Although an interim release, there are a number of new features in 0.8.2 that are worth noting.

1. emrecent - possible candidate for a rename to emdput, this script started off just as a review tool for recent builds (hence the current name). Finds recent .changes files in the Emdebian working directory, collates them, provides a viewer for the debc -a $ARCHcontents using whiptail or zenity along with error logging. If the default zenity frontend is installed, you can still select to use whiptail (e.g. when over an SSH connection) using the -w option to emrecent. Further checks are run using the second script:


2. emdebcheck - a local Emdebian version of the debcheck that runs on the Debian archive using edos-debcheck to highlight non-installable packages before an upload breaks the archive. This isn't such a problem in Debian but Emdebian needs to build installer images and similar tools from packages in unstable so an installability check is very useful. Certain packages are expected to be non-installable due to dependencies that are removed in Emdebian so emrecent supports a --skip option to omit the emdebcheck run for such builds.


3. emsource --status now reports errors logged by emrecent or emdebcheck.


4. Unpacking support in emsandbox - EXPERIMENTAL!. debootstrap --foreign puts a higher-than-necessary burden on the host device when running the default --second-stage - not just in CPU workload but in the amount of free space required to copy and unpack all the .deb files. The original debootstrap tarball contains the downloaded .deb archives and only a few packages are actually unpacked manually. Unpacking support in emsandbox adds a handler using dpkg to unpack ALL .deb files in .$BUILDPLACE/var/cache/apt/archives/ using dpkg -e and dpkg -x, creates a suitable status file for dpkg and removes the .deb packages for a smaller tarball. The result is (almost) a foreign filesystem image that can be copied directly onto the host device. The remaining tasks are only:
   • /sbin/ldconfig
   • /usr/bin/dpkg --configure -a
   . Depending on how well this works in real situations, unwrap could become the default handler for debootstrap --second-stage --foreign in emdebian-tools. Unpack support is enabled via the debootstrap suite scripts which define the package set, the first_stage_install and the (much reduced) second_stage, replacing the sequence of install commands with a single function provided by emdebian-tools. See /usr/lib/emdebian-tools/emdebian.gpe for an example.

In common with all previous interim Emdebian releases, 0.8.2 has been uploaded to the Emdebian tools repository already added to your apt sources when installing emdebian-tools so apt will be able to upgrade seamlessly.
(0.8.0 introduced a check in emsetup to ensure that the latest version has actually been installed.)
Once features have stabilised (probably after testing at Fosdem), I'll upload 0.9.0 to Debian unstable, as usual, or maybe one or two more interim releases to Emdebian.

Around the end of 2006 I come up with the idea of setting up something I called font-machine: a collection of scripts / utilities, intended to improve quality of fonts by defining and implementing automatic tests able to catch errors and provide screenshots. Some pioneering work on this area was done a while ago by Miriam who set up a page showing how fonts currently in Debian look like. I did something similar focusing on the fonts used by the Debian graphical installer (will write a separate post to describe the way it works). I'll start describing the tools which I've used more frequently; of course my preference goes to the ones which can be run non-interactively: those that can be invoked inside shell scrips and keep your CPU busy! fntsample is probably one of the programs I've used more frequently during the last months: it was written by Eugeniy Meshcheryakov, who also made it available as a Debian package, and creates really nice and professional PDF / PS charts showing all the glyphs contained in a particular font file. The following code snippet shows how you can use fntsample to create pdf charts for each of the ttf files contained in ttf-dejavu package (will often refer to this package since I maintain it :-) ):

font="http://ftp.de.debian.org/debian/pool/main/t/ttf-dejavu/ttf-dejavu-core_2.23-1_all.deb"
deb=$(basename $ font )
wget $font
dpkg -x $ deb  $ deb/.deb/ 

outdir="out"
mkdir $outdir
for ttf in $(find $ deb/.deb/  -name '*.ttf') ; do
pdf="$(basename $ ttf    sed -e "s \.ttf$ \.pdf ")"
fntsample -f $ ttf  -o $ outdir /$ pdf  -l > $ outdir /$ pdf/.pdf/.outline 
pdfoutline $ outdir /$ pdf  $ outdir /$ pdf/.pdf/.outline  $ outdir /$ pdf 
done

Note that PDF files will have useful outlines (aka bookmarks) courtesy of the pdfoutline tool shipped with the fntsample package. Results are IMHO very imperessive! PS: looking at the above chart for Cyrillic, I've just noticed the glyphs are ordered as to read "SEX"... I did not choose that particular chart snippet on purpose!

The notice for the February meeting was posted on Monday. Late again - it's meant to be a week's notice, according to this. I'm disappointed that the current SPI board still hasn't got basic member communications working, even as the year end approaches. Is a default cron-job mail (like we use at TTLLP ) so difficult to set up? Anyway, one of the few interesting items on the agenda is

"Decision on new board member"

but I've not applied for the post for three reasons. Firstly, on reflection, enough SPI members placed me as last choice (which I think is mostly based on old mud-slinging, but it still happened) in its last election that I don't think being appointed would give me a strong enough mandate for the changes I want (more transparency, consultation and work towards meeting the Better Business Bureau standards). Secondly, I'm finding that my Cooperatives-SW board post is taking more time this year. Finally, I hope to be appointed to a representative post in another organisation soon and it's nearly always better to work where I'm obviously wanted. I've asked if the applications of any candidates for the SPI board post will be posted for member review somewhere (because members are supposed to oversee the board, but how can that happen if we don't see basic info on them?) and for there to be a members Q+A during the meeting, but I don't know whether there's more than one candidate or whether the Q+A will happen. Members are a bit in the dark on this one. Again. I hope to see some other SPI members online about 1900Z tonight (20 Feb). I should actually be online during this one, for a change.

