Another good day at South by Southwest. I had the night out last night, so I stopped at the Frogdesign Party for a while to see people and have some beers. I left to try to see Douglas Coupland's new movie, Everything's Gone Green. As a speaker I got a "gold" pass, which means I get to go see some of the films in the festival, but by the time I got to the theatre, it was at capacity. Too bad! Over to Club de Ville to see old friend Ben Cerveny, then trying to catch up with Niko, then an early night getting home. This morning I went to see Identity Woman (Kaliya Hamlin) talk about OpenID at the identity panel. It was a good discussion about identity and privacy, and I also got to meet Scott Kveton in person, too. Mike Linksvayer was there too, which was nice; it's great catching up with such a sympatico person. This afternoon I watched the incredibly valuable Everything You Always Wanted to Know About the Mobile Web...but Were Afraid to Ask. Great practical information for people willing to give mobile a try. I came away enthused and ready to make wikitravel.mobi a reality. Best of all was seeing Ben on his panel about virtual identity and avatars. Ben's got a talent for identifying the most intellectually stimulating thread in a conversation and following it with gusto, so it was really cool to see him talk on stage. tags: sxsw07 austin douglas coupland identity woman mobile web ben cerveny

La Traviata We stopped in for dinner at La Traviata, an Italian restaurant on Congress that Maj had heard good things about. The menu was nice but not too friendly to us pescevegetarians; we were excited when we heard that there was a seafood special that night. But the waiter came back to tell us that they weren't available. After we ordered, I heard the waitress behind me saying to her very big table, "...and we have two plates of the mahi-mahi available..." I stopped our waiter when he came by, and he was sheepish. "The chef was keeping those two plates for this big party." Oh. Our food was great -- I had a mushroom fettuccine, Maj had a grilled salmon with greens -- and we forgot about it. But the waiter came out later and said, "I talked about it with the chef and we want to extend our apologies. We should offer the specials to every customer equally. The chef wants to offer you dessert on the house." OK, sounds good. It doesn't take much to make up for a mistake, especially in the restaurant industry. La Traviata had good food, a really nice building, and great service up until then, but going that extra mile to make up for a mistake -- a debatable mistake I probably would have never thought about again -- gained my trust. More restaurants -- no, more businesses -- should have service like that. tags: la traviata austin italian restaurant

Blog review roundup I wanted to quickly shout-out to people who mentioned my talk at SXSW (Talks/SXSW07) in their blogs:

• Mike Linksvayer, SXSW: Commercialization of Wikis.
• Angela Beesley, Commercialization of wikis. I hope she saw that she was thanked at the end!
• Liz Henry, SXSWi panel on commercialization of wikis. The canonical notes, better than my own.
• Adam Darowski, SXSWi: Commercialization of Wikis. Adam's doing some wiki projects himself, and he found the talk helpful. Great!
• Mathieu Ouellet, Commercialization of Wikis. I hadn't seen Mathieu's great travel/tourism blog before, but it's bookmarked now. Great reading.

I'm really glad to see so much positive response to the talk. I worked really hard on it, and the subject is obviously very dear to my heart. It's great when your work pays off and people appreciate it. tags: sxsw07 me talk blogs wiki

Wiki BOF We're having a Wiki BOF lunch tomorrow at the 4th-floor coffee lounge. It should be fun. Thanks for announcing it, Liz! tags: wiki sxsw07 bof flock together

So after a busy week at work and a rather busy day yesterday (with a rehearsal of the ensemble, then me volunteering to do the bar at a musical of one of the other choirs of the same group as the one I'm in, and then finally the DPL debate), I decided not to do anything remotely useful today. Since the weather was nice, I went to the city. As I arrived there, walking around to figure out something interesting to do, I passed by 'De Muze', a well-known Antwerp jazzcaf (which either does not have a website, or has managed to hide it quite well). Since it was about 14:45, and they start live concerts there at 15:00 on sunday, I stayed for a while. After that, I went walking around in the city some more, enjoying the sun, eventually going through the Sint-Annatunnel (known to us Antwerp people as the "Voetgangerstunnel" -- pedestrian's tunnel -- since that's what it is), and stayed on the other bank of the Schelde for about an hour. Went home again, then, and had dinner. I'll probably have a lot of questions to answer on -vote by now, but I just don't care for now. Tomorrow is another day.

After this bugreport from Tuomo Valkonen (upstream of the ion window manager) against the ion3 Debian package and a personal discussion with him by mail, I'm no longer interested in maintaining the ion2, ion3, ion3-mod-ionflux and ion3-scripts packages. Drop me a mail when you're interested in taking over these packages. Update: The ion3 packages have been removed from etch yesterday, and I filed RFAs (#414362, #414363, #414364 and #414378) against the ion2 and ion3 packages.

