Those of you that watch my twitter know that we got dumped on with snow recently. The final estimate reported by local papers is 17 to 19 inches. That s my car. You might understand why I went home at 1PM Tuesday and worked from home the rest of the afternoon. The county didn t get the roads opened until 5:30PM Wednesday, so we were stuck. Terah s dad kindly opened the driveway for us though. Without that, we wouldn t have even known where it was. Jacob and Oliver loved playing in the snow. It was a HUGE hit for them. Both of them hated to go back inside when it was time. Oliver had trouble walking, or even standing up, but that didn t stop him from begging for more every chance he got. On Saturday, I took Jacob outside to play. We had in mind building a snow tunnel. We went to one of the big piles of snow left by the tractor after our driveway was cleared, and I dug out a space underneath it that Jacob could crawl through. He got a little scoop (he insisted on calling it my shovel ) and helped dig too. He had a great time with it. He was very anxious to go inside, and it probably didn t help his eagerness that the cats could freely walk through it long before he could. They were around and taking a great interest in the proceedings. One of then stretched out on my back while I was stretched out pulling snow out from the pile. Finally Jacob got to go through. He had a little trouble because it wasn t tall enough for him to crawl like he usually does (though still plenty big for him to get through with lots of room to spare), but he came out beaming. I then went and got the camera and got some photos of his second trip through. You d think that this might be the highlight of a 4-year-old s snow excursion. And given his excitement, you might be very convinced of that. But you d be wrong. What Jacob really wanted was a snow train. So I drew some train track-sized lines in the snow with my shovel. Then I was supposed to draw a train engine. He had been planning this for hours before we even went outside, and I knew very well what was supposed to go on the engine: a snowball for a headlight. We then added passenger cars and a coal car, because apparently that s what you do with snow trains. And the result: When we went inside, Terah asked Jacob about his snow experience. Jacob was very happy, until she asked him if his snow train was a real train or a drawing of a train. Then he became very sad when he said it was a drawing of a train, and decided it was not what he wanted AT ALL. So today we went out again. This time I built a snow train that stands up, complete with snowballs for wheels. I asked him if it was right, and he kept saying, No, I want a REAL train. Finally I asked him what the difference between a real snow train and this one was. Apparently a real train would be on tracks, move around, make noise, and take us places. Fortunately he didn t dwell too long when I explained I couldn t build one of those. And then today s highlight was writing JACOB in the snow. He had started by drawing larger and larger J letters with his arm, and finally asked me to make one. I made footprints in the shape of a very large J, which he loved. He had me make another one, and then the rest of the letters in his name.

As part of the KDE3/QT3 cleanup after the Squeeze release, Debian is about to remove the kkbswitch package from it s archives (unstable, testing). I got a request to keep the package available as it solves some complicated situations when having more than two keyboard layouts. As a response to that request I m staring to look for someone who is willing to port kkbswitch to QT4. I d be more than happy to continue maintaining the package if such a port is done.
Filed under: Debian GNU/Linux, Free software applications

As much for my own reference as anything else... I quite often use vmplayer on my work desktop, and occasionally on my laptop. Other options might work better for other people, but the company have already settled on using vmware on their Linux machines to give users access to Outbreak, Office etc. I try to avoid them as much as possible, but about the only effective option for calendaring at work is Outbreak. *spit*. And on my laptop, I just have a vmplayer setup containing a trivial Windows XP installation for things like Nokia firmware updates. It's more hassle than I can be arsed with to move to something else - the only thing worse than using Windows is installing it, in my experience. In most respects, vmplayer is working OK for me. But: it has one intermittent and really annoying bug. Every now and again, as I switch away from the vmplayer session to another desktop using Ctrl-Alt, then Ctrl-Alt-Cursor, vmplayer eats the state of the X keyboard modifier keys. This makes things interesting after that point: my normal use of emacs, firefox, xterms, mutt (etc.) is fairly heavily dependent on being able to use the Shift and Ctrl keys. This looks like it has been documented as a bug in a number of places over the past few months/years (1, 2, 3, 4, etc.) but there doesn't seem to be a fix coming. However, what I have found out is that there is a workaround: setxkbmap will reset the modifier key state when things have broken. If only I'd been able to find that earlier - I've ended up restarting X or rebooting in the past... :-(

I spent most of the week-end working in the pkg-fonts team SVN repository and uploading font packages. The main goal was implementing "Build-Depends:fontforge-nox fontforge" to make the build of fonts easier and faster when they're built from FontForge source files. While doing this, I updated a few of these fonts. I also completely revamped the linux-libertine package which was left pending for quite some time in our SVN (after initial work by Rog rio Brito). I also definitely adopted the ttf-sinhala-lklug font package (the only fonts we have for Sinhala language, so far). Finally, I started going through the list of packages that still depend on defoma. I prodded maintainers for several of these, the most outdated ones....to propose adopting the package under the team's umbrella. We'll see what happens. Quite productive week-end, indeed (and I even managed to watch the three 6 nations rugby games, plus running around 30 kilometers...doh).

