If I told you that in the last two days, I have been caught in a vortex of coincidence, a vortex composed of pit bulls, free software, diaspora (the software), mold, and a New York Times reporter, I bet you would think not likely. So the story started on Jet Blue, which offers snacks, lots of them, and Direct TV. Since I don t have TV I kinda go on a binge, watching all sorts of shows as I make my way home. I watched a pretty distributing but interesting documentary on Jim Jones on CNN and a show on Animal Planet on pit bulls and parolees. When I rolled into my my current digs in northern Manhattan (I am currently banished from my downtown apt due to mold, but that is a whole other story), there was a dinner party well underway. At some point in the evening prompted by me, we talked pit bulls as my friends want to get one but their family has issued a threat of disavowal if they do. The next morning, I was scoping out the website for the Animal Planet show as I was intrigued by it and frankly I kinda like pit bulls (maybe less now although I think they are unfairly maligned). Five minutes into pursuing the site, I hear screeches from hell. It sounds like a woman is being attacked. And she is. A woman right outside of my window was being attacked by a pit bull. So I am staying with a friend, an open source developer, Karl Fogel and good soul that he is, he runs out to help the lady (since I have been subject to 5 weeks of sickness due to mold or so that is what we think it is was enough for me; I could not stomach the idea of getting bit so I played the role of concerned spectator). It took minutes upon minutes, really just too many minutes to get the pit bull off, even a brick pounded against his head failed (apparently, a cigarette or match held to the throat does the trick, which I found out later). Eventually, the dog was extracted, a huge team of cops showed up, the dog was whisked away, the victim taken to the hospital, and life returned to calm and quiet. So the next day, I was being interviewed by a New York Times reporter Jim Dwyer who wrote a story about Diaspora for the New York Times back in the summer, helping to propel it from relative obscurity to near insta-fame (one of the Diaspora developers, Max, was my student). We were running out of time (I had another appointment) so I asked him if he lived in northern Manhattan as that is what his bio page indicates. He confirmed, I explained I was up there and that we could meet up there later to finish up. He inquired what part, I told him roughly where I was, he remarked he was near there, and so naturally I told him about the crazy pit bull attack I witnessed from my window as I can t shut my trap when it comes to things like that. Well yes you know what is coming next next: he was there, helping Karl (and others) deal with the pit bull attack. He lives nearby and heard the shrieks of agony and came out to aid. All and all it was pretty horrific. He also met Karl in so far as Karl gave him his phone number and email just in case he was needed as a witness (Karl had to dash off to catch a plane). Well, the funny thing, or as you also might guess: Jim, who is doing some more writing on tech, free software etc, should really talk to Karl given his key role in the community, so they already met, although under odd and terrible circumstances. I am not sure if I am more wigged out by the fact that I was reading about pit bulls when the attack happened or whether the reporter I was interviewed by was there along side with a free software developer he really needs to interview. Whatever the case, I kinda hope the vortex of coincidence now leaves me to hit someone else (sans any horrible attack). Or else, as Karl noted in the blog comments, I will have to be very careful about what shows I watch:

Amen to that! Enough with the coincidence vortex. As I said to Biella in IRC later: Do us a favor don t watch any shows about nuclear attacks on New York, okay

I m not an avid gamer, but I do occasionally enjoy playing video games. I sometimes have time to do so over the holidays, so I m looking for suggestions. I have a PS3 and a PC available. Thinking about what I like, most recently it seems to be immersive world games: Oblivion, Dragon Age, Mass Effect 1 & 2, and GTA. I ve also enjoyed simulation games, such as Civ, SimCity, FreeCiv, and Railroad Tycoon in the past and could again. Some of the Star Wars games (Knights of the Old Republic, Jedi Academy, Force Unleashed) I ve enjoyed, though the ones that have essentially no plot I didn t really. What suggestions do you have?

Hello During the Config::Model presentation at Debian mini-conf, I was asked whether Config::Model could be used from other languages than Perl. Of course, config-edit command line can be launched from any program with any language, but we can hardly call it an API. There s also the possibility to use Config::Model::SimpleUI to fork a process and send commands on its STDIN and get results on STDOUT. But using this from another program is awkward. On kernel side, /proc and /sys are widely used to get information from the kernel and set kernel configuration. How about using a similar approach with system configuration data ? Configuration data from config files is already mapped into a tree within Config::Model. This tree can also be mapped to a file system structure. This file system structure could have the following layout:

/conf/
system/
sshd/
PermitRootLogin # contain 0 or 1
ssh/

popcon/

As a bonus, this file system would provide a unified access to all system configuration data available through Config::Model. In any case, people would still be able to tinker configuration with their favorite text editor on a file in /etc. The modification will be propagated to the corresponding entry in the /conf virtual file system. The reverse will also be done. Anyone interested ? All the best PS: Further technical discussion will be held on Config::Model mailing list: config-model-users at lists.sourceforge.net 2010.11.25 edit: specified that config data can still be written in usual config file.

I ve just been asked for advice on buying a digital camera. I m not an expert on cameras but I have a good general knowledge of technology and I m sure that the readers of my blog will correct me rapidly if I make any serious mistakes. ;)Types of CameraThe Wikipedia Page about Digital Cameras is worth reading [1].Here are the types of camera that are useful as a stand-alone camera (IE not camera phones or industrial cameras):

• Digital SLR large, very capable, and very expensive. They have detachable lenses and a prism to split the light between a viewfinder and the CCD that records the digital photo. Such a split provides much less benefit now that you can have an LCD display for the viewfinder. In Australia they seem to start at about $1500.
• Bridge Cameras they are of a similar size and shape to a Digital SLR, but the lens is permanently attached and the price is a lot lower. Typically between $400 and $800.
• Mirrorless Interchangeable Lens Cameras they allow changing lenses like a DSLR but don t have the prism for an optical viewfinder. This makes the optics simpler and cheaper. Andre Pang wrote a good review of one [2] which sells for about $700.
• Compact cameras small and cheap. Between $60 and $400 depending on features.