On Wednesday March 7th, I announced the end of the "blitz" l10n NMU campaign. This campaign started on January 21st after a first campaign during Autumn 2006. The main point was dealing with all pending l10n issues reported against packages, with etch as the main target and French reaching 100% as the secondary target..:-) This has been a great success, thanks to the collaboration of maintainers, translators and release managers. I have no statistics on the number of closed bugs and uploaded packages (shame on me), but at some moments I did up to 8 uploads in the same day. The pending l10n bugs page clearly shows that, except for a few packages for which maintainers have various, good and bad reasons to refuse a NMU and a maintainer upload, the situation is now quite clean. Release constraints now enforce more and more care with uploads, so it's time to suspend the action and move to another jihad (not officially announced yet, I'm preparing the material and announcement).

So, that was the debate. Now I can stop and read the answers properly. It was a bit disappointing that one candidate (gustavo) didn't appear, one was late (sjr) and one withdrew on the day of the debates (svenl). I guess I'll see what explanations are submitted. The debate opened with a fairly gentle question, asking for introductions. Makes sure the process is working, I guess. Generally inoffensive, but Anthony Towns's answer is puzzling: shouldn't he have documented stuff during the last transition if he thought it lacking? If he's re-elected, there won't be a transition, so any documentation would be based on year-old memories... he's giving an argument for electing someone else! The communication question got a variety of responses. Not sure that Wouter Verhelst's aim of better team communications is achievable, but maybe it is - don't know without more communication from people who aren't currently communicating well! Not sure whether Steve McIntyre is arguing for diplomacy and politeness or the truth of the Sapir-Whorf hypothesis, which is more worrying. Releases. Oh! Releases. Aigars Mahinovs's plan to release less often is interesting, but is it realist or defeatist? None of the candidates seem keen to give NM the radical revision that I think it needs - the median time in DAMnation is longer than the median time for the whole of the AM-led review, contrary to what Wouter Verhelst seems to claim later (line 754). About the only reforms suggested are Anthony Towns making permissions more gradual and Steve McIntyre's (IMO scary) social conformance test. Each of the candidates sees a slightly different thing as debian's biggest problem, although some of them overlap. Maybe this is the axis that differentiates the candidates most? Also, a full range of "code of conduct" views seem to be there: from it being a good idea, through leaving it for others to try, to being opposed. Then it was onto the buck-passing round. Another communication question brought some similar responses and this absolute gem from Aigars Mahinovs:-

"A technical solution to a social problem - a cron job that will send the email every two months, 6 text files with a template saying that nothing has been done and I just need to remember to write something good into those files before they are sent."

I like that idea! A few technical questions brought some interesting reminders about work that is actually already underway, but maybe not very visible, then there was a question about other distributions. Predictably, most of the focus fell on Utnubu and other derivatives, with a few mentions of Gentoo too. The targetted questions brought a few amusing replies: at least one candidate seems to say that they won't pursue a past comment if elected, while Anthony Towns seems to see the new FDL and CC licences and GPL'd Java as personal achievements. The cage fight (or open discussion, as it is more usually known) spent most of its time emphasising and clarifying points from earlier. It only seemed to be at the end when it cut new ground, with questions about demographics and $10million. Finally, closing summaries again showed the differences of approaches and views. Then that was that and the participants logged off into the night...

• The debate
• The audience
• The sources

When I first moved to Canberra to work at Asia Online, I was staying at the Waldorf, and working in Braddon, so it was a really nice short skate to work. I think skating around after work in the summer time (with daylight saving) was one of the things that made Canberra really grow on me. I managed to destroy the (fairly cheap) blades in an incident in Commonwealth Park, and then lashed out on a more expensive pair of Bauer skates, which I subsequently hated. The original pair were simple, had a good hard shell, and three ski-strap style buckles, so they provided pretty good ankle support. The Bauers, on the other hand, had to be bought in a women's size because apparently my feet were too small for the men's sizes, were lace up, and had two Velcro straps that went around the top of the laces. I really made a terrible purchasing decision in getting them, because I found I could never get them tight enough around my ankles, and they were too tight around my toes, and were generally quite uncomfortable. Anyway, fast forward something like seven years to today, and I've been meaning to try skating to work to see how long it took. This morning, Sarah felt like some Vegemite, and I've got two bottles at work, and we seem to have run out at home. Sarah proposed that we cycle into work to get one of the bottles, and I thought this would be the perfect time to try out the skates again with no time constraints. So, I pulled them out, got to try out the new safety gear that I think Sarah got me for my birthday 2 years ago, and we headed off down the Stevens Creek trail. Things started out okay (as they always tended to do) but by the time we got to the La Avenida exit from the trail, I was feeling like a quick break to give my feet a breather, and I realised that the back left wheel had pretty much shredded itself. Seems the wheels don't have a fantastic shelf life. So Sarah cycled back home and got the car, and we aborted that adventure. I think rather than persisting with a pair of skates that I totally hate, I'll replace the wheels and give them away to Good Will, and look at getting a new pair that suck less. I think after waiting six or seven years between pairs is long enough get over the few hundred I spent on this pair. We're going to stay in San Francisco next Friday night after a party, so I think I'll go check out this store on Saturday. Hopefully I can make a better purchasing decision this time around.

