This is a post about the implementation of data types in the programming language Haskell. If you haven t heard about that, you can proabably safely skip it. For a while I have been thinking: Isn t there a way to get rid of the intermediate Maybe construct in a common expression like fromMaybe default . lookup. It seems that a way to do that would be to pass more information to the Maybe-generating function: What to do with a Just-Value, and what to return in case of Nothing. This leads to a new definion of the Maybe data type as a function. Later I discovered that this seems to work for any algebraic data type. This is probably nothing new, but I was offline at the time of writing, so I didn t check. This means that this might also be total rubbish. Enjoy.

• Algebraic Data Type Done Differently (PDF-File)
• Algebraic Data Type Done Differently (Literate Haskell Source / LaTeX Source)

Update: Several responses in the haskell-cafe -list told me that I just re-invented Curch-Encoding. Nice :-)

I forgot the PIN of my card recently, I dug into the "safe place where the PIN is written" and found that ... (let's say) I don't have it there anymore.

I went to the bank determined to reset my PIN and go on with my life. Here is a short version of the dialog:

- Hello. Your ATM has blocked my card. I would like it back.
- Ok, here you have it, but first, please tell my the secret word you wrote on the form when you made the card.
- Of course... [blabla]
- Ok. The card is unblocked, you will be able to use it in about 15 min.
- Well, yes. I would like to reset my PIN number since I forgot it.
- What kind of card do you have?
- Maestro
- I am sorry, for this type of card, we can't reset the PIN number. We will have to make another card.
- I am sorry, I think there is a misunderstanding here. Are you telling me that I have to make another card just because I want to reset my PIN?
- Yes, for this type of card is not possible to reset the PIN. We have to make another one. We don't have the list of PIN numbers for this kind of cards, so we can't reset the PIN.

[That sounds like "for other types of cards, we have the PIN numbers for every card out there listed on a tally sheet, but we don't for the type of card you have", put in another form. Spooky, huh?]

... If you had the PIN you could change it at the ATM, but we can't do that since we don't have the PIN number.

- Didn't you think that resetting the PIN is a feature useful enough to have?
- [here the broken recorder model enters the scene] For your type of card we can't reset he PIN, we will have to....

[more question from my side trying to understand why is it not possible to just ignore the old PIN and overwrite the information on the card were, of course, fruitless]

[after some time, I gave up]
- OK, how much will it take for the new card to be created?
- Two weeks.
- What? Anyway... how much will that cost?
- 7 RON (approx. 2 or 2.5$)
- OK. Can I withdraw now money from my account?
- Yes
- OK, good, at least that. I would like 500RON. Also, I would like to start the card change procedure.
- Of course.
[The guy gives me the money and starts to look into the system to start the "new card" procedure. Before giving me the money, I asked if he needed my ID or something, but I am not sure if he would have had asked me by himself, if I didn't...]
- There is a small problem...
- Oh, really? Let me guess, it is not possible to start the procedure from this sales point and I will have to go to another one...
- Yes. This card was created at the sales point in Calea Doroban ilor, through a corporate contract and I don't have access to that contract from here... Actually, if I think of it... your employer made that card for you, isn't it?
- Yes.
- In that case you will have to go to your employer and ask for a new card...

GREAT!

On the positive side, at least I can withdraw money from my account... OTOH, I didn't ask if having the card with me would be necessary to withdraw money, so I am not sure if, in the case I will have to give the card to my employer, I will be able to get any cash from the bank...

It’s still in a very early stage (I’ve started coding it yesterday), but it’s basic functionality is already there: You can query the BTS, filter the list of bugreports in realtime by typing something and view the full bugreports in HTML. You can even provide additional information for existing bugs or create new bugreports. It currently only supports icedove and mutt as mailclient but adding other clients is very easy. This tool is not designed to replace reportbug, it rather aims for the newbie users feeling uncomfortable typing their mails in vi and would rather have something to point and click. Maybe I can merge the code with reportbug, but after a quick look at it’s code it seems that this will not be as easy as I thought in the beginning. The code is available here. You’ll need python-qt3 to run it. Update: The screencast was created with byzanz via
$ byzanz-record -c -l -d 45 reportbug-ng.gif
Hint: Best to switch the desktop resolution to something like 800×600 before recording — resizing the gif afterwards is very expensive (cpu- and memory wise).

