Having had a number of hard drives fail over the years I use RAID whenever possible to reduce the probability of data loss caused by hardware failure. It’s unfortunate that some machines make it impractically difficult to install a second hard drive (my laptop and some small form factor desktop machines I have given to relatives). But when it’s possible I have two hard drives running software RAID-1. I use two partitions, one for /boot and one as a LVM physical volume (PV). When using RAID I make both /boot and the PV be software RAID-1 devices (the vast majority of machines that I install don’t have budget available for hardware RAID). /boot is a small partition, approximately 100M. For a machine with only one disk I make the second partition take all the available space as there is no benefit in doing otherwise (LVM allows me to create an arbitrary number of block devices out of the space at run-time). When using software RAID I often make the PV take less than the full capacity of the disks. When the disks are 40G or more I usually use less than half the capacity. For most machines that I install or run the full capacity of the disks is not required. One deficiency of Linux software RAID is that on a power failure the entire RAID device must be checked to ensure that all disks have matching data. Reading the entire contents of a pair of disks can take a large amount of time if the disks are large, and as the size of disks is increasing at a greater rate than the speed of disks this problem is getting worse. See my ZCAV benchmark results page for graphs of the contiguous IO performance of some disks I’ve owned [1]. It seems that with a 10G disk you may expect to be able to read it all in less than 1000 seconds, for a 46G disk it’ll be something greater than 1,500 seconds, and for 300G disks you are looking at something well in excess of 5,000 seconds. Almost all disks (and all IDE and SATA disks for which I’ve seen benchmark results) have the lower block numbers mapped to the outside tracks which are longer and give a higher contiguous IO speed. So by using the first half of the disk the RAID synchronisation time is reduced to less than half what it might be (in the absence of motherboard bottlenecks). When there is no need for more than about 10G of storage space there’s no benefit in making a large RAID device and wasting recovery time. While the system can operate while the RAID is synchronising the performance will be significantly lower than normal. If the usage pattern of the machine changes such that it needs more space it’s easy to create new partitions, make a new software RAID, and then add it to the LVM volume group (I’ve done this before). So the down-side to this is minimal. When creating LVM logical volumes (LVs) I create volumes for the root filesystem and swap space when doing the install. This should result in the swap space being near enough to the start of the disk to get reasonable performance (but I haven’t verified this). I make the root filesystem reasonably large (EG 6G) as disk space is plentiful and cheap nowadays and the root filesystem is the only one that you can’t easily extend when running LVM (trying to do so deadlocks the disk IO). After the base install is done I create other LVs.

• [1] http://www.coker.com.au/bonnie++/zcav/results.html

Share This

My mothers computer had died. Well, the Linux on it was still working, so she was able to open her document files, read her email and use chat. Pretty much everything works under Linux, with the exception of using the Fax functionality of the AVM Fritz!Box via CAPI-over-TCP. (Ironically, the Fritz!Box itself runs Linux, so it's just because AVM doesn't bother to supply a Linux client too).Anyway. Logging in remotely, I quickly found out that the hard drive had serious issues, with lots of bad sectors on the main Windows partition (fortunately, we kept system data and user data separate!). So I'm not blaming Microsoft for dying (but Samsung; since this is the second time within three years the drive has died, I guess I won't be buying a Samsung HD anytime soon).Last weekend, I bought a new hard disk and went to my parents to fix it. I copied over the partitions (some 64k data could not be read any more), and tried to get Windows up again, too. (Linux was trivial; copy, boot record, done)So I ended up doing a "rescue" Windows installation, using the XP service pack 2 CD. I figure this is still the latest setup for XP available? It went through the usual driver-loading, did the first part of the installation, rebooted into the new system, did this "estimated time 39 Minutes" setup screen. After like 10-15 Minutes, it had a bluescreen, dumped memory and rebooted. And cycled through that again and again.It took me like 6 hours total to get the Windows system fixed (mostly waiting for the Microsoft setup to run through again). I figure that there aren't many users out there that actually could have fixed that Windows. The reason is simple: Microsoft crappy setup. Probably to protect it's serial number thingy or just to display fancier graphics, setup refuses to work in safe mode. And the bluescreen even suggested to try the safe mode, just to display the message "setup.exe doesn't work in safe mode, click OK to reboot".If I could have used that "safe mode", fixing would have been a lot easier. The bluescreen mentioned a device driver ati2something.sys; apparently part of the ATI video driver. So I tried the rescue console of the XP CD to just kill that driver, but setup kept on actually reinstalling the file.The way I fixed it in the end is simple: Linux to the rescue. I booted the (working like a charm) Linux installation, accessed the main Windows partition using ntfs-3g, found all references to the ATI driver in the Windows\Inf driectory and removed them.After I had removed these references, Microsofts setup.exe completed, and I had a working-again Windows in VGA mode. Then I could install the ATI drivers again. Microsoft really needs to work on that setup, it needs to allow disabling certain drivers and similar rescue things.Maybe Microsoft should start shipping a Knoppix CD with Windows, for repair.

