I always spend my Christmas with my parents, and for the past few years, I've always started some new little hobby hacking project or another. Three years ago I started writing a new text editor, sex.py. I still use it, although I haven't had much time to improve it further. This year, I wanted to see if I could come up with a little something to jot down random little notes easier, to keep track of said notes, and to help me manage a GTD workflow better. Last summer, I started dabbling with the "Getting Things Done" method by David Allen. It's basically a way of keeping track of things that you need to do. A bit more sophisticated than a simple todo list, without getting seriously bureaucratic or tedious. So far, whenever I follow the method, it seems to be working, although I'm not sure if it is because of using this particular method, or because I'm a method at all. GTD requires keeping a few lists of things: todo items that can be done now (assuming suitable context, but with no unfilled dependencies), todo items that might be done some day, etc. The tool I chose for this last summer is Gjots2. It's a GUI outliner tool that works adequately, but is not smooth enough to prevent me from looking at better tools. One of the things missing from Gjots2 is a good search facility. You can't do things like "show me all items containing the words 'Debian' and 'upload'", for example. Some time ago, while browsing 43Folders, I learned about a small application for MacOS X, called Notational Velocity. I don't have a Mac, so I can't try it out myself, but it works by keeping track of small text-only notes, each with a title, and has a user interface geared at searching. Instead of having a tree or a list of notes, it has a title bar where you enter some words, and it shows you a list of the notes that match those words. You can then either select something from the list, or press Enter to create a new note, with the text you entered as a title. This sounded intriguiging to me, and I thought it might be interesting to experiment with it for my note taking and GTD needs. So I spent one night at my parent's writing a first approximation of a prototype. I'm calling it Notetak. I've today switched from Gjots2 to Notetak, and it's already clear that it's a completely different approach to things. So far I like it, but I'll have to experiment with this for a few days or weeks to see if it really works. I'm pretty sure the basic approach would benefit from having additional tags for notes, or possibly having stored searches. I keep finding myself searching for, say, "@next" a lot to get a list of GTD next actions. The source (and a preliminary .deb) is on my home page, in case you're interested. Please note (ahem) that this is highly experimental and may eat your data. I may abandon it at any moment, if I decide that it's not worth it, but if not, it might also change frequently. If you do use it, I'd be happy to receive any bug reports, suggestions for improvements, and patches you may come up with.

Nice Christmas for us at the Prodromou homestead in Los Altos Hills. My brothers Nate and Ted spent Christmas Eve with us at the big house, and we hung out till late at night watching Leeroy Jenkins videos on YouTube. The next morning, Amita June woke up early, oblivious to the importance of the day. My nieces Elena and Tessa had their initial gift opening at their house in Mountain View then came over to my Mom and Dad's around noon. So the rest of us played and chatted and had a nice brunch. We had a good time opening presents, and Amita got her main wished-for gifts: lots of musical instruments, like drums, maracas, and a recorder. She also got some nice clothes, both from my folks and her maternal grandparents. Altogether a good holiday, and as usual a watershed of stress. We don't have too much to do between now and the end of the year, so it's a good time to get caught up on some projects that need some attention. And, y'know, just rest. tags: christmas prodromou family amitajune

Basecamp crazy So, I really like the Basecamp project management service. It's a really intuitive system, simple to use, without a lot of project-management mumbo-jumbo that makes tracking your time and planning work too hard to do. It's nicely implemented, has a great UI, and does lots of neato Ajax stuff, so it's easy to use. I crossed the rubicon from the gratis version to the low-volume personal version last year, making myself a whole-hearted participant in the freemium business model. A couple of days ago, I crossed another milestone: I had more than 3 concurrent projects going, so I had to upgrade to the Business version. Normally I'd be pretty P.O.'d to pay for a Web service, but for one that has shown me a lot of value, and that I've moved into incrementally as I've become dependent on it, I'm more willing to pay. I'm not sure what that says about my values, about this particular business model, or just about the quality of the Basecamp service. tags: basecamp freemium project management

One-time passwords So, I'll admit it: I think one-time passwords are pretty hard to understand. But Nick Moffitt gives a very good description of OPIE (One-time Passwords in Everything) in his blog this week. And, before you ask: yes, I am down with OTP. You know me. tags: nick moffitt opie one-time password

Eric, I don't know where you are in Brooklyn, but the NYSC in Boerum Hill has some squash going on.

I love that one of the benefits to working on free software is that it exposes you to tools that you wouldn't normally be aware of. A prime example is software that you can use for writing documentation, like LaTeX and revision control systems. At work I've been writing up a fairly long document. Normally at work I'm forced to use OO.o or word because I have to trade the file back and forth with my boss, but this time since I'm doing all the actual writing, I've been using LaTeX and git to manage the thing. In addition, I need a bibliography and references, so I basically needed something like LaTeX. I send my boss an rtf (made with latex2rtf) and pdf (made with pdflatex) when I want comments, and I can still use the highly structured style of LaTeX to make sure that things like my lists get formatted properly every single time. Trying to do this in Word was both frustrating and time consuming.