Angie, Leif and I met with one the two surgeons who will be doing the work. I s'pose it's good and bad that the co-director of the UCSF Spine Centre, Dr. Mummaneni is personally taking on the case. Good that I'll have the best possible care; Bad that I'm apparently interesting enough to warrant it.

Meeting with him was matter of fact. He talked about how he'll approach the surgery (from the back, since the placement of my aortic arch and innominant vein would make coming through the front problematic). It looks like I'll have rods and screws from T1-T6, with a cage replacing the vertebra at least at T3 and possibly at T4. People don't usually do that much movement in their thoracic back so, ongoing, his opinion was that I largely won't notice it.

In hospital-time will depend on whether or not the surgery can be done in one shot. Because of the trickiness of the area, it may not be possible to get it entirely from the back, and he'll do two surgeries rather than one if that can avoid me winding up in a wheelchair. Ideally, there's one surgery, and a week later I'm home and able to take care of myself. The way they take the tumor out in a couple pieces is known as "en bloc spondylectomy", but may not be possible with the way the spinal nerve is being pinched. He described the surgery itself, and the simple version is "remove one or two vertebra, replace them with cages, stabilize the surrounding area". Yay to the Black and Decker surgical division.

He'll be assisted by Dr. Chau for spinal cord monitoring and the rest of the surgery.

The last thing they did as I left the hospital last Saturday was a full body CT scan with contrast, and the radiologists have declared that that they see no additional tumors in the body. I'll visit with an oncologist to do some final tests, but consistently the answer is coming back that this isn't cancer, it's more likely an isolated mutation. Dr. Mummaneni doesn't feel that this is a side effect of sitting at a computer since I was 3 years old, any of the car accidents, or being hit across the back with a flute case in grade 9.

I did ask if I'll set off metal detectors at airports after this, and apparently the titanium used doesn't do that.

So, erm. What are the risks? Honestly, pretty consistently less than doing nothing. Having this thing would eventually result in paralysis anyway, and aside from the usually OMG-they're-cutting-me-open-anything-could-happen type of things that don't keep me from biking to work on a regular basis, all the other options are "And life improves from here". Informed consent means that I have statistics in my head that I'd rather not dwell on and a laundry list of things to panic about when I wake up in the middle of the night but those really are just nerves acting up and stress wanting to come out. Nothing wrong with any of that.

Surgery is booked for March 3rd. We'd hoped to go to Vancouver for Leif's birthday around then, but I've been asked not to fly. Rapid pressure changes apparently will aggravate what's there now.

I feel good about this. I'm back to pretty much 100% after the hospital time last week, and noticed that after the embolism that I'm moving a bit freer than I was before. That's enough to start the optimism going already. We've also twiddled my medicine for every 8 hours rather than 6, which will help me sleep better, and reduced it, which will help me feel better.

Having time-frames and knowing that I'm in good hands is a lovely place to be after all that.

Recently, as part of the many antitrust/anti-competition legal actions they’re suffering under, Microsoft released specifications for the old Office binary file formats. As expected, they’re big and complex. Joel Spolsky (a former member of the Excel team) had some thoughts on their size and complexity:

With a little bit of digging, I ll show you how those file formats got so unbelievably complicated, why it doesn t reflect bad programming on Microsoft s part, and what you can do to work around it.

The digging turns up reasons that make some sense: the limitations of older computers, feature creep, a complete lack of attention to the future. But it’s hard to see some of these reasons as “why it doesn’t reflect bad programming on Microsoft’s part”. Carelessness is common, sure, but we don’t call it a virtue because everybody does it. And these are problems that should have been on someone’s radar at Microsoft. It’s one thing for a grunt programmer to hack a feature to meet a deadline; it’s another for the management to simply go along with it, or to not order a rethink when the problems come to light. When you read about hacks like the following, everything sounds nice and reasonable, until you remember what the end result is: that Microsoft Excel doesn’t have a standard format for storing and manipulating dates!

There are two kinds of Excel worksheets: those where the epoch for dates is 1/1/1900 (with a leap-year bug deliberately created for 1-2-3 compatibility that is too boring to describe here), and those where the epoch for dates is 1/1/1904. Excel supports both because the first version of Excel, for the Mac, just used that operating system s epoch because that was easy, but Excel for Windows had to be able to import 1-2-3 files, which used 1/1/1900 for the epoch. It s enough to bring you to tears. At no point in history did a programmer ever not do the right thing, but there you have it.

