To hell with all this warm weather. Begin this week my thesis supervisor got back from the States, so I've been getting a much-needed kick under the backside. My thesis is improving with leaps and bounds, and although I've got a lot of work left I've also got a renewed sense of direction. I should find a few minutes somewhere to document, package and upload my python GA-toolkit code, it's becoming pretty neat and allows easy linking of GA's together. Optimizing algorithms sounds boring, and it is, but 'parameter calibration using meta-evolutionary algorithms' has a nice ring to it. In other news, Erich too has given me a much-needed kick regarding the Debtags AI SoC project. I've modified the old ai-tagger to also include the directories each debian package contains: The results are interesting to say the least. Take for example kde-i18n-zhtw in the tagdb changes webinterface. It clearly should get the culture::chinese tag, as it's the KDE Chinese i18n package for crying out loud. Yet, the old tagger gives it a mere 0.0003. Not good. The new tagger? 0.99004. Remarkable what a little bit of extra meta-data can do...

A month between postings. Who needs regular updates? I've got a few of these weekend weeviews piled up, so I'm going to do them two at a time every couple of days. Omega Man Charleton Heston makes this post-apocalyptic world view quite the masterpiece. Considering his current stance on guns, it is easy to throw a couple of cheap shots at the movie in which he plays a gun-crazed doctor. Thinking you're the only one left in existence has got to be pretty hard on the psyche, and it shows in the character. Robert Neville (Heston's character) obviously doesn't think he's really alone, just the only one left who shouldn't be shot on sight. The rest of the human race was hit by a crappy plague, 28 days later-style. This plague apparently doesn't kill all brain functions, but only crams you into a religious sect which could only be described as luddite. Movies aren't interesting without a love interest, so Heston finds out early about Lisa (Rosalind Cash) who is keeping a set of children who are immune. Robert is also immune, and hopes to create a serum from his blood. This 70's end of the world is remarkably watchable, although it has it's moments of Action Movie. The acting is well done, although the cult of luddites is somewhat overplayed and has strange overtones of vampirism for some reason. Omega Man gets a 7. (imdb, amazon) Conquest of the Planet of the Apes As a child of the 80s, I never saw any of the original Planet of the Apes movies, and always assumed they were campy and not well done. Imagine my surprise when I discovered that they actually have a plot and are interesting. This fourth movie in the series of 70s movies presents it's moral message with a generous heaping of.. it's moral message. Years after his parents travelled backward in time in Escape from the Planet of the Apes, Caesar, the only talking ape left, is incognito with the circus master who raised him and comes to the city for the first time. At this time the plague which killed all pets has already ravaged the nation, humans have decided that apes are more useful as slaves than pets, and already have a large monolithic "Ape Management" section of government. Caesar gets thrown through the system when his "owner" gets brought into questioning for.. questioning the treatment of an ape. Being highly intelligent, he quickly gets snatched up for his skills by a top government official. Starting an underground resistance movement is the next step, and dominos start to fall from there. Conquest.. then degenerates into a large-cast action film, with hundreds of extras in a street-level ape vs. human fight. It's not the most interesting movie ever, but considering my expectations I can happily give it a 6. (imdb, amazon)

The French Constitutional Council just decided about the DAVDSI law^[1] that:

• reverse engeneering a DRM is illegal, even if you try to port it to other platform respecting its limitations ;
• copying illegal stuff can lead to prison, whereas the governement motto was that prison for hackers should be avoided at any cost, and that gradual fines had to be used instead.

The opposition had made a formal request to the CC asking to reject the law, and they got one that is worse than the one proposed by the government. One that is maybe even worse than the DMCA^[2]. OMFFSM The small benefit is that the point that said that authors who write softwares that can be used to exchange copyrighted contents has been softened (in fact restricted) a bit. But still remains, which in itself still is a nightmare. (for the non french-speaking people, the picture says this man whistle music without paying it )

I don't know quite what's going on this week, but I like it. I receive a fair number of emails every week asking me to do little things related to Debian. For some reason, over the last few days, the percentage of people who are taking the time to send a quick email saying "thank you" for whatever I've done in response to their reqeust has gone way up. Thank you.

