Debconf 24 is coming to a close in Busan, South Korea this year.
I thought that last year in India was hot. This year somehow managed to beat that. With 35C and high
humidity the 55 km that I managed to walk between the two conference buildings have really put the
pressure on. Thankfully the air conditioning in the talk rooms has been great and fresh water has been
plentiful. And the korean food has been excellent and very energetic.
Today I will share with you the main group photo:
You can also see it in:
The rest of my photos from the event will be published next week. That will give me a bit more time to process
them correctly and also give all of you a chance to see these pictures with fresh eyes and stir up new memories from
the event.
Review: The Book That Wouldn't Burn, by Mark Lawrence
Series:
Library Trilogy #1
Publisher:
Ace
Copyright:
2023
ISBN:
0-593-43793-4
Format:
Kindle
Pages:
561
The Book That Wouldn't Burn is apparently high fantasy, but of the
crunchy sort that could easily instead be science fiction. It is the
first of a trilogy.
Livira is a young girl, named after a weed, who lives in a tiny settlement
in the Dust. She is the sort of endlessly curious and irrepressible girl
who can be more annoying than delightful to adults who are barely keeping
everyone alive. Her settlement is not the sort of place that's large
enough to have a name; only their well keeps them alive in the desert and
the ever-present dust. There is a city somewhere relatively near, which
Livira dreams of seeing, but people from the settlement don't go there.
When someone is spotted on the horizon approaching the settlement, it's
the first time Livira has ever seen a stranger. It's also not a good
sign. There's only one reason for someone to seek them out in the Dust:
to take. Livira and the other children are, in short order, prisoners of
the humanoid dog-like sabbers, being dragged off to an unknown fate.
Evar lives in the library and has for his entire life. Specifically, he
lives in a square room two miles to a side, with a ceiling so high that it
may as well be a stone sky. He lived there with his family before he was
lost in the Mechanism. Years later, the Mechanism spit him out alongside
four other similarly-lost kids, all from the same library in different
times. None of them had apparently aged, but everyone else was dead.
Now, years later, they live a strange and claustrophobic life with way too
much social contact between way too few people.
Evar's siblings, as he considers them, were each in the Mechanism with a
book. During their years in the Mechanism they absorbed that book until
it became their focus and to some extent their personality. His brothers
are an assassin, a psychologist, and a historian. His sister, the last to
enter the Mechanism and a refugee from the sabber attack that killed
everyone else, is a warrior. Evar... well, presumably he had a book,
since that's how the Mechanism works. But he can't remember anything
about it except the feeling that there was a woman.
Evar lives in a library in the sense that it's a room full of books, but
those books are not on shelves. They're stacked in piles and massive
columns, with no organizational system that any of them could discern.
There are four doors, all of which are closed and apparently impenetrable.
In front of one of them is a hundred yards of char and burned book
remnants, but that door is just as impenetrable as the others. There is a
pool in the center of the room, crops surrounding it, and two creatures
they call the Soldier and the Assistant. That is the entirety of Evar's
world.
As you might guess from the title, this book is about a library. Evar's
perspective of the library is quite odd and unexplained until well into
the book, and Livira's discovery of the library and subsequent
explorations are central to her story, so I'm going to avoid going into
too many details about its exact nature. What I will say is that I have
read a lot of fantasy novels that are based around a library, but I don't
think I've ever read one that was this satisfying.
I think the world of The Book That Wouldn't Burn is fantasy, in
that there are fundamental aspects of this world that don't seem amenable
to an explanation consistent with our laws of physics. It is, however,
the type of fantasy with discoverable rules. Even better, it's the type
of fantasy where discovering the rules is central to the story, for both
the characters and the readers, and the rules are worth the effort. This
is a world-building tour de force: one of the most engrossing and
deeply satisfying slow revelations that I have read in a long time. This
book is well over 500 pages, the plot never flags, new bits of
understanding were still slotting into place in the last chapter, and
there are lots of things I am desperately curious about that Lawrence left
for the rest of the series. If you like puzzling out the history and
rules of an invented world and you have anything close to my taste in
characters and setting, you are going to love this book.
(Also, there is at least one C.S. Lewis homage that I will not spoil but
that I thought was beautifully done and delightfully elaborated, and I am
fairly sure there is a conversation happening between this book and Philip
Pullman's His Dark Materials series that I didn't quite untangle
but that I am intrigued by.)
I do need to offer a disclaimer: Livira is precisely the type of character
I love reading about. She's stubborn, curious, courageous, persistent,
egalitarian, insatiable, and extremely sharp. I have a particular soft
spot for exactly this protagonist, so adjust the weight of my opinion
accordingly. But Lawrence also makes excellent use of her as a spotlight
to illuminate the world-building. More than anything else in the world,
Livira wants to understand, and there is so much here to
understand.
There is an explanation for nearly everything in this book, and those
explanations usually both make sense and prompt more questions. This is
such a tricky balance for the writer to pull off! A lot of world-building
of this sort fails either by having the explanations not live up to the
mysteries or by tying everything together so neatly that the stakes of the
world collapse into a puzzle box. Lawrence avoids both failures. This
world made sense to me but remained sufficiently messy to feel like humans
were living in it. I also thought the pacing and timing were impeccable:
I figured things out at roughly the same pace as the characters, and
several twists and turns caught me entirely by surprise.
I do have one minor complaint and one caveat. The minor complaint is that
I thought one critical aspect of the ending was a little bit too neat and
closed. It was the one time in the book where I thought Lawrence
simplified his plot structure rather than complicated it, and I didn't
like the effect it had on the character dynamics. There is, thankfully,
the promise of significant new complications in the next book.