The best part about the experience has been using revision control though. Having atomic changesets with a log message is something we tend to take for granted in free software work, but compare it to the change tracking in OO.o and Word. It's amazing how much easier it makes it. I can actually see what I was thinking a few days ago, which was the last time I had been revising the document. Being able to visualize the changes and history with tools like qgit are even nicer. And tags... I don't think OO.o or Word lets you tag specific revisions, but I know that when I do this with Word, I end up with a ton of documents labeled "DavidRev1" and so forth, and I always mess up the revisions by using "Save" instead of "Save As".

And this doesn't even touch on the things I haven't done yet. I haven't done any branching, for example. I'm sure that when I write my thesis, I'll end up using that, but just knowing that it's available is exciting. The thing I wish I could do most though is actually put the repo up somewhere and have me and my boss actually use it the same way a normal shared source code repository is used.

The standard sorry ending to this story is that getting these things in broad use is basically a pipe dream. It continually amazes me that people will put up with Word or Powerpoint when it's so often the wrong tool for the job. The simplest things, like being able to look at a document's history and the diff and know in a minute exactly what you were thinking when you put down your work a week ago, help so much. It's sad because the technology problem has been largely solved (a small GUI frontend would be the last piece), but the evangelism problem remains. One thing is for sure, I'm not looking forward to writing my next paper in Word.

Yay! We finally have snow! I took a picture, but need to charge the batteries in order to get it off of the camera. And for that, I need to find the charger in one of these boxes...

It's an odd feeling, realising that this is the last Christmas that Angie and I get calmly to ourselves. Sprout will be ~9 months old next Christmas, certainly old enough to enjoy shiny light s and music and such, even if (s)he* will be unaware of what's actually happening. We've been making the most of being lazy: Sleeping in, reading books, hacking hppa on Feisty... The types of things that a person can enjoy on a lazy day. =)

Moving has been going really well. While we still have a fair bit to unpack, it's past the overwhelming stage. We spent a bit of time this weekend clearing space for things like cooking and walking. We even managed to get a tree up, although the decorations are quite minimal this year.

We have the last of our moving to do today. A last round of a few plants, and a couple breakables that we didn't want handled by the movers. The new subletters show up tomorrow and then we're basically done with the old place.

Everything so far feels like a great close to 2006.

Amis and Paiwan input method and character set Arne G tje ( ) created:

• a working SCIM input method for Amis
• a test text file with all the Amis characters
• a working SCIM input method for Paiwan
• a test text file with all the Paiwan characters
• a Browser test for Amis and Paiwan

The scripts, especially Amis, make heavy use of Unicode combination characters. They should display well at least with the Dejavu Sans font in many applications. Try it out: if it displays correctly, you should see:

• accented letters instead of letters next to accents.
• i with both the dot and the accent.

Update: there is now a wiki page on i18n.debian.net.

Replace nautilus with pcmanfm I'm sponsoring the upload of pcmanfm and I think it's a very interesting piece of software. There's a new upload coming, and I'd like it to have some instructions on how to replace nautilus with pcmanfm, and possibly how to go back to nautilus. Here's the best I found. Replacing nautilus with pcmanfm To have pcmanfm start instead of nautilus:

1. Go to Desktop -> Preferences -> Session manager
2. Go to the 'Current Session' tab
3. There's an entry like 40 Restart nautilus --sm-config-prefix /nautilus-SoMeThInG/: remove it
4. Go to the 'Startup Programs'
5. Add an entry to run pcmanfm

Alternatively:

1. Run gnome-session-remove nautilus
2. Go to Desktop -> Preferences -> Session manager
3. Go to the 'Startup Programs'
4. Add an entry to run pcmanfm

To configure pcmanfm to draw the background:

1. Run pcmanfm
2. Go to Edit -> Preferences
3. Go to the Desktop tab
4. Enable "Show file icons on desktop"
5. Customise wallpaper as you wish

Alternatively, I wrote a little script that will generate a ~/.pcmanfm/main configuration file from you taking some settings from gconf:

#!/bin/bash
# Generate a pcmanfm configuration file reading values from gconf
echo "# ~/.pcmanfm/main configuration file generated by $0"
echo
echo '[General]'
echo 'terminal=gnome-terminal'
echo
echo '[Desktop]'
echo 'showDesktop=1'
# Detect wallpaper setting
WALLPAPER= gconftool-2 --get /desktop/gnome/background/picture_filename 
if ! [ -z "$WALLPAPER" ]
then
    echo 'showWallpaper=1'
    echo "wallpaper=$WALLPAPER"
fi
# Detect color setting (doesn't really work: I could not find significant keys)
#COLOR= gconftool-2 --get /desktop/gnome/background/primary_color 
#if ! [ -z "$COLOR" ]
#then
#   R=$(( $(printf %d 0x$ COLOR:1:2 ) * 65536 / 256 ))
#   G=$(( $(printf %d 0x$ COLOR:3:2 ) * 65536 / 256 ))
#   B=$(( $(printf %d 0x$ COLOR:5:2 ) * 65536 / 256 ))
#   echo "Bg1=$R,$G,$B"
#fi

Getting nautilus again

1. Kill pcmanfm
2. Run nautilus: it will register itself with the session manager

Open questions Originally, I had nautilus registered in the session manager as something like nautilus --sm-config-prefix /nautilus-SoMeThInG/. After removing it and having it reregister itself, I have it only as nautilus. I have not been able to find out what is the difference. It would also be cool to have a little program that registers pcmanfm as a 'Restart' entry with priority 40, just like nautilus.

Chris Samual writes a good summary of Peter Gutmann's analysis of the cost of Vista (in terms of DRM).

The following paragraph in the article however seemed more interesting to me:
Once a weakness is found in a particular driver or device, that driver will have its signature revoked by Microsoft, which means that it will cease to function (details on this are a bit vague here, presumably some minimum functionality like generic 640x480 VGA support will still be available in order for the system to boot). This means that a report of a compromise of a particular driver or device will cause all support for that device worldwide to be turned off until a fix can be found.

Now just imagine that you want to cause widespread disruption - a DOS (Denial Of Service) attack against Windows users. What better option than to cause most of them to have hardware that's not acceptable to the OS? I expect that there will be many instances of security holes in drivers and hardware being concealed by MS because they can't afford the PR problems resulting from making millions of machines cease functioning. But just imagine that someone finds hardware vulnerabilities in a couple of common graphics drivers or pieces of hardware and publicly releases exploits shortly before a major holiday. If it's public enough (EG posted to a few mailing lists and faxed to some major newspapers) then MS would be forced to invoke the DRM measures or lose face in a significant way. Just imagine the results of stopping 1/3 of machines working just before Christmas!

Of course after the first few incidents people will learn. It shouldn't be difficult to configure a firewall to prevent all access to MS servers so that they can't revoke access, after all our PCs are important enough to us that we don't want some jerk in Redmond just turning them off. Of course disabling connections to MS would also disable security updates - but we all know that usability is more important than security to the vast majority of users (witness the number of people who happily keep using a machine that they know to be infected with a virus or trojan).

If this happens and firewalling MS servers becomes a common action, I wonder if MS will attempt the typical malware techniques of using servers in other countries with random port numbers to get past firewalls. Maybe Windows updates could be spread virally between PCs, this method would allow infecting machines that aren't connected to the net via laptops.

Finally, I recommend that people who are interested in such things read Eastern Standard Tribe by Cory Doctorow, he has some interesting ideas about people DOSing corporations that they work for which seem surprisingly similar to what MS is doing to itself. I'll post about my own observations of corporations DOSing themselves in the near future.

I managed to have the Xmas eve I wanted to. I stayed at home, alone, I didn t eat anything special, I went to bed at 21:30, sober, watched a wonderfully strange movie on my laptop until I fell asleep (with the laptop, and both cats on my bed), and got up today at 07:45.

Of course I was only free from all the family pressures because I was sick enough to be excused, but so far, this has been the best Xmas eve I ever had.

I missed the ugly, quickly and mindlessly bought, presents, the old time quarrels that arise as the wine gets drunk, the unbearable Xmas TV show as a background and the inability to turn the damn TV off!

I also skipped meeting family members that made my childhood and teenage years hell, pretended my abusive father was not hurting me, my sister and my mother, and never did anything about it, never loved me the way I am, don t respect the way I live and don t acknowledge what I see as my achievements in life, because I have always been too fat for them, not feminine enough for them, I never finished college (that I paid for by myself, and certainly not for them ), and refuse to eat animal corpses.

Anyway, don t get too worried, I was only sick from eating too much chocolate and Xmas sweets the day before ;)

(and I am perfectly fine with the family I was blessed with, because, in a wicked way, they taught me not to be judgemental, to have lots of empathy, to be less rigid, to accept people as they are and not as I would want them to be, to see the beauty in people fatter than chopsticks, to do things for myself and not to please others, to be independent, to want to live differently, and to have the courage to stand up to the people like them in the world, and more importantly, they taught me to love myself despite the worth that the rest of the world might think I have).

If you happen to have a nicer family, enjoy them, but not because it is $HOLIDAY, enjoy them because you have them. And stop buying like there s no tomorrow, for ecology s sake!

