Although I like the idea of a tiling and completely keyboard focused window manager, I never fell in love with Ion because the default keybindings weren’t really intuïtive (to me). A few months ago I noticed, that ratpoison is also a tiling and completely keyboard focused window manager, only with much more intuitive usage: If you know screen and it’s keybindings, you also know ratpoison and it’s keybindings: Just exchange Ctrl-A with Ctrl-T. This sounds perfect for usage on my low performance laptops, where I have small screens and usually also no virtual desktops in use. There’s only one thing which annoys me in ratpoison: If I use a mostly mouse driven application like e.g. a webbrowser with ratpoison, I have no problems to click on links, even if the webbrowser is not in the so called “current frame”. But if e.g. click into an input field, I usually notice much too late that while the mouse works fine in the browser, keyboard focus is still in some other window. Currently they all use flwm, the Fast and Lite Window Manager. So what I would need is a tiling and keyboard focused window manager but with “focus follows mouse” politics. And since the laptops on which I intend to use such a window manager, all have a touchpad or thumbstick, the mouse there counts as keyboard focused, too somehow, doesn’t it? :-) I wonder, if an ion3 could be configured to use the same keybindings as ratpoison. That would probably fulfil this desire. On the other hand, there are browsers which are fine without mouse. lynx or links2 for example, so the focus problem I have with ratpoison wouldn’t occur. But what if I need or want a keyboard driven and full blown webbrowser? Ok, Firefox as well as Opera are not that bad in keyboard only use, but they still are focused on the mouse using user. But Gecko wouldn’t be Gecko, if there wasn’t some Gecko based browser with this features: On the ratpoison website I found a link to a very interesting Firefox plugin which makes Firefox a complete new browser, a keyboard driven webbrowser named Conkeror. It has no toolbars at all, no (visible) tabs, no menus, no nothing — it shows only the website in fullscreen, a status line and a multipurpose command line — exactly like the mini-buffer of GNU Emacs. But not only the layout, even the keybindings are very emacsish: C-x C-f opens an URL in a new buffer -eh- tab, C-x 5 C-f opens an URL in a new frame (window), C-x C-v opens a new URL in the current tab (buffer) with the current URL as editable default value, C-x b switches to another tab, C-x k kills -eh- closes a tab, C-x C-b lists all open tabs, l goes back (remember the Emacs info reader, eh?), C-g quits accidently requested dialogs or stops loading a web page, Ctrl-s and Ctrl-r give you forward and backward i-search, C-n, C-p, C-f and C-b scroll, etc. Even M-x works, e.g. will M-x revert-buffer reload the web page. (Unfortunately Esc-x doesn’t work. Yet.) And for vi freaks, there is even M-x use-vi-keys. There’s even one lynxish keybinding: \ lets you view the source. And although it’s one of the strangest webbrowsers I saw yet, I somehow like it and also would like to see it in Debian as package, since it is the perfect companion for ion or ratpoison. Looking through apt’s package cache as well as the wnpp bugs, I haven’t found any hint on somebody already packaging it, so I’ll have a look on it and on how to to package a Firefox extension for Debian. BTW: While looking through the wnpp bugs, I found bug #335459, which is the ITP flock, an also Gecko based browser with a lot of cool features for blogger who like social network tools. Another nice thing I found today in Debian was the xfonts-artwiz package whose small fonts are very suitable for small resolution screens, especially if a tiling window manager is used with a e.g. 800×600 resolution. Unfortunately they aren’t available in a charset with German umlauts. Apropos tiling window managers: Anyone tried pconsole with an automatically tiling and resizing window manager? I wonder if it’s usable. At least on MacOS X with its cascading window positioning algorithm, pconsole is a pain. — But even without cascading windows, MacOS X is a pain for keyboard users. Just think of its default behaviour when using the tab key inside a form mask: It will skip all buttons, all checkboxes, all radio buttons and all select boxes. Argh!

I use more than one computer, and quite a bit. I use three regularly, and two or three more on occasion.

But this seems to be a surprise to many programs.

I want to carry certain things with me from machine to machine, access them from anywhere, and have changes propogate across.

Things such as:

• Bookmarks


• newsrc files (to mark which Usenet articles are read)


• mail (solved with my OfflineIMAP program)


• A small set of files


• Contacts


• Calendar/scheduler (appointments)

Now, MacOS X seems to do some of this with their for-pay mac.com service. But I wonder why so few other apps do this out of the box?