Tracing python programs. Today, Evan Dandrea asked a general question "Where is set -x for python". A quick google for sys.settrace found: Some code snippets. I thought this was nice, but surely you want to be able to just trace an arbitrary program. So I present a 'quick hack' (5 minutes precisely :)) to do that based on the previous links final version:

#!/usr/bin/env python
 import linecache
import os
import os.path
import sys
 def traceit(frame, event, arg):
    if event == "line":
        lineno = frame.f_lineno
        filename = frame.f_globals["__file__"]
        if (filename.endswith(".pyc") or
            filename.endswith(".pyo")):
            filename = filename[:-1]
        name = frame.f_globals["__name__"]
        line = linecache.getline(filename, lineno)
        print "%s:%s: %s" % (name, lineno, line.rstrip())
    return traceit
 def main():
    search_path = os.environ.get('PATH',
        '').split(os.path.pathsep)
    argv = sys.argv[1:]
    if not argv:
        raise Exception("No command to trace supplied")
    args = argv[1:]
    command = argv[0]
    if os.path.sep not in command:
        for path in search_path:
            if os.path.exists(os.path.join(path, command)):
                command = os.path.join(path, command)
                break
    del sys.argv[0]
    source = open(command, 'rt')
    exec_symbols = dict(globals())
    exec_symbols['__name__'] = '__main__'
    sys.settrace(traceit)
    exec source in exec_symbols, exec_symbols
 main()
 

Zack's pam-hooks module got me thinking that the whole "start stuff at user login/logout" thing should be simplified a huge lot. Currently, there are just too many mechanisms depending on the user's shell, ?dm, distribution, session manager/desktop environment etc. Should this be a topic for the freedesktop.org people (or is it already - it might fit into Portland in some way)? A standardized way to hook into session setup/teardown might also be good for security: if there's only few ways to get stuff started at login, that means fewer places to look where malware could be hiding. Of course, it also means that said malware can spread more easily, being more independent of the user's desktop environment.

It seems to me that the Asus EeePC (a $AU499 ultra-light laptop with only flash storage) would make a decent router. Often full desktop PCs are used as routers because they run the most common software and have standard interfaces. There have been dedicated router devices with flash for a long time, but without the ability to connect a standard monitor and keyboard they were always more difficult to manage than general purpose PCs. Also dedicated routers have limited RAM and storage which often does not permit running a standard OS. According to the best review I could find [1] EeePC has a minimum of 256M of RAM, a Celeron-M CPU (32bit Intel), and a minimum of 2G of flash storage. This hardware is more than adequate to run most server software that you might want to run (my current router/firewall/server has 192M of RAM). It could run a web server, a mail server, or any other general server stuff. It comes pre-loaded with a modified version of Debian so you get all the Debian software (which incidentally means more pre-packaged software than is available for any other distribution). Bigger versions are common, I believe that the $AU499 version has 512M of RAM and 4G of flash - I’m not sure that I could even obtain a lesser EeePC in Australia. The up-side of flash is that it doesn’t take much power as having a low power device in whatever confined space ends up housing your router is a good thing (the EeePC is listed as using less than 20W no matter what the load and idling at as little as 14W) and that it doesn’t tend to break when dropped or have any moving parts to wear out. The down-side of flash is that a sufficient number of writes will destroy it. Obviously swap is not a suitable use for a flash storage device. But a small mail server (suitable for the needs of a home or a small office) should be fine with it. Squid is commonly run on router devices, to run it on an EeePC I would be inclined to buy 1G USB flash device for the cache, then if Squid’s use destroyed the flash storage it would be easy to spend $20 and buy another. The EeePC has three USB ports and a built-in Ethernet port. I believe that the minimum number of Ethernet ports for a firewall is three, this means either one for the uplink, one for the DMZ, and one for your LAN, or two for uplinks (with a redundant uplink) and one for the LAN. The three USB ports allow using two USB Ethernet devices to provide the minimum three Ethernet ports and one for USB flash storage. One notable advantage of using a laptop as a server is the built-in UPS (the laptop battery). Many people have put old laptops into service as servers for this reason, but usually an old battery gives no more than about 30 minutes of power, while a new EeePC should be able to last for more than 3 hours without mains power. Using a second-hand laptop as a server is usually not viable in a corporate environment as laptops are all different. Repairing an old desktop PC is easy, repairing an old laptop is unreasonably difficult and often more expensive than replacing it. The low price of the EeePC makes it easily affordable (cheaper than some of the desktop machines that might be used for such a purpose) and the fact that it is purchased new at such a price means that you get warranty support etc. It seems to me that a significant disadvantage of using an EeePC (or anything other than a real server) for a server task is that it lacks ECC RAM [2], but as I’m not aware of any device sold for the purpose of running as a low-end router or sold at a price-point such that it could be used as a low-end router which has ECC RAM I guess that’s not a big disadvantage for that purpose. But the lack of ECC RAM and the lack of useful support for RAID does make it a little less suitable for use as a mail server. Finally if you are going to run a VPN then it would be handy to be able to secure the hardware against malicious activity when the office is closed. An EeePC will fit nicely in most safes… Please let me know what you think about this idea. I’ll probably start installing some such machines for clients in the near future if ASUS can keep up with the demand.

