Well, that's all for today. I think so. You can never be sure.
Well, that's all for today. I think so. You can never be sure.
So I started migrating some of my LXCs to Jessie, to test the
migration in advance. The upgrade itself was easy (the LXC is
mostly empty and only runs radicale), but after the upgrade I
couldn't login anymore (using lxc-console since I don't have
lxc-attach, the host is on Wheezy). So this is mostly a note to
self.
auth.log was showing:
Mar 25 22:10:13 lxc-sync login[1033]: pam_loginuid(login:session): Cannot open /proc/self/loginuid: Read-only file system Mar 25 22:10:13 lxc-sync login[1033]: pam_loginuid(login:session): set_loginuid failed Mar 25 22:10:13 lxc-sync login[1033]: pam_unix(login:session): session opened for user root by LOGIN(uid=0) Mar 25 22:10:13 lxc-sync login[1033]: Cannot make/remove an entry for the specified sessionThe last message isn't too useful, but the first one gave the answer. Since LXC isn't really ready for security stuff, I have some hardening on top of that, and one measure is to not have rw access to /proc. I don't really need pam_loginuid there, so I just disabled that. I just need to remember to do that after each LXC upgrade. Other than that, I have to boot using SystemV init, since apparently systemd doesn't cope too well with the various restrictions I enforce on my LXCs:
lxc-start -n sync Failed to mount sysfs at /sys: Operation not permitted(which is expected, since I drop CAP_SYS_ADMIN from my LXCs). I didn't yet investigate how to stop systemd doing that, so for now I'm falling back to SystemV init until I find the correct customization:
lxc-start -n sync /lib/sysvinit/init INIT: version 2.88 booting [info] Using makefile-style concurrent boot in runlevel S. hostname: you must be root to change the host name mount: permission denied mount: permission denied [FAIL] udev requires a mounted sysfs, not started ... failed! failed! mount: permission denied [info] Setting the system clock. hwclock: Cannot access the Hardware Clock via any known method. hwclock: Use the --debug option to see the details of our search for an access method. [warn] Unable to set System Clock to: Wed Mar 25 21:21:43 UTC 2015 ... (warning). [ ok ] Activating swap...done. mount: permission denied mount: permission denied mount: permission denied mount: permission denied [ ok ] Activating lvm and md swap...done. [....] Checking file systems...fsck from util-linux 2.25.2 done. [ ok ] Cleaning up temporary files... /tmp. [ ok ] Mounting local filesystems...done. [ ok ] Activating swapfile swap...done. mount: permission denied mount: permission denied [ ok ] Cleaning up temporary files.... [ ok ] Setting kernel variables ...done. [....] Configuring network interfaces...RTNETLINK answers: Operation not permitted Failed to bring up lo. done. [ ok ] Cleaning up temporary files.... [FAIL] startpar: service(s) returned failure: hostname.sh udev ... failed! INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. dmesg: read kernel buffer failed: Operation not permitted [ ok ] Starting Radicale CalDAV server : radicale.
https://www.google.com/calendar/ical/person%40gmail.com/private-12341234123412341234123412341234/basic.ics
After doing that, I noticed that the fan in my laptop was on more often than
usual, and I noticed that akonadi-server and postgres were running very often,
and doing quite a lot of processing.
The evil
I investigated and realised that Google
seems to be doing everything they can to make their ical feeds hard to sync
against efficiently. This is the list of what I have observed Gmail doing to an
unchanged ical feed:
Date: headers in HTTP replies are always nowIf-Modified-Since: is not supportedDTSTAMP of each element is always nowVTIMEZONE entries appear in random orderORGANIZER CN entries randomly change between full name and plus.google.com
user IDATTENDEE entries randomly change between having a CN or not having itTRIGGER entries change spontaneouslyCREATED entries change spontaneously.ics feed has actually changed.
Have a look at the script:
I consider it far from trivial, since it needs to do a partial parsing of the
.ics feed to throw away all the nondeterminism that Google pollutes it with.