The caveat is a bit harder to put my finger on, but a comparison to Alaya
Dawn Johnson's The Library of Broken
Worlds might help. That book was also about a library, featured a
protagonist thrown into the deep end of complex world-building, and put
discovery of the history and rules at the center of the story. I found
the rules structure of The Book That Wouldn't Burn more
satisfyingly complicated and layered, in a way that made puzzle pieces fit
together in my head in a thoroughly enjoyable way. But Johnson's book is
about very large questions of identity, history, sacrifice, and pain, and
it's full of murky ambiguity and emotions that are only approached via
metaphor and symbolism. Lawrence's book is far more accessible, but the
emotional themes are shallower and more straightforward. There is a
satisfying emotional through-line, and there are some larger issues at
stake, but it won't challenge your sense of morality and justice the way
that The Library of Broken Worlds might. I think which of those
books one finds better will depend on what mood you're in and what reading
experience you're looking for.
Personally, I was looking for a scrappy, indomitable character who would
channel her anger into overcoming every obstacle in the way of thoroughly
understanding her world, and that's exactly what I got. This was my most
enjoyable reading experience of the year to date and the best book I've
read since Some Desperate Glory.
Fantastic stuff, highly recommended.
Followed by The Book That Broke the World, and the ending is a bit
of a cliffhanger so you may want to have that on hand. Be warned that the
third book in the series won't be published until 2025.
Rating: 9 out of 10
The diffoscope maintainers are pleased to announce the release of diffoscope
version 273. This version includes the following changes:
[ Chris Lamb ]
* Factor out version detection in test_jpeg_image. (Re:
reproducible-builds/diffoscope#384)
* Ensure that 'convert' is from Imagemagick 6.x; we will need to update a
few things with IM7. (Closes: reproducible-builds/diffoscope#384)
* Correct import of identify_version after refactoring change in 037bdcbb0.
[ Mattia Rizzolo ]
* tests:
+ Add OpenSSH key test with a ed25519 key.
+ Skip the OpenSSH test with DSA key if openssh is >> 9.7
+ Support ffmpeg >= 7 that adds some extra context to the diff
* Do not ignore testing in gitlab-ci.
* debian:
+ Temporarily remove aapt, androguard and dexdump from the build/test
dependencies as they are not available in testin/trixie. Closes: #1070416
+ Bump Standards-Version to 4.7.0, no changes needed.
+ Adjust options to make sure not to pack the python s-dist directory
into the debian source package.
+ Adjust the lintian overrides.
The Combatants
In the red corner, weighing in at nah, I m not going to do that schtick.
The plaintiff in the case is Alegeus Technologies, LLC, a Delaware Corporation that, according to their filings, is a leading provider of a business-tobusiness, white-label funding and payment platform for healthcare carriers and third-party administrators to administer consumer-directed employee benefit programs .
Not being subject to the US bonkers health care system, I have only a passing familiarity with the sorts of things they do, but presumably it involves moving a lot of money around, which is sometimes important.
The defendant is DigiCert, a CA which, based on analysis I ve done previously, is the second-largest issuer of WebPKI certificates by volume.
The History
According to a recently opened Mozilla CA bug, DigiCert found an issue in their domain control validation workflow, that meant it may have been possible for a miscreant to have certificates issued to them that they weren t legitimately entitled to.
Given that validating domain names is basically the YOU HAD ONE JOB! of a CA, this is a big deal.
The CA/Browser Forum Baseline Requirements (BRs) (which all CAs are required to adhere to, by virtue of their being included in various browser and OS trust stores), say that revocation is required within 24 hours when [t]he CA obtains evidence that the validation of domain authorization or control for any Fully Qualified Domain Name or IP address in the Certificate should not be relied upon (section 4.9.1.1, point 5).
DigiCert appears to have at least tried to do the right thing, by opening the above Mozilla bug giving some details of the problem, and notifying their customers that their certificates were going to be revoked.
One may quibble about how fast they re doing it, but they re giving it a decent shot, at least.
A complicating factor in all this is that, only a touch over a month ago, Google Chrome announced the removal of another CA, Entrust, from its own trust store program, citing a pattern of compliance failures, unmet improvement commitments, and the absence of tangible, measurable progress in response to publicly disclosed incident reports .
Many of these compliance failures were failures to revoke certificates in a timely manner.
One imagines that DigiCert would not like to gain a reputation for tardy revocation, particularly at the moment.
The Legal Action
Now we come to Alegeus Technologies.
They ve opened a civil case whose first action is to request the issuance of a Temporary Restraining Order (TRO) that prevents DigiCert from revoking certificates issued to Alegeus (which the court has issued).
This is a big deal, because TROs are legal instruments that, if not obeyed, constitute contempt of court (or something similar) and courts do not like people who disregard their instructions.
That means that, in the short term, those certificates aren t getting revoked, despite the requirement imposed by root stores on DigiCert that the certificates must be revoked.
DigiCert is in a real rock / hard place situation here: revoke and get punished by the courts, or don t revoke and potentially (though almost certainly not, in the circumstances) face removal from trust stores (which would kill, or at least massively hurt, their business).
The reasons that Alegeus gives for requesting the restraining order is that [t]o
Reissue and Reinstall the Security Certificates, Alegeus must work with and
coordinate with its Clients, who are required to take steps to rectify the
certificates. Alegeus has hundreds of such Clients. Alegeus is generally
required by contract to give its clients much longer than 24 hours notice
before executing such a change regarding certification.
In the filing, Alegeus does acknowledge that DigiCert is a voluntary member of the Certification Authority Browser Forum (CABF), which has bylaws stating that certificates with an issue in their domain validation must be revoked within 24 hours.
This is a misstatement of the facts, though.
It is the BRs, not the CABF bylaws, that require revocation, and the BRs apply to all CAs that wish to be included in browser and OS trust stores, not just those that are members of the CABF.
In any event, given that Alegeus was aware that DigiCert is required to revoke certificates within 24 hours, one wonders why Alegeus went ahead and signed agreements with their customers that required a lengthy notice period before changing certificates.
What complicates the situation is that there is apparently a Master Services Agreement (MSA) that states that it constitutes the entire agreement between the parties and that MSA doesn t mention certificate revocation anywhere relevant.
That means that it s not quite so cut-and-dried that DigiCert does, in fact, have the right to revoke those certificates.
I d expect a lot of update to your Master Services Agreement emails to be going out from DigiCert (and other CAs) in the near future to clarify this point.