• [1] http://www.hothardware.com/articles/Asus_Eee_PC_Full_Retail_Review_Showcase/?page=1


• [2] http://etbe.coker.com.au/2007/07/15/desktop-machines-and-ecc-ram/

Share This

pam-hooks - PAM module to execute login/logout actions Yesterday I've finally published a PAM module I wrote a while ago to implement an apparently trivial need which I haven't found implemented elsewhere. What I wanted to do was simply to be able to execute hook scripts upon an user is entering or leaving a PAM session. Actually, my use case is to clean the home directory of a user upon its GDM logout (and to be sure also just after he logs in) as such a user is a "dummy" one, reused by several people in a stripped down kiosk-like environment. When I did my googling about this I was able to find only Enrique Oca a's PAM preprofile which can force script execution at authentication time, but nothing for the logout. So I wrote my own toy module, generalizing a bit the API so that invoked scripts are informed about whether a login or logout is in process. The result is pam-hooks. It is not in Debian since I do not know how many people can be interested in such a thing; in case you are just let me know. Dear lazyweb, comments, code auditing, and pointers to similar stuff I've overlooked are really welcome.

I have just uploaded javatools 0.5 to unstable and it is currently waiting in NEW. Anyone wishing to try it out earlier can find source and packages (it's arch: all) at http://www.srcf.ucam.org/~mjj29/javatools/ . Javatools replaces the existing jarwrapper package and also contains programs to help packagers in creating packages for Java programs and libraries. Packaging tools The javahelper package consists of several small programs which make packaging Java programs and libraries easier. They are generally designed to work in the same fashion as the debhelper programs, but start with the jh_ prefix. All of the programs have their command line arguments documented in manpages. jh_build Many Java programs and libraries are distributed without sane build systems. jh_build provides a simple interface for building Java source code into Jars, including setting the appropriate entries in the manifest. In almost all cases all that needs to be done to call jh_build is to set JAVA_HOME and CLASSPATH and then call jh_build with the name of the jar and the directory containing the source.

JAVA_HOME=/usr/lib/jvm/java-gcj
CLASSPATH=/usr/share/java/esd.jar:/usr/share/java/jsch.jar
jh_build weirdx.jar src
   

This command will compile all the Java files under src , set the classpath in the manifest and build it all into weirdx.jar. A couple of other options are worth mentioning. If this jar contains an application rather than a library then the -m or --main option can be used to set the Main-Class attribute in the manifest which will allow the resulting jar file to be be executed jh_build also provides a --clean parameter which should be called in the clean target of debian/rules . jh_libs For library packages Debian Java policy currently requires that the libraries be installed to /usr/share/java in a versioned format and with an unversioned symlink. jh_libs will take a jar and correctly install it. As with debhelper programs, this can either take a jar as a parameter, or read a list of jars from a file in the Debian directory. It also follows the -p , -i and -s semantics of debhelper for selecting which packages to install the jar to. When operating on a package, jh_libs will read the list of library jars from debian/package.jlibs or debian/jlibs . The jlibs file is a list of jars to install, one per line, and works exactly the same as listing them on the command line. Each jar is installed to debian/package/usr/share/java/ in the appropriate versioned and unversioned forms. jh_depends jh_depends works like dpkg-shlibdeps, but for jar files. For each jar in the package it takes the jars on which it depends and finds the packages to which they belong. These are included in the debhelper substvars as $ java:Depends . The control file can then just list that variable which is filled in automatically. This is done by reading the Class-Path attribute from the manifest of each jar. Jar files should include this attribute to prevent applications which use them from needing a full recursive classpath in their startup scripts and to prevent unneccessary transitions when the library changes its dependencies. If the package is not built with jh_build and the upstream build system doesn't set it correctly then jh_manifest can be used to fix this. If the application uses executable jars (see Runtime support below) then jh_depends will also add the appropriate depends on jarwrapper and the correct Java runtime. jh_manifest Many upstream build systems do not set the Class-Path attribute in the jars they create. This leads to several unwanted problems, such as expanding the classpath which applications have to use and introducing unneccessary transitions. They also may not set the Main-Class attribute. Both of these are required for running jars with the -jar parameter. jh_manifest can fix the manifest files of jars. It can either read from a manifest file in the Debian directory or run in a mode which updates all the jars with the CLASSPATH environment variable. The manifest files can either be debian/package.manifest or debian/manifest . The format of this file is a list of jars and indented below each one a list of manifest elements to set:

usr/share/weirdx/weirdx.jar:
 Main-Class: com.jcraft.weirdx.WeirdX
 Debian-Java-Home: /usr/lib/jvm/java-gcj
   

jh_exec The Runtime support section below describes running executable jars directly. jh_exec will scan package directories for jars in the paths, or symlinks to jar from the paths, and ensure that they have been set executable if necessary. jh_makepkg jh_makepkg will create template Debian packages for Java programs and libraries similar to dh-make . It should be run in the source directory and it will create the orig.tar.gz and most of the files in the Debian directory, which need only small changes neccessary to build the package. java-propose-classpath Some upstreams have complicated classpaths which may not be obvious to the packager when using jh_manifest to set the Class-Path attribute. java-propose-classpath will unpack a jar and look at the symbols imported to the class files, then scan all the jars in /usr/share/java . This shouldn't be run in the build since it is slow, and there may be ambiguities that the packager must resolve. It is still very useful for the packager as most of the time it will get it right automatically. Runtime support Javatools also provides some runtime support. Unlike compiled programs, or purely interpreted programs with hash-bang lines, Java programs cannot be directly executed. Many upstreams expect them to be run using java -jar jarname or java classname . This is not generally acceptible in systems which expect to just be able to run the command or launch it from a menu. As a result, many packagers are writing wrapper scripts which just call java with the correct classpath, jar and main class. jarwrapper There is an alternative to wrapper scripts, however. The binfmt_misc kernel module allows the kernel to call out to a program in userspace to execute specific types of file. jarwrapper registers itself as a handler for executable jars. This is done by reading values from the manifest file. In order for executable jars to work the following attributes must or may be defined in the manifest. These attributes can be set using jh_build and jh_manifest .