Today are provincial elections in The Netherlands, one of the least visible governments in this country, so it's hard to decide what would be a good choice. Add to that that the chosen members will in turn choose the (national) Senate. I have never been fond of package deals. I do not necessarily vote for the same party on the provincial level as I do nationally, because these two layers deal with distinctly different classes of decisions. After casting my vote I returned home with a little doubt of whether I'd made the right choice, until I realised which 9 parties I didn't vote for. The fact that my vote did not go to the parties that I don't trust our province or senate with is far more useful than the relatively small difference between the candidates I considered.

I recently wrote an article or two about distributed version control systems.

I've been using Darcs since 2005. I switched to Darcs, in fact, 10 days after the simultaneous founding announcements of git and Mercurial.

Overall, I have been happy. I continue to believe that it is the most distributed of the distributed VCSs, which is a Good Thing.

However, I have lately started having trouble with Darcs hanging while working on my Debian packages. My post to the Darcs user list drew out a few other people whith this problem, which is a design flaw of Darcs.

So I revisited the VCS landscape. I re-examined git, Mercurial, and bzr. I eventually decided to give Mercurial a try. I avoided git because I write some code that is portable to Windows, and git isn't (or isn't very well). Also, git is complex to pick up for me, and I certainly don't want to force something complex onto my contributors. bzr seemed to still have some strange behaviors that it's had for awhile, and I couldn't find even one advantage of it over Mercurial. So off I went with Mercurial.

I quickly learned a bit of a philosophical difference from Darcs to Mercurial.

Darcs avoids conflicts at all costs. Mercurial makes handling conflict easy and, in many cases, automatic.

It is exactly this Darcs behavior that permits both is excellent "darcs send" feature (still unmatched in any other VCS), but also causes its hang problems.

I found Mercurial quite pleasant to work with, and *fast*. It seems to be edging out git in speed tests sometimes these days.

It is easy to get started with Mercurial. The mq system -- similar to quilt or other patch-management programs -- is really quite an amazing hybrid between patch management and version control. I frankly don't see any need for other patch-management tools anymore.

Mercurial has a "patchbomb" feature where you can select a range of changesets to send off, and it will generate nice emails with one changeset per email, and send them to your selected destination, optionally with an introductory message. The normal way of interacting with other Mercurial users is via the hg export/import commands, which send around simple unified diffs plus some additional header information, optionally in the git extended diff format.

I am happy with Mercurial and am in the process of converting my Debian repositories from Darcs to Mercurial. I'm going to keep my personal code in Darcs for the moment because "darcs send" is still easier than "hg email", but that may change before long, depending on how my experience goes.

I'd encourage others to give Mercurial a try. The community is also very nice and helpful.

I have contributed patches to Tailor to make it make exact copies of Darcs repos into Mercurial, which are now in its Darcs repo. There is also a thread on the Mercurial list with some of my initial questions/concerns coming from a Darcs perspective.

After asking for useable CA Software, I have finally settled on using EasyRSA. This is what I did to come across the packaging shortcomings of EasyRSA in Debian. Storing your CA Be sure that your CA is stored in a secure place. Don’t store it online, and make it accessible only to yourself. In my opinion, storing the the CA in a cryptoloop container file on a small 32 MB USB stick is a good idea. Cryptloop is rather easy today and available in the stock Linux kernel. I commonly use grml-crypt to manage the crypto loopback stuff:

sudo grml-crypt start /media/usb4/cryptoloop $MOUNTPOINT

Gotcha: don’t confuse sudo’s “password” prompt with grml-crypt’s “Enter LUKS passphrase” prompt, the cryptoloop password won’t bring you anywhere on the sudo prompt. Preparing the CA directory For the CA, create a dedicated directory in the mounted cryptoloop file system. You’re originally supposed to copy the entire EasyRSA directory tree in there, but I’d recommend to only link the files from your system’s EasyRSA directory to automatically take advantage of distribution updates. You’ll need at least these links:

lrwxrwxrwx 1 mh mh   56 Dec 25 23:23 openssl.cnf -> /usr/share/doc/openvpn/examples/easy-rsa/2.0/openssl.cnf
lrwxrwxrwx 1 mh mh   52 Dec 25 23:22 pkitool -> /usr/share/doc/openvpn/examples/easy-rsa/2.0/pkitool
lrwxrwxrwx 1 mh mh   60 Dec 25 23:23 whichopensslcnf -> /usr/share/doc/openvpn/examples/easy-rsa/2.0/whichopensslcnf

ln -s /usr/share/doc/openvpn/examples/easy-rsa/2.0/openssl.cnf .
ln -s /usr/share/doc/openvpn/examples/easy-rsa/2.0/pkitool .
ln -s /usr/share/doc/openvpn/examples/easy-rsa/2.0/whichopensslcnf .