(The requisite "I have no time any more, it's 10 days late") It certainly feels like 3 months has passed since I last reflected on her development. It feels like forever. As usual, we've managed to do a fair bit in 3 months. She's doing very well. Growing nicely. Still around the 25th percentile for weight, but now up to the 50th percentile for height. We just had to upgrade her from an infant car seat to a "big kid" car seat, because she was maxing it out on height, not weight. She seems to have handled the transition okay, but we haven't done any long car trips since making the change. She's now sitting really well, and pulling herself up into a standing position. She's cruising around on furniture a bit (and sporting various bruises to show for it). She started crawling at six and a half months, and now there's no stopping her. She's into everything. No more teeth have appeared yet. Her top teeth have been looking like they want to do something for ages. I think, given a recent uptick in fussiness, their appearance may be imminent. On the food front, she's eating all sorts of things. We've got a few infant/toddler cookbooks, so we still are predominantly feeding her either a combination of pureed fruits and vegetables, or a few pureed dishes that I've prepared (mainly vegetable stews or risotto). She also enjoys bread, toast and has taken to Vegemite on toast, like a good little Aussie. The other night we ate out at our local Italian restaurant, and she had some garlic bread and some penne pasta with marinara sauce. She's definitely enjoying finger food. We went back to Australia for a couple of weeks recently, and she handled the flights extremely well, and had an absolute ball back in Australia. She'd just started sleeping through the night a few times before we left for the trip, and didn't sleep as well while we were in Australia, but got back into the swing of things in under a week of getting back to the US. She's so much fun at this age. She laughs, she plays. She gets so excited when I get home from work in the evenings. I love her and being a Dad so much.

MySQL supports a plugin interface since 5.1, which enables creation of server components. Plugins can be loaded at server startup, or loaded and unloaded at runtime without restarting the server. Most of these plugins require the full MySQL source tree during their build, which was not available in Debian as a binary package until I uploaded 5.1.54-2 to unstable last week. I had this item on my TODO list since MySQL 5.1 was uploaded to Debian unstable, because it is not possible for a Debian source package to build-depend on another source package. Thankfully, Clint Byrum from Ubuntu sent me a small patch which added the new binary package.

The first package making use of the new mysql-source-5.1 package is HandlerSocket, a NoSQL plugin for MySQL. It is currently waiting in Debian's NEW queue for approval, and I am sure we will see more plugins/packages (XtraBackup from Percona is another well known candidate) making use of the new binary package in Debian soon.

I just need to work more on bilocality. While I did find two geocaches, one at the South/Noon Train Station (taalverwarringen ), one in the buurt of the University, I did manage to miss the AW building completely and utterly. Wow. Except, that Haiku guy came over to talk for a bit (nice). And I drew. An Atari logo with swirl, for that weird stuff I recently have been found doing. More mksh-current news coming soon, stay tuned. In the meanwhile, I met bonsaikitten IRL (at FOSDEM, yes, too) who kindly made a live ebuild , i.e. a source package building -current. Finally let s say a big thank you to the person mostly manning our booth, gecko2, and to Benny for talking to people, getting That Other Packaging Thingy working, and pimping the website a bit.

A new release of Gnash, version 0.8.9, is due in the near future. Plenty of bugs have been fixed, but some users are still going to have problems playing YouTube videos. Here's a short explanation. At some point last year, YouTube started setting HTTP cookies in your web browser, to keep track of which of their video servers is nearest to your machine. This lets them provide a better experience for you (I guess). Here's a diagram of what goes on in your browser: As of Gnash 0.8.8, a workaround was added, calling an NPAPI function NPN_GetValueForURL to ask the web browser for the relevant cookies. New diagram: The downside is that this function was only added in NPAPI version 1.9. This means:

• Only the NPAPI plugin has this workaround, not any of the other gnash plugins (e.g. the native kparts one for Konqueror).
• While most browsers do implement NPAPI, not all of them have been updated to include this newer function yet. So the versions of Epiphany and Chromium shipped in Debian at the time of writing do not work with gnash/YouTube as far as I am aware (but Webkit has fixed this upstream).

What does Adobe's plugin do? I imagine it's something like the following: So, the good news is, this problem should almost certainly get fixed over the coming Debian release cycle, if only because all the browsers will get updated. In the meantime, disabling cookies (and removing stale ones from YouTube) is a workaround.

I ve been using dailystrips since April 2006 to get a daily overview page of all the various daily web comics I (and a few friends) like to see. It makes it much simpler than having to browse dozens of various webpages, with all their useless webbugs integrated, to see stuff. That had some drawbacks:

• dailystrips is unmaintained code. Last upstream release is from 2003.
• It is uncapable of fetching any other information than just the image. Which is bad for those like xkcd, Astronomy picture of the day or others where the title/alt text actually is an important part of it.

So about two or three weeks ago I took a look at dailystrips code to figure out where I need to stuff some lines in to get the additional information. Yuck. No. I don t like it. Not because it is perl, that alone would be fine. So, instead I went and did a little rewrite of it. In a simple and pure bash script. I duplicated the functionality of the daily mode (fetch images per day and put them into a daily subdirectory, create html files for them) and didn t bother with the fetch a random strip one as I never used that. Turned out at 276 lines of shell script that can even fetch alt/title and not break on funny characters in them, yay. Even better, as the search terms for the additional information is just a regex using bashs capability there run over the html file, one can have anything from it put as alt/title onto the final page. When I had that working I asked a colleague to provide a bit of CSS, so it also looks better now. An example output is available (note that the Previous/Archive links are not available there), and if you want you can take a look at the code too. There is no Debian package and I m not sure there should ever be one. If you want to get me patches feel free to mail me, be it for the CSS or the script, whatever.

Did not exist.Will never exist.There was quite a lot of buzz about privacy with that new IPv6 thingy. Some say it is bad, as you will have a static address. Some say the privacy extensions will fix everything. I say: lemme rant ;)First of all, that was the internet, when I started using it back in 1999:

[ New Yorker Magazine, March 1993] On the Internet nobody knows that you are a dog And that s the internet today:

[ robcottingham.ca] How the hell does Facebook know I m a dog?