It may not have been the wrong decision, in the sense that it enabled them to ship, and shipping is everything in some circles. But as a design decision, how can anyone defend such inconsistency? Business information technology was able to move forward in the early ’90s because older document formats like 1-2-3 and WordPerfect were simple enough to import easily into Microsoft Office. Today, when we talk about moving to open-source suites like OpenOffice or online systems like Google Docs, detractors left and right cite the pain of document conversion as a reason to hold back. But if Joel is right about the old binary formats, the pain of transition is like the pain of changing your oil: you can pay now, or you can pay a lot more later. Even Microsoft is having trouble opening its own files from long ago, with “long ago” being a period measured in years, not decades. Maybe you didn’t write anything a decade ago you’d care to read again today; maybe you can’t imagine any of your stuff being worth reading a decade from now. Do you want to take that chance? Thankfully, I was a geek, and kept most of my documents in plain text. Today, I take care to save important documents in formats and encodings designed for the long haul, like Unicode, ODF, and PDF. It helps that I avoid Microsoft software like the plague. (If you think they’ve changed since the bad old days, just surf the web in Firefox on Linux sometime, and see how many badly-rendered pages look much better when you switch their text encoding from Unicode to “Windows-1252″.) If you have a lot of Office documents, even if you’re happy with Office, you might consider whether you care about opening those documents ten years from now, and whether you’d rather take the time to future-proof them while you still can.

Searching for an alternative for our old Cisco Border Router we are evaluating some software routing suites on “normal” server hardware.
First we tried Vyatta, but the routing software frequently crashed completly. Maybe this is fixed with VC4 Alpha 1, but we didn’t test that.
Next try was the development version (0.99.9) of quagga from Debian testing, but it looks like a peering with one of our cisco router fails after the hold timer expires. (more…)

This January I've put some research (together with Dick) into the security of electronic waste registration techniques. About 25% of Dutch municipalities employ some kind of tariff differentiation ("diftar"): a household pays per quantity of waste. A traditional way of implementing this is to use coloured, taxed garbage bags, but more modern municipalities employ bins with RFID tags or underground containers which can be opened with (again) RFID cards. These underground containers then communicate their records of disposals to the central office. We visited a number of municipalities around the country, scanned ID cards and containers and even tooka ride on a garbage truck. Some highlights of our findings:

• Most access cards for underground containers can be trivially cloned; they are EM4x05 type cards with factory UNIQUE.
• In one municipality, we could open the underground containers with any card of the EM4x05 type, regardless of origin. With one notable exception: 0x0 doesn't work.
• One type of tag has preventive measures against readout (and hence cloning), but these features are not used.
• Virtually no encryption is used in any of the communications, e.g. plain HTTP was used for worldwide access to the adminsitrative backend interface. Again one exception: a new version of a system used WEP to "secure" wireless transfer of data...
• There's no security awareness among municipalities. Defined requirements concern the physical robustness of systems or collection costs, but no demands are placed on information integrity or confidentiality.

We saw many different systems with each having their own flaws. It would be better if municipalities joined forces and designed one or two good systems instead of a dozen half-baked ones. These public systems funded with public money should then have a similarly public security evaluation.

Galax in Debian version 0.9.9 in experimental / NEW Executive summary: Galax (a fast XQuery implementation with support for static typing) is now in Debian. After my introductory post on XQuery and how to use it in Debian I've got motivated again in finishing the Debian packaging of Galax. (Or was the motivation coming from the fact that Saxon-B is terribly slow and also the annoying thought that one has to pay for extra-optimizations and static typing?) Galax, on the contrary, is really fast, Schema-aware, and supports static typing out of the box (you won't discover too late that you've added an integer to a string-valued node). Galax is now (almost) in Debian: yesterday I've uploaded version 0.9.9 to experimental, but of course it will need to pass through NEW before being available to the public. In the meantime it is available from my repository, here's the needed sources.list line:

deb http://people.debian.org/~zack/debian unstable main

in case you wanna look at the source package you can do one of:

$ dget http://people.debian.org/~zack/debian/pool/galax_0.9.9-1.dsc
$ debcheckout svn://svn.debian.org/svn/pkg-ocaml-maint/trunk/packages/galax/trunk

Getting started with Galax Mini howto for evaluating XQuery queries with Galax:

# aptitude install galax
$ cat sample.xq 
<bookshelf>
  for $book in doc('books.xml')//book
  where
    some $surname in $book/author/last
    satisfies $surname eq "Stevens"
  return <title>   xs:string($book/title)   </title>  
</bookshelf>
$ head -n 7 books.xml 
<bib>
  <book year="1994">
    <title>TCP/IP Illustrated</title>
    <author><last>Stevens</last><first>W.</first></author>
    <publisher>Addison-Wesley</publisher>
    <price>65.95</price>
  </book> 
$ galax-run sample.xq   xmllint --format -
<?xml version="1.0"?>
<bookshelf>
  <title>TCP/IP Illustrated</title>
  <title>Advanced Programming in the UNIX Environment</title>
</bookshelf>

The galax-doc package contains much more documentation of course ...
PS this evening I'll travel to Paris, where I'll be for a week, moving to FOSDEM for the week-end. Drop me a note if you want to get in touch for beer/keysigning/whatever.

I should've known that posting something about ID cards would spark a number of reactions. In fact, I did—which is one of the reasons why I posted that; nothing like a bit of discussion every once in a while. Brian M. Carlson writes:

The difference between the US and Belgium, for example, is that Belgium has comprehensive privacy legislation.