Configuring your CA The only thing you cannot link is the vars file which contains your CA’s local settings:

export EASY_RSA=“$(pwd)”
export OPENSSL=“openssl”
export PKCS11TOOL=“pkcs11-tool”
export GREP=“grep”
export KEY_CONFIG=$($EASY_RSA/whichopensslcnf $EASY_RSA)
export KEY_DIR=“$EASY_RSA/keys”
# Issue rm -rf warning
echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
export KEY_SIZE=1024
export CA_EXPIRE=3650
export KEY_EXPIRE=3650
export KEY_COUNTRY=“DE”
export KEY_PROVINCE=“”
export KEY_CITY=“”
export KEY_ORG=“Zugschlus.de”
export KEY_EMAIL=“mh+easyrsa-mh-openvpn@zugschlus.de”
export PKCS11_MODULE_PATH=“dummy”
export PKCS11_PIN=“dummy”

Comments have been removed from this file. Better copy the file from /usr/share/doc/openvpn/examples/easy-rsa/2.0/vars and edit it to your needs. I added the two PKCS11 variables since you won’t otherwise be able to issue certificate requests. Creating the CA Next, decide on a shell instance where you will do most operations, and source vars in there. Next, run /usr/share/doc/openvpn/examples/easy-rsa/2.0/clean-all. If you do this in a directory of an already-in-use EasyRSA CA, you’ll need to restore your backup. To actually initialize the CA, run pkitool --initca --pass. If you do not give the --pass parameter, you’ll create a CA that can issue certificates without asking for a passphrase, which might not be a brilliant idea. Choose a reasonably secure pass phrase. Creating Certificates - the simple and suboptimal way You can now simply proceed to create an arbitrary number of pairs of “private” keys and associated certificate by simply calling pkitool <clientname> and/or pkitool --server <servername>. Depending on your security policy, you can mandate the private keys to be protected by a passphrase (adding --pass to the command lines), but you’ll have the expense of being asked for the passphrase every time you start a new openvpn daemon. Creating Certificates the Right Way I have put the “private” in quotes since the keys created this way are not really private: The key was created on the box hosting the CA, was stored on the local (crypted) file system and needs to be moved to the target system via a secure channel. Doing so the right way is harder than expected, so it is usually the better way to keep the private key really private by creating it directly on the target system. On the target system, you need OpenVPN installed, and openssl. After the certificate was created, you can remove openssl again. Creating a private key is part of a key-pair generation process that also leaves a certificate request. The contents of the certificate request is public, and you can safely move it to the CA box and convert it to a certificate by signing the request. You only need to make sure that nobody exchanges your target system’s certificate request for her own before you sign it as you might end up certifying a wrong identity. For the rest of this document we’re going to assume that you have ssh access to the target system and have verified the ssh host key, so that you can be reasonably sure to be connected to the right system. To create a certificate request, you can use this script, which I have called create-easyrsa-cert-req:

#!/bin/bash
set -u
TMPDIR=“/tmp”
export OPENSSL=“openssl”
export PKCS11TOOL=“pkcs11-tool”
export GREP=“grep”
export KEY_CONFIG=“/usr/share/doc/openvpn/examples/easy-rsa/2.0/openssl.cnf”
export KEY_DIR=“$TMPDIR/keys.$$”
mkdir -p $KEY_DIR
export KEY_SIZE=1024
export KEY_EXPIRE=3650
export KEY_COUNTRY=“DE”
export KEY_PROVINCE=“”
export KEY_CITY=“”
export KEY_ORG=“Zugschlus”
export KEY_OU=“$(hostname --fqdn)”
export KEY_EMAIL=“mh+$(hostname)-ovpn-cert@zugschlus.de”
export DEBUG=1
umask 077
if [ “$ 1:-foo ” != “server” ]; then
  /usr/share/doc/openvpn/examples/easy-rsa/2.0/pkitool --csr $(hostname)
else
  /usr/share/doc/openvpn/examples/easy-rsa/2.0/pkitool --csr --server $(hostname)
fi
mv $TMPDIR/keys.$$/* .
rm -rf $TMPDIR/keys.$$