I suggest that people not start out a hobby of digital photography with a DSLR or other interchangeable lens camera. I think that it s best to start out with simple gear that s cheap if you decide that digital photography is not your thing then you have wasted less money, and if you really get into it then you ll be able to make a more informed choice about an expensive camera after getting some experience.A spare cheap compact camera can be useful even if you own a more expensive camera. There are times when you don t want the bulk of a DSLR or Bridge Camera and when you have a risk of theft or accidental damage such that you don t want to take an expensive camera. People who are really serious about photography apparently take a camera everywhere, you could have a compact camera in your front pocket for fast pictures and a bulky camera in your backpack for when you have time to prepare a quality shot. So buying a cheap camera and then buying an expensive one a few months later would not be wasting money!As the person who asked for advice has never owned a digital camera before I ll focus on cheap compact cameras for the rest of this post.Pixels and LensesCameras are typically advertised with the resolution in Megapixels described in bold. Presumably most people search for the camera with the highest resolution. The first thing to beware of is cameras that don t have hardware which is capable of taking a picture of the stated resolution, they use interpolation to generate a higher resolution image. There are probably some cameras with interpolation that are OK and provide a decent picture at a low price, but generally I recommend avoiding all cameras that do interpolation.Optical zoom is a very important feature. Often pictures have to be cropped to remove unwanted background, if you zoom in appropriately you can avoid cropping and make better use of the available resolution. Beware of cameras that advertise things such as advanced zoom , anything that doesn t exactly say optical zoom is using digital zoom IE interpolation. I suggest not considering a compact camera unless it can do at least 4* optical zoom, with 5* or better being preferable.The physical size of the lens is important. A bigger lens allows better pictures in adverse lighting and also allows a faster shutter speed to give better photos of moving objects and better photos when you are moving. Generally you can get a rough idea of the potential that a camera has by just glancing at the lens, if it s the size of a lens in a mobile phone then the pictures won t be that great. If it is on a telescopic mount and it s wide then the result will be better. When buying a lens for a DSLR or other detachable lens camera you should be able to read specifications of the lens which indicate it s size. For compact cameras the specifications of the lens are usually available from the vendor and often available from review sites but generally aren t included in adverts by retailers. If you are comparing cameras in the store looking at them seems like the best option.The ratio of the lens area to the number of pixels determines how much light is received by the sensors for each pixel. So when there are two cameras that are essentially identical apart from the number of megapixels the one with the highest number isn t necessarily better in all situations. A 12MP camera might not give a better result than a 10MP camera, a monitor described as Full HD has a resolution of 1920*1080 which is 2MP. A 5MP camera is useful to allow cropping but if the aim is to display pictures on current monitors then anything much bigger than 5MP is probably wasted at this time and 10MP will provide pictures that can use the capabilities of monitors that are developed for a while.PrintingSome printers that are affordable for home use might require something like a 7MP camera to print a picture at A4 or Letter size at the highest quality. Professional printing will probably require something even greater. But if your intended use of a digital camera doesn t involve printing the pictures, or only rarely involves printing them at A4 or Letter size then you don t need a high resolution for printing. I expect that there are some available printers that can use paper at sizes such as B3 which might require a 20MP camera for best quality. But if the aim of the printing is to put a picture on your wall (the most common case) then even if it s not at the ideal resolution then probably no-one will notice the difference you can t see the pixels from a few meters away.If the aim of the camera is to photograph professional artwork for the purpose of selling it on the Internet then a high resolution camera really isn t desired. You want to offer pictures on the Internet which aren t good enough to be usefully printed.VideoThe capabilities for recording video can vary significantly between different cameras in the same range. If you don t care about video then that s fine, but if video matters to you then you have to read the specs. It s also worth considering digital video cameras, I have previously summarised the available digital video cameras although I m sure that there have been some new models since then [3]. A good (expensive) digital camera will have video functionality that compares well to most digital video cameras but it will cost a lot more.Choosing a Compact CameraThere are many compact cameras in the $100 to $150 price range. Ted s has the Samsung Digimax ES65 for $99.95 which has 10MP and 5* optical zoom. This seems like a good deal. Practice with a cheap camera could easily allow you to make a better choice when buying a more expensive camera that saves you more than $100 so it seems unlikely that you will have any great regrets about buying a $100 camera.Buying from the specs is a bad idea, I recommend testing a camera in the store before buying every store that you want to buy from allows this. But don t expect that quality pictures in the store means much, the people who run the camera stores usually set them up with good lighting so that pictures will tend to turn out well. The aim of an in-store test is not to discover what the camera does well, but to discover what (if anything) it does badly. Also it s useful to test the ergonomics of the camera before buying, discover whether you would be happy to hold the camera for an hour.It s a good idea to ask the staff at a camera store for advice, but don t rely on such advice. My experience is that they tend not to ask what the prospective customer plans to do with the camera and this significantly limits the quality of their recommendations.ConclusionMake your first digital camera a cheap compact camera that doesn t cost much more than $100. Make sure it has at least 4* optical zoom with 5* being preferred. Don t worry too much about the number of megapixels, anything more than 5 will do. Test the camera in the store to look for any obvious reasons that make it unsuitable for your use. If you want video then be prepared to pay a little more as the cheapest cameras have a low resolution for video.