Well, yes. Obviously, ID cards require some privacy legislation in order to prevent abuse of said cards. In Belgium, only the police is allowed to require me to show them my ID card; everyone else can ask, but I can tell them to go screw themselves. Of course they can then also refuse to provide me with a given service, but I may be able to sufficiently prove my ID with other means. The point is, whether or not a designated ID card exists does not impact the need for privacy legislation; if you want to protect your privacy, you need such legislation anyway, ID or no ID. The fact that you don't have an ID card does not mean in any way that people can't ask you to prove your ID; and the existence of an ID card does not mean that all of a sudden all other ways for me to prove my ID are null and void. "Anonymous" writes:

You seem to take as a given that we need an official government-issued ID card, and from there you draw the fairly reasonable conclusion that if we need one it ought to exist separately from a driver's license. I agree that your assumption leads to your conclusion, but I disagree with your assumption.

Well, no, I do not assume that we need an official government-issued ID card. I know we do. That's not to say we need government-issued ID in all cases where we need to provide proof of ID; but when we do, there should be a way that does not overload some document into something which it was never intended to be. "bignose" writes:

You miss the main complaint of a national ID card system: that it would be *mandatory* for a person who wishes to operate in the country. That's the important part that is not true for a driver's license: not having a driver's license does not make the person an unperson.

It is not necessary for me to have an ID card to "operate" in Belgium. There are a few things where the ID card is indeed required; e.g., the last time I personally had to use my ID card was during the last elections. If I would have had an encounter with the police in that time, they could have asked for it, too; but that didn't happen. Also, when doing my tax declaration online, I used the electronic keys on the ID card, so that I could only update my tax declaration—and not, say, my neighbour's. But that's only doable when you have an electronic ID card system, which is not necessarily a good idea (in contrast to plain old paper ID cards, I do have privacy concerns with electronic versions—details on request) Of course, the fact that I can "operate" in Belgium without the use of an ID card does not mean it is legal for me to walk around without one; but that is not entirely the same thing. There were some more comments to my previous blog post, but I don't disagree with those.

Matt Bottrell writes about the Oracle Linux offerings presented at LCA 2008 [1] The one thing that Oracle does which I really object to is the “unbreakable” part of their advertising. They have pictures of penguins in armour and the only reasonable assumption is that their system is more secure in some way. As far as I am aware they offer no security features other than those which are available in Red Hat Enterprise Linux, CentOS, and Fedora. The unbreakable claims were also made before Oracle even had their own Linux distribution, which gave them even less reason for the claims. If someone is going to be given credit for making Linux unbreakable then the contributors list for the SE Linux project [2] is one possible starting point. Another possibility is that credit could be given to Red Hat for introducing so many security features to the mainstream Linux users before any other distribution. In terms of improving the security of databases it’s probably best to give credit to Kaigai Kohei and the PostgreSQL team for Security Enhanced PostgreSQL [3]. I believe that NEC also deserves some credit for sponsoring Kaigai’s work, I am not sure whether NEC directly sponsored his recent work on SE-PostgreSQL but they certainly sponsored his past work (and are credited on the NSA web site for this). Oracle’s Linux distribution is based on CentOS and/or Red Hat Enterprise Linux (RHEL). The situation with RHEL is that the source is freely available to everyone but binaries are only available to people who pay for support. CentOS is a free recompile of RHEL and a good choice of a distribution if you want a server with long-term support and don’t want to pay Red Hat (I run many servers on CentOS). While Matt gets most things right in his post there is one statement that I believe to be wrong, he writes “One of the craziest statements I heard during the talk was that Oracle will only support their products running under a VM if it’s within Oracle VM“. My knowledge of Xen causes me to have great concerns about reliability. My conversations with MySQL people about how intensive database servers are and how they can reveal bugs in the OS and hardware are backed up by my own experience in benchmarking systems. Therefore I think it’s quite reasonable to decline to support software running under someone else’s Xen build in the same way as you might refuse to support software running under a different kernel version (for exactly the same reasons). Matt however goes on to make some very reasonable requests of Oracle. The demand for native packages of Oracle is significant, I can’t imagine official Debian package support appearing in the near future, but RPM support for RHEL etc would make things easier for everyone (including Oracle). A better installation process for Oracle would also be a good thing. My observation is that most Oracle installations are not used for intensive work and use database features that are a sub-set of what MySQL offers. I’ve seen a few Oracle installations which have no more than three tables! The installation and management of Oracle is a significant cost factor. For example I used to work for a company that employed a full-time Oracle DBA for a database with only a few tables and very small amounts of access (he spent most of his time watching videos of fights and car crashes that he downloaded from the net). Adding one extra salary for a database is a significant expense (although the huge Oracle license fees may make it seem insignificant).

