Search Results: "cas"

12 January 2007

Ian Murdock: Babies, bath water and open platforms

Steve Jobs: “You don t want your phone to be an open platform.” More Steve Jobs: “These are devices that need to work, and you can t do that if you load any software on them. That doesn t mean there s not going to be software to buy that you can load on them coming from us. It doesn t mean we have to write it all, but it means it has to be more of a controlled environment.” It’s widely understood that Microsoft beat Apple in the PC game because Apple was a tightly integrated, closed platform, whereas Microsoft was an open ecosystem where anyone could play (albeit at their own peril). Clearly, the strategy has not adapted well to digital media players. Why? Because people are tired of products that don’t work. Anyone who has ever had to glue a PC back together for a family member knows what I mean. Does “open” have to mean “poorly integrated” though? Clearly, I don’t think so, given how much I’ve invested in Linux over the years and how much I’m investing in the LSB now. And the job the distributions do in the Linux world is nothing short of amazing, if you think about it—taking thousands of moving parts written by thousands of different people and crafting them into what appears, for the most part, to be an orchestrated whole. Personal experience bears this out too—it’s not that the entire Windows Media ecosystem produces bad products (iTunes pales in comparison to Rhapsody), it’s that the integration points are extremely fragile (e.g., I tried Rhapsody To Go with a Plays For Sure device, which was an awful experience). In other words, just like a chain, an open ecosystem is only as strong as its weakest link, because it’s the links where things break. Sure, there are bad products. I’ve owned no less than two MP3 players in the last few years, and they were pretty terrible. It’s the very, very simple things too. For example, I listen to a lot of podcasts. There’s (gasp!) a Podcasts menu on the iPod, whereas on every other device I’ve owned, podcasts are interspersed with the music, making them difficult to find and, adding insult to injury, mixing gobbledygook into my otherwise well organized collection. Furthermore (gasp!), the iPod keeps track of which podcasts I listen to, and in concert with iTunes, automatically deletes the ones I’m done with. Them’s lasers! Ah, iTunes. Despite the fact that anyone in the world can write a podcatcher (it’s just RSS with enclosures, fer godsakes), the only one I’ve ever used that works worth a damn is iTunes. Everything else is just “integrated” with bailing wire—create a Windows Media playlist, drop it in this directory, etc. The situation on Linux is a bit better, but guess what—Rhythmbox, Banshee, etc. didn’t work with either of the open media players I owned, even though the integration point for one of them was the file system. No, the players on Linux support the iPod best because that’s what everyone has, and if I’m going to pay extra for the iPod, aren’t I primarily buying the integrated experience? (On a related note, I’ve never understood why people pay top dollar for Macs and install Linux on them. But I digress..) Once you taste the fruit of the integrated experience, it’s easy to get sucked in all the way. I eventually tired of all the wasted time and money trying to use an open media player and broke down and bought an iPod. Not too long after, I canceled my Rhapsody subscription. Why? Because I couldn’t use it with my iPod. My overall music experience is diminished (I’m a big believer in the celestial jukebox), but I want one music platform, not two. And the iPod is the one with critical mass. Anything else is swimming upstream. Are open platforms doomed then? I think that’s, as they say, throwing the baby out with the bath water. The key is to have open interfaces, and the key to having open interfaces that work is cooperation between the vendors that implement them. Perhaps surprisingly, the iPod is a good example of how it can be done. The biggest reason for my iPod purchase: I can hook it directly into my car stereo instead of using an FM transmitter. Apple isn’t getting into the car business—it’s decided to cooperate with other companies to make this work. And you don’t hear too much about people calling their technophile relatives to come glue their cars back together. (And talk about the importance of not crashing..) The lesson here, it seems to me, is that an ecosystem is never the sum of its parts—it’s either a whole lot more or a whole lot less. Furthermore, it’s the responsibility of the vendors (and community) that make up that ecosystem to ensure the result comes up on the right side of the equation in the final analysis.

Martin-Éric Racine: Copywrong: Media Moguls versus Artists

One recurrent theme in discussions about Copyrights and Digital Rights Management is that the Media Industry allegedly represents the interests of the Artists. Yet, recent actions in Canada and elsewhere prove that Artists who benefited from the wider exposure of their creations via the Internet in fact oppose laws that would preserve and further entrench the monopoly of the Industry. Finland's case is no different: as reported by Jaakko Kuivalainen in the Tekij noikeuslaki blog [in Finnish], a number of Finnish Artist Coalitions are currently opposing the transfer of copyright issues from the Ministry of Education (who also handles cultural affairs) to the Ministry of Commerce, because they fear that the interests of the Media Industry would suddenly have precedence over those of the Artists and small Independent Cultural Producers. Yet another proof that, no, Media Moguls do not speak on behalf of the Artists.