• [1] http://en.wikipedia.org/wiki/Digital_camera
• [2] http://algorithm.com.au/blog/files/gf1.php
• [3] http://etbe.coker.com.au/2010/07/20/digital-video-cameras/

This post and the next to come are about a project I'm doing at work that I've called The Freaky Wall. The project has its origins on the idea that using multiples technologies is better for security; almost all the servers I use are running Debian GNU/Linux and use iptables locally, so when I decided that we had to build new firewalls at work I thought it was a good idea to look at different technologies, that is, a different kernel and firewalling tools. As I wanted to avoid iptables and the Linux kernel my first idea was to go after the free BSD systems (FreeBSD, OpenBSD or NetBSD), and soon realized that pf (the OpenBSD Packet Filter) was the way to go; it has a clean syntax and includes advanced features like CARP and pfsync that allow me to build redundant firewalls. Before going after the standard systems I looked at pfSense a firewall appliance built on top of FreeBSD that uses a PHP interface to do everything. At first it seemed that it was going to be a good option, but soon I felt that I wasn't in control of what the system was doing and I had to change the PHP code to do trivial things (I wanted to configure IP aliases on a CARP interface and it was not possible with the web interface, while it is trivial to do using the standard system configuration files), so I left the idea of using it. The second option was to use OpenBSD directly, as it is the system were pf has been developed. Soon I saw that I was going to be able to do what I wanted with the system, but I missed the Debian's way of installing and upgrading the system and the list of packages available. For different reasons the firewall project was left in a limbo for a little while and when I went back to it I already had to upgrade my test systems to a new OpenBSD release; after reading a little bit about how to upgrade and not liking the idea of doing it I remembered that jordi suggested that if we only want the kernel and the firewall tools the Debian GNU/kFreeBSD port could be an option instead of OpenBSD or FreeBSD. Before trying to install the Debian GNU/kFreeBSD system I saw Robert's post about a Debian installer with ZFS support and I decided to start with it, as the use of ZFS will allow us to use software RAID-1 and snapshots, something we have on almost all our Linux servers (we use software RAID for redundancy and LVM snapshots to be able to do our backups at any time of the day with consistent data, but that is for another post). On my next post I'll explain how I did the initial installation with ZFS, and after that I'll explain the changes I did to the kernel and some of the packages to be able to build a firewall as described on the Firewalling with PF document (that is, I needed pfctl, pflogd, a tcpdump with pflog support, the pf's ftp-proxy, etc.) and on the last document I'll explain how I've configured the firewalls The Debian Way .

Ogg and MP3 files often contain the interpreter and song title in the file name. Which is (besides quoting blanks, etc.) usually no issue if you have English interpreters or song titles. But it may become a character set issue, if you have songs with e.g. French, German, Greek, or Russian interpreters or song titles: They may not be in your preferred character set and therefore don t display properly on your system. Worst case: You just see questions marks. If you face such problems, convmv (man page, Debian package) is your tool, because convmv converts filenames from one encoding to another:

$ ls -lF
total 4
-rw-rw-r-- 1 abe abe 4 2010-11-21 16:17 ????
$ convmv -f latin1 -t utf-8 *
Your Perl version has fleas #37757 #49830 
Starting a dry run without changes...
mv "./??"       "./ "
No changes to your files done. Use --notest to finally rename the files.
$ convmv --notest -f latin1 -t utf-8 *
Your Perl version has fleas #37757 #49830 
mv "./??"       "./ "
Ready!
$ ls -lF
total 4
-rw-rw-r-- 1 abe abe 4 2010-11-21 16:17  
$ 

Of course it can also recursively rename your whole Ogg collection. And it can do it interactively, too:

$ ls -lF
total 4
-rw-rw-r-- 1 abe abe 4 2010-11-21 16:17 ????
$ convmv -i --notest -f latin1 -t utf-8 *
Your Perl version has fleas #37757 #49830 
mv "./??"       "./ " (y/n) y
Ready!
$ ls -lF
total 4
-rw-rw-r-- 1 abe abe 4 2010-11-21 16:17  
$ 

So convmv takes away at least one UTF-8 migration fear. Update 23:03: Nearly forgot, but Mowgli reminded me: There is also convmvfs (Debian package), a FUSE based filesystem which converts file names on access.

Most of the computers in use by the Debian Edu/Skolelinux project are virtual machines. And they have been Xen machines running on a fairly old IBM eserver xseries 345 machine, and we wanted to migrate them to KVM on a newer Dell PowerEdge 2950 host machine. This was a bit harder that it could have been, because we set up the Xen virtual machines to get the virtual partitions from LVM, which as far as I know is not supported by KVM. So to migrate, we had to convert several LVM logical volumes to partitions on a virtual disk file. I found a nice recipe to do this, and wrote the following script to do the migration. It uses qemu-img from the qemu package to make the disk image, parted to partition it, losetup and kpartx to present the disk image partions as devices, and dd to copy the data. I NFS mounted the new servers storage area on the old server to do the migration.

#!/bin/sh
# Based on
# http://searchnetworking.techtarget.com.au/articles/35011-Six-steps-for-migrating-Xen-virtual-machines-to-KVM
set -e
set -x
if [ -z "$1" ] ; then
    echo "Usage: $0 <hostname>"
    exit 1
else
    host="$1"
fi
if [ ! -e /dev/vg_data/$host-disk ] ; then
    echo "error: unable to find LVM volume for $host"
    exit 1
fi
# Partitions need to be a bit bigger than the LVM LVs.  not sure why.
disksize=$( lvs --units m   grep $host-disk   awk ' sum = sum + $4  END   print int(sum * 1.05)  ')
swapsize=$( lvs --units m   grep $host-swap   awk ' sum = sum + $4  END   print int(sum * 1.05)  ')
totalsize=$(( ( $disksize + $swapsize ) ))
img=$host.img
#dd if=/dev/zero of=$img bs=1M count=$(( $disksize + $swapsize ))
qemu-img create $img $ totalsize MMaking room on the Debian Edu/Sqeeze DVD
parted $img mklabel msdos
parted $img mkpart primary linux-swap 0 $disksize
parted $img mkpart primary ext2 $disksize $totalsize
parted $img set 1 boot on
modprobe dm-mod
losetup /dev/loop0 $img
kpartx -a /dev/loop0
dd if=/dev/vg_data/$host-disk of=/dev/mapper/loop0p1 bs=1M
fsck.ext3 -f /dev/mapper/loop0p1   true
mkswap /dev/mapper/loop0p2
kpartx -d /dev/loop0
losetup -d /dev/loop0

The script is perhaps so simple that it is not copyrightable, but if it is, it is licenced using GPL v2 or later at your discretion. After doing this, I booted a Debian CD in rescue mode in KVM with the new disk image attached, installed grub-pc and linux-image-686 and set up grub to boot from the disk image. After this, the KVM machines seem to work just fine.