• [1] http://matt.bottrell.com.au/item/163/


• [2] http://www.nsa.gov/selinux/info/contrib.cfm


• [3] http://www.kaigai.gr.jp/index.php?sepgsql

Share This

Matt Bottrell wrote an interesting and informative post about laptops for school kids [1]. His conclusion is that based on technical features the OLPC machine is best suited for primary school children and one of the ASUS EeePC, the Intel Classmate, and the Everex Cloudbook would be best suited for high-school students. The Asus EeePC [2] is a good option, it runs a variant of Debian and the Debian Eeepc Team are active in getting full Debian support for it [3]. The Intel Classmate [4] has a choice of Windows XP, Mandriva, and Metasys Classmate. The web page says that it’s designed “for primary students (ages 5-14)“, so I think that Matt made a mistake in listing this as a possibility for high-schools, of course when running Mandriva it could have software installed for any age group but the hardware design may be better suited to younger children. The Everex Cloudbook [5] runs the GOS Rocket [6] OS which seems to be an Ubuntu variant with an Enlightenment based GUI and a configuration aimed at using Google services (blogger, gmail, etc). Configuring Ubuntu to suit your needs is easy enough (it’s based on Debian). Note that Matt did not mention where one might purchase a Cloudbook in Australia and I don’t recall seeing one on any of my many window-shopping expeditions to Australian consumer electronics stores, while the EeePC is widely available (except when sold out). But I’m sure that if the government wanted to place an order for a couple of million units then Everex would ramp up production quickly enough. Matt made one statement that I strongly disagree with, he wrote “A traditional notebook is far too heavy for high-school kids to lug around“. To test this theory I searched for some high-school text books and a set of scales. A year 11 Maths A text book from ~1988 weighed 600g and the pair of year 12 Maths A and Maths B texts weighed 1.6Kg. When I was at high-school the day was divided into seven “periods”, some classes took two periods so four different classes which required text books (or other books) was typical. Carrying 3Kg of books to school would not be uncommon for year 12 students. The Lenovo T series (advertised as “premier performance” and the model I personally prefer) is listed as having a starting weight of 2.1Kg (which presumably doesn’t include the power pack). My Thinkpad T series (from about 2004) weighs about 2.4Kg according to my kitchen scales and has a battery weighing just over 400g. My practice for a long time was to own a spare power pack for my Thinkpad so that I could leave it at work (saving 400g when travelling to and from work). I have also had the practice of buying a spare battery when I buy a Thinkpad (you need a spare battery for a long trip). So if I had really wanted to save weight I could have left a battery at work and reduced by travel weight by another 400g (with the cost being that I couldn’t use it when on a train or bus). A spare power pack is not overly expensive. In the usual case students would only need a battery when at school (it’s a little known fact that Thinkpads work perfectly without a battery plugged in). So if a student had a power pack at home as well as one at school and if they left their battery at school and they owned one of the latest Thinkpad T series (listed with a starting weight of 2.1Kg) then their travel weight might be about 1.7Kg. If the majority of school texts could be stored on their laptop then the result of using a Thinkpad T series would be a significant weight reduction! If the students were using a Thinkpad X series (more expensive so maybe not a good option) then the list weight is 1.57Kg and the travel weight might be as low as 1.3Kg (at a rough estimate). The EeePC offers significant benefits for school use, it is light, cheap (children tend to break or lose things more frequently than adults so you should budget for buying two of anything that they use), and having no hard drive (flash storage) it should cope well with being dropped. The screen on the EeePC is unreasonably small buy Asus could release a new model with a bigger screen (they may do this in the future anyway or a government contract could encourage them to do it sooner). I agree that the EeePC or the Everex Cloudbook is probably the best option for high-school students, but I can’t agree with any claim about a traditional laptop being too heavy, the only reason for excluding a traditional laptop is that those new ultra-lights are better. Another reason that might be cited for not using laptops is the cost. While prices of $1000 or more for a traditional laptop are rather expensive, the $500 for an EeePC is not that expensive - and the government could surely negotiate a better deal, I would be surprised if they couldn’t get the price down to $350 by some bargaining and by removing the middle-man. A careful child could use the same laptop for the entire duration of high-school and their parents would incur less expense than they currently would spend on text books. As for the current lack of electronic text books. Currently when the education department selects a book it’s a license to print money for the author and publisher. All that the education department has to do is to declare that they will do a deal with the first company to release their books under a creative commons license. The idea would be that an author (or publishing company) would get paid a fixed sum of money for a CC release of a text book which would then be available for use by anyone anywhere in the world. World-wide free distribution would be no loss to the author (each country tends to have unique books anyway) but would be a good act of charity from our government to developing countries. Once books were available under a creative commons license (without the “no modifications” clause) they could be freely improved by anyone. Improving text books for younger students could be a good school project. Update: Thanks to Steve Walsh for pointing out that the Classmate can run Linux. It’s a pity that he didn’t link to my post so that his readers could see what he was referring to. I take it as a good sign of the quality of my posts that such small errors get pointed out.

• [1] http://matt.bottrell.com.au/item/166/


• [2] http://eeepc.asus.com/au/index.htm


• [3] http://syn.theti.ca/articles/2008/02/16/bits-from-the-debian-eee-pc-team


• [4] http://www.classmatepc.com/


• [5] http://www.everex.com/


• [6] http://www.thinkgos.com/

Share This

One of Sarah's university subjects this semester is a statistics course. One of the requirements of this course is some software package that only runs on Windows. As the only Windows machines in the house are my laptop, which dual-boots between Linux and Windows XP and goes for many months without XP seeing the light of day, and our desktop, which dual-boots between Linux and an ageing Windows 2000 installation (which blue-screens on boot at the moment because I have a Sun Quad Fast-Ethernet card in it), we figured it might be a good idea to look into getting a copy of Windows XP (especially before it stops becoming available). I wouldn't buy Vista, given all the bad things I've heard about it. The game plan was to either throw it on the desktop (and see if it tolerated the QFE card better than 2000) or try out Boot Camp on Sarah's MacBook Pro. We ended up doing the latter. I did all of the post-installation configuration of XP while Sarah was napping this afternoon, and I have to say I'm impressed. Apple (for whatever reason) has gone to a fair amount of trouble to make sure that Windows runs really well on their hardware, and the Boot Camp stuff is really slick. It all "just works". Even the built-in iSight camera. So I feel pretty dirty for forking out for a copy of Windows XP (although I'm deriving some pleasure from boosting the Windows XP sales figures in spite of Windows Vista being available), and then putting it on a Mac to boot, but we'll blame the university for being uncool. Now if I could just get the Windows version of ClamAV to make me feel confident it was actually providing some protection...

