First of all, congratulations to all those who got us 2022 Debconf, so we will finally have a debconf in India. There is of course, lot of work to be done between now and then. For those who would be looking forward to visit India and especially Kochi I would suggest you to hear this enriching tale
I am sorry I used youtube link but it is too good a podcast not to be shared. Those who don t want youtube can use the invidio.us link for the same as shared below.
https://www.invidio.us/watch?v=BvjgKuKmnQ4
I am sure there are lot more details, questions, answers etc. but would direct them gently to Praveen, Shruti, Balasankar and the rest who are from Kochi to answer if you have any questions about that history.
National Science Day, GMRT 2020
First, as always, we are and were grateful to both NCRA as well as GMRT for taking such good care of us. Even though Akshat was not around, probably getting engaged, a few of us were there. About 6-7 from the Mozilla Nasik while the rest representing the foss community. Here is a small picture which commentrates the event
National Science Day, GMRT 2020
While there is and was a lot to share about the event. For e.g. Akshay had bought RPI- Zero as well as RPI-2 (Raspberry Pi s ) and showed some things. He had also bought up a Debian stable live drive with persistence although the glare from the sun was too much that we couldn t show it to clearly to students. This was also the case with RPI but still we shared what and how much we could. Maybe next year, we either ask them to have double screens or give us dark room so we can showcase things much better. We did try playing with contrast and all but it didn t have much of an effect . Of course in another stall few students had used RPI s as part of their projects so at times we did tell some of the newbies to go to those stalls and see and ask about those projects so they would have a much wider experience of things. The Mozilla people were pushing VR as well as Mozilla lite the browser for the mobile.
We also gossiped quite a bit. I shared about indicatelts , a third-party certificate extension although I dunno if I should file a wnpp about it or not. We didn t have a good experience of when I had put an RFP (Request for Package) which was accepted for an extension which had similar functionality which we later come to know was sharing the sites people were using the extension to call home and share both the URL and the IP Address they were using it from. Sadly, didn t leave a good taste in mouth
Delhi Riots
One thing I have been disappointed with is the lack of general awareness about things especially in the youth. We have people who didn t know that for e.g. in the Delhi riots which happened recently the law and order (Police) lies with Home Minister of India, Amit Shah. This is perhaps the only capital in the world which has its own Chief Minister but doesn t have any say on its law and order. And this has been the case for last 70 years i.e. since independance. The closest I know so far is the UK but they too changed their tune in 2012. India and especially Delhi seems to be in a time-capsule which while being dysfunctional somehow is made to work. In many ways, it s three body or a body split into three personalities which often makes governance a messy issue but that probably is a topic for another day. In fact, scroll had written a beautiful editorial that full statehood for Delhi was not only Arvind Kejriwal s call (AAP) but also something that both BJP as well as Congress had asked in the past. In fact, nothing about the policing is in AAP s power. All salaries, postings, transfers of police personnel everything is done by the Home Ministry, so if any blame has to be given it has to be given to the Home Ministry for the same.
American Capitalism and Ventilators
America had been having a history of high cost healthcare as can be seen in this edition of USA today from 2017 . The Affordable Care Act was signed as a law by President Obama in 2010 which Mr. Trump curtailed when he came into power couple of years back. An estimated 80,000 people died due to seasonal flu in 2018-19 . Similarly, anywhere between 24-63,000 have supposed to have died from Last October to February-March this year. Now if the richest country can t take care of their population which is 1/3rd of the population of this country while at the same time United States has thrice the area that India has. This I am sharing as seasonal flu also strikes the elderly as well as young children more than adults. So in one senses, the vulnerable groups overlap although from some of the recent stats, for Covid-19 even those who are 20+ are also vulnerable but that s another story altogether.
If you see the CDC graph of the seasonal flu it is clear that American health experts knew about it. One another common factor which joins both the seasonal flu and covid is both need ventilators for the most serious cases. So, in 2007 it was decided that the number of ventilators needed to be ramped up, they had approximately 62k ventilators at that point in time all over U.S. The U.S. in 2010, asked for bids and got bid from a small californian company called Newport Medic Instruments. The price of the ventilators was approximately INR 700000 at 2010 prices, while Newport said they would be able to mass-produce at INR 200000 at 2010 prices. The company got the order and they started designing the model which needed to be certified by FDA. By 2011, they got the product ready when a big company called Covidgen bought Newport Medic and shutdown the project. This was shared in a press release in 2012. The whole story was broken by New York Times again, just a few days ago which highlighted how America s capitalism rough shod over public health and put people s life unnecessarily in jeopardy. If those new-age ventilators would have been a reality then not just U.S. but India and many other countries would have bought the ventilators as every county has same/similar needs but are unable to pay the high cost which in many cases would be passed on to their citizens either as price of service, or by raising taxes or a mixture of both with public being none the wiser. Due to dearth of ventilators and specialized people to operate it and space, there is possibility that many countries including India may have to make tough choices like Italian doctors had to make as to who to give ventilator to and have the mental and emotional guilt which would be associated with the choices made.
Some science coverage about diseases in wire and other publications
Since Covid coverage broke out, the wire has been bringing variousreports of India s handling of various epidemics, mysteries, some solved, some still remaining unsolved due to lack of interest or funding or both. The Nipah virus has been amply discussed in the movie Virus (2019) which I shared in the last blog post and how easily it could have been similar to Italy in Kerala. Thankfully, only 24 people including a nurse succumbed to that outbreak as shared in the movie. I had shared about Kerala nurses professionalism when I was in hospital couple of years back. It s no wonder that their understanding of hygeine and nursing procedures are a cut above the rest hence they are sought after not just in India but world-over including US and UK and the middle-east. Another study on respitory illness was bought to my attention by my friend Pavithran.
Possibility of extended lockdown in India
There was talk in the media of extended lockdown or better put an environment is being created so that an extended lockdown can be done. This is probably in part due to a mathematical model and its derivatives shared by two Indian-origin Cambridge scholars who predict that a minimum 49 days lockdown may be necessary to flatten the covid curve about a week back.
Predictions of the outcome of the current 21-day lockdown (Source: Rajesh Singh, R. Adhikari, Cambridge University)
Alternative lockdown strategies suggested by the Cambridge model (Source: Rajesh Singh, R. Adhikari, Cambridge University)
India caving to US pressure on Hydroxychloroquine
While there has been lot of speculation in U.S. about Hydroxychloroquine as the wonder cure, last night Mr. Trump threatened India in a response to a reporter that Mr. Modi has to say no for Hydroxychloroquine and there may be retaliations.
As shared before if youtube is not your cup you can see the same on invidio.us
https://www.invidio.us/watch?v=YP-ewgoJPLw
Now while there have been several instances in the past of U.S. trying to bully India, going all the way back to 1954. In fact, in recent memory, there were sanctions on India by US under Atal Bihari Vajpayee Government (BJP) 1998 but he didn t buckle under the pressure and now we see our current PM taking down our own notification from a day ago and not just sharing Hydroxychloroquine but also Paracetemol to other countries so it would look as if India is sharing with other countries. Keep in mind, that India, Brazil haven t seen eye to eye on trade agreements of late and Paracetemol prices have risen in India. The price rise has been because the API (Active Pharmaceutical Ingredients) for the same come from China where the supply chain will take time to be fixed and we would also have to open up, although should we, should we not is another question altogether. I talk about supply chains as lean supply chains were the talk since late 90 s when the Japanese introduced Just-in-time manufacturing which lead to lean supply chains as well as lot of outsourcing as consequence. Of course, the companies saved money but at the cost of flexibility and how this model was perhaps flawed was shared by a series of articles in Economist as early as 2004 when there were lot of shocks to that model and would be exaberated since then. There have been frequent shocks to these fragile ecosystem more since 2008 after the financial meltdown and this would put more companies out of business than ever before.
The MSME sector in India had already been severely impacted first by demonetization and then by the horrendous implementation of GST whose cries can be heard from all sectors. Also the frequent changing of GST taxes has made markets jumpy and investors unsure. With judgements such as retrospective taxes, AGR (Adjusted Gross Revenue) etc. it made not only the international investors scared, but also domestic investors. The flight of the capital has been noticeable. This I had shared before when Indian Government shared about LRS report which it hasn t since then. In fact Outlook Business had an interesting article about it where incidentally it talked about localcircles, a community networking platform where you get to know of lot of things and whom I am also a member of.
At the very end I apologize for not sharing the blog post before but then I was feeling down but then I m not the only one.
TL;DR; please help localizing Mailman3 [1]. You can find it on hosted Weblate [2].The next component releases are planned in 1-2 weeks from now. Thanks for your contribution! If you can't make it now, please consider working on Mailman3 translations at some later point of time. Thanks!
Time has come for Mailman3
Over the last months I have found an interest in Mailman3. Given the EOL of Python2 in January 2020 and also being a heavy Mailman2 provider for various of my projects and also for customers, I felt it was time to look at Mailman2's successor: Mailman3 [1].
One great novelty in Mailman3 is the strict split up between backend (Mailman Core), and the frontend components (django-mailman3, Postorius, Hyperkitty). All three are Django applications. Postorius is the list management web frontend whereas Hyperkitty is an archive viewer. Other than in Mailman2, you can also drop list posts into Hyperkitty directly (instead of sending a mail to the list). This makes Hyperkitty also some sort of forum software with a mailing list core in the back. The django-mailman3 module knits the previous two together (and handles account management, login dialog, profile settings, etc.).
Looking into Mailman3 Upstream Code
Some time back in midst 2019 I decided to deploy Mailman3 at a customer's site and also for my own business (which still is the test installation). Living and working in Germany, my customers' demand often is a fully localized WebUI. And at that time, Mailman3 could not provide this. Many exposed parts of the Mailman3 components were still not localized (or not localizable).
Together with my employee I put some hours of effort into providing merge requests, filing bug reports, request better Weblate integration (meaning: hosted Weblate), improving the membership scripting support, etc. It felt a bit like setting the whole i18n thing in motion.
Call for Translations
Over the past months I had to focus on other work and two days ago I was delighted that Abhilash Raj (one of the Mailman3 upstream maintainers) informed me (via closing one of the related bugs [3]) that Mailman3 is now fully integrated with the hosted Weblate service and a continous translation workflow is set to go.
The current translation stati of the Mailman3 components are at ~ 10%. We can do better than this, I sense.
So, if you are a non-native English speaker and feel like contributing to Mailman3, please visit the hosted Weblate site [2], sign up for an account (if you don't have one already), and chime in into the translation of one of the future mailing list software suites run by many FLOSS projects all around the globe. Thanks a lot for your help.
As a side note, if you plan working on translating Mailman Core into your language (and can't find it in the list of supported languages), please request this new language via the Weblate UI. All other components have all available languages enabled by default.