The setup
The script needs to be run periodically, and I used it as an opportunity to
try
systemd
user
timers:
$ cat ~/.config/systemd/user/update-ical-feeds.timer
[Unit]
Description=Updates ical feeds every hour
# Only run when on AC power
ConditionACPower=yes
[Timer]
# Run every hour
OnActiveSec=1h
# Run a minute after boot
OnBootSec=1m
Unit=update-ical-feeds.service
$ cat ~/.config/systemd/user/update-ical-feeds.service
[Unit]
Description=Update ICal feeds
[Service]
# Use oneshot to prevent two updates being run in case the previous one
# runs for more time than the timer interval
Type=oneshot
ExecStart=/home/enrico/tmp/calendars/update
$ systemctl --user start update-ical-feeds.timer
$ systemctl --user list-timers
NEXT LEFT LAST PASSED UNIT ACTIVATES
Wed 2015-03-25 22:19:54 CET 59min left Wed 2015-03-25 21:19:54 CET 2s ago update-ical-feeds.timer update-ical-feeds.service
1 timers listed.
Pass --all to see loaded but inactive timers, too.
systemctl --user daemon-reload.
Further investigation
I wonder if ConditionACPower needs to be in the .timer or in the
.service, since there is a [Unit] section is in both. Update: I have
been told it can be in the .timer.
I also wonder if there is a way to have the timer trigger only when online.
There is a network-online.target and I do not know if it is applicable. I
also do not know how to ask systemd if all the preconditions are currently met
for a .service/.timer to run.
Finally, I especially wonder if it is worth hoping that Google will ever make
their .ics feeds play nicely with calendar clients.
We are very pleased to announce that HP has committed support of DebConf15 as Platinum sponsor.
"The hLinux team is pleased to continue HP's long tradition of
supporting Debian and DebConf," said Steve Geary, Senior Director at
Hewlett-Packard.
Hewlett-Packard is one of the largest computer companies in the
world, providing a wide range of products and services, such as
servers, PCs, printers, storage products, network equipment, software,
cloud computing solutions, etc.
Hewlett-Packard has been a long-term development partner of Debian, and provides hardware for port development, Debian mirrors, and other Debian services
(HP hardware donations are listed in the Debian machines page).
With this additional commitment as Platinum Sponsor, HP contributes to make possible our annual conference,
and directly supports the progress of Debian and Free Software, helping to strengthen the community who continue to collaborate on their
Debian projects throughout the rest of the year.
Thank you very much, Hewlett-Packard, for your support of DebConf15!
Become a sponsor too!
DebConf15 is still accepting sponsors. Interested companies and organizations may contact the DebConf team through sponsors@debconf.org, and
visit the DebConf15 website at http://debconf15.debconf.org.
I follow a few blog aggregators (or "planets") and it's always a struggle to
keep up with the amount of posts that some of these get. The best strategy I
have found so far to is to filter them so that I remove the blogs I am not
interested in, which is why I wrote
PlanetFilter.
So I started by looking for
another approach and by asking people around me how they dealt with the
firehoses that are Planet Debian and
Planet Mozilla.
It seems like a lot of people choose to "randomly sample" planet feeds and
only read a fraction of the posts that are sent through there. Personally
however, I find there are a lot of authors whose posts I never want to
miss so this option doesn't work for me.
A better option that other people have suggested is to avoid
subscribing to the planet feeds, but rather to subscribe to each of the
author feeds separately and prune them as you go. Unfortunately, this
whitelist approach is a high maintenance one since planets constantly add
and remove feeds. I decided that I wanted to follow a blacklist approach
instead.
/etc/planetfilter.d/ and
outputs filtered feeds in /var/cache/planetfilter/.
You can either:
file:///var/cache/planetfilter/planetname.xml to your local feed readerhttp://localhost/planetname.xml) using a
webserver, or[feed]
url = http://planet.debian.org/atom.xml
[blacklist]
[blacklist]
authors =
Alice Jones
John Doe
[blacklist]
titles =
This week in review
Wednesday meeting for
/etc/polipo/config:
proxyAddress = "127.0.0.1"
proxyPort = 8008
allowedClients = 127.0.0.1
allowedPorts = 1-65535
proxyName = "localhost"
cacheIsShared = false
socksParentProxy = "localhost:9050"
socksProxyType = socks5
chunkHighMark = 67108864
diskCacheRoot = ""
localDocumentRoot = ""
disableLocalInterface = true
disableConfiguration = true
dnsQueryIPv6 = no
dnsUseGethostbyname = yes
disableVia = true
censoredHeaders = from,accept-language,x-pad,link
censorReferer = maybe
/etc/default/planetfilter:
export http_proxy="localhost:8008"
export https_proxy="localhost:8008"
~ gem update ctioga2The website has also been decently improved, with now a search box for finding images in the gallery
The Debian Project will celebrate its 22nd birthday during DebConf15 in Heidelberg in August 2015.