ARPA just turned 50 and Ronda Hauben, long time author on the politics and culture of the net, has written a nice reflective piece on the significance of the organization of ARPA. Challenging the idea that military roots had dug into the organizational logic of the ARPA institution and especially the ARPAnet, she instead provides the following narrative:

The organizational structure of ARPA made possible the creation of the
computer science research office within ARPA begun by Licklider. That
office has demonstrated the importance of the support for basic
research in the field of computer science. The IPTO supported a
general area of research, one with a far reaching impact. The
achievements of this research office were not specific defense related
applications, nor were the goals narrowly aimed at defense specific
applications. If this reality is not recognized, however, it is
possible to mistakenly attribute significant computer science
achievements to defense specific objectives. A common and widespread myth exists that the Internet has grown out of
a defense specific objective, i.e. from the goal to create a computer
network that could survive a nuclear war. This is a striking example
of how a false narrative can spread and gain public credence. This false narrative finds its roots in the failure to understand that
ARPA was not an agency created for defense specific applications, but
to support the basic research which would lead to new concepts and
ideas.

At Melbourne Tullamarine airport today, I was asked to present the credit card used to book my flights as a security measure to be able to fly Bangkok-Zurich. I did not need the card for the Melbourne-Bangkok leg. Unfortunately, I left the card at home for various reasons. In the end, they just issued both boarding passes anyway. I was not allowed to take the throw-away wooden chopsticks that came with my Pad Thai lunch through the security checkpoint. For dinner on the airplane to Bangkok, we were given plastic knives and metal forks. For dinner on the second trip, we got metal knives. At Bangkok airport, I had to pass a security checkpoint changing planes. They confiscated the plastic water bottle which was given to me on the flight from Melbourne (the bottle said Thai airlines on the label). The lady in front of me was using one of those telescopic walking sticks, she apparently had a bad leg. They didn t even bother asking about the stick, which she ran through the x-ray. Terrorists don t have bad legs, nor know how to pretend. How long are we going to put up with this bullshit? NP: The Flower Kings: Stardust We Are

Following the first phase, the second and final phase of the Penny and Martin adventure ended last Friday at Wellington airport. I am now 11 500 metres high on my way from Bangkok to Zurich, looking back at seven days on the New Zealand South Island, another in Wellington, and a night in Melbourne. Here s the summary of the 2200km we travelled, with selected photos inline. Penny has more pictures in her Flickr album.

• Thursday: ferry from Wellington to Picton and on to Amberley, where we stayed with Penny s sister Janey.
• Friday: via Christchurch to Lake Tekapo for a lovely swim in turquoise water, before we set up the tent at Lake Pukaki with Mount Cook in the distance. Camping with a car isn t all bad.
• Saturday: via Wanaka en route to Haast Pass with a stopover at the Gates of Haast for some rock hopping and full body immersion in the icy water (yes, Penny went in all the way, too). From Haast, we took the beautiful road to Jackson Bay and back, before heading into Cascade Valley for another night of camping, this time with millions of sandflies forcing us to dress appropriately. NB: please, no new offers for fashion modeling contracts, I am already fully booked. Penny might appreciate them though, especially if she gets to wear white socks.
• Sunday: fled the valley as if running for life (think final scene of Hitchcock s Birds) to prevent further sandfly attacks and headed north to the Fox and Franz Josef Glaciers, where we got soaked in heavy rain. Reached Greymouth in time for the tour of the local Monteith brewery and spent the night recovering from the camping in the Charles Court Motel. Monteith s Munich-style Golden lager beer is actually quite reminiscent of Munich-style lager! I also got to take three girls to the men s toilet to see the world s coolest urinal.
• Monday: the bad weather followed us up the west coast to Punakaiki but didn t deter us from taking a short hike to the pancake rocks, nor from visiting the seal colony at Cape Foulwind later in the day. I found out how much Penny loves Nikau trees. From there, headed west for Lewis Pass and passed up on camping due to the heavy rainfall. Instead, we booked into the Maruia Springs Resort Hotel and indulged in hot springs recreation and camping-stove-cooked pasta in the room.
• Tuesday: the weather in Kaikoura, which we reached around noon the next day, wasn t any better, which foiled our diving plans, so we continued on to Picton and decided to cut our road trip short by one day to give us more time tying up loose ends in Wellington.
• Wednesday: got up early to rent diving equipment for two dives at Karaka point, where we inspected (and swam through) an old ship s wreck. We also collected around 20 scallops, which we brought to Penny s parents and enjoyed them cooked in ginger and garlic for a late lunch. The ferry took us back to Wellington that night, where I got to see Eagle vs. Shark, a Kiwi movie starring Jemaine Clement from the Flight of the Conchords and music composed by local bands, foremost of which The Phoenix Foundation. I have to side with Penny: it s an enjoyable flick but probably not worth watching multiple times.
• Thursday: following breakfast at the Olive cafe, we went on shopping sprees (I found a store selling Icebreaker gear at 50% ), chilled in the afternoon, fetched excellent Sushi at the Wasabi Sushi Train, and finally saw The Phoenix Foundation play a free concert at Frank Kitts Park.