When called without parameters, it creates a certificate request for an OpenVPN client certificate, and when you call it with “server” as parameter, it will create a server certificate request. In any case, it will leave two files in the current directory. They are named after the current host name, and have the extensions .csr and .key. The .key file is your private key. keep it private! The .csr file is the certificate request which you can now move to the keys subdirectory of your CA directory via scp or other means such as an USB stick. To do the actual signing, invoke pkitool --sign <hostname> and enter the CA passphrase. You can ignore the error message that there was no .key file to chmod. Gotcha, when signing a server certificate, use pkitool --server --sign <hostname>. Move Certificate to the target host You can now move the certificate to the target system. Since you’re probably going to need the root certificate and the certificate revocation list as well, you can move the .key file (if created on the CA system), the .crt file, and ca.crt to the target system. These files are public, so there is no need for a secure channel. Revoking Certificates Since an OpenVPN server’s only means of authentication is to check whether the certificate presented by a client is signed by the “right” CA, the only way to revoke VPN access is to revoke the certificate. This is also done on the CA system by calling /usr/share/doc/openvpn/examples/easy-rsa/2.0/revoke-full <client-name>. This creates a crl.pem file which contains a list of all revoked certificates. You need to have a mechanism to distribute that list to all systems that might need it, and it is recommended to have this automated. Remember, if you do not distribute the .crl file, the systems are not going to know about revoked certificates.

Stratus seeks for comments from Alioth admins. Yes I’d like to see OpenID integration with Gforge. The upstream situation is a bit difficult, so I don’t think that you’ll have official opinion from them. In my case, I want OpenID integration because it would be cool to offer a standard wiki and be able to define ACL on some pages which refer to the Alioth accounts that people are used to use. In the longer term, we have other web services which are going to need authentication (DWTT, new version of the PTS, …) in order to provide customized content and it would be great to rely on OpenID for that part. I’m waiting your patches! And next time you want an opinion from the Alioth admins, please mail us instead of hoping that we won’t miss your blog entry in planet.debian.org.

Last weekend I attended the Chemnitzer Linux-Tage, which have been, again, a very nice event. They have a really nice Social Event and very good overall service for people that do stuff for the event (like giving a talk, running a booth). If only they would have similar good connection with trains, its always annoying to go there. :) I had a talk on Sunday afternoon, a bit about Xen on Debian, and just judging from the feedback I got right after the talk my performance was not too bad. My slides are available in case you want to read them. (They are in german only). Fixed two little mistakes people told me after the talk. I also used the CLT to get another sponsor for this years DebConf, yay. Hopefully it works at Cebit too. :) The weekend only has one big bad thing - my Ibook decided to die. It just want let me turn it on again. Plays a sound, but nothing else happens. The few times it decided to boot it didnt run for long. Some minutes and it completly hang. BAAD. Especially a day before I want to use it to give a talk. Damn thing. Now I need to finally get me the new laptop I am planning to get since December. So, looking bad at what suggestions I got in December (thanks to all who sent mails!): - Someone suggested looking at Lenovo T60s. Well, fine, except that their largest display is 15”, and I want more. I dont care much about the weight, so that doesnt count. Also, if it would be IBM still I (maybe) would consider it, but at the same time I got two people telling me to not look at Lenovos, they had bad experience with them… - A suggestion lead me to a site of a notebook manufacturer that only runs if you allow flash in your browser. No thanks, they dont want my money. - HP business notebooks seem to have a good support within people reading my blog (or better - Planet Debian). - And finally, people have been happy with Dell notebooks. So I compared Dell and HP, both times the business notebook class. And currently want to buy a HP nw9440 one. Will get damn expensive, but a similar Dell would only be 100EUR less, and well, HP does care way more for Linux then Dell ever did (or will do)… BTW: We have to many mails on Debian lists!

