Just a quick pre-holiday update on the state of XTech 2006. We've had, as usual, some amazing paper submissions so far, so please keep them coming. Don't forget, too, that we're also asking for tutorial submissions. These should be half-day or full-day and, as well as the free conference registration all speakers get, we pay an honorarium to tutors. Deadline is 9 January at the latest. One very exciting bit of news I have is that Paul Graham has agreed to deliver one of the keynote sessions at XTech. I'm very pleased about this, and it follows in the tradition we've established of having interesting and challenging speakers, rather than putting plenary sessions up for sale to sponsors. Amsterdam. 16-19 May 2006. What could be better? As for the holidays, I hope to be spending some time catching up on my open source work, and also carrying on my work with Rails. A busy couple of months at work, combined with no fewer than two bad server hardware issues, has eroded free time considerably. So to anyone waiting on me for something, I do apologise. One final pointer: IBM developerWorks have published the first part of my examination of the future of HTML, focusing on WHATWG. Look out very soon for the second part, looking at the various activities underway at the W3C. I know that my editor at least awaits this eagerly! Thanks to everyone who's read this blog during the year, and for the many interesting and helpful conversations that have come from it. Happy Christmas!

I've been relying on just Planet for reading blogs. I mainly read just Planet Debian and Linux Linux Australia, with a shortlist of other friends' blogs that used to be read via my own Planet instance, which is currently in a shipping container somewhere. This of course sucks in two ways: if you don't keep up, articles fall off the bottom and are gone forever, and you have to mentally keep track of what you've already read. So the next choice is a feed-reader like Liferea, but this then sucks in different ways: it's tied to the computer you run it on, and posts that have been previously read often seem to come back as new. I get this every time I refresh Planet Linux Australia. Drives me mad. So what I really want is a way of being able to centrally store what I've read, regardless of where I am, and what computer I'm using. Enter Google Reader. It has a nice clean interface, it's Ajaxed up the wazoo, and Just Works^tm. My only (minor) beefs are that it doesn't seem to allow you to mark posts as read or unread, and that it always wants to have the current article second from the top in the list. Other than that, the UI is very clean and simple (and even uses vi keys). Added bonus is that if any other user is already subscribed to the feed, you get all the historical articles for free, which in the case of the Planets, goes back a lot further than the feed currently provides. Ideally I'd like something like this, that I can run on my own server, because I like keeping everything in the family. In the meantime, this is a suitable alternative. Getting all the back-articles is a bonus well worth it. Full disclosure: I work for Google, but that's what's making me look for a more efficient method to read blogs.

Procmail Sucks

OK sucks is a bit strong: It is both insanely extensible and utterly horrid to work with. I wish there were a decent perl replacement for Procmail. Seems to me that regexps and piping through external programs covers 99% of the average procmail use cases. Perl has a lot of modules already existing for working with mbox files, maildirs, and even messages. It seems that parp should be that project but it hasn’t been touched since 2002. PMS is another dead project. Does anything exist already? Or am I stuck in procmail hell? I’d be tempted to start my own project … "down that path lies madness"

I just got spammed by the government. Well, almost so. I received a mail from the Belgische BrandwondenStichting. That's a Belgian Government-sponsored and -founded organisation created with the intention of providing information and prevention regarding fire and fire-inflicted wounds. Apparently, they discovered the "power" of the Internet, and sent me some email warning me about the danger of fireworks. I couldn't care less; I do like to watch the fireworks, but I don't usually fire it myself. But I do think it's worrisome that my own government start sending out this kind of things...

Even though my blog doesn't enable comments by default (instead everything is moderated), someone still thought it was a good idea to spam on a (totally unrelated, though as it happens the first at the time) post on my blog for their blog aggregator that is totally content-less at this point in time (and no, I will not post a link). That's the first time this happens, in all the time I've had comments on my blog; so moderating them seems to work well. Which obviously is nice.

As you read this fascinating but edited-for-brevity irc log from #debian-boot, imagine yourself as a contributor to either the larger Debian project or the Debian-Installer sub-project. At what point do you begin to feel insulted?