My New Zealand beer top-ten, in reverse order: Monteith s Original, Monteith s Black, Mac s Great White, Monteith s Golden, Monteith s Celtic, Monteith s Pilsener, Emerson s Pilsener, Mac s Hop Rocker, Emerson s 1812 India Pale Ale, and (drum-roll): Mac s Sassy Red. Yum! The Emerson beers get no links because the brewery website uses Flash. Thanks, Penny, for a fabulous two weeks! NP: The Flower Kings: Back in the World of Adventures

In the past few months in the Debian-EeePC team, a number of interesting things have been happening. Progress has been made to ensure the Eee’s drivers get merged upstream. Chris Snook from Red Hat has taken over atl2 upstream and has started merging it with the atl1 driver to make a unified atlx driver that will be suitable for inclusion in the kernel. As well, there is continued progress on the madwifi driver, with a patch now included to support version 2.6.24 of the Linux kernel. In the meantime, the Debian Eee PC Install HowTo has been under constant revision, even gaining recently the beginnings of translations in French and German. ACPI, another important piece of infrastructure for the Eee, is now supported in lenny and sid through Eric Cooper’s eeepc-acpi kernel module. This is a fork of the asus-acpi module renamed so that it won’t conflict with the in-tree version. It turns out that asus-acpi is deprecated, having been replaced by asus-laptop. Eric has been in touch with the asus-laptop maintainer to ensure the Eee-specific bits are merged so that we can eventually retire our forked version. There still remains at the top of our Todo list the issue of ACPI scripts to go with the kernel module. Having at first considered patching acpi-support, we have decided instead to start with Eric’s own scripts which will be packaged shortly for Debian. This gives us more freedom to tinker before considering submitting patches to more general laptop support packages like acpi-support. Finally, after Brendan M. had to send his Eee back to Asus for repairs, work stopped for a while on the custom debian-eeepc installer. Fortunately, he just got his system back from the shop as good as new and has returned with renewed vigor to that task. He has produced a new version of the installer which we are now testing. Thanks to the efforts of numerous users and developers who are being added to our ranks daily, we expect by the time Lenny releases we will be well on our way to providing a pure Debian solution for the Eee. Whether or not everything needed for the Eee is in Lenny at that time remains to be seen. We need to allow for how long it takes to get new drivers into the kernel. But if we miss the release, we will certainly provide backports and look forward to full support in the following release.

With /usr/bin/screen -dm you can start a screen non-interactively, eg. from cron, passing the command to run and its arguments as normal arguments:

  @reboot    screen -dm rtorrent -p 12345-12346

However, I wanted to start from cron a screen that would run various commands, each in its own window. AFAIK you can’t do this with a simple invocation, but you can prepare a custom screenrc file that defines which commands to run, with the screen command. For example:

  % cat ~/.screenrc_foo
  escape "^Oo"
  startup_message off
  hardstatus alwayslastline "%w"
  screen 0 command0 -x -y
  screen 1 command1 -z -w
  screen -t windowname 2 command2
  screen -t windowname 3 sh -c 'cd ~/quux && ./wrapper.sh'

Then you start it from cron like this:

  @reboot    screen -dm -c ~/.screenrc_foo

Thanks to Luca Capello and Romain Francoise in #debian-devel for the tip. Update: Laurence J. Lane points on IRC the -X option to screen, so you could do without the screenrc file and do it like this:

  % screen -dmS NAME command0 -x -y
  % screen -S NAME -X screen command1 -z -w
  % screen -S NAME -X screen -t windowname command2
  ...

A nice feature from PostgreSQL are “write ahead log” (WAL) files. Quoting from the PostgreSQL website they describe every change made to the database’s data files. […] if the system crashes, the database can be restored to consistency by “replaying” the log entries made since the last checkpoint. This basically enables online backup of your database cluster. And as you end up having the complete log of all actions within your database(s) you are also able to go back in time to any point you like. I won’t write a complete howto about it, as the PostgreSQL docs are pretty good, just some notes how I did my setup, as a kind of reminder for me when I have to do it again.

---

There must be a place to store WAL files which ends up not being on the same machine, otherwise it doesn’t make much sense. For me that means scp to a different host, but an NFS mount or some storage array or drbd device might also be an option. Much of the following is for the scp method, but easily adaptable to other storage methods. I need a target user on the host I copy files to, and as I did the setup for the pentabarf database running on host skinner, I helpfully named it pentabarf-backup. The copy process can’t be interactive so the postgres user on the database host needs to have a passwordless SSH key to login to the pentabarf-backup user on the backup host. To limit my bad feeling about “passwordless key to login” I restrict the key by adding

from="skinner.debconf.org,72.32.250.224,72.32.79.241",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty 

in front of it while copying it to the pentabarf-backup users .ssh/authorized_keys file. I need a few directories, namely pentabarf-WAL-skinner, pentabarf-tarballs and pg_xlog-skinner for the stuff to backup, created in the home of the pentabarf-backup user. Next step is to tell PostgreSQL our wish to have online backups. Add the following statements to your postgresql.conf, adapting the values to your needs:

archive_command = 'ssh backup test ! -f pentabarf-WAL-skinner/%f && rsync -az %p backup:pentabarf-WAL-skinner/%f'
checkpoint_timeout = 1h
archive_timeout = 12h