Well, I d say that s not correct. Even in 1999 facebook could know you are a dog (if you ignore the fact, that there was no facebook in 1999), it s just noone really cared about it. But let s start from the beginning :)An IP-address is a 32-bit integer

An IP-address is technically a 32-bit integer, formatted into 4 8-bit parts (you can read more about IPv4 at Wikipedia), which makes a total of 4,294,967,296 possible IP-addresses. Your ISP has a range in this address-space it can give to its customers (you). My ISP (Unitymedia) owns about 300,000 IP-addresses (based on the RIPE database), which is about 0.007% of the whole address-space. If you look at the RIPE page, you see two common netname prefixes (DE-KNRW and DE-IESY-HFC) which match two regions of Germany where my ISP has its customers (Unitymedia is a merge of ish and iesy). What does that mean? It means one can map a Unitymedia customer into one of these regions, even if he would change his IP-address (Unitymedia uses DHCP with high lease-times, so this does not happen actually). It does not map the customer to a dog yet, but I bet real GeoIP databases can map them correctly to a city (I didn t try much, but this site suggests it works: http://www.ip-adress.com/?lc=en at least they map me correctly to Duesseldorf).Dynamic IP-addresses do not improve privacy

Given the above facts, even if Unitymedia would give me a new IP-address every X hours (many DSL-providers have X=24), it is still possible to map me into a set of about 150,000 users (here user means customer, there still may be multiple computers connected via the same line). I would even go further and say the set is much smaller, as I think I am not able to get every free IP-address from DE-KNRW-*, as these should be bound to cities/regions (GeoIP databases exist, you rememember?) and I do not move with my line.Routers and reverse DNS kill privacy

Currently, my IP-address is 62.143.232.104, which has a reverse DNS entry ip-62-143-232-104.unitymediagroup.de and does not say anything about me or my location, besides of the obvious Unitymedia customer . But look at the traceroute:

4  7111A-MX960-01-ae5.frankfurt.unity-media.net (80.81.192.181)
5  13NOC-MX960-01-ae8.kerpen.unity-media.net (80.69.107.26)
6  1411G-MX960-01-ae9.neuss.unity-media.net (80.69.107.2)
7  1411J-MX960-01-ae1.bilk.unity-media.net (80.69.107.70)
8  PH-1411J-uBR10k-06-Te-1-2-0.bilk.unity-media.net (80.69.102.106)

Frankfurt is about 250km from here, Kerpen about 60, Neuss about 10 and Bilk is a part of the city I live in, about 4km away from my home. I guess you get the idea :)Browsers kill privacy tooDo I have to say more than a link to https://panopticlick.eff.org/? My Chromium scores one in 1,400,000. How much IP-addresses did I have to hide in again?We are at the dog level now, dogs use BoneOS with FireBark, not Linux with Chromium :)IPv6 kills cute kittensOh, and privacy, because with IPv6, there are 2^128 IPv6-addresses out there, of which your provider will maybe own a /32 (2^96 addresses) and give you a /48 (2^80 addresses) or (more likely) /64 (2^64 addresses). Then you enable the great IPv6 privacy extensions (RFC4941) and happily hide in your own assigned subnet, still being a customer of your ISP, still living in the same city and using your old browser It s just about mapping subnets instead of individual IP-addresses then. And we can t get lower as the dog levelPeople can annoy meI did not write all this to teach you, you can do yourself with Wikipedia and RFCs. There is a person out there, who thinks using a random name, mail address and twitter account could fool me into thinking that s a new, yet unknown, person to me. Well, I am not stupid, sorry. When you comment on my blog, your IP-address is logged, when I approve the comment, I often look at the reverse DNS and the whois entry of that IP-address (sorry, I AM paranoid). I even might check my webserver logs (or Piwik) where did you come from (Google etc), writing accidentally in your comment does not help :) Also, if you are trying to fool me, don t use your own computer, running Windows 7 and Firefox which I installed. Oh, and probably do not use your home line which I used to login into my admin-area using my unique Chromium ;)Sorry Hanna Lena, the chicken has just eaten her own eggs And yes, one can track down a single person on this big thing called internet, IPv6 will not change this (in any direction).

I just realized that the Debian Installer is ten years old! It actually got started ten years ago last summer, but now is also an apt anniversary -- ten years ago, I successfully booted d-i for the first time. It's amazing that d-i has been around as long as Debian Developers who have "been with the project longer than most". (Many of whom have been long-time contributors to d-i themselves.) Astonishing that my basic design has held up and remains relevant. And every time I boot up the Debian kFreeBSD installer, or run the graphical installer, or hear someone raving about how easy Ubuntu was for them to install (and know d-i was underneath), I'm amazed at the places people have taken d-i. The code has recently moved to git. As changes like ext4 by default start to flow in to d-i, with Wheezy development starting up, I hope to see more people enticed into working on d-i. Anyone can do like Matthew Palmer has done with netcfg -- pick a component of d-i that interests you, check out its git repository, and take it from being reasonably well team-maintained to awesomely you-maintained. In five or ten years Matthew will be able to look back at all the people who have used d-i to install over IPv6, and on WPA wireless, and with his other netcfg improvements. Trust me, it's a great feeling. Previously: d-i retrospective (better written than the above & well worth a re-read)