---

<Chepre> can i talk to the chief of debian please. the whole project could earn some money
<minghua> Chepre: if you are serious, write email to leader@debian.org
<Chepre> thanks minghua. is there a way to get a "official" release created with all up-to-date modules, like for Intel ICH7 sATA-Controller...as long as i pay for it?
<minghua> Chepre: chances are small. the official release is a long process
<minghua> and it doesn't happen often
<minghua> the earliest date you can expect for next release is probably end of 2006
<minghua> so you would have a better chance to hire some people/company who knows debian and provide you an updated kernel
<Chepre> OMG? does debian have not enough coders or don't they have "fun" to keep it up-to-date? e.g. the intel ich7 is already very old
<Chepre> well, can i hire the debian-team?
<minghua> Chepre: well, there is no official "team", but sure, you can hire debian developers
<gravity> Chepre: The stock kernel doesn't support your device? Why not? Is the driver not in the mainline kernel tree?
<Chepre> no
<gravity> Why not?
<Chepre> its just a default Dell PowerEdge 850 with Intel ICH7 and it isn't supported
<gravity> Chepre: Well, did you send an installation report?
<Chepre> gravity: no
<gravity> Chepre: That'd be a good first step to getting your problem fixed for future releases
<minghua> Chepre: ah, then it's supported by stock kernel after all, did you say it only works for kernel > 2.6.12?
<Chepre> minghua: 2.6.8-2 doesnt support it
<minghua> Chepre: okay, so as gravity said, write an installation report so that people know your problem
<Chepre> well, we cant wait month or years for a fix
<gravity> Chepre: You can create a custom installer image with the updated kernel for your work
<Chepre> we have to install many server in the next weeks :(
<munghua> Chepre: then I'm sure if you offer enough money, some d-i people can provide an installer with a newer kernel for you
<Chepre> well, i already got an custom installer but its a bit buggy...i need a whole netinst with the same "quality" like the official releases got
<gravity> sounds you were at the right track at the beginning... though "chief of debian" is probably the wrong person to contact :-P
<gravity> You could send a mail to debian-boot I suppose, offering the work for what you need
<Chepre> well, i also need up-to-date software, not just only the installer :( so the "whole" debian-team has to stop current work and has to start creating a stable version which is newer than the current unstable
<Chepre> minghua: do you think 50k are enough to get a 3.3 as stable?
<minghua> Chepre: by "up-to-date software" you mean all the software, including desktop, web servers, and stuff?
<gravity> Chepre: You may want to check out an alternative source. HP, as I understand it, provides the kind of support you want. Progeny does as well. And Ubuntu has their own full derivative with this sort of thing
<Chepre> minghua: right, as long the software is not a beta :)
<gravity> Chepre: The whole Debian team is not the kind of project that'll do this for you
<Chepre> so the debian-team dont want to earn money?
<Chepre> gravity: i know, open source :) ... but i think the guys making a new "official" release for me whould be very happy getting up to 20.000 us$ for one month of work
<gravity> Chepre: It would violate a lot of principles and the stable release policy to do an official debian release. You could get what you need with a name other than debian though, with some of the companies I listed above
<Chepre> where is the problem? i give you the money and you give me an up-to-date release which is only for my company, not for public
<gravity> I know I'd quit the project if there was an official Debian release for cash
<minghua> and there are like what, 10,000 packages in sarge now?
<gravity> Chepre: That's what those companies are for. Debian doesn't work like that
<gravity> Chepre: If you want to talk to individual debian developers for that, you can do that too
<Chepre> hmm, ok....now i know why the d-i doesn't recognize smp or 64bit systems

---

Now imagine yourself as someone who is trying to install Debian on twenty thousand stock machines for work and it's not working. At what point above did you begin to feel alienated? (Assuming that "Chepre" is not trolling,) Neither side in this exchange is particularly meaning to insult the other, both are doing what is right and obvious from their perspective. Two ships passing in the night, two trains speeding down a track, I don't know. It's a shame we can't deal better with this sort of thing. I would be truely interested to see how other free software projects deal with it differently. The rest of this is my attempt at some analysis and is probably not very useful.. A few mistakes Chepre made:

• When trying to communicate with someone, it's helpful to try to understand their motivations. Maybe these people are not highly motivated by money. Maybe spending 1% of your budget to buy the right someone a computer exhibitng the problem would be more effective.
• If a coder asks if you're filed a formal report of your problem, and you haven't, and you don't understand the underlying problem and rebuff their attempts to get a grip on it, escalating the issue to upper management will not make them your friend.
• Trying to pre-solve your problem by setting requirements like "it can't be a beta" and "it needs to be a 3.3 release" and "it needs to be newer than the current version" will only result in the wrong problem being solved, and smart people will not want to get involved in such a process. If you plan to hire someone to solve a problem it makes more sense to give them a broad vision of the problem to be solved, some example use cases, and let them, not you, solve the problem. That's what you're hiring them for.
• Not doing basic background research. And letting it show.

A few mistakes the channel (irr-)regulars made:

• Not recognising that "it will be done at the end of 2006" is not an answer a user wants to hear, and not pointing out alternatives such as last month's beta release or today's daily build.
• Assuming that when a user asks for a release, they necessarily want what we consider a "stable release". Perhaps they want a release that has some form of support and is free of showstopper bugs; what Debian terms "stable" is not the only release that necessarily has those characteristics, depending on how it will be used. (In other words, holy penguin pee (aka "official") might be more plentiful, and more symbolic, than you think.)
• Not pointing Chepre to the Debian consultants page. (Minor, but it's possibly the best place to have mentioned.)
• Getting offended. And letting it show.

That'll be about World Cup 2006 in Germany.
Poland has Germany, Equador and Costa Rica in its group. It's always hard to play with an organizer of cup, but maybe we can at least draw with them. Rest of teams seem to be within our range, but at previous cup we disregarded potentially weak teams and didn't promote to second round ;)
Good luck to every competitor!

This time it's free of ads for everyone (no need to register).
It's still free as in beer, but on some slow machines launching Firefox could take ages, so it's pretty good alternative.

I bought brand new Siemens C75 phone few days ago. This is how it looks like:

It's really great and of course I wanted to put Debian logo on screen. I had some old serial cable from my previous phone, so that was first I tried. Unfortunately trying to connect to phone causes its power down. Probably some firmware problems.
So I bought USB cable today. This time at least it doesn't want to switch off my phone, but I still can't get it work. Tried siefs, scmxx and both seem to have problems handling this phone.
I forced usbserial module to use explicit vendor and product id. Only then dmesg shows:

usbserial.c: USB Serial support registered for Generic
usbserial.c: Generic converter detected
usbserial.c: Generic converter now attached to ttyUSB0 (or usb/tts/0 for devfs)
usbserial.c: USB Serial Driver core v1.4

This seems to be ok at least according to many howtos I found on net. So why does it still not work?

Opera Software released 8.02 version of their browser and for one day registration is for free. So I have finally opportunity to test it without advertisements ;)
It's not free software but it's still nice to have some replacement for not-so-light Firefox.

So the final implementation detail in the embargoing scheme is providing a tool to move stuff from the embargoed and unembargoed queues into the archive. The existing tool the security team use is called “amber” (after the inimitable Amber Benson). amber’s pretty simple: it takes a DSA number, and the .changes files you’re looking at; then asks for confirmation, accepts the packages into the archive, regenerates Packages and Release files, fills out a template advisory with details from the deb and mails that off, and uploads the files to ftp-master for inclusion in the next stable release. There are a few problems with that. One is it doesn’t allow for rejections. Another is it doesn’t provide the security team with the opportunity to edit advisories while the packages are being prepared. Another issue is that the entire program has to run under sudo with full archive priveleges. Enter “dak dsa” aka “newamber”. The new tool aims to do more or less the same thing, but with a little more style. First, it provides a small interactive interface, so that processing an advisory now looks like:

$ newamber DTSA-25-1 smb4k_*.changes
Create new advisory DTSA-25-1? y
Advisory: DTSA-25-1
Changes:
 smb4k_0.6.4-0.0etch1_alpha.changes
 smb4k_0.6.4-0.0etch1_hppa.changes
 smb4k_0.6.4-0.0etch1_i386.changes
 smb4k_0.6.4-0.0etch1_m68k.changes
 smb4k_0.6.4-0.0etch1_mips.changes
 smb4k_0.6.4-0.0etch1_mipsel.changes
 smb4k_0.6.4-0.0etch1_s390.changes
 smb4k_0.6.4-0.0etch1_sparc.changes
Packages:
 smb4k 0.6.4-0.0etch1 (alpha, hppa, i386, m68k, mips, mipsel, s390, source, sparc)
Approve, [E]dit advisory, Show advisory, Reject, Quit? 