Ever wondered which mirror of your favourite Linux distribution is the fastest at your location? Check it with netselect (code at GitHub). It checks for the number of hops and ping times to given hosts and tells you which one is the fastest of them:

# netselect -vv ftp.de.debian.org ftp2.de.debian.org \
                ftp.ch.debian.org ftp.nl.debian.org ftp.debian.org
Running netselect to choose 1 out of 5 addresses.
.......................................................
ftp.de.debian.org                       25 ms  16 hops   90% ok ( 9/10) [   72]
ftp2.de.debian.org                      17 ms  17 hops   90% ok ( 9/10) [   51]
ftp.ch.debian.org                        0 ms   3 hops   90% ok ( 9/10) [    0]
ftp.nl.debian.org                       22 ms  15 hops   90% ok ( 9/10) [   62]
ftp.debian.org                          22 ms  15 hops   90% ok ( 9/10) [   60]
    0 ftp.ch.debian.org

And if you re too lazy to optimize your sources.list with netselect manually, just use the netselect-apt package. It will do it for you.

My trusty somewhat-old laptop has been under the weather lately. It will not boot when it's cold, and it's fairly picky. ~20 C seems too cold already; so I have to heat it up at little.
Now that winter is coming, this needs to be done almost every morning, and that is extremely annoying. Does anybody have an idea of what could be wrong? It seems that the problem is not just a loose connection, as the laptop goes up in stages:

1) when the power button is pressed the power LED will blink for a split-second and nothing will happen,
2) the LED will light up for slightly longer, but the laptop still will not boot,
3) the laptop starts booting but shuts off spontaneously after while on the BIOS screen,
4) the laptop goes through the BIOS screen, but shuts down before showing the boot menu.
Past that, apparently the CPU generates enough heat for stable operation.
This is fairly complicated behaviour for a hardware problem. I wonder, maybe the power supply is at fault? Any ideas, anyone? This is a good excuse to buy a new laptop, but I would rather not splurge right before Christmas season.

Can I count myself in a majority of people that feel that, while the USB standard is a great advance regarding the way we used to connect our stuff to the computer some years ago (when we used a different cable for every friggin' device we had, and we had to care about having only one parallel and two seral ports in regular configurations, and don't even get me started on port settings speed, parity, etc.), every time we hold a USB cable in our hand we feel one of the designer teams decided to play a prank on humanity by making the connector's orientation basically unguessable? By the frustration this square thingy inflinges on us (being any other decent cable used on a computer either have a visually recognizable shape or just round and thus omnidirectional) I think that the rate by which I get the connector with the correct side up (or front, or right, or whatever) is way lower than 50%. Anyway, I found that the standard does provide for a (IMO quite dubious but still better than guesswork at the port) way to distinguish which way up - Quoting from Wikipedia's entry on USB connectors:

( )The side of the connector on a USB cable or other product with the "USB Icon" (trident logo) should be "visible" to the user during the mating process.( ) Officially, the USB 2.0 specification states that the required USB Icon is to be "embossed" ("engraved" on the accompanying diagram) on the "topside" of the USB plug, which "provides easy user recognition and facilitates alignment during the mating process."

There are several caveats which make this less than ideal, some of which you already thought of, some others are in the referred article and I won't reproduce them. I am just amazed that... USB has been around for almost 15 years (and has been the most popular connection type for ~10 years). And I have never seen anybody apparently knowing this rule. This was a public service announcement in the hopes you will be happier people armed with its knowledge.

Ever wondered how to test or connect to a WebDAV server on the commandline? Don t want to use a bloaty GUI file manager to connect to a WebDAV server? Then use cadaver (Debian package), a WebDAV client reminiscent of the classic ftp commandline client (plus tab completion :-).

$ cadaver https://webdav.phys.ethz.ch/unixhome/abe/vortraege
Authentication required for D-PHYS on server  webdav.phys.ethz.ch':
Username: abe
Password: 
dav:/unixhome/abe/vortraege/> ls
Listing collection  /unixhome/abe/vortraege/': succeeded.
Coll:   wml                                    0  Mar 13  2007
dav:/unixhome/abe/vortraege/> quit
Connection to  webdav.phys.ethz.ch' closed.

There is also nd which works more like ncftpget/ncftpput/wget/wput, but I didn t get the current version in Debian to work with our WebDAV server. Last time I used nd was back then at ECOS times more than half a decade ago.