Not being a lawyer, I can t imagine which way this case might go, but there s one thing we can be sure of: some lawyers are going to able to afford that trip to a tropical paradise this year.
The Security Issues
The requirement for revocation within 24 hours is an important security control in the WebPKI ecosystem.
If a certificate is misissued to a malicious party, or is otherwise compromised, it needs to be marked as untrustworthy as soon as possible.
While revocation is far from perfect, it is the best tool we have.
In this court filing, Alegeus has claimed that they are unable to switch certificates with less than 24 hours notice (due to contractual SLAs ).
This is a pretty big problem, because there are lots of reasons why a certificate might need to be switched out Very Quickly.
As a practical example, someone with access to the private key for your SSL certificate might decide to use it in a blog post.
Letting that sort of problem linger for an extended period of time might end up being a Pretty Big Problem of its own.
An organisation that cannot respond within hours to a compromised certificate is playing chicken with their security.
The Takeaways
Contractual obligations that require you to notify anyone else of a certificate (or private key) changing are bonkers, and completely antithetical to the needs of the WebPKI.
If you have to have them, you re going to want to start transitioning to a private PKI, wherein you can do whatever you darn well please with revocation (or not).
As these sorts of problems keep happening, trust stores (and hence CAs) are going to crack down on this sort of thing, so you may as well move sooner rather than later.
If you are an organisation that uses WebPKI certificates, you ve got to be able to deal with any kind of certificate revocation event within hours, not days.
This basically boils down to automated issuance and lifecycle management, because having someone manually request and install certificates is terrible on many levels.
There isn t currently a completed standard for notifying subscribers if their certificates need premature renewal (say, due to needing to be revoked), but the ACME Renewal Information Extension is currently being developed to fill that need.
Ask your CA if they re tracking this standards development, and when they intend to have the extension available for use.
(Pro-tip: if they say we ll start doing development when the RFC is published , run for the hills; that s not how responsible organisations work on the Internet).
The Givings
If you ve found this helpful, consider shouting me a refreshing beverage.
Reading through legal filings is thirsty work!
With the work that has been done in the debian-installer/netcfg merge-proposal !9 it is possible to install a standard Debian system, using the normal Debian-Installer (d-i) mini.iso images, that will come pre-installed with Netplan and all network configuration structured in /etc/netplan/.
In this write-up, I d like to run you through a list of commands for experiencing the Netplan enabled installation process first-hand. Let s start with preparing a working directory and installing the software dependencies for our virtualized Debian system:
Next we ll prepare a VM, by copying the EFI firmware files, preparing some persistent EFIVARs file, to boot from FS0:\EFI\debian\grubx64.efi, and create a virtual disk for our machine:
Finally, let s launch the debian-installer using a preseed.cfg file, that will automatically install Netplan (netplan-generator) for us in the target system. A minimal preseed file could look like this:
For this demo, we re installing the full netplan.io package (incl. the interactive Python CLI), as well as the netplan-generator package and systemd-resolved, to show the full Netplan experience. You can choose the preseed file from a set of different variants to test the different configurations:
We re using the linux kernel and initrd.gz here to be able to pass the preseed URL as a parameter to the kernel s cmdline directly. Launching this VM should bring up the official debian-installer in its netboot/gtk form:
Now you can click through the normal Debian-Installer process, using mostly default settings. Optionally, you could play around with the networking settings, to see how those get translated to /etc/netplan/ in the target system.
After you confirmed your partitioning changes, the base system gets installed. I suggest not to select any additional components, like desktop environments, to speed up the process.
During the final step of the installation (finish-install.d/55netcfg-copy-config) d-i will detect that Netplan was installed in the target system (due to the preseed file provided) and opt to write its network configuration to /etc/netplan/ instead of /etc/network/interfaces or /etc/NetworkManager/system-connections/.
Done! After the installation finished, you can reboot into your virgin Debian Sid/Trixie system.
To do that, quit the current Qemu process, by pressing Ctrl+C and make sure to copy over the EFIVARS.fd file that was modified by grub during the installation, so Qemu can find the new system. Then reboot into the new system, not using the mini.iso image any more:
Finally, you can play around with your Netplan enabled Debian system! As you will find, /etc/network/interfaces exists but is empty, it could still be used (optionally/additionally). Netplan was configured in /etc/netplan/ according to the settings given during the d-i installation process.
In our case, we also installed the Netplan CLI, so we can play around with some of its features, like netplan status:
Thank you for following along the Netplan enabled Debian installation process and happy hacking! If you want to learn more, find us at GitHub:netplan.
This week our family suffered another loss with my brother in-law. We will miss him dearly. On our way down to Phoenix to console our nephew that just lost his dad our car blew up. Last week we were in a roll over accident that totaled our truck and left me with a broken arm. We are now in great need of a new vehicle. Please consider donating to this fund: https://gofund.me/033eb25d . Kubuntu is out of money and I am between work packages with the project . We are 50 miles away from the closest town for supplies, essentials such as water requires a vehicle.
I have had bad years before ( covid ) in which I lost my beloved job at Blue Systems. I made a vow to myself to never let my personal life affect my work again. I have so far kept that promise to myself and without further ado I present to you my work.
Kubuntu:
Many SRUs awaiting verification stage including the massive apparmor policy bug.
sddm fix for the black screen on second boot has passed verification and should make .1 release.
See Debian for the qt6 Plasma / applications work.
Debian:
qtmpv in NEW
arianna in NEW
kamera uploading today
kcharselect Experimental
Tokodon Done, but needs qtmpv to pass NEW
Gwenview WIP needs kamera, kio-extras
kio-extras WIP
KDE Snaps:
Please note: for the most part the Qt6 snaps are in edge except the few in the project that are heavily tested. Please help test the edge snaps so I can promote them.
