Max Spevack: “The Fedora Project is leading the creation of a new community around RPM. One in which the leaders can come from Fedora, from Red Hat, from Novell, from Mandriva, or from anywhere.”

Interesting article by everyone’s hero Bruce Schneier on real-world passwords. Schneier analyzed the spoils of a phishing attack on MySpace that resulted in the collection of 34,000 usernames and passwords:

We used to quip that “password” is the most common password. Now it’s “password1.” Who said users haven’t learned anything about security?

There are only a few days left until the close of the XTech 2007 call for participation. XTech 2007 will be held 15-18 May 2007 in Paris, France.
As I wrote last month, the theme for this year's conference is "The Ubiquitous Web", reflecting the many ways, places and devices through which we now interact with and are affected by the web. XTech 2007 will be comprised of four thematic tracks:

• Applications: web applications, vocabularies, publishing, content management, case studies
• Browser Technologies: browsers, mobile, user interface, related issues and standards.
• Core Technology: the heart of web technology, markup, protocols, semantics and more.
• Open Data: technology, experiences and policy behind open access to data.

All these topic suggestions are of course just that; don't feel you are limited to topics mentioned explicitly in the call.XTech is always topical, so to take that angle, we'll be expecting to hear about things such as Second Life, mobile and geolocative services, progress in open standards, Ajax toolkits, OpenDocument vs Microsoft Open XML, copyright, identity, best design practices and more.Just a few more tips based on submissions so far:

• Don't worry if you can't decide which track your submission falls into: just say so in the notes, and the programme committee can place it appropriately.
• If you have something super-secret you can't talk about yet, but can do by May 2007, write to me personally and we'll try to come to a suitable arrangement.
• If you have a great excuse why you need just a few more days to respond to the call, also let me know.

Otherwise, propose away!

My face is covered in egg. Antti-Juhani Kaijanaho found a security problem in EoC, both the 1.0.3 and the 1.2.3 versions. The problem is that EoC did not quote shell arguments properly. I have fixed the problem in 1.2.4, which contains no other changes relative to 1.2.3. This problem has the code CVE-2006-5875. You can find the 1.2.4 version from the EoC website: http://liw.iki.fi/liw/eoc/ and I have also uploaded it to Debian's unstable. Debian's stable contains 1.0.3, and I have prepared a patch for that. It is actually essentially the same patch as was used to create 1.2.4. The Debian security team has uploaded a fixed version of the 1.0.3 package to security.debian.org. I've attached it to this message in case anyone not running Debian wants to stay with 1.0.3, but I won't be releasing a 1.0.4 unless someone really needs it (if you do, please tell me immediately). For risk assessment: I was unable to come up with an exploit. Doing so would require getting a certain kind of construct through the SMTP level to EoC, and I wasn't able to make that happen, but I would not rely on it being impossible. Therefore, please upgrade immediately. I apologize for this problem. It was amateurish to let the problematic code into a released version of the program, I knew better than do that.

Yesterday the release manager Andreas ‘aba’ Barth announced:

Etch is now frozen! Wheeeeeee!!!

This means, that “all packages now need to be hand-approved in order to go to testing”.
So policyd-weight needs to be hinted, which is already done, but ipplan will never make it into etch, since its out of NEW only 2 days ago. So here needs etch-backports to take place.
I hope etch will be released now soon (mid next month). Good work since here .. go ahead! Anyways … many, many thanks goes to my great sponsor Daniel Baumann. Without his patience and help this list of packages would never happen. Debian, opensource, Packaging, planet

So I am back to le study of le hackers, trying to write a super-secret paper that I will present in January and then of course I am back with and to my beloved book (which for now has the following title: “Freedom’s Pleasures: Hacker Practice And The Limits of Liberalism” but I am sure it will morph, endlessly). As part of my transition I just finished re-reading one of my favorite articles on the history of Usenet: If I want it, it s OK: Usenet and the (outer) limits of free speech by B. Pfaffenberger (available here for download. When I released one of my dissertation chapters where I addressed the phenomenon of the Cabal, Bryan was nice enough to write me and point me to his article, which also examines the existence of Backbone Usenet Cabal. The artile, which provides just the right mix of history and commentary, analyzes how a free speech ethic came to be valued on Usenet and the ways in which technological and social factors co-mingled to facilitate and dampen the free flow of expression. You are provided with classic Usenet quotes like:

Usenet is like a herd of performing elephants with diarrhea–massive, diffi-
cult to redirect, awe-inspiring, entertaining, and a source of mind-boggling
amounts of excrement when you least expect it. (Spafford, 1993b)

You learn about the early attempts to control spam by the likes of “CancelMoose:”

In 1995, a secret, shadowy figure known as the CancelMoose
devised a spam-canceling program called a cancelbot.”