At this age, it s unsurprising that children of Debian contributors have attended our
developer conference for several years.
Going with the times, we would like to work further towards making DebConf15 a
child-friendly (parents-friendly) conference. The conference venue is far away
from traffic, self-contained, and there is a dedicated children s play room.
There are green areas around, and the Heidelberg Zoo
is literally within sight of the venue. We haven t yet discussed deals with
them, but we could.
In short: if you d like to attend DebConf, but you are yet unsure what to do
with your children bring your kids along!
The hostel has a number of 3 and 4 bed-rooms with en-suite bathrooms, plus a
good supply of cots available for the very little ones. We will allocate such
rooms to families exclusively for your privacy (subject to availability, so
please register
yourself ASAP, and include a note about your kids).
We are maintaining answers to
commonly-asked questions on the wiki. Please let us know if anything is
missing, and feel free to update the page yourself.
We would also like to explore additional possibilities to make it easier for
parents to participate in the conference. At the moment, we re still scouting
for ideas and there are already a number of promising leads.
To help us figure out what we d best offer, we need to know about the demand.
If you are planning to bring your children, or if you re thinking about it,
please drop a short note with number and ages and any other relevant
information to kids@debconf.org.
Your mail will be read by a few parents involved in the organisation of
DebConf15 and we will obviously keep your data private.
We also created a (publicly archived) mailing list to discuss options and keep
people updated on our plans. Please subscribe yourself to the
list, if interested, and feel free to write to debconf-kids@lists.debian.org
with any questions or ideas you might have.
| Author: | David Lochbaum |
| Author: | Edwin Lyman |
| Author: | Susan Q. Stranahan |
| Author: | Union of Concerned Scientists |
| Publisher: | The New Press |
| Copyright: | 2014 |
| ISBN: | 1-59558-927-9 |
| Format: | Kindle |
| Pages: | 320 |
or Twitter 
or Diaspora*
Unverified backups are useless, every sysadmins know that. But manually verifying a backup means wasting time and resources. Moreover it s boring. You should automatize it!
Charlie Chaplin Modern Times
Backup Checker on github
Hey, this database dump is 6 months old, it s useless today!Backup Checker now controls the expiration duration and triggers a warning if the given duration starting from the last modification of the archive (mtime) is expired. Short examples of the warning: WARNING:root:/backups/backups-12022015.tar.gz is outdated. Was good until 01/03/15 00:00:00 now 22/03/15 21:38:20 You won t be surprized any more by outdated useless data in your backups. Backup Checker also offers lots of other controls. Check the features list! Installing Backup Checker Backup Checker is available from PyPI using the following command:
# pip3.4 install backupcheckerIt s also available for your Debian Squeeze or Debian Wheezy. Check how to get it for your specific distributions.
What about you? How and what for do you use Backup Checker? We would be happy to get your feedbacks. The project cares about our users and the outdated feature was a awesome idea in a feature request by one of the Backup Checker user, thanks Laurent!
I haven't blogged anything in months and figured that now might be a good time to get around that. Here it goes:
Today early in the morning my monitoring system notified me about unusual high outgoing traffic on my hosting plattform. I traced the problem down the webserver which is also hosting this abondened website.
Looking into this with iptraf revealed that this traffic is coming only from one IP. At first I thought anybody might grabbing my Debian packages from ftp.cyconet.org. But no, it was targeting my highly sophisticated blogging plattform.
