gerade war jemand von der DHL bei uns an der Tür; nur kann er halt das Paket für die DHL Express nicht mitnehmen. Ich habe den Eindruck, wenn das über die normale DHL verschickt würde wär es schneller... da wär das Paket schon da, bis die DHL Express es mal schafft hier vorbeizukommen wenn jemand zuhause ist...

The day that Bruce Perens gets to tell me that Novell is the new SCO is the day that I willingly accept an offer to be sodomised with a pneumatic drill.

Novell have contributed more code to Linux than pretty much any other single commercial entity other than Red Hat. Without the Novell kernel developers, Linux would be in a much worse state than it currently is. However, I'd expect that everyone in Novell knows that they're also entirely dependent upon the developers working for other distributions. Killing every other distribution isn't advantageous to Novell. And, perhaps more importantly, the death of Novell would be a (short-term?) disaster for every other distribution. Debian may have a larger market share than Novell, but if Novell dies then that's going to be a share of a very small market.

The Linux community doesn't need to eat its own. And one very basic fact does still remain - if Microsoft couldn't sue you before, they still can't sue you. If you're legal, nothing Novell can do will alter that.

(It's sort of touching that Bruce has time to comment on this sort of thing, but didn't seem to find time to make Linuxworldexpocontinentconferencecountymeeting last month. Thanks, Bruce. Thruce. But hey, you're in the credits for A Bug's Life and Toy Story II!)

Having spent the better part of two days provisioning my new MacBook Pro’s OS X, Debian, and Windows XP instances, I am keenly aware of how much the Debian distribution’s package management system and its volume of packages have spoiled me. In that two days, the amount of time required to provision Debian was negligible, even though it is configured to completely match my Lifebook’s Debian Sid instance. In fact, the sum total of time to set up Debian, including every application I use, was about 45 minutes of my involvement. Those who know Debian (and Ubuntu, Linspire, Xandros, Mepis, or any other Debian derivative) are coolly nodding their heads, while others are probably thinking I am a lying, biased Linux zealot. It’s no lie; here are the steps I had to take:

• Run the Debian Installer business card image and perform a stock Sid installation, choosing Desktop and Standard System options in the task selection step. If you weren’t wanting to run Sid, the netinstall image would be fine as well.
• Generate a package list on the current Debian installation via # dpkg --get-selections > dpkg-selections.txt
• Copy the package list file to the new installation; I have copied it to my home directory in this example.
• Set the package selections for the new installation via # dpkg --set-selections ~/dpkg-selections.txt
• Run aptitude or synaptic and choose the install action, then go do something else. Thousands, literally thousands of software packages are being installed for you. Everything from your email client to your office suite to your software development tools are being pulled down from package mirrors. In my case, this was over 850MB of compressed package files.
• After the package download, answer any configuration questions aptitude (or synaptic) poses.
• Copy your /home directory contents to the new installation.

Compare that to what it takes with either Mac OS X or Windows XP to get all of your applications installed and configured. Even if you don’t know a thing about Linux or even the more technical side of those operating systems, you can tell from the brevity of that set of steps that the Debian setup is remarkably simple. Now, some will already be keying in their comment posts with exclamations of “Hey! There’s DarwinPorts/Fink/Cygwin!” Yeah, each of those is a nice start; however, they pale in comparison. Fink at least has the robust apt/dpkg foundation, but even it has a relatively meager package selection. I am sure I’ll be writing more on life with Fink and DarwinPorts in the near future. I still don’t have half the stuff installed on XP that I plan to use. I get tired just thinking about the installs. 8^)