Things ready to change again :o)

[Debian]

Keeping you up-to-date about my NM process, I have some good news since last time I wrote here. I was approved in the P&P! And I just sent the answers to T&S Part 1, by far, this was the most time intensive part of the NM until now. I had to fix RC-bugs, write shell script, write manpages and answer another round of questions. It is a hard part of the NM, IMHO, not because of the questions but because of the time required to prepare everything as good as possible. There is always something new to learn about Debian, how the project works, where to find information, how to help, it is really amazing. Extremadura i18n meeting is pretty close and we have a proposal to work in the debian-installer language packs (or something like that) trying to add more languages (and trying to save space or using another approach to load the languages).

Talking quickly about Brazil, August is almost there, our Debian User Group already find a place to celebrate Debian Anniversary, which is great and will allow us to prepare everything in the best way possible to have a very nice event. Translation work is a little bit delayed because CVS pserver is offline and translators without ssh access (non Debian Developers) can't work directly, we are routing our files and patches do debian-www, a huge thanks for all people helping us to get the files commited!

[Random stuff]

University classes are about to begin. Next week (August 31st), let's go for another round. I got visit from my cousing from Sao Paulo and also from my cousins from Netherlands, busy weekend (which delayed a little bit my NM answers, but it was all fun). :-)

I'm trying to get involved with DebConf Organization, we are in the middle of lots of changes. I'm working to get my packages uploaded to get them in "etch" and "in time". I'm also waiting for the new point release of Sarge (r3) so we can update Debian-BR-CDD (r1). Speaking about Debian-BR-CDD, we are ready to migrate to RT which will help to keep the tasks (DebConf Teams also use it).

Hmmm, I would like to write more about lots of things. Not right know, but certainly pretty soon. And by the way, if you don't know, the idea is to get Debian GNU/Linux 4.0, codename "etch", in time for Christmas. :-)

Dear Blars,

If you're going to file bugs against my packages, please ensure that I can email you. Rather than, say, blocking what appears to be an entire /16 of addresses. Of which my ISP happens to own a measly /20. I'm aware that your policies may result in some degree of collateral damage, but if you don't want to receive email from me because some ISP that probably isn't in the same cocking country as me[1] doesn't answer their abuse@ email[2] then don't fucking email me in the first place, you astonishing cunt.

Love,

Matthew.

[1] The netblock covers the UK, Switzerland, Georgia, France, Ukraine, Italy, the US, Gibralter[3], Germany, Russia and Lithuania. My ISP, well, doesn't.
[2] I checked. Mine's never received any email from you there, ever.
[3] Yes, I know

I've been working on some introductory slides on SELinux. They're still far from finished. All I've written so far is some basic terminology, identities, roles, types. I also tried to show how this increases security, though that part is probably still hard to understand unless you know about common attack vectors. I havn't yet written about the actual policy, policy modules, all the fancy UI stuff available, reachability analysis etc. I probably will not do so: The goal of the slides is not to give an exact overview over how SELinux works, how to write good policy etc. I also don't claim to have all facts right - instead I want to provide an easy to understand overview over how SELinux works and why it is a good thing. I guess I won't even be flaming AppArmor. ;-) Thats why I picked the name "gentle introduction to SELinux". Remember, it's just a work in progress, "the best is yet to come". I really need your feedback (and encouragement -- there is still so much to be written). Get the slides as PDF here. Feedback is best via email -- erich AT debian DOT org. I intentionally do not have comments in my blog.