Choosing edit will grab a copy of the template and run vi – the template will only be filled out when you approve the upload though, since the values might change before then. Accept will do more or less what old amber did; though instead of mailing the filled in advisory draft it’ll just leave it in the filesystem instead. Of course, running vi (well, $EDITOR) generally means you can get a shell too, so running the command with full archive priveleges is a bit much – at least if you’re trying to have any sort of granularity to your security regime, which was, after all, the whole point of this exercise. So instead of running the entire command as the katie user, “dak dsa” instead has to escalate its own priveleges, in this case using sudo and specific options, such as sudo dak dsa -A -- foo.changes to approve foo.changes. Fortunately sudo and the apt argument parser are cooperative enough to allow “dak dsa” users to invoke “dak dsa -A – *” as katie, and thus have only the very limited access we’re trying for. Obviously the above is taken from the testing-security team – it’s the same source and i386 packages, recompiled on other architectures by the security.debian.org testing autobuilders. It’s shown up a few flaws in the autobuilding for etch: (a) the amd64 autobuilder isn’t active; (b) the arm buildd can’t seem to find its chroot in between running apt-get install and apt-get remove; (c) the s390 buildd only works if the source is on ftp-master; (d) of the five m68k buildds that will take packages for security.debian.org updates to testing, only two will succeed (a400t and poseidon). There’s also the notable problem that the chroots for the functional buildds have gotten out of date and that builds break somewhat obscurely as a consequenece. One of the test updates is also failing on hppa due to space restrictions. And of course, the above list is after a chunk of other problems have already been fixed. It’s worth noting that even if the above isn’t fixed for testing now; we’ll still need etch chroots for security.debian.org when we release, so those problems have to be dealt with at some point. And that the brokenness is the result of six months’ divergence from sarge; after a year and a half when etch releases – or the three years between woody and sarge’s release – it’s probably fair to expect worse breakage. Anyway, that’s just about it from me on this topic. Micah Anderson from the testing-security group is currently checking out the unembargoed facility, and has redone a couple of DTSAs on security.d.o. So presumably those guys will start working out whether security.d.o is something they want to make use of, and if so, working out what changes/tweaks are necessary for that. Though, unsurprisingly, I also still have to do some committing to CVS…

It’s more than a year since the first development release of Backup Manager, this easy-to-use tool for archiving your data under Linux. Version 0.6 which has just been released, provides a set of features for letting you implement your own backup strategy.
Backup Manager is able to use any existing infrastructure for achieving this goal: FTP or SSH accounts, CD/DVD burning devices…
A couple of different backup methods are available: tarballs (incremental or not), dumps (MySQL, SVN) and a generic method which uses content sent on stdout by an arbitrary command. An effort has been given regarding localisation, the program is now translated in 5 languages: French, German, Spanish, Italian and Vietnamese. The user guide has been writen and is available in different formats. Hopefully, the debian package will come very soon…

Only if the attack's for the benefit of the sysadmin or their employer, as far as I can tell. All-party Parliamentary Internet Group had links to legislation/regulation:

• the Computer Misuse Act 1990 doesn't make this explicit;
• Cybercrime Convention says a person can be held liable for crimes committed for their benefit made possible by lack of supervision (Article 12) and also lets you be slapped for withholding evidence;
• the EU Framework Decision on "Attacks Against Information Systems" echoes this (Article 9).