And then in the end, he provides his challeng to one of the dominant STS theories of the time, SCOT: “It should be noted that this picture is at odds with the predictions of the social construc-
tion of technology (SCOT) theory (Pinch & Bijker, 1987), in which the outcome of a period
of technical controversy is ascribed solely to social factors. Underlying SCOT s dogmatism
is a justifiable aversion to technological determinism, the doctrine that a technology s con-
tent leads irresistably to predictable social consequences a doctrine that is simply the re-
verse of SCOT s insistence on social causation. Two wrongs, as we were taught in kinder-
garten, do not make a right. What we see in the history of Usenet is a contingent outcome
that is shaped neither exclusively by social nor by technical factors, but rather is best under-
stood as a long process in which contesting groups attempt to mold and shape the technol-
ogy to suit their ends sometimes successfully, and sometimes not. They are as likely to be
blindsided by technological developments as they were to succeed in changing the system
to meet their ends. As this article attests, it is one thing to create new technologies with a
coherent social vision, and it is quite another to control the way it grows and develops.” I could not agree with him more. I think what he is highlighting is that if we dip into the historical record, we have instances in which technology can trump the social and vice-versa (and often instead it is a co-mixture), so in the end, understanding the impact of technologies is less about theories of technology and more of a historical question…

Yesterday was general assembly of the Linux user group Aargau (a place in switzerland). The association hasn’t got enough money, this is a severel months old story already, and the person who managed the money was very inactive. The president also didn’t want to do his job anymore, so we had to search a new advisory board. Unfortunately there weren’t enough members who are interested in this job, so the association will be resolved. This is quite hard for me because I met there some cool people which became (some of them at least) good friends, I say “thank you very much” to G rkan, Daniel, David, Werewolfi, Harzi, Nils, B, Vany and last but not least also to the “swisscom idiot”…
Yeah, there isn’t much more to say about this, only that I will miss those cool evenings very much But from another point of view, yesterday was a very good day because Debian Etch is finally frozen, so we had to celebrate at the LUG-AG meeting and there are some pictures (the big ones are 403, if you want them just send me a mail and I will allow it for your IP). Thanks to all Debian people who helped getting Etch in shape and thanks to the releasemanagers…

Three prostitutes have been murdered near Ipswich and two more are missing. BBC News ( The World At One in particular) seem to be dwelling on the fact that Suffolk has no permanent investigation team. It's probably totally alien to London-based commentators and analysts that an area the size of Suffolk (roughly the middle third of the round bit north of London that sticks out into the North Sea - an area about two-and-a-half times the size of Greater London) has only about a dozen killings a year. What would the investigation team do for the rest of the year? It seems better to have police that know their service area, but sometimes call in help from neighbouring police to investigate murders. I wish the BBC would stop looking at East Anglia through the London Eye and treat it like the other regions. I lived there until recently and East Anglia may be next to London, but it's very different. Why does BBC even bother to point out that it was Norwich South MP Charles Clarke who proposed merging Suffolk Constabulary with two of its neighbours? London-born Clarke was infamous for doing as he was told by Islington Blair. Anyway, this is well outside my normal writing, but the BBC non-news really irritated. Now, fingers crossed that Suffolk Constabulary get to the bottom of the murders soon and the BBC stops criticising the police at this early stage.