11 January 2007

Russell Coker: ps and security

A post by Scott James Remnant describes how to hide command-line options from PS output. It's handy to know that but that post made one significant implication that I strongly disagree with. It said about command-line parameters "perhaps they contain sensitive information". If the parameters contain sensitive information then merely hiding them after the fact is not what you want to do as it exposes a race condition!

One option is for the process to receive it's sensitive data via a pipe (either piped from another process or from a named pipe that has restrictive permissions). Another option is to use SE Linux to control which processes may see the command-line options for the program in question.

In any case removing the data shortly after hostile parties have had a chance to see it is not the solution.

Apart from that it's a great post by Scott.

David Moreno Garza: Fatherland! Socialism or death, I swear it!

From The New York Times:

CARACAS, Venezuela, Jan. 10 President Hugo Ch vez was sworn in to a new six-year term at a ceremony here on Wednesday in which he described Jesus as “the greatest socialist in history” and pledged to speed Venezuela s metamorphosis into a Socialist country. “Fatherland! Socialism or death, I swear it!” Mr. Ch vez yelled as he was sworn in and given the presidential sash and a golden key to the tomb where the remains of Sim n Bol var, the South American liberator, are interred.

/me cheers :)

Manoj Srivastava: Mail Filtering with CRM114: Part 2

Or, Cleanliness is next to godliness The last time when I blogged about Spam fighting Mail Filtering With CRM114 Part 1, I left y'all with visions of non-converging learning, various ingenious ways of working around a unclean corpus, and perhaps a sinking feeling that this whole thing was more fragile than it ought to be. During this eriod of flailing around, trying to get mailtrainer to learn the full corpus correctly, I upgraded to an unpackaged version of crm114. Thanks to the excellent packaging effort by the maintianers, this was dead easy: get the debian sources using apt-get source crm114, download tghe new tarball from crm114 upstream, cp the debian dir over, and just edit the changelog file to reflect the new version. I am currently running my own, statically linked 20061103-Blame Dalkey.src-1. Cleaning the corpus made a major difference to the quality of discrimination. As mentioned earlier, I examined every mail that was initially incorrectly classified during learning. Now, there are two ways this can happen: That the piece of mail was correctly placed in the corpus, but had a feature that was different from those learned before; or that it was wrongly classified by me. When I started the chances were almost equally likely; I have now hopefully eliminated most of the misclassifications. When mailtrainer goes into cycles, retraining on a couple of emails round after round, you almost certainly are trying to train in conflicting ways. Cyclic retraining is almost always a human's error in classification. Some of the errors discovered were not just misclassifications: some where things that were inappropriate mail, but not Spam; for instance there was the whole conversation where someone one subscribed debian-devel to another mailing list, there was the challenge, the subscription notice, the un-subscription, challenge, and notice -- all of which were inappropriate, and interrupted the flow, and contributed to the noise -- but were not really Spam. I had, in a fit of pique, labelled them as Spam; but they were really like any other mailing list subscription conversations, which I certainly want to see for my subscriptions. crm114 did register the conversations as Spam and non-Spam, as requested, but that increased the similarity between Spam and non-Spam features -- and probably decreased the accuracy. I've since decided to train only on Spam, not on inappropriate mails; and let Gnus keep inappropriate mails from my eyes. I've also waffled over time about whether or not to treat newsletters from Dr. Dobbs Journal or USENIX as Spam or not -- now my rule of thumb is that since I signed up for them at some point, they are not Spam -- though I don't feel guilty about letting mailagent squirrel them away mostly out of sight. A few tips about using mailtrainer:

10 January 2007

Erich Schubert: Linux distributions to be illegal in Germany?