If, by some sort of Christmas miracle, all pending debconf translation bugs get fixed in one day, French debconf translations would reach 100% completeness (the real status is 96.16% today). The Czech team reached this briefly in the past and it's a pretty long time since we're hunting that moving target. Thanks to the release process, package maintainers have stopped changing their debconf templates daily and, with the incredible work of Thomas Huriaux, we've been able to reach that Nirvana.

We had a tough time getting out of Encinitas yesterday. It seems like everything was going wrong. I'd forgotten to order food for a sick aunt and her family in New Jersey the night before, so I was scrambling with apologies and new orders all morning. Then, when we finally got out of town, we hit traffic for about an hour near Santa Ana. Blech! Fortunately, it's a nice stretch of California highway, and we could see Catalina Island off on the horizon to the west. Our Christmas-eve-eve (or Festivus, if you will) was spent at Maj's parents' house in Long Beach, with about 30+ Jenkinses plus various offshoots and friendly relations. They have a huge house near Long Beach/Belmont Shore, with a giant tiled patio area that goes right into the house. It was a good place for a party. Amita June got some nice gifts from family, including a screaming monkey doll dressed as Superman. Yeah, we already have one screaming monkey doll with an "I LA" t-shirt, so this new one will join our growing collection of screaming monkeys with poor sartorial taste. tags: christmas belmont shore festivus long beach amita june

Typewriters are broken Yesterday Amita June and I were playing with pyKeys, from the awesome pyToddler suite of tools, and I realized that typewriter keyboards are broken. I was showing her that when she pushed on the key marked "Q", a "Q" would appear on the screen. But that's not what happened: instead, a "q" appeared on the screen. That's not a bug in pyToddler, of course: that's just the way typewriters work. If you click on the button marked with a capital letter, it prints the lowercase letter on the paper or screen. To get the capital letter itself, you have to put the keyboard in another mode, or use a modifying chord key. I'm not sure why this is the case. It's clear why we use modifier keys to make capitals, since we type lowercase keys much more often. But why do keyboards show the capitals printed on the keys, then? tags: typewriter keyboard pytoddler pykeys

Free Culture Christmas If there's anything that gives a bracing jolt of Christmas cheer, it's 235 Creative Commons Christmas songs. Thanks to Uwe Hermann for compiling this fine list. tags: cc christmas open content music christmas song

I'm pretty happy about the way the 'Ten Web 2.0 APIs you can really use' episode of the LinuxCast came out so well. I'm not very used to talking for recording, and like everyone I don't particularly enjoy hearing my own voice recorded (do I really sound like that?), but it was fun to do, and I think it's a nice adjunct to the Ten Web 2.0 APIs you can really use article itself. tags: api podcast linuxcast linuxworld