Last week, I spent some time implementing various color manipulation routines. The ultimate goal was to find a way to determine if a text in a certain color was readable on a background with a different color. Something I failed to do so far, despite my research in the area. However, since I think my code could be useful for other people, I've set up a tiny git repository with the routines I wrote. The funniest one to implement was CIEDE2000. I verified my code with the data given in the specifications and can assure it's correct. :-)

I'm still running upgrade testing of the Lenny Gnome and KDE Desktop, but have not had time to spend on reporting the status. Here is a short update based on a test I ran 20101118. I still do not know what a correct migration should look like, so I report any differences between apt and aptitude and hope someone else can see if anything should be changed. This is for Gnome: Installed using apt-get, missing with aptitude

apache2.2-bin aptdaemon at-spi baobab binfmt-support browser-plugin-gnash cheese-common cli-common cpp-4.3 cups-pk-helper dmz-cursor-theme empathy empathy-common finger freedesktop-sound-theme freeglut3 gconf-defaults-service gdm-themes gedit-plugins geoclue geoclue-hostip geoclue-localnet geoclue-manual geoclue-yahoo gnash gnash-common gnome gnome-backgrounds gnome-cards-data gnome-codec-install gnome-core gnome-desktop-environment gnome-disk-utility gnome-screenshot gnome-search-tool gnome-session-canberra gnome-spell gnome-system-log gnome-themes-extras gnome-themes-more gnome-user-share gs-common gstreamer0.10-fluendo-mp3 gstreamer0.10-tools gtk2-engines gtk2-engines-pixbuf gtk2-engines-smooth hal-info hamster-applet libapache2-mod-dnssd libapr1 libaprutil1 libaprutil1-dbd-sqlite3 libaprutil1-ldap libart2.0-cil libatspi1.0-0 libboost-date-time1.42.0 libboost-python1.42.0 libboost-thread1.42.0 libchamplain-0.4-0 libchamplain-gtk-0.4-0 libcheese-gtk18 libclutter-gtk-0.10-0 libcryptui0 libcupsys2 libdiscid0 libeel2-data libelf1 libepc-1.0-2 libepc-common libepc-ui-1.0-2 libfreerdp-plugins-standard libfreerdp0 libgail-common libgconf2.0-cil libgdata-common libgdata7 libgdl-1-common libgdu-gtk0 libgee2 libgeoclue0 libgexiv2-0 libgif4 libglade2.0-cil libglib2.0-cil libgmime2.4-cil libgnome-vfs2.0-cil libgnome2.24-cil libgnomepanel2.24-cil libgnomeprint2.2-data libgnomeprintui2.2-common libgnomevfs2-bin libgpod-common libgpod4 libgtk2.0-cil libgtkglext1 libgtksourceview-common libgtksourceview2.0-common libmono-addins-gui0.2-cil libmono-addins0.2-cil libmono-cairo2.0-cil libmono-corlib2.0-cil libmono-i18n-west2.0-cil libmono-posix2.0-cil libmono-security2.0-cil libmono-sharpzip2.84-cil libmono-system2.0-cil libmtp8 libmusicbrainz3-6 libndesk-dbus-glib1.0-cil libndesk-dbus1.0-cil libopal3.6.8 libpolkit-gtk-1-0 libpt-1.10.10-plugins-alsa libpt-1.10.10-plugins-v4l libpt2.6.7 libpython2.6 librpm1 librpmio1 libsdl1.2debian libservlet2.4-java libsrtp0 libssh-4 libtelepathy-farsight0 libtelepathy-glib0 libtidy-0.99-0 libxalan2-java libxerces2-java media-player-info mesa-utils mono-2.0-gac mono-gac mono-runtime nautilus-sendto nautilus-sendto-empathy openoffice.org-writer2latex openssl-blacklist p7zip p7zip-full pkg-config python-4suite-xml python-aptdaemon python-aptdaemon-gtk python-axiom python-beautifulsoup python-bugbuddy python-clientform python-coherence python-configobj python-crypto python-cupshelpers python-cupsutils python-eggtrayicon python-elementtree python-epsilon python-evolution python-feedparser python-gdata python-gdbm python-gst0.10 python-gtkglext1 python-gtkmozembed python-gtksourceview2 python-httplib2 python-louie python-mako python-markupsafe python-mechanize python-nevow python-notify python-opengl python-openssl python-pam python-pkg-resources python-pyasn1 python-pysqlite2 python-rdflib python-serial python-tagpy python-twisted-bin python-twisted-conch python-twisted-core python-twisted-web python-utidylib python-webkit python-xdg python-zope.interface remmina remmina-plugin-data remmina-plugin-rdp remmina-plugin-vnc rhythmbox-plugin-cdrecorder rhythmbox-plugins rpm-common rpm2cpio seahorse-plugins shotwell software-center svgalibg1 system-config-printer-udev telepathy-gabble telepathy-mission-control-5 telepathy-salut tomboy totem totem-coherence totem-mozilla totem-plugins transmission-common xdg-user-dirs xdg-user-dirs-gtk xserver-xephyr zip

Installed using apt-get, removed with aptitude

arj bluez-utils cheese dhcdbd djvulibre-desktop ekiga eog epiphany-extensions epiphany-gecko evolution-exchange fast-user-switch-applet file-roller gcalctool gconf-editor gdm gedit gedit-common gnome-app-install gnome-games gnome-games-data gnome-nettool gnome-system-tools gnome-themes gnome-utils gnome-vfs-obexftp gnome-volume-manager gnuchess gucharmap guile-1.8-libs hal libavahi-compat-libdnssd1 libavahi-core5 libavahi-ui0 libbind9-50 libbluetooth2 libcamel1.2-11 libcdio7 libcucul0 libcurl3 libdirectfb-1.0-0 libdmx1 libdvdread3 libedata-cal1.2-6 libedataserver1.2-9 libeel2-2.20 libepc-1.0-1 libepc-ui-1.0-1 libexchange-storage1.2-3 libfaad0 libgadu3 libgalago3 libgd2-noxpm libgda3-3 libgda3-common libggz2 libggzcore9 libggzmod4 libgksu1.2-0 libgksuui1.0-1 libgmyth0 libgnome-desktop-2 libgnome-pilot2 libgnomecups1.0-1 libgnomeprint2.2-0 libgnomeprintui2.2-0 libgpod3 libgraphviz4 libgtk-vnc-1.0-0 libgtkhtml2-0 libgtksourceview1.0-0 libgtksourceview2.0-0 libgucharmap6 libhesiod0 libicu38 libisccc50 libisccfg50 libiw29 libjaxp1.3-java-gcj libkpathsea4 liblircclient0 libltdl3 liblwres50 libmagick++10 libmagick10 libmalaga7 libmozjs1d libmpfr1ldbl libmtp7 libmysqlclient15off libnautilus-burn4 libneon27 libnm-glib0 libnm-util0 libopal-2.2 libosp5 libparted1.8-10 libpisock9 libpisync1 libpoppler-glib3 libpoppler3 libpt-1.10.10 libraw1394-8 libsdl1.2debian-alsa libsensors3 libsexy2 libsmbios2 libsoup2.2-8 libspeexdsp1 libssh2-1 libsuitesparse-3.1.0 libsvga1 libswfdec-0.6-90 libtalloc1 libtotem-plparser10 libtrackerclient0 libvoikko1 libxalan2-java-gcj libxerces2-java-gcj libxklavier12 libxtrap6 libxxf86misc1 libzephyr3 mysql-common rhythmbox seahorse sound-juicer swfdec-gnome system-config-printer totem-common totem-gstreamer transmission-gtk vinagre vino w3c-dtd-xhtml wodim