I was honoured to be on the ETech 07 programme committee. Alas, I can't get there this year due to the very enjoyable reason of recent parenthood. Nevertheless, here are some of the talks I'd earmarked to attend.
Creating Addictive User Experiences (Kathy Sierra)Is it possible to say too many good things about Kathy Sierra? Any project or product built with attention to her advice about empowering users gets a huge head start to popularity and success. I was fortunate enough to spend a day with Kathy last year on a training course, and it was great to see the passion and commitment from her writing runs through her as a person, even behind the scenes.Applied Web Heresies (Avi Bryant)I'd go to this one out of insatiable curiosity. I believe that web conventions enable rapid application design (c.f. REST in Rails) but here's an argument that not following them also reaps rewards. Attend this talk prepared for involvement. I've never met a Squeaker without attitude.
Making Offline Web Applications a Reality (Zimbra)A short product talk, but taking web apps offline is an area to watch. Even if you don't think offline is that important to you, many of the same principles apply to application mobility. Take that key app data off onto your phone, watch or memory stick.Collective Intelligence, Indeterminacy, and the Illusion of Control (Charles Armstrong)More user-facing stuff. How do you give a user of a large nondeterministic piece of social software the idea that they're in control? This is an important topic to me: note how many pieces of social software fall by the wayside right away. For some, it's lack of utility, but that's influenced too by the degree of engagement and control a user feels.
No Program Left Behind: Liberating TV from the Tyranny of the Ephemeral (Tom Loosemore)There is no good reason not to listen to Tom Loosemore. Especially when he feels strongly about something. The idea of this talk is a "vision of a cheap consumer device sitting under your TV that will capture, store, and share all TV, forever." The TV industry sure needs its visionaries.
Patterns: From Fabrics to Fabrication (Dale Dougherty)Dale was responsible for getting my XML career off the ground, and you can find him at work behind some of the smartest things O'Reilly's done over the years. Make magazine was one of those, and now he's moving on to Craft. Design patterns for, er, real designs.RFID Guardian: A Personal Platform for RFID Privacy Management (Melanie Rieback)
Jamming bad RFIDs. Having just taken delivery of an RFID-enabled passport, this is starting to come home to me.Super Ninja Privacy Techniques for Web App Developers (Marc Hedlund)Despite the cute title, lots of good stuff here. Expectnation is going to end up with a truck load of user registrations, and their privacy is important to me. I imagine there'll be some good debate in the Q&A session for this talk.JavaScript: It's Happening All Over Again! (James A. Duncan)I've recently got the JS bug, thanks to JQuery. It's actually a fun and malleable language to work in. I'd go to this talk looking for fellow travellers and hints, though I'm a bit skeptical about Zimki itself.

• ETech 2007 registration
  

The Finnish parliamentary elections are very soon. I kinda like my candidate’s flyer (no, I did not take part in its design): The text reads: Geek to Parliament! Basic rights must be preserved on the Internet and elsewhere. Technology for nature and people. What is the fate of MP3?

It's official! If all goes well, Ilenia and I should be settling in to an appartment in Innsbruck, Austria by April 2nd. She has been hired to work with Andreas Villunger's group, which is a great opportunity for her, and also for me to work on some things that are not yet public... We've got a lot of good friends here in Padova, and not seeing them very regularly will be the hardest part of leaving. However, Innsbruck is only about 4 hours away, and Ilenia managed to find us a place on short notice that has a guest bedroom, so we hope to have lots of visitors!