<iframe frameborder="0" marginheight="0" marginwidth="0" scrolling="no" src="http://rcm.amazon.com/e/cm?lt1=_blank&amp;bc1=000000&amp;IS2=1&amp;bg1=FFFFFF&amp;fc1=000000&amp;lc1=0000FF&amp;t=dedasys-20&amp;o=1&amp;p=8&amp;l=as4&amp;m=amazon&amp;f=ifr&amp;asins=B003YH9MMI" style="width: 120px; height: 240px; float: left; margin-right: 10px;"></iframe> I tend to be a sucker for business books, to the point where I created (and later sold) a site to discuss them. Part of the motivation for creating that site was that a lot of them tend to contain one good idea, and an inordinate amount of fluff. This book does not - it's good material that could not easily be summarized because it's full of information. I think it's actually one of the more relevant books I've ever read in that, for my situation, the idea behind it really speaks to me. I work as a consultant during the days, and I like it a lot. Rather than working on the same old thing year after year, I get to meet new people, new clients, new situations, and help them out, which is motivating. However, consulting has its downsides too, in that it doesn't create a great deal of long-term value. Once you've finished up a project, it's on to the next one, or no money comes in. I'm also a bit older and more set in my ways: I did my time in the California Bay Area, and I don't relish going back and working like mad on a "Real Startup" with VC backing, crazy hours, and having the thing consume my life. The idea behind "Start Small, Stay Small" is to find and create really niche products: stuff that will earn you some extra money as a developer, but also niches that are small enough to not really be interesting to larger companies that need a lot of income to justify a forray into a particular market segment. This, then, becomes your 'competitive advantage': Microsoft, or even 37 Signals, simply isn't going to chase after a market that is worth 20,000 dollars a year. And yet for someone working on their own, if you manage to set up something that brings in that money, and mostly automate it so that it's not a second job, it's a tidy extra bit of money. Several projects like that might even be enough to live on, depending on your lifestyle. With that in mind, the authors, Rob Walling and Mike Taper, delve into the details of how to go about doing so. The whole thing is done under the assumption that you don't have a lot of time or money to throw at things that don't bring in concrete results in relatively short order. Various subjects discussed in detail include how to find a niche, how to create a sales web site, how to measure market demand, conversion rates, how to productively outsource less critical portions of your business, and much more. They also discuss what sorts of numbers to look at for various aspects of the business, and anchor the discussion with real numbers for many things, rather than just giving you a hand-wavy phrase that's not that useful in the real world. It's not a 'timeless' book as all the concrete numbers and techniques reference technologies, sites, and the market dynamics of 2011, but after all, that's part of what makes it good. Other things I didn't like so much were being sold on their for-pay "micropreneur community", and the relatively high price of the book but I think it's worth it given the real advice you get. If you don't like marketing, and think that products succeed or fail on their merits alone, of course the book will leave you cold, but of course you're wrong about that anyway!