Installed using aptitude, missing with apt-get

gstreamer0.10-gnomevfs

Installed using aptitude, removed with apt-get

[nothing]

This is for KDE: Installed using apt-get, missing with aptitude

autopoint bomber bovo cantor cantor-backend-kalgebra cpp-4.3 dcoprss edict espeak espeak-data eyesapplet fifteenapplet finger gettext ghostscript-x git gnome-audio gnugo granatier gs-common gstreamer0.10-pulseaudio indi kaddressbook-plugins kalgebra kalzium-data kanjidic kapman kate-plugins kblocks kbreakout kbstate kde-icons-mono kdeaccessibility kdeaddons-kfile-plugins kdeadmin-kfile-plugins kdeartwork-misc kdeartwork-theme-window kdeedu kdeedu-data kdeedu-kvtml-data kdegames kdegames-card-data kdegames-mahjongg-data kdegraphics-kfile-plugins kdelirc kdemultimedia-kfile-plugins kdenetwork-kfile-plugins kdepim-kfile-plugins kdepim-kio-plugins kdessh kdetoys kdewebdev kdiamond kdnssd kfilereplace kfourinline kgeography-data kigo killbots kiriki klettres-data kmoon kmrml knewsticker-scripts kollision kpf krosspython ksirk ksmserver ksquares kstars-data ksudoku kubrick kweather libasound2-plugins libboost-python1.42.0 libcfitsio3 libconvert-binhex-perl libcrypt-ssleay-perl libdb4.6++ libdjvulibre-text libdotconf1.0 liberror-perl libespeak1 libfinance-quote-perl libgail-common libgsl0ldbl libhtml-parser-perl libhtml-tableextract-perl libhtml-tagset-perl libhtml-tree-perl libio-stringy-perl libkdeedu4 libkdegames5 libkiten4 libkpathsea5 libkrossui4 libmailtools-perl libmime-tools-perl libnews-nntpclient-perl libopenbabel3 libportaudio2 libpulse-browse0 libservlet2.4-java libspeechd2 libtiff-tools libtimedate-perl libunistring0 liburi-perl libwww-perl libxalan2-java libxerces2-java lirc luatex marble networkstatus noatun-plugins openoffice.org-writer2latex palapeli palapeli-data parley parley-data poster psutils pulseaudio pulseaudio-esound-compat pulseaudio-module-x11 pulseaudio-utils quanta-data rocs rsync speech-dispatcher step svgalibg1 texlive-binaries texlive-luatex ttf-sazanami-gothic

Installed using apt-get, removed with aptitude

amor artsbuilder atlantik atlantikdesigner blinken bluez-utils cvs dhcdbd djvulibre-desktop imlib-base imlib11 kalzium kanagram kandy kasteroids katomic kbackgammon kbattleship kblackbox kbounce kbruch kcron kdat kdemultimedia-kappfinder-data kdeprint kdict kdvi kedit keduca kenolaba kfax kfaxview kfouleggs kgeography kghostview kgoldrunner khangman khexedit kiconedit kig kimagemapeditor kitchensync kiten kjumpingcube klatin klettres klickety klines klinkstatus kmag kmahjongg kmailcvt kmenuedit kmid kmilo kmines kmousetool kmouth kmplot knetwalk kodo kolf kommander konquest kooka kpager kpat kpdf kpercentage kpilot kpoker kpovmodeler krec kregexpeditor kreversi ksame ksayit kshisen ksig ksim ksirc ksirtet ksmiletris ksnake ksokoban kspaceduel kstars ksvg ksysv kteatime ktip ktnef ktouch ktron kttsd ktuberling kturtle ktux kuickshow kverbos kview kviewshell kvoctrain kwifimanager kwin kwin4 kwordquiz kworldclock kxsldbg libakode2 libarts1-akode libarts1-audiofile libarts1-mpeglib libarts1-xine libavahi-compat-libdnssd1 libavahi-core5 libavc1394-0 libbind9-50 libbluetooth2 libboost-python1.34.1 libcucul0 libcurl3 libcvsservice0 libdirectfb-1.0-0 libdjvulibre21 libdvdread3 libfaad0 libfreebob0 libgd2-noxpm libgraphviz4 libgsmme1c2a libgtkhtml2-0 libicu38 libiec61883-0 libindex0 libisccc50 libisccfg50 libiw29 libjaxp1.3-java-gcj libk3b3 libkcal2b libkcddb1 libkdeedu3 libkdegames1 libkdepim1a libkgantt0 libkleopatra1 libkmime2 libkpathsea4 libkpimexchange1 libkpimidentities1 libkscan1 libksieve0 libktnef1 liblockdev1 libltdl3 liblwres50 libmagick10 libmimelib1c2a libmodplug0c2 libmozjs1d libmpcdec3 libmpfr1ldbl libneon27 libnm-util0 libopensync0 libpisock9 libpoppler-glib3 libpoppler-qt2 libpoppler3 libraw1394-8 librss1 libsensors3 libsmbios2 libssh2-1 libsuitesparse-3.1.0 libswfdec-0.6-90 libtalloc1 libxalan2-java-gcj libxerces2-java-gcj libxtrap6 lskat mpeglib network-manager-kde noatun pmount tex-common texlive-base texlive-common texlive-doc-base texlive-fonts-recommended tidy ttf-dustin ttf-kochi-gothic ttf-sjfonts