The British and Irish Legal Information Institute didn't let me find any cases with computer misuse AND supervision. Using "lack of supervision" alone finds common sense use only. So it seems to hinge on supervision. I hope that you have to do something pretty obviously daft to fall foul of a court on that. I guess that you shouldn't let a server managed by you run totally unattended, but if you take normal precautions (firewall, logcheck, intrusion detection and so on and actually review them), the admin should be OK whatever. If someone's just using your computer as a jumping-off point for random attacks, I don't see how that's for your benefit either. I think that wording might be to discourage evil businesses having teams trying to deface competitor sites and so on. There's probably a bigger danger from copyright and trademark infringement accusations IMO. I am not a lawyer. Check the above yourself or consult a lawyer about it. If you do and have updates, can you let me know, please?

Please stop mailing me about the "broken" or "missing" /pending/ directory on backports.org. It's gone, and will never come back. That was a temporary solution, all packages from there were moved into the regular archive a few days ago.

A long time, the common way of working around MSIE CSS bugs was to exploit parser bugs and missing features in it's CSS parser. Recently I read about a cleaner approach; I tested it recently and it seems to work quite well. Judging from the W3C validator, it's compatible with XHTML, too. It's nor perfect, but it probably is the best we can do currently. (And definitely cleaner than the parser-bug-exploits listed before.) The approach is simple: given the string <!--[if IE]> Foobar <![endif]--> in an HTML file, almost any parser will treat this as an comment. Except for Internet Exploiter, which will treat "Foobar" as if it was part of the regular text. Instead of "Foobar", you can load an override stylesheet to work around Internet Explorer bugs. Note that as a side effect, MSIE is not a standards compliant parser for XHTML. ;-) Now for the drawbacks:

• The part hidden from every parser except IE is not validated by tools
• The converse construct (remove --), to hide stuff from IE only, is not valid XHTML
• The conditional needs to be in every HTML file, it's not in the CSS and not cached with the CSS, so sligthly less performant than other solutions.
• It doesn't nest, you can't use comments in this construct
• They are, after all, a hack

For comparison, a few of the older tricks in CSS:

body        background-color: red;  
html>body   background-color: green;  

This is 100% valid CSS, and works because Internet Exploder doesn't support CSS 2 child selectors. But you cannot always use this, since you need to know the parent elements name. Note that this can give you trouble with the upcoming Internet Explorer which will likely have support for this selector, but will probably be "compatible" to some of the known MSIE 5/6 bugs.

body  
  voice-family: "\" \""; /* some browsers have a parsing bug */
                         /* and will ignore the following rules */
  voice-family: inherit;
  background-color: green;
 

This abuses an attribute to confuse the CSS parser of some browsers. A real hack, strongly discouraged.

I've still been extremely busy. Unlike my last fairly incoherent brain dump, this time I've been keeping notes on the things I wanted to write about, so hopefully I won't forget things. Here we go...

Squirrels

Squirrels are absolutely everywhere. They're very fast and very cute. They're kind of like possums, except diurnal. They run up trees with ease, and leap from tree to tree. It's quite cool to watch them. The damn things don't stand still long enough to be photographed (properly), and they don't let you get too close without scampering up a tree or running off. I'm told they're the number one carrier of rabies, so I shouldn't be trying to get too close anyway.

Sales tax

Definitely one of the more annoying aspects of consumer life is the fact that prices quoted are not inclusive of sales tax. This means you always need to part with more cash than you expect. Furthermore, there are some places (some fast-food outlets) that do quote the prices inclusive of tax, so it's really hard to know what you're in for.

Speed limits

I find speed limit signs to be either infrequent or harder to notice, or a combination of both. They're just a black text on white background sign. I'm used to them having the red circle. That said, no one seems to drive at the speed limit anyway.

Ethnicity

Canberra's a very white town compared to say Sydney, but I reckon at least the San Jose area of California blows the socks off what I've seen of Sydney for multiculturalism. You really notice it over here. I've been at the mall in Milpitas, and you can play "spot the white European" (a variation of "spot the Caucasian").

Different responses to thankyou

I think the fairly standard response to saying thanks that I'm used to is "You're welcome". Over here, you get "mm hmm" a lot, which is just strange.