My first ever Linux installation was done in the late nineties 1998 or thereabouts but was a RedHat 4.5 installation rather than a Debian one. The reason for that was fairly simple: the Infomagick sixpack CD set that I'd bought contained RedHat, Debian, and Slackware, but the RedHat installation was the only one that could be installed directly from CD the other two required me to write floppies and boot from those to start the installation, and I wasn't very fond of that idea. It was only a few years and a few broken RedHat upgrades later that I saw the light and considered trying out this Debian thing that some of my classmates were talking about. The fact that I'd just bought my own computer (rather than having to compete for time with my siblings on my parents' computer) was a good reason to do a fresh Linux installation. I'd been planning to install Linux From Scratch, but as what was still known as the LFS HOWTO told me you'd need a working Linux installation to do that, I considered my options. Since I'd developed a strong dislike of RedHat, I wasn't interested in doing another RedHat anymore. So, I downloaded the most recent version of Debian at the time (Potato Test Cycle III), wrote it to a CD, and installed. I've probably still got the CD lying around somewhere. A few months later, I found these "Linux Gazette" packages in the archive, with the latest packaged issue being 47, but the latest upstream version being much higher. Trying to figure out what was going on, I mailed the maintainer, Adrian Bridgett, who encouraged me to take over maintenance. Thus began my life of actively contributing to Open Source software. In November 2000, I applied to become a Debian Developer. In January 2001, Martin Michlmayr was assigned to be my AM. And in early February 2001, now just over ten years ago, I'd become a Debian Developer. Yes, that was fast, and no, I probably wasn't really ready yet, at the time. Originally, I only cared much about these Linux Gazette packages. But, as time went on, I started looking around, too. A friend passed me an old Macintosh Centris 610. As I tried to install Debian on it, I found that it didn't actually run very well. This turned out to be due to it having a broken 68LC040 processor, so I bought me another m68k-based mac, one with a full 68040 processor (a Centris 650). Thus I became involved in the m68k port and buildd maintenance. As these old machines came with 80MB or 250MB SCSI hard disks of which I had none laying around, and a then-recent Debian installation had minimum requirements of about 200MB, I was in need of network storage to be able to do anything useful with the mac. NFS didn't work as expected; the RTC implementation on m68k mac hardware was reverse engineered and didn't work too well at the time, which meant that the clock would run slower if the machine was under load, and that in turn would mean that make would get confused about timestamps, since they would suddenly appear to originate from the future (in NFS, it's the server that assigns time stamps, not the client). There was a simple solution, however; Pavel Macheck had written this neat 'Network Block Device', which would let the client do its own filesystem on network storage. Only it wasn't packaged; but then, that was easy to fix. Thus I started maintaining the single piece of software that I've worked the most on, to date. A few years later, Pavel lost interest in maintaining NBD, and handed over upstream maintenance to me and maintenance of the kernel side to Paul Clements. Thus began my life in upstream work. And while I originally joined Debian with the intent of using it as a learning experience and stepping stone on my way to more "important" free software, I found that it wasn't as satisfying as was my work for Debian. Over the years, there's been this duality where I've felt like I was doing too much and not enough at the same time. Too much, because the things I was doing would eat up much of my spare time, leaving little time left for other hobbies. Not enough, because I witnessed other people doing much more for Debian than I did, and I wanted to make a difference. As the years passed by, many things have changed. Not only in Debian, but also besides it. I became an independent contractor, focusing mostly on supporting people in using Debian (although I support them with other distributions, too). The importance of a port went from 'something which these weird porter people are doing, and that we should probably help them with if it doesn't work, but is their problem really' to 'something that I really really really have to make sure works for my packages', and back for the port that I cared about most. After several years of trying, I finally managed to explain to my parents what this Debian thing is, why it matters, and what my role in the whole thing is. We did a few releases, some taking longer than I would've liked. People joined the project, and left again. Some of my friends died. My fame in the project rose, even though I wasn't aware of it initially; and thus I was rather surprised when someone asked me whether I was "the Wouter Verhelst" at a key signing party. Recently, I've started looking back, and considered the things which Debian has meant to me. Ten years ago, I was 22, still in college, and had way too much spare time on my hands. I'd recently gotten my first Internet installation, and all these online communities were very new to me. Yes, that was all probably rather late. Debian has changed my life in many ways; it has allowed me to meet various kinds of people, both online and in meatspace. I've been to Helsinki, Edinburgh, Mar del Plata, C ceres, and New York City, places that I might otherwise not have visited. Each of these trips was an incredible experience that I have fond memories of; and while the most fond ones originate from Helsinki, I cherish the memories of each of these trips as some of the best trips I've ever done. Working on Debian has forced me to learn about the inner workings of a Linux-based system, which is knowledge that has helped me tremendously professionally, too. And finally, working on Debian has given me a unique perspective on this whole FOSS community, which has helped shape my ethics and my view of the world. While I believe that I would've subscribed to most of that ideology at any rate, I'm not sure that the details of my beliefs and understanding would've been exactly the same. And while I don't agree on every position that the project subscribes to as a whole, I do believe that the philosophies that lie at the core of this project contain just the right mix of pragmatism and ideology that makes it possible for our project to thrive in a changing world of not only a growing group of people who subscribe unconditionally to the free software ideals, but also business people who care mostly about money. Over the years, somehow I moved from "one of the recent batch of new Debian Developers" to "someone who's been with the project longer than most". It still feels weird to see people shut up because you've built up a reputation in some area, and you give your gut opinion on some subject without researching it too much. I try not to let that happen too often. Today, ten years and just over a week ago, my life as a Debian Developer started, and it would change the way I looked at the world, the things I would do in my spare time, and the people I would meet. I wouldn't have it any other way. Thanks, Debian, for what's been a blast; may the next ten years be as inspiring to me and everyone as the past ten!

Today I started to package from nearly all packages which I maintain within debian the new upstream versions, as squeeze is finally released Have fun with powertop 2.0beta (1.97) and the new lmms versions, to name only a few!

Other people have taken notice of the recent auto-run attack research against Linux. I was extremely excited to see Jon Larimer publishing this stuff, since it ultimately did not start with the words, first we disabled NX, ASLR, and (SELinux AppArmor) I was pretty disappointed with last year s Blackhat conference because so many of the presentations just rehashed ancient exploitation techniques, and very few actually showed new ideas. I got tired of seeing mitigation technologies disabled to accomplish an attack. That s kind of not the point. Anyway, Jon s research is a step in the right direction. He defeats ASLR via brute-force, side-steps NX with ret-to-libc, and finds policy holes in AppArmor to accomplish the goal. I was pleased to see protected by PIE and AppArmor in his slides Ubuntu s hardening of evince was very intentional. It has proven to be a dangerous piece of software, which Jon s research just further reinforces. He chose to attack the difficult target instead of going after what might have been the easier thumbnailers. So, because of this research, we can take a step back and think about what could be done to improve the situation from a proactive security perspective. A few things stand out:

• GNOME really shouldn t be auto-mounting anything while the screen is locked (LP: #714958).
• AppArmor profiles for the other thumbnailers should be written (LP: #715874).
• The predictable ASLR found in the NX-emulation patch is long over-due to be fixed. This has been observed repeatedly before, but I hadn t actually opened a bug for it yet. Now I have. (LP: #717412)
• Media players should be built PIE. This has been on the Roadmap for a while now, but is not as easy as it sounds because several of them use inline assembly for speed, and that can be incompatible with PIE.
• Consider something like grsecurity s GRKERNSEC_BRUTE to slow down execution of potentially vulnerable processes. It s like the 3 second delay between bad password attempts.

Trying to brute-force operational ASLR on a 64bit system, though, would probably not have worked. So, again, I stand by my main recommendation for security: use 64bit. :) Good stuff; thanks Jon!