References:
There have been lot of stories about Coronavirus and with it a lot of political blame-game has been happening. The first step that India took of a lockdown is and was a good step but without having a plan as to how especially the poor and the needy and especially the huge migrant population that India has (internal migration) be affected by it. A 2019 World Economic Forum shares the stats. as 139 million people. That is a huge amount of people and there are a variety of both push and pull factors which has displaced these huge number of people. While there have been attempts in the past and probably will continue in future they will be hampered unless we have trust-worthy data which is where there is lots that need to be done. In the recent few years, both the primary and secondary data has generated lot of controversies within India as well as abroad so no point in rehashing all of that. Even the definition of who is a migrant needs to be well-established just as who is a farmer . The simplest lucanae in the later is those who have land are known as farmers but the tenant farmers and their wives are not added as farmers hence the true numbers are never known. Is this an India-specific problem or similar definition issues are there in the rest of the world I don t know.
How our Policies fail to reach the poor and the vulnerable
The sad part is most policies in India are made in castles in the air . An interview by the wire shares the conundrum of those who are affected and the policies which are enacted for them (it s a youtube video, sorry)
If one with an open and fresh mind sees the interview it is clear that why there was a huge reverse migration from Indian cities to villages. The poor and marginalized has always seen the Indian state as an extortive force so it doesn t make sense for them to be in the cities. The Prime Minister s annoucement of food for 3 months was a clear indication for the migrant population that for 3 months they will have no work. Faced with such a scenario, the best option for them was to return to their native places. While videos of huge number of migrants were shown of Delhi, this was the scenario of most states and cities, including Pune, my own city . Another interesting point which was made is most of the policies will need the migrants to be back in the villages. Most of these are tied to the accounts which are opened in villages, so even if they want to have the benefits they will have to migrate to villages in order to use them. Of course, everybody in India knows how leaky the administration is. The late Shri Rajiv Gandhi had famously and infamously remarked once how leaky the Public Distribution system and such systems are. It s only 10 paise out of rupee which reaches the poor. And he said this about 30 years ago. There have been numerous reports of both IPS (Indian Police Services) reforms and IAS (Indian Administrative Services) reforms over the years, many of the committee reports have been in public domain and in fact was part of the election manifesto of the ruling party in 2014 but no movement has happened on that part. The only thing which has happened is people from the ruling party have been appointed on various posts which is same as earlier governments.
I was discussing with a friend who is a contractor and builder about the construction labour issues which were pointed in the report and if it is true that many a times the migrant labour is not counted. While he shared a number of cases where he knew, a more recent case in public memory was when some labourers died while building Amanora mall which is perhaps one of largest malls in India. There were few accidents while constructing the mall. Apparently, the insurance money which should have gone to the migrant laborer was taken by somebody close to the developers who were building the mall. I have a friend in who lives in Jharkhand who is a labour officer. She has shared with me so many stories of how the labourers are exploited. Keep in mind she has been a labor officer appointed by the state and her salary is paid by the state. So she always has to maintain a balance of ensuring worker s rights and the interests of the state, private entities etc. which are usually in cahoots with the state and it is possible that lot of times the State wins over the worker s rights. Again, as a labour officer, she doesn t have that much power and when she was new to the work, she was often frustrated but as she remarked few months back, she has started taking it easy (routinized) as anyways it wasn t helping her in any good way. Also there have been plenty of cases of labor officers being murdered so its easier to understand why one tries to retain some sanity while doing their job.
The Indian response and the World Response
The Indian response has been the lockdown and very limited testing. We seem to be following the pattern of UK and U.S. which had been slow to respond and slow to testing. In the past Kerala showed the way but this time even that is not enough. At the end of the day we need to test, test and test just as shared by the WHO chairman. India is trying to create its own cheap test kits with ICMR approval, for e.g. a firm from my own city Pune MyLab has been given approval. We will know how good or bad they are only after they have been field-tested. For ventilators we have asked Mahindra and Mahindra even though there are companies like Allied Medical and others who have exported to EU and others which the Govt. is still taking time to think through. This is similar to how in UK some companies who are with the Govt. but who have no experience in making ventilators are been given orders while those who have experience and were exporting to Germany and other countries are not been given orders. The playbook is errily similar. In India, we don t have the infrastructure for any new patients, period. Heck only a couple of states have done something proper for the anganwadi workers. In fact, last year there were massive strikes by anganwadi workers all over India but only NDTV showed a bit of it along with some of the news channels from South India. Most mainstream channels chose to ignore it.
On the world stage, some of the other countries and how they have responded perhaps need sharing. For e.g. I didn t know that Cuba had so many doctors and the politics between it and Brazil. Or the interesting stats. shared by Andreas Backhaus which seems to show how distributed the issue (age-wise) is rather than just a few groups as has been told in Indian media. What was surprising for me is the 20-29 age group which has not been shared so much in the Indian media which is the bulk of our population. The HBR article also makes a few key points which I hope both the general public and policymakers both in India as well as elsewhere take note of.
What is worrying though that people can be infected twice or more as seems to be from Singapore or China and elsewhere. I have read enough of Robin Cook and Michael Crichton books to be aware that viruses can do whatever. They will over time mutate, how things will happen then is anybody s guess. What I found interesting is the world economic forum article which hypothesis that it may be two viruses which got together as well as research paper from journal from poteome research which has recently been published. The biggest myth flying around is that summer will halt or kill the spread which even some of my friends have been victim of . While a part of me wants to believe them, a simple scientific fact has been viruses have probably been around us and evolved over time, just like we have. In fact, there have been cases of people dying due to common cold and other things. Viruses are so prevalent it s unbelivable. What is and was interesting to note is that bat-borne viruses as well as pangolin viruses had been theorized and shared by Chinese researchers going all the way back to 90 s . The problem is even if we killed all the bats in the world, some other virus will take its place for sure. One of the ideas I had, dunno if it s feasible or not that at least in places like Airports, we should have some sort of screenings and a labs working on virology. Of course, this will mean more expenses for flying passengers but for public health and safety maybe it would worth doing so. In any case, virologists should have a field day cataloging various viruses and would make it harder for viruses to spread as fast as this one has. The virus spread also showed a lack of leadership in most of our leaders who didn t react fast enough. While one hopes people do learn from this, I am afraid the whole thing is far from over. These are unprecedented times and hope that all are maintaining social distancing and going out only when needed.
Heteronomy refers to action that is influenced by a force outside the individual, in other words the state or condition of being ruled, governed, or under the sway of another, as in a military occupation.
Poster P590CW $9.00 Early Warning Signs Of Fascism Laurence W. Britt wrote
about the common signs of fascism in April, 2003, after researching seven fascist
regimes: Hitler's Nazi Germany; Mussolini's Italy; Franco's Spain; Salazar's Portugal;
Papadopoulos' Greece; Pinochet's Chile; Suharto's Indonesia. Get involved! Text:
Early Warning Signs of Fascism Powerful and Continuing Nationalism Disdain For
Human Rights Identification of Enemies As a unifying cause Supremacy of the military
Rampant Sexism Controlled Mass Media Obsession With National Security
Political and social scientist Stefania Milan writes about social movements, mobilization and organized collective action. On the one hand, interactions and networks achieve more visibility and become a proxy for a collective we . On the other hand: Law enforcement can exercise preemptive monitorin
The Italian diaspora is the large-scale emigration of Italians from Italy. There are two major Italian diasporas in Italian history. The first diaspora began more or less around 1880, a decade or so after the Unification of Italy (with most leaving after 1880), and ended in the 1920s to early-1940s with the rise of Fascism in Italy. The second diaspora started after the end of World War II and roughly concluded in the 1970s. These together constituted the largest voluntary emigration period in documented history. Between 1880-1980, about 15,000,000 Italians left the country permanently. By 1980, it was estimated that about 25,000,000 Italians were residing outside Italy. A third wave is being reported in present times, due to the socio-economic problems caused by the financial crisis of the early twenty-first century, especially amongst the youth. According to the Public Register of Italian Residents Abroad (AIRE), figures of Italians abroad rose from 3,106,251 in 2006 to 4,636,647 in 2015, growing by 49.3% in just ten years.
Update 2020-04-03: Please see this post for updated location of the packages!!! Now for i586 and amd64 architectures!
I have been trying out the Plasma Desktop for one week now, and I am very positively surprised. Compared to the clumsy history of KDE3, the current desktop is extremely small-footprint and smooth, surprisingly. Integration is as expected great, and mixing programs from the other world (Gtk/Gnome) works also extremely smooth.
If there are a few things I would change, then mostly the chaos about kwallet and Gnome keyring. I would love to have one secret storage, and it seems that Gnome Keyring is preferrable, but this is in flux at the moment. Also, it is not that pressing, because I have moved all my passwords into pass and thus don t need the secret storage that much anymore.
So, after a bit of working with Plasma, I realized that Debian still ships an old version, the most recent being 5.18.3 LTS. Thus, I embarked onto a journey of updating all the necessary packages, and there are a lot: in total 106 packages I did update (and one new one!) until I finally had a new plasma-desktop package available. If you are interested, there are binaries for amd64 and sources in my Debian repository (WARNING: These packages are for Debian/sid and maybe testing, and cannot be used with Buster!):
deb https://www.preining.info/debian unstable kde
deb-src https://www.preining.info/debian unstable kde
As usual, don t forget to import my GPG key, and all packages are without warranty :-;
There are two packages that I didn t manage to update: kde-gtk-config which has changed a lot and contains far less files, and breeze-icons which fails on its own symlink tests. If anyone has an idea, please let me know.
If other packages are missing, please also drop me a line and I ll try to update them.
Enjoy.
Listening to experts argue can be one of the better ways to learn about a
new field. It does require some basic orientation and grounding or can be
confusing or, worse, wildly misleading, so some advance research or
Internet searches are warranted. But it provides some interesting
advantages over reading multiple popular introductions to a field.
First, experts arguing with each other are more precise about their points
of agreement and disagreement because they're trying to persuade someone
who is well-informed. The points of agreement are often more informative
than the points of disagreement, since they can provide a feel for what is
uncontroversial among experts in the field.
Second, internal arguments tend to be less starry-eyed. One of the
purposes of popularizations of a field is to get the reader excited about
it, and that can be fun to read. But to generate that excitement, the
author has a tendency to smooth over disagreements and play up exciting
but unproven ideas. Expert disagreements pull the cover off of the
uncertainty and highlight the boundaries of what we know and how we know
it.
Lost in Math (subtitled How Beauty Leads Physics Astray) is
not quite an argument between experts. That's hard to find in book form;
most of the arguments in the scientific world happen in academic papers,
and I rarely have the energy or attention span to read those. But it
comes close. Hossenfelder is questioning the foundations of modern
particle physics for the general public, but also for her fellow
scientists.
High-energy particle physics is facing a tricky challenge. We have a
solid theory (the standard model) which explains nearly everything that we
have currently observed. The remaining gaps are primarily at very large
scales (dark matter and dark energy) or near phenomena that are extremely
difficult to study (black holes). For everything else, the standard model
predicts our subatomic world to an exceptionally high degree of accuracy.