The newsrc question is a particularly difficult one to crack, it seems. There are various schemes for synchronizing bookmarks, but none seem to work reliably.

Sigh.

Many moons ago, when I started my project on F/OSS I imagined that it would stay within the purview of anthropology, hacking, science and technology studies to bleed only a little bit into legal studies and only because I was dealing with the fraught politics of intellectual property law. As it turned out, the Law, with a capital L, as on object of analysis and site for the production of cultural value, turned out not to be peripheral but utterly central… And since, I have pretty much stayed within the territory of legal studies, vastly interested in the more invisible cultural and political effects of the law. Recent obsessing on this topic has led to a nascent thesis about law, discrimination, politics , and civil rights that I am looking to substantiate (so if anyone has any citations or helpful hints, do pass along) and it is this: When there are positive changes made in the law, it can come with various political costs. And the one I am interested in, is how, given other conducive conditions, legal changes that look awesome on paper, can work to undermine its potential by breeding a type of complacency of (in)action, largely because it seems as if the worst of the problems have been fixed. So if we look to the American legal context of 1960s and 1970s as a prime example, it is clear there was a heck of a lot of turmoil in the arena of civil rights, much of which, many liberals and progressives would say, led to positive legal transformation. During this period the content of many laws were purged of overt discrimination that, for example, which led a lethal blow to segregation and started to dismantle some of the worst pieces of scaffolding of mental health law (just to cite a few examples). At one level while we may easily recognize these changes as laudable and even perhaps “progressive,” the effects of it may be less so. Once legal content is purged of the ugly, this can breed an ugly form of complacency, in which the problem seems (re)solved, so people no longer feel guilt and attention is diverted away from any number of things, like: 1) new problems not necessarily addressed in the law 2) the rise of new laws or 3) the fact that the law is empty unless actively applied. I have yet to read anything directly related to this theory or apply it myself but it is something that has been on my mind for a couple of years now. But after talking about this topic from a friend, I decided to finally take crack at The Law in Shambles a Prickly Paradigm Press pamphlet by Thomas Geogheghan, a labor lawyer from Chicago. While it did not specifically address the issue I am raising (though it got pretty close in a number of places) I got more than I had bargained for; it is truly incisive (though frighteningly depressing) look at the current state of the law, and also, like so many of the PPP’s, much more fun to read than any most academic book or articles. For those who don’t know the PPP publish a series of short pamphlets and it was started by the legendary anthropologist, Marshal Sahlins, who is also known to be a little prickly himself (but it softened by his humor). They are often written by academics on contemporary topics of political interest (read: very biased) in a manner that is a lot looser and free wheeling than any article or book that would come out of an academic journal or publishing house. The PPP allows its authors to unbuckle a few notches off the sometimes uptight, constraining academic belt of writing and the result is often impassioned, funny, and yet remarkably astute essays. If Montaigne were around today, he would surely be proud of his essayistic legacy. The title of the book sums up the the topic at hand. His explanation as to why the (American) law is in disarray has not to do with the law in the abstract but with the total disintegration of a certain class of institutions and a specific class of law (namely unions , the law of trusts etc.). As institutional supports from the New Deal have been thrown out the door, it is the individual, largely through tort law, who has had to wield the fury of the law, in defense of a slew of individual rights and to defend themselves against new forms of attack (the worst being lawsuits brought forth by “charitable institutions” like hospitals). While the law is conceived as something we are all equal under, of course, it is access to the law, which makes all the difference in terms of making it a viable (or not) as social tool. With the demise of the unions, he argues, came the death of certain type of contract law in employment, and the stellar rise of tort law, which conceives of wrongful acts not as breaches of contract (which would apply to all persons under the contract) but as matters of personal injury. Whereas in the past unions would arbitrate contract law, wielding the power of numbers so that individuals were not burdened and burned with the expense (of time and money) of the law, with tort the law becomes formalized, conceived, and imagined in highly individual terms (even when grouped into class actions, it becomes a matter of proving personal injury), the effect of which, he argues is meaner and more complex than contract for four reasons 1) The name of the legal game is to discover motive, which is about as confusing as it can get and thus more arbitrary 2) It is more expensive than old contract law 3) Cases rarely go to trial (didn’t really get the importance of this point) 4) Because its focus is on motive and intense and subjective states, everything is open to scrutiny, so that I can force you to tell me everything what is in your secret heart. Not to mention in your tax returns. The result is torts produced a bitter, dog-eats-dog Hobbesian, legal world, which in turn makes for experiencing the law as an arbitrary force. This individualization of the law through tort also intersects with many other changes such as the demise of regulatory power that add more fire to the disintegration of the law and the subsequent experience of law and life as arbitrary. And it is this chapter (From Administrative Law to No Law, The Rise of the Whistleblower and Trail Lawyer) which got me a little closer to my own point that I brought up above. For example, he writes:

Once, when I filed suite to get the Labor Department to enforce the child labor laws for 16- and 17-year olds, kids whom they do not even pretend to protect, I got nowhere. I met with the Solicitor who told me: Look, suppose I agree with you. How would I ever get the money to enforce it? He was right. If I had won and they had issued regulations, it would have only been worse. In Labor, as in agency after agency, we have a vast complex body of law which would take mandarin to learn that no one enforces.. The law is there. On paper. Indeed, it is a lot of paper. How much paper? Fifty volumes, in paperback in total. I know because I counted. But as to big chunks in these volumes, there is no one there to enforce it. p. 48

Lots of paper I think can make people comfortable in thinking that famous Virginia Slims Slogan, We’ve come a long way, Baby, when it fact, it can often just means what it literally looks like, “Damn, that’s a buttload of paper.” There is a lot more packed into this tiny book, covering the deep gulf between left and right, the stagnation of an old constitution that is impossible to revise, the loss of accountability in all branches of government, the redrawing of districts, and the slight expansion and curbing of of majoritarian voting in the last hundred years. It gets a little shrilly by the end, but you know, it is all pretty upsetting stuff and it is good to shrill from time to time. Though he never refers to neoliberalism, capitalism, or postmodernism, this book is also a great companion to a class of this literature on the rise of fragmentation and instability in social and cultural life brought forth by changes in the economic system (thinking here of David Harvey, Fredric Jameson, etc). In fact, I think it does a much better job than at relaying how it is that vast sectors of society experience fragmentation, instability, and frustration.

First of all a little bit (important) linguististic knowledge, “Stifteusflug” means the following, it’s swiss slang: “Stift” -> “der Lehrling” -> apprentice “Usflug” -> “der Ausflug” -> expedition So, you understand? Ok, last friday we went to Zurich. “we” means in this case all apprentices from grenchen.ch and swg.ch, and there where 2 other women who came with us. Early in the morning, about 8 o’clock we met us near the trainstation in Grenchen and went with the 8.24-train to Zurich mainstation. There we went first to the Zurich zoo, ate a formal dinner, back to the city, go on the lake with a ship, a little trip through the “Niderd rfli” and finally went home. Yes, it was October 13th, on a friday, so there had to been some mysterious troubles which finally came because the train didn’t stop in Grenchen, but that’s a detail now. Here a picture of me with the penguins: Here a picture from the dinner

Warning: useless rant follows Since about two years, my main machine is an Apple Powerbook G4. These come with builtin wireless ("Airport Express"), but for a long time there were no Linux drivers for these things. Instead, I had bought myself a USB wireless thingy; one based on a ZD1211 chipset, for which there is a free driver contributed by the company that designed the chipset. The driver needs non-free firmware, but I don't give a flying **** about that. The unfortunate thing about the driver is that it was written in a style that makes it hard to be accepted by the kernel developers, so that didn't happen. And won't for a while. As a result, the driver sometimes breaks upon kernel upgrade, which is a shame. But when it does work (which unfortunately is not 'now'), it works great; the throughput is about as much as I could expect from my 11M wireless access point. The alternative now is to use the Airport Express driver. Unfortunately, this driver only exists because some binary-only driver that existed for Linux somewhere was reverse-engineered. As a result, the driver isn't very good; it sometimes crashes on me (in which case the only thing I can do is power down my laptop and boot it up again), and when it does work only has a throughput of about 60kB, at best. Which is not very good (a 10Mbit network can easily reach about 10 times that speed; and yes, I did verify that I'm running at 11Mb/s, not at 1). I'm very grateful to Zydas for providing a GPL-ed driver for their hardware. If only companies such as nVidia, ATI, and broadcom would give up their crack pipe and behave similarly, then this world would be a much better place. But I'm not grateful to Zydas for just providing a dump of their CVS repository and leaving it at that; getting a driver into the Linux kernel is not that hard, it just takes some persistence. Had they done that, I would've had working wireless now. Real working. grmbl. Update: Seems the situation is better than I thought. It had been a long time since I last tried the bcm43xx driver. Last time I tried it it was a piece of crap; when I tried it a few days ago, it was also a piece of crap. Apparently, though, that was just bad luck, since the driver in 2.6.18 is buggy (but it should be fixed in 2.6.18.1). And for the Zydas driver, apparently it made it into the kernel mainline while I wasn't looking. Only it doesn't work for me, probably because the hardware is breaking down (if I hold it in a peculiar way, it gets detected as a broken USB1 device rather than a working USB2 device, which is not good...). That, or my access point is playing tricks on me. That wouldn't be the first time, either. I guess an apology is warranted here. Sorry.