Installed using aptitude, missing with apt-get

dolphin kde-core kde-plasma-desktop kde-standard kde-window-manager kdeartwork kdebase kdebase-apps kdebase-workspace kdebase-workspace-bin kdebase-workspace-data kdeutils kscreensaver kscreensaver-xsavers libgle3 libkonq5 libkonq5-templates libnetpbm10 netpbm plasma-widget-folderview plasma-widget-networkmanagement xscreensaver-data-extra xscreensaver-gl xscreensaver-gl-extra xscreensaver-screensaver-bsod

Installed using aptitude, removed with apt-get

kdebase-bin konq-plugins konqueror

I'm in the process of setting up a mail server, which will eventually accept mail for a given domain. I am also changing name servers for said domain (to make use of zoneedit.com). So far, I have the new server accepting mail for the domain, and the new name server serving records for the domain, including an MX pointing at the new server. However, I haven't updated the domain record, so the authorative nameservers haven't changed. Despite this, somehow, spammers are already attempting to submit mail for the domain in question to the new MX server. Not only that, but it's targetted at particular users with non-obvious local parts. The new MX advertises itself as "a-sub-domain.example.org", for values of "example.org", so it's possible in theory to derive "example.org" from the banner. But unlikely. Are they psychic? Or is a spammer somehow getting notified of new MX records hosted at zoneedit (no matter whether glue records point at them)?

Which mail server administrator hasn t tested his servers using telnet on port 25, speaking SMTP himself? And which of them made a typo and had to retype everything due to missing readline support of telnet? If you want to check SMTP over SSL aka SMTPS, you had to use openssl s_client -connect yourserver:465 . And what did you use to check TLS support on port 25? Just forget about those hassles and use swaks (Debian package), the Swiss Army Knife for SMTP. It does all the annoying stuff (using the correct syntax, typing fast enough, SSL, TLS, etc.) for you while still giving you full control over the SMTP session, especially showing you all input and output:

$ swaks -t abe@noone.org -s sym.noone.org -q RCPT
=== Trying sym.noone.org:25...
=== Connected to sym.noone.org.
<-  220 sym.noone.org ESMTP Postfix (Debian/GNU)
 -> EHLO nemo.deuxchevaux.org
<-  250-sym.noone.org
<-  250-PIPELINING
<-  250-SIZE 10240000
<-  250-ENHANCEDSTATUSCODES
<-  250 8BITMIME
 -> MAIL FROM:<abe@nemo.deuxchevaux.org>
<-  250 2.1.0 Ok
 -> RCPT TO:<abe@noone.org>
<** 450 4.2.0 <abe@nemo.deuxchevaux.org>: Sender address rejected: Greylisted, see http://postgrey.schweikert.ch/help/noone.org.html
 -> QUIT
<-  221 2.0.0 Bye
=== Connection closed with remote host.

Since the moment I discovered swaks, I never telnetted to port 25 anymore.

I still have some social life with non-geek friends who keep using MSN for instant messaging. I m currently using Finch, which is a libpurple-based IM. If you re in a similar situation, so you probably came to this post due to a certificate error message from Microsoft servers when trying to start your Finch (or Pidgin). All you need is download the following updated certificates from Pidgin website and replace them into your purple installation dir (probably in /usr/share/purple/ca-certs): http://developer.pidgin.im/viewmtn/revision/downloadfile/cd236baf6d00f3e1561a40974ce1828b793ea187/share/ca-certs/Microsoft_Secure_Server_Authority_2010.pem http://developer.pidgin.im/viewmtn/revision/downloadfile/cd236baf6d00f3e1561a40974ce1828b793ea187/share/ca-certs/Microsoft_Internet_Authority_2010.pem

Okay, I've finally settled on something. I decided to pass on the ASRock box. The price was just too high for my liking, and I've ordered a Zotac ZBOX HD-ID11. Yes, it's going to have a dirty proprietary NVIDIA graphics chipset. The interwebs tell me that it's the only one that will do H.264 decoding in hardware. I'm not sure I particularly care, for my application. It comes with DVI and HDMI, and a DVI-to-VGA dongle, so I should still be able to plug it into whatever floats my boat. What I did did just realise, about 15 minutes after I placed the order and was changing Zoe's diaper, was that I don't have a remote control solution now. The ASRock box included a remote control. I figure I can use one of the 6 USB ports and get some sort of USB infra-red adapter, and probably keep using the Hauppauge remote that came with my PVR-350 card. With the money I've saved buying the ZBOX, I've ordered a 40Gb Intel SSD, so that should make for a nice, no-moving-parts front end (assuming everything works). Everything should arrive before Thanksgiving, so I'll have a few days off work to tinker. Here's hoping I haven't bought a lemon.

About this time last year, I spent a while talking about how Barnes and Noble were failing in their GPL obligations. It took them about two months to release some source code that didn't actually correspond to the hardware - they finally provided it in March, more than three months after shipping the device.

The Nook Color is now shipping. Guess what Barnes and Noble aren't providing yet?

The flood of generic Chinese Android devices with no source code makes it very easy to think that GPL adherence is something that's only problematic with devices sourced from countries with poor records in IP enforcement. In reality, it's a problem everywhere. Barnes and Noble are a US company and the contractors for the Nook were based in Canada. They're aware enough to include the GPL notice in their documentation, but not concerned enough to make sure that they actually posses the source code that they're legally obliged to provide.