• Main-Class: The name of the class to be run when the application starts. (REQUIRED)
• Class-Path: The path to all the jar files on which this jar depends. (REQUIRED unless empty)
• Debian-Java-Home: A Debian-specific property if this application depends on a specific runtime. Specify the path to the runtime which should be used. (OPTIONAL)
• Debian-Java-Parameters: A Debian-specific property if this application needs extra options to the JVM. (OPTIONAL)

Putting it together This section shows the debian packaging generated by jh_makepkg for an application and a library using jh_build . Sample Library Packaging debian/control

Source: jsch
Section: libs
Priority: optional
Maintainer: Matthew Johnson 
Build-Depends: debhelper (>= 5), javahelper, java-gcj-compat-dev, libzlib-java
Standards-Version: 3.7.3
Homepage: http://www.jcraft.com/jsch/
Package: libjsch-java
Architecture: all
Depends: $ java:Depends , $ misc:Depends 
Description: Java secure channel
 JSch is a pure Java implementation of SSH2. JSch allows you to
 connect to an sshd server and use port forwarding, X11 forwarding,
 file transfer, etc., and you can integrate its functionality
 into your own Java programs. JSch is licensed under a BSD style
 license.
   

debian/rules

#!/usr/bin/make -f
export JAVA_HOME=/usr/lib/jvm/java-gcj
export CLASSPATH=/usr/share/java/zlib.jar
build: build-stamp
build-stamp:
	dh_testdir
	jh_build jsch.jar src
	touch $@
clean:
	dh_testdir
	dh_testroot
	jh_build --clean
	dh_clean
	rm -f build-stamp jsch.jar
install: build
	dh_testdir
	dh_testroot
	dh_clean -k
	dh_installdirs
binary-arch: build install
	# Java packages are arch: all, nothing to do here
binary-indep: build install
	# Create the package here
	dh_testdir
	dh_testroot
	dh_clean -k
	dh_install -i
	dh_installdocs -i
	dh_installchangelogs -i
	dh_javadoc -i --sourcedir=src 
	jh_libs -i
	jh_depends -i
	dh_compress -i
	dh_fixperms -i
	dh_installdeb -i
	dh_gencontrol -i
	dh_md5sums -i
	dh_builddeb -i
binary: binary-indep binary-arch
.PHONY: build clean binary-indep binary-arch binary install
   

debian/libjsch-java.jlibs

jsch.jar
   

Sample Application Packaging debian/control

Source: salliere
Section: misc
Priority: optional
Maintainer: Matthew Johnson 
Build-Depends: debhelper (>= 5), java-gcj-compat-dev, fastjar, 
               libmatthew-debug-java, libcsv-java,
               libitext-java, javahelper
Standards-Version: 3.7.3
Package: salliere
Architecture: all
Depends: $ java:Depends , $ misc:Depends 
Description: Short Description
 Long Description
   

debian/rules

#!/usr/bin/make -f
export JAVA_HOME=/usr/lib/jvm/java-gcj
export CLASSPATH=/usr/share/java/csv.jar:/usr/share/java/debug-disable.jar:/usr/share/java/itext.jar
build: build-stamp
build-stamp:
   dh_testdir
   # Build the package
   jh_build salliere.jar src
   touch $@
clean:
   dh_testdir
   dh_testroot
   jh_build --clean
   dh_clean
   rm -f build-stamp salliere.jar
install: build
   dh_testdir
   dh_testroot
   dh_clean -k
   dh_installdirs
binary-arch: build install
   # Java packages are arch: all, nothing to do here
binary-indep: build install
   # Create the package here
   dh_testdir
   dh_testroot
   dh_clean -k
   dh_install -i
   dh_installdocs -i
   dh_installchangelogs -i
   jh_manifest -i
   dh_link -i
   jh_exec -i
   jh_depends -i
   dh_compress -i
   dh_fixperms -i
   dh_installdeb -i
   dh_gencontrol -i
   dh_md5sums -i
   dh_builddeb -i
binary: binary-indep binary-arch
.PHONY: build clean binary-indep binary-arch binary install
   