Elisa
Okular
Konsole ( please note this is a confined terminal for the project and not very useful except to ssh to the host system )
Kwrite
Gwenview
Kate ( classic )
Gcompris
Alligator
Ark
Blinken
Bomber
Bovo
Calindori
Digikam
Dragon
Falkon
Filelight
WIP Snaps or MR s made
KSpacedual
Ksquares
KSudoku
KTuberling
Kubrick
lskat
Palapeli
Kajongg
Kalzium
Kanagram
Kapman
Katomic
KBlackBox
KBlocks
KBounce
KBreakOut
KBruch
Please note that 95% of the snaps are free-time work. The project covers 5. I am going as fast as I can between Kubuntu/Debian and the project commitments. Not to mention I have only one arm! My GSOC student is also helping which you can read all about here: https://soumyadghosh.github.io/website/interns/gsoc-2024/gsoc-week-3-week-7/
There is still much work to do in Kubuntu to be Plasma 6 ready for Oracular and they are out of funds. I will still continue my work regardless, but please consider donating until we can procure a consistent flow of funding : https://kubuntu.org/donate/
Thank you for reading and have a blessed day!
DebConf24, the 25th edition of the Debian
conference is taking place in Pukyong National University at Busan, Republic of
Korea.
Thanks to the hard work of its organizers, it again will be an interesting and
fruitful event for attendees.
We would like to warmly welcome the sponsors of DebConf24, and introduce them to
you.
We have three Platinum sponsors.
Proxmox is the first Platinum sponsor.
Proxmox provides powerful and user-friendly Open Source server software.
Enterprises of all sizes and industries use Proxmox solutions to deploy
efficient and simplified IT infrastructures, minimize total cost
of ownership, and avoid vendor lock-in.
Proxmox also offers commercial support, training services, and an extensive
partner ecosystem to ensure business continuity for its customers.
Proxmox Server Solutions GmbH was established in 2005
and is headquartered in Vienna, Austria.
Proxmox builds its product offerings on top of the Debian operating system.
Our second Platinum sponsor is Infomaniak.
Infomaniak is an independent cloud service provider recognised throughout
Europe for its commitment to privacy, the local economy and the environment.
Recording growth of 18% in 2023, the company is developing a suite of online
collaborative tools and cloud hosting, streaming, marketing and events
solutions.
Infomaniak uses exclusively renewable energy, builds its own data centers and
develops its solutions in Switzerland, without relocating.
The company powers the website of the Belgian radio and TV
service (RTBF) and provides streaming for more than 3,000
TV and radio stations in Europe.
Wind River is our third Platinum sponsor.
For nearly 20 years, Wind River has led in commercial Open Source Linux
solutions for mission-critical enterprise edge computing.
With expertise across aerospace, automotive, industrial, telecom, and more,
the company is committed to Open Source through initiatives like eLxr, Yocto,
Zephyr, and StarlingX.
Our Gold sponsors are:
Ubuntu,
the Operating System delivered by Canonical.
Freexian,
a services company specialized in Free Software and in particular Debian
GNU/Linux, covering consulting, custom developments, support and training.
Freexian has a recognized Debian expertise thanks to the participation of
Debian developers.
Lenovo,
a global technology leader manufacturing a wide portfolio of connected
products including smartphones, tablets, PCs and workstations as well as
AR/VR devices, smart home/office and data center solutions.
Korea Tourism Organization,
which purpose is to advance tourism as a key driver for national economic
growth and enhancement of national welfare and intends to be a public
organization that makes the Korean people happier; it promotes national wealth
through tourism.
Busan IT Industry Promotion Agency,
an industry promotion organization that contributes to the innovation of the
digital economy with the power of IT and CT and
supports the ecosystem for innovative local startups and companies to grow.
Microsoft,
who enables digital transformation for the era of an intelligent cloud and an
intelligent edge.
Its mission is to empower every person and every organization on the planet to
achieve more.
doubleO,
a company that specializes in consulting and developing empirical services
using big data analysis and artificial intelligence.
doubleO provides a variety of data-centered services together with small and
medium-sized businesses in Busan/Gyeongnam.
Our Silver sponsors are:
Roche, a major international pharmaceutical
provider and research company dedicated to personalized healthcare.
Two Sigma, rigorous inquiry, technology
data science, and invention to bring science to finance and help solve the
toughest challenges across financial services.
Arm: leading technology provider of processor
IP, Arm powered solutions have been supporting innovation for
more than 30 years and are deployed in over 280 billion chips to date.
Google, one of the largest technology companies in
the world, providing a wide range of Internet-related services and products
such as online advertising technologies, search, cloud computing, software,
and hardware.
FSIJ, the Free Software Initiative
of Japan, a non-profit organization dedicated to supporting Free Software
growth and development.
Busan Tourism Organisation:
leading public corporation that generates social and economic values in Busan
tourism industry, developing tourism resources in accordance with government
policies and invigorate tourism industry.
Civil Infrastructure Platform,
a collaborative project hosted by the Linux Foundation,
establishing an open source base layer of industrial grade software.
Collabora, a global consultancy delivering
Open Source software solutions to the commercial world.
Matanel Foundation, which operates in Israel,
as its first concern is to preserve the cohesion of a society and a nation
plagued by divisions.
A special thanks to the
Pukyong National University, our Venue
Partner and our Network Partners KOREN
and KREONET!
Thanks to all our sponsors for their support!
Their contributions make it possible for a large number of Debian contributors
from all over the globe to work together, help and learn from each other in
DebConf24.
Yay, crypto!
DebCamp has started, and in a couple of days, we will fully be in DebConf24
mode!
As most of you know, an important part that binds Debian together is our
cryptographic identity assurance, and that is in good measure tightened by the
Continuous Key-Signing Parties we hold at DebConfs and other Debian and Free
Software gatherings.
As I have done during (most of) the past DebConfs, I have prepared a set of
pseudo-social maps to help you find where you are in the OpenPGP mesh of our
conference. Naturally, Web-of-Trust maps should be user-centered, so find your
own at:
https://people.debian.org/~gwolf/dc24_ksp/
The list is now final and it will not receive any modifications (I asked
for them some days
ago); if your
name still appears on the list and you don t want to be linked to the DC24 KSP
in the future, tell me and I ll remove it from future versions of the list
(but it is part of the final DC24
file, as its checksum
is already final)
Speaking of which!