Tijuana We're on a trip in Southern California this week, so we decided yesterday to go to Tijuana for the day. Maj, Amita June and I got out of the condo we're staying at in Encinitas early in the morning -- well, early for a vacation day -- and headed down to downtown San Diego. It's a trip of about 25 miles, with one tricky turnoff at highway 805 that seems to get me every time I visit this part of the world. Going into Mexico with a car can be a bit of a hassle. Many American insurers don't cover cars going into Mexico, and you'll often get asked about insurance when you cross over. There are some quick-and-dirty insurers on the border that can give you one-day insurance or other short-term coverage, but we have a rental car right now, and most (all?) rental car companies forbid with bitter, mouth-foaming forbiddance driving the car across the border. Fortunately for us, San Diego has a great way around this problem. Their trolley system goes from downtown San Diego right up to the border in San Ysidro. So, we picked it up in the Civic Center downtown, after a brief stop at the Downtown San Diego Vistors Center (to get tourist material), a shopping foray at a stall outside of the downtown Macy's (to get Amita June a pair of purple Crocs), and a side trip into the Westin for a bathroom break. Man, the Westin in San Diego has nice bathrooms! I'd heard about these trolleys in the past, and I guess I'd expected a kind of fancy tourist train, but it's really just the Blue Line for typical light-rail trains for San Diego and its suburbs. The seats were comfortable, but the train right-of-way went through some of the least scenic parts of Southern California I've ever seen. There's something about this corner of the United States of America that's depressing and end-of-the-world; I get the same feeling about other borderlands, like around Plattsburgh and Laredo. The end of the line for the trolley is completely opaque as to how get into Mexico. We wandered around past some ugly strip malls until Maj spotted a tiny oblique walkway that said "US PROPERTY SUBJECT TO SEARCH AND FINE" and in much smaller letters "a Mexico - to Mexico". We went through a wiggly walkway and across the no-man's land between the scary metal fence at the US border and the actual Mexican customs area. Nobody was there, but we got the feeling we were being watched. At the end of this weird walk was a very nice tourist info center, where we got some maps and brochures and such. Another 10 minutes walk through the streets up against the fence, we got to Avenida Revolucion, the central way through the Tijuana/Zona Centro. It had been a while since we'd been to a city with aggressive touts, so getting yelled at by people in shop doorways or in the street was a bit of a jolt. I hate the invasion of my anonymity, and I'm pretty reflexive about saying "NO NO NO NO NO" to everyone, but Maj is a little more practical. "If everything is run by aggressive sideshow barkers, you're going to miss out on everything," she points out. "Sometimes, you have to say 'yes', even if you don't like the way the question was asked." By the time we hit av. Revolution, we were pretty tired, so we stumbled into the first restaurant we found -- El Torito, a big nightclub with go-go cages, a mechanical bull, and a tattoo parlour on premises. I was attracted by the racy Absinth Mexico posters. "Family restaurant, family place," said the touts, seeing the baby in the stroller. Sure. The food wasn't bad -- I made the mistake of ordering the fish Vera Cruz, but the waiter made a smelly-face and suggested I get the shrimp instead -- and the cocktails at 1PM were generous and inexpensive. Probably the nicest part was a guy with a guitar who came over and asked to sing. "We've got enough music," said Maj, pointing at the ceiling where loud disco tunes were booming. But he was insistent, so we let him play, and he sang a loud Besa Me Mucho that drowned out the Ricky Martin and had us, the waiter, and nearby diners singing along by the end. Amita June was fascinated by the sounds, and clapped along when he was done. After lunch we walked down av. Revolucion, which had a dense layer of souvenir shops and discount pharmacies offering Viagra and Cipro without a prescription. One weird repeated theme was donkeys painted as zebras, hooked up to carts where you could sit and get your picture taken for $2. Some of the donkeys looked pretty good in their zebra stripes, but most looked pretty bummed out. I'm not sure why tourists would expect to get their picture taken with a zebra while in northern Mexico. It got a lot nicer as we got down to the end of the block, and we kicked ourselves for being so lazy when we passed Chiki Jai, a charming little restaurant with tiled walls and rough wood furniture. Much more to our tastes than El Torito. We stopped at the monumental Jai Alai courts, with a beautiful facade and a nice statue out front. Ducking into the Tia Juana's next door, we did a diaper-change break and had some chips and salsa and pineapple juice (and Dos Equis Dark on tap for Papa). Then we started walking back to the border. On our way back, we got off of Revolucion and walked over to the city's Cathedral. It was a much more realistic part of the town -- shopping and bars and restaurants, true, but less ridiculous touristy crap. When we got to the cathedral, there was a holiday street fair going outside, with games and food stalls and people laughing and walking around with kids. It felt a little more human than the pressure-tactics-dense world of Revolucion. On our way back to the border crossing, we dipped briefly into the red light district at the head of av. Constitucion (who knew?), then made the long slog back to the USA. We didn't get much in the way of souvenirs, but Maj bought a nice set of luchador dolls for her brother, complete with a tiny wrestling ring. The line at the border was huge, and we had to wait at the trolley station for another 30 minutes before one left for SD again. By the time we got back downtown, around 5:30, we really weren't up for a dinner in the San Diego/Gaslamp Quarter like we'd originally planned. So we piled into the car, paid the $20 parking to get out, and headed right into rush-hour traffic that led to the over-populated and under-networked North County (San Diego County). Would I take the trolley to Tijuana again? Maybe. Next time, I'd probably go to one of the stops between San Diego and San Ysidro, where there are free parking lots and a little less hassle. tags: tijuana san diego travel san ysidro

Hazards of vacation homes I was just rifling through the fridge here at the condo in Encinitas and found what I thought was a delicious Abita beer, the fine drink you have when you can't handle another hurricane in New Orleans. But it turned out to be an Abita Purple Haze, a gross raspberry-wheat beverage. Unfair! It has probably been stuck in the back of the fridge of this condo for years. Fortunately there was still another Stone Pale Ale, from the North County local microbrewery, to satisfy my lunchtime beer needs. tags: stone brewing abita beer