I just got back from 4S, which happens to be one of my favorite of the large professional association conferences. Ok, 15 minutes to deliver talk is the equivalent of being treated as canned sardines, and thus totally unpleasant, but I feel like I can go to most any talk and find it relevant or interesting to my own work. I t is certainly more manageable too in terms of size than something like the AAAs which also gives you a paltry 15 minutes to present and worse, the association has been treading in some ethically problematic territory lately, so much so, I would rather throw my money to the other AAA. While in Vancover, my Internet access was near to nothing (I was staying with a friend who I have not seen since the summer of 2002, but alas, thanks to chatting we have been in pretty consistent contact). When I came back I came across some discouraging but not so surprising new news on the AAA and their cowardly decision to fight the FRPAA that would mandate open access for articles derived from federally funded research… The cherry on top of the cake was they dissolved the AnthrSource Steering Committee formed precisely to figure out how to open up access, no less! Alex Golub, a Savage Minds blogger, and a now ex-member of AnthroSource committee has written an excellent roundup of the story (link above) and Peter Suber, also has two very nice summaries, including links to the appropriate documentation. This year since I am curtailing my time on the conference circuit, I decided not to go to the AAA conference because frankly I am totally annoyed with the professional organization. I am usually quite proud to be or at least amused after I tell folks that I am am anthropologists (most react as if I had decided to embark on some real courageous path) but I am quite embarrassed about the association that is supposed to represent my interests and the profession at large. The links on SM point to and flesh out the problems with AAA’s refusal to jump on an exciting opportunity to free up some knowledge but I want to just emphasize three of the most problematic parts of their decision: 1.The most offensive part is that in reality the proposed bill is quite conservative in so far as it only asks for what should already be (a) given. That is, if the government is using tax dollars to fund research, it has every right to demand the fruits of such scholarship is made available to tax payers. Right? Given the neoliberal moment we are in, in which the government is retrehcnhing on all sorts of supports, this bill is admirable and I am afraid that if it does not pass it can be easily used by conservatives to justify future cuts of such funds. And given the very uncontroversial nature of the bill, it is not surprising that so many of the social science and humanities associations did not protest the bill… Anthropology sticks out as a sore sore thumb in fact. 2. The AAAs deployed FUD tactics to justify their position saying that open access would jeopardize peer review… Sigh. That is just so off the mark and the AnthroSource steering committee letter addressed this point well. 3. Many anthropologist know first-hand how appalling access outside of Europe, US, Australia, Japan etc, can be, even for academics and thus, AAA’s lack of support for this is also implicitly sanctions the North South Division that have plagued the field and all of academia so long. And for a field that has often been very thoughtful about these power/knowledge dynamics, it is doubly even more stinging… Is there really such a strong disconnect between the association and discplinary ethical currents?

Things like this make us women feel VERY welcome in IT.

This time it's EagleSoft. But I am fearing SIMO in Madrid this week. It is just a CBIT-kind of computing fair, where there are more semi-naked women that semi-naked hardware to look at.

I did not want to attend this year, but I will. Just to take pictures of how male-targetted this market is. Naked women are used to sell anything, including computers.

I am nauseated and want to run really far away, where I can no longer take part in this consumerism-sexism whirlpool, and life a simple, materialism-free life, kind of Amish-like, but with access to my email :).

Excuse the rant.


Update: As requested by Madduck, I am happy to quote Erinn: The expression "nice rack" is used as a way to compliment a woman's breasts, as she was kind enough to explain on IRC for non-native speakers.
Please also note the expression on the guy's face.
Also, there are links to more sexism in IT adverts in this entry's comments. Feel free to add your own pointers. As consumers^Wcustomers we can make the educated choice.

I was too busy to read my favourite tech news the last few weeks. This sunday I finally started working on the backlog. Parts of it - I'm not going to try to catch up with Slashdot... And most of the time, I'm only reading the headlines, too. Most of the stuff here will be in German; since I'm also interested in the politics surrounding technology here in germany, a local ticker such as Heise is most useful for me.

• If you're living in germany, please sign the Petition against the use of voting machines in germany. Read my german blog post on it for the reasons why voting machines undermine democracy (short version: most citicens can't verify their vote was counted, or that the system is fair)
• Nvidia closed-source drivers had a security issue. German article on it. Another example why closed source drivers are bad - they don't get the security verifications and support that opensource software has. Apart from being badly integrated and less reliable.
• Google bought YouTube. IMHO a bad idea. YouTube is full of copyright violations, and there is not that much original content or community, actually. Having the financial background of Google, it's now much more interesting to actually sure YouTube.
• Buchpfade.de a community platform created by friends of mine, centered around books. Don't ask me about details, I havn't used it yet. I think you can see what your friends have been reading, and get some book recommendations based on the reading habits of others.
• Kiss or Diss
. Like Hot or Not, but with video. (aka: "totally better"). Though not too interesting for the tech crowd, it actually is quite addictive. The official launch should happen sometime the next few days.

the Novell and Microsoft deal: I wonder if it's mostly to show an act of good will, to calm Europe in preparation of the Vista release. This and the new API for third party security software may get them to launch Vista on time in Europe, too.