This report is 2 week late It was delayed by an important event, not the release of squeeze, but the birth of my first child: C lestine is born Monday the 31th of January. My wife and C lestine are both fine now but the firsts days were not that easy. I m starting to recover from the lack of sleep, but I m still very late on my debian tasks So I guess I just drop Triaging for week 13, 14 and maybe 15 Now the bugs I triaged just before :

• #509489 ping & merge with #492783 Switching from tty to X by pressing Alt+cursorkey pass cursorkey keypress to X. OK for this user, waiting for more responses on other merged bugs
• #515546 ping & closed keys stick when switching consoles.
• #369202 ping randomly activated access keys .
• #547143 ping, it s udev now, not hal xorg/evdev/HAL versus serial mouse submitter said serial devices should be handled using inputattach. I think It s been added to some docs but didn t take time to look at it.
• #547888 ping & closed by submitter thanks! high CPU usage in X.org server after some time.
• #489996 mail error, closed problem auto-detecting / selecting some modes.
• #550124 ping & closed some modes aren t recognized.

The X Strike Force (still) needs you ! You can have a look at the X Strike Force Bug Closing Procedure and check XSF unstable bugs sorted by date.

Yesterday night I arrived in Pune for the GNUnify conference where I m a speaker. I should speak more often at such conferences, they really pamper the speakers: I was picked up with a car from the train station, brought to a posh restaurant where other speakers were already dining and afterwards accommodated in the guest house of the Symbiosis University, which means a spacious room with my own bathroom (with running hot water) and best of all: Internet connectivity after midnight! Tonight I was alone, the next night I ll be sharing it with another speaker.
Today we had breakfast at the conference venue and the first talks started. I attended a talk about Openmoko, but nothing new to me so far. I was happy to see Debian listed as one of the Distributions for the FreeRunner, given that I once co-initiated that port. Nevertheless it could not bring me to try using the FreeRunner again, reliability is just not good enough. I asked for the next best (in terms of freedom and geek-compatibility) phone, but there is no obvious good answer. The n700 seems to be a dead end, given that Nokia might ditch Meego. The Geeksphone sounds like a good candidate, but is out of stock. My Haskell talk will start in 30 minutes. I hope I ll reach my audience and haskell-cafe will see more Indian names soon... The talks are recorded. I guess I should have dressed better.

After Debian Squeeze was released last weekend, development will speed up again.
Today I uploaded a new postfwd package which ships also the postfwd2 script, a prefork server version.
I also started to orphan packages I m not using anymore or having dead upstream. The first candidate was policyd-weight, fortunately Chris Butler took the package over.
I m happy to be the first uploader into squeeze-backports with . icinga.

My problem was: I had a number of databases generated in different machines and I wanted to query them as if they were one, using the database the data came from as a field while querying and while showing results. The databases are SQLite3 files, generated using SQLAlchemy in a Python program. I solved this by using SQLAlchemy, which was good because I could use the same ORM mapping that the program used. I noticed that the Horizontal Sharding SQLAlchemy extension would fit well the problem, although not perfectly. I had to make some changes in some classes of this extension, and now it works fine. It was possible to filter the data using database as a criteria, but I couldn't get the database information from each line of a query result. I made a simple patch to SQLAlchemy, which wasn't likely to be introduced in the distribution, but worked for me, and sent it to its bug tracker. The change was included in SQLAlchemy in a very different fashion, as expected, but since I'm using the released version from SQLAlchemy, I kept on using my version of the patch. I don't want to do direct changes in SQLAlchemy source code, so I made the change in my program:

class ShardedSessionShardId(ShardedSession):
    def __init__(self, *args, **kwargs):
        super(ShardedSessionShardId, self).__init__(*args, **kwargs)
        self._query_cls = ShardedQueryShardId
class ShardedQueryShardId(ShardedQuery):
    def _execute_and_instances(self, context):
        if self._shard_id is not None:
            result = self.session.connection(
                            mapper=self._mapper_zero(),
                            shard_id=self._shard_id).execute(context.statement, self._params)
            news = list(self.instances(result, context))
            for new in news:
                new.shard_id = self._shard_id
            return iter(news)
        else:
            partial = []
            for shard_id in self.query_chooser(self):
                result = self.session.connection(
                            mapper=self._mapper_zero(),
                            shard_id=shard_id).execute(context.statement, self._params)
                news = list(self.instances(result, context))
                for new in news:
                    new.shard_id = shard_id
                partial = partial + news
            # if some kind of in memory 'sorting'
            # were done, this is where it would happen
            return iter(partial)
create_session = sessionmaker(class_=ShardedSessionShardId)

Another problem is that I had to make each result be included in the query, even if two results from different DBs have the same primary key. I achieved this by changing two classes: WeakInstanceDict, and Mapper. For using the new WeakInstanceDict, I had again to change the ShardedSession variation:

class WeakInstanceDictNoIdentity(WeakInstanceDict):
    def add(self, state):
        # if state.key in self:
        #     if dict.__getitem__(self, state.key) is not state:
        #         raise AssertionError("A conflicting state is already "
        #                             "present in the identity map for key %r"
        #                             % (state.key, ))
        # else:
            dict.__setitem__(self, state.key, state)
            self._manage_incoming_state(state)
class ShardedSessionShardId(ShardedSession):
    def __init__(self, *args, **kwargs):
        super(ShardedSessionShardId, self).__init__(*args, **kwargs)
        self._query_cls = ShardedQueryShardId
        self._identity_cls = WeakInstanceDictNoIdentity
        self.identity_map = self._identity_cls()