Hardware sucks. It just totally and utterly sucks. I purchased a 300 GB hard drive (plus a 3.5" USB disk drive enclosure) roughly 8 months ago which I encrypted using dm-crypt and then used it as a backup medium. And now the disk has died. No, this is not a software problem (that would be easy to deal with), the hardware is simply dead (it's making funny "klck" noises all the time). Mounting it via USB (using the USB enclosure) doesn't work at all anymore. I connected the disk via IDE in a PC and was able to mount it just fine (with cryptsetup luksOpen and all). A simple ls works, too (at least in the top-level directory). So I tried to copy the data over to another medium, but when accessing certain directories or files the system simply hangs and I get tons of funny kernel errors (and the disk makes even more and louder funny noises). Great. Stupid as I am, I also put data on the drive which I did not have backups of on other media (mostly because the data is huge, e.g. conference video recordings, large amounts of Creative Commons MP3s etc). OK, so I managed to get at least some small parts of my data, but now the disk is completely dead, I fear. I'll try to convice the vendor to give me a new drive, but I won't let them get their fingers on my data, i.e., I will not send the disk to them (yes, even though it is encrypted; crypto can be broken). Any ideas what else I could do? A professional "data recovery" service is not an option either, they usually cost 1000-2000 Euros (in the best case). What do you do for storing huge amounts of data nowadays? The only viable option I can think of is a RAID-5 (mdadm) with 3 or more disks in a silent PC which I can leave turned on 24/7. Unfortunately that costs non-trivial amounts of money. CDs are too small and they don't last too long either; the same is true for DVDs. Sigh...

Joey and Josselin, I'm calling you childish, not because you "stand" your principles, but because of the way you try to convince others that your principles are better. What you are using is:

• Insults ("lying", and for the record, FUD means twisting the facts and telling only half the story, and you are twisting the facts, as I detailed in my post; "should read constitution", which of course means to imply that I'm trying to deny you some constitutional right, which I'm not, I'm just asking you to stop spreading FUD)
• Blackmail and threats ("I'll stop contributing" [if dunc-bank is paying anyone], "reduced it much less than I could, probably much less than I should")
• Schadenfreude (the libpng mishap of the new maintainer; noone broke libpng intentionally. That is not a nice character trait, and pollutes the community)
• You seriously annoy people by going on and on and on, while everybody has already understood your opinion and arguments (and just happens to have a different opinion)
• Playing big words without actual content ("read the constitution 2.1.1", which btw. also states that you "must not actively work against these rules and decisions properly made under them"; your attempt at a GR failed, and you are working against these decisions on planet; I've however never said that you're oblieged to still work for Debian if you don't like the decision)

Actually, I'm by now convinced that it would have been better for Debian, if you would just have really left. Your behaviour in the last months makes you qualify as "poisonous people" (except these usually aren't big contributors). In my opinion, your infighting has harmed the project, it gives people the impression that being involved in Debian means mostly having to deal with such things. While it's not - Debian is still fun to me, although I have little time, and didn't manage to go to the last few Debian meetings here in Munich - all these fights are a nuisance to me. Even though I'm not actually affected by them (neither Dunc-Tank, because it doesn't demotivate me, nur the powerpc fights, nor some other fights on -private), the way they are dicussed on the Debian lists does annoy me. Again: if anything is cutting on my motiviation, it's your behaviour (this btw. includes the powerpc issue and fighters, too, especially Sven Luther who has probably sent as many mails as all others together, just reiterating the same things again and again). So if you are planning to become a Debian contributor, learn to use the "delete" button in your email clients, and don't be afraid to just delete whole threads. Certain threads are just a waste of time and bring negative emotions. So: Joey, Josselin: grow up, and accept that people sometimes have a different opinion, and you can achieve more by accepting that your opinions differ and just try to make the most of it anyway. Reminding them of your differences won't make them change their mind, nor will it make them like you any better. Fortunately, most people in the project (well, everybody except me?) seem to obey above "poisoned people" recommendations, and just ignored your posts on this issue. I didn't, and one of the reasons it that I feared Joeys first post could grab some media attention, and I felt there should be at least one post saying that, well, the debian-installer and some other RC bugs are probably also a cause of the delay, and it's probably not worth rehashing the dunc-bank issue. So far, I've only seen one news article citing aba that the delay was caused by the debian installer among others, no "the delay is due to dunc-bank demotivating all developers" FUD.

The delay of Debian Etch caught some bad press this week. Some articles compare Debian to Ubuntu (which tries hard to have fixed-time releases), and some bloggers are amused by the fact that the next Debian release was delayed “again”. There are some important points though:

• Etch wasn’t really scheduled to be released on Dec 4th. This target date was mainly used to determine other dates in the release process, like the freeze dates.
• Ubuntu Dapper was delayed as well, for 6 weeks. Ubuntu Edgy wasn’t delayed, but I don’t think anybody can seriously compare Ubuntu Edgy’s quality with the upcoming Debian etch’s quality: edgy was more like a technology preview.