The biggest party in Bavaria and part of the current german government, CSU, has announced that they want to make the "production and distribution of killer-games" illegal in germany. They claim it's because of a recent highschool shooting (no fatalities except the shooter; there was one other highschool shooting in germany a few years ago with 16 fatalities. Yes, that is 17 fatalities in over 40 years, the 42 years old amok runner back then didn't play killer games, I guess, although he used a flame thrower...). This would make the production and distribution in Germany unlawful, since we include games such as overkill, tremulous and openarena. Other distributions such as SuSE probably include some games that classify as "killer games" as well. Also note that "distribution" is a rather wide term. Does it apply to web sites? ISPs? If there is an online killer game, is the ISP "distributing" it? Polticians (especially those from CSU/CDU/SPD) are such a bunch of idiots. Please do NOT ever again vote for CSU. Software patents, killer games, "Problemfrauen & Schadbären", surveillance cameras and other surveillance, military inside germany (note that in desaster cases such as the flooding some years ago we could already deploy soldats without extra laws), shooting down of civilian airplanes, transrapid, reducing math and natural sciences in highschools, "google earth threatens worldcup security", police installing trojans on home PCs (because criminals don't install virus scanners?), kicking "irritating" students out of school, study fees, ... Often they make George W. Bush look like a genius, don't they? They don't do any important stuff, but just say whatever a majority people might want to hear. They waste our money (Transrapid). They destroy our biggest resource (changes in school system and university system, which will reduce average knowledge in germany a lot). They do lots of stupid things, which heavily invade privacy or public safety (military, surveillance) with no benefits in safety and many of which even where only stopped because they violated our constitution. Do not vote for them! [Updates: Daniel, sorry for posting a non-english post to planet. I again put it into the wrong category; I intended to do a longer post (this one) in english later on. For clarification: CSU is the sister party of CDU, these parties have an arrangement not to compete by region and are closely affiliated. On the nation-wide level they have a joint list, which often is called CDUCSU. So they're not just an "affiliate", but a strong part of the ruling party. Holger Levsen pointed out we are likely going to violate some laws much earlier by distributing ("hacker-") tools such as nmap, ettercap or whireshark.]

Sven Mueller: etbe: some random Linux tips

Russel Coker wrote in etbe: some random Linux tips: Prefixing a bash command with ‘ ‘ will prevent a ! operator from running it. For example if you had just entered the command ” ls -al /” then “!l” would not repeat it but would instead match the preceeding command that started with a ‘l’. On SLES-10 a preceeding space also makes the command not appear in the history while on Debian/etch it does (both run Bash 3.1). It’s pretty easy to get the Bash shell to ignore lines starting with a space in its history: Just add
export HISTCONTROL=ignorespace
to your ~/.bashrc. Alternatively, ignoredups ignores duplicates and ignoreboth ignores both. It’s also possible to tell Bash to ignore lines which match a specific pattern. For example,
export HISTIGNORE=" *:~/*"
will ignore any command starting with a space (emulation the ignorespace option to HISTCONTROL) or starting with ~/ (any program/script in or below your directory). Personally, I just use “HISTCONTROL=ignoreboth“.

Miriam Ruiz: A cute toy

One of the most typical religious traditions in Spain, within the Xmas celebrations, is the Kings’ day (”D a de Reyes”), which is celebrated every year on the 6th of January remembering the arrival of the three Kings to bring their presents to baby Jesus. It is quite typical to have presents that day, and one of the things I got this year was an external 2.5′’ HD case with multimedia playing capacity. I also got a 120 Gb 2.5′’ HD for it. The strongest point I had for it was that my brother already has one and it seems to support many file formats and codecs without problem. In my very short experience with it, just a few days for the moment, it has been able to reproduce all the films I have tried. The main drawback is that it only supports VFAT/FAT32 and NTFS partitions, and only 2 different partitions, no more. Thus, I had to cope with NTFS if I wanted to use the whole HD. I created one VFAT partition as big as supported by that filesystem (32 Gb, with a file limit of 4 Gb) just in case I need it when I go to some friends’ house, and another NTFS partition for the rest of the disk. The next point was to be able to read and write to it from my Debian-powered computer. Reading NTFS is no problem at all, as it seems to be built-in in the kernel by default, but for being able to write on it, I had to use ntfs-3g. It seems to work perfect for me, on an Intel-compatible 32bit computer.

Gustavo Franco: What you did for Debian in the past year?

Dear lazyweb,
Looking back, what a insane year, but not due to the Debian related stuff that was fun to do, to say the least. Anyway, i hope to write similar stuff in the next year but with a even more exciting content. Thanks for those that helped me and those who did something for Debian in the past year. See you!

