This past saturday I passed by this man in the park. He was calling and feeding some squirrels.

<object height="385" width="480"><param name="movie" value="http://www.youtube.com/v/eA1ASjWRmbs?fs=1&amp;hl=ro_RO"><param name="allowFullScreen" value="true"><param name="allowscriptaccess" value="always"><embed allowfullscreen="true" allowscriptaccess="always" height="385" src="http://www.youtube.com/v/eA1ASjWRmbs?fs=1&amp;hl=ro_RO" type="application/x-shockwave-flash" width="480"></embed></object>

He was kind enough to give me some walnuts to call the squirrels myself. He did this without even me asking.

<object height="385" width="480"><param name="movie" value="http://www.youtube.com/v/oL700Fnd3ck?fs=1&amp;hl=ro_RO"><param name="allowFullScreen" value="true"><param name="allowscriptaccess" value="always"><embed allowfullscreen="true" allowscriptaccess="always" height="385" src="http://www.youtube.com/v/oL700Fnd3ck?fs=1&amp;hl=ro_RO" type="application/x-shockwave-flash" width="480"></embed></object>

It was such a wonderful experience for me, especially since the last squirrel gently touched my index finger while trying to get the walnut from my hand. Its paw was so cold and it felt very smooth and gentile.

I don't know when, but I will definitely go with a bag of walnuts of my own and spend some time there.

This past saturday I passed by this man in the park. He was calling and feeding some squirrels.

<object height="385" width="480"><param name="movie" value="http://www.youtube.com/v/eA1ASjWRmbs?fs=1&amp;hl=ro_RO"><param name="allowFullScreen" value="true"><param name="allowscriptaccess" value="always"><embed allowfullscreen="true" allowscriptaccess="always" height="385" src="http://www.youtube.com/v/eA1ASjWRmbs?fs=1&amp;hl=ro_RO" type="application/x-shockwave-flash" width="480"></embed></object>

He was kind enough to give me some walnuts to call the squirrels myself. He did this without even me asking.

<object height="385" width="480"><param name="movie" value="http://www.youtube.com/v/oL700Fnd3ck?fs=1&amp;hl=ro_RO"><param name="allowFullScreen" value="true"><param name="allowscriptaccess" value="always"><embed allowfullscreen="true" allowscriptaccess="always" height="385" src="http://www.youtube.com/v/oL700Fnd3ck?fs=1&amp;hl=ro_RO" type="application/x-shockwave-flash" width="480"></embed></object>

It was such a wonderful experience for me, especially since the last squirrel gently touched my index finger while trying to get the walnut from my hand. Its paw was so cold and it felt very smooth and gentile.

I don't know when, but I will definitely go with a bag of walnuts of my own and spend some time there.

This post and the next to come are about a project I'm doing at work that I've called The Freaky Wall. The project has its origins on the idea that using multiples technologies is better for security; almost all the servers I use are running Debian GNU/Linux and use iptables locally, so when I decided that we had to build new firewalls at work I thought it was a good idea to look at different technologies, that is, a different kernel and firewalling tools. As I wanted to avoid iptables and the Linux kernel my first idea was to go after the free BSD systems (FreeBSD, OpenBSD or NetBSD), and soon realized that pf (the OpenBSD Packet Filter) was the way to go; it has a clean syntax and includes advanced features like CARP and pfsync that allow me to build redundant firewalls. Before going after the standard systems I looked at pfSense a firewall appliance built on top of FreeBSD that uses a PHP interface to do everything. At first it seemed that it was going to be a good option, but soon I felt that I wasn't in control of what the system was doing and I had to change the PHP code to do trivial things (I wanted to configure IP aliases on a CARP interface and it was not possible with the web interface, while it is trivial to do using the standard system configuration files), so I left the idea of using it. The second option was to use OpenBSD directly, as it is the system were pf has been developed. Soon I saw that I was going to be able to do what I wanted with the system, but I missed the Debian's way of installing and upgrading the system and the list of packages available. For different reasons the firewall project was left in a limbo for a little while and when I went back to it I already had to upgrade my test systems to a new OpenBSD release; after reading a little bit about how to upgrade and not liking the idea of doing it I remembered that jordi suggested that if we only want the kernel and the firewall tools the Debian GNU/kFreeBSD port could be an option instead of OpenBSD or FreeBSD. Before trying to install the Debian GNU/kFreeBSD system I saw Robert's post about a Debian installer with ZFS support and I decided to start with it, as the use of ZFS will allow us to use software RAID-1 and snapshots, something we have on almost all our Linux servers (we use software RAID for redundancy and LVM snapshots to be able to do our backups at any time of the day with consistent data, but that is for another post). On my next post I'll explain how I did the initial installation with ZFS, and after that I'll explain the changes I did to the kernel and some of the packages to be able to build a firewall as described on the Firewalling with PF document (that is, I needed pfctl, pflogd, a tcpdump with pflog support, the pf's ftp-proxy, etc.) and on the last document I'll explain how I've configured the firewalls The Debian Way .