Fractions vs decimal

They love their fractions. Petrol gets quoted at 221⁹/₁₀, which took me a while to realise was 221.9 cents per gallon

Alcoholic beverage labelling

Australia has the concept of a "standard drink". I remember as a kid the advertising campaign "rethink your third drink" (or for women, "rethink your second drink"). The idea being that men could drink two standard drinks in the first hour, and then one standard drink every hour after that, and be at 0.05% blood alcohol, which is the legal limit for Australia. And every bottled alcoholic drink is labelled with how many standard drinks it is. An average beer is about 1.2 standard drinks for example. No such labelling over here. You get the percentage of alcohol per volume, and that is it, which makes self-regulating very difficult. The limit is apparently 0.08%, but I don't think I want to be driving around on the wrong side of the road at that level (or any level really).

Christmas vs "Holidays"

Everyone and every piece of advertising goes on about the "Holidays". Retail people are always wishing us "Happy Holidays" instead of "Merry Christmas". I think this is because there's a large chunk of people who don't necessarily celebrate Christmas.

Tipping

I haven't really come across tipping in everyday life as much as I'd expected, but when I think about it a bit, I'm at work most of the time, so that's probably why. The general rule seems to be to tip "double the tax", so for a bill at a restaurant, or where you get personal service, such as a haircut, you tip. But you don't tip at McDonald's, nor Subway (where I would have expected you would).

That's about all my current observations on living over here. Tomorrow we get our townhouse in Central Park. Our air-freight was finally delivered today. (What was supposed to take about 8 days took 4 weeks). Not sure when we can expect our sea freight at this stage. We bought a couple of mountain bikes last weekend, and if the weather is okay tomorrow, we'll pick them up and ride them home. We've found a really nice off road (as in not shared with cars) bike path, which runs close to home all the way to work. I'm really keen to roller blade to work if it's feasible, and also to cycle in. I'm a bit disappointed to discover after we've been accepted for the place that we're right on top of a toxic waste dump (or something like that). If I grow a second head, you'll know why. The other piece of exciting news is that the bank sent me a debit card, when they'd previously told me they wouldn't until I had a Social Security number (still no sign if that yet). This thing (the debit card) is freaking weird. It's Mastercard branded, and in some places you use it like you'd use a debit card for EFTPOS back home. You swipe, enter your PIN and that's it. In other cases, you swipe and sign a bit of paper like a credit card transaction. In either case, money is sucked out of our checking account. The scary thing is that no one seems to check signatures in this country, and a lot of places will accept credit card payments electronically (like petrol stations where you just swipe the card at the bowser and enter the ZIP code of your billing address and that's it). Oh, and I can use this thing like a credit card for Internet purchases. What bothers me is that the level of authentication is so low, but it's sucking actual money out of our checking account, so with all the credit card fraud around, it's relatively trivial to draw actual money out of a bank account, as opposed to using someone's credit. That said, I just got the card today, and since then, it's made shopping so much easier. It's amazing how many places won't accept a foreign credit card, and I was a big user of EFTPOS back home, and this ability to use a debit card like a credit card means I can essentially continue in that habit. I wasn't looking forward to carrying lots of cash or having to use cheques.

I'm feeling somewhat stupid. I sat down tonight to have a look at writing a basic fire/flame demo thing under X (the sort of thing people used to write in 3 bytes of x86 assembly 10 years ago). See, I'd quite like a funky xdm/login thingy for my laptop, so random people who see me use it on the train think "Woah, cool". I'm sad like that. Anyway, my idea is a ring of fire with the login prompt in the middle. This seems simple. Except when I try to get involved with programming X. Now, I'm not a graphics programmer by any stretch of the imagination. But all I want is a nice simple framebuffer I can store pixels of 24 bit colour into. Or 8 bits with a colourmap is fine too. If the functions for dealing with the colourmaps are decently documented. This isn't much to ask, is it? Perhaps the issue was that I assumed Xlib would just provide me something that could do this. Or that I'd be able to find decent docs easily. Or that I had more than 2 braincells to rub together. But I've given up now. I really don't understand how to get Xlib to just let me XSetForeground to a 24 bit colour and then XDrawPoint. I tried to fight XAllocColor. I even accepted defeat and had a quick look for a simple X framebuffer library. No joy. So, can someone point me at the right docs to inhale for this sort of thing? Or a really lightweight C library that'll make it all really easy?