9 January 2007

Erich Schubert: SVN $Date$ to ISO 8601 in XSLT

I'm keeping my homepage in a SVN repository; I'm using the $Date$ variable to automatically track the last modification date (though it will also change on minor modifications). For the HTML "Date" meta tag, the W3C recommends using ISO8601 date format. This is the (non-XSLT-2, so no regexp) hack I use for conversion:
<xsl:value-of select="concat(substring($string,8,4),'-',substring($string,13,2),'-',substring($string,16,2),'T',substring($string,19,8),substring($string,28,5))" />
Did I mention I hate XSLT? It's lacking so many standard functions, like date-time processing, regular expressions, exceptions, ... - granted, a lot of stuff was added for XSLT2, but it still sucks badly. Especially the syntax. Here's how to format the date according to RFC 2616, as used in the last-modified meta tag and HTTP/NNTP/SMTP headers:
<xsl:variable name="day" select="concat(substring($string,8,4),'-',substring($string,13,2),'-',substring($string,16,2))" />
<xsl:variable name="time" select="substring($string,19,8)" />
<xsl:variable name="timezone" select="substring($string,28,5)" />
<xsl:value-of select="date:day-abbreviation($day)" />
<xsl:text>, </xsl:text>
<xsl:value-of select="date:day-in-month($day)" />
<xsl:text> </xsl:text>
<xsl:value-of select="date:month-abbreviation($day)" />
<xsl:text> </xsl:text>
<xsl:value-of select="date:year($day)" />
<xsl:text> </xsl:text>
<xsl:value-of select="date:time($time)" />
<xsl:text> </xsl:text>
<xsl:value-of select="$timezone" />
Note that this does not include any error handling and is not very robust. You also need an XSLT processor with some of the ">">">http://exslt.org/dates-and-times extensions such as xsltproc. (Which unfortunately doesn't do XSLT2 yet and doesn't have a regexp extension). [Update: Joel Wreed pointed me to his libxslt plugins, a regexp and a exsl.org/dates-and-times plugin. These would help a lot, though IIRC the date-parse exsl.org spec doesn't support the date format I'd need. (So I can't just say date-format(date-parse(...),...)). Also he said that they basically are unmaintained right now. It would be nice if they could be merged into libxslt, though...]

David Pashley: Reason 82973 why MySQL is a toy

MySQL cleverly maps
CREATE INDEX foo_bar ON Foo(Bar);
to
LOCK TABLE Foo WRITE;
CREATE TEMPORARY TABLE A-Foo ( .... INDEX foo_bar (Bar));
INSERT INTO A-Foo SELECT * FROM Foo;
ALTER TABLE Foo RENAME TO B-Foo;
ALTER TABLE A-Foo RENAME TO Foo;
DROP TABLE B-Foo;
If you have a very large table, expect this operation to take a) a lot of disk space, b) a very very long time and c) block any writes to the table in the process. I don't recommend adding indexes or altering any very large tables that are in production on MySQL, because you won't be in production for quite some time. Update: Tom Haddon asked me if this applied to recent versions of MySQL or to PostgreSQL. Looking at the docs, it appears to still apply to 5.1:
  • http://dev.mysql.com/doc/refman/5.1/en/create-index.html
  • http://dev.mysql.com/doc/refman/5.1/en/alter-table.html
    In some cases, no temporary table is necessary:
    • If you use ALTER TABLE tbl_name RENAME TO new_tbl_name without any other options, MySQL simply renames any files that correspond to the table tbl_name. (You can also use the RENAME TABLE statement to rename tables. See Section 13.1.16, RENAME TABLE Syntax .)
    • ALTER TABLE ... ADD PARTITION creates no temporary table except for MySQL Cluster. ADD or DROP operations for RANGE or LIST partitions are immediate operations or nearly so. ADD or COALESCE operations for HASH or KEY partitions copy data between changed partitions; unless LINEAR HASH/KEY was used, this is much the same as creating a new table (although the operation is done partition by partition). REORGANIZE operations copy only changed partitions and do not touch unchanged ones.
    If other cases, MySQL creates a temporary table, even if the data wouldn't strictly need to be copied (such as when you change the name of a column).
  • http://dev.mysql.com/doc/refman/5.1/en/alter-table-problems.html
As far as PostgreSQL is concerned, it doesn't mention anything about doing the same thing, but does mention that it does a full sequential scan of the table. During this time writes are blocked. You can use the CONCURRENTLY keyword to allow writes to happen, but it does two scans and will take longer, but you can still use your database. http://www.postgresql.org/docs/8.2/interactive/sql-createindex.html