To start using the new Mapper, I simply replaced each call to mapper with MapperNoIdentity:

class MapperNoIdentity(Mapper):
    def _instance_processor(self, context, path, adapter,
                                polymorphic_from=None, extension=None,
                                only_load_props=None, refresh_state=None,
                                polymorphic_discriminator=None):
        """Produce a mapper level row processor callable
           which processes rows into mapped instances."""
        pk_cols = self.primary_key
        if polymorphic_from or refresh_state:
            polymorphic_on = None
        else:
            if polymorphic_discriminator is not None:
                polymorphic_on = polymorphic_discriminator
            else:
                polymorphic_on = self.polymorphic_on
            polymorphic_instances = util.PopulateDict(
                                        self._configure_subclass_mapper(
                                                context, path, adapter)
                                        )
        version_id_col = self.version_id_col
        if adapter:
            pk_cols = [adapter.columns[c] for c in pk_cols]
            if polymorphic_on is not None:
                polymorphic_on = adapter.columns[polymorphic_on]
            if version_id_col is not None:
                version_id_col = adapter.columns[version_id_col]
        identity_class = self._identity_class
        def identity_key(row):
            return identity_class, tuple([row[column] for column in pk_cols])
        new_populators = []
        existing_populators = []
        load_path = context.query._current_path + path
        def populate_state(state, dict_, row, isnew, only_load_props):
            if isnew:
                if context.propagate_options:
                    state.load_options = context.propagate_options
                if state.load_options:
                    state.load_path = load_path
            if not new_populators:
                new_populators[:], existing_populators[:] = \
                                    self._populators(context, path, row,
                                                        adapter)
            if isnew:
                populators = new_populators
            else:
                populators = existing_populators
            if only_load_props:
                populators = [p for p in populators
                                if p[0] in only_load_props]
            for key, populator in populators:
                populator(state, dict_, row)
        session_identity_map = context.session.identity_map
        if not extension:
            extension = self.extension
        translate_row = extension.get('translate_row', None)
        create_instance = extension.get('create_instance', None)
        populate_instance = extension.get('populate_instance', None)
        append_result = extension.get('append_result', None)
        populate_existing = context.populate_existing or self.always_refresh
        if self.allow_partial_pks:
            is_not_primary_key = _none_set.issuperset
        else:
            is_not_primary_key = _none_set.issubset
        def _instance(row, result):
            if translate_row:
                ret = translate_row(self, context, row)
                if ret is not EXT_CONTINUE:
                    row = ret
            if polymorphic_on is not None:
                discriminator = row[polymorphic_on]
                if discriminator is not None:
                    _instance = polymorphic_instances[discriminator]
                    if _instance:
                        return _instance(row, result)
            # determine identity key
            if refresh_state:
                identitykey = refresh_state.key
                if identitykey is None:
                    # super-rare condition; a refresh is being called
                    # on a non-instance-key instance; this is meant to only
                    # occur within a flush()
                    identitykey = self._identity_key_from_state(refresh_state)
            else:
                identitykey = identity_key(row)
            # instance = session_identity_map.get(identitykey)
            # if instance is not None:
            #     state = attributes.instance_state(instance)
            #     dict_ = attributes.instance_dict(instance)
            #     isnew = state.runid != context.runid
            #     currentload = not isnew
            #     loaded_instance = False
            #     if not currentload and \
            #             version_id_col is not None and \
            #             context.version_check and \
            #             self._get_state_attr_by_column(
            #                     state,
            #                     dict_,
            #                     self.version_id_col) != \
            #                             row[version_id_col]:
            #         raise orm_exc.ConcurrentModificationError(
            #                 "Instance '%s' version of %s does not match %s"
            #                 % (state_str(state),
            #                     self._get_state_attr_by_column(
            #                                 state, dict_,
            #                                 self.version_id_col),
            #                         row[version_id_col]))
            # elif refresh_state:
            if refresh_state:
                # out of band refresh_state detected (i.e. its not in the
                # session.identity_map) honor it anyway.  this can happen
                # if a _get() occurs within save_obj(), such as
                # when eager_defaults is True.
                state = refresh_state
                instance = state.obj()
                dict_ = attributes.instance_dict(instance)
                isnew = state.runid != context.runid
                currentload = True
                loaded_instance = False
            else:
                # check for non-NULL values in the primary key columns,
                # else no entity is returned for the row
                if is_not_primary_key(identitykey[1]):
                    return None
                isnew = True
                currentload = True
                loaded_instance = True
                if create_instance:
                    instance = create_instance(self,
                                                context,
                                                row, self.class_)
                    if instance is EXT_CONTINUE:
                        instance = self.class_manager.new_instance()
                    else:
                        manager = attributes.manager_of_class(
                                                instance.__class__)
                        # TODO: if manager is None, raise a friendly error
                        # about returning instances of unmapped types
                        manager.setup_instance(instance)
                else:
                    instance = self.class_manager.new_instance()
                dict_ = attributes.instance_dict(instance)
                state = attributes.instance_state(instance)
                state.key = identitykey
                # manually adding instance to session.  for a complete add,
                # session._finalize_loaded() must be called.
                state.session_id = context.session.hash_key
                session_identity_map.add(state)
            if currentload or populate_existing:
                if isnew:
                    state.runid = context.runid
                    context.progress[state] = dict_
                if not populate_instance or \
                        populate_instance(self, context, row, instance,
                            only_load_props=only_load_props,
                            instancekey=identitykey, isnew=isnew) is \
                            EXT_CONTINUE:
                    populate_state(state, dict_, row, isnew, only_load_props)
            else:
                # populate attributes on non-loading instances which have
                # been expired
                # TODO: apply eager loads to un-lazy loaded collections ?
                if state in context.partials or state.unloaded:
                    if state in context.partials:
                        isnew = False
                        (d_, attrs) = context.partials[state]
                    else:
                        isnew = True
                        attrs = state.unloaded
                        # allow query.instances to commit the subset of attrs
                        context.partials[state] = (dict_, attrs)
                    if not populate_instance or \
                            populate_instance(self, context, row, instance,
                                only_load_props=attrs,
                                instancekey=identitykey, isnew=isnew) is \
                                EXT_CONTINUE:
                        populate_state(state, dict_, row, isnew, attrs)
            if loaded_instance:
                state._run_on_load(instance)
            if result is not None and \
                        (not append_result or
                            append_result(self, context, row, instance,
                                    result, instancekey=identitykey,
                                    isnew=isnew)
                                    is EXT_CONTINUE):
                result.append(instance)
            return instance
        return _instance