debian/salliere.install

salliere.jar usr/share/salliere
   

debian/salliere.links

usr/share/salliere/salliere.jar usr/bin
   

In just over a month (1 month and 1 day, to be precise), it's FOSDEM again. The Debian Developers Room schedule is almost complete, and some interesting things are being published around it. Such as the pre-FOSDEM beer event. In previous years, this always happened at the "Le Roi d'Espagne", a bar at Grand Place in Brussels. This was a nice place for many years, because it's easily found, and they have this backroom where quite a lot of people would fit in. Unfortunately, "quite a lot" does not equal "a huge number", with the amount of people going to the pre-FOSDEM beer event more and more approaching the latter than the former as the years go by. Last year, it finally became too crowded, and it was decided that the pre-FOSDEM beer event would change bars this year. Which has now happened. This year, the pre-FOSDEM beer event will be at the Delirium Caf , which is not at the Grand Place anymore, but just 100m away from it; the FOSDEM website has more information. A nice feature of the Delirium Caf , besides the fact that they are much larger, is the huge amount of different beers they have. Over 2000 of them, which you can query online!. And that's not even considering the soft drinks or waters or whatever, which they also have on their menu. Another novelty this year is the streaming; the main tracks that will be held in Janson will be streamed out of the event, and the Debian video team is also planning to do some streaming. Meaning, even if you can't make it to FOSDEM, you'll still be able to follow some of it. You won't be able to follow everything, especially not the hallway track which at FOSDEM is a very important one; but at least you'll be able to sample some bits, which is nice. Other than that, not much will change. There'll be a key signing party, organized by yours truly. There'll be Lightning talks, there'll be the Main track, and there'll be a number of Developer rooms, including the Debian one—which, occasionally, is also organized by yours truly. This conference has always been my favourite (even though I haven't been to many conferences besides FOSDEM); I've never missed even one edition ever since the very first one back in 2001 (when it was still called OSDEM). And since a few years, I've also been offering crashing space at our office, for international geeks who don't mind roughing it a bit (it's an office, there no shower, there's only floor space). This year, perhaps I haven't been spamming enough for that, but for now I only have two people who're interested in sleeping over (and they're not even sure); if you're going to FOSDEM and still need a place to sleep, you're (probably ;-) welcome. Send me an email. On the Debian front, things are going well, for the most part. The list of speakers for the Devroom is nearing completion, leaving me with little more to do than to start assigning times. We've been assigned a booth as well, but there I still need to figure out how to organize it, and what to do with it. There will of course be the regular UK T-shirts, and probably some other merchandizing, but I also want something involving some computer device. We've had this d-i "babelbox" installation running a few times now, which was nice; but I do think we need some variation, too. The only problem with that approach is that I don't really know what that variation could be. Suggestions are welcome! And so time goes on, and FOSDEM draws nearer. At some point it'll eventually happen, and then it will be over before one can say "blueberry pie". Sometimes I wonder whether all these months of preparation are actually worth it. But when FOSDEM is actually here, I'm sure I'll find that it is, indeed, worth it...

Julien Goodwin asks whether an insecure platform can perform secure computation [1]. My immediate reaction was to recall Charles Babbage’s quote On two occasions I have been asked, ”Pray, Mr. Babbage, if you put into the machine wrong figures, will the right answers come out?” […] I am not able rightly to comprehend the kind of confusion of ideas that could provoke such a question [2]. However on careful reading of Julien’s post it seems that he is most interested in the integrity of the computations rather than the secrecy. He suggests the possibility of performing the computation twice and comparing the results. Of course the issue to consider is whether both computations could be subverted. It seems most likely that if you are using someone else’s computation cluster for the calculations then performing the same calculation on two nodes of that cluster will give the same result both times (whether it’s right or wrong). If there was a computation that would get a result that can be verified with little computation then it would be an easy problem to solve. For example if I wanted to brute-force a passphrase for a GPG key then I could try all combinations that were known to be possible, if one was flagged as correct then in a millisecond I could verify it. If none of the possibilities were listed as correct then I could assume that the process was broken in some way. The problem with this is that such a passphrase can have arbitrary length (I know someone who uses more than 50 characters). So if I used a brute-force attack on passwords of up to 9 characters that doesn’t exclude a 10 character password. Probably the best potential use for insecure systems is for analysing large data sets. There have been several projects to harness unused computation resources to perform various large calculations (protein folding and SETI are two examples). Most such projects use closed-source programs because the people who run the contests are afraid of cheats who modify their programs to merely say “no” repeatedly and quickly. Of course this wouldn’t be a problem if they didn’t have a high-score table, and disassembling the program to hack the protocol can’t be that difficult (consider the work invested in reverse engineering protocols such as SMB which are much more complex). It would probably be reasonably to randomly send batches of work to two machines in different regions for such large-scale public computation projects. Finally if you want to perform calculations on secret data on someone else’s hardware then you may have lost before you even start.

• [1] http://laptop006.livejournal.com/39799.html


• [2] http://en.wikipedia.org/wiki/Garbage_In,_Garbage_Out

Share This

For the time being offline I've been doing a lot of things, and some of them involve free software of course. I'm glad to announce that this march Peru will be heading the direction from its current status-quo to, what we expect, is the first step into a real and sustainable ecosystem where our talented people (from academy, and others) get their hands dirty into to real contribution to free software projects. involucrate.org has born as a project focused on building an environment to foster a real free software community focused on technical contribution and making our country have a larger spot on the free software contributors world-map. The lack of appropiate models and the inhability to stablish a link between the real actors on such scenary have led to a poor involvement and groups atomization for "ideological" or political means, making room for "religionization" of a very technical and licensing model matter where debate over technical aspects have gone 0. Our manifesto (in Spanish) explains our vision and mission, and also how we expect to achieve such a challenging goal. Is in our will to link our academic people, who was somehow behind the walls (a luxury for a country like mine), and the other actors here and globally. We want our talented people to see globally, and offer our life-experience on the field to make them aware and show them the opportunities that they can have and how other people near us who are making it right!. This time, thanks to the wonderful guys at GNOME Foundation, we are having our very first international conference called involucrate+GOME focused on free software development and, as we expect to be, be the first step of a series of world-class events where we expect to set a yearly world-known free software event here in Peru. Something we dodn't have after more than 10 years since the first group of people gathered together to discuss which is the best distro or something like that and the discussion is still ongoing. As noted the conference will be focused mostly, well almost 90%, in GNOME, but we expect to have more editions dedicated to one or more projects. So, I invite you to check our program and our cool speakers, all from south america and all contributing on GNOME. Of course you are invited to attend to, if you happen to like us! Bring your questions and contributions to this initiative to both our project web or DebianPeru web who is coordinating this initiative, I mean this is almost a debianite sub-project ;) I want to say as a side-note, that despite what media has made people think, we are making a real cool relationship with the chilean community. Expect to hear from us soon, and not because we've buying more wine from Chile and they are importing real pisco from Peru, or because we'll mimic our presidents. I really like this time, it comes 10 years late, however!