Contact information on web pages. May now be reachable with two clicks from the first page, if the wording is obvious. Germany used to require contact information to be reachable with a single click for commercial web pages.

Flash 9 for Linux. Beta. Closed source, and it frequently locks up my browser. Probably has a lot of security issues, too; so better use it only with flashblock, and load flash only from somewhat trusted sites. But it works, and it finally allowed me to see that I don't care about MySpace videos and similar crap.

New Ubuntu release. Congrats, but I havn't tested it yet. I considered going Ubuntu for some of my computers, but ended up with Debian on all of them. I just feel more at home here, and there is not much that Ubuntu has in extras for me that I really need.

My new laptop has harddrive encryption, and encrypted swap. Suspend works, thanks to David Härdemann for helping me with that.

I missed the Debian bug squashin party, which was kindly hosted by the LiMux team, responsible for the Debian Linux installation at the city of Munich. This deployment may become one of the most prominent examples of good Debian use: customized, to offer the best end user experience.

Debian renames firefox and thunderbird. Welcome iceweasel and icefox. The official mozilla stuff is somewhat written for Windows, and needs modifications for proper Linux integration. This violates Mozilla trademark policy. In fact, Ubuntu and other Linux distributions would have to do this renaming, too!

BenQ Mobile crash in Germany. IMHO this was planned by both Siemens and BenQ to get rid of "liabilities". Reminds me of the famous un-word "Kollateralschaden"...

Firefox 2.0 - does this mean it has more features I do not need? I'm using epiphany; it has almost all the features I need, but a much nicer, less cluttered UI. Some say it's also faster, and it's Gnome integration definitely is better. The only thing I sometimes use firefox for is the web developer extension, which is a really nice tool when you have to fight HTML and CSS.

Java to become OpenSource. Well, I hope they use a sane license... but at least that should finally clear up the licensing issues many people still see with current Debian Java packages. But I fear it might already be too late - Mono support has been better than Java for some time now.

[RV Heraclitus SE Asia voyage: blog photos] We arrived in Kupang (West Timor), will be heading off on Tues 7th to motor through Indonesia and towards Thailand, hopefully visiting Roti, Flores, Sumbawa and or other islands in the area along the way. We've seen the ever-changing iridescent colours of a dying mahi-mahi, tuna blood, misty hills of a strange new land looming on the horizon, the unfamiliarly shaped Indonesian fishing and other boats, dead-calm seas in the early morning, a bossy French warship, customs planes flying overhead and calling us every day, the eerie blue of the deep ocean with floating jellies at a swim stop, taking down the mainsail in the channel, shitter crabs, oil platforms in the distance, flocks of flying fish getting out of our way during a calm sunset, bird-stowaways, the amazing crystal goo of phosphorescence off the bow, zillions of mini-buses (taxis) in Kupang and many other things. The open-sea sailing has been mostly relaxing, although we motored a lot of the way from Thursday Island. I'm hoping there will be some more wind, but it looks like we'll be motoring to Thailand (to arrive after Christmas), maybe against the wind since the season has changed. I'm looking forward to finally doing some diving and snorkeling during the next leg of the journey. If there are any Indonesian Debian or Indymedia folk that would like to meet up with me for a keysigning and or bintang, please send me an email and I'll try to let you know if an opportunity arises.