We had a good weekend this weekend. It was the Nuit Blanche here in Montreal -- a winter festival in which people stayed up all night on Saturday night, visiting art museums, dancing, seeing theater, or having hot chocolate. It's a good tradition in this city, and a lot of fun. We went ice-skating in Parc LaFontaine on Saturday afternoon -- except the ice wasn't very skatey. After the big snowstorm on Friday, the temperature went up to 4C on Saturday, so the ice was mushy and soft. Amita enjoyed riding around on the lake on her sled, though. On Sunday we had a bruncher at our house with friends who were a little worn out from the long night. I made fondue fromage, a big salad, potatoes, and a fondue v g tarien -- veggie bouillon boiling in a pot, with various vegetables that people could dip in, let cook, then eat off their forks. It was a good time. tags: weekend montreal nuit blanche

RoCoCoCamp is a go I spent part of the day today meeting up with the other CoConveners of RoCoCoCamp to go over some logistics for the event. RoCoCoCamp is an unconference centered around wikis and wiki-like Web sites, but stretching out into issues of collaboration, creativity, and self-organizing social groups. It's the Montreal version of RecentChangesCamp, and it's going to take place 18-20 May 2007 here in Montreal. We're finalizing the space and starting to line up funding for the event, as well as catering, lodging, etc. I've sent out a lot of invitations to wiki friends to come join; I think it's going to be a great conference. tags: rocococamp recentchangescamp wiki unconference

More certs for certifi.ca I've been trying to streamline the user experience on certifi.ca, the OpenID identity-provider I set up that uses only client-side certificates for authentication. I've added support for 4 more CAs: GeoTrust, TC TrustCenter, CACert, and StartCom. They all seem to be working well, which is great, although I could really use some help beta-testing the service by users of some of the newer CAs (especially CACert and StartCom). tags: certifi.ca geotrust tc trustcenter cacert startcom

In case anyone is relying on me to point them to the funniest episodes of The Show with Zefrank, this (today’s) is one, especially if you spend any time on Friendster or that odd new generation Myspace.com (when I was young, we had a public_html directory, and we knew how to set permissions on it! I also truthfully walked nearly a mile in freezing weather and snow uphill to get to the school bus). Apparently, The Show will be done for good in just under two weeks. Who knows where all the fans will go?

I was thinking about mentors.debian.net and how much it's useful and unknown for many DDs and potential contributors. I don't think our GForge installation (http://alioth.debian.org) reached its full potential (in terms of audience) but is more known than mentors.

I like the mentors documentation on how a non-DD can upload packages to their repository, and almost everything else there except for the need to create yet another account in a website. I would be glad to see the code move to nm.d.o/mentors, but being less hungry why not some integration with Alioth?

I think that if we add OpenID support into GForge and push that to Alioth, services like mentors will benefit instantly any Debian contributor (DD or not) using svn.d.o, for example. I have no knowledge on GForge internals, but feedback from a GForge hacker if this feature is planned or if this contribution would be welcome will be appreciated. That would be great hear the opinions from alioth and mentors admins.

In other words: I want my Alioth OpenID and i'm sure you can think about new interesting use cases (eg.: forums, debian-community anyone?).

One thing that has always surprised me is how few people talk to speakers after they have finished their lecture. A lecture might have many questions and the questions may be cut off, but when the speaker leaves the room they will usually do so alone.

When I give lectures at conferences I'm always happy to spend more time talking to people who are interested in the topic and disappointed that so few people choose to do so. It seems that other people have similar experiences, there have been several occasions when I have invited speakers to join me for lunch and no-one else has shown interest in joining us.

Usually the most significant factor in making someone offer a talk at a Linux conference is the opportunity to teach other people about the technology that they are working on. People with that motivation will take the opportunity to teach people at lunch, dinner, whenever.

Linux Conf Au has an event called the "Professional Delegates Networking Session" which is regarded by some people as the way to meet speakers (about half the delegates don't attend so the ratio of speakers to delegates is significantly better than at other conference events). But it seems to me that it's more efficient to just offer to buy them dinner. When I worked for Red Hat the maximum value for a gift I could accept was $100US, I expect that Red Hat has not changed this policy since then and that most companies that employ speakers at Linux conferences have similar policies. $100US is more than a meal costs at most restaurants that are near a Linux conference.