It makes me really sad to see, that dictionary attacks are smashing with such a high power these days, even without evaluating the 404 response.$ grep 46.235.43.146 /var/log/nginx/vhosts/access_logs/blog.waja.info-access.log tail -2 46.235.43.146 - - [23/Mar/2015:08:20:12 +0100] "POST /wp-login.php HTTP/1.0" 404 22106 "-" "-" 46.235.43.146 - - [23/Mar/2015:08:20:12 +0100] "POST /wp-login.php HTTP/1.0" 404 22106 "-" "-" $ grep 46.235.43.146 /var/log/nginx/vhosts/access_logs/blog.waja.info-access.log wc -l 83676 $ grep 46.235.43.146 /var/log/nginx/vhosts/access_logs/blog.waja.info-access.log wc -l 83782 $ grep 46.235.43.146 /var/log/nginx/vhosts/access_logs/blog.waja.info-access.log grep -v wp-login.php wc -l 0
Friday the 13th was my day. In so many different ways. I received a package which was addressed to Rhonda D'Vinewith a special hoodie in it. The person at the post office desk asked me whether it was for my partner, my response was a (cowardly) "no, it's my pseudonym" but that settled any further questions and I got my package. Later I received an email which made me hyper happy (but which I can't share right now, potentially later). In the evening there was the WortMacht FemSlam (
WordMight FemSlam) poetry slam to which the host asked me to attend just the day before. I was hyper nervous about it. The room was fully packed, there were even quite some people who didn't have a place to sit and were standing at the side. I presented Mermaids because I wasn't able to write anything new on the topic. One would think I am attached enough to the poem by now to not be nervous about it, but it was the environment that made my legs shake like hell while presenting. Gladly I hope it wasn't possible to see it enough under my skirt, but given that it was the first time that I presented it in my home town instead of the "anonymous" internet made me extra anxious. In the end I ended up in place 5 of 7 attendees, which I consider a success given that it was the only text presented in English and not in typical poetry slam style.
I know you, I've seen you at the FemSlam!. That was extra sweet. :)) I'm happy that I was notified about the FemSlam on such short notice, it was a great experience. So today's entry goes out to the host of that event. This is about Yasmo. One can just be envious about what she already accomplished in her still young life. And she is definitely someone to watch out for in the years to come. I have to excuse to my readers who don't understand German yet again, but I'll get back to something English next time, I promise. :)
Wie kann es sein, dass es immer noch diesen Jolly-Buntstift gibt, der "Hautfarbe" hei t?"(
How is it possible that there is still this jolly crayon called "colour of the skin"?)
I have just released version 1.9 of Obnam, my backup program. See the
website at http://obnam.org for details. The new version is
available from git (see http://git.liw.fi) and as Debian packages
from http://code.liw.fi/debian. Due to the freeze of Debian for the
jessie release, I've not uploaded this version to Debian yet (not
experimental and not backports).
This is the first Obnam release since May 13, 2014, 313 days ago.
That's a long time. I make no excuses: Obnam is a hobby project, which
I work on when I have the time and energy. The past year has been very
/interesting/ year for me, in all sorts of stressful ways: I've
changed jobs, moved to another country, and dealt with the loss of a
close relative. Because of this, I've not been able to spend as much
time on Obnam as I'd like.
The NEWS file extract below gives the highlights of what has happened
to Obnam during this time. There's been a lot of things, actually.
My plans for Obnam next are mainly centered around performance. This
will require developing a new repository format, to allow things that
are not possible with the current format. For example, the current
format stores each data chunk in its own file in the repository, and
that is quite wasteful when live data files (and therefore their
chunks) are quite small.
As preparation for this work, the silly-looking "simple" format has
been added, mostly to make sure the internal code infrastructure is
ready to support multiple repository formats in the same Obnam
version.
Those interested in discussing ways to make Obnam fast should join the
obnam-dev mailing list.
Version 1.9, released 2015-03-22
New features:
--include option to Obnam, allowing one to
include files that would otherwise be excluded (see --exclude).obnam fsck to remove unused chunks, if the
--fsck-fix or --fsck-rm-unused settings are used. He also made
it not check for unused chunks when it's useless to do so, because
of various --fsck-skip settings are used.obnam kdirstat, which
makes the KDE k4dirstat utility be able to show graphically which
parts of a backup generation use most space.simple repository format, which is for
demonstration only. It is much too simplistic to be used for real.obnam --help are now clearer that the --root
setting and command line arguments to obnam backup can be SFTP
URLs. Thanks to Simone Piccardi for reporting the issue.assertRaises as a context manager).obnam mount) when
fusermount is available, rather than checking for membership in
the group fuse. The latter is a Debianism (fixed in Debian
jessie).obnam verify didn't notice that a
file had new data, when the modification time was the same. Obnam
now notices this.stat fields as None. Fixed to change those to be 0 instead.foobar (0.2.0-1) unstable; urgency=medium
* update debian/NEWS file
-- Hideki Yamane <henrich@debian.org> Wed, 20 Aug 2014 07:12:51 +0900
foobar (0.2.0-1) unstable; urgency=medium
[releasenote: Stretch]
* "buz" package user should migrate other packages since this package
doesn't provide buz package anymore.