7 January 2007

Wouter Verhelst: Credit card online security

Martin Krafft blogs about the "security" in credit card numbers, where you can theoretically pay anything with just a number and a name, which can be just read off of any credit card. Since fairly recently, this is no longer true. As I discovered last week (when I wanted to renew my grep.be license), banks now have the ability to require that a user is redirected to their site in order to confirm a payment. In my case, this requires me to sign the payment with my digipass. This obviously requires me to have an account for their online banking system, but I don't think it is unreasonable to require an online banking account if you want to be able to do payments online. This is both good and bad. Good, because it increases security tremendously. Bad, because I'd lost my digipass again, so I couldn't go ahead with the payment :/ (I have gotten a new one from the bank in the mean time, and just renewed the domain).

Evan Prodromou: 16 Niv se CCXV

Amita June is reaching a point in her life where it's time for us to start weaning her from breastfeeding. Most parents do this much earlier, if they breastfeed at all, but we've been devotees of attachment parenting for a while, and we wanted to give her as much time nursing as possible. But at 15 months, she's ready to start doing things like sleep through the night on her own, drink only cow's milk, and be a little more independent. So, this month we're starting to do some night weaning. What does this mean? First of all, Maj is no longer nursing the baby to bed. She now is doing the main pre-sleep prep work (a bath), does a short nursing period, and then hands the baby off to me for some reading, songs, and walking down to sleep. This will gradually move into fewer, shorter nursings before sleep, and ultimately to none. Once that connection has been broken, I think the main point of nursing will be occasional comfort nursing during the day. Gradually, that will fade out. And then there will be none. It's kind of exciting to be the Primary Sleep Guy for the baby. We're re-connecting in a way that we haven't in a while -- I was only putting her to bed occasionally for a quite a while. It's also been pretty successful so far, which has been good. tags:

Souper Bruncher When Maj and I first moved to Montreal, we had help from some friends who we'd known from before. After we moved into our apartment, we invited them all over for dinner to say thanks. In order to get to know people in our new hometown, we also asked each person to bring someone we didn't know, so we could make new friends. The event was so successful, and we met so many new people, that we made it a regular occasion. For almost three years, every Tuesday night we invited friends over to our home for dinner (or souper in Quebecois French), with an open invitation to meet new friends and interesting people. It was a great way to meet interesting folks in Montreal, and most of our best friends here we met through these dinners. We were even profiled in Elle Quebec as a model for how to make new friends. But when the baby was born, we just couldn't manage to organize dinners any more every week. Cooking for 20+ people isn't that expensive, especially since we're pescevegetarians and that kind of food just isn't that costly. But it does take a lot of time and energy, and with a newborn baby we just didn't have either. Now, with Amita a little more than a year old, we're trying to start up our regular home parties on a more manageable scale. We're doing brunch at our house on Sunday afternoons around 3PM, with a much smaller list of invitees, requests for RSVPs, and a clear indication that the event only goes until bedtime. (Our Tuesday night dinners would occasionally stretch until dawn.) It seems to be working pretty well; we've had a lot of fun at the last couple of brunches we've had. And brunch is a much more laid-back meal than a dinner party, anyways. (Although John Usher asks incredulously, "By what stretch of the imagination is 3PM between breakfast and lunch?") I'm looking forward to our next brunch (tomorrow) a lot, and I hope to get many more friends over to our home in the next few months of Sundays. tags:

6 January 2007

Martin F. Krafft: Adam's Apples

I've been away from Zurich for a while, and one of the things I missed the most was my favourite cinema. So last night, I didn't need my arm twisted much (by Hanspeter) to go and see the Danish film Adam's Apples (warning: Flash content). Imagine a church community made up of four people: Ivan, the reverend, who lives Jesus' philosophy to offer the other cheek when slapped on one. Ivan is father to Christoffer, a spastic-retard, and widow to his late wife, who killed herself not being able to handle the retardation of their child. Ivan, of course, denies all this and treats Christoffer like a regular, jovial and energetic child, and lulls over the loss of his wife in an accident. If someone get too close to Ivan, he'll bleed from his ear. Ivan is played by Mads Mikkelsen, who also plays Le Chiffre in the latest Bond movie "Casino Royale" (which I'll cover in another post). Then there's Sarah, a dosser who got off with a man she didn't know or love and now expects a child. Because of her drinking problem, the child is said to have a 40% chance of being disabled. She cannot handle it and runs to Ivan for advice. Khalid is a Saudi who's on parole at the church after plenty of armed robberies of Statoil stations as part of his mission to destroy the Statoil empire. He speaks broken Danish (wonderfully translated in the subtitles), seems extreme at most of his actions, but all he really wants it is to return to Saudi Arabia. He's been at the church way longer than his parole, saving money but also just enjoying the innocence. Gunnar is a massively obese ex-tennis player who turned to overeating and alcohol after a ball of his was wrongfully judged to be out, causing him to lose an important game. He's at the church on parole for small-scale thievery and plays a role somewhat reminiscent of Lenny in "Of Mice and Men:" stupid but kind. He is also way beyond the end of his parole. There's also a doctor who seems to be the only one with a firm grasp of reality, but his sarcasm overshadows that completely. One day, Adam arrives. Adam's a misanthropic neo-nazi on parole, sent to the church to be cured. Adam calls himself evil and seems to be just that: he cannot deal with niceness, especially not the straioght-up, disarming kind displayed by Ivan in fact, he's the kind of guy who'd slap the other cheek even if not offered. Adam's task is to care for the apple tree (which is everyone's pride) and bake a cake from the harvest. As the story develops, Adam's fight against Ivan's benevolence reaches hilarious heights as the characters seem to exchange exactly those sentences that the other didn't want to hear. When later a group of neo-nazis join the battle, as well as what would have to be called God, everyone (characters and movie-goers) are left wondering who's after whom, and sundry other questions on morale. The film was once again a great display of Scandinavian cinematography, which I've grown to like a lot over the years of being a regular at this cinema. Despite the somewhat flat story and the surreal element of God in one scene (and only one), I can hartily recommend it. The actors are doing an amazing job, and in the end, the movie is primarily funny, not because of jokes or forced humour, but because of the dryness and darkness of what's happening between what seems to be average people like you and me on the screen. NP: The Flower Kings / Paradox Hotel

Martin F. Krafft: Credit card verification codes

There once was a credit card number tied to a name and when it was abused, the credit card company decided to tie it to an expiration date. It didn't take long until gifted hackers found out that twelve months and an average life cycle length of two years required them to check each credit card number against the 24 possible expiration date month-year pairs, so the credit card companies also required the billing address to match (at least fuzzily). Unfortunately, many of the companies accepting and storing credit card data are run by clueless people and the data sets of names, numbers, expiration dates, and billing addresses leaked, causing even more organised abuse. The credit card companies did not like that and proceeded to invest tiny amounts of additional energy and manpower into improving the status quo. So then, one day, in the dungeons of the credit card company offices, a bright young graduate from one of the American elite colleges yelled "heureka" [*] and outlined how to secure credit cards with the "credit card verification code" (CVC), printed on the back of each card printed, not stamped like the number. Maybe his/her theory was that the stamped number could be read from both sides, so a printed CVC would only be readable from one side of the card, bringing instantaneous 200% security increase. Maybe it was some other theory. In any case, the companies readily adopted the CVC and by today, every web form will ask you to also enter the CVC. They'll probably store and leak it too. What's next? Credit card colour?
[*]"Heureka" is Greek for "this bath is too hot" [Dr. Who].
NP: OSI / Free Update: Andrew Pollock points me to the Wikipedia article on CVC as good reading. Indeed, the article explains security benefits in face-to-face transactions and in the socalled "card not present" situations, like ordering over the Internet. Apparently the CVC must not be stored, so in some ways they have learnt from the past. I know of at least one merchant in the US who stores the CVC in my profile though. Update: Mark Brown adds: "The CVC is being used because it defeats attacks like taking a photo of a card with a mobile phone: it makes it usefully harder (not impossible) for people to transparently clone cards." This squares with the Wikipedia article.

Russell Coker: document storage

I have been asked for advice about long-term storage of documents. I decided to blog about it because my thoughts may be useful to others, and because if I get something wrong then surely people will correct me. ;)

Many organizations are looking at using computers for storing all documents. This gives savings on the costs of storing paper - the promise of the paperless office is being fulfilled. There are some potential issues about whether a signature in a PDF file that's scanned from paper is valid - but I guess it's the same as a signature on a FAX and everyone seems to accept FAXed contracts.

The technical problem is how to reliably store data long-term. The problem is that all modern methods of storing data will degrade over time. Anything less than engraving a message in stone, gold, or platinum and burying it will have some data loss eventually.