Now this is interesting: BEA is coming out with a version of its application server that runs directly atop VMware. With this move, VMware takes another step toward becoming a full fledged operating system in its own right. VMware is already promoting the distribution of applications as virtual machine images, and operating systems are first and foremost application platforms. If VMware is an application platform, why not cut out the middle man entirely, particularly given that the middle man adds a few hundred megabytes of largely invisible baggage to the application, not to mention an enormous amount of maintenance burden for the ISVs that make or break an application platform? For me, the real question is: Why BEA and not VMware? A JavaOS makes a lot of sense, since it builds on one of the world’s largest developer communities—it’s a well known environment among developers, and there are a huge stable of applications that could take advantage of the new platform with minimal porting. Furthermore, applications are increasingly server based, with the browser providing the UI, so this matches well with industry trends and nicely addresses the problem that VMware would have a very hard time building any sort of graphical user interface into its platform, just given the nature of what it is. That said, VMware should really want to provide the JavaOS directly. With Xen and Virtual Server moving aggressively to bundle their products with widely deployed operating systems, the game’s already afoot, and if virtualization becomes just another operating system feature, VMware is at a distinct disadvantage, as it owns no operating system to bundle its product with. Finally, what about standards? New kind of operating system or operating system feature, there are going to be multiple application platforms if history is any indication (and it usually is), so how do applications take advantage of the new platforms without the inevitable fragmentation? It’s going to be an interesting space to watch, that’s for sure.

I guess it was only a matter of time before Novell did something that seems likely to harm other free software, after their little deal with Microsoft. I'm surprised it came so soon: they have offered to add Office OXML support to OpenOffice. As Georg Greve writes:

"Bob Sutor, IBM's Vice President of Standards and Open Source has written a good analysis why the specification is more akin to a denial of service attack than an Open Standard."

There's more discussion in Georg Greve's wrap-up. See the top of this article on my site for boycott Novell links and so on.

It's been more than one year that I'm waiting on NM queue, waiting for an Applicant Manager, performing Philosophy & Procedure part 1 & 2, then Tasks & Skills.

When applying for NM, it's really appreciated to already maintain a few packages in the archive, so for T&S the AM can check them and appreciate the work done. I guess people applying for NM first start by taking care of some package, before submitting.

But for me, it was the opposite way. I joined pkg-xfce team more than 18 months ago, and got my first packages in the archive a few weeks later.

I only applied to NM 6 months later, because, as I was dedicating more time to pkg-xfce, it would be more efficient for me to be able to upload directly, without
bothering huggie or ema (the two DDs in the team). It wasn't really required, but
it interested me, and huggie said me that it'd take some time so the sooner, the better.

Now, due to personal reason, huggie and ema don't have time/motivation anymore to work on pkg-xfce. I'm currently the one in charge, as I spent some time on it, and tries to spent some time on debian-desktop team, so we have a nice and consistent look for desktop environments in Etch. But I can't upload my packages myself, I need to find a sponsor. Xfce represent more than 50 packages (including goodies), that's quite a lot, and we have scripts and procedure to be efficient when rebuilding everything. If I could do everything myself, Xfce 4.4rc2 (released 2006/11/05) would have been in Etch since a long time. But I can't, because I'm stuck in NM queue.

Most of 4.4rc2 packages have been uploaded by my AM, Dafydd Harries (which I want to thank, though), but not everything, and few packages won't be in Etch, now that it's frozen. Yeah, that means that Etch will have half rc1 and half rc2, which isn't really good. Not really bad either, but still... (ok, and not as bad as shipping broken svn snapshots...)

I'm interested in beeing a Debian Developper because I *know* it'll make my work and my time more efficient. And not beeing able to push rc2 to Etch because of that really makes me sad...

There were more shocking news for me when I got back home yesterday. Via Toni Hermoso, I learned that Toni Cucarella, a Valencian writer I recently discovered, just announced that he has abandoned his writing activities, just a little bit after announcing he wouldn't further update his blog. I learned about Toni Cucarella's literature aproximately one year ago, when I heard about a new novel, Quina lenta agonia, la dels ametlers perduts, on the radio, which sounded interesting. The book fascinated me as soon as I started reading. Describing the life of a group of children in the outskirts of X tiva, a small city south of Val ncia, in the late 1960s, Cucarella managed to transmit some feelings about my childhood during the summers of the early 80s around my town in the inner province of Castell . It wasn't anything in particular what did this, but the way the book was written, which managed to describe how these kids lived happily and in freedom around their houses, regardless their economic status and the difficulties their families went through. All of this reminded me of my sister, cousins and friends running around the streets and fields, away from our parents or any adults, in a time when nobody thought this was dangerous or irresponsible. The only two sins were to play on the road or to get back home a lot after the sunset. Toni Cucarella has been very vocal against the Language Authorities in Val ncia regarding the unity of the Catalan language, and specifically against the Acad mia Valenciana de la Llengua, a recently created institution which now has competence over the "Valencian language", something that was previously in the hands of a scientific institution like the Universitat de Val ncia. He has finally burned out, not only due to the bad situation Catalan literature is in the Valencian Country, but also because leaving aside two very prominent exceptions, Valencian authors are basically ignored in Catalunya, making their subsistence quite difficult. I hope Toni can build some new motivations after some time and the public can enjoy new novels written by him in the future, as well as more of those very interesting blog entries we had got used to reading every few days. In the meanwhile, thanks for your writings, Toni, and good luck with your new activities!

Last night, when we got home after the long weekend up around theawesome Terres de l'Ebre, first thing I learned from the news is that Augusto Pinochet had finally died while we were driving back. It is too bad that once again he managed to avoid a trial that would have made him officially guilty of all the horrible happenings of Chile during his military coup and his bloody dictatorship. But he's gone now, and this will be a great relief for the thousands of Chileans who survived his regime, and for those who lost family members or friends just because they defended some ideals. The world will associate his surname to torture, murder and corruption; he surely won't be remembered for the image of the old, calm man surrounded by family members that an ever-shrinking minority tried to transmit. Last night, I raised my cup to celebrate Pinochet's death. Viva Chile!

Saw this on Baen’s Bar

Loser- INTP 46% Extraversion, 53% Intuition, 66% Thinking, 33% Judging

Talked to another human being lately? I’m serious. You value knowledge above ALL else. You love new ideas, and become very excited over abstractions and theories. The fact that nobody else cares still hasn’t become apparent to you… Nerd’s a great word to describe you, and I seriously couldn’t care less about the different definitions of the word and why you’re actually more of a geek than a nerd. Don’t pretend you weren’t thinking that. You want every single miniscule fact and theory to be presented correctly. Critical? Sarcastic? Cynical? Pessimistic? Just a few words to describe you when you’re at your very best…*cough* Sorry, I mean worst. Picking up the dudes or dudettes isn’t something you find easy, but don’t worry too much about it. You can blame it on your personality type now. On top of all this, you’re shy. Nice one, wench. No wonder you’re on OKCupid! Now, quickly go and delete everything about “theoretical questions” from your profile page. As long as nobody tries to start a conversation with you, just MAYBE you’ll now have a chance of picking up a date. But don’t get your hopes up. I am interested though. If a tree fell over in a forest, would it really make a sound? ***************** If you want to learn more about your personality type in a slightly less negative way, check out this. ***************** The other personality types are as follows… Loner - Introverted Sensing Feeling Perceiving Pushover - Introverted Sensing Feeling Judging Criminal - Introverted Sensing Thinking Perceiving Borefest - Introverted Sensing Thinking Judging Almost Perfect - Introverted iNtuitive Feeling Perceiving Freak - Introverted iNtuitive Feeling Judging Crackpot - Introverted iNtuitive Thinking Judging Clown - Extraverted Sensing Feeling Perceiving Sap - Extraverted Sensing Feeling Judging Commander - Extraverted Sensing Thinking Perceiving Do Gooder - Extraverted Sensing Thinking Judging Scumbag - Extraverted iNtuitive Feeling Perceiving Busybody - Extraverted iNtuitive Feeling Judging Prick - Extraverted iNtuitive Thinking Perceiving Dictator - Extraverted iNtuitive Thinking Judging

My test tracked 4 variables How you compared to other people your age and gender: You scored higher than 53% on Extraversion You scored higher than 25% on Intuition You scored higher than 52% on Thinking You scored higher than 15% on Judging

Link: The Brutally Honest Personality Test written by UltimateMaster on OkCupid Free Online Dating, home of the The Dating Persona Test

Russel Coker has posted a SELinux on Debian etch in 5 Minutes guide. Some small things to note:

• This is for etch, which has Linux 2.6.18 - there are SELinux changes in 2.6.19 which require policy version 21, whereas 2.6.18 has policy version 20. Changing it in /etc/selinux/semanage.conf may or may not be enough.
• rjc posted this Policy fix you'll likely need for running enforcing
• strict, while being more secure, will likely require you to write some policy modules on your own
• policy is a snapshot from october, you might want to get an updated policy. However I currently don't have time to work on it, and I just heard that etch was frozen. But maybe Manoj has still time to update the policy and get it into etch...