The one thing about agreeing to dedicate my time exclusively to Debian for a month is that it means there are loose ends that had to be tied up first -- loose ends that in my case took until October 11th to tie up, leaving me no time to keep up on Debian in the meanwhile... But hey, it only took me until Saturday to get a handle on my email again (more or less), and until Monday to clean up the list of RC bugs so that it pretty accurately represents what we need to finish up for the release. And hey, it's really not too bad, when you consider that of the 299 RC bugs listed on turmzimmer.net as applying to etch, only 104 of them are more than 10 days old, which means we can expect a pretty sharp decline in this count as our maintainers diligently fix the hidden RC bugs that dunc-bank have been helpfully reporting for us. :) And of those 104 older RC bugs, about 10% or so are already fixed in unstable as part of one of two transitions: the Xorg 7.1 transition and the apache 2.2 transition, so that's where I'm focusing my attention right now -- along with tackling the "low-hanging" bugs, the ones on my own packages... There are other transitions we still need to pay attention to, such as ghc6 (fixes wrong code generation problems on alpha), libraw1394 (lib transition that blocks a few other RC bugfixes), and linux-2.6 (newest kernel wanted for best upstream security and hardware support), but other than that, we're pretty darn close to having the right set of packages for release. The freeze is looking closer every day!

The computer which hosts this host is a venerable Pentium 150Mhz, with 64Mb of physical memory and two decently sized disks. It has been running non-stop mostly without hiccups for several years, and I'm quite happy with it, even if the processing power is so scarce I've been having to tune down some services as Debian has gotten more resource hungry, dist-upgrade after dist-upgrade. Natura is my 2nd oldest Debian install, coming back from Ham, and after a while it became a home server when it was replaced by an Athlon 700Mhz at my father's house. The only hardware incidents are all related to blackouts or storms: two dead disks and one power supply. The CPU died years ago, but I discovered that many months later. I guess it wasn't so necessary. :) It is time to replace natura, though. The components are aging and they have become quite noisy, despite my attempts to cleanup the dust. Lately it is so loud that I can't understand how my dad can actually get work done with that persistent noise in the room. Besides, it'd be good to get just a little bit more of CPU power to do a few things that have been postponed for a while now. I have been looking for offerings in the embedded devices market. I am looking for a device with the following characteristics:

• Silent: this is a must. If fans aren't involved, that's great, but I know there are some devices with just one fan for the hard drives, etc. which are really silent too. Noise is the #1 reason I want to get a replacement.
• CPU power and RAM: it doesn't need to be too powerful, but of course an improvement over a Pentium 150 Mhz is expected. :) The minimal RAM would be 128Mb, I guess, and if it's expandable/replaceable, that'd be a big plus.
• Power consumption: I have other boxes around which I haven't used to replace natura to get more CPU power because I've always assumed that it'd be hard to match the Pentium's power consumption. As it's up 24/7, I want it to be good in this area. AFAIK, the devices I'm looking for do quite well on this area, though.
• Hard drives: many offerings accept two or four HDs inside the case. I won't need four, but the possibility of setting up RAID is quite attractive.
• Hackable: should be supported by GNU/Linux, and if d-i does a good job on it, bonus!
• Price: last, but not least, I'm willing to spend some money on this, but I probably don't aim for the most expensive devices...