Last weekend I had great fun during my first cal otada with my Friends in Picamoixons, very near Valls in Tarragona. While it's already a tradition for my friends, this was the first time I went there, after having missed many other opportunities probably due to my overcommitment to triathlon training a few years ago. So on Friday we drove up North to Catalunya, and arrived quite late to Frago's house in the center of the town, where we slept in two packed rooms and the terrace after getting some beers in Dune. Early next morning we met Frago's friends and bought the necessary vegetables and wine for our great lunch, and soon after we were in the middle of some olive field outside Picamoixons, where we prepared a big fire and the cal ots. A cal ot is a special type of onion which grows in the area, which ends up being very long and thin. After cutting part of the green leaves, they are cooked over the flames, which carbonises the first few layers of the onion, but leaves the inner part ready for consumption. After this, you just need to pull from the inner leaves to get rid of the burnt stuff and eat the rest with a delicious and typical sauce for cal ots. So far, so good. What if your group of friends has extended the tradition, allowing for extra fun bits? In our cal otades, after you've peeled the cal ot, you keep the carbonised stuff. It's valuable ammo, which will soon be thrown at others' faces. Trying to remain clean is futile, you soon are covered by sauce and black stuff all over your head and clothes. This was real fun! After eating part of the group went up a mountain to visit an arab tower, which helped me not to get totally drunk before the night. When it got dark, we were all back to our positions around the fire, chatting and listening to varied music, while we waited for the lunar eclipse. The eclipse was impressive, seen from the country side, with absolutely no luminic contamination. My friend Jordi carefully prepared his camera to do a good photograph series of the event, and the results were impressive. When the eclipse was about to be full, it was great to see a miriad of stars appear in the sky, previously hidden by the perfect full moonlight. We were just too lucky that the weather fixed up just on time to have a completely clear sky.

The lunar eclipse, as seen from the Catalan countryside. Pics by Jordi Jover. Many were quite tired by 3 or so, so we started setting up tents and went to sleep by 4. Sunday was a slow day, dedicated to cleaning up our stuff and eating leftovers cooked on a new fire. We were back in Val ncia at 8PM or so and even after showering and cleaning my hair with shampoo, my head still smelled like smoke. Actually, I think it might still smell a tiny bit today. In short, a lovely weekend, which I hope to repeat next year. Too bad the lunar eclipse bit will be missing for quite a few more years. :)

Last weekend I had great fun during my first cal otada with my Friends in Picamoixons, very near Valls in Tarragona. While it's already a tradition for my friends, this was the first time I went there, after having missed many other opportunities probably due to my overcommitment to triathlon training a few years ago. So on Friday we drove up North to Catalunya, and arrived quite late to Frago's house in the center of the town, where we slept in two packed rooms and the terrace after getting some beers in Dune. Early next morning we met Frago's friends and bought the necessary vegetables and wine for our great lunch, and soon after we were in the middle of some olive field outside Picamoixons, where we prepared a big fire and the cal ots. A cal ot is a special type of onion which grows in the area, which ends up being very long and thin. After cutting part of the green leaves, they are cooked over the flames, which carbonises the first few layers of the onion, but leaves the inner part ready for consumption. After this, you just need to pull from the inner leaves to get rid of the burnt stuff and eat the rest with a delicious and typical sauce for cal ots. So far, so good. What if your group of friends has extended the tradition, allowing for extra fun bits? In our cal otades, after you've peeled the cal ot, you keep the carbonised stuff. It's valuable ammo, which will soon be thrown at others' faces. Trying to remain clean is futile, you soon are covered by sauce and black stuff all over your head and clothes. This was real fun! After eating part of the group went up a mountain to visit an arab tower, which helped me not to get totally drunk before the night. When it got dark, we were all back to our positions around the fire, chatting and listening to varied music, while we waited for the lunar eclipse. The eclipse was impressive, seen from the country side, with absolutely no luminic contamination. My friend Jordi carefully prepared his camera to do a good photograph series of the event, and the results were impressive. When the eclipse was about to be full, it was great to see a miriad of stars appear in the sky, previously hidden by the perfect full moonlight. We were just too lucky that the weather fixed up just on time to have a completely clear sky.

The lunar eclipse, as seen from the Catalan countryside. Pics by Jordi Jover. Many were quite tired by 3 or so, so we started setting up tents and went to sleep by 4. Sunday was a slow day, dedicated to cleaning up our stuff and eating leftovers cooked on a new fire. We were back in Val ncia at 8PM or so and even after showering and cleaning my hair with shampoo, my head still smelled like smoke. Actually, I think it might still smell a tiny bit today. In short, a lovely weekend, which I hope to repeat next year. Too bad the lunar eclipse bit will be missing for quite a few more years. :)