Joey, just don't delay your releases waiting for incoming translations. Gettext is anyway smart enough to not use translations when they're non-existing (aha) of fuzzy. So, an incomplete translation for a program will just end up in a partially translated program. That's actually the case for *many* localized software, including the big ones. I suggest that you apply such a schedule:

• Plan a release
• Send call for translations (hint: podebconf-report-po is your friend even for non debconf translations...see its man page) and give translators a deadline. The deadline has to be reasonable and leave some room for translation proofreading. Most often, when few strings are impacted (say not more than 20 but, again, that's hard to judge)
• When the deadline is reached, upload release with what you have
• A few days weeks later, eventually release a new version with late translations

But, as you suspected, releasing without synchronised translations is the better choice....as long as you care abou tsending call for updates when needed. BTW, if you need some help to coordinate incoming translations for apt-key, maybe ask on debian-i18n and someone will eventually pop up (hopefully, not /me).

Things have been rather hectic lately, so I haven't found much time to blog. Here's why: DBE62 The Gigabit Ethernet version of our thin client took more time to produce than I expected, for a number of reasons mostly related to a few improvements we decided to squeeze into the design at the last minute. However, today, we finally reached a point where LinuxBIOS runs as well as it did on our previous DBE61 model and where we no longer need any DOS tool to flash the MAC address into the VIA velocity Gigabit chip we selected. Hurray! Production will only commence in one month, but I'm already excited by the new model's potential, both as a thin client and as an embedded platform. Another good thing is that, thanks to Ubuntu developer Scott Balneaves, we managed to get all the necessary tools to support thin clients based on LinuxBIOS into LTSP, so our Etherboot model works out of the box on Ubuntu, since Gutsy. Hurray! There is one remaining issue related to recent changes in X.org core functionalities that make the AMD driver we need unstable but, again, various AMD, Debian and Ubuntu developers are looking into fixing this, so we should soon have spotless Geode support into Debian and Ubuntu again. T rkiye I visited Turkey twice over the last few months, because I'm putting together a pilot project to better promote the Estonian high-tech sector abroad, in collaboration with the Estonian government. I have to say that the more I visit Turkey, the more I like the place and the more understand why these people see themselves as Europeans because, you know what? They are: practically every significant civilization and religion that is at the core of European culture had major events taking place in in Anatolia or Thrace and, also, a devastatingly huge percentage of the consumer goods sold in Europe are designed and manufactured in Turkey. Learning the rudiments of Turkish has also proven to be a lot of fun. While I'm nowhere near as fluent in Turkish as in Finnish or even in Estonian, the learning curve isn't as steep as I initially expected: Altaic and Ugric languages share a surprising amount of grammatical concepts, while Turkish itself borrowed a lot of vocabulary from French, because the founder of modern Turkey, Atat rk, was very fond of the language. I'll venture that proximity with nearby Middle-Eastern countries that were formerly under French influence has something to do with it too. Identity crisis To me, the most challenging part of these business missions abroad is to represent a whole economic sector from a country of which I'm not a citizen or even a resident. Case in point: Being invited to dinner by a Turkish investor, I noticed the waiter asking my host where his foreign guest might be from. A few minutes later, as the waiter put down a gigantic pita bread with the word "Estonia" spelled in roasted sesame seeds, my host asked, reading my business card:

• Actually, your name doesn't sound Estonian. France?
• Qu bec.
• And your mobile number ... 358 ... is that Finland?
• Yup. I've been living there for the past 10 years.
• Ah! So you don't live in Tallinn?
• Nope. Helsinki.

Looking at the waiter and pointing at the gigantic pita, he continues:

• Actually, make that Canada ... no, Finland ... Ah, sorry, never mind. Just keep it as Estonia.