But physicists don't like the theory. The details of why are much
of the topic of this book, but the short version is that the theory does
not seem either elegant or beautiful. It relies on a large number of
measured constants that seem to have no underlying explanation, which is
contrary to a core aesthetic principle that physicists use to judge new
theories.
Accompanying this problem is another: New experiments in particle physics
that may be able to confirm or disprove alternate theories that go beyond
the standard model are exceptionally expensive. All of the easy
experiments have been done. Building equipment that can probe beyond the
standard model is incredibly expensive, and thus only a few of those
experiments have been done. This leads to two issues: Particle physics
has an overgrowth of theories (such as string theory) that are largely
untethered from experiments and are not being tested and validated or
disproved, and spending on new experiments is guided primarily by a sense
of scientific aesthetics that may simply be incorrect.
Enter Lost in Math. Hossenfelder's book picks up a thread of
skepticism about string theory (and, in Hossenfelder's case, supersymmetry
as well) that I previously read in Lee Smolin's The Trouble with Physics. But while Smolin's critique was
primarily within the standard aesthetic and epistemological framework of
particle physics, Hossenfelder is questioning that framework directly.
Why should nature be beautiful? Why should constants be small? What if
the universe does have a large number of free constants? And is the
dislike of an extremely reliable theory on aesthetic grounds a good basis
for guiding which experiments we fund?
Do you recall the temple of science, in which the foundations of
physics are the bottommost level, and we try to break through to
deeper understanding? As I've come to the end of my travels, I worry
that the cracks we're seeing in the floor aren't really cracks at all
but merely intricate patterns. We're digging in the wrong places.
Lost in Math will teach you a bit less about physics than Smolin's
book, although there is some of that here. Smolin's book was about
two-thirds physics and one-third sociology of science. Lost in
Math is about two-thirds sociology and one-third physics. But that
sociology is engrossing. It's obvious in retrospect, but I hadn't thought
before about the practical effects of running out of unexplained data on a
theoretical field, or about the transition from more data than we can
explain to having to spend billions of dollars to acquire new data. And
Hossenfelder takes direct aim at the human tendency to find aesthetically
appealing patterns and unified explanations, and scores some palpable
hits.
I went into physics because I don't understand human behavior. I went
into physics because math tells it how it is. I liked the
cleanliness, the unambiguous machinery, the command math has over
nature. Two decades later, what prevents me from understanding
physics is that I still don't understand human behavior.
"We cannot give exact mathematical rules that define if a theory is
attractive or not," says Gian Francesco Giudice. "However, it is
surprising how the beauty and elegance of a theory are universally
recognized by people from different cultures. When I tell you, 'Look,
I have a new paper and my theory is beautiful,' I don't have to tell
you the details of my theory; you will get why I'm excited. Right?"
I don't get it. That's why I am talking to him. Why should the laws
of nature care what I find beautiful? Such a connection between me
and the universe seems very mystical, very romantic, very not me.
But then Gian doesn't think that nature cares what I find
beautiful, but what he finds beautiful.
The structure of this book is half tour of how physics judges which
theories are worthy of investigation and half personal quest to decide
whether physics has lost contact with reality. Hossenfelder approaches
this second thread with multiple interviews of famous scientists in the
field. She probes at their bases for preferring one theory over another,
at how objective those preferences can or should be, and what it means for
physics if they're wrong (as increasingly appears to be the case for
supersymmetry). In so doing, she humanizes theory development in a way
that I found fascinating.
The drawback to reading about ongoing arguments is the lack of a
conclusion. Lost in Math, unsurprisingly, does not provide an
epiphany about the future direction of high-energy particle physics. Its
conclusion, to the extent that it has one, is a plea to find a way to put
particle physics back on firmer experimental footing and to avoid
cognitive biases in theory development. Given the cost of experiments and
the nature of humans, this is challenging. But I enjoyed reading this
questioning, contrarian take, and I think it's valuable for understanding
the limits, biases, and distortions at the edge of new theory development.
Rating: 7 out of 10
This article isn t about anything new , like the previous ones on AppStream it rather exists to shine the spotlight on a feature I feel is underutilized. From conversations it appears that the reason simply is that people don t know that it exists, and of course that s a pretty bad reason not to make your life easier Mini-Disclaimer: I ll be talking about appstreamcli, part of AppStream, in this blogpost exclusively. The appstream-util tool from the appstream-glib project has a similar functionality check out its help text and look for appdata-to-news if you are interested in using it instead.
What is this about?
AppStream permits software to add release information to their MetaInfo files to describe current and upcoming releases. This feature has the following advantages:
Distribution-agnostic format for release descriptions
Provides versioning information for bundling systems (Flatpak, AppImage, )
Release texts are short and end-user-centric, not technical as the ones provided by distributors usually are
Release texts are fully translatable using the normal localization workflow for MetaInfo files
Releases can link artifacts (built binaries, source code, ) and have additional machine-readable metadata e.g. one can tag a release as a development release
The disadvantage of all this, is that humans have to maintain the release information. Also, people need to write XML for this. Of course, once humans are involved with any technology, things get a lot more complicated. That doesn t mean we can t make things easier for people to use though.
Did you know that you don t actually have to edit the XML in order to update your release information? To make creating and maintaining release information as easy as possible, the appstreamcli utility has a few helpers built in. And the best thing is that appstreamcli, being part of AppStream, is available pretty ubiquitously on Linux distributions.
Update release information from NEWS data
The NEWS file is a not very well defined textfile that lists user-visible changes worth mentioning per each version. This maps pretty well to what AppStream release information should contain, so let s generate that from a NEWS file!
Since the news format is not defined, but we need to parse this somehow, the amount of things appstreamcli can parse is very limited. We support a format in this style:
When parsing a file like this, appstreamcli will allow a lot of errors/ imperfections and account for quite a few style and string variations. You will need to check whether this format works for you. You can see it in use in appstream itself and libxmlb for a slightly different style.
So, how do you convert this? We first create our NEWS file, e.g. with this content:
Version 0.2.0
~~~~~~~~~~~~~~
Released: 2020-03-14
Bugfixes:
* The CPU no longer overheats when you hold down spacebar
Version 0.1.0
~~~~~~~~~~~~~~
Released: 2020-01-10
Features:
* Now plays a "zap" sound on every character input
For the MetaInfo file, we of course generate one using the MetaInfo Creator. Then we can run the following command to get a preview of the generated file: appstreamcli news-to-metainfo ./NEWS ./org.example.myapp.metainfo.xml - Note the single dash at the end this is the explicit way of telling appstreamcli to print something to stdout. This is how the result looks like:
<?xml version="1.0" encoding="utf-8"?>
<component type="desktop-application">
[...]
<releases>
<release type="stable" version="0.2.0" date="2020-03-14T00:00:00Z">
<description>
<p>This release fixes the following bug:</p>
<ul>
<li>The CPU no longer overheats when you hold down spacebar</li>
</ul>
</description>
</release>
<release type="stable" version="0.1.0" date="2020-01-10T00:00:00Z">
<description>
<p>This release adds the following features:</p>
<ul>
<li>Now plays a "zap" sound on every character input</li>
</ul>
</description>
</release>
</releases>
</component>
Neat! If we want to save this to a file instead, we just exchange the dash with a filename. And maybe we don t want to add all releases of the past decade to the final XML? No problem too, just pass the --limit flag as well: appstreamcli news-to-metainfo --limit=6 ./NEWS ./org.example.myapp.metainfo.tmpl.xml ./result/org.example.myapp.metainfo.xml
That s nice on its own, but we really don t want to do this by hand The best way to ensure the MetaInfo file is updated, is to simply run this command at build time to generate the final MetaInfo file. For the Meson build system you can achieve this with a code snippet like below (but for CMake this shouldn t be an issue either you could even make a nice macro for it there):
In order to also translate releases, you will need to add this to your .pot file generation workflow, so (x)gettext can run on the MetaInfo file with translations merged in.
Release information from YAML files
Since parsing a no structure, somewhat human-readable file is hard without baking an AI into appstreamcli, there is also a second option available: Generate the XML from a YAML file. YAML is easy to write for humans, but can also be parsed by machines.The YAML structure used here is specific to AppStream, but somewhat maps to the NEWS file contents as well as MetaInfo file data. That makes it more versatile, but in order to use it, you will need to opt into using YAML for writing news entries. If that s okay for you to consider, read on!
A YAML release file has this structure:
---
Version: 0.2.0
Date: 2020-03-14
Type: development
Description:
- The CPU no longer overheats when you hold down spacebar
- Fixed bugs ABC and DEF
---
Version: 0.1.0
Date: 2020-01-10
Description: -
This is our first release!
Now plays a "zap" sound on every character input
As you can see, the release date has to be an ISO 8601 string, just like it is assumed for NEWS files. Unlike in NEWS files, releases can be defined as either stable or development depending on whether they are a stable or development release, by specifying a Type field. If no Type field is present, stable is implicitly assumed. Each release has a description, which can either be a free-form multi-paragraph text, or a list of entries.
Converting the YAML example from above is as easy as using the exact same command that was used before for plain NEWS files: appstreamcli news-to-metainfo --limit=6 ./NEWS.yml ./org.example.myapp.metainfo.tmpl.xml ./result/org.example.myapp.metainfo.xml If appstreamcli fails to autodetect the format, you can help it by specifying it explicitly via the --format=yaml flag. This command would produce the following result:
<?xml version="1.0" encoding="utf-8"?>
<component type="console-application">
[...]
<releases>
<release type="development" version="0.2.0" date="2020-03-14T00:00:00Z">
<description>
<ul>
<li>The CPU no longer overheats when you hold down spacebar</li>
<li>Fixed bugs ABC and DEF</li>
</ul>
</description>
</release>
<release type="stable" version="0.1.0" date="2020-01-10T00:00:00Z">
<description>
<p>This is our first release!</p>
<p>Now plays a "zap" sound on every character input</p>
</description>
</release>
</releases>
</component>
Note that the 0.2.0 release is now marked as development release, a thing which was not possible in the plain text NEWS file before.
Going the other way
Maybe you like writing XML, or have some other tool that generates the MetaInfo XML, or you have received your release information from some other source and want to convert it into text. AppStream also has a tool for that! Using appstreamcli metainfo-to-news <metainfo-file> <news-file> you can convert a MetaInfo file that has release entries into a text representation. If you don t want appstreamcli to autodetect the right format, you can specify it via the --format=<text yaml> switch.
Future considerations
The release handling is still not something I am entirely happy with. For example, the release information has to be written and translated at release time of the application. For some projects, this workflow isn t practical. That s why issue #240 exists in AppStream which basically requests an option to have release notes split out to a separate, remote location (and also translations, but that s unlikely to happen). Having remote release information is something that will highly likely happen in some way, but implementing this will be a quite disruptive, if not breaking change. That is why I am holding this change back for the AppStream 1.0 release.