One of the many things I'm working on in my copious amounts of spare time is setting up the server that HP donated Linux Australia after I think linux.conf.au 2006. Said server has iLO, which facilitates remote power management and remote console, both things I want to have working on this server before it goes into production. Jon's been madly poking holes in his firewall for me so I could access the iLO stuff. I'm already liking it better than Dell's BMC, because it has things like SSH, although the whole thing hasn't been without some adventures. I fiddled around via the web interface and added an account for myself and an SSH key. Then I tried to SSH in, and promptly got stuff like

buffer_get_ret: trying to get more bytes 4 than in buffer 0
buffer_get_int: buffer error

straight after what looked like a successful connection, and then the SSH connection got terminated. I did a pile of Google searching, and found people had to disable environment variable sending, and agent forwarding to get this to stop happening. Interestingly, I can't find a way to disable SendEnv on a per-host basis with OpenSSH, if it's been set in /etc/ssh/ssh_config, which is kind of annoying. So after solving the problem of gaining SSH access to the iLO, I then battled with the remote console. The host already had a throwaway Linux installation on it, but the remote console kept freaking out about the console being in graphics mode. I figured this was because it was using a frame-buffer. No problem, I just needed to boot with vga=normal. Problem was, GRUB was configured with hiddenmenu so I had 3 seconds to hit Escape before it charged off and booted up. Not that big a deal you'd think, except to get out of the remote console and back to the iLO prompt, you have to hit Escape (, so the iLO eats Escape keys for breakfast. After having a bit of debate with some mainly Red Hat-oriented sysadmins on #sage-au, it turned out that RHEL has a patch so that GRUB accepts any key, not just Escape to present the menu. That was no use to me, as the box wasn't running RHEL. And all I was asking for was if anyone had any iLO experience, no whether or not "any key" was the equivalent of Escape. Sheesh. It turned out that I needed to press Escape twice in that initial 3 seconds, with probably sufficient pause between the two presses for it to register properly, in order for an Escape character to be sent to GRUB. Fun.

Now, this is one cool project (and video) from Alan Carvalho de Assis (and friends), as announced on the LinuxBIOS mailing list: LinuxBIOS with X Server Inside (YouTube video). The setup: LinuxBIOS + a Linux kernel + BusyBox + a tiny X11 server (Kdrive) + the Matchbox window manager + rxvt. All of this in a normal BIOS chip (2 MB), without any hard drive connected (who needs hard drives when you can fit everything in the BIOS just fine)... The thing boots into BusyBox in less than 6 seconds, then in ca. 2 seconds into X11 + rxvt. There's probably even room for improvement there... It seems there will be an OGG Theora version of the video soon, and I hope a small HOWTO about the project, too. More LinuxBIOS-related screenshots and videos are available in the wiki btw., and a bunch more will follow soon...

I recently wrote an article or two about distributed version control systems.

I've been using Darcs since 2005. I switched to Darcs, in fact, 10 days after the simultaneous founding announcements of git and Mercurial.

Overall, I have been happy. I continue to believe that it is the most distributed of the distributed VCSs, which is a Good Thing.

However, I have lately started having trouble with Darcs hanging while working on my Debian packages. My post to the Darcs user list drew out a few other people whith this problem, which is a design flaw of Darcs.

So I revisited the VCS landscape. I re-examined git, Mercurial, and bzr. I eventually decided to give Mercurial a try. I avoided git because I write some code that is portable to Windows, and git isn't (or isn't very well). Also, git is complex to pick up for me, and I certainly don't want to force something complex onto my contributors. bzr seemed to still have some strange behaviors that it's had for awhile, and I couldn't find even one advantage of it over Mercurial. So off I went with Mercurial.

I quickly learned a bit of a philosophical difference from Darcs to Mercurial.

Darcs avoids conflicts at all costs. Mercurial makes handling conflict easy and, in many cases, automatic.

It is exactly this Darcs behavior that permits both is excellent "darcs send" feature (still unmatched in any other VCS), but also causes its hang problems.

I found Mercurial quite pleasant to work with, and *fast*. It seems to be edging out git in speed tests sometimes these days.

It is easy to get started with Mercurial. The mq system -- similar to quilt or other patch-management programs -- is really quite an amazing hybrid between patch management and version control. I frankly don't see any need for other patch-management tools anymore.

Mercurial has a "patchbomb" feature where you can select a range of changesets to send off, and it will generate nice emails with one changeset per email, and send them to your selected destination, optionally with an introductory message. The normal way of interacting with other Mercurial users is via the hg export/import commands, which send around simple unified diffs plus some additional header information, optionally in the git extended diff format.

I am happy with Mercurial and am in the process of converting my Debian repositories from Darcs to Mercurial. I'm going to keep my personal code in Darcs for the moment because "darcs send" is still easier than "hg email", but that may change before long, depending on how my experience goes.