If you are to be a part of the keysigning, get the final DC24
file and, on a device
you trust, check its SHA256 by running:
Make sure the resulting number matches the one I m presenting. If it doesn t,
ensure your copy of the file is not corrupted (i.e. download again). If it still
doess not match, notify me immediately.
Does any of the above confuse you? Please come to (or at least, follow the
stream for) my session on DebConf opening day, Continuous Key-Signing Party
introduction,
10:30 Korean time; I will do my best to explain the details to you.
PS- I will soon provide a simple, short PDF that will probably be mass-printed
at FrontDesk so that you can easily track your KSP progress.
A new minor release 0.4.23 of RQuantLib
just arrived at CRAN earlier
today, and will be uploaded to Debian in due course.
QuantLib is a rather
comprehensice free/open-source library for quantitative
finance. RQuantLib
connects (some parts of) it to the R environment and language, and has
been part of CRAN for more than
twenty-two years (!!) as it was one of the first packages I
uploaded.
This release of RQuantLib
updates to QuantLib version 1.35
released this morning. It accommodates some removals following earlier
deprecations, and also updates most of the code in the function for a
more readable and compact form of creating shared pointers via
make_shared() along with auto.
Changes in RQuantLib version 0.4.23 (2024-07-23)
Adjustments for QuantLib 1.35 and removal of deprecated code (in
utility functions and dividend case of vanilla options)
Adjustments for new changes in QuantLib 1.35
Refactoring most C++ files making more use of both
auto and make_shared to simplify and shorten
expressions
On the 18th of May I blogged about my new 5120*2160 monitor [1]. One thing I noted was that one Netflix movie had run in an aspect ratio that used all space on the monitor. I still don t know if the movie in question was cropped in a letterbox manner but other Netflix shows in full screen mode don t extend to both edges. Also one movie I downloaded as in 3840*1608 resolution which is almost exactly the same aspect ratio as my monitor. I wonder if some company is using 5120*2160 screens for TVs, 4K and FullHD are rumoured to be cheaper than most other resolutions partly due to TV technology being used for monitors. There is the Anamorphic Format of between 2.35:1 and 2.40:1 [2] which is a close match for the 2.37:1 of my new monitor.
I tried out the HDMI audio on a Dell laptop and my Thinkpad Yoga Gen3 and found it to be of poor quality, it seemed limited to 2560*1440, at this time I m not sure how much of the fault is due to the laptops and how much is due to the monitor. The monitor docs state that it needs HDMI version 2.1 which was released in 2017 and my Thinkpad Yoga Gen3 was released in 2018 so probably doesn t have that. The HDMI cable in question did 4K resolution on my previous monitor so it should all work at a minimum of 4K resolution.
The switching between inputs is a problem. If I switch between DisplayPort for my PC and HDMI for a laptop the monitor will usually timeout before the laptop establishes a connection and then switch back to the DisplayPort input. So far I have had to physically disconnect the input source I don t want to use. The DisplayPort switch that I ve used doesn t seem designed to work with resolutions higher than 4K.
I ve bought a new USB-C dock which is described as doing 8K which means that as my Thinkpad is described as supporting 5120 2880@60Hz over USB-C I should be able to get 5120*2160 without any problems, however for unknown reasons I only get 4K. For work I m using a Dell Latitude 7400 2in1 that s apparently only capable of 4096*2304 @24 Hz which is less pixels than 5120*2160 and it will also only do 4K resolution. But for both those cases it s still a significant improvement over 2560*1440. I tested with a Dell Latitude 7440 which gave the full 5120*2160 resolution, I was unable to find specs on what the maximum resolution of the 7440 is. I also have bought DisplayPort switch rated at 8K resolution. I got a switch that doesn t also do USB because the ones that do 8K resolution and USB are about $70. The only KVM switch I saw for 8K resolution at a reasonable price was one designed for switching between two laptops and there doesn t seem to be any adaptors to convert from regular DisplayPort to USB-C alternative mode so that wasn t viable. Currently I have the old KVM switch used for USB only (for keyboard and mouse) and the new switch which only does DisplayPort. So I have two buttons to push when switching between input sources which isn t too bad.
It seems that for PCs resolutions with more pixels than 4K are as difficult and inconvenient now as 4K was 6 years ago when I started doing it. If you want higher than 4K resolution to just work at this time then you need Apple hardware.
The monitor has a series of modes for different types of output, I ve found standard to be good for text and movie to be good for watching movies/TV and for playing RTS games. I previously wrote about how to use ddcutil to use a monitor as a KVM switch [3], unfortunately I can t do this with the new monitor as the time that the monitor waits for a good signal on a new input after changing is shorter than the time taken for Linux on the laptops I m using to enable HDMI output. I ve found the following commands to do the basics.
# get display mode
ddcutil getvcp DC
# set standard mode
ddcutil setvcp DC 0
# set movie mode
ddcutil setvcp DC 03
Now that I have that going the next thing I want to do is to have it switch between standard and movie modes when I switch keyboard focus.
The Akismet WordPress anti-spam plugin has changed it s policy to not run on sites that have adverts which includes mine. Without it I get an average of about 1 spam comment per hour and the interface for removing spam takes more mouse actions than desired. For email spam it s about the same volume half of which is messages with SpamAssassin scores high enough to go into the MaybeSpam folder (that I go through every few weeks) and half of which goes straight to my inbox. But fortunately moving spam to a folder where I can later use it to train Bayesian classification is a much faster option on PC and is also something I can do from my phone MUA.
As an experiment I have configured my blog to only take comments from registered users. It will be interesting to see how many spammers make it through that and to also see feedback from genuine people. People who can t comment can tell me about it via the contact methods listed here [1].
I previously wrote about other ways of dealing with hostile comments [2]. Blogging seems to be less popular nowadays so a Planet specific forum doesn t seem a viable option. It s a pity, I think that YouTube and Facebook have taken over from blogs and that s not a good thing.