If the documents that need to be archived have no special requirements and if you have a good backup system in place (testing backup media, off-site storage in case of disaster, multiple sets of hardware that can read the backup media in case of hardware failure, etc) then you might be able to just store the documents on a server and include them in the backup plan. The regular backups should cater for replacing media over the long term. If however there is a significant amount of data or the data has confidentiality requirements that preclude having it all online all the time then you need a separate infrastructure for such storage.

Regular backup systems have to deal with files being deleted from storage and files that have their contents changed. For a document archiving system no file will ever be changed once it has been created and no file will be deleted. This allows some simplifications to the backup strategy. For example if you have multiple terabytes of documents backed up by tape and stored off-site you could use CD-ROMs or other media for storing recent changes. It would be very easy for an employee to grab a couple of CDs before rushing out of a burning building, but grabbing a set of tapes (or the correct tape from a large set) may not be possible.

It would be possible to use a tape library system as the primary storage for documents. If a large organization was going to implement this a few years ago that might be a good option. Nowadays storage is getting increasingly large and cheap. Terabytes are available in desktop PCs and hundreds of terabytes are available for server storage. So having the primary document store on a server with a decent amount of space and then making tape backups for storage in secure locations seems viable.

One thing to note about such document storage is that having everything on a server allows a much larger amount of data to be accessed and copied more easily than on paper. Sorting through a billion paper documents and copying the thousand most useful ones would be a difficult task for someone who was involved in industrial espionage. Finding the most useful files when they are indexed on a server should be quite easy and copying a few thousand is also easy (one thousand scanned documents of medium size should fit on a USB memory stick - much smaller than a few reams of copied documents).

Finally documents have to be archived in publicly documented file formats that can be easily read in the future. The PDF specification is well known and there are multiple programs that can display data in such files, another good option for scanned documents is JPEG. Proprietary formats such as MS-Word should never be used, you never know whether you will be able to read them in four years, let alone the seven years for which many documents must be retained or the 20-30 years that some documents must be retained.

Eduard Bloch: Just orphan by force

Yes Mark, your rant expresses well what I think. And also what I have said before but apparently not many people do care. I still think that we need a strong DPL or a special delegate with powers of orphaning packages by force, since sometimes getting a new maintainer is a step ahead no matter how much experience the new maintainer needs to have. Skills can be learned. But skills in the hands of an inactive maintainer is simply dead potential. Doing something somehow is sometimes better than not doing anything. A such hypothetical delegate would need to have the right nose to detect such cases and orphan such packages. No matter how important this package is - bugs are bugs are bugs and they need to be fixed in a timely manner, ie. without unacceptable/long delays, no matter which RL problems of the particular maintainer do hinder him/her.

Bernhard R. Link: clean vs. crowded bug pages

Marc Brockschmidt wrote the BTS is too crowded and Joey Hess objected that a too clean BTS can also be a bad sign.

I think both is true or to say better none of the ways makes sense without the other:

Bug reports are in my eyes one of the most valueable resources we have. Noone can test everything even in almost trivial packages. To archive quality we need the users input and a badly worded bug report is still better than no bug report at all. Our BTS is a very successfull tool in that as it lowers the barrier to report issues. No hassles to create (and wait for completion of) an account, no regrets by getting funny unparseable mails about some developer changing their e-mail addresses (did I already say I hate bugzilla?).

As those reports are valueable information, one should keep them as long as they can be usefull. Looking at the description of the wontfix tag shows that even a request that cannot be or should not be fixed in the current context is considered valueable. Most programs and designs change, and having a place to document workarounds and keep in memory what open problems exist.

On the other hand a crowded bug list is like a fridge you only put food into. Over time it will start to degrade into the most displeasing form of a compost heap. The same holds for bug reports:

Most bugs are easier when they are young: You most propably have the same version as the submitter somewhere, know what changed recently and when you can reproduce it you get some hints on what is happening and get add it. If you cannot reproduce it, the submitter might still be reachable for more information.

When the report is old, things get harder. Is the bug still present? Was it fixed in between by some upstream release? Is the submitter still reachable and does still remember what happened?

When I care enough of a problem to write a bug report and trying to supply a patch for it, I try to always take a look at the bug list and look for some other low hanging fruits to pick and submit some other patch, too. (After all, most of the time is spend trying to understand the package and the strange build system upstream choose instead of plain old autotools and not when fix the problem). But when it is hard to see the trees because of all the dead wood around it, and there is nothing to find with some way to reproduce it and one knows far too well that the most efficient steps would be a tedious search for old versions to see if that was a bug solved upstream many years ago, good intentions tend to melt like ice thrown in lava.