I've found that the Thecus YES Box N2100 is one of the most interesting offerings: 2 Gigabit ethernet ports, two internal SATA HD bays, 3 USB ports... but is a bit too expensive: 350 (without disks). tbm also told me to look at some cheaper PowerPC devices, but I forgot the name right now. So, dear Lazyweb, what would you recommend as a natura replacement for a home server?

After much more work than was necessary, I managed to get Asterisk to blat on the TV the caller ID information of an incoming call. Next I need to see if I can pause the TV, and resume it when the call ends. The MythTV side just needed to be configured to listen on the UDP notify port, the XML templates and whatnot were already there for it (I think installed by MythPhone), so all I had to do was get Asterisk to run this script when a call came in:

#!/usr/bin/perl
use Asterisk::AGI;
use IO::Socket;
# Set this to the broadcast address for your network
$netbroadcast = "172.16.0.255";
$AGI = new Asterisk::AGI;
my %input = $AGI->ReadParse();
my $num = $input 'callerid' ;
my $name = $input 'calleridname' ;
($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime();
$date = sprintf("%02d/%02d/%4d %d:%02d:%02d",$mday,$mon+1,$year+1900,$hour,$min,$sec);
$sock = IO::Socket::INET->new(PeerPort  => 6948,
                              PeerAddr  => $netbroadcast,
                              Proto     => udp,
                              Broadcast => 1 ) or die "Can't bind : $@\n";
print $sock <<EOT;
<?xml version="1.0"?>
<mythnotify version="1"><container name="notify_cid_info"><textarea name="notify_cid_line"><value>Unused</value></textarea><textarea name="notify_cid_name"><value>NAME: $name</value></textarea><textarea name="notify_cid_num"><value>NUM : $num</value></textarea><textarea name="notify_cid_dt"><value>$date</value></textarea></container></mythnotify>
EOT
close $sock;
exit(0);

That was accomplished by just adding an AGI(mythcid.agi) application call to one my existing extensions that handled incoming calls. Future enhancements will involve displaying who the caller wants to speak to after they've selected the appropriate response from the menu we give most callers. The Asterisk::AGI Perl module was a bit hard to track down. I've made a 2 second (dh-make-perl) Debian package of it, available here. If I get sufficiently motivated, I'll consider cleaning it up and uploading it to Debian.

The computer which hosts this host is a venerable Pentium 150Mhz, with 64Mb of physical memory and two decently sized disks. It has been running non-stop mostly without hiccups for several years, and I'm quite happy with it, even if the processing power is so scarce I've been having to tune down some services as Debian has gotten more resource hungry, dist-upgrade after dist-upgrade. Natura is my 2nd oldest Debian install, coming back from Ham, and after a while it became a home server when it was replaced by an Athlon 700Mhz at my father's house. The only hardware incidents are all related to blackouts or storms: two dead disks and one power supply. The CPU died years ago, but I discovered that many months later. I guess it wasn't so necessary. :) It is time to replace natura, though. The components are aging and they have become quite noisy, despite my attempts to cleanup the dust. Lately it is so loud that I can't understand how my dad can actually get work done with that persistent noise in the room. Besides, it'd be good to get just a little bit more of CPU power to do a few things that have been postponed for a while now. I have been looking for offerings in the embedded devices market. I am looking for a device with the following characteristics:

• Silent: this is a must. If fans aren't involved, that's great, but I know there are some devices with just one fan for the hard drives, etc. which are really silent too. Noise is the #1 reason I want to get a replacement.
• CPU power and RAM: it doesn't need to be too powerful, but of course an improvement over a Pentium 150 Mhz is expected. :) The minimal RAM would be 128Mb, I guess, and if it's expandable/replaceable, that'd be a big plus.
• Power consumption: I have other boxes around which I haven't used to replace natura to get more CPU power because I've always assumed that it'd be hard to match the Pentium's power consumption. As it's up 24/7, I want it to be good in this area. AFAIK, the devices I'm looking for do quite well there, though.
• Hard drives: many offerings accept two or four HDs inside the case. I won't need four, but the possibility of setting up RAID is quite attractive.
• Hackable: should be supported by GNU/Linux, and if d-i does a good job on it, bonus!
• Price: last, but not least, I'm willing to spend some money on this, but I probably don't aim for the most expensive devices...

I've found that the Thecus YES Box N2100 is one of the most interesting offerings: 2 Gigabit ethernet ports, two internal SATA HD bays, 3 USB ports... but is a bit too expensive: 350 (without disks). tbm also told me to look at some cheaper PowerPC devices, but I forgot the name right now. So, dear Lazyweb, what would you recommend as a natura replacement for a home server?

I know, I just ranted about it. However, it would seem that the Xorg driver can do more with the video card in my laptop than would appear at first sight. If I plug a VGA monitor to the mini-DVI output of my PowerBook and start X, then the nv(4) driver seems to detect it. Behold the diff:

--- Xorg.0.log.not-connected	2006-10-19 14:49:07.000000000 +0200
+++ Xorg.0.log.connected	2006-10-19 14:49:51.000000000 +0200
@@ -11,7 +11,7 @@
 Markers: (--) probed, (**) from config file, (==) default setting,
 	(++) from command line, (!!) notice, (II) informational,
 	(WW) warning, (EE) error, (NI) not implemented, (??) unknown.
-(==) Log file: "/var/log/Xorg.0.log", Time: Thu Oct 19 14:42:00 2006
+(==) Log file: "/var/log/Xorg.0.log", Time: Thu Oct 19 14:42:46 2006
 (++) Using config file: "xorg.conf"
 (==) ServerLayout "Default Layout"
 (**)  -->Screen "Default Screen" (0)
@@ -444,7 +444,7 @@
 (II) NV(0): Probing for analog device on output A...
 (--) NV(0):   ...can't find one
 (II) NV(0): Probing for analog device on output B...
-(--) NV(0):   ...can't find one
+(--) NV(0):   ...found one
 (II) NV(0): Probing for EDID on I2C bus A...
 (II) NV(0): I2C device "DDC:ddc2" registered at address 0xA0.
 (II) NV(0): I2C device "DDC:ddc2" removed.
@@ -452,7 +452,46 @@
 (II) NV(0): Probing for EDID on I2C bus B...
 (II) NV(0): I2C device "DDC:ddc2" registered at address 0xA0.
 (II) NV(0): I2C device "DDC:ddc2" removed.
-(II) NV(0):   ... none found
+(--) NV(0): DDC detected a CRT:
+(II) NV(0): Manufacturer: MAX  Model: 178e  Serial#: 2006
+(II) NV(0): Year: 2000  Week: 13
+(II) NV(0): EDID Version: 1.0
+(II) NV(0): Analog Display Input,  Input Voltage Level: 0.714/0.286 V
+(II) NV(0): Sync:  Separate
+(II) NV(0): Max H-Image Size [cm]: horiz.: 36  vert.: 27
+(II) NV(0): Gamma: 2.76
+(II) NV(0): DPMS capabilities: StandBy Suspend Off; RGB/Color Display
+(II) NV(0): redX: 0.632 redY: 0.329   greenX: 0.272 greenY: 0.604
+(II) NV(0): blueX: 0.142 blueY: 0.062   whiteX: 0.280 whiteY: 0.311
+(II) NV(0): Supported VESA Video Modes:
+(II) NV(0): 640x480@60Hz
+(II) NV(0): 640x480@75Hz
+(II) NV(0): 800x600@75Hz
[...more data about the monitor goes here...]

The nv(4) manpage also contains this bit:

       Option "CrtcNumber" "integer"
              Many graphics cards with NVIDIA chips have  two  video  outputs.
              The  driver attempts to autodetect which one the monitor is con 
              nected to.  In the case that autodetection picks the wrong  one,
              this  option  may be used to force usage of a particular output.
              The options are "0" or "1".  Default: autodetected.

... but when I set that to 1 in the Section "Device" of my xorg.conf, it still uses the internal monitor of my laptop. Am I missing something?

While looking for users which still have “.” in their path, I found the following nice bloomer:

PATH= $PATH:.:$HOME/bin''

It’s obvious what the user tried to do. But why the fuck does this (more or less man or info page alike) quoting syntax work? It took me a moment to realise that this kind of “quoting” works in nearly all Unix shells: The two backquotes as well as the two single quotes become an empty string and are therefor completely useless in this case. The user probably read some uglily localized man or info page (like the German ones in Debian Sarge) and did some copy and paste to his .bashrc. And since it “worked” he didn’t see any reason to change it again.

Once again, I'm not involved enough in the rails community to know if something like this has already been done, but I thought it was kind of cool. It's a generic search system for ActiveRecords:

def searcher_find(paramname, model)
  conds = []
  condvals = []
  columns = model.column_names
  params[paramname].each do  k, v 
    ks = k.to_s
    if columns.include? ks
      col = model.columns_hash[ks]
      case col.type
      when :text
        conds << " # k  like ? "
        condvals << "%# v %"
      when :integer
        if v != ""
          conds << " # k  = ? "
          condvals << v.to_i
        end
      when :float
        if v != ""
          conds << " # k  = ? "
          condvals << v == v.to_f
        end
      end
    end
  end
  return model.find(:all, :conditions => [conds.join(' and '), *condvals])
end

You would call it like so: @products = searcher_find(:product, Product). The above version is just the "simplest thing that could possibly work", and probably needs fixing, but I thought I'd write it down so that others could take it and use it.

Although I am also tempted to consider taking up ballroom dancing in that case, on a very unrelated note, is this just my kernel, or is it a general knowledge that I can use /proc/1/root/ to access what is outside the chroot?

The recent news from the UK gives us an example of invasive security. Preventing passengers carrying on any hand luggage (even wallets) and frisking all of them is the type of treatment you expect for criminals and visitors to maximum security prisons. It's not what you expect for people who are involved in routine (or what used to be routine) travel.

The security measures offered by SE Linux are sometimes described as invasive. I don't believe that this is an accurate description. I admit that sometimes minor tweaks are required (such as setting the correct context of a file). But for most users (corporate users and typical home users) the distribution takes care of all this for them. A default Fedora install should just work for the typical home user and a default Red Hat Enterprise Linux install should just work for the corporate user.

The main reason that it's so easy to use is that the default domain for user sessions and for daemons that are not specifically configured in the security policy is unconfined_t. This means that programs for which there is no policy and programs run from a user session do not have SE Linux access controls. The default configuration of SE Linux only restricts programs that are known to be at risk.

The most common case of SE Linux access controls causing inconvenience is the policy for Apache (the daemon with the most configuration options). There are a set of configuration options (known as booleans) that can be used to determine what aspects of Apache will be confined, generally it only takes a few minutes to determine and specify the correct settings to support the desired operation.

Next time you are being frisked at a UK or US airport and are facing the prospect of a long flight with books and all other forms of entertainment banned keep in mind that airlines have invasive security and should be avoided if possible. SE Linux offers security that is at most a minor inconvenience (usually not even noticed) and should be embraced.

An anti-spam measure that is used by a very small number of people is that of verifying the sender address by connecting to the sending mail server. For example when I send mail from russell@coker.com.au the receiving machine will connect to my mail server and see whether it accepts mail addressed to russell@coker.com.au and will reject my mail if that isn't the case.

The problem with this is that if I try to send mail to someone who has their mail server listed as a SPAM source then their efforts to verify my email address will fail and then my message to them will bounce with a confusing error message. This means that if one of the two mail servers involved in the communication is listed in a DNSBL or RHSBL service then all communication will be impossible. There will not be an option for one person to say "please phone me on this number if you can't send me an email".

This happened recently when someone from Italy asked me a question about SE Linux. So I will answer here (maybe they read my blog). In any case the answer might be of general interest:

Firstly I have to note that I have a B.Sc degree and no post-graduate qualifications, so it is not accurate to address me as Dr. Coker.

The question is: Let's imagine a user acquire root rights. Especially on Fedora Core, which modify su command to map it to sysadm_r role, couldn't he/she simply disable SELinux, delete logs, and so on?

If a user obtains ultimate privileges then they can do all things including deleting logs etc.

One thing to note is that there is no need for any process other than kernel threads to have ultimate privs, it would be useful in some situations to make log files append-only for all processes and the SE Linux policy language supports this.

The nearest any release policy comes to implementing such things is the separation between sysadm_r and secadm_r in the MLS policy in recent versions of Fedora.

Also note that it is possible to configure a SE Linux policy that does not permit any process to request that a new policy be loaded, the policy files be changed on disk, or the use of programs such as debugfs. Using SE Linux to enforce a policy that can not be bypassed by anything less than booting from installation media is quite easy to achieve.

One idea that I had was to have GPG implemented in the system BIOS and have GPG checks performed on the kernel before it's loaded (to verify that the kernel had not been modified). The kernel could be passed a decryption key for the root filesystem by the BIOS, and SE Linux would be enabled as soon as the root filesystem was mounted. Thus nothing less than disassembling the BIOS would allow a hostile person to access the data on the disk. This is all possible with technology that has been common for many years. I almost convincced a BIOS author to implement this in about 2002.

There has been a lot of discussion recently about how to take laptops on planes following the supposed terror threat in the UK which has been debunked by The Register and other organizations. There is an interesting eWeek article about this that contains the interesting quote "The built-in locks don't yet meet TSA specifications because they cannot be opened using the TSA master key" when reviewing a laptop case. Creating a master key is not that difficult and is explained in this PDF file. Theft by baggage handlers is quite a common occurance (see this google search for details).

So baggage handlers can easily reverse-engineer the TSA master key, steal laptops from baggage, smuggle drugs, and put bombs in baggage if they are so inclined.

There have been a number of cases of laptops containing sensitive financial, medical, and military data being stolen. Now someone who wants to steal data merely needs to work as a baggage handler and copy the hard drives of laptops before loading them. Data is more valuable if no-one knows that it has been stolen.

It would be ironic if an airline employee had their laptop hard drive copied and sensitive information about airport security was lost because of this.

After a recent mailing list discussion about computer security I'm going to be quoted in someone's .sig so I think that I need to write a blog entry.

Here is an article about a 2001 case of a man who was arrested for pedophilia and spent 9 days in prison: http://www.xatrix.org/article.php?s=3549 .

This article on The Register has links to a few other articles and describes how a man has been found guilty due to the apparent actions of a hostile program on his machine (and served 20 days jail time).

Rumor has it that pedophiles are really disliked in prison and that they are often attacked by other prisoners. Even spending a few days in prison as a pedophile could be enough to get raped.

Run the latest version of the OS for your PC with all security patches. If you buy a second-hand machine reformat and reinstall as the first thing that you do just in case the last owner had kiddy porn (even though they may not have known of it).

I am constantly amazed at the apparent lack of interest in car-pooling when travelling between LUV meetings and the restaurant where we have dinner. After the last meeting I was one of the first five people to arrive at the restaurant and we had arrived in three separate cars. For the most luxurious travel you can have four people to a car and a standard sedan class vehicle can legally and safely carry five people. So an extra seven people could have been comfortably driven to the restaurant and an extra ten people could have been safely and legally driven to the restaurant. But instead most people were waiting in the cold at the tram stop.

Things are quite different in Europe. There was one occasion when after an LSM (Libre Software Meeting) conference in Bordeaux we got 8 people in a Mazda 323, now that's what I call car-pooling! NB This is dangerous and illegal, so I can't recommend doing it.

In regard to my post yesterday about Planet Debian I received the following response:
James Purser said I'm betting that your feed is an atom feed. We had the same problem on PLOA with Jeff and Pias feeds when they switched to atom. Planet needs to be upgraded.
Well I am using an atom feed, so this probably explains it. Sorry for the inconvenience to the Planet Debian readers, I guess that things will stay the way they are until it is upgraded.

Also when viewing my blog entry in Planet Debian I realised that much of a spam message had got pasted in to the URL field for the Planet Debian link. Oh the irony that I only found this embarassing error because of a bug in the Planet software.

This brings me to another issue, Security Enhanced X. With SE-X (before you ask, I didn't invent the acronym) you can use SE Linux to control communication between windows on an X desktop. With a modification to the clipboard manager (klipper in the case of KDE) every piece of data that's copied from an application will have a security context assigned to it and this context will be checked against the context of an application that is to be the target of a paste operation. Klipper will also have to support relabeling clipboard data. Therefore if I want to cut text from my email client (Kmail) and paste it into Firefox then I would have to relabel it with the appropriate MCS categories. This would permit me to paste text from an email into a web form with a few extra mouse clicks, but would prevent me from accidentally pasting the wrong text. Keeping in mind the fact that there are many more embarassing things that could be accidentally pasted into a blog entry than the contents of a spam this doesn't seem overly difficult.

PS Before anyone jumps to conclusions. When I receive GPG encrypted email or other material that should be kept confidential I try and avoid cutting it, and if I have to do so I clear the clipboard buffer afterwards. Keeping spam a secret is not really a priority to me so I didn't take adequate precautions in this case.