-- Hideki Yamane <henrich@debian.org> Wed, 20 Aug 2014 07:12:51 +0900
Release and Release.gpg files that pass apt's signature
validation on my home connection.
Google publishes Linux software repositories for several of their products,
including Google Chrome, which is available from the following apt source:
deb http://dl.google.com/linux/chrome/deb/ stable main
pub 1024D/7FAC5991 2007-03-08
Key fingerprint = 4CCA 1EAF 950C EE4A B839 76DC A040 830F 7FAC 5991
uid Google, Inc. Linux Package Signing Key <linux-packages-keymaster@google.com>
sub 2048g/C07CB649 2007-03-08
apt-get update:
W: GPG error: http://dl.google.com stable Release: The following signatures were
invalid: BADSIG A040830F7FAC5991 Google, Inc. Linux Package Signing Key
<linux-packages-keymaster@google.com>
apt-get update is run again. Apparently,
this is due to "bad pushes" occurring in the Google infrastructure. An example
of this can be seen in the following curl output:
$ curl -v http://dl.google.com/linux/chrome/deb/dists/stable/Release \
http://dl.google.com/linux/chrome/deb/dists/stable/Release.gpg
* Hostname was NOT found in DNS cache
* Trying 74.125.196.136...
* Connected to dl.google.com (74.125.196.136) port 80 (#0)
> GET /linux/chrome/deb/dists/stable/Release HTTP/1.1
> User-Agent: curl/7.38.0
> Host: dl.google.com
> Accept: */*
>
< HTTP/1.1 200 OK
< Accept-Ranges: bytes
< Content-Length: 1347
< Content-Type: application/octet-stream
< Etag: "518b8"
< Expires: Sun, 22 Mar 2015 18:55:19 PDT
< Last-Modified: Fri, 20 Mar 2015 04:22:00 GMT
* Server downloads is not blacklisted
< Server: downloads
< X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
< X-Xss-Protection: 1; mode=block
< Date: Sun, 22 Mar 2015 01:55:19 GMT
< Alternate-Protocol: 80:quic,p=0.5
<
Origin: Google, Inc.
Label: Google
Suite: stable
Codename: stable
Version: 1.0
Date: Thu, 19 Mar 2015 22:55:29 +0000
Architectures: amd64 i386
Components: main
Description: Google chrome-linux repository.
MD5Sum:
53375c7a2d182d85aef6218c179040ed 144 main/binary-i386/Release
c556daf52ac818e4b11b84cb5943f6e0 4076 main/binary-i386/Packages
867ba456bd6537e51bd344df212f4662 960 main/binary-i386/Packages.gz
2b766b2639b57d5282a154cf6a00b172 1176 main/binary-i386/Packages.bz2
89704f9af9e6ccd87c192de11ba4c511 145 main/binary-amd64/Release
fa88101278271922ec9b14b030fd2423 4082 main/binary-amd64/Packages
1ba717117027f36ff4aea9c3ea60de9e 962 main/binary-amd64/Packages.gz
19af18f376c986d317cadb3394c60ac5 1193 main/binary-amd64/Packages.bz2
SHA1:
59414c4175f2cc22e67ba6c30687b00c72a7eafc 144 main/binary-i386/Release
1764c5418478b1077ada54c73eb501165ba79170 4076 main/binary-i386/Packages
db24eafac51d3e63fd41343028fb3243f96cbed6 960 main/binary-i386/Packages.gz
ad8be07425e88b2fdf2f6d143989cde1341a8c51 1176 main/binary-i386/Packages.bz2
153199d8f866350b7853365a4adc95ee687603dd 145 main/binary-amd64/Release
7ce66535b35d5fc267fe23af9947f9d27e88508b 4082 main/binary-amd64/Packages
a72b5e46c3be8ad403df54e4cdcd6e58b2ede65a 962 main/binary-amd64/Packages.gz
dbc7fddd28cc742ef8f0fb8c6e096455e18c35f8 1193 main/binary-amd64/Packages.bz2
* Connection #0 to host dl.google.com left intact
* Found bundle for host dl.google.com: 0x7f24e68d06a0
* Re-using existing connection! (#0) with host dl.google.com
* Connected to dl.google.com (74.125.196.136) port 80 (#0)
> GET /linux/chrome/deb/dists/stable/Release.gpg HTTP/1.1
> User-Agent: curl/7.38.0
> Host: dl.google.com
> Accept: */*
>
< HTTP/1.1 200 OK
< Accept-Ranges: bytes
< Content-Length: 198
< Content-Type: application/octet-stream
< Etag: "518f4"
< Expires: Sun, 22 Mar 2015 18:55:19 PDT
< Last-Modified: Fri, 20 Mar 2015 04:05:00 GMT
* Server downloads is not blacklisted
< Server: downloads
< X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
< X-Xss-Protection: 1; mode=block
< Date: Sun, 22 Mar 2015 01:55:19 GMT
< Alternate-Protocol: 80:quic,p=0.5
<
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEABECAAYFAlULm7YACgkQoECDD3+sWZFyxACeNPuK/zQ0v+3Py1n2s09Wk/Ti
DckAni8V/gy++xIinu8OdUXv7c777V9H
=5vT6
-----END PGP SIGNATURE-----
* Connection #0 to host dl.google.com left intact
Release and Release.gpg files were fetched with the same
HTTP connection, so the two files must have come from the same web frontend.