I'm glad to see that the Linux Foundation are providing resources to ensure compliance, but it's likely that this is going to continue being a problem until we start engaging in more visible efforts to educate companies about their legal obligations. The idea that a company like Barnes and Noble would ship copies of Windows without paying the appropriate license fees is pretty implausible, but they seem perfectly happy to engage in for-profit copyright violation if nobody's going to chase them down. It'll be interesting to see if this trend continues, or if we start making a sincere effort to remind vendors of their obligations.

In other GPL violation news - Fusion Garage have promised me that they'll provide the source code to their GPLed components on Monday. Given that the device has been end of lifed this is obviously pretty inept. Investors should realise that they're putting money into a company that has knowingly been engaging in criminal behaviour for over 6 months. We'll see how they manage compliance for their Android devices.

The GNU coreutils command du knows about the option -h to output human readable (or at least human friendly) values with unit prefixes, e.g. k, M or G. The GNU coreutils command sort also can sort by numbers for quite a long time using the option -n , but that doesn t work on the output of du -h . So you usually just did one of the following commands, but couldn t easily combine them:

$ du -h
$ du   sort -n

For approximately a year, GNU sort now knows about another command line option named -h . You guessed it probably: sort -h can sort human readable values with SI prefixes, e.g.

$ du -h   sort -h   tail -15
34M     ./ttf-mplus-033/debian/ttf-mplus
34M     ./ttf-mplus-033/debian/ttf-mplus/usr
34M     ./ttf-mplus-033/debian/ttf-mplus/usr/share
34M     ./ttf-mplus-033/debian/ttf-mplus/usr/share/fonts
34M     ./ttf-mplus-033/debian/ttf-mplus/usr/share/fonts/truetype
34M     ./ttf-mplus-033/debian/ttf-mplus/usr/share/fonts/truetype/ttf-mplus
35M     ./ttf-mplus-034
57M     ./ttf-mplus-029
60M     ./php5-5.2.6/ext
60M     ./ttf-mplus-030
63M     ./ttf-mplus-031
65M     ./ttf-mplus-032
67M     ./ttf-mplus-033
81M     ./php5-5.2.6
1.5G    .
$

You can get this feature already in Debian Unstable (Sid) and Testing (Squeeze, the upcoming stable release), and Ubuntu Maverick and Natty, but not yet in the current Debian Stable release (Lenny) nor in the last Ubuntu LTS release (Lucid Lynx).

I have long been in Bruce Schneier s camp, thinking that the TSA is a joke: nothing but security theater. A few recent examples come to mind:

• In the famous recent event, a man refuses to go through the backscatter machine, and then refuses to be groped. They tell him he can t board the plane, take a report, and say he is free to leave. Then they say he has to go back to the screening area and be screened before leaving the airport, despite his wishes. Obviously they don t believe he really had a bomb, because if he did, would they really want him in a cramped area surrounded by hundreds of civilians? So why make him go back?
• Reading about these screenings, one of my thoughts was, I sure wouldn t want to have my kids have to go through that, or a millimeter wave machine whose health effects are completely unknown! Then I read the TSA s bulletin, intended to calm people like me: don t worry, kids under 13 will never be patted down. OK TSA, so either your patdowns are completely ineffective or you are so naive that you think that nobody under 13 could ever be an attacker. If the latter, why fuss with making them go through security in the first place?

I don t get it. They have been completely reactionary since they began. They have a complete failure of institutional imagination. Something happens, and then a new rule comes out to prevent the thing that everybody is now expecting. And what happens about the thing that people aren t expecting yet? Nothing. So we now have to take off our shoes because one guy tried to use them for something nefarious. OK, fine, but the next guy is probably going to try something other than shoes. Which is why, I m sure, many people are pointing out that the TSA is over-reliant on technology and device detection and completely underemphasizing evildoer detection as, we are repeatedly reminded, the Israelis excel at. The TSA s attempt to remedy that was foolish at best, and, according to a recent report, not grounded in science. Which is why I am heartened that, almost a decade after 9/11, Americans are starting to let go of their fear and be ready to reclaim some sense of intelligence at the security line. The fact that politicians think there is something to be gained by being tough on TSA s invasive screening procedures, rather than risk looking soft on terrorism, is evidence of this. So, what I haven t yet worked out is this: What gives, TSA? Are they:

• Stupid or incompetent? Do they really, deep down, actually believe it when they say this is excellent, best in the world security? Do they really not see how stupid it is?
• Afraid? Are they afraid that if they don t deploy every possible technological solution, and then there is an attack, that they will be fired? (This surely doesn t explain the botched behavioral screening program though)
• Pressured? Are the vendors of security technology getting at them directly or indirectly via politicians forcing them to deploy this stuff?
• Apathetic? They simply have a job, don t really care about it at all, and are just doing the minimum necessary to bring home a paycheck?
• Stuck in a culture of rigidity? Unable to come up with any sort of process that gives screeners the ability to use discretion, they insist that everyone be treated equally and that those that aren t are treated differently on a completely random basis. Some bureaucrats probably spent years on the plan, which is totally useless.

(Note: this criticism is directed mostly at the upper levels of TSA management; I do not believe the people most of us see have the ability to change the system, even if they wanted to.) One final word: I also get annoyed at all the people that grouse at the TSA checking 80-year-olds as thoroughly as everyone else. An 80-year-old could be wearing a hidden device just as much as anyone else could, and if we don t check them, then someday they probably will. The key is to be smart about who we check carefully. Use data, behavioral analysis, simple questioning, etc it works, and is a lot better than exempting people under 13 and over 80 from screening on arbitrary grounds. Also, it might help anyone with a blurry groin. And it might just save a bunch of us from getting cancer.