In the meanwhile, besides improving the XML form of release information, I also hope to support a few more NEWS text styles if they can be autodetected. The format of the systemd project may be a good candidate. The YAML release-notes format variant will also receive a few enhancements, e.g. for specifying a release URL. For all of these things, I very much welcome pull requests or issue reports. I can implement and maintain the things I use myself best, so if I don t use something or don t know about a feature many people want I won t suddenly implement it or start to add features at random because they may be useful . That would be a recipe for disaster. This is why for these features in particular contributions from people who are using them in their own projects or want their new usecase represented are very welcome.
Since the beginning, the numpysane library provided a broadcast_define()
function to decorate existing Python routines to give them broadcasting
awareness. This was very useful, but slow. I just did lots of typing, and now I
have a flavor of this in C (the numpysane_pywrap module; new in numpysane
0.22). As expected, you get fast C loops! And similar to the rest of this
library, this is a port of something in PDL: PDL::PP.
Full documentation lives here:
https://github.com/dkogan/numpysane/blob/master/README-pywrap.org
After writing this I realized that there was something similar available in
numpy this whole time:
https://docs.scipy.org/doc/numpy/reference/c-api.generalized-ufuncs.html
I haven't looked too deeply into this yet, but 2 things are clear:
There's a design difference: the numpy implementation uses function callbacks,
while I generate C code. Code generation is what PDL::PP does, and when I
thought about it earlier, it seemed like doing this with function pointers would
be too painful. I guess it's doable, though.
And at least in one case, the gufuncs aren't doing the right broadcasting thing:
>>> a = np.arange(5).reshape(5,1)
>>> b = np.arange(3)
>>> np.matmul(a,b)
ValueError: matmul: Input operand 1 has a mismatch in
its core dimension 0, with gufunc signature
(n?,k),(k,m?)->(n?,m?) (size 3 is different from 1)
This should work. And if you do this with numpysane.broadcast_define() or with
numpysane_pywrap, it does work. I'll look at it later to figure out what it's
doing.
A new release 0.2.16 of RInside arrived on CRAN and in Debian today. This comes almost exactly one year after the previous release 0.2.15. RInside provides a set of convenience classes which facilitate embedding of R inside of C++ applications and programs, using the classes and functions provided by Rcpp.
This release brings one new feature, contributed by Lance Bachmeier (with some additional post-processing by me). It adds the ability to embed and call R from C programs and applications. The interface is more limited as we do not get Rcpp for automagic conversion. But this offers the door to a number of applications supporting plain C interface, and the new examples directory for example shows one for ruby. We may add others.
The short list of changes since the last release were:
Changes in RInside version 0.2.16 (2020-03-12)
RInside is now embeddable (with a reduced interface) from C applications thanks to Lance Bachmeier (who is now co-author) plus some polish by Dirk in #43)
Added R_SESSION_INIIALIZED to list of excluded variables.
Added simple diagnostics function to have a registered function.
Welcome to gambaru.de. Here is my monthly report (+ the first week in March) that covers what I have been doing for Debian. If you re interested in Java, Games and LTS topics, this might be interesting for you.
Debian Games
The games team received a lot of FTBFS bug reports due to a recent change in SDL2. (#951087) Many games that relied on the FindSDL2.cmake macro suddenly stopped building from source. Simon McVittie, who analyzed the situation, provided some helpful fixes for the problem. Ideally all affected packages and SDL2 should be fixed. I applied his patch for blockattack (#951943) and came up with similar patches for megaglest (#951959) and spring (#951974), pekka-kana-2 (#952049) was fixed by Simon and Carlos again.
I updated clanlib, an older SDK for game development, fixed a Perl build failure and applied patches to make cross-builds and reproducible builds possible.
I backported the latest version of Minetest, 5.1.1, to buster-backports.
Morris was ported to GSetting by Yavor Doganov and Reiner Herrmann ported it to the signals2 boost library (well done folks!) while I was tying all things together.
Freecol, a remake of the old Colonization received some love too. I could fix a build failure, create a valid appdata file and apply upstream s patch to address CVE-2018-1000825.
ufoai: I fixed a build failure caused by an upgrade to the mxml 3.x library. There is another issue with the old and soon to be removed gtksourceview2 library which the map editor relies on for some specific functions. I suppose the only way is to disable the functionality or to disable the editor alltogether. The game itself is not affected.
I sponsored an improved version of mupen64plus-qt for Dan Hastings, an RC fix for widelands by Juhani Numminen and
reviewed opensurge and surgescript for Carlos Donizete Froes. The former retro platformer opensurge is still missing from Debian and would be a nice addition to the games section. There is still some kind of runtime problem / shared library error and more work is required to make progress here.
After we received new bug reports for ublock-origin, this time because of sandboxing limitations in Chromium, I decided to revert back to two different binary packages, one for Firefox and one for Chromium. This will avoid any sandboxing problems due to the previous use of symlinks. The new version 1.25.0 is currently waiting in NEW.
Instead the update of privacybadger to version 2020.2.19 and binaryen was much more straightforward.
Debian LTS
This was my 48. month as a paid contributor and I have been paid to work 10 hours on Debian LTS, a project started by Rapha l Hertzog. In that time I did the following:
DLA-2133-1. Issued a security update for tomcat7 fixing 3 CVE.
DLA-2138-1. Issued a security update for wpa fixing 1 CVE.
Worked on a security update for squid3 that is not finished yet.
ELTS
Extended Long Term Support (ELTS) is a project led by Freexian to further extend the lifetime of Debian releases. It is not an official Debian project but all Debian users benefit from it without cost. The current ELTS release is Debian 7 Wheezy . This was my 21. month and I have been paid to work 8 hours on ELTS.
ELA-217-1. Issued a security update for tomcat7 fixing 1 CVE. I investigated CVE-2019-17569 and found that it did not affect the version in Wheezy because the refactoring and thus the regression happened in a later version. I worked on CVE-2020-1938, a possible remote code execution vulnerability regarding the AJP protocol. After I had backported the initial upstream patch, I discovered that more and more changes to the code were required which I found to be too intrusive eventually. Since the AJP port is disabled by default in Debian and the scenario of an untrusted user/service like mod_jk and Apache 2 seems unlikely, I opted for not making those changes.
Created a script to display which supported source packages are embedded into other supported packages and to show the embedded code copies in supported packages. There will be another script for LTS that behaves slightly different but it will also help to highlight CVE in embedded-code-copies in LTS and Debian packages in general.
I have worked a bit on the fonts I use recently. From the main font I
use every day in my text editor and terminals to this very website, I
did a major and (hopefully) thoughtful overhaul of my typography, in
the hope of making things easier to use and, to be honest, just
prettier.
Editor and Terminal: Fira mono
This all started when I found out about the JetbrainsMono font. I found the idea of ligatures
fascinating: the result is truly beautiful. So I do what I often do
(sometimes to the despair of some fellow Debian members) and filed a
RFP to document my research.
As it turns out, Jetbrains Mono is not free enough to be packaged in
Debian, because it requires proprietary tools to build. I nevertheless
figured I could try another font so I looked at other monospace
alternatives. I found the following packages in debian:
Because Fira code had ligatures, i ended up giving it a shot. I really
like the originality of the font. See, for example, how the @ sign
looks when compared to my previous font, Liberation Mono:
Liberation Mono
Fira Mono
Interestingly, a colleague (thanks ahf!) pointed me to the Practical
Typography post "Ligatures in programming fonts: hell no", which
makes the very convincing argument that ligatures are downright
dangerous to programming environment. In my experiences with the
fonts, it was also not always giving the result I would expect. I also
remembered that the Emacs Haskell mode would have this tendency of
inserting crazy syntactic sugar like this in source code without being
asked, which I found extremely frustrating.
Besides, Emacs doesn't support ligatures, unless you count such
horrendous hacks which hack at the display time. That's because
Emacs' display layer is not based on a modern rendering library like
Pango but some scary legacy code that very few people
understand. On top of the complexity of the codebase, there is also
resistance in including a modern font.
So I ended up using Fira mono everywhere I use fixed-width fonts, even
though it's not packaged in Debian. That involves the following
configuration in my .Xresources (no, I haven't switched to Wayland):
! font settings
Emacs*font: Fira mono
rofi*font: Fira mono 12
! Symbola is to get emojis to display correctly, apt install fonts-symbola
!URxvt*font: xft:Monospace,xft:Symbola
URxvt*font: xft:Fira mono,xft:Symbola
I also dropped this script in ~/.local/share/fonts/download.sh, for
lack of a better way, to download all the fonts I'm interested in:
Update: I forgot to mention one motivation behind this was to work
around a change in the freetype interpreter, discussed in bug
866685 and my upgrades
documentation.
Website: Charter
That "hell no" article got me interested in the Practical
Typography web book, which I read over the weekend. It was an eye
opener and I realized I had already some of those concepts
implanted; in fact it's probably after reading the Typography in ten
minutes guide that I ended up trying Fira sans a few years
ago. I have removed that font since then,
however, after realising it was taking up an order of magnitude more
bandwidth space than the actual page content.
I really loved the book, so much that I actually bought it. I
liked the concept of it, the look, and the fact that it's a living
document. There's a lot of typography work I would need to do on this
site to catchup with the recommendations from Matthew
Butterick. Switching fonts is only one part of this, but it's
something I was excited to work on. So I sat down and reviewed the
free fonts Butterick recommends and tried out a few. I ended up
settling on Charter, a relatively old (in terms of computing)
font designed by Matthew Carter (of Verdana fame) in 1987.
Charter really looks great and is surprisingly small. While a single
version of Fira varies between 96KiB (Fira Sans Condensed) and 308KiB
(Fira Sans Medium Italic), Charter is only 28KiB! While it's still
about as large as most of my articles, I found it was a better
compromise and decided to make the jump. This site is now in Serif,
which is a huge change for me.
The change was done with the following CSS:
h1, h2, h3, h4, h5, body
/*
* Charter: Butterick's favorite, freely available, found on https://practicaltypography.com/free-fonts.html
* Palatino: Mac OS
* Palatino Linotype: Windows
* Noto serif: Android, packaged in Debian
* Liberation serif: Linux fallback
* Serif: fallback
*/
font-family: Charter, Palatino, "Palatino Linotype", "Noto serif", "Liberation serif", serif;
/* Charter is available from https://practicaltypography.com/charter.html under the liberal Bitstream license */
I have also decided to outline headings by making them slanted, using
the beautiful italic version of Charter:
h1, h2, h3, h4, h5
font-style: italic;
I also made the point size larger, if the display is large enough:
/* enlarge body point size for charter for larger displays */
@media (min-device-width: 750px)
body
font-size: 20px;
line-height: 1.3; /* default in FF is ~1.48 */
Modern display (including fonts) have a much higher resolution and the
point size on my website was really getting too small to be
readable. This, in turn, required a change to the max-width:
#content
/* about 2.5 alphabets with charter */
max-width: 35em;
I have kept the footers and "UI" elements in sans-serif though, and
kept those aligned on operating system defaults or "system fonts":
/* some hacking at typefaces to get some fresh zest in here
* fallbacks from:
* https://en.wikipedia.org/wiki/List_of_typefaces_included_with_Microsoft_Windows
* https://en.wikipedia.org/wiki/List_of_typefaces_included_with_macOS
*/
.navbar, .footer
/*
* Avenir: Mac, quite different but should still be pretty
* Gill sans: Mac, Windows, somewhat similar to Avenir (indulge me)
* Noto sans: Android, packaged in Debian
* Open sans: Texlive extras AKA Linux, packaged in Debian
* Fira sans: Mozilla's Firefox OS
* Liberation sans: Linux fallback
* Helvetica: general fallback
* Sans-serif: fallback
*/
font-family: Avenir, "Gill sans", "Noto sans", "Open sans", "Fira sans", "Liberation sans", Helvetica, sans-serif;
/* Fira is available from https://github.com/mozilla/Fira/ under the SIL Open Font License */
/* alternatively, just use system fonts for "controls" instead:
font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", "Roboto", "Oxygen", "Ubuntu", "Cantarell", "Fira Sans", "Droid Sans", "Helvetica Neue", sans-serif;
gitlab uses: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Noto Sans", Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"
*/
I've only done some preliminary testing of how this will look
like. Although I tested on a few devices (my phone, e-book tablet, an
iPad, and of course my laptop), I fully expect things to break on
your device. Do let me know if things look better or worse. For
future comparison, my site is well indexed in the Internet
Wayback Machine and can be used to look at the site before the
change. For example, compare the previous article here with its
earlier style.