(Though, it is possible they were served by different backends.) However, the
detached signature in Release.gpg does not match the content in Release:
gpgv: Signature made Fri 20 Mar 2015 12:01:58 AM EDT using DSA key ID 7FAC5991
gpgv: BAD signature from "Google, Inc. Linux Package Signing Key <linux-packages-keymaster@google.com>"
Release.gpg file is
returned, but the Release file is slightly different:
$ curl -v http://dl.google.com/linux/chrome/deb/dists/stable/Release \
http://dl.google.com/linux/chrome/deb/dists/stable/Release.gpg
* Hostname was NOT found in DNS cache
* Trying 74.125.196.136...
* Connected to dl.google.com (74.125.196.136) port 80 (#0)
> GET /linux/chrome/deb/dists/stable/Release HTTP/1.1
> User-Agent: curl/7.38.0
> Host: dl.google.com
> Accept: */*
>
< HTTP/1.1 200 OK
< Accept-Ranges: bytes
< Content-Length: 1347
< Content-Type: application/octet-stream
< Etag: "518f3"
< Expires: Sun, 22 Mar 2015 18:55:04 PDT
< Last-Modified: Fri, 20 Mar 2015 04:05:00 GMT
* Server downloads is not blacklisted
< Server: downloads
< X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
< X-Xss-Protection: 1; mode=block
< Date: Sun, 22 Mar 2015 01:55:04 GMT
< Alternate-Protocol: 80:quic,p=0.5
<
Origin: Google, Inc.
Label: Google
Suite: stable
Codename: stable
Version: 1.0
Date: Fri, 20 Mar 2015 04:02:02 +0000
Architectures: amd64 i386
Components: main
Description: Google chrome-linux repository.
MD5Sum:
89704f9af9e6ccd87c192de11ba4c511 145 main/binary-amd64/Release
fa88101278271922ec9b14b030fd2423 4082 main/binary-amd64/Packages
1ba717117027f36ff4aea9c3ea60de9e 962 main/binary-amd64/Packages.gz
19af18f376c986d317cadb3394c60ac5 1193 main/binary-amd64/Packages.bz2
53375c7a2d182d85aef6218c179040ed 144 main/binary-i386/Release
c556daf52ac818e4b11b84cb5943f6e0 4076 main/binary-i386/Packages
867ba456bd6537e51bd344df212f4662 960 main/binary-i386/Packages.gz
2b766b2639b57d5282a154cf6a00b172 1176 main/binary-i386/Packages.bz2
SHA1:
153199d8f866350b7853365a4adc95ee687603dd 145 main/binary-amd64/Release
7ce66535b35d5fc267fe23af9947f9d27e88508b 4082 main/binary-amd64/Packages
a72b5e46c3be8ad403df54e4cdcd6e58b2ede65a 962 main/binary-amd64/Packages.gz
dbc7fddd28cc742ef8f0fb8c6e096455e18c35f8 1193 main/binary-amd64/Packages.bz2
59414c4175f2cc22e67ba6c30687b00c72a7eafc 144 main/binary-i386/Release
1764c5418478b1077ada54c73eb501165ba79170 4076 main/binary-i386/Packages
db24eafac51d3e63fd41343028fb3243f96cbed6 960 main/binary-i386/Packages.gz
ad8be07425e88b2fdf2f6d143989cde1341a8c51 1176 main/binary-i386/Packages.bz2
* Connection #0 to host dl.google.com left intact
* Found bundle for host dl.google.com: 0x7ffa33d8b6a0
* Re-using existing connection! (#0) with host dl.google.com
* Connected to dl.google.com (74.125.196.136) port 80 (#0)
> GET /linux/chrome/deb/dists/stable/Release.gpg HTTP/1.1
> User-Agent: curl/7.38.0
> Host: dl.google.com
> Accept: */*
>
< HTTP/1.1 200 OK
< Accept-Ranges: bytes
< Content-Length: 198
< Content-Type: application/octet-stream
< Etag: "518f4"
< Expires: Sun, 22 Mar 2015 18:55:05 PDT
< Last-Modified: Fri, 20 Mar 2015 04:05:00 GMT
* Server downloads is not blacklisted
< Server: downloads
< X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
< X-Xss-Protection: 1; mode=block
< Date: Sun, 22 Mar 2015 01:55:05 GMT
< Alternate-Protocol: 80:quic,p=0.5
<
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEABECAAYFAlULm7YACgkQoECDD3+sWZFyxACeNPuK/zQ0v+3Py1n2s09Wk/Ti
DckAni8V/gy++xIinu8OdUXv7c777V9H
=5vT6
-----END PGP SIGNATURE-----
* Connection #0 to host dl.google.com left intact
Date line in the Release file is different:
@@ -6 +6 @@
-Date: Thu, 19 Mar 2015 22:55:29 +0000
+Date: Fri, 20 Mar 2015 04:02:02 +0000
Release file are in a different order, as well,
though the actual hash values are the same. This Release file does have a
valid signature:
gpgv: Signature made Fri 20 Mar 2015 12:01:58 AM EDT using DSA key ID 7FAC5991
gpgv: Good signature from "Google, Inc. Linux Package Signing Key <linux-packages-keymaster@google.com>"
Release.gpg files in the good and bad cases are the same, and
the same signature cannot cover two files with different content. Also note that
the same mis-signed content is available via HTTPS, so it is probably not
caused by a MITM attack.
The possibility of skew between the Release and Release.gpg files is
precisely why inline signed Release files were introduced, but Google's
repositories use only the older format with a detached signature.
It would be nice if Google could fix the underlying bug in their infrastructure
that results in mis-signed repositories being published frequently, because it
trains users to ignore cryptographic failures.
.nvidia-settings-rc in my homedir from ages ago was
fun 
The downside was that the system was noisier under load; slightly
noisier in some games, to much more noisier in others. This didn't
match my expectations, since the specific version of the card I bought
was not overclocked and had extra large fans, and with only a +25W TDP
it shouldn't have been significantly noisier. Well, that's it, I said,
not all marketing/reviews should be believed.
One interesting thing was that I wasn't clearly able to pin-point what
was generating the additional noise.
PSU upgrade
I was thinking anyway about doing a PSU upgrade as well, since my
current PSU was even older than my videocard, and was at the limit.
Dust
So I bought a PSU as well, and spent about half a day installing
it. Why half a day? Because the new PSU is modular, and the
combination with the case I have means I could redo the cabling inside
my case, significantly.
In the process, I found a lot of accumulated dust which I cleaned. I
also found out that parts of the CPU cooler fins were blocked by dust,
so the fan was not as effective as when new. I also realised that one
case fan was no longer effective in its position, since I have no HDDs
that need cooling (this case is split between MB and HDD/PSU areas),
so I could move it in a place that cools better the various PCIe
devices.
and silence!
After all was said and done, the PC booted up just fine. Everything
seemed correct, the new position of the fan was drawing in cold air
and pushing it over the PCIe cards, so it was time to see if all the
cleanup had any effect on the behaviour under load.
So I start a game, the card gets slightly noisier compared to idle,
and stays there. I go on playing for 10 minutes, which would have
been more than enough to heat the whole system enough that it becomes
noisy, but nothing, just slightly above the normal "PC is on"
noise. Before all the upgrades, my old card was definitely noisier
when playing
I don't know if there is a single, key factor, or if it's a
combination of all of:
Who are you?
I am Laura Arjona, I work as IT assistant at Technic University of Madrid, I am married and I have a son, and I use and promote free (libre) software both at job and at home and with friends. I have a nice time contributing in Debian and other FLOSS projects but I always want to do more than what I manage to actually do (I hope I can improve that, as time goes by... and maybe when I get retired I am the SuperLArjona that you wrote about!).