Honestly, trying to keep a straight face while saying "We" about a country of which I'm not a citizen and where I don't even reside becomes unbearable. At some point, some European bureaucrats will have to admit that I need a new citizenship, to reduce the confusion and to let me find myself a proper national identity again; the sooner, the better. Besides, the absurdity of the situation keeps on jumping at everyone's face: during the second mission to Turkey, I kept on bumping into Finnish diplomats who took personal offense at me for living in their country and yet representing the interests of a competing, neighboring country. If you ask me, I cannot entirely blame them for it. However, as far as I'm concerned, I've done my homeworks: I've been here 10 years, I speak the language and I don't have a criminal record. Given this, you'd think that acquiring citizenship would be a mere formality, but the Ulkomaalaisvirasto doesn't see it that way. If you ask me, this country's very first Minister of Immigration, Mrs.Astrid Thors, ought to unilaterally grant citizenship to anyone who's lived here for at least 5 years, just for the asking, regardless of what circumstances brought them here or of what absurd decisions the Ulkomaalaisvirasto might have previously made on their residence permit status. Doing this would go a long way towards undoing the mess of her predecessors at the Ministry of Interior and it would speak volumes about how much Finnish society has evolved from the days when any foreigner was a commie they had to push over the Eastern border.

The portal http://www,softwarefree,org/ aggregates many blog feeds related to free software without regard to license. The About Page for my blog links to my Blog License page which states that “The contents of my blogs (unless otherwise noted) are licensed under a non-commercial share-alike license. This means (among other things) that you may not put my content on a web page that contains Google AdWords or any other similar advertising“. Fortunately I had just read a great post on ProBlogger.net about dealing with such problems [2]. This time I decided to report the site to Google Adsense. I’ve been sending out a few DMCA take-down messages recently and it doesn’t seem to do much good (some sites keep doing it). So I’ll try getting their Google account cancelled. I encourage everone who blogs on Planet Debian and the other planets that they use as sources of such unauthorised copying to do the same.

• [1] http://doc.coker.com.au/legal/blog-license/


• [2] http://www.problogger.net/archives/2008/01/20/fighting-scrapers-with-your-left-jab/

Share This

Sadly, I can't seem to get things right re: Fosdem. I got the dates wrong for Fosdem and had to pay extra to change the bookings. Last year I got the flight wrong and had to pay extra to fly from Gatwick instead of Heathrow (and when I got to Brussels there was some bomb alert that had closed the airport, just to make things worse).
I will now be in Fosdem, on time but poorer than necessary.
I can't get to London in time to take the same Eurostar as many others and there isn't time get back home with the Sunday evening train so I'm staying until Monday morning.
Things are so much easier when public transport isn't involved.
Bah - there's always next year to get things right.

Many languages are spoken in more than one country, and many countries have more than one language. When you forget this you do stuff like language selection menus that use flags to represent languages. This is problematic for several reasons, starting with having to ask yourself what flag you are going to use to represent English, and how to deal with the angry letters you’ll receive when you use the national flag to represent a regional language. So, using flags to represent languages is definitely discouraged. This said, have a look at this small piece of the KDE l10n stats page: The funny thing is that the flag you see next to Galician is the flag of Greenland. And Galician is not spoken at all in Greenland! So, what happened? Why did they use so wrong a flag? The problem is that the ISO 639-1 code for the Galician language is gl , which is the same as the ISO 3166-1 code for Greenland. So, when choosing the flag for Galician they confused the language code with the country code and selected the flag for gl : that is, for Greenland. (I’m surprised that they used the Ukrainian flag ( ua ) for the Ukrainian language ( uk ), and not the Union Flag. Perhaps that would have been too obvious an error :) – although I have been told by email that the ISO 3166-1 code for the UK is GB , not UK ) So, my takeaway message is: don’t use flags to represent languages and if you do, make sure you use a flag of a place where the language is actually spoken! Addendum: I have just seen that Basque is accompanied by the flag of the European Union! That’s because the language’s code is eu . Ah, and there are three variants of the Chinese language (Hong-Kong, Simplified and Traditional), all with the flag of the People’s Republic of China. Someone is bound to receive angry email – Taiwan is a political hot potato. I have sent email to the maintainer of the page.

The problems are now fixed, thanks to a tip from Julian.
See Debian Lenny on amd64 HP Pavilion dv6000 (dv6615ea).
Julian notes that HP do make some friendly laptops. Thing is, I'm not looking for a "business laptop" - neither are many potential GNU/Linux users. I took the chance to persuade the sales assistant about Debian and all things free software - URL's, etc., then the laptop demonstrated the size of the gap that we still need to cover - that needs a change of heart at NVidia.
I had already found that Wiki page but that refers to the dv6116eu as opposed to the dv6615ea - a small difference but these things can mean big differences in how the chipsets are actually implemented.
Matthew - I tried to install an amd64 etch installer (4.0r2), i386 etch installer (4.0) and I tried upgrading to Debian sid once I did have a working implementation via Mepis. I wasn't at all surprised that the graphics were going to be a problem - my surprise is reserved for the parts of a laptop that I tend to assume are no longer proprietary, like ethernet. Guess I was wrong.
The bcm43xx driver problem is a Broadcom issue - it is hardly suprising that the free software driver has problems when there is no spec. What is more annoying is that the wireless device does not show up anywhere in the logs, even with Mepis, with or without the bcm driver + firmware.
GNOME does need more than the expected graphics problems - without the proprietary drivers the trackpad is also non-functional, the Mepis patches for X mean that the Gnome libraries don't load and updating the X packages means that X itself fails.
I may have been "frank" in my assessment of the laptop but that was simply down to the frustration. I don't have time to faff around with this kind of hassle.
I really don't mind having problems with the NVidia graphics - what annoys me is that the lack of any kind of ethernet support and the sheer number of fixes and hacks that Mepis have to use to get something out of the laptop.
Each time I tried to move to an updated Debian package of a mepis version, something else proprietary broke and I really can't use KDE long term. I also wanted to be able to use this in 64bit but the (non-graphics) proprietary stuff just doesn't allow that.
Not everyone has the option of only buying expensive business laptops or those that are known to work and not everyone has the time to spend working out how to fix these problems. (I used to but I wanted something that required less downtime.)