I'd encourage others to give Mercurial a try. The community is also very nice and helpful.

I have contributed patches to Tailor to make it make exact copies of Darcs repos into Mercurial, which are now in its Darcs repo. There is also a thread on the Mercurial list with some of my initial questions/concerns coming from a Darcs perspective.

After asking for useable CA Software, I have finally settled on using EasyRSA. This is what I did to come across the packaging shortcomings of EasyRSA in Debian. Storing your CA Be sure that your CA is stored in a secure place. Don’t store it online, and make it accessible only to yourself. In my opinion, storing the the CA in a cryptoloop container file on a small 32 MB USB stick is a good idea. Cryptloop is rather easy today and available in the stock Linux kernel. I commonly use grml-crypt to manage the crypto loopback stuff:

sudo grml-crypt start /media/usb4/cryptoloop $MOUNTPOINT

Gotcha: don’t confuse sudo’s “password” prompt with grml-crypt’s “Enter LUKS passphrase” prompt, the cryptoloop password won’t bring you anywhere on the sudo prompt. Preparing the CA directory For the CA, create a dedicated directory in the mounted cryptoloop file system. You’re originally supposed to copy the entire EasyRSA directory tree in there, but I’d recommend to only link the files from your system’s EasyRSA directory to automatically take advantage of distribution updates. You’ll need at least these links:

lrwxrwxrwx 1 mh mh   56 Dec 25 23:23 openssl.cnf -> /usr/share/doc/openvpn/examples/easy-rsa/2.0/openssl.cnf
lrwxrwxrwx 1 mh mh   52 Dec 25 23:22 pkitool -> /usr/share/doc/openvpn/examples/easy-rsa/2.0/pkitool
lrwxrwxrwx 1 mh mh   60 Dec 25 23:23 whichopensslcnf -> /usr/share/doc/openvpn/examples/easy-rsa/2.0/whichopensslcnf

ln -s /usr/share/doc/openvpn/examples/easy-rsa/2.0/openssl.cnf .
ln -s /usr/share/doc/openvpn/examples/easy-rsa/2.0/pkitool .
ln -s /usr/share/doc/openvpn/examples/easy-rsa/2.0/whichopensslcnf .

Configuring your CA The only thing you cannot link is the vars file which contains your CA’s local settings:

export EASY_RSA=“$(pwd)”
export OPENSSL=“openssl”
export PKCS11TOOL=“pkcs11-tool”
export GREP=“grep”
export KEY_CONFIG=$($EASY_RSA/whichopensslcnf $EASY_RSA)
export KEY_DIR=“$EASY_RSA/keys”
# Issue rm -rf warning
echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
export KEY_SIZE=1024
export CA_EXPIRE=3650
export KEY_EXPIRE=3650
export KEY_COUNTRY=“DE”
export KEY_PROVINCE=“”
export KEY_CITY=“”
export KEY_ORG=“Zugschlus.de”
export KEY_EMAIL=“mh+easyrsa-mh-openvpn@zugschlus.de”
export PKCS11_MODULE_PATH=“dummy”
export PKCS11_PIN=“dummy”

Comments have been removed from this file. Better copy the file from /usr/share/doc/openvpn/examples/easy-rsa/2.0/vars and edit it to your needs. I added the two PKCS11 variables since you won’t otherwise be able to issue certificate requests. Creating the CA Next, decide on a shell instance where you will do most operations, and source vars in there. Next, run /usr/share/doc/openvpn/examples/easy-rsa/2.0/clean-all. If you do this in a directory of an already-in-use EasyRSA CA, you’ll need to restore your backup. To actually initialize the CA, run pkitool --initca --pass. If you do not give the --pass parameter, you’ll create a CA that can issue certificates without asking for a passphrase, which might not be a brilliant idea. Choose a reasonably secure pass phrase. Creating Certificates - the simple and suboptimal way You can now simply proceed to create an arbitrary number of pairs of “private” keys and associated certificate by simply calling pkitool <clientname> and/or pkitool --server <servername>. Depending on your security policy, you can mandate the private keys to be protected by a passphrase (adding --pass to the command lines), but you’ll have the expense of being asked for the passphrase every time you start a new openvpn daemon. Creating Certificates the Right Way I have put the “private” in quotes since the keys created this way are not really private: The key was created on the box hosting the CA, was stored on the local (crypted) file system and needs to be moved to the target system via a secure channel. Doing so the right way is harder than expected, so it is usually the better way to keep the private key really private by creating it directly on the target system. On the target system, you need OpenVPN installed, and openssl. After the certificate was created, you can remove openssl again. Creating a private key is part of a key-pair generation process that also leaves a certificate request. The contents of the certificate request is public, and you can safely move it to the CA box and convert it to a certificate by signing the request. You only need to make sure that nobody exchanges your target system’s certificate request for her own before you sign it as you might end up certifying a wrong identity. For the rest of this document we’re going to assume that you have ssh access to the target system and have verified the ssh host key, so that you can be reasonably sure to be connected to the right system. To create a certificate request, you can use this script, which I have called create-easyrsa-cert-req:

#!/bin/bash
set -u
TMPDIR=“/tmp”
export OPENSSL=“openssl”
export PKCS11TOOL=“pkcs11-tool”
export GREP=“grep”
export KEY_CONFIG=“/usr/share/doc/openvpn/examples/easy-rsa/2.0/openssl.cnf”
export KEY_DIR=“$TMPDIR/keys.$$”
mkdir -p $KEY_DIR
export KEY_SIZE=1024
export KEY_EXPIRE=3650
export KEY_COUNTRY=“DE”
export KEY_PROVINCE=“”
export KEY_CITY=“”
export KEY_ORG=“Zugschlus”
export KEY_OU=“$(hostname --fqdn)”
export KEY_EMAIL=“mh+$(hostname)-ovpn-cert@zugschlus.de”
export DEBUG=1
umask 077
if [ “$ 1:-foo ” != “server” ]; then
  /usr/share/doc/openvpn/examples/easy-rsa/2.0/pkitool --csr $(hostname)
else
  /usr/share/doc/openvpn/examples/easy-rsa/2.0/pkitool --csr --server $(hostname)
fi
mv $TMPDIR/keys.$$/* .
rm -rf $TMPDIR/keys.$$

When called without parameters, it creates a certificate request for an OpenVPN client certificate, and when you call it with “server” as parameter, it will create a server certificate request. In any case, it will leave two files in the current directory. They are named after the current host name, and have the extensions .csr and .key. The .key file is your private key. keep it private! The .csr file is the certificate request which you can now move to the keys subdirectory of your CA directory via scp or other means such as an USB stick. To do the actual signing, invoke pkitool --sign <hostname> and enter the CA passphrase. You can ignore the error message that there was no .key file to chmod. Gotcha, when signing a server certificate, use pkitool --server --sign <hostname>. Move Certificate to the target host You can now move the certificate to the target system. Since you’re probably going to need the root certificate and the certificate revocation list as well, you can move the .key file (if created on the CA system), the .crt file, and ca.crt to the target system. These files are public, so there is no need for a secure channel. Revoking Certificates Since an OpenVPN server’s only means of authentication is to check whether the certificate presented by a client is signed by the “right” CA, the only way to revoke VPN access is to revoke the certificate. This is also done on the CA system by calling /usr/share/doc/openvpn/examples/easy-rsa/2.0/revoke-full <client-name>. This creates a crl.pem file which contains a list of all revoked certificates. You need to have a mechanism to distribute that list to all systems that might need it, and it is recommended to have this automated. Remember, if you do not distribute the .crl file, the systems are not going to know about revoked certificates.

Web Hosting - A Market for Lemons

This is a really irritating problem for hired webmasters. Too often, my prospective customers go and buy from someone else who has a slicker sales team but does a terrible job. Then what can you do? I'm honest with them about the flaws if they ask, but it'll be months before they have the money to fix their mistake - or sometimes years before they can escape their contract lock-in. Depressingly, this ends with "we find that there really aren't any good solutions to the lemons problem".

RIMU Rules

Tip from a coop ISP about a global hosting provider.

xinit considered harmful

Warning about a bad machine supplier.

Web Hosting Chat - The Number 1 in Web Hosting discussion Forums - powered by vBulletin

Possible information source about web hosting

Project Management Source: Ten Golden Rules

If I tried a little harder, I could probably make a top 10 top 10s.

10 Stupid Mistakes Made by the Newly Self-Employed

I think I've done half of these.

10 Business Lessons From a Snarky Entrepreneur

A more positive list from the same author.

10 Ways to Relaxify Your Workspace

Could I even do Top 10 Steve Pavlina Top 10s?

problog: work from home

Oh OK, here's a different author. Are all of these positives, though?

Little Known Ways to Brand on the Cheap: 99 Tips for Poor Web Startups

I keep returning to this list. Lots of good ideas.

Digit news - Most B-to-B Web sites fail

and we need those good ideas, as the statistics are horrible.