If I was a manager at a company that sent employees to a Linux conference I would first send email to some speakers who were working in areas of Linux development that were related to the projects that the employees were working on. I would ask the speakers if they would be interested in having dinner bought for them by my company and give them the option of bringing one or two friends along for a free meal (the friends would probably be people who work in similar areas).

We had one of the biggest snows of the year today in Montreal. The storm, which happened overnight and was supposed to let up around noon, still hasn't stopped. It's a practical white-out outside -- big fluffy flakes everywhere. The radio said we had more than 40 cm of snow, which is just amazing. I headed over to La ka this afternoon for an interview with Steve Faguy of the Montreal Gazette. I was pretty worried about going out, but as usual I was pleasantly surprised when I was outside. Snowy weather is pretty gentle, and although I was cold and wet when I got to La ka, it wasn't all that bad. I had a good talk with Steve about Wikitravel, Montreal tech scene, and the French Revolutionary Calendar. I'm looking forward to seeing the article when it comes out. tags: steve faguy la ka snow interview gazette

certifi.ca doing well I was glad to see a post about certifi.ca in the Solution Media Blog of Thomas Huhn. Thomas set up the extremely useful OpenID Directory, so his opinion is pretty valuable. I'm glad he's as enthused about certifi.ca as I am. tags: thomas huhn certifi.ca openiddirectory openid

Registration and privacy I think I have an account on every free OpenID service on the Web. I need lots of accounts for debugging purposes, and I also like to have an idea of what people are doing with the protocol. I checked out prooveme.com a few days ago. prooveme.com gives out OpenIDs with SSL cert authentication, like certifi.ca. It seems like an OK service, but I don't think they use SSL and certs the right way. I tested the prooveme ID on a couple of services, had a couple of errors, and that was that. So I was surprised to see this posting in the proovemeblog today:

• certifi.ca is another site doing certificated OpenID. Evan, the creator of certifi.ca is a subscriber of ours. We'll obviously be pleased if he carries on using us!

Now, I've been in wikis long enough to know that you have to AssumeGoodFaith when people post things in public forums, so I'll take this comment as nothing more than clumsy but good-natured ribbing. Ha ha ha. But: I haven't publicly said that I'd tested out the prooveme server. I'm not particularly embarrassed about it, but I hadn't had any reason to mention it to anybody, either. So the only way the poster could know that I'd registered for their service was to check their database records for my registration information. Publishing users' registration info without their consent steps over an important privacy line for me and, I think, for a lot of people. I'm not sure making a joke really justifies that kind of privacy invasion. I don't feel fairly treated, here. I partly blame myself: after all, I submitted personally-identifying information (PII) into a Web form on a site without an explicit privacy policy. I've gotten so used to OpenID providers being experienced with security and privacy issues that I made assumptions that turned out not to be the case. I've taken the incident as a wake-up call to put a privacy policy on certifi.ca. I hope that will communicate to users what I consider acceptable use of their data. And I'll make sure to check carefully for privacy policies whenever creating a new account in the future. For clarity: if I have an account on a Web service, that is not any kind of endorsement of their service, and doesn't necessarily suggest that I use that service regularly (or at all). I'm going to see what I can do to get my account deleted from the prooveme servers to avoid any misunderstanding in the future. tags: prooveme privacy openid

I tried to setup VMWare today, to be able to have some virtual machines to test random stuff. My laptop only has a small HD, so I want to have all the VM stuff on my huge external USB drive. Also I only use them occasionally, so that pretty much rules out Xen. So I decided to give VMWare a try. VMWare has always been a desaster installation-wise. It took me like 5 runs to get it installed properly; you need to apply some patches or it won't work with current kernels etc. After these tries it had installed without any further error messages and the GUI also came up easily. However none of the VMs I created did anything; apparently they're supposed to at least show some BIOS like screen. Instead I only get the error message "Unable to change virtual machine power state: The process exited with an error: End of error message." And of course it doesn't tell me which process or anything else that could help debugging it. Shutdown also doesn't work properly - stopping vmware leaves a vmware-serverd process running that needs to be killed with -9. As usual, commercial software is totally disappointing. [Update: so neither the vmmon shipped with VMWare nor the one from vmware-any-any-update108 worked; keep your eyes open for update109. I managed to patch vmmon myself, in include/compat_kernel.h move the if/else part up to the front, as it is in update108.]