Another thing to note is that include_directories adds both the source
directory and corresponding build directory to include path, so you don't
have to care.
It seems that I have to care after all.
Thankfully there is an implicit_include_directories setting
that can turn this off if needed.
Its documentation is not as easy to find as I'd like (kudos to Kangie on IRC),
and hopefully this blog post will make it easier for me to find it in the
future.
The Rcpp Core Team is once again pleased to announce a new release
(now at 1.0.13) of the Rcpp package.
It arrived on CRAN earlier
today, and has since been uploaded to Debian. Windows and macOS builds
should appear at CRAN in the next few days, as will builds in different
Linux distribution and of course r2u should catch up
tomorrow too. The release was uploaded last week, but not only does Rcpp always gets flagged because of the
grandfathered .Call(symbol) but CRAN also found two packages
regressing which then required them to take five days to get back to
us. One issue was known; another
did not reproduce under our tests against over 2800 reverse dependencies
leading to the eventual release today. Yay. Checks are good and
appreciated, and it does take time by humans to review them.
This release continues with the six-months January-July cycle started
with release
1.0.5 in July 2020. As a reminder, we do of course make interim
snapshot dev or rc releases available via the Rcpp drat repo as well as
the r-universe page and
repo and strongly encourage their use and testing I run my systems
with these versions which tend to work just as well, and are also fully
tested against all reverse-dependencies.
Rcpp has long established itself
as the most popular way of enhancing R with C or C++ code. Right now,
2867 packages on CRAN depend on
Rcpp for making analytical code go
faster and further, along with 256 in BioConductor. On CRAN, 13.6% of
all packages depend (directly) on Rcpp, and 59.9% of all compiled packages
do. From the cloud mirror of CRAN (which is but a subset of all CRAN
downloads), Rcpp has been downloaded
86.3 million times. The two published papers (also included in the
package as preprint vignettes) have, respectively, 1848 (JSS, 2011) and 324 (TAS, 2018)
citations, while the the book (Springer useR!,
2013) has another 641.
This release is incremental as usual, generally preserving existing
capabilities faithfully while smoothing our corners and / or extending
slightly, sometimes in response to changing and tightened demands from
CRAN or R standards. The move towards a
more standardized approach for the C API of R leads to a few changes;
Kevin did most of the PRs for this. Andrew Johnsom also provided a very
nice PR to update internals taking advantage of variadic templates.
The full list below details all changes, their respective PRs and, if
applicable, issue tickets. Big thanks from all of us to all
contributors!
Changes in
Rcpp release version 1.0.13 (2024-07-11)
Changes in Rcpp API:
Set R_NO_REMAP if not already defined (Dirk in #1296)
Add variadic templates to be used instead of generated code
(Andrew Johnson in #1303)
Count variables were switches to size_t to avoid
warnings about conversion-narrowing (Dirk in #1307)
Rcpp now avoids the usage of the (non-API) DATAPTR function when
accessing the contents of Rcpp Vector objects where possible. (Kevin in
#1310)
Rcpp now emits an R warning on out-of-bounds Vector accesses.
This may become an error in a future Rcpp release. (Kevin in #1310)
Switch VECTOR_PTR and STRING_PTR to new
API-compliant RO variants (Kevin in #1317 fixing #1316)
Changes in Rcpp Deployment:
Small updates to the CI test containers have been made (#1304)
The Initial Encounter:
I recently started to work with Nginx to explore the requirements on how to
configure a then so called server block. It s quite different than within
Apache. But there are a tons of good websites out there which do explain the
different steps and options quite well. I also realized quickly that I need to
be able to configure my Nginx setups in a way so the content is delivered
through https with some automatic redirection from http URLs.
Let s install Nginx
Installing Nginx
$ sudo apt update
$ sudo apt install nginx
Checking your Web Server
We can check now nginx service is active or inactive
Output
nginx.service - A high performance web server and a reverse proxy server
Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
Active: active (running) since Tue 2024-02-12 09:59:20 UTC; 3h ago
Docs: man:nginx(8)
Main PID: 2887 (nginx)
Tasks: 2 (limit: 1132)
Memory: 4.2M
CPU: 81ms
CGroup: /system.slice/nginx.service
2887 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
2890 nginx: worker process
Now we successfully installed nginx and it in running state.
How To Secure Nginx with Let s Encrypt on Debian 12
In this documentation, you will use Certbot to obtain a free SSL certificate
for Nginx on Debian 12 and set up your certificate.
Certbot is now ready to use, but in order for it to automatically configure
SSL for Nginx, we need to verify some of Nginx s configuration.
Step 2 Confirming Nginx s Configuration
Certbot needs to be able to find the correct server block in your Nginx
configuration for it to be able to automatically configure SSL. Specifically,
it does this by looking for a server_name directive that matches the domain you
request a certificate for. To check, open the configuration file for your
domain using nano or your favorite text editor.
Fillup above data your project wise and then save the file, quit your editor,
and verify the syntax of your configuration edits.
$ sudo nginx -t
Step 3 Obtaining an SSL Certificate
Certbot provides a variety of ways to obtain SSL certificates through
plugins. The Nginx plugin will take care of reconfiguring Nginx and reloading
the config whenever necessary. To use this plugin, type the following command
line.
$ sudo certbot --nginx -d example.com
The configuration will be updated, and Nginx will reload to pick up the new
settings. certbot will wrap up with a message telling you the process was
successful and where your certificates are stored.
Output
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/example.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/example.com/privkey.pem
Your cert will expire on 2024-05-12. To obtain a new or tweaked
version of this certificate in the future, simply run certbot again
with the "certonly" option. To non-interactively renew *all* of
your certificates, run "certbot renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
Your certificates are downloaded, installed, and loaded. Next check the
syntax again of your configuration.
$ sudo nginx -t
If you get an error, reopen the server block file and check for any typos or
missing characters. Once your configuration file s syntax is correct, reload
Nginx to load the new configuration.
$ sudo systemctl reload nginx
Try reloading your website using https:// and notice your browser s security
indicator. It should indicate that the site is properly secured, usually with
a lock icon.