Sometimes, spam can be entertaining:

latest .linux kernel involves
HALVES HIV/AIDS
location

Literally. From my "spammy" folder, with mails that score between 2 and 4 in my Spamassassin. Thats where most of my spam goes to. Another spam that would most likely have been blocked by greylisting - but it was forwarded via another mail box not being protected by greylisting. :-( Btw, I think greylisting could help reducing the load on master.debian.org, since it's really cheap on the CPU and disk. On my server it cut down email numbers to be handled by a huge amount. I don't have numbers on how well it works for larger mail servers though. I guess a pure sender-IP greylisting won't be too helpful, but a senderIP+destination greylisting (maybe just first 8 chars of destination, that should handle any +extensions etc.) should still work well.

Hey, I'm sure you're wondering what DeFuBu is, aren't you? That's the Debian Funniest Bug contest! This is a new monthly contest which consists to choose the more fun bug. How to win? Simply drop me an email with the bug number. I will maintain a list of candidats. Then, a selected and feed jury will choose the best of them.
If the bug you reported win, you and the reporter will win something like your weight in Ubuntu CD or the right to write my new book, Debian for dummies. For example, I give you a bug reported by Florent Bayle, #355455, which the first candidate for July. PS: Please note that I do this for fun, not for raising personnal attacks ;-) PS2: This challenge has been renamed to DeFuBu to avoid some misunderstanding on its leitmotiv.

One of these days I'd like to understand why my life goes in waves. This round was contacts from Vancouver.

Katy and Ryan were here this weekend.
Frances just called to tell me about working at an Ottawa church this fall.
I sat down at my email and Mulan emailed me.
Ted, Tam, Heather and Rachel emailed to arrange visiting at the end of August.
Sandy (Angie's mom) is coming here on Saturday and will house-sit through Opus.
Jamu was in Montreal last week (even though I wasn't).
Heather (Angie's sister) was here the week before.

Weird. I don't mind at all, though. =) I miss all y'all!

This afternoon I started looking at cfengine. In very little time, I've already set up rules that can bring a system from pretty much cdebootstrap state up to a minimal production system in our environment. I've still got a little ways to go, but it's already hacking on /etc/hosts, hosts.deny, sources.list, installing appropriate Debian packages for our systems, etc.

It's come a long way since I last looked at it six years ago.

One thing I can't figure out...

I have a /etc/bacula/bacula-fd.conf file that contains, among other things, this:

Director  

  Name = backup-dir

  Password = "foo"

 



Director  

  Name = backup-mon

  Password = "bar"

  Monitor = yes

 

I can't figure out how to make cfengine delete just that second section. I tried this:

       BeginGroupIfLineMatching "  name = .+-mon"

         IncrementPointer "-1"

         DeleteToLineMatching "\ "

         DeleteNLines "1"

       EndGroup

But it seems that the pointer is never actually being decremented, even when examined under verbose mode. That is, it leaves the leading "Director " line in the file.

I'm currently considering how to encode publication dates correctly in an RSS 2.0 file. There are basically two different dates: What is the semantical date (i.e. what should the user see as date), and what is the technical date (i.e. when was the content changed last technically). Currently, at the item-level, there is only one element specified: the pubDate which tells when the article was published. It would sound logical to use the lastBuildDate from the channel as well there, and just put the technical date into the lastBuildDate. I'm however wondering if that's really a good idea?

“The girls I encountered were so immersed in this lifestyle, in their new reality, and completely divorced from the outside world. How could I explain to them that what they are doing means nothing in the outside world, yet will affect them for the rest of their lives? They have given up who they are for now; they have put their dreams on hold; their lives for the next two years have become a wistful compromise.”

PGP keys I won't be signing... or trusting

This is the keysigning exchange service at Biglumber. The owner of key F5538629A12E35418DFBF242FA89FA5556F42D8B has signed your key (DEA27BAA479CCA5876E5DE5628DEAE7F29982E5A). Your key with this signature on it will be emailed to you once you have uploaded a signed copy of their public key to Biglumber. Log in to biglumber.com and look for the key exchange link.