[ Yes, entry written for my Mexican fellows. My blog is in English. Don't rant about that, your pleads won't be listened ]
Damog just ranted (in Spanish) about too many people coming to Mexico City. I completely agree with him, but not with his conclusions. We are a ~25,000,000 people city, in a ~100,000,000 people country. The inequity we face every day is huge (Cd. Nezahualc yotl, among the poorest in the city, is the most densely populated region in the whole world, but you can easily spot over 2000 sq mt houses in Bosques de las Lomas or similar regions - And the whole Santa F region just scares me, it is an unknown planet I don't even want to think of). But what's really terrible is how living in this city changes our collective moods.
Sometimes it strikes me to understand how people in other countries can live in one town and work in another, over 40 minutes away. Well, for many years I worked at places over one hour away from home - and I didn't even cross the city. Mexico City is, or was last time I checked, 40x70km, and without enough adequate main ways. Of course, people get grumpy and aggressive while driving.
What's my answer?
Don't drive.
Seriously.
Yesterday, for example, I chaired three talks at Linuxworld Mexico. In friggin' Hip dromo de las Am ricas, a convention center located in one of the worst-connected pieces of land in Mexico. Usually, it would take me 40-90 minutes to get there by car, depending on the time of day and phase of Deimos against Fobos. Of course, it took me 70 minutes to go by metro+bus. I took two nice books (La regi n m s transparente, a beautiful book by Carlos Fuentes no Mexico City inhabitant should skip, and Laurence Rosen's Open Source Licensing). And I didn't get bored, and I didn't hate the people I was riding with. Even though I crossed the most crowded metro stations. Not only I saved a fair amount of money (MX$6.50 each way against probably something close to MX$120 between the gas and the parking fee of that unholy convention center), but I used my time much better. Some years ago, when I regularly travelled one hour back and forth to work, I learnt most of what I know today of Computer Science during the long time I spent sitting on small microb s seats. Not the most luxurious way of travelling, but still a very good way of moving around our messy city.
Of course, today I have learnt even more, and I want to advocate it: don't work far from your house, or at least, don't work far from a place reachable by Metro. Sometimes it sounds impossible, but really... How much do you value your time? Do you think that it's better to get MX$20,000 a month in a Santa F office than to get MX$15,000 in an office in Insurgentes? Do you think nobody will pay you decently if the offices are in Ermita Iztapalapa? Good work done brings a good salary. And seriously, the extra MX$5,000 in my first example is not worth the daily anger you will get by crossing the city to get to Nowhere Land and work for the corporate overlords.
I might be extremely lucky, but I work 3Km away from home. I come by bike every day. And yes, I was scared at first - Even in Ciudad Universitaria people drive aggressively. You have to take care where you drive. Taxi drivers are among the worst, as they are always in a hurry. And, yes, my elbow has an ugly scratch, as I prefered to stop and fall off my bike than to land over a car whose driver was in a hurry. I've just had my bike for ~6 weeks (after over 10 years of not riding one, and back then, just for a bit), but I'm confident enough to get off the safety of a protected University with no cafres driving their microb s as they damn well please. Last weekend I had a ~6km drive (Copilco-Miguel ngel de Quevedo-Loreto-Alta Vista-Copilco) using several high transit vialities (Universidad, Revoluci n, Insurgentes). I crossed three times the San ngel bus hub, which scared my ass as I approached - But it's perfectly doable, far easier than what I expected. It was fun. It is a decent excercise. And we need more people to take the streets with their bikes.
This morning I heard on the radio that Marcelo Ebrard (Mexico City mayor) is pushing a plan to boost bycicle usage in the city. Something similar to what has been done inside Ciudad Univeritaria, but -of course- in a larger scale: Useful ciclov as along the main roads, city-owned bike rental places (where you can rent your bike at one and drop it at another spot), all this well connected to the main Metro stations. In this interview (in this morning's 98.5 FM news program - sorry, I don't know who heads it... Mart n something IIRC) they said that today, ~0.7% of the trips outside home in Distrito Federal (where only 8 out of our 25 million people live) are carried out on bycicle, and they expect to raise it to 5% over the next six years. We will see about that, I can only wish this program best luck.
Damog complains that we drive like shit because dealing with too many people for too long pisses us off - Ok, Damog, here is the recipe: Don't get pissed off. Each of us will make a minor but tangible contribution. Don't drive so much. Quit your job so far away, get a decent (even worse paid) job closer to your house, closer to the university. You will be happier. Get a bike. Use it, you live close to UNAM as well. You will be happier. And we will be one step closer to total world domination. (yes, we the bikers, not we the Debianers ;-) )

NTL blocking web sites?