What parts of FLOSS community are you engaged?
I use Debian, and CyanogenMod + F-Droid in my phone. I coordinate the translation of the Debian website into Spanish, help with FSFE website translation too, and translate some other free software (GNU MediaGoblin, F-Droid, Android apps that I use, web services that we use at work...). I use and promote some free social networks: pump.io, GNU Social, and XMPP. My work/friends environment is mostly Windows/Android so I try to find/promote libre software replacements or interesting applications for them. I give free FLOSS stickers to everybody showing interest for libre software, and a nice Debian sticker if they finally install it in their computers.
Setup of your main machine?
My machine is a humble Compaq Mini 110C laptop (32bits, Atom N270@1.60GHz, 1GB RAM) and I have Debian Jessie (future-stable ATM) with xfce on it. I'm not tied to particular tools, for example I use Mousepad for editing here in my xfce, Kate in my desktop at work, nano in the server. The only "tuning" that I always do is to set a dark background for terminals and text editors, but I don't even switch to a desktop dark theme... (BTW I love Jessie's theme, "Lines"!). I know there are awesome pieces of software out there (hey emacs-org-mode!), but I just don't have fun having to learn them by myself (no LUG near, I'm afraid...).
Some memorable moments from Debian conferences?
I've only been at Barcelona MiniDebConf Women 2014 and it was great. It was memorable that I promoted the keysigning for that MiniDebConf, and came home with lots of signatures and papers to verify and sign... and then I was not remembering my GPG main key passphrase! so I hid under my desk for two months, and then, decided to start again (created a new key and tried to meet some Debian people in Madrid...). So I guess I should go to some (Mini)DebConf again.
You are currently involved in process of becoming non-packaging Debian Developer - what made you take that step?
I began translating in 2011, and since then, I enjoyed contributing in Debian (women, l10n-es, website, publicity). I'm quite regular with the translation work, and applying for DD is a plan to 'force' myself to find chunks of time to contribute more in the other areas too. I also believe that applying I may help other people to also apply or get more involved or become more visible. So here I am.
Although you applied for non-packaging Debian Developer you recognize
that there is still a technical learning curve in Debian even for that - what are the technical aspects a non-Developer should grasp?
Well, I suppose it depends on the area you are contributing. In Publicity you find repositories in git (bits.debian.org), and subversion (Debian Project News). The website uses CVS (www.debian.org)... So you need the basics of 3 different version control systems to commit your changes (or send them to the mailing list and wait somebody to commit them). We use a mail robot to coordinate the translation work, so you need to write the subject with a certain format, and some people complains when somebody send mail in HTML (plain text is preferred). There are some other tools such as IRC and GPG that I began using just for contributing to Debian. Once that you learn them a bit and you learn how Debian works, you understand they are the great tools and you get in love (hey meetbot and KGB! hey i18n.debian.org!), but I wonder how people with no technical background, or even Computer Engineering students nowadays, accostumed to instant messaging in the mobile, fancy web interfaces and so on, look at these tools and just don't even try.
How do you see future of Debian development?
I don't know, Debian is huge... Some areas in which I hope we, as a community, find the way to work more: packaging (or help configuring) web applications or network services, provide LTS support, and keep on improving outreach/diversity.
What are your future plans in Debian, what would you like to work on?
In the Spanish team area, my plan is to go on translating the website, jump more often into translating package descriptions too, and help first-time-contributors to keep themselves involved. In the website and publicity teams, I hope I manage to put some weekly time to help with pending tasks/bugs, and serve as liaison with the other areas in which I'm involved (women, l10n, contributors...). If I become DD, I would like to create/adopt some data sources for contributors.debian.org, or convince people to do it I'm not sure if I will be able to attend DebConf some year; meanwhile, at least, I'll continue trying to help with the blog and promotion (as -publicity-team member).
Why should developers and users join Debian community? What makes Debian a great and happy place?
For using it: the desktop experience has improved very much in the last years, there's a clear separation between free and non-free software so the Debian users always know where are we, and there is wide documentation (in English, at least. Probably in other languages too). For getting involved: I like very much that you can lurk what almost everybody does: just join some mailing lists or IRC channels, the Debian people work in the open. So you know a bit where are you jumping in. Later you learn that everything is easier than what was looking from the outside, because you make friends and with friends everything is better. 
Next.