The changes to the theme are of course available in my custom ikiwiki
bootstrap theme (see in particular commits 0bca0fb7 and
d1901fb8), as usual.
Enjoy, and let me know what you think!
PS: I considered just setting the Charter font in CSS and not adding
it as a @font-face. I'm still considering that option and might do
so if the performance cost is too big. The Fira mono font is
actually set like this for the preformatted sections of the site, but
because it's more common (and it's too big) I haven't added it as a
font-face. You might want to download the font locally to benefit from
the full experience as well.
PPS: As it turns out, an earlier version of this post featured exactly
that: a non-webfont version of Charter, which works fine if you have a
good Charter font available. But it looks absolutely terrible if, like
many Linux users, you have the nasty bitmap font shipped with
xfonts-100dpi and xfonts-75dpi. So I fixed the webfont and
it's unlikely this site will be able to load reasonably well in Linux
until those packages are removed or bitmap font rendering is disabled.
Self-handicapping is a cognitive strategy by which people avoid effort in the hopes of keeping potential failure from hurting self-esteem.[1] It was first theorized by Edward E. Jones and Steven Berglas,[2] according to whom self-handicaps are obstacles created, or claimed, by the individual in anticipation of failing performance.[3]
Learned Helplessness is behaviour exhibited by a subject after enduring repeated aversive stimuli beyond their control. It was initially thought to be caused from the subject's acceptance of their powerlessness: discontinuing attempts to escape or avoid the aversive stimulus, even when such alternatives are unambiguously presented. Upon exhibiting such behavior, the subject was said to have acquired learned helplessness.[1][2] Over the past few decades, neuroscience has provided insight into learned helplessness and shown that the original theory actually had it backwards: the brain's default state is to assume that control is not present, and the presence of "helpfulness" is what is actually learned.[3]
Everywhere I worked in the past, the only feedback that was asked of
employees was during a yearly evaluation meeting. These meetings always felt to me
like talking to Santa Claus and his Knecht Ruprecht. I was asked: Were you a good
employee last year? If yes, we might give you a raise. If no, admit all
your mistakes now, even if we already know everything, ho ho ho. And don't you talk about your feelings, or your
well-being, or say anything about the organization's (invisible)
hierarchies, otherwise we will put you on the "naughty list", and that's it with candy. The
yearly evaluation set aside, there was no other place to give feedback (except by escalating a matter by involving the Labour Court, if you happen to work in France, or going on strike, also mostly part of French culture).
Feedback allows to reflect on work processes, to situate oneself, and to get closure.
How surprised was I when, some years ago, I received an email from a
collaborator asking me: kindly for just few paragraphs (doesn t have to be
anything long) to hear from you about the process, your work, challenges
you had, or anything else you want to mention there.. Wow!
This simple email allowed me to reflect about:
What did I like about the project? What part of the work was fun, challenging, and creative?
What went well or was complicated? How did our meetings work out? Were they
productive? Was it easy for me to frame the work I have to do? Were expectations clearly defined? How were remarks
and proposals for improvement presented to me? Did people test my work
thoroughly and gave me useful feedback on mistakes or misunderstandings? Did I
have to do lots of unexpected work? Were file formats, texts or other input not
well formatted or unclear, or arrived late? Did I allocate enough time to the project? Was I late with delivering anything? Could I have done better?
What is my overall conclusion for this project? Between what
went well and what did not: were the issues, the workload, the
assignments manageable? Am I willing to work with this person again? If
yes, what needs to change? If no, why?
What am I grateful for? What can I thank my colleagues/collaborators for? Did they have great
communication skills, ideas, were they on time, did they voice issues early
enough? How did it feel to work with them?
How do we get to a feedback culture?
How do we get from German Christmas folklore, protestant work
ethics, and the deeply rooted principles of disciplining and punishing to a feedback culture on eye level? It sounds
a bit like going from the dark ages to a really cool science fiction utopia
with universal peace, telepathy, and magic between all sentient beings on all
inhabited planets in the cosmos at least that's how I imagined it as a child, just like some of my heroes did: the cosmonaut girl who saves Earth, the boy who talks to space flowers that give him the capacity to fly, and the little onion who fights for justice (the Italian author was so popular on our side of the iron curtain that a soviet astronomer named a minor planet after him. His wife meanwhile immortalized Karl Marx.) and some romantic part of me hangs on to these ideas.
Feedback is not always easy to hear and to give.
I-Statements
Giving and receiving feedback is hard in a culture where people learnt that
when they made a mistake they won't get candy. Or that they have to constantly please
other people because they are not worthy by themselves. This can lead to people
putting mistakes on one another. Every sentence that starts with You are
has the potential of creating a lot of hurt, and anger. Have you heard of I-Statements? They have very powerfully changed my
world view, as they shift from accusation to ownership of feelings. So
instead of telling someone Your writing style is impossible! You really need to change the way you write.,
with an I-Statement one could say I have a hard time understanding that
part of the text. I-Statements make cooperation possible.
Listening actively
Feedback is not about being right or wrong, it's first of all about being
able to see how another person has experienced a situation. Active listening is a tool that helps with understanding. It might seem easy, but needs quite
some practice and a safe space. One part of active listening is to restate what you hear the
other person say (by mirroring, or paraphrasing), to make sure you understood,
and make sure they know you understood what they were trying to say. You can
practise this: in a circle of three people, have one person tell how they
experienced a (possibly conflictual) situation, have one person do the active
listening, and the third person observing in order to give feedback to the
active listener about how they did. Then switch roles, for example
clockwise, until everyone has had every role.
Encouraging continuous feedback
A working feedback culture does not take place
only once a year. It needs to be a continuous process and therefore implemented
in meetings, teams, eventually on the level of a project. Making clear: Who can I talk to if
I experience an issue? is not different than telling developers and users where and how they can report a bug, or request a feature. A safe space to express feedback is key.
Encouraging multiple feedback channels
Some people might feel less empowered or more vulnerable over a channel than
others. Make sure to have different channels for receiving feedback such as
email, a point on each meeting agenda, a one-to-one meeting, or a poll.
Giving and receiving feedback on eye level
In a workplace that does not have a working feedback culture, feedback is
easily perceived as policing. If your feedback process consists of asking
people to upload a form to a cloud server every 3 months, and you notice that
some people don't do it, you could ask yourself if there is an issue with how
your colleagues perceive giving feedback in your organization. Do you meet
your colleagues on eye level when it comes to feedback? Do you take feedback
seriously and act on it? How do you deal with unpleasant feedback? How do
you react when colleagues don't meet your expectations? Can people participate
in the feedback process within their paid work time? Did everybody understand
what the feedback process is about?
Don't jump to conclusions
Humans are problem solving animals. When someone comes to us with a problem,
the first thing we want to do is to solve it, to help them. But sometimes this
is uncalled for, it can be disempowering, or prevent people from acquiring competences themselves, and it can even break people's boundaries. So
instead of asking What can I do for you?, try asking What do you
need right now? People will often reply something that you did not
expect at all.
Acting on feedback
Make sure you have a process to collect feedback (possibly anonymized) and
to regularly evaluate if the organization needs to implement changes to thrive.
Conclusion
I stumbled upon Hans-Christian Dany's critique of feedback again recently, therefore I need to make it clear: I'm not interested in improving capitalist work culture by using cybernetic principles of self-regulation through feedback. Instead, I am interested in improving cooperation between people who work either individually or in organizations on eye level. In this framework, I see feedback processes as profoundly anti-capitalist methods to improve cooperation while working towards common good.
Implementing these ideas should be doable: there are organizations who provide feedback training for example. This document, initially aiming at people in cooperatives, gives many insights on communication skills and
feedback, the agile and UX worlds do feedback "retrospectives". and otherwise I'll have to go and write science fiction stories for
children myself.
Welcome to the February 2020 report from the Reproducible Builds project.
One of the original promises of open source software is that distributed peer review and transparency of process results in enhanced end-user security. However, whilst anyone may inspect the source code of free and open source software for malicious flaws, almost all software today is distributed as pre-compiled binaries. This allows nefarious third-parties to compromise systems by injecting malicious code into ostensibly secure software during the various compilation and distribution processes.
The motivation behind the reproducible builds effort is to provide the ability to demonstrate these binaries originated from a particular, trusted, source release: if identical results are generated from a given source in all circumstances, reproducible builds provides the means for multiple third-parties to reach a consensus on whether a build was compromised via distributed checksum validation or some other scheme.
In this month s report, we cover:
Media coverage & upstream news A new paper on reproducible containers, Ruby updates, etc.
Distribution work More work in Debian, openSUSE & friends.
Software development Updates and improvements to our tooling.
Getting in touch How to contribute, more venues for discussion.
If you are interested in contributing to the project, please visit our Contribute page on our website.
All computation that occurs inside a DetTrace container is a pure function of the initial filesystem state of the container. Reproducible containers can be used for a variety of purposes, including replication for fault-tolerance, reproducible software builds and reproducible data analytics. We use DetTrace to achieve, in an automatic fashion, reproducibility for 12,130 Debian package builds, containing over 800 million lines of code, as well as bioinformatics and machine learning workflows.
Debian
Chris Lamb created a merge request for the core debian-installer package to allow all arguments and options from sources.list files (such as [check-valid-until=no] , etc.) in order that we can test the reproducibility of the installer images on the Reproducible Builds own testing infrastructure. (#13)
Thorsten Glaser followed-up to a bug filed against the dpkg-source component that was originally filed in late 2015 that claims that the build tool does not respect permissions when unpacking tarballs if the umask is set to 0002.
Matthew Garrett posted to the debian-devel mailing list on the topic of Producing verifiable initramfs images as part of a wider conversation on being able to trust the entire software stack on our computers.