While I was living in Argentina, we (my family) found ourselves checking for
weather forecasts almost constantly weather there can be quite unexpected,
much more so that here in Mexico. So it took me a bit of tinkering to come up
with a couple of simple scripts to show the weather forecast as part of my
Waybar setup. I haven t cared to share
with anybody, as I believe them to be quite trivial and quite dirty.
But today, V ctor was asking for some slightly-related
things, so here I go. Please do
remember I warned: Dirty.
I am using OpenWeather s open
API. I had to register to get an APPID, and it
allows me for up to 1,000 API calls per day, more than plenty for my uses, even
if I am logged in at my desktops at three different computers (not an uncommon
situation). Having that, I set up a file named /etc/get_weather/, that
currently reads:
# Home, Mexico City
LAT=19.3364
LONG=-99.1819
# # Home, Paran , Argentina
# LAT=-31.7208
# LONG=-60.5317
# # PKNU, Busan, South Korea
# LAT=35.1339
#LONG=129.1055
APPID=SomeLongRandomStringIAmNotSharing
Then, I have a simple script, /usr/local/bin/get_weather, that fetches the
current weather and the forecast, and stores them as /run/weather.json and
/run/forecast.json:
#!/usr/bin/bashCONF_FILE=/etc/get_weather
if[-e"$CONF_FILE"];then."$CONF_FILE"else
echo"Configuration file $CONF_FILE not found"exit 1
fi
if[-z"$LAT"-o-z"$LONG"-o-z"$APPID"];then
echo"Configuration file must declare latitude (LAT), longitude (LONG) "echo"and app ID (APPID)."exit 1
fi
CURRENT=/run/weather.json
FORECAST=/run/forecast.json
wget -q"https://api.openweathermap.org/data/2.5/weather?lat=$ LAT&lon=$ LONG&units=metric&appid=$ APPID"-O"$ CURRENT"
wget -q"https://api.openweathermap.org/data/2.5/forecast?lat=$ LAT&lon=$ LONG&units=metric&appid=$ APPID"-O"$ FORECAST"
This script is called by the corresponding systemd service unit, found at
/etc/systemd/system/get_weather.service:
[Unit]
Description=Get the current weather
[Service]
Type=oneshot
ExecStart=/usr/local/bin/get_weather
And it is run every 15 minutes via the following systemd timer unit,
/etc/systemd/system/get_weather.timer:
[Unit]
Description=Get the current weather every 15 minutes
[Timer]
OnCalendar=*:00/15:00
Unit=get_weather.service
[Install]
WantedBy=multi-user.target
(yes, it runs even if I m not logged in, wasting some of my free API
calls but within reason)
Then, I declare a "custom/weather" module in the desired position of my
~/.config/waybar/waybar.config, and define it as:
This script basically morphs a generic weather JSON description into another set
of JSON bits that display my weather in the way I prefer to have it displayed
as:
#!/usr/bin/rubyrequire'json'Sources=:weather=>'/run/weather.json',:forecast=>'/run/forecast.json'Icons='01d'=>' ',# d day'01n'=>' ',# n night'02d'=>' ','02n'=>' ','03d'=>' ','03n'=>' ','04d'=>' ','04n'=>' ','09d'=>' ','10n'=>' ','10d'=>' ','13d'=>' ','50d'=>' 'ret='text':nil,'tooltip':nil,'class':'weather','percentage':100# Current weather report: Main text of the modulebeginweather=JSON.parse(open(Sources[:weather],'r').read)loc_name=weather['name']icon=Icons[weather['weather'][0]['icon']]' '+f['weather'][0]['icon']+f['weather'][0]['main']temp=weather['main']['temp']sens=weather['main']['feels_like']hum=weather['main']['humidity']wind_vel=weather['wind']['speed']wind_dir=weather['wind']['deg']portions=portions[:loc]=loc_nameportions[:temp]='%s %2.2f C (%2.2f)'%[icon,temp,sens]portions[:hum]=' %2d%%'%humportions[:wind]=' %2.2fm/s %d '%[wind_vel,wind_dir]ret['text']=[:loc,:temp,:hum,:wind].mappportions[p] .join(' ')rescue=>errret['text']='Could not process weather file (%s %s: %s)'%[Sources[:weather],err.class,err.to_s]end# Weather prevision for the following hours/daysbegincast=[]forecast=JSON.parse(open(Sources[:forecast],'r').read)min=''max=''day=Time.now.strftime('%Y.%m.%d')by_day=forecast['list'].each_with_indexdof,iby_day[day] =[]time=Time.at(f['dt'])time_lbl='%02d:%02d'%[time.hour,time.min]icon=Icons[f['weather'][0]['icon']]' '+f['weather'][0]['icon']+f['weather'][0]['main']by_day[day]<<f['main']['temp']iftime.hour==0min='%2.2f'%by_day[day].minmax='%2.2f'%by_day[day].maxcast<<' min: <b>%s C</b> max: <b>%s C</b>'%[min,max]day=time.strftime('%Y.%m.%d')cast<<' <b>%04d.%02d.%02d</b> '%[time.year,time.month,time.day]endcast<<'%s %2.2f C %2d%% %s %s'%[time_lbl,f['main']['temp'],f['main']['humidity'],icon,f['weather'][0]['description']]endcast<<' min: <b>%s</b> C max: <b>%s C</b>'%[min,max]ret['tooltip']=cast.join("\n")rescue=>errret['tooltip']='Could not process forecast file (%s %s)'%[Sources[:forecast],err.class,err.to_s]end# Print out the result for Waybar to processputsret.to_json
The end result? Nothing too stunning, but definitively something I find useful
and even nicely laid out:
Do note that it seems OpenWeather will return the name of the closest available
meteorology station with (most?) recent data for my home, I often get Ciudad
Universitaria, but sometimes Coyoac n or even San ngel Inn.
After the VoLTE saga [1] and the problems with battery life on the PinePhonePro [2] (which lasted 4 hours while idle with the screen off in my last test a few weeks ago) I m running a Galaxy Note 9 [3] with the default Samsung OS as my daily driver.