Ah, the great democratization of PGP. Who needs security when we can just collect signatures like baseball cards and hawk our identities on eBay instead? Should be an easy profit, apparently I don't even have to show that I'm me to get in on the signature exchange market. This PSA brought to you by the committee for not trusting Ryan Ward. ...whoever that is.

It's rare that I find a letter to the editor of a newspaper profound enough to be worth tearing out and saving. Today was one of those days. I am pleased to discover that the full text is visible online, so I can share Ashley Frohwein's letter Insight on Fourth of July flag burning here. Sadly, I'm not always proud of my country... but some of the principles on which it was founded remain as noble and inspiring as ever!

Back in mid-February, I was invited to participate in a review of EU government policy support research on gender issues in Free Software communities at the University of Cambridge. The meeting was fascinating to me not only because of my level of interest in the content, but also because the reviewers were a wonderfully diverse group of genuinely interesting people. I also must admit that being a guest of Kings College for two nights was quite an experience in and of itself... As someone who has been a strong proponent of the idea that approaches and technologies adopted by Free Software developers are something other communities might want to borrow from or emulate, I found the results of this research both disturbing and enlightening. The disturbance centers around just how strongly male-biased our current behaviors seem to be in practice, particularly in the Debian project. My moment of enlightenment was the realization that many of the ideas we discussed about how to encourage and enable more female participation in our communities could simultaneously make our projects more appealing and rewarding to all of our contributors! I've talked to various people about this research in my travels since the meeting in February, and many have followed up asking for pointers to the findings. I was pleased to learn this morning that the integrated report of findings and recommendations from this work are finally available online. I hope at least some of you will read this report, and will then be as interested as I am in looking for ways to change the status quo. Perhaps a BOF at the upcoming Debian developer's conference to discuss these results and brainstorm specific actions we can take in the Debian project would be a good place to start? I expect to arrive late on the 15th, and must depart early on the morning of the 21st...

Just home from West Virginia, where my wife's family gather at her grandmother's house to celebrate Thanksgiving. The traditional turkey feast was pleasant as always, but the real culinary high point of this trip was on the way home... The closest major airport is Pittsburgh, we had a couple of extra hours on Saturday before our flight, and Karen and I are both graduates of CMU. So we decided to detour into Pittsburgh and and drive around a bit to see how things had changed over the years and what was still familiar. The biggest visible differences to us were on the river fronts, from the new stadium that replaced Three Rivers to what looks like a technology park built along the Monongahela under the parkway, where steel mills once stood. We didn't take time to do more than drive around the CMU perimeter, but even that let us see that the campus landscape has changed dramatically since we were students. Otherwise, most of the major landmarks that matter to us remain unchanged, including the apartment on South Millvale I lived in for all but my freshman years at CMU. But best of all, 'the O' was still alive and well on Forbes avenue! I'm sure I ate there an average of at least once a week from the time Steve Fisher introduced me to the place until I moved to Colorado. I often tell people that the best part of having to travel a lot for work is that I get to sample interesting foods from around the world... and many of my strongest travel memories are of meals enjoyed with interesting people and wonderful food. However, despite all those experiences, 'O' fries continue to rank near the very top of my list of foods I'm willing to go out of my way for. Even my 5-year-old son, who can be a lot pickier about what he'll eat than I like to admit, thanked me repeatedly on the flights home the rest of the afternoon for "making me try those french fries with cheese". Sometime, I'd love to spend enough time in Pittsburgh to see how many of the other places I used to love to eat are still around... In the meantime, a regular fix of chili dogs and fries at the 'O' are one of the few things I really miss about the years I spent in Pittsburgh.