59 reviews of Debian packages were added, 30 were updated and 42 were removed this month adding to our knowledge about identified issues. Many issue types were noticed and categorised by Chris Lamb, including:
diffoscopediffoscope is our in-depth and content-aware diff-like utility that can locate and diagnose reproducibility issues. It is run countless times a day on our testing infrastructure and is essential for identifying fixes and causes of nondeterministic behaviour.
Chris Lamb made the following changes this month, including uploading version 137 to Debian:
The sng image utility appears to return with an exit code of 1 if there are even minor errors in the file. (#950806)
Also extract classes2.dex, classes3.dex from .apk files extracted by apktool. (#88)
No need to use str.format if we are just returning the string. []
Add generalised support for ignoring returncodes [] and move special-casing of returncodes in zip to use Command.VALID_RETURNCODES. []
Other tools
disorderfs is our FUSE-based filesystem that deliberately introduces non-determinism into directory system calls in order to flush out reproducibility issues. This month, Vagrant Cascadian updated the Vcs-Git to specify the debian packaging branch. []
reprotest is our end-user tool to build same source code twice in widely differing environments and then checks the binaries produced by each build for any differences. This month, versions 0.7.13 and 0.7.14 were uploaded to Debian unstable by Holger Levsen after Vagrant Cascadian added support for GNU Guix [].
Project documentation & website
There was more work performed on our documentation and website this month. Bernhard M. Wiedemann added a Java Gradle Build Tool snippet to the SOURCE_DATE_EPOCH documentation [] and normalised various terms to unreproducible [].
Chris Lamb added a Meson.build example [] and improved the documentation for the CMake [] to the SOURCE_DATE_EPOCH documentation, replaced anyone can with anyone may as, well, not everyone has the resources, skills, time or funding to actually do what it refers to [] and improved the pre-processing for our report generation [][][][] etc.
In addition, Holger Levsen updated our news page to improve the list of reports [], added an explicit mention of the weekly news time span [] and reverted sorting of news entries to have latest on top [] and Mattia Rizzolo added Codethink as a non-fiscal sponsor [] and lastly Tianon Gravi added a Docker Images link underneath the Debian project on our Projects page [].
Upstream patches
The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where appropriate. This month, we wrote a large number of such patches, including:
Bernhard M. Wiedemann (for the openSUSE distribution):
Testing framework
We operate a fully-featured and comprehensive Jenkins-based testing framework that powers tests.reproducible-builds.org. This month, the following changes were made by Holger Levsen:
In addition, Mattia Rizzolo added an Apache web server redirect for buildinfos.debian.net [] and reverted the reshuffling of arm64 architecture builders []. The usual build node maintenance was performed by Holger Levsen, Mattia Rizzolo [][] and Vagrant Cascadian.
Getting in touch
If you are interested in contributing to the Reproducible Builds project, please visit our Contribute page on our website. However, you can get in touch with us via:
This month s report was written by Bernhard M. Wiedemann, Chris Lamb and Holger Levsen. It was subsequently reviewed by a bunch of Reproducible Builds folks on IRC and the mailing list.
Today, after many months of development, a new release of
Nikita
Noark 5 core project was finally
announced
on the project mailing list. The Nikita free software solution is
an implementation of the Norwegian archive standard Noark 5 used by
government offices in Norway. These were the changes in version 0.5
since version 0.4, see the email link above for links to a demo
site:
Updated to Noark 5 versjon 5.0 API specification.
Changed formatting of _links from [] to to match IETF draft
on JSON HAL.
Merged Registrering og Basisregistrering in version 4 to
combined Registrering.
DokumentObjekt is now subtype of ArkivEnhet.
Introducing new entity Arkivnotat.
Changed all relation keys to use /v5/ instead of /v4/.
Corrected to use new official relation keys when possible.
Renamed Sakspart to Part and connect it to Mappe, Registrering
and Dokumentbeskrivelse instead of only Saksmappe.
Moved Korrespondansepart connection from Journalpost to
Registrering.
Moved Part and Korrespondansepart from package sakarkiv to
arkivstruktur.
Renamed presedensstatus to presedensStatus.
Use new JSON content-type "application/vnd.noark5+json".
Updated prepopulated format list to use PRONOM codes.
Implemented endpoint for system information.
Implemented national identifiers for both file and record.
Implemented comments.
implemented sign off.
implemented conversion.
Improved/implemented OData search and paging support for more entities.
No longer exposes attribute Dokumentobjekt.referanseDokumentfil,
one should use the relation in _links instead.
Corrected relation keys under
https://rel.arkivverket.no/noark5/v5/api/administrasjon/, replacing
'administrasjon' with 'admin'.
Fixed several security and stability issues discovered by Coverity.
Corrected handling ETag errors, now return code 409.
Improved handling of Kryssreferanse.
Changed internal database model to use UUID/SystemID as primary keys
in tables.
Changed internal database table names to use package prefix.
Changed time zone handling for date and datetime attributes, to be
more according to the new definition in the API specification.
Change revoke-token to only drop token on POST requests, not GET.
Updated to newer Spring version.
Changed primary key and URL component for metadata code lists to
use the 'kode' value instead of a SystemID.
Corrected implementation of Part and Sakspart.
Changed instance lists with subtypes (like .../registrering/ and
.../mappe/) to include the attributes and _links entries for the
subtype in the supertype lists.
Adjusted _links relations to make it possible to figure out the
entity of an instance using the self->href->relation key lookup
method.
Fixed several end points to make sure GET, PUT, POST and DELETE
match each other.
Updated DELETE endpoints to work with UUID based entity
identifiers.
Restructured code to use more common URL related constants in entry
point values and replace @RequestMapping with method specific
annotations.
Added first unit test code.
Updated web GUI to work with the updated API.
Changed integer fields, enforce them as numeric.
Rewrote and simplify metadata handling to use common service and
controller code instead of duplicating for each type.
Implemented the remaining metadata types.
Changed Country list source from Wikipedia to Debian iso-codes and
updated the list of Countries.
I've been managing my UNIX $HOME repository with version control
for almost two decades now (first under CVS, then with git). Once in a
while, I find a little hack to make this work better.
Today, it's dconf/gsettings, or more specifically,
Workrave that I want to put in git. I noticed my laptop was
extremely annoying compared with my office workstation and realized
I never figured out how to write Workrave's configuration to git. The
reason is that its configuration is stored in dconf, a binary database
format, but, blissfully, I had forgotten about this and tried to
figure out where the heck its config was.
I was about to give up when I re-remembered this, when I figured I
would just do a quick search ("dconf commit to git") and that brought
me to Josh Triplett's Debconf 14 talk about this exact topic. The
slides are... a little terse, but I could figure out the gist of
it. The key is to change the DCONF_PROFILE environment to point to a
new config file (say in your .bashrc):
export DCONF_PROFILE=$HOME/.config/dconf/profile
That file (~/.config/dconf/profile) should be created with the
following content:
user-db:user
service-db:keyfile/user
The first line is the default: store everything in this huge
binary file.
The second is the magic: it stores configuration in a precious
text file, in .config/dconf/user.txt specifically.
Then the last step was to migrate config between the two. For that I
need a third config file, a DCONF_PROFILE that has only the text
database so settings are forcibly written there, say
~/.config/dconf/profile-edit:
service-db:keyfile/user
And then I can migrate my workrave configuration with:
gsettings list-recursively org.workrave while read schema key val ; do DCONF_PROFILE=~/.config/dconf/profile-edit gsettings set "$schema" "$key" "$val" ; done
Of course, a bunch of those settings are garbage and do not differ
from the default. Unfortuantely, there doesn't seem to be a way to
tell gsettings to only list non-default settings, so I had to do
things by hand from there, by comparing my generated config with:
That's a nice setup: "YOLO" settings end up in the binary database
that I don't care about tracking in git, and a precious few snowflakes
get tracked in a text file. Triplett also made a command to change
settings in the text file, but I don't think I need to bother with
that. It's more critical to copy settings between the two, in my
experience, as I rarely have this moment: "oh I know exactly the key
setting I want to change and i'll write it down". What actually
happens is that I'm making a change in a GUI and later realize it
should be synchronized over.
(It looks like Triplett does have a tool to do those diffs and
transitions, but unfortunately git://joshtriplett.org/git/home
doesn't respond at this time so I can't find that source code.)
(Update: that git repository can be downloaded with:
git clone https://joshtriplett.org/git/home
It looks like dconfc is designed to copy settings between the two
databases. So my above loop would be more easily written as:
Certainly simplifies things. dconfd is also nice although it relies
on the above dconfe script which makes it (IMHO) needlessly hard to
deploy.)
Now if only Firefox bookmarks were reasonable again...
Here's what happened in the Reproducible
Builds effort between Sunday November 5 and
Saturday November 11 2017:
Upcoming events
On November 17th Chris Lamb will present at Open Compliance
Summit,
Yokohama, Japan on how reproducible builds ensures the long-term sustainability
of technology infrastructure.
We plan to hold an assembly at
34C3
- hope to see you there!
LEDE CI tests
Thanks to the work of lynxis, Mattia and h01ger, we're now testing all LEDE
packages in our setup. This is our first result for the ar71xx
target: "502
(100.0%) out of 502 built images and 4932 (94.8%) out of 5200 built packages
were reproducible in our test setup." - see below for details how this was
achieved.
Bootstrapping and Diverse Double Compilation
As a follow-up of a discussion on bootstrapping compilers we had on the Berlin
summit, Bernhard
and Ximin worked on a Proof of Concept for Diverse Double Compilation of tinycc
(aka tcc).
Ximin Luo did a successful diverse-double compilation of
tinycc git HEAD using gcc-7.2.0,
clang-4.0.1, icc-18.0.0 and pgcc-17.10-0 (pgcc needs to triple-compile it).
More variations are planned for the future, with the eventual aim to reproduce
the same binaries cross-distro, and extend it to test GCC itself.
Packages reviewed and fixed, and bugs filed
Patches filed upstream:
i4l-base (merged) -
Uninitialized memory written to output.
Reviews of unreproducible packages
73 package reviews have been added, 88 have been updated and 40 have been removed in this week,
adding to our knowledge about identified issues.
4 issue types have been updated:
reproducible archlinux: don't use hidden files for the package lists
reproducible fedora: don't use hidden files for the package lists
udd-query: move from public-udd-mirror.xvm.mit.edu to udd-mirror.debian.net
udd-query: remove the temporary file with a trap in case this script is called with the wrong argument, and in case of failures, etc, the temporary file would be left around otherwise
reproducible debian: schroot-create: drop the reproducible gpg keyring into /etc/apt/trusted.gpg.d/ instead of using apt-key add
reproducible debian: setup_pbuilder: drop the reproducible gpg keyring into /etc/apt/trusted.gpg.d/ instead of using apt-key add
reprodocible debian: setup_pbuilder: stop installing gnupg2 in our chroot, not needed anymore now
Mattia also merged and deployed some commits from others this week.