A Cambridge Co-operator: Fairtrade Fortnight

This is nearly over. Rush to your local co-op, co-operative food, co-op scottish or Welcome to get a big discount now.

Co-operatives' merger to create group to rival Sainsbury's Guardian Unlimited Business

Soon we'll be bigger than Sainsbury's.

Co-operative Bank February 07 eNews

Where some of the profits from the co-op group goes...

A Cambridge Co-operator: Phone Co-op Annual Results

A different co-op which I'm also in.

VoIP for Business 2007 - Welcome to the essential business communications experience!

Interesting, but I still can't get my office VoIP phone to work reliably...

Are .com and .net domains best? @ Problogger

The masses say .com, but my three .uk domains are going fine for my target audience. I wonder about .coop and .eu, but there's not much incentive yet.

Margaret Hodge announces Companies Act Implementation timetable Small Business Service

Argh a confusing consultation. Is it worth replying?

There are days like this where you get inspiration. Since about January (strange that one cannot never remember the beginning of such annoyances), neither suspend-to-ram nor suspend-to-disk were working anymore on my Dell latitude X1. Suspend to RAM indeed stopped working back in August 2006 for an unknown reason. The laptop indeed goes into sleep mode but, when waking up, the video card is not restored properly. A quite common problem, unfortunately. Why it suddenly stopped working is hard to explainn but as my laptop runs unstable and, usually, the latest Debian kernel, there may be an explanation somewhere betwwen kernel stuff and Xorg stuff. Since then, I had suspend to disk working pretty well until it suddenly stopped working back in January. The system was printing "Snapshotting system" on the screen and that's all. So, since then, I keep my laptop ON all the time, which is pretty bad when travelling (and I travel a lot all day long as I use public transportation with 3 connections morning and evening). Moreover, I cannot even completely close it because some moron at Dell has decided to hardcode in the BIOS that the laptop should enter suspend to RAM when the LID is closed. So, closing the laptop means....no more screen when opening it up. As a consequence, during last weeks, I had my laptop hald-closed in my bag with some random device inserted between the screen and the keyboard to prevent it to be entirely closed. Absolutely stupid. However, this morning, the Holy Grace touched me. I finally remembered that, for last New Year's Eve week-end, I did setup the Conexant HSF modem drivers on the laptop because I was staying at my mom's place with nothing but a phone line to get my mail. And, definitely, this was the explanation. As soon as I unload the Conexant driver before going to suspend to disk mode, the suspend to disk magically works again. Dammit. Once again a proof that Thou Shalt Never Use Non-Free Drivers. I'm now again a happy suspend to disk user. If someone, some day, can bring me back a working suspend to RAM, I'll hug kiss her him to death.

I originally was quite reluctant to post on Planet Debian about the DPL race, but hey, this is the campaigning period, anyway. My choice not to go into too much detail about what I'll do about Debian seems to spark some confusion. I initially thought of adding a rather verbose explanation for that to my platform; but as the initial version of my platform got quite long and convoluted, it got cut. Perhaps that wasn't a very good idea, so here goes: One observation I've made over the years is that DPL candidates often come up with all sorts of grandiose plans about what should be done to improve Debian. These plans are usually the result of some observation they've made, and consequently some thinking they've put in so as to come up with what they think is the most reasonable solution to the problem at hand. The only problem with this approach is that, if you're not involved in whatever you have ideas on, you'll probably end up suggesting things which the people that are involved do not think is a good idea to do. Which would consequently mean that you'll either have to do it all by yourself (since you can't force DDs to do something against their will, and we have a constitution to back that up), or that they convince you that it's not a good idea, and you end up not doing whatever you promised to do during your campaign anyway. First, this is silly. If you don't know whether you can or will keep a promise, you should not make it. But apart from that, it's also a problem; if you get elected mainly because you promise to do one thing and then don't end up doing it, or do something else instead, then you've got yourself a very good reason not to be liked in the community. Which isn't something a DPL should aim for, I believe. So rather than coming up with a detailed plan of all the things I'd do once elected, I decided to come up with a detailed plan of all the things that need work. The exact stuff that gets done about them would then be decided after having a chat (on IRC or otherwise) with the people involved, directly or otherwise, and after considering what other people's opinion on the matter is, if I know said opinion. Does that give me a carte blanche, as Julien suggests? Well, yes and no. Yes, because every Debian Developer who runs for DPL is essentially asking for a carte blanche; after all, the DPL has the ability to speak for the developer body, unless overruled by GR. No, because I don't think doing whatever I want and everyone else be damned is an even remote sign of maturity, and because I promised not to seek the controversy in making decisions (while not avoiding it at all cost either).