In a recent work-related conversation, Matthew Wilcox pointed out that EFI partitions are mountable on Linux and many distributions keep ia64 system partitions mounted at /boot/efi by default, but Debian does not. Since that behavior is mostly my fault, I recounted the history by way of explaining why it worked that way... and on suggestion from Martin Pool am repeating it here to document all this for posterity. When we were making ia64 bootstrap decisions, the default bootloader on i386 was lilo, and the closest example to what we needed for ia64 in Debian was powerpc. This is because systems using EFI only understand FAT partitions by default, and thus need a FAT partition somewhere that the firmware can read from... often the first partition on the first disk. The Debian model for handling such things at the time seemed to be to craft a command to hook from kernel package postinst scripts that did the heavy lifting in association with a config file. What went on behind the curtain wasn't something to bother the user with on an average day if you could avoid it cleanly. Some bootloaders know how to read a config file from /boot directly, and we started out thinking we'd use elilo that way, but it was hard to match up paths/naming in EFI to what they would look like under Linux. It was also clear to me that most ia64 systems were going to have large system partitions so there'd be plenty of space. So we punted and copy the elilo executable, config file, and any kernels or initrd files referenced in the config to the system partition. I also thought the default location other distributions had chosen for mounting the EFI partition once the kernel was up, /boot/efi, was pretty ugly, but I couldn't think of anything better. The problem is that the standard says you need an \efi\"whatever" directory as the root of your content in the system partition, so mounting the partition at /boot/efi yields paths like /boot/efi/efi/debian. Some distributions didn't adhere to the standard at first, and so didn't see the ugliness until they started to comply... but I was on a team at HP making disk partitioning and content decisions that caused me to be very aware of these details. Putting that all together, I decided there wasn't any point in having the EFI partition mounted by default... anyone who cared and wanted it mounted could just add a line to /etc/fstab to put it wherever they wanted. If I were doing it again today, I'd have an entry in /fstab marked noauto delivered during system installation. I haven't cared enough to tackle that change, though. Sadly, there's one detail of the current implementation that can get in the way of complete happiness. The Debian-specific 'elilo' script that runs in user space to manage the EFI boot partition contents based on the content of /etc/elilo.conf expects to have to mount the EFI partition, and exits with a complaint if the partition is already mounted. For typical users, this script only gets called during installation and from kernel package postinsts, and the actual elilo bootloader remains oblivious to all this. If other distros have picked up the Debian script, I'm not aware of it. So, you're no worse off mounting the EFI partition in Debian than with some other distro, you just get treated poorly if you try to use our elilo script while the partition is mounted. Clearly, we could handle this better. If someone wants to offer up a patch to the elilo script that asks the user if it's OK to scribble in the already-mounted partition instead of doing a mount / scribble / unmount cycle in the presence of an existing mount, I'll be happy to include it in the Debian elilo package. Meanwhile, a lot of us have switched from lilo to grub on our i386 systems, and I'd love for my ia64 systems to work more like my grub-equipped systems. But making a substantive change like teaching elilo to know where /boot is so that it can read a config file from there and do things more like grub, without symlinks, etc, has several issues. We'd need to get the right set of file systems supported from EFI/elilo, we'd need to address the naming issues, and we would require either user intervention on upgrade, or some clever automatic parsing and rewriting of the relevant config files. I can think of other things that would be more rewarding to work on, so don't anyone hold their breath...

I had a chance to hear Alan Kay talk during a visit to HP Labs a week or so ago. Among other things, it motivated me to finally sit down and have a look at Squeak. I'd heard Ted Kaehler and others talk about it. I have fond memories of playing with Smalltalk at various times in the past, starting when I was an undergrad at CMU. I know the folks in Extremadura include Squeak in the systems they deploy in schools, and I even came home from Malaga with a CD containing their packages! But I just hadn't ever gotten around to actually doing anything with Squeak. Now I have... and even better, so have my kids. ;-) In fact, while I think I understand what's actually going on better, my daughter now has spent much more time playing with eToys than I have. I'm really curious to see how far she goes with this...