Many languages are spoken in more than one country, and many countries have more than one language. When you forget this you do stuff like language selection menus that use flags to represent languages. This is problematic for several reasons, starting with having to ask yourself what flag you are going to use to represent English, and how to deal with the angry letters you’ll receive when you use the national flag to represent a regional language. So, using flags to represent languages is definitely discouraged. This said, have a look at this small piece of the KDE l10n stats page: The funny thing is that the flag you see next to Galician is the flag of Greenland. And Galician is not spoken at all in Greenland! So, what happened? Why did they use so wrong a flag? The problem is that the ISO 639-1 code for the Galician language is gl , which is the same as the ISO 3166-1 code for Greenland. So, when choosing the flag for Galician they confused the language code with the country code and selected the flag for gl : that is, for Greenland. (I’m surprised that they used the Ukrainian flag ( ua ) for the Ukrainian language ( uk ), and not the Union Flag ( uk ). Perhaps that would have been too obvious an error :)) So, my takeaway message is: don’t use flags to represent languages and if you do, make sure you use a flag of a place where the language is actually spoken!

Many languages are spoken in more than one country, and many countries have more than one language. When you forget this you do stuff like language selection menus that use flags to represent languages. This is problematic for several reasons, starting with having to ask yourself what flag you are going to use to represent English, and how to deal with the angry letters you’ll receive when you use the national flag to represent a regional language. So, using flags to represent languages is definitely discouraged. This said, have a look at this small piece of the KDE l10n stats page: The funny thing is that the flag you see next to Galician is the flag of Greenland. And Galician is not spoken at all in Greenland! So, what happened? Why did they use so wrong a flag? The problem is that the ISO 639-1 code for the Galician language is gl , which is the same as the ISO 3166-1 code for Greenland. So, when choosing the flag for Galician they confused the language code with the country code and selected the flag for gl : that is, for Greenland. (I’m surprised that they used the Ukrainian flag ( ua ) for the Ukrainian language ( uk ), and not the Union Flag. Perhaps that would have been too obvious an error :) – although I have been told by email that the ISO 3166-1 code for the UK is GB , not UK ) So, my takeaway message is: don’t use flags to represent languages and if you do, make sure you use a flag of a place where the language is actually spoken!

Tricky question, isn't it? Indeed, according to the ISO 639-3 standard which finally became an official ISO standard in 2007, there are 7696 different languages, including extinct, ancient, historic, and constructed languages. Of course, this may become a very debated discussion about what constitues a "language". Let's give the guidelines used by SIL International, who was designated by ISO as the official maintenance agency for ISo-639: There is no one definition of "language" that is agreed upon by all and appropriate for all purposes. As a result, there can be disagreement, even among speakers or linguistic experts, as to whether two varieties represent dialects of a single language or two distinct languages. For this part of ISO 639, judgments regarding when two varieties are considered to be the same or different languages are based on a number of factors, including linguistic similarity, intelligibility, a common literature, the views of speakers concerning the relationship between language and identity, and other factors. The following basic criteria are followed:

• Two related varieties are normally considered varieties of the same language if speakers of each variety have inherent understanding of the other variety (that is, can understand based on knowledge of their own variety without needing to learn the other variety) at a functional level.
• Where spoken intelligibility between varieties is marginal, the existence of a common literature or of a common ethnolinguistic identity with a central variety that both understand can be strong indicators that they should nevertheless be considered varieties of the same language.
• Where there is enough intelligibility between varieties to enable communication, the existence of well-established distinct ethnolinguistic identities can be a strong indicator that they should nevertheless be considered to be different languages.

So, we (iso-codes package maintainers) now have to update that part of our package and buy a big bunch of aspirin to people who will work on translating this. Moreover, contrary to all other such standards (3166 for country names, old 639-2 for languages, 15924 for language script names), there is no bloody official *French* version, so even the French translator has to work. Gues who this was until now? :-) To end this blog entry, let's ask a funny question to the readers (no, comments not allowed on my blog, I'm lazy, so answers by mail or in your blogs): what is the country in the world which as the highest number of languages listed in ISO 639-3?

We are getting many bugs about wrong DPI configuration and DisplaySize not working. In most of the cases, it is actually caused by a confusion between Monitor sections in xorg.conf and RandR 1.2 outputs. With a default config, RandR 1.2 drivers will basically associate the unique Monitor section with their first output, even if not enabled. Bug #461501 is a good example of this issue. RandR 1.2 drivers (intel, ati, nv for G80, mga in experimental, radeonhd so far) require that you specify which output is attached to which monitor. If you have a Monitor section with identifier "Foo" connected on output "BAR", then you want the following in your Device section:

    Option "Monitor-BAR" "Foo"

Or (easier), just rename identifier "Foo" into "BAR". You need to add such a section for each output that you want to tweak (DisplaySize, ModeLine, PreferredMode). Then your tweaks will be applied to the right monitor/output. See the HowToRandR12 sections III.1 and III.3 for details.