Now, the question is: how good is Debian Etch compared to Ubuntu Dapper ? It’s difficult to compare distributions: there aren’t a lot of good metrics for this. Of course, one could compare the number of packages that fail to build from source (it’s a good indicator of something seriously wrong in a package). But a lot of work has been done on etch about this, so it wouldn’t really be fair for Ubuntu. A good alternative is debcheck. debcheck checks that packages can be installed (i.e that their dependancies can be satisfied). It does so by analyzing the content of the Packages files. I compared the results of debcheck on etch as of today (I re-processed it, but the same results are available from qa.d.o), and of debcheck on Dapper (not including dapper-updates - I wanted to compare quality at release date). Included sections were main for etch, and main, restricted and universe for dapper (I didn’t want to consider non-free packages, since their quality tend to be lower). Results: 4 packages have unsatisfiable Depends on etch, on i386. 49 have unsatisfiable Recommends. In the main section of Dapper, still on i386, only one package has a problem with its Depends (it was psycopg, because its binary package python2.3-psycopg has a dependancy on python2.3-egenix-mxdatetime). 46 packages in main had unsatisfiable Recommends. This is better than Etch, of course, but Ubuntu/main is much smaller than Debian/main. When restricted and universe are included, the results are much worse. 80 packages have unsatisfiable Depends, and 150 packages have unsatisfiable Recommends. It is worth noting that those numbers are worse than those of Debian unstable as of today (67 packages have unsat Depends, 34 have unsat Recommends). Conclusions (sort of):

• Using the debcheck metric (which is actually quite important, since it translates in uninstallable packages for the users), Debian etch is already of better quality than Ubuntu Dapper when it was released (again, I haven’t checked with dapper-updates included).
• It would be great to integrate such tests into the Ubuntu release process. Fixing bug is good, but such tools help to improve the distribution quality as a whole. I’ll try to work on this for Feisty after the Etch release.

For various reasons, Software in the Public Interest (SPI) owned the domains opensource.org and opensource.net, which have been managed by the Open Source Initiative (OSI) for most of their life. This supported various SPI goals and also gave a possibility of community control of opensource.org/net just in case it was ever needed. OSI does not offer much opportunity for community control, as it is a self-appointing board. (Regular readers may remember that the principles of democratic member control, autonomy and concern for community are important to me.) I was watching as the SPI board voted in favour of giving away the opensource domains, proposal 2006-11-18.dbg.mjs.1 on the agenda. The vote happened without any discussion in the meeting. From memory (I guess logs will appear on the SPI site eventually):- David Graham ("SPI must also be involved in the promotion of and education about open source") proposed and voted for this action that stops SPI being involved in this promotion and education about open source; Michael Schultheiss ("I look forward to SPI's future expansion") (amended and?) voted for this action that reduces SPI; Neil McGovern ("achieve a greater degree of involvement [...] from the community in general") voted for this action that lessens SPI's involvement; Jimmy Kaplowitz ("It is important that it continue holding in trust the money and other legal assets belonging to its member projects [...] fulfill some more of its stated corporate purposes, involving education of the general public about free software and about computers in general") voted for this action that drops these assets and reduces involvement in education of the general public; Bdale Garbee ("would like to close this issue one way or another, once and for all") seemed willing to vote for anything which prevented further discussion - of course, only surrendering the domains could close it once and for all, as this is a one-way trapdoor topic - but had apologised for absence from the meeting; Martin "Joey" Schulze had apologised for absence from the meeting; Josh Berkus (nothing obviously relevant in his platform) abstained - consistent but disappointing; I think Branden Robinson was missing. Ian Jackson ("SPI's role is to provide a stable legal entity which can hold assets") voted against this action so that SPI would keep holding these assets. Bravo! Sources: The quotes above are the board's own promises in their election platforms, as listed on the SPI site in 2003 2006 apart from Bdale Garbee's platform which wasn't at the link given in 2004 so that quote is from the minutes of the previous meeting If some board members are willing to give away assets for no good reason, that strikes at one of SPI's core methods: holding assets for the community. What can we trust about this board? Their platforms are full of fine sentiments, but how do their actions reflect their platforms? This may be a mostly-dormant issue until the next election. If you want any of SPI's assets, just ask. If your request is rejected (as SPI rejected the opensource domain give-away before), just keep asking new sets of voters until they agree.