I had to include some auxiliary definitions to make the rewrites work:

_none_set = frozenset([None])
_runid = 1L
_id_lock = util.threading.Lock()
def _new_runid():
    global _runid
    _id_lock.acquire()
    try:
        _runid += 1
        return _runid
    finally:
        _id_lock.release()

It would be good to be able to set these identity requirements as a parameter. My last problem was selecting more than one database to search. setshard only worked for one, so I created a new field in query, called shards, and checked for it on querychooser:

def query_chooser(query):
    try:
        return query.shards
    except AttributeError:
        pass
    return tcs.keys()

So, when I want to look only in a list of shards, I set this field. I'm aware that this is not a recommended python idiom, but, well, it works fine.

Sponsoring a package means uploading a package for someone else (usually a new contributor starting out as package maintainer). This is an activity reserved to Debian Developer who are supposed to be knowledgeable about packaging. This article tries to document the process to ensure the sponsor is doing a reasonably good job according to Debian s standards. Sponsoring a package in the Debian archive is not a trivial matter. It means that you verified the packaging and that it is of the level of quality that Debian strives to have. Let s have a look to what you can and should do when you re sponsoring a package. Sponsoring the initial upload Sponsoring a brand new package into Debian requires a thorough review of the Debian packaging. Building the package and testing the software is definitely not enough! You should open every file in the debian directory and look out for potential problems. Here s a checklist that you can use to perform the audit:

• Verify that the upstream tarball provided is the same that has been distributed by the upstream author (when the sources are repackaged for Debian, generate the modified tarball yourself).
• Run lintian. It will catch many common problems. Be sure to verify that any lintian overrides setup by the maintainer is fully justified.
• Run licensecheck and verify that debian/copyright seems correct and complete. Look for license problems (like files with All rights reserved headers, or with a non-DFSG compliant license).
• Build the package with pbuilder (or any similar tool) to ensure that the build-dependencies are complete.
• Proofread debian/control: does it follow the best practices? are the dependencies complete?
• Proofread debian/rules: does it follow the best practices? do you see some possible improvements?
• Proofread the maintainer scripts (preinst, postinst, prerm, postrm, config): will the preinst/postrm work when the dependencies are not installed? are all the scripts idempotent (i.e. can you run them multiple times without consequences)?
• Review any change to upstream files (either in .diff.gz, or in debian/patches/ or directly embedded in the debian tarball for binary files). Are they justified? Are they properly documented (with DEP-3 for patches)?
• For every file, ask yourself why the file is there and whether it s the right way to achieve the desired result. Is the maintainer following the best packaging practices described by the Developers Reference?
• Build and install the packages, try the software. Ensure you can remove and purge the packages. Maybe test the packages with piuparts.

If the audit did not reveal any problem, you can upload the package. But remember that even if you re not the maintainer, the sponsor is still responsible of what he uploaded to Debian. That s why you re encouraged to keep up with the package through the Package Tracking System. Sponsoring an update of an existing package You will usually assume that the package has already gone through a full review. So instead of doing it again, you will carefully analyze the difference between the current version and the new version prepared by the maintainer. If you have not done the initial review yourself, you might still want to have a more deeper look just in case the initial reviewer was sloppy. To be able to analyze the difference you need both versions. Download the current version of the source package (with apt-get source) and rebuild it (or download the current binary packages with aptitude download). Download the source package to sponsor (usually with dget). Read the new changelog entry, it should tell you what to expect during the review. The main tool you will use is debdiff, you can run it with two source packages (.dsc files), or two binary packages, or two .changes files (it will then compare all the binary packages listed in the .changes). If you compare the source packages (excluding upstream files in the case of a new upstream version, for example by filtering the output of debdiff with filterdiff -i '*/debian/*'), you must understand all the changes you see and they should be properly documented in the Debian changelog. If everything is fine, build the package and compare the binary packages to verify that the changes on the source package have no unexpected consequences (like some files dropped by mistake, missing dependencies, etc.). You might want to check out the Package Tracking System to verify if the maintainer has not missed something important. Maybe there are translations updates sitting in the BTS that could have been integrated. Maybe the package has been NMUed and the maintainer forgot to integrate the changes from the NMU in his package. Maybe there s a release critical bug that he has left unhandled and that s blocking migration to testing. Whatever. If you find something that she could have done (better), it s time to tell her so that she can improve for next time. And so that she has a better understanding of her responsibilities. If you have found no problem, upload the new version. Otherwise ask the maintainer to provide you a fixed version.

---

This article will be repurposed to enhance the Debian Developers Reference, hopefully leading to a fix for the wishlist bug #453313. Click here and help me fix more of those. You re also welcome to suggest improvements in the comments. Are there other checks that you re always doing? Do you have some handy tip to make it easier to review a package?

7 comments Liked this article? Click here. My blog is Flattr-enabled.