So, when I wrote both is true I meant that keeping real-world issues documented and aware is a good thing. But having bugs rot (and often they do), will pervert all the advantages. In the worst case, people will even stop submitting new reports as it takes to long to look at all the old ones to look for a dublicate.

Rudy Godoy: News and more news

Seems that I manage to publish yearly news. Well this time I've many of them. DebianPeru's event videos.
As promised, we've published the videos for our D aDebian 2006 anual event. You can find the event videos and also the lightning talks videos.
I want to thank our sponsors and people involved on producing them. We are already working on our next event which is mainly focused on attract, teach and involve more people on directly contributing to Debian and free software. Talking about Debian events and user-base growth, when I went to the place to make stickers for give out on our last event, I went with the swirl logo and said to the business owner: I want to print this. He said ok, and later he asked me: is it Debian right? I was like... yes!. Later we talked a bit more and he told me that he found Debian on the Internet while looking for alternatives to have his business run safely, since, as he related me looking worried, the police came to their place and seizure all the computers from other businesses claiming that they are running "pirated" software. So he found Linux and Debian. He told me that was having some issues with their devices, mostly his CD/DVD printers and scanners. We talked a bit more and I invited him to our local group and the event of course. It was a very cool incident, and I nominated him our official merchansiding supplier ;) Debian gaining market share.
Last year was quite good for Debian in Peru, besides the growing user-base, some government agencies have explicitly named as the operating system or linux-flavour they want third party deploy for them. One of the most important cases, IMHO, is the PDT software, which is the program that every business should use to submit taxes information. Currently it's only available for Windows and it's written in Visual Basic. Although, mostly because it's lack of stability and extensibility by third party, some government agencies have been pushing for SUNAT open it's source code. It was, as with many other out of place subjects, source of lot of flames and irrelevant waste of time by the local linux-supporters. Anyway, they didn't open the software, but instead they called for software vendors to compete for the development of a new version which should be multi-platform and according the specs at least run on Windows, Linux and Mac OS X, and on the Linux side they mentioned specifically that the program should be apt-get-able, thus vendor should provide a Debian package compliant with 3.0 or superior. Microsoft loves Debian.
I was invited to, which was meant to be, the true and first Microsoft vs. free software debate in Peru, but was, as we in APESOL have experienced for years: Microsoft refusing to debate. So it was mostly APESOL being technical, as requested by orga, and Microsoft being funny. I was astonished that almost half of Microsoft speakers mentioned Debian at least 5 times in their talks and dedicated almost half of their time to talk about free software (open source), interoperability and technological neutrality. It was fun for me to see them helping us to get known. There are some pictures on my flickr page. Personal life and Debian work.
Last year I've lost my two cats, both died in not a very good way, they are missed for sure. I'm sure I want a full white one, but not sure how soon. I've been really busy working on my business which led me to not being able to contribute as much as I wanted but I managed to do some stuff. In the other hand I've learned many important things that we, as free software community should seriously consider. Most of them have been already pointed out by some people on p.d.o already. Ok I believe this is enough, blame this to the not-blogging-for-long-time syndrome due the commies hidden over there locking my access to former hosting.

Christian Perrier: Debconf flight booking

Today, I began seeking for a good and cheap flight for me to go to Debconf in Edinburgh. That may sound easy (Paris to Scotland, not that a big deal), but the real jungle that are now european flights makes it more complicated than it appears. First of all, no choice to leave from Paris-Orly, which is much more closer to my place (30km without going through Paris) than Charles de Gaulle (80km). Then, the choice is mostly between: The choice is pretty easily made. Ryan Air would make me save 73 euros but would make a very unpractical trip (the bus shuttle to Beauvais leaves more than 3 hours before the flight and, similarly the bus shuttle to/from Prestwick seems quite unpractical. EasyJet is pretty not much cheaper than traditional companies and includes an unguaranteed connection in London Luton. British Airways is more expensive and includes a (guaranteed) connection. So, I'll very probably fly Air France..:-)...cocorico! For the french fellows reading this: in case you guys want to share the flight...or avoid sharing it....I'll probably fly Paris-Edinburgh on June 15th, leaving at 16:15 (AF 5052) and come back on June 24th, leaving at 18:15 (AF 5053). The flight back could be AF 5051 at 09:05 but that one is more expensive by 26 euros.

Next.

Previous.