Alexander 'lynxis' Couzens
reproducible_lede: use correct place/variable to save results: Results on remote nodes are expected to be under $TMPDIR, which defined by openwrt_build. RESULTSDIR is undefined on the remote node
reproducible_lede: enable building all packages again, after it was disabled to improve the debug speed.
reproducible_lede: correct given path for node_cleanup_tmpdirs & node_save_logs-
reproducible_lede: enable CONFIG_BUILDBOT to reduce inodes while building.
kpcyrd:
reproducible-archlinux: try porting abs to asp
reproducible-archlinux: explicitly sync packages
reproducible-archlinux: use sudo for pacman
Hans-Christoph Steiner:
reproducible fdroid: point jenkins to canonical URL
reproducible_fdroid: separate testsuite into its own job
reproducible fdroid: sync upstream script names with jenkins.debian.net, make things self-documenting by reusing the same names everywhere.
reproducible_fdroid_test: make script executable
Chris Lamb:
Move some IRC announcements to #debian-reproducible-changes.
Holger Levsen:
reproducible LEDE: try to deal gracefully with problems and report
as usual, Holger merged many of the above commits and deployed them.
Misc.
This week's edition was written by Ximin Luo, Bernhard M. Wiedemann, Chris Lamb
and Holger Levsen & reviewed by a bunch of Reproducible Builds folks on IRC &
the mailing lists.
Narabu is a new intraframe video codec. You probably want to read
part 1,
part 2,
part 3,
part 4
and
part 5
first.
Like I wrote in part 5, there basically isn't a big splashy ending where
everything is resolved here; you're basically getting some graphs with
some open questions and some interesting observations.
First of all, though, I'll need to make a correction: In the last part,
I wrote that encoding takes 1.2 ms for 720p luma-only on my GTX 950,
which isn't correct I remembered the wrong number. The right number is
2.3 ms, which I guess explains even more why I don't think it's acceptable
at the current stage. (I'm also pretty sure it's possible to rearchitect
the encoder so that it's much better, but I am moving on to other
video-related things for the time being.)
I encoded a picture straight off my DSLR (luma-only) at various resolutions,
keeping the aspect. Then I decoded it a bunch of times on my GTX 950
(low-end last-generation NVIDIA) and on my HD 4400 (ultraportable Haswell
laptop) and measured the times. They're normalized for megapixels per second
decoded; remember that doubling width (x axis) means quadruple the pixels.
Here it is:
I'm not going to comment much beyond two observations:
Caches matter, even on GPU. This is the same data over and over again (so small
images get an unrealistic boost), so up to a certain point, it's basically
all in L1.
The GTX 950 doesn't really run away from the Intel card before it's getting
enough data to chew on. Bigger GPUs don't have faster cores they're just more parallel.
Encoding only contains the GTX 950 because I didn't finish the work to get
that single int64 divide off:
This is interesting. I have few explanations. Probably more benchmarking and
profiling would be needed to make sense of any of it. In fact, it's so
strange that I would suspect a bug, but it does indeed seem to create a
valid bitstream that is decoded by the decoder.
Do note, however, that seemingly even on the smallest resolutions, there's a
1.7 ms base cost (you can't see it on the picture, but you'd see it in an
unnormalized graph). I don't have a very good explanation for this either
(even though there are some costs that are dependent on the alphabet size
instead of the number of pixels), but figuring it out would probably be a
great start for getting the performance up.
So that concludes the series, on a cliffhanger. :-) Even though it's not in a
situation where you can just take it and put it into something useful, I hope
it was an interesting introduction to the GPU! And in the meantime, I've
released version 1.6.3 of Nageru, my live video
mixer (also heavily GPU-based) with various small adjustments and bug fixes
found before and during Tr ndisk. And Movit is getting compute shaders
for that extra speed boost, although parts of it is bending my head.
Exciting times in GPU land :-)
Previously: v4.13.
Linux kernel v4.14 was released this last Sunday, and there s a bunch of security things I think are interesting:
vmapped kernel stack on arm64
Similar to the same feature on x86, Mark Rutland and Ard Biesheuvel implementedCONFIG_VMAP_STACK for arm64, which moves the kernel stack to an isolated and guard-paged vmap area. With traditional stacks, there were two major risks when exhausting the stack: overwriting the thread_info structure (which contained the addr_limit field which is checked during copy_to/from_user()), and overwriting neighboring stacks (or other things allocated next to the stack). While arm64 previously moved its thread_info off the stack to deal with the former issue, this vmap change adds the last bit of protection by nature of the vmap guard pages. If the kernel tries to write past the end of the stack, it will hit the guard page and fault. (Testing for this is now possible via LKDTM s STACK_GUARD_PAGE_LEADING/TRAILING tests.)
One aspect of the guard page protection that will need further attention (on all architectures) is that if the stack grew because of a giant Variable Length Array on the stack (effectively an implicit alloca() call), it might be possible to jump over the guard page entirely (as seen in the userspace Stack Clash attacks). Thankfully the use of VLAs is rare in the kernel. In the future, hopefully we ll see the addition of PaX/grsecurity s STACKLEAK plugin which, in addition to its primary purpose of clearing the kernel stack on return to userspace, makes sure stack expansion cannot skip over guard pages. This stack probing ability will likely also become directly available from the compiler as well.
set_fs() balance checking
Related to the addr_limit field mentioned above, another class of bug is finding a way to force the kernel into accidentally leaving addr_limit open to kernel memory through an unbalanced call to set_fs(). In some areas of the kernel, in order to reuse userspace routines (usually VFS or compat related), code will do something like: set_fs(KERNEL_DS); ...some code here...; set_fs(USER_DS);. When the USER_DS call goes missing (usually due to a buggy error path or exception), subsequent system calls can suddenly start writing into kernel memory via copy_to_user (where the to user really means within the addr_limit range ).
Thomas Garnier implemented USER_DS checking at syscall exit time for x86, arm, and arm64. This means that a broken set_fs() setting will not extend beyond the buggy syscall that fails to set it back to USER_DS. Additionally, as part of the discussion on the best way to deal with this feature, Christoph Hellwig and Al Viro (and others) have been making extensive changes to avoid the need for set_fs() being used at all, which should greatly reduce the number of places where it might be possible to introduce such a bug in the future.
SLUB freelist hardening
A common class of heap attacks is overwriting the freelist pointers stored inline in the unallocated SLUB cache objects. PaX/grsecurity developed an inexpensive defense that XORs the freelist pointer with a global random value (and the storage address). Daniel Micay improved on this by using a per-cache random value, and I refactored the code a bit more. The resulting feature, enabled with CONFIG_SLAB_FREELIST_HARDENED, makes freelist pointer overwrites very hard to exploit unless an attacker has found a way to expose both the random value and the pointer location. This should render blind heap overflow bugs much more difficult to exploit.
Additionally, Alexander Popov implemented a simple double-free defense, similar to the fasttop check in the GNU C library, which will catch sequential free()s of the same pointer. (And has already uncovered a bug.)
Future work would be to provide similar metadata protections to the SLAB allocator (though SLAB doesn t store its freelist within the individual unused objects, so it has a different set of exposures compared to SLUB).
setuid-exec stack limitation
Continuing the various additional defenses to protect against future problems related to userspace memory layout manipulation (as shown most recently in the Stack Clash attacks), I implemented an 8MiB stack limit for privileged (i.e. setuid) execs, inspired by a similar protection in grsecurity, after reworking the secureexec handling by LSMs. This complements the unconditional limit to the size of exec arguments that landed in v4.13.
randstruct automatic struct selection
While the bulk of the port of the randstruct gcc plugin from grsecurity landed in v4.13, the last of the work needed to enable automatic struct selection landed in v4.14. This means that the coverage of randomized structures, via CONFIG_GCC_PLUGIN_RANDSTRUCT, now includes one of the major targets of exploits: function pointer structures. Without knowing the build-randomized location of a callback pointer an attacker needs to overwrite in a structure, exploits become much less reliable.
structleak passed-by-reference variable initialization
Ard Biesheuvel enhanced the structleak gcc plugin to initialize all variables on the stack that are passed by reference when built with CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL. Normally the compiler will yell if a variable is used before being initialized, but it silences this warning if the variable s address is passed into a function call first, as it has no way to tell if the function did actually initialize the contents. So the plugin now zero-initializes such variables (if they hadn t already been initialized) before the function call that takes their address. Enabling this feature has a small performance impact, but solves many stack content exposure flaws. (In fact at least one such flaw reported during the v4.15 development cycle was mitigated by this plugin.)
improved boot entropy
Laura Abbott and Daniel Micay improved early boot entropy available to the stack protector by both moving the stack protector setup later in the boot, and including the kernel command line in boot entropy collection (since with some devices it changes on each boot).
eBPF JIT for 32-bit ARM
The ARM BPF JIT had been around a while, but it didn t support eBPF (and, as a result, did not provide constant value blinding, which meant it was exposed to being used by an attacker to build arbitrary machine code with BPF constant values). Shubham Bansal spent a bunch of time building a full eBPF JIT for 32-bit ARM which both speeds up eBPF and brings it up to date on JIT exploit defenses in the kernel.
seccomp improvements
Tyler Hicks addressed a long-standing deficiency in how seccomp could log action results. In addition to creating a way to mark a specific seccomp filter as needing to be logged with SECCOMP_FILTER_FLAG_LOG, he added a new action result, SECCOMP_RET_LOG. With these changes in place, it should be much easier for developers to inspect the results of seccomp filters, and for process launchers to generate logs for their child processes operating under a seccomp filter.
Additionally, I finally found a way to implement an often-requested feature for seccomp, which was to kill an entire process instead of just the offending thread. This was done by creating the SECCOMP_RET_ACTION_FULL mask (n e SECCOMP_RET_ACTION) and implementing SECCOMP_RET_KILL_PROCESS.
That s it for now; please let me know if I missed anything. The v4.15 merge window is now open!
As a cat owner, being surprised by cat intelligence delights me. They re not exactly smart like a human, but they are smart in cattish ways. The more I watch them and try to sort out what they re thinking, the more it pleases me to discover they can solve problems and adapt in recognizably intelligent ways, sometimes unique to each individual cat. Each time that happens, it evokes in me affectionate wonder.
Today, I had one of those joyful moments.
First, you need to understand that some months ago, I thought I had my male cat all figured out with respect to mealtimes. I had been cleaning up after my oafish boy who made a watery mess on the floor from his mother s bowl each morning. I was slightly annoyed, but was mostly curious, and had a hunch. A quick search of the web confirmed it: my cat was left-handed. Not only that, but I learned this is typical for males, whereas females tend to be right-handed. Right away, I knew what I had to do: I adjusted the position of their water bowls relative to their food, swapping them from right to left; the messy morning feedings ceased. I congratulated myself for my cleverness.