Is ntl blocking access to thepiratebay or was ntl's Norwich cache broken? (Is this ntl Virgin Media now?)

BBC NEWS World Europe Gorbachev wades into piracy row

How not to make friends and influence people, the Microsoft way. With the result that:

BBC NEWS World Europe Piracy case collapses in Russia

Well, that was always going to happen!

Microsoft standards bid faces failure - Computeract!ve

and while I'm grumbling about Microsoft (which I don't do very often, but I may have a pop at Vista in a week or so), here's Open XML failing to get fast-tracked.

Denmark mandates open standards by 2008

...but they've still got friends in Denmark's standards body.

Random thought: Roomba scare

Self-improvement for Vacuum Cleaners! Now that would be bad tech.

This is a multi-part message in MIME format.

I always sign up for plain text if it's available. HTML-only is a big discouragement. HTML with a useless plain text part like that is nearly always deleted unread. Protx, this means you!

VOIP IP Telephony: Skype dumps you BIOS info and sends home!

Yet another way that Skype is evil. See also:

pagetable.com Skype Reads Your BIOS and Motherboard Serial Number

Internet phones have a lot to answer for, including my imminent router upgrade:

Bagel Belly Blog: Future proof

The browser-awkwardness of the current router's web interface is another reason I'm looking at OpenWRT-like replacements.

FastMail.FM weblog: More greylisting details

Greylisting seems good, but xbl is a terrible blacklist. I don't know how it works and it has often listed new ISP mail relays (which were not open relays or exploited). Avoid xbl.

debian.org and SPAM - MadBlog

Using RBLs to trigger greylisting seems like a good idea to me.

Sue them all.

Finally, this would be funny if it wasn't so silly. Advertisers: be careful of your music placements or you might start a bomb scare. Although, musical bombs? Wouldn't that be a bit of a Hollywood film stunt?

So, in light of Sven's Platform, I think I'll just not bother reading his platform when he does get off his arse and publish it (must get round to finishing off NM, must find time from somewhere). On the offchance that you're reading this after he actually publishes it, here's what it said (single line): "As protest against my unfair banning from debian mailing lists, i will not publish any platform until the weekend after the end of the ban." Isn't he clever? Isn't that a fantastic way to process - don't publish your platform (that might actually help your case, if you've got any actually reasonable ideas), just whine (again) about your "unfair" banning. *sigh*. Somedays I do just wonder about humanity.

Thanks to Rommel, I got infected with the FizzBuzz. I won’t bother to repost my own Perl solutions here, but let me say for the record what intrigued me most:

it’s amusing to me that any reference to a programming problem– in this case, FizzBuzz– immediately prompts developers to feverishly begin posting solutions.
1) The whole point of the article is about WHY we have to ask people to write FizzBuzz. The mechanical part of writing and solving FizzBuzz is irrelevant.

I should also say it took me a while (more than the 2 minutes for CodingHorror, and more than 10 for Rommel) to write up a couple of solutions; I had to set up a Test::More test script first. Yes, I cannot read.

I have long felt that many airport security measures are just for show — “security theatre”, as Bruce Schneier puts it — but I now have some anecdotal evidence to back it up. I fly frequently: from Dublin to my family in Durham, and I make the occasional transatlantic flight too. Before I realised it last week, I had taken a travel sewing kit in my hand luggage on seven flights, both short-haul and long. In Chicago, I even had my luggage hand-checked; they still didn’t notice it. Maybe they’d have been more thorough if I’d been wearing a turban.

In case there are people who don't know and care, ftp.ro.debian.org/debian is down. You can switch to ftp.lug.ro/debian if you have a i386, amd64 or powerpc arch system.

For others, I'd recommend ftp.at.debian.org/debian or ftp.de.debian.org/debian.