I had an exhausting and stressing weekend. We had a long long holiday this week in Mexico. Some people had the week until Tuesday and had from Wednesday to Sunday off, because of the Day of the Dead celebration (being Nov 1st and 2nd, and taking Friday 3rd also). I didn’t have any classes, but the Superior Algebra teacher made us attend an exam on Friday and Saturday (9 am and 8 am, respectively). Some of my friends were high and drunk from Tuesday afternoon and will remain that way until tomorrow, while I had to stay at home and work stressing for my poor understanding on the class, trying to study with tons of things on my head, etc. This so much sucks. Anyway, last week, Raquel, Tato, Javier and a friend of Tato managed to go to Yeah Yeah Yeahs‘ concert, which was fucking amazing. I love Karen O, her sex appeal and the way she does to put people in the mood is great and lovely. Unfortunately, Rach hasn’t put the pics (we got her digital camera inside the building but was discovered by the staff and forced to put it on a stuff hold table, fuckers) yet, I hope she does soon The best moment of the concert: Date with the Night. Next weekend, the Corona Music Fest will take place in the Azteca stadium, which has me anxious. I can’t wait to watch The Mars Volta on stage. Other nice bands I’m expecting to watch are NOFX, Clap Your Hands Say Yeah, Resorte, La Gusana Ciega and the Nortec Collective. Here’s the flyer:

Following Joey’s lead, here’s some DWN-style comments on some of the stuff I’ve been involved in or heard of over the past week… A future for m68k has been planned on the release list, after being officially dropped as a release architecture in September. The conclusion of the discussion seems to be that we’ll move the existing m68k binaries from etch into a new “testing-m68k” suite that will be primarily managed by m68k porters Wouter Verhelst and Michael Schmitz, and aim to track the real testing as closely as can be managed. In addition the m68k will aim to make installable snapshots from this, with the aim of getting something as close as possible to the etch release on other architectures. A new trademark policy for Debian is finally in development, inspired by the Mozilla folks rightly pointing out that, contrary to what we recommend for Firefox, our own logos aren’t DFSG-free. Branden Robinson has started a wiki page to develop the policy. The current proposal is to retain two trademark policies – an open use policy for the swirl logo, that can be used by anyone to refer to Debian, with the logo released under an MIT-style copyright license, and left as an unregistered trademark; and an official use license for the bottle-and-swirl logo, with the logo being a registered trademark, but still licensed under a DFSG-free copyright license. The hope is that we can come up with at least one example, and hopefully more, of how to have an effective trademark without getting in the way of people who want to build on your work down the line. Keynote address at OpenFest. Though obviously too modest to blog about this himself, Branden Robinson is currently off in Bulgaria, headlining the fourth annual OpenFest, speaking on the topics of Debian Democracy and the Debian Package Management System. New Policy Team. After a few days of controversy following the withdrawal of the policy team delegation, a new policy team has formed consisting of Manoj Srivastava, Russ Allbery, Junichi Uekawa, Andreas Barth and Margarita Manterola. Point release of sarge, 3.1r4. A minor update to Debian stable was released on the 28th October, incorporating a number of previously released security updates. Updated sarge CD images have not been prepared at this time and may not be created until 3.1r5 is released, which is expected in another two months, or simultaneously with the etch release. Debian miniconf at linux.conf.au 2007. While it may technically not be supposed to be announced yet, there’s now a website for the the Debian miniconf at linux.conf.au 2007, to be held in Sydney on January 15th and 16th (with the rest of the conference continuing until the 20th). This year derived distributions are being explicitly encouraged to participate, so competition is likely to be high, and it’s probably a good idea to get your talk ideas sorted out pretty quickly if you want them to be considered!

More bits for DWN, which published some of the previous ones last week. A release update was posted by Andreas Barth. Items discussed include the full freeze of Etch (delayed slightly), the kernel firmware issue (considered resolved by the release team), an analysis of remaining release critical bugs, and some final changes to the release policy including LSB 3.1. All developers should read the full email for details. Work continues on d-i RC1. Everything is in place and only some building and testing needs to be done before the new version of the installer is released. Development work on etch's installer after this will be limited to bug fixes, and an update to the 2.6.18 kernel. Frans Pop posted a todo list and an updated timeline. ARM v3 support. There was a thread on debian-arm about whether etch should support the arm v3 instruction set, used in a few older arm systems, but not supported by mono. Wookey said "Yes. I think the time has come for arm to drop v3. It might have been better to anounce this earlier, but never mind." There were no objections.