In part 1, I described the problem of software installation on Linux; in part 2, I’ll describe the solution we came up with at the recent LSB Packaging Summit. After reading through the comments to part 1, let me first point out that our goal is to create a vibrant third party software ecosystem around Linux—you know, like the one Microsoft has built around Windows. No, it’s not about imitating Microsoft. It’s about being competitive. A platform is only as good as the applications that run on it. Bottom line: Many third parties have built their businesses around proprietary software, and we can’t just ignore them. And “ecosystem” implies decentralized, which I argued in part 1 was a key tenet of open source development anyway, i.e., this should be playing to one of our core strengths. So, if your “solution” is to tell ISVs (independent software vendors) to give us their source code so the distributions can include it because that’s just how we do things, you can safely skip the rest of the post below. You’re simply not going to agree that any of this is a problem. Ok. Assuming our goal is to create a vibrant third party software ecosystem (and everyone still reading agrees that’s a good goal, right?), we have the following challenges. First of all, the distribution vendors are hugely invested in their existing package systems, and for the most part, those package systems work extremely well. As I said in part 1, “if [an application] is in your distro of choice, you re only an apt-get or a yum install away from running it.” (I’m saying it again here because some of the commenters apparently didn’t see that. The tricky bit is “in your distro of choice”, which by definition is not the case with third party software.) Furthermore, a variety of highly sophisticated systems management solutions are built above those package systems, such as Red Hat Network and Novell ZENworks. This is a pretty important consideration, because these days, the “software management problem” largely involves managing software across the entire infrastructure, not just a single system. What problem then? This: ISVs have thus far been reluctant to use the native package systems. Why? THEY’RE hugely invested in “package systems” for other platforms, and every Linux specific thing they have to support costs money. In a world where decisions are ruled by cost vs. benefit, this is a pretty important consideration too. How do ISVs handle this today? For the most part, they ignore the package systems on Linux and do their own thing. Trouble is, while doing their own thing gives ISVs the flexibility to work cross platform, it ultimately makes their products integrate poorly in the broader systems management context because the package systems know nothing about them. What is needed is a way to bridge the gap between what the distros provide and what the ISVs want. But how? First off, we have to understand what ISVs want. The answer is simple: ISVs want to treat Linux as a single platform, which means they want to offer a single package for Linux, much as they do for Windows. So, if one commenter is right that “[t]he problem is that people (including software distributors) believe there s such [a] thing as ‘Linux’ as a target platform” and that “[i]f you re distributing software for ‘Linux’ then it won t be simple to install it, ever”, well, then Linux is destined to suffer the fate of UNIX. I’m not ready to give up so easily. Several commenters suggested that what we need is a brand new package system. That’s a non-starter—for one thing, the distros aren’t going to be too keen on replacing something they’re hugely invested in, and if ISVs aren’t going for RPM today, why would they go for something different tomorrow? No, to find a way forward, we need an evolutionary step from where we are today. From there, perhaps we can do more, but even the first steps can be quite valuable in their own right. To help find those first steps, we put some of the leading minds in Linux packaging in the same room (including the maintainers of RPM at Red Hat and Novell and the authors/maintainers of APT, yum, alien, and klik) along with ISVs large and small, server and desktop. The discussion pretty quickly converged on constructing a single API that could be implemented across the various package systems, because APIs make for nice evolutionary steps and can, done right, mask underlying implementation differences. Question is, what do ISVs need in such an API? Limiting the scope is key here, because providing an API that spans all the functionality of, say, RPM and dpkg is overwhelming to the point of being unworkable, not to mention more work to implement, which in turn makes it less likely to get into the distros so that ISVs can count on it being there, the whole point of this exercise in the first place. Fortunately, the ISVs don’t really need much. At the most basic level, an installer just needs to be able to query the system to see if it’s LSB compliant, and if it is, what version of the LSB it’s compliant with; and it needs to be able to “register” with the package system, so the package system knows about it, including what files it has installed. And that’s really about it. Importantly, because we assume an environment that’s LSB compliant, we don’t have to worry about dependencies, because everything is covered by the single LSB dependency, and dependency management is 95% of the package systems right there. We still need minimal dependency support—components can extend the LSB, and applications can depend on those other components being installed—but we’re talking on the order of a handful of components, not the tens of thousands of components typical package systems have to deal with. We only had a day, so we obviously don’t have a complete solution yet. For one thing, we barely touched on the issue of uninstallation (should we allow applications to register GUI uninstallers?), and the issue of how applications go about changing the system configuration still needs discussion (in a lot of cases, the assumption of LSB compliance means the installer is going to be well behaved, but there’s undoubtedly corner cases to be explored). And it’s going to take time for the API to be implemented and put into widespread enough use that ISVs can depend on it. However, everyone in the room did come to consensus pretty quickly that this was an important problem, and that providing a simple API that provides the minimum necessary functionality was the way to go. Perhaps most exciting, the very people whose support are needed to put the API into widespread use were in that room, and active participants in the discussion too. Everyone is certainly motivated: The distros get more applications, which makes the shared platform more attractive; and ISVs get lower cost, which tilts the cost vs. benefit equation in their favor, making Linux versions more economically attractive and potentially opening new markets. Because this is just a start, the FSG is launching a Packaging workgroup to continue the discussion we started at the Packaging Summit. If you’re interested in this topic, I’d encourage you to join the mailing list and get involved. There’s still plenty to be done. Update: One more thing: In addition to making it easier for ISVs to better support Linux by simply extending their existing installation scripts, the API approach really comes into its own when you imagine it implemented in things like Autopackage and InstallAnywhere. Let the market decide!