You see, after the swap, as he hooked the kibbles with his left paw out of the right-hand bowl, they would land immediately on the floor where he could give them chase. The swap caused the messes to cease because before, his left-handed scoops would land the kibbles in the water to the right; he would then have to scoop the kibble out onto the floor, sprinkling water everywhere! Furthermore, the sodden kibble tended to not skitter so much, decreasing his fun. Or so I thought. Clearly, I reasoned, having sated himself on the entire contents of his own bowl, he turned to pilfering his mother s leftovers for some exciting kittenish play. I had evidence to back it up, too: he and his mother both seem to enjoy this game, a regular fixture of their mealtime routines. She, too, is adept at hooking out the kibbles, though mysteriously, without making a mess in her water, whichever way the bowls are oriented. I chalked this up to his general clumsiness of movement vs. her daintiness and precision, something I had observed many times before.
Come to think of it, lately, I ve been seeing more mess around his mother s bowl again. Hmm. I don t know why I didn t stop to consider why
And then my cat surprised me again.
This morning, with Shadow behind my back as I sat at my computer, finishing up his morning meal at his mother s bowl, I thought I heard something odd. Or rather, I didn t hear something. The familiar skitter-skitter sound of kibbles evading capture was missing. So I turned and looked. My dear, devious boy had squished his overgrown body behind his mother s bowls, nudging them ever so slightly askew to fit the small space. Now the bowl orientation was swapped back again. Stunned, I watched him carefully flip out a kibble with his left paw. Plop! Into the water on the right. Concentrating, he fished for it. A miss! He casually licked the water from his paw. Another try. Swoop! Plop, onto the floor. No chase now, just satisfied munching of his somewhat mushy kibble. And then it dawned on me that I had got it somewhat wrong. Yes, he enjoyed Chase the Kibble, like his mom, but I never recognized he had been indulging in a favourite pastime, peculiarly his own
I had judged his mealtime messes as accidents, a very human way of thinking about my problem. Little did I know, it was deliberate! His private game was Bobbing for Kibbles. I don t know if it s the altered texture, or dabbling in the bowl, but whatever the reason, due to my meddling, he had been deprived of this pleasure. No worries, a thwarted cat will find a way. And that is the joy of cat intelligence.
First of all, congratulations to all those who got us 2022 Debconf, so we will finally have a debconf in India. There is of course, lot of work to be done between now and then. For those who would be looking forward to visit India and especially Kochi I would suggest you to hear this enriching tale
I am sorry I used youtube link but it is too good a podcast not to be shared. Those who don t want youtube can use the invidio.us link for the same as shared below.
https://www.invidio.us/watch?v=BvjgKuKmnQ4
I am sure there are lot more details, questions, answers etc. but would direct them gently to Praveen, Shruti, Balasankar and the rest who are from Kochi to answer if you have any questions about that history.
National Science Day, GMRT 2020 
. Of course in another stall few students had used RPI s as part of their projects so at times we did tell some of the newbies to go to those stalls and see and ask about those projects so they would have a much wider experience of things. The Mozilla people were pushing VR as well as Mozilla lite the browser for the mobile.
We also gossiped quite a bit. I shared about indicatelts , a third-party certificate extension although I dunno if I should file a wnpp about it or not. We didn t have a good experience of when I had put an RFP (Request for Package) which was accepted for an extension which had similar functionality which we later come to know was sharing the sites people were using the extension to call home and share both the URL and the IP Address they were using it from. Sadly, didn t leave a good taste in mouth 
Predictions of the outcome of the current 21-day lockdown (Source: Rajesh Singh, R. Adhikari, Cambridge University)
Alternative lockdown strategies suggested by the Cambridge model (Source: Rajesh Singh, R. Adhikari, Cambridge University)
TL;DR; please help localizing Mailman3 [1]. You can find it on hosted Weblate [2].The next component releases are planned in 1-2 weeks from now. Thanks for your contribution! If you can't make it now, please consider working on Mailman3 translations at some later point of time. Thanks!
Time has come for Mailman3
Over the last months I have found an interest in Mailman3. Given the EOL of Python2 in January 2020 and also being a heavy Mailman2 provider for various of my projects and also for customers, I felt it was time to look at Mailman2's successor: Mailman3 [1].
One great novelty in Mailman3 is the strict split up between backend (Mailman Core), and the frontend components (django-mailman3, Postorius, Hyperkitty). All three are Django applications. Postorius is the list management web frontend whereas Hyperkitty is an archive viewer. Other than in Mailman2, you can also drop list posts into Hyperkitty directly (instead of sending a mail to the list). This makes Hyperkitty also some sort of forum software with a mailing list core in the back. The django-mailman3 module knits the previous two together (and handles account management, login dialog, profile settings, etc.).
Looking into Mailman3 Upstream Code
Some time back in midst 2019 I decided to deploy Mailman3 at a customer's site and also for my own business (which still is the test installation). Living and working in Germany, my customers' demand often is a fully localized WebUI. And at that time, Mailman3 could not provide this. Many exposed parts of the Mailman3 components were still not localized (or not localizable).
Together with my employee I put some hours of effort into providing merge requests, filing bug reports, request better Weblate integration (meaning: hosted Weblate), improving the membership scripting support, etc. It felt a bit like setting the whole i18n thing in motion.
Call for Translations
Over the past months I had to focus on other work and two days ago I was delighted that Abhilash Raj (one of the Mailman3 upstream maintainers) informed me (via closing one of the related bugs [3]) that Mailman3 is now fully integrated with the hosted Weblate service and a continous translation workflow is set to go.
The current translation stati of the Mailman3 components are at ~ 10%. We can do better than this, I sense.
So, if you are a non-native English speaker and feel like contributing to Mailman3, please visit the hosted Weblate site [2], sign up for an account (if you don't have one already), and chime in into the translation of one of the future mailing list software suites run by many FLOSS projects all around the globe. Thanks a lot for your help.
As a side note, if you plan working on translating Mailman Core into your language (and can't find it in the list of supported languages), please request this new language via the Weblate UI. All other components have all available languages enabled by default.
References:
Update 2020-04-03: Please see 
If there are a few things I would change, then mostly the chaos about kwallet and Gnome keyring. I would love to have one secret storage, and it seems that Gnome Keyring is preferrable, but this is in flux at the moment. Also, it is not that pressing, because I have moved all my passwords into 
Mini-Disclaimer: I ll be talking about 
A new release 0.2.16 of 
Welcome to gambaru.de. Here is my monthly report (+ the first week in March) that covers what I have been doing for Debian. If you re interested in Java, Games and LTS topics, this might be interesting for you.
Debian Games
![A dark terminal window showing the prompt '[SIGPIPE]anarcat@angela:~(master)$' in the Liberation Mono font](https://anarc.at/tag/debian-planet/snap-2020.03.10-19.36.04-liberation.png)
Liberation Mono
![A dark terminal window showing the prompt '[SIGPIPE]anarcat@angela:~(master)$' in the Fira mono font](https://anarc.at/tag/debian-planet/snap-2020.03.10-19.35.25-fira-mono.png)
Fira Mono
Everywhere I worked in the past, the only feedback that was asked of
employees was during a yearly evaluation meeting. These meetings always felt to me
like talking to Santa Claus and his 
Narabu is a new intraframe video codec. You probably want to read
I'm not going to comment much beyond two observations:
This is interesting. I have few explanations. Probably more benchmarking and
profiling would be needed to make sense of any of it. In fact, it's so
strange that I would suspect a bug, but it does indeed seem to create a
valid bitstream that is decoded by the decoder.
Do note, however, that seemingly even on the smallest resolutions, there's a
1.7 ms base cost (you can't see it on the picture, but you'd see it in an
unnormalized graph). I don't have a very good explanation for this either
(even though there are some costs that are dependent on the alphabet size
instead of the number of pixels), but figuring it out would probably be a
great start for getting the performance up.
So that concludes the series, on a cliffhanger. :-) Even though it's not in a
situation where you can just take it and put it into something useful, I hope
it was an interesting introduction to the GPU! And in the meantime, I've
released version 1.6.3 of 
Previously: 
As a cat owner, being surprised by cat intelligence delights me. They re not exactly smart like a human, but they are smart in cattish ways. The more I watch them and try to sort out what they re thinking, the more it pleases me to discover they can solve problems and adapt in recognizably intelligent ways, sometimes unique to each individual cat. Each time that happens, it evokes in me affectionate wonder.
Today, I had one of those joyful moments.
First, you need to understand that some months ago, I thought I had my male cat all figured out with respect to mealtimes. I had been cleaning up after my oafish boy who made a watery mess on the floor from his mother s bowl each morning. I was slightly annoyed, but was mostly curious, and had a hunch. A quick search of the web confirmed it: my cat was left-handed. Not only that, but I learned this is typical for males, whereas females tend to be right-handed. Right away, I knew what I had to do: I adjusted the position of their water bowls relative to their food, swapping them from right to left; the messy morning feedings ceased. I congratulated myself for my cleverness.
You see, after the swap, as he hooked the kibbles with his left paw out of the right-hand bowl, they would land immediately on the floor where he could give them chase. The swap caused the messes to cease because before, his left-handed scoops would land the kibbles in the water to the right; he would then have to scoop the kibble out onto the floor, sprinkling water everywhere! Furthermore, the sodden kibble tended to not skitter so much, decreasing his fun. Or so I thought. Clearly, I reasoned, having sated himself on the entire contents of his own bowl, he turned to pilfering his mother s leftovers for some exciting kittenish play. I had evidence to back it up, too: he and his mother both seem to enjoy this game, a regular fixture of their mealtime routines. She, too, is adept at hooking out the kibbles, though mysteriously, without making a mess in her water, whichever way the bowls are oriented. I chalked this up to his general clumsiness of movement vs. her daintiness and precision, something I had observed many times before.
Come to think of it, lately, I ve been seeing more mess around his mother s bowl again. Hmm. I don t know why I didn t stop to consider why
And then my cat surprised me again.
This morning, with Shadow behind my back as I sat at my computer, finishing up his morning meal at his mother s bowl, I thought I heard something odd. Or rather, I didn t hear something. The familiar skitter-skitter sound of kibbles evading capture was missing. So I turned and looked. My dear, devious boy had squished his overgrown body behind his mother s bowls, nudging them ever so slightly askew to fit the small space. Now the bowl orientation was swapped back again. Stunned, I watched him carefully flip out a kibble with his left paw. Plop! Into the water on the right. Concentrating, he fished for it. A miss! He casually licked the water from his paw. Another try. Swoop! Plop, onto the floor. No chase now, just satisfied munching of his somewhat mushy kibble. And then it dawned on me that I had got it somewhat wrong. Yes, he enjoyed Chase the Kibble, like his mom, but I never recognized he had been indulging in a favourite pastime, peculiarly his own
I had judged his mealtime messes as accidents, a very human way of thinking about my problem. Little did I know, it was deliberate! His private game was Bobbing for Kibbles. I don t know if it s the altered texture, or dabbling in the bowl, but whatever the reason, due to my meddling, he had been deprived of this pleasure. No worries, a thwarted cat will find a way. And that is the joy of cat intelligence.