I don t think that many people will be rushing out to buy a 2018 phone regardless of my review. For someone who wants a phone of such age (which has decent hardware and a low price) then good options are the Pixel phones which are all supported by LineageOS.
I recommend not buying this phone due to the fact that it doesn t have support for VoLTE with LineageOS (and presumably any other non-Samsung Android build) and doesn t have support from any other OS. The One Plus 6/6T has Mobian support [4] as well as LineageOS support and is worth considering.
The Note 9 still has capable hardware by today s standards. A 6.4 display is about as big as most people want in their pocket and 2960 1440 resolution in that size (516dpi) is probably as high as most people can see without a magnifying glass. The model I m using has 8G of RAM which is as much as the laptop I was using at the start of this year. I don t think that many people will have things that they actually want to do on a phone which needs more hardware than this. The only hardware feature in new phones which beats this is the large folding screen in some recent phones, but $2500+ (the price of such phones in Australia) is too much IMHO and the second hand market for folding phones is poor due to the apparently high incidence of screens breaking.
The Note 9 has the Dex environment for running as a laptop if you connect it to a USB-C dock. It can run nicely with a 4K monitor with USB keyboard and mouse. The UI is very similar to that of older versions of Windows.
The Samsung version of Android seems mostly less useful than the stock Google version or the LineageOS version. The Samsung keyboard flags words such as gay as spelling errors and it can t be uninstalled even when you install a better keyboard app. There is a Bixby button on the side of the phone to launch the Bixby voice recognition app which can t be mapped to any useful purpose, The Google keyboard has a voice dictation option which I will try out some time but that s all I desire in terms of voice recognition. There are alerts about Samsung special deals and configuration options including something about signing in to some service and having it donate money to charity, I doubt that any users want such features. Apart from Dex the Samsung Android build is a good advert for LineageOS.
The screen has curved sides for no good reason. This makes it more difficult to make a protective phone case as a case can t extend beyond the screen at the sides and therefore if it s dropped and hits an edge (step, table, etc) then the glass can make direct contact with something. Also the curved sides reflect sunlight in all directions, this means that the user has to go to more effort to avoid reflecting the sun into their eyes and that a passenger can more easily reflect sunlight into the eyes of a car driver. It s an impressive engineering feat to make a curved touch-screen but it doesn t do any good for users.
The stylus is good as always and the screen is AMOLED so it doesn t waste much power when in dark mode. There is a configuration option to display a clock all the time when the screen is locked because that apparently doesn t use much power. I haven t felt inclined to enable the always on screen but it s a nice feature for those who like such things.
The VoLTE implementation is apparently a bit unusual so it s not supported by LineageOS and didn t work on Droidian for the small amount of time that Droidian supported it.
Generally this phone is quite nice hardware it s just a pity that it demonstrates all of the downsides to buying a non-Pixel phone.
We are pleased to announce that
Wind River has committed to sponsor
DebConf24 as a Platinum Sponsor.
For nearly 20 years, Wind River has led in commercial open source Linux
solutions for mission-critical enterprise edge computing. With expertise
across aerospace, automotive, industrial, telecom, more, the company is
committed to open source through initiatives like eLxr, Yocto, Zephyr,
and StarlingX.
With this commitment as Platinum Sponsor, Wind River is contributing to
make possible our annual conference, and directly supporting the
progress of Debian and Free Software, helping to strengthen the
community that continues to collaborate on Debian projects throughout
the rest of the year.
Wind River plans to announce an exiting new project based on Debian at
this year's DebConf!
Thank you very much, Wind River, for your support of DebConf24!
Become a sponsor too!
DebConf24 will take place from 28th
July to 4th August 2024 in Busan, South Korea, and will be preceded by
DebCamp, from 21st to 27th July 2024.
DebConf24 is accepting sponsors! Interested companies and organizations
should contact the DebConf team through sponsors@debconf.org, or visit the
DebConf24 website at https://debconf24.debconf.org/sponsors/become-a-sponsor/.
In two weeks DebConf24, the Debian conference starts in Busan, South
Korea. Therefore I've added support for the Korean language into the
web service of FAI:
https://fai-project.org/FAIme/
Another new feature of the FAIme service will be announced at
DebConf24 in August.
Prior to arrival in Kenya, you need to apply for an Electronic Travel Authorization (eTA) on their website by uploading all the required documents. This system is in place since Jan 2024 after the country abolished the visa system, implementing the eTA portal. The required documents will depend on the purpose of your visit, which in my case, was to attend a conference.
Here is the list of documents I submitted for my eTA:
Scanned copy of my passport
Photograph with white background
Flight tickets (reservation)
Hotel bookings (reservation)
Invitation letter from the conference
Yellow Fever vaccination certificate (optional)
Job contract (optional)
Reservation means I didn t book the flights and hotels, but rather reserved them. Additionally, optional means that those documents were not mandatory to submit, but I submitted them in the Other Documents section in order to support my application. After submitting the eTA, I had to make a payment of around 35 US Dollars (approximately 3000 Indian Rupees).
It took 40 hours for me to receive an email from Kenya stating that my eTA has been approved, along with an attached PDF, making this one of my smoothest experiences of obtaining travel documents to travel to a country :). An eTA is technically not a visa, but I put the word visa in the title due to familiarity with the term.
You can also see it in:
The rest of my photos from the event will be published next week. That will give me a bit more time to process
them correctly and also give all of you a chance to see these pictures with fresh eyes and stir up new memories from
the event.
It s not often that a company is willing to make 
A new minor release 0.4.23 of 
The Rcpp Core Team is once again pleased to announce a new release
(now at 1.0.13) of the 
I am using 
Do note that it seems OpenWeather will return the name of the closest available
meteorology station with (most?) recent data for my home, I often get Ciudad
Universitaria, but sometimes Coyoac n or even San ngel Inn.
In two weeks DebConf24, the Debian conference starts in Busan, South
Korea. Therefore I've added support for the Korean language into the
web service of FAI:
