Search Results: "cas"

3 October 2006

Evan Prodromou: 11 Vend miaire CCXV

October is a busy month for us. October 14th is my birthday, and October 16th is our wedding anniversary. On our honeymoon in 2004, we took a trip to wt:Charlevoix at the mouth of the Saguenay fjord in Quebec. Then, in October 2005, Amita June had just been born, so we took a short trip to Ottawa for the weekend. At this point, I think we've established an anniversary tradition of short weekend trips to cities in Eastern Canada. This year, Maj started arranging a trip to St. John's in Newfoundland. I'm pretty fascinated by wt:Newfoundland -- it's one of the oldest settlements in North America, yet very isolated. Its culture is a unique blend of Celtic, English, and a smattering of French Canadian with an idiosyncratic accent and great music. But St. John's is just too remote for a relaxing, romantic anniversary weekend. We kept trying to find easier ways to get there, and nothing was working out. So we decided to save Newfoundland for a spring trip. My crazy-cuckoo dream is to drive from Montreal to Labrador City and then out to Goose Bay in Labrador on the mainland, take the ferry to Newfoundland, drive around a bit there, then back to Montreal on a car ferry. Good trip, eh? So, we decided to take things a little easier and go to another part of Canada. We've wanted to visit wt:Halifax for a long time, and now it looks like it's going to work out. It's only 1-1/2 hours by plane from Montreal, and it's supposed to be a very charming, fun city. I got good deals on Air Canada for the two of us, plus baby, and we're staying at the posh Lord Nelson hotel in the middle of town. Even though it's the "Splurge" hotel on the Wikitravel Sleep section, I was able to get a discount with my CAA card that makes the price just about acceptable for a special occasion weekend. Now we have to plan what to do when we get there. We've only been to Nova Scotia once, and that was just a jaunt across the border from New Brunswick for kcks. I'm going to pore over the Wikitravel and World66 articles to see what I can come up with, and hopefully do some research while we're on the road. Really, that's the best part for me. I probably shouldn't look so far ahead -- we've got Hudson (New York) still to do this weekend. Like I said, a busy month! tags:

Free Books I've been planning to go to the local Wiki Wednesday here in [wt:Montreal], so I was reviewing the Montreal Wiki Wednesday page for previous events. Although we've made it to a few of the previous ones, we definitely haven't made it to all the ones we said we would... so be it. One of the previous speakers was Hugh McGuire, a Montrealer who started an excellent project called Librivox. Librivox is a project to create free audiobooks, with chapters contributed over the Internet by readers around the world. They take books from Project Gutenberg (which is apparently a MediaWiki wiki site now... who knew?) and volunteers read them and then the whole thing gets munged into a nice little package. Everything stays in the public domain (bless their generous souls) and they even have a Librivox podcast just in case you swing that way. I'm super-hot for audio books. I love listening to them while driving, especially for long road trips. Maj is lukewarm on the idea, but she occasionally gets into them when we've got a good book going. The big downside is that they're ridiculously expensive -- $50+ for some books. The only thing that bothers me a bit about Librivox is that there arent CD Audio ISOs available. We have an MP3 CD player in our car, and I think it should work fine, but for sharing it's awful nice to have real CDs. UPDATE (from Hugh): There are mp3 ISOs available here: LibriVarc, but no aiff files. mega storage space, bandwidth and transfer problems to do that, but if anyone is interested in providing such CDs, or helping manage such a project, we'd love to know about it. tags:

BarCampMontreal And while drifting through Hugh McGuire's blog, what do I see but a link to the newly-announced BarCampMontreal -- the first BarCamp to happen here in The City Without a Nickname. I had thought that the loose plan was to do a BarCamp to coincide with RecentChangesCamp in May 2007, but this plan seems more impetuous and uninhibited -- just like a BarCamp. There are just too many people to invite here in Montreal, though... we have something like 20 Debian developers, a whole passel of bloggers and wikitistas, lots of games developers and folks like that. Lots of work before the big weekend. Did I mention that October is a busy month? tags:

Day against DRM And look at that... October 3 is the Day against DRM per Defective by Design. A new DRM info clearinghouse, cleverly named drm.info, launched today, too. I've been in the weird situation lately of fighting against over-protectiveness w/r/t DRM in the Creative Commons licenses, when in fact I think DRM is twisted and dumb. It's a bill of goods being sold to entertainment companies by shady technology groups, it's rarely effective, and its only value is to punish law-abiding citizens. It's gotta go. A passionate and profanity-laced article I wrote about DRM coders for Pigdog Journal was linked from ars technica and BoingBoing last year. Although my writing style is a bit different (cough cough) than it once was, I still feel the same about DRM: a shameful and hostile way for technologists to treat each other. tags:

Are you experienced? So, I like the TV show Lost a lot, but I had no idea about this immersive alternate reality game The Lost Experience. Seems like just the kind of intense investigation game to keep losties busy for the entire summer. (You know, while they weren't trying to figure out the truth about lonelygirl15.) I'm not really that into figuring this stuff out, but I do enjoy reading the details once people have worked them through. tags:

Edd Dumbill: Living and coding on a Mac

For most of this year I've been working mainly on a Macbook Pro, having deserted my Ubuntu desktop.  Somebody wrote to me recently, kindly enquiring how this life was going, and asking some questions in particular.

Although of limited interest to some, I decided to answer the mail here, if for nothing else to record my views for future reference.

Q: How is developing on a Mac? Is TextMate really that good?

Developing Rails applications on a Mac is sweet, and yes, TextMate really is that good. My jilted .emacs languishes in lonely misery.

Developing other (non-Mac) stuff on a Mac is a real pain however, because nothing's where you'd expect it after years of Linux use.  Like several other developers I've seen, I run Ubuntu Linux in a virtual machine under Parallels for such work.

It's not just that Macs lack apt-get (as you can get it with fink), it's that they lack the reliability of Debian or Ubuntu's package repositories to underpin it. Running Linux in a virtual machine is far easier.

On the subject of TextMate,  perhaps the best compliment I can pay it is that using it reminds me of the last text editors I really felt at home in, CygnusEd and then FrexxEd on the Amiga. TextMate's most serious flaw is the inability to create split views, however. It seems to me that's a key programmers' feature, to be able to read from one source file at the same time as editing another.

Q: Is the hype about Ruby on Rails true?

I still think so. I resisted it for 6 months because I tend to be averse to anything that gets such a large amount of publicity, but then stepped aboard the train around the time of Rails 0.13.

I've not really looked back after my initial experiments seemed to bear out the claim of developing "ten times faster than PHP". I'll admit I find it hard to keep up with all the extra developments that get added at the Rails cutting edge, but then again I don't really need them.  Most of those additions are refinements, rather than core changes. Constraints on my time mean I tend to write in a common Rails subset, as opposed to flexing my muscles with the obscure but clever bits.Even if your taste isn't for Rails, then the trend that Rails, Django and friends have started is improving the web development playing field for all.

Q: What makes you happy and sad about the Mac?

The things that the Mac still scores on are:
The interesting thing to me is that none of these are very difficult to surmount, for want of a little resource.  The day of the Linux desktop, so perennially around the corner, will yet come.

As a balancing postscript, I will mention that there are some things that are Mac irritants to a sensible Linux person, which include filesystem case sensitivity, lack of decent SSH agent (yes, I've tried them all), not knowing what to kill -9 when things go pear-shaped, Apple's arrogance, crippled nature of some default apps (iChat won't put multiple accounts in the same window, Safari doesn't support keyboard navigation at all well, Quicktime player won't play movies fullscreen).

MJ Ray: First of the gang to the vote

Strange comments from Release Manager Andreas Barth predicting that this resolution would mean:
'The debian-installer has to be changed prior to release of Etch. This change alone would delay by at least 6 months, according to Joey's estimations.'
The resolution does not specify how it should be implemented technically. I'm pretty sure other options (such as dropping some hardware support from the official release) have been mentioned and there are probably suggestions that I'm unaware of. If the release managers choose to delay the release until debian-installer is changed, then that is their choice.
'Even fonts and videos would fall into the category where we would need source - but what is the source of a font? or a video stream? (and yes, fonts are "works that are executed by other means", i.e. displayed on the screen) That is a great new place for lots of new discussions that don't really help our users, but will definitly waste lots of time.'
The source of a font is what you used to make that font. Similarly for other work. It's pretty obvious in most cases. As far as I understand the concept of streaming video, we don't have it in the release, so that one seems a strange argument to me.
'We would be in a very bad situation e.g. with the debian-keyring (and all other sort of crypthographic stuff) - I definitly don't plan to distribute the sources for my public key (as the sources can also be used to generate the private key).'
I think this is the only interesting point: but is the debian-keyring made up of programs, rather than data that is input to a program? Do the private keys contain instructions which are executed by GnuPG? If not, note that source provision is only "strongly recommended" not required and there is a pretty strong reason for it not to be included in this small case.
'In summary, this proposal would delay the release of Etch by at least 6 months, probably even one year. Of course, any of the pending GRs can still overrule the result of this GR, but - that is not something we should be proud about, or even plan.'
In summary, I think we should remember that predictions can be wrong as well as right, even from a release manager, whether or not they are being paid for their time by an external organisation. Of course, the release manager could try to make those predictions true, but that would be pretty cynical. Vote to reaffirm DFSG 2! Update: shortly after publication of the above, someone at TU Wien wrote "yay for debian-legal fuckheads". Good argument(!) I can see why you are at university(!) Also, Andreas Barth's last blog post keeps changing the date, so it sits in the top place on planet for ages. I didn't think it was so weak as to need that sort of help. This update suggests it might be a software bug, though. Update 2: Hoho, guess I found part of the problem!

Andreas Barth: Blogs and unknown times?

For some reason or other, one of my blog titles appears on the top of PlanetDebian for some time. I don't know why, and the file is on the filesystem (using CEST): 
-rw-r--r--  1 aba aba 1381 Oct  2 10:54 etch-gr-1.txt
I'm sorry if the mistake is on my side, please tell me what to fix in case it is.

2 October 2006

Jeff Bailey: IPv6

Slashdot had a post this evening about the update to the O'Reilly IPv6 book.

I took a scan of the comments, and got the usual bits - why would someone bother? What's the killer app? We're not running out of oil^Waddresses! While I don't claim to be an expert on the topic, where I have used IPv6 succesfully is on my home network. Where NAT is really annoying for geeks is that our ISPs give us one IP address, make it move around occasionally, and tell us we can't run servers on it. Add an IPv6 tunnel to this, and it doesn't really matter what my ISP thinks. My machines remain trivially addressable. Scanning the address space to try and hammer on the boxes is a non-trivial task and by-and-large, Windows zombies aren't usually talking on IPv6.

This isn't a permanent nirvana, but if general attitudes about v6 are the same as the drones on /., then my little workaround hack will persist for a while.

Andrew Pollock: [opinion] On Linux Australia futures

I've been a bit busy lately, so I've only now skimmed through my linux-aus backlog, as well has had time to put some thoughts together on the whole AUUG/LA thing. I will point out that I had a similar rant back in July last year, and a lot of what I said then still holds true. So one of the problems is we seem to have too many organisations. OSIA, AUUG, LA, SAGE-AU, ACS, to name a few. They've all got a bit of overlap. They've all got different names (well duh) that imply different things. So AUUG, as the Australian Unix Users Group, is losing is relevance. So much so, that the "About AUUG" page doesn't even discuss what the hell the acronym stands for. Somewhere along the line, they've adopting the tag line of "the Organisation for Unix, Linux and Open Source professionals". So they're clearing still trying to remain a "professional" body. As is SAGE-AU. Clearly with a name like the System Administrator's Guild of Australia, it's obvious what demographic this organisation is for. Now of course a lot this organisation's members are going to be administering Linux. You could also argue they're using it as well. SAGE-AU is operating-system agnostic though, and doesn't really get all community about the operating systems its members administer. Which leads us to Linux Australia. An organisation that (at least in my opinion) that is more about the community around the operating system than anything else. And in this case, by operating system, I'm talking about a lot more than just the kernel. OSIA, on the other hand, is an organisation I haven't heard a lot about, and know even less about. The name though, pretty clearly suggests what they're on about. If OSIA didn't look like it was more about corporate members than individuals, I'd be saying that this is where a large chunk of AUUG members should go, if AUUG were to fold. It does leave a certain demographic out in the cold: ISVs that make closed-source software for Unix and Linux. Since, for example, CheckPoint seem to be sponsoring the AUUG conference, they obviously feel that they have some sort of affinity with the organisation. Finally, there's ACS. Another organisation I don't know a lot about. I would think that maybe this could be another potential destination for AUUG members if it were to fold. Back to Linux Australia, and whether that name is the best thing for the organisation. I personally think it is not. Linux Australia is way more about F/LOSS evangelisation and the community that exists around that, than anything else. To a lesser degree, it tries to act as the "mother LUG" of all the Linux User Groups around the country, but given the loose structure of the LUGs, this is more of an assumed position than anything else. So what to call LA instead? Steal AUUG's tag line? "The Australian Linux and Open Source Community Group (ALOSCG)"? "The Australian Linux and Free Software Community Organisation (ALFSCO)"? Hmm, the second one could be mutated in "Alfresco". Cute. Funnily enough, the same arguments apply to renaming linux.conf.au, however I'm not in favour of that. I agree with what Maddog said on the linux-aus list, about it being easier for sponsors to identify with something more specific like "Linux" than something more amorphous like "Free and Open Source software". I also think linux.conf.au has a pretty strong brand associated with it. Finally, I want to bang the drum for organisational change. There was some discussion about membership tiers. I think this is a good idea. I think having paid members (and some member services) would be good. It would provide Linux Australia with an additional revenue stream, and it would allow it to provide something to its members. If there was a membership structure like "student" (which would be free), "associate" (paid, but cheap) and "professional" (paid, but slightly more expensive), you could allow all categories to vote, but give the paid members some additional services like a sticky email address, dynamic DNS hostname, maybe if LA got direct sponsors, the sponsor organisations could provide discounts to members like what SAGE-AU does. I also think that if LA were to employ a full or part-time administrative person (like SAGE-AU did until recently) would also be beneficial. This person could do heaps of administrative stuff and coordination for the organisation, as well as be a resource for the linux.conf.au organisers, and be cheaper than having to pay an Executive President or something like that. it would allow for the organisation to go to the next level, and be a little less amorphous and have a tangible existence.

29 September 2006

Edd Dumbill: A deployment pattern for Rails and bzr

I can't get enough of the bzr revision control system, and I'm quite fond of Rails too. So, I thought I'd share my deployment setup for Rails applications using Capistrano and bzr. Capistrano works on the assumption that you're deploying from a revision control system. Secondly, it requires that your deployment server is aware of how to access this system. This leaves you with various options, the most obvious of which are:
  1. Host your source repository on your deployment server
  2. Have your deployment server equipped with remote access to your source repository
  3. Mirror your repository to your deployment server
Of these, option 1 is out for all but somewhat casual projects, option 2 either opens up your source repository more than I like, or needs fiddly tunnelling of SSH which I don't think Capistrano is up to yet (I only like to use key-based access with SSH, rather than password based access, which seems at the moment complicate life where Capistrano is concerned.) I've opted for option 3. The pattern I use is this. On setting up the deployment server, I push a copy of the bzr repository to a private directory. Then, on deployment I first update that repository securely from the master repository inside my network, then export the new release locally on the server. Here are the relevant bits of my Capistrano configuration: 
set :repository, "/opt/repo_mirror/# application "

…

set :scm, :bzr
set :checkout, "branch"

…

task :before_update_code do
   bzr push sftp://deploy.example.org/opt/repo_mirror/# application 
end
One big advantage of this over option 2, a remote source repository, is that only the changes are sent up to the server, and the bandwidth-intensive application checkout happens locally on the deployment machine. The final bit of improvement this could stand is to have the bzr checkout use export and not branch, but I think I'll have to alter the Capistrano's bzr plugin in order to do this.

Edd Dumbill: Locking down portmap on Debian

Most sensible people are very wary of NFS and its potential for security holes. If you can at all help it, it's a good idea not to run NFS and portmap on a network interface with direct internet connectivity. However, this isn't always convenient. As I needed to have NFS sharing on a host exposed to the internet, I set about finding the various places I needed to firewall. The tools I typically use to verify I've done the right things are netstat -nap on the machine concerned, to check for listening processes, and nmap from remote hosts to sniff for open ports. Portmap and its associated programs mostly use 'tcpwrappers' for controlling access. The first step you ought to take in securing portmap is to ensure that your hosts.allow and hosts.deny files are set up to control access properly. In /etc/hosts.deny, deny access to allcomers: 
mountd: ALL
statd: ALL
portmap: ALL
rquotad: ALL
Then in /etc/hosts.allow, let the good guys through (adjust for your network): 
mountd: 192.168.0.
statd: 192.168.0.
portmap: 192.168.0.
rquotad: 192.168.0.
On top of this, however, you should firewall off the ports that these programs use. As I found out, this is not as easy as it sounds. Portmap assigns random ports for some of the services it starts. You can run rpcinfo -p to see the ports in use. An example run on one of my machines looks like this: 
program vers proto   port
 100000    2   tcp    111  portmapper
 100000    2   udp    111  portmapper
 100003    2   udp   2049  nfs
 100003    3   udp   2049  nfs
 100003    4   udp   2049  nfs
 100003    2   tcp   2049  nfs
 100003    3   tcp   2049  nfs
 100003    4   tcp   2049  nfs
 100021    1   udp  32770  nlockmgr
 100021    3   udp  32770  nlockmgr
 100021    4   udp  32770  nlockmgr
 100021    1   tcp  32788  nlockmgr
 100021    3   tcp  32788  nlockmgr
 100021    4   tcp  32788  nlockmgr
 100005    1   udp   1005  mountd
 100005    1   tcp   1008  mountd
 100005    2   udp   1005  mountd
 100005    2   tcp   1008  mountd
 100005    3   udp   1005  mountd
 100005    3   tcp   1008  mountd
 100024    1   udp    863  status
 100024    1   tcp    866  status
Of these, nfs and portmapper always use the same ports, 2049 and 111, so ensure you block off these. What about the rest? Happily, there's a way to configure them to use constant ports so we can reliably firewall them. Life would be too easy if all this configuration was in the one place, so here's how to find the different places you need to change. Finally, if you're running quotas, be sure to do something similar with RPCRQUOTADOPTS in /etc/default/quota. See also: Finally, I ought to note that I've written this up in case it helps anybody else. As with everything I write here, I make no warranty about its accuracy. Security is hard and obscure (but that's no reason not make our best efforts!)

Russell Coker: SAK, ctrl-alt-del, and Linux keyboard mapping

A common problem with Linux systems is when Windows users press CTRL-ALT-DEL at the login prompt and reboot the machine.

To fix this some people change the ^ca line in /etc/inittab to just disable the reboot function. However this is not desirable because sometimes you want to reboot a machine with a simple keypress.

Another problem that has not been widely considered is the use of fake login prompts by attackers. This can be implemented in either text mode or graphics mode. All the fake login prompt has to do is display something that looks like a real login prompt, accept a user-name and password, verify the password (a localhost ssh connection is a good way of doing this) and then abort. In the case of a text-mode login the user will think that they entered the wrong password, in the case of a GUI login via an XDM program the user will think that the login program just crashed. Then the attacker has access to their account.

The solution to the fake-login problem is the use of the Secure Attention Keyboard (SAK) feature. When invoked this feature makes the kernel kill all processes that are on the virtual console in question. If you make CTRL-ALT-DEL the SAK combination then pressing those keys will cause the kernel to kill any processes that are attached to the current virtual console and preventing the ability of hostile programs to forge a login prompt (which is the same as it's purpose in Windows).

The next thing to do is to make another combination used for system boot. A reasonable combination seems to be CTRL-ALT-BREAK as those keys are widely separated and the combination is not used for anything else.

If you put the following in a file named sak.map (or whatever you want to call it) then the command loadkeys sak.map will apply the change. Note that when creating a keyboard map you should do it on a machine for which you don't mind being forced to perform a hardware reboot. It's easy to make a mistake and give yourself a keyboard mapping that is not usable. Another possibility is to do such testing on a machine that allows ssh logins, you can then login via ssh and run loadkeys -d to correct any errors you might make.

control alt keycode 119 = Boot
control alt keycode 83 = SAK
control alt keycode 111 = SAK
control altgr keycode 119 = Boot
control altgr keycode 83 = SAK
control altgr keycode 111 = SAK

Note that the above covers both ALT and ALT-Gr keys as well as the numeric keypad and regular versions of the delete key.

dumpkeys -l gives you a list of all possible keyboard combinations. showkey will display the number matching any key you press and will exit after 10 seconds of inactivity.

28 September 2006

Biella Coleman: The Silence of Failure in Silicon Valley

After about 6 months of initial research in the Bay Area, I had to make a choice over the future direction of my more directed fieldwork. Would my project be on Silicon Valley, its religious fervor for the exuberant technology start-up, with the geek entrepreneur (probably with some affiliation with Standford) at its center stage, or would it be more broadly about free software and the culture of geekdom? I chose the later, for various reasons, but I think I wanted to write a dissertation that did not bleed with cynicism but instead flowed and flowered with a lot more joy than could have been possible if I had stayed within the grasp of the start-up and the venture capitalist. That said, I learned a lot about SV, took a lot of notes, and read most anything I could get my hands on whether the work of San Jose Anthropologist,Jan English-Lueck or published in magazines like Mother Jones, Harpers, and even the National Geographic. One of the luminaries that writes about SV from a cultural perspective is Paulina Borsook. And she is fine writer who admittedly has ticked me of on occasion (to be precise because she collapsed too much of geek culture into that of the specific SV world in Cyberselfish, which at the time I found almost personally offensive, probably more than it should have). Today I just came across a short, older but very illuminating piece of hers The Disappeared of Silicon Valley (or why I couldn’t write that piece) which is as much about the limits of historical representation in general as it specifically about the failings of start-ups in SV at the end of the recent boom and bust cycle. So her goal was simple enough: To find people involved in starting new high-tech whose companies had died.. and to find them to get a more visceral and cultural window into this experience. But it was a near to impossible task. Despite her impeccable record with confidentiality and a far flung social network, she could not get anyone talk about these ostensible failures. There has been a good amount of writing on the limits of historical representation because the archive or what comes to be the archive is a function of power and it is usually the powerless who are left out, as the work of Michel-Rolph Trouillot has so eloquently shown. But while it is true that some CEO of a dethroned corporation may be powerless in some sense of the word, it is not what we associate with the word. But in fact, the power of stigma of failure in a region that magnifies an already well-develiped cultural fetish of success (especially, I imagine, among male graduates, of places like Stanford Buisiness School), is enormous, so much so, that it seems one can only write about the experience, as Barsook has done so well, through the reality of a lack, through silence.

Evan Prodromou: 6 Vend miaire CCXV

As far as I can tell, polygen is a piece of software developed to make jokes at my expense (my favourite kind!). First there was the Evan's blog posts grammar, and now I've made the list in the Complaints grammar for the Debian:TheDebianChoirOfComplaints. I'm so glad this process has finally been automated! tags:

Hey Don Don Marti saw my ssh woes as previously mentioned (see Tag/ssh) and gave a cool shell function to fix it. It even snags credentials from your other ssh-agent instances, even if they're not an immediate parent of your shell. Thanks, Don! Thanks, wp:Lazyweb! tags:

OpenSearch So, I've been twiddling around with OpenSearch, the feed-based distributed search system that weird little Amazon subsidiary A9 is foisting off on the world. I think it'd probably be pretty neat for Wikitravel. Gregory Szorc, the mad scientist of the MediaWiki world, has done a nice OpenSearch extension for MediaWiki. I had to tweak it a lot, which was kind of fun, but I still haven't gotten it to work entirely satisfactorily. I'm suspecting I'll have to changeover to lucene search, the MW plugin that uses Lucene as search subsystem, to really get reasonable performance out of this. In any event I'm mildly interested in OpenSearch. It's nice, I guess, and it's kind of cool that it works with Firefox and IE7 as an in-browser search alternative. However, I'm disappointed it's not supported in other portals besides A9. tags:

YaCy Speaking of search: wow. YaCy. The distributed search engine system. It seems like a really good idea, but I'm not really impressed by the search results I've gotten so far. But, regardless, I've set up the crawler to run on a couple of servers around the house, and the daemon seems to be running pretty cool, so it's not really noticeable. I'll probably forget about them for a while, and we'll see what some benign neglect will bring to their index accuracy. tags:

27 September 2006

Aigars Mahinovs: Howard worldwide

I am hooked. I love to listen to Howard Stern. Up to now I have been doing it quietly by downloading it from P2P ever since I heard about him from a 60 minutes appearance just before moving to satellite radio on 1st January of 2006. Finally Sirius started transmitting their radio stations to the Internet (for a fee). 13$ a month is not cheap for Internet radio (that is common to be gratis), but Howard Stern makes up for every penny of that with 5 hours of great talk show 4 days a week. And the dozens of other channels are just bonus. If I were in the coverage zone of the Sirius satellite, I would get a receiver and look forward to the Stiletto, but as I am in UK, I have to make do with the Bittorrents shared by a highschool janitor and now with live streams from Sirius.com for 13$ per month. Luckily, the streaming works perfectly in Linux. (I did have to supply a USA address when registering, so I gave them the address of Google headquarters :) ) One more case where a gratis P2P downloads create a devoted fan and generate a sale. Now I am just relaxing and enjoying channels 100 - Howard, 9 - The Pulse, 12 - Super Shuffle and 33 - Area 33.

Uwe Hermann: Towards a moderately paranoid Debian laptop setup [Update]

I was planning to set up my laptop from scratch for a while now... so I did. Preparation BIOS Installation / Setting up full-disk encryption using dm-crypt
  • Enable shadow passwords. Allow login as root (I feel confident that I won't do stupid things as root).
  • Choose a good root password, and a (different) good user password. Don't enter a full name for the user.
  • Choose the latest kernel (old kernels might have security issues). Do not participate in popcon.
  • Do not install any tasks (no "desktop", no "base system"). We want the smallest installation possible, and add only the packages we really need. Fewer packages means fewer security issues (statistically).
  • That's it. Eject the CD-ROM, reboot, change the BIOS to only allow booting from hard drive.
    • Post-installation tasks Networking, Upgrading and Apt-secure SELinux Now install and set up SELinux. This section is based on notes from Erich Schubert (thanks!), and will soon appear in the SELinuxSetup wiki page, too. Behaviour Further ideas That's it. You can take off that stupid tin-foil hat now. Update 2006-09-29: Fixed typos. Mentioned sxid. Added two-factor authentication.

    Uwe Hermann: Towards a moderately paranoid Debian laptop setup

    I was planning to set up my laptop from scratch for a while now... so I did. Preparation BIOS Installation / Setting up full-disk encryption
  • Enable shadow passwords. Allow login as root (I feel confident that I won't do stupid things as root).
  • Choose a good root password, and a (different) good user password. Don't enter a full name for the user.
  • Choose the latest kernel (old kernels might have security issues). Do not participate in popcon.
  • Do not install any tasks (no "desktop", no "base system"). We want the smallest installation possible, and add only the packages we really need. Fewer packages means fewer security issues (statistically).
  • That's it. Eject the CD-ROM, reboot, change the BIOS to only allow booting from hard drive.
    • Post-installation tasks Networking, Upgrading and Apt-secure SELinux Now install and set up SELinux. This section is based on notes from Erich Schubert (thanks!), and will soon appear in the SELinuxSetup wiki page, too. Behaviour Further ideas That's it. You can take off that stupid tin-foil hat now.

    Wouter Verhelst: Infodrom quotes

    Nothing like reading quotes by yourself out of contet. I think I prefer this one:
    And "88" is based on 2 eights, which is 2 more than 6. This means that there are 3 numbers 2 in the number 88; with 8 being 2 more than 6, the number is actually 666, which is the number of the devil. Therefore, they *must* be associated with the Devil.
    I can't fully remember what the context for this one was (nor can I for most of the other quotes on that page), and google doesn't help. I do have a faint idea that it involved some case where I thought someone else was basing an argument on something ridiculous, and that I wanted to show them that; but I'm not sure what it exactly was. Anyone else have an idea here?

    Dirk Eddelbuettel: Announcing 'littler'

    Earlier today, Jeff announced our new toy r (aka 'littler') with this post on the r-help list. What is 'littler'? We summarized it briefly in the post and on our respective or pages:
    GNU R, a language and environment for statistical computing and graphics, provides a wonderful system for 'programming with data' as well as interactive exploratory analysis, often involving graphs. Sometimes, however, simple scripts are desired. While R can be used in batch mode, and while so-called 'here' documents can be crafted, a long-standing need for a scripting front-end has often been expressed by the R Community. littler (pronounced 'little R' and written 'r') aims to fill this need. It can be used directly on the command-line just like, say, bc(1): 
    	$ echo 'cat(pi^2,"\n")'   r
	9.869604
    http://ftp-master.debian.org/new.html Equivalently, commands that are to be evaluated can be given on the command-line 
    	$ r -e 'cat(pi^2, "\n")'
	9.869604
    But unlike bc(1), GNU R has a vast number of statistical functions. For example, we can quickly compute a summary() and show a stem-and-leaf plot for file sizes in a given directory via 
    	$ ls -l /boot   awk '!/^total/  print $5 '   \
		 r -e 'fsizes - as.integer(readLines());
			print(summary(fsizes)); stem(fsizes)'
	   Min. 1st Qu.  Median    Mean 3rd Qu.    Max.
	     13     512  110100  486900  768400 4735000
	Loading required package: grDevices
	  The decimal point is 6 digit(s) to the right of the  
	  0   00000000000000000011112223
	  0   5557778899
	  1   112233
	  1   5
	  2  
	  2  
	  3  
	  3  
	  4  
	  4   7
    And, last but not least, this (somewhat unwieldy) expression can be stored in a helper script: 
    	$ cat examples/fsizes.r
	#!/usr/bin/env r
	fsizes - as.integer(readLines())
	print(summary(fsizes))
	stem(fsizes)
    (where calling /usr/bin/env is a trick from Python which allows one to forget whether r is installed in /usr/bin/r, /usr/local/bin/r, ~/bin/r, ...) A few examples are provided in the source directories examples/ and tests/.
    At least one shortcoming already became apparent: by calling it r to not trample on the real R binary, we obviously overlooked that there are certain operating systems on which case is ignored -- ouch. So Mac users may have to install it as a littler binary. Other comments, as seen in the mailing list thread, are mostly supportive. littler can either be downloaded from either the Vanderbilt BioStat Wiki or my local archive. Also available is SVN access via 
    	svn  http://littler.googlecode.com/svn/trunk/ littler
    Debian users shall get it via apt-get install littler as soon as it leaves Debian's NEW queue. In the meantime, the configure && make && make install three-step works for us under any of Debian testing, Ubuntu Dapper, OS X, and with both R 2.3.1 and the pre-releases of R 2.4.0.

    Benjamin Mako Hill: Who Gets to Define Freedom?

    Recently, I had an opportunity to publicly discuss my projects around definitions of freedom for creative work with Lawrence Lessig at a workshop at Wizards of OS. In particular, we talked about my article Toward a Standard of Freedom in which I advance a call for a list of essential freedoms, a definition of free culture or content, and a goal around which a social movement for free creative works can be based. At WOS, Lessig and I agreed that its likely that, eventually, some standard (or standards) of freedom will take hold. Like me, Lessig seems to think that this is a good thing. We both agree that there will be, and should be, competing definitions of freedom, competing social movements, and a long conversation about what essential freedom really to creative works is before we get there. Our most fundamental differences seem to stem from a disagreement about who gets to define freedom or, perhaps more precisely, who the communities of producers should listen to in order to find out what essential freedoms in the domain of different types of creative works are. Lessig is extremely reticent to make any claims about what essential freedoms might be: he does not want to speak for creative communities that he does not intimately understand. While he seems to be suspect of any project making normative claims in this regard, he disagrees most strongly with projects like mine that offer definitions of free content and expressions that are intended to be applied broadly and outside of the explicit domain of the definition's initiators recognized experience (in our case, online encyclopedias and software). Lessig explained that he trusts musicians -- and in particular, Gilberto Gil, the progenitor of the CC Sampling license -- when it comes to defining essential freedoms for music. Similarly, he trusts programmers -- and in particular, Richard Stallman -- when it comes to defining essential freedom for software. Since Richard and I are less accomplished, less well known, and less experienced musicians, Lessig feels most comfortable erring in favor of Gil where there's a disagreement between us about the scope of essential freedom for music. While his is a convincing argument, I disagree with Lessig's position for a series of reasons I'll try to discuss here. First, it is important to remember that Gilberto Gil does not represent all musicians. There are many artists and musicians who support my definition. There are many (and probably more if the CC license usage statistics are any indication) who support Gil's lower base-line. It's worth remembering that, even though we disagree, both Gil and I are offering controversial and extreme positions. Today, most creators think that giving away their work at no cost, even non-commercially and barring derivatives, is crazy. To illustrate why this is not a problem, we can look again to free software. In the free software community, we see that Richard Stallman does not speak for the programming community at large when it comes to defining essential freedoms to code. In the mid-eighties, Stallman spoke for himself and a tiny handful of like-minded others. Today he speaks for many more but it's still a tiny fraction of all programmers. It's hard to remember when you're down in the trenches but the idea that software should be free remains a marginal and kooky idea to this day. Due to the hard work of the free software movement, many people have adopted Stallman's definition of essential freedom for software and many more will. But it is not mainstream and it didn't get here by being so. Setting an ethical standard and a goal for a social movement should not be about being popular. It should be about describing an ideal. It should be about standing up to injustice. It should be about answering the question, "what sort of world do I want to live in?" Not only is this process not a popularity contest, it will, in all likelihood, stand to make one very unpopular. Being respected or seen as an expert within a field will help with the adoption of one's ideal. Programmers trusted Richards Stallman because he'd written large parts of the very popular programming tools like GNU Emacs and GCC. However, it wasn't from his experience in programming that this insight into the importance of software freedom stemmed. It was from his desire to be a good, ethical, neighbor and member of a technical community. To this day, most great programmers continue to disagree with Richard. Second, I'm interested not only in talking about the ability of authors to choose how their works are used but in the rights of readers. You don't need to have a platinum album under your belt to have an informed and important opinion about how music should be heard, experienced and distributed. Lessig's current push for a "Read-Write Culture" is very fixated on creators and re-mixers. That's only one important piece of the community that frames and deals with this problem. Third, while I agree with Lessig that discussions around definitions of free culture must happen separately in each separate artist community, I see several compelling reasons why a single definition of freedom may be a very good idea both tactically and philosophically. For example, it provides a common rallying cry around which different creative groups can collaborate and it mirrors the common treatment of different types of works in current IP systems. More importantly, there are fundamental similarities between information goods and the way they are created, distributed, and consumed on computers and in digital networks. I've highlighted this before in quoting Eben Moglen on the ethics of creating artificial scarcity in goods with zero marginal cost. As a final note, it's worth stating that one doesn't need to feel that all works should be free to support a definition of freedom. Richard Stallman provides a great example of this. Stallman doesn't think that works of opinion or works that are designed primarily to entertain need to be free. However, he does believe that the term "free" should refer to a fixed set of freedoms so that he can take such a position. Without a definition of "free," a position on what should or should not be "free" is impossible. I believe that freedom to distribute and produce information goods like art and content and software are embedded in a set of freedoms and rights for both the producers and consumers. I think that to some degree (and quite probably a less extensive degree), Lessig agrees with this. Unlike Lessig, I don't believe that one needs extensive expertise in the creation of a particular type of creative good to make true statements about what is ethical or unethical in the production, distribution, and control of it. To use admittedly extreme analogies, you don't need to be a slave owner (or slave for that matter) to say that slavery is wrong. You don't need to be a farmer to make arguments against or in favor of vegetarianism or in favor of free range animals. I don't believe you have to be a technologist to claim that certain freedoms to technology are essential. I don't believe that you need to be an musician (successful or not) to make claims about essential rights to music. I welcomed the conversations and challenges that Lessig offered and it was encouraging to see agreement on the process of discussion and debate going forward. After the workshop, Lessig suggested that we continue the conversation. I look forward to doing just this in other venues and in other ways.

    26 September 2006

    Evan Prodromou: 4 Vend miaire CCXV

    In all the fuss over the last few days I haven't mentioned that our friend Jani Patokallio has been in town this week. Jani is a longtime, dedicated Wikitraveller who's been instrumental in the success of the site; his dad is the Finnish ambassador to Canada so he gets the occasion once in a while to be in our neck of the woods. It was great to have him here. First, it was good because we finally managed to go out to Maamm Bolduc, the fantastic nearby diner/restaurant with the great poutine that I mentioned in Journal/20 Prairial CCXIV. Great according to montrealpoutine.com, that is. And I have to confess: it was an incredibly good poutine. Maj and I got the v g , which was rich with fried mushrooms and peppers, and Jani got the bourgignon, full of wine and beef. I think we all left satisfied. We also managed to head out to Chu Chai, the Thai restaurant on rue St Denis with all the fake meat. Jani brought his brother Miko who's at McGill right now, and they didn't seem to mind the tofu and seitan and stuff, so it must be good. I also had showed Maj the Debian:HugAFinn game, and we resolved to earn some points while we had two Finns in a relatively captive situation. I think both J & M were nonplussed by our hugging advances, but once they learned that it was in the interest of gaining points, they acquiesced stoically. Fine people, the Finns! tags:

    Thanks Matt Matt Brubeck pointed out a 7-line shell script to fix the ssh UI problem I pointed out on Journal/2 Vend miaire CCXV. At least I think it was Matt -- he didn't sign his comment. This makes the second time in the last week or so that someone else has edited my WikiBlog. I guess it's a good thing, but it's making me think I need to work out some formal way to do commenting. tags:

    25 September 2006

    Russell Coker: Ethernet bonding

    Bonding is one of the terms used to describe multiple Ethernet cables used to form a single virtual network link. This can be done for performance or reliability.

    Bonding for performance used to be common when 100baseT was the fastest network technology that was commonly available. In 1999 servers could usually sustain considerably more than 10MB/s so a single 100baseT network interface was a performance bottleneck. At that time I worked with Cisco switches and Solaris machines that had up to four 100baseT links bonded for performance.

    Nowadays Gigabit Ethernet is commonly available, most laptops have Gigabit Ethernet on the motherboard. Gigabit PCI cards are as cheap as $35, and Gigabit switches can be purchased for as little as $139. Server hardware is a little more expensive, but it's still quite cheap and commonly available.

    Most people don't need more than Gigabit speed, in fact most systems can not saturate a Gigabit link due to poor application design, a slow operating system, or slow disks used to provide the data. So at this time there is little speed for bonded Gigabit networking for performance.

    There is still the issue of reliability. Often you want to have two ethernet cards and cables configured so that if one breaks the network won't go down.

    One annoying thing about bonding in Linux (in 2.6.x kernels) is that the module has to be loaded separately for each bond interface, and the parameters for an interface can't be changed without unloading and loading the driver (very painful if you log in to the machine via ssh over the bonded interface to do sys-admin work).

    The parameters I have in /etc/modprobe.conf for bonding are:

    alias bond0 bonding
    options bond0 mode=1 arp_interval=500 arp_ip_target=192.168.0.1

    This means that if there is no traffic on the link then every 500ms an ARP request will be sent for the address 127.128.129.130 (I used the address of my router but substituted a different value for this blog entry). An ARP request for a machine on the local LAN is a request that will always be satisfied if the machine in question and the network link are working.

    The idea is that you have two switches and every computer that matters has two ethernet ports. If one port stops working (broken Ethernet card, cable, or router) then the other takes over.

    The special file /proc/net/bonding/bond0 can be used to view the current configuration of the bond0 device.

    Below are sample configuration files for Fedora and Red Hat Enterprise Linux to configure bonding:


    /etc/sysconfig/networking/devices/ifcfg-bond0:
    DEVICE=bond0
    IPADDR=192.168.0.2
    NETMASK=255.255.255.0
    NETWORK=192.168.0.0
    BROADCAST=192.168.0.255
    ONBOOT=yes
    BOOTPROTO=static
    # GATEWAY should be the IP address to ARP ping
    GATEWAY=192.168.0.1
    TYPE=Ethernet

    /etc/sysconfig/networking/devices/ifcfg-eth0
    DEVICE=eth0
    BOOTPROTO=none
    HWADDR=xx:xx:xx:xx:xx:xx
    ONBOOT=yes
    SLAVE=yes
    MASTER=bond0
    TYPE=Ethernet

    /etc/sysconfig/networking/devices/ifcfg-eth1
    DEVICE=eth1
    BOOTPROTO=none
    HWADDR=xx:xx:xx:xx:xx:xx
    ONBOOT=yes
    SLAVE=yes
    MASTER=bond0
    TYPE=Ethernet


    Note that there is nothing preventing you from having more than two devices bonded together for reliability, but I doubt that you really need that.

    Jordi Mallach: Visited the opthalmologist

    Today I went to the hospital to visit the opthalmologist. The good news: as expected, what happened the other day was just a case of optical migraine, which needs no treatment and I shouldn't worry about. Thanks to everyone who mailed me or commented in the blog giving advice or wishing me luck! The doctor examined my retina, and found nothing wrong with them that would cause lights or total blindness. He did find what he described as the start of retinal folding , which might be congenite, but I should keep an eye on in case it becomes a real problem. Apparently I should be vigilant to objects appearing with deformed shapes, etc. So I came back earlier that expected to office, but I really can't do anything here due to the pupil dilation. Everything is blurry, light is extremely annoying, and I'm writing this using a ridiculously big terminal font. The get decent sleep plan continues, and I've been sleeping the expected amount of hours since last Tuesday.

    Next.

    Previous.