The above tells PostGreSQL that i want it to archive the files using ssh to my backup host and transfer files with rsync (via ssh), but only if they do not exist yet. It also tells it to archive the files at least once every 12 hours. The effect is that WAL files get copied over when they are “full” or after 12 hours passed, whatever happens first. Don’t set it too low, as the file will always have the full, fixed size and you waste space transferring mostly-empty files. In case you are concerned with the possibly slow speed of a network link, the PostgreSQL site has the following to say about this: The speed of the archiving command is not important, so long as it can keep up with the average rate at which your server generates WAL data. Normal operation continues even if the archiving process falls a little behind. I haven’t had a problem with the speed yet. A 16MB file every (at least) 12 hours isn’t that bad. Now that we have done all the setup and are able to transfer WAL files, we need a base backup to start with. Issue a SELECT pg_start_backup(‘BASE_BACKUP’); as a database superuser and then backup the database cluster by backing up the whole clusters data/ directory (and every other location if you use tablespaces). When you are done issue SELECT pg_stop_backup(); and you are done with your base backup. You might want to exclude pg_xlog/ to save space, you don’t need it.
As I’m lazy I use a script (written by Peter ‘weasel’ Palfrader), you can get it here, but whatever you take is fine. If you use the script just make sure to adapt the variables in the script to values that fit your system. From now on you should do such base backups in regular intervals, I run them once a week, as recovery does need the last base backup plus all WAL files from then on. Doing regular base backups limits the amount of WAL files you need to keep around / you need to replay.

---

Reading the above you might find that there is a window of up to 12 hours from which I do not have backups. True, and to make this window way smaller, I am using another script (also written by weasel), get it here, together with an init script. This synchronizes the pg_xlog/ directory to my backup host every 5 minutes, so in case of a server crash I can replay everything up to the last 5 minutes. Recovery using WAL files This is pretty simple, and also good documented at the PostgreSQL site again. For my scenario it basically boils down to

1. Stop postgres
2. Move away the cluster.

   mv /var/lib/postgresql/8.2 /var/lib/postgresql/8.2_old

3. Restore the backup dump, be careful to have the file rights correct. For the above described setup that means copy and untar the latest tarballs created weekly.
4. Recreate pg_xlog:

     mkdir /var/lib/postgresql/8.2/main/pg_xlog
     chown postgres:postgres /var/lib/postgresql/8.2/main/pg_xlog
     chmod 40700 /var/lib/postgresql/8.2/main/pg_xlog
     mkdir /var/lib/postgresql/8.2/main/pg_xlog/archive_status
     chown postgres:postgres /var/lib/postgresql/8.2/main/pg_xlog/archive_status
     chmod 40700 /var/lib/postgresql/8.2/main/pg_xlog/archive_status
    

5. Copy possibly unarchived WAL files from /var/lib/postgresql/8.2_old/main/pg_xlog into the newly created pg_xlog.
6. Copy all the WAL segment files that are needed over from the backup host. That should be all the files on the backup host, directory pentabarf-WAL-skinner/. You should be able to limit it by taking all those files >= the latest *.backup file.
7. Create a recovery command file recovery.conf in the cluster data directory. You may also want to temporarily modify pg_hba.conf to prevent ordinary users from connecting until you are sure the recovery has worked. The content of recovery.conf is

         restore_command = 'cp /tmp/pg-WAL/%f "%p"'
        

   Make sure that the file location you specify is the location you put the WAL segment files into in the prior step.
8. Start the server, it will go into recover mode and proceed to read through all the archived WAL files it needs.
9. Look at the database and decide if you like what you see.

Of course the procedure can be slightly adapted, so you end up with a database state from 2 weeks ago. Or 3 days. Or whatever you may need (and have WAL files for). There are many possibilities, and there is a lot of text on the PostgreSQL page that I don’t want to duplicate here, so please read it. Also, I’m not using this as the sole and only way to backup my database(s), they are all still dumped into SQL files every day. This is just additional.

A post entitled Saved by SPAM just appeared on the Journal's website. Yes, it's only barely ironic, but heck, my blog is geeky enough for a lame joke about spam and it is Friday afternoon before a long weekend ...

pbuilder with default settings will fail to build a package depending on sun-java5 or sun-java6, because the license needs to be accepted first. Now some time ago I saw a patch for pbuilder itself to “fix” this, but for the time beeing I used to set DEBIAN_FRONTEND to readline in my pbuilderrc. But today Michael Koch came up with much better suggestions: Preset the debconf value in the CHROOT and save it. It’s pretty easy:

$ sudo pbuilder login --save-after-login
# echo "sun-java5-jdk shared/accepted-sun-dlj-v1-1 boolean true"   debconf-set-selections
# echo "sun-java6-jdk shared/accepted-sun-dlj-v1-1 boolean true"   debconf-set-selections
# exit

and voila, problem solved. Thanks to Michael for the tip.