I have been asked how Ubuntu relates to Debian, and how packages flow from one to the other. So here s my attempt at clarifying the whole picture.

Where do the packages come from? Most packages are created by Debian contributors and they are uploaded in Debian unstable (or Debian experimental). New packages are reviewed by the Debian ftpmasters before being accepted in the official archive. The packages are held in the NEW queue until the review is over, and the time spent there varies between a few hours and a few months (usually they are processed within one week or two). Ubuntu imports all the official Debian packages, but they also add some packages of their own. About 7% of the Ubuntu packages are third-party software that have been packaged for Ubuntu but not for Debian. What are the changes made by Ubuntu? From all the source packages coming from Debian, 17% have additional changes made by Ubuntu. Many of them are part of the main repository, which is actively maintained by Canonical and Ubuntu core developers. The universe repository is usually closer to the official Debian packages. Many of the changes made by Ubuntu are the results of the decisions taken during the Ubuntu Developer Summit in order to reach specific goals: provide a better user interface, offer faster boot times, become a better platform for third-party software developers, offer a good integration with their online services (Launchpad, Ubuntu One), etc. Other changes are simply the result of fixing bugs reported by Ubuntu users. Note that even non-modified source packages will result in different binary packages for Ubuntu. That s because Ubuntu has made changes to the build environment. They only support Intel-based computers with a 686-class (or newer) CPU, they enable some compiler options that Debian doesn t, etc. And all binary packages are modified by a program called pkgbinarymangler. Ubuntu s release cycle and the relation with Debian Ubuntu releases every 6 months (that s what time based releases is about). Debian has a very different schedule. How does Ubuntu manage to reuse Debian s work? Ubuntu imports packages from Debian unstable (even experimental sometimes) to get the newest packages. If the Ubuntu package already has Ubuntu-specific changes, they merge their changes in the updated Debian package. Otherwise the Debian package is simply grabbed and rebuilt in Ubuntu. This works well because Debian unstable is much more usable than the name suggests. And this process only goes on during the first 2 months of the cycle (until the Debian Import Freeze), so there s plenty of time afterward to fix the biggest problems. In the third and fourth month, it s still possible to pick updated packages from Debian but it must be requested by a developer, it won t be done automatically. At the end of the fourth month, the feature freeze is put in place. The 2 months left are dedicated to bug fixing and polishing the distribution. There are various sub-freezes that happen in this period, you can check the Natty release schedule as an example. Picking updated packages from Debian is now the exception, it will only be allowed if the update on the Debian side is a bug-fix only release. Credits: some figures taken from a talk of Lucas Nussbaum, they were collected based on the packages available in the Lucid Lynx release of Ubuntu. Click here to subscribe to my newsletter and get my monthly update on what s going on in Debian and Ubuntu.

15 comments Liked this article? Click here. My blog is Flattr-enabled.

The choir I sing in (Pro Musica) will be performing on January 22nd in Bremen, Germany. Together with two local choirs we will perform Verdi's Requiem, which is absolutely fabulous. See for yourself:
<object height="385" width="480"><param name="movie" value="http://www.youtube.com/v/TVjDP0vlem4?fs=1&amp;hl=lt_LT&amp;color1=0x3a3a3a&amp;color2=0x999999"> <param name="allowFullScreen" value="true"> <param name="allowscriptaccess" value="always"> <embed allowfullscreen="true" allowscriptaccess="always" height="385" src="http://www.youtube.com/v/TVjDP0vlem4?fs=1&amp;hl=lt_LT&amp;color1=0x3a3a3a&amp;color2=0x999999" type="application/x-shockwave-flash" width="480"></embed></object>
(Also try Solti's version for better sound quality, but no video.)
It's going to be a busy month preparing for the concert. Verdi's melodies are not complicated, but he's crazy with dynamics: I think it's the first time I've seen a quintuple pianissimo (ppppp) or a quadruple fortissimo (ffff) in sheet music.

Ever wondered which mirror of your favourite Linux distribution is the fastest at your location? Check it with netselect (code at GitHub). It checks for the number of hops and ping times to given hosts and tells you which one is the fastest of them:

# netselect -vv ftp.de.debian.org ftp2.de.debian.org \
                ftp.ch.debian.org ftp.nl.debian.org ftp.debian.org
Running netselect to choose 1 out of 5 addresses.
.......................................................
ftp.de.debian.org                       25 ms  16 hops   90% ok ( 9/10) [   72]
ftp2.de.debian.org                      17 ms  17 hops   90% ok ( 9/10) [   51]
ftp.ch.debian.org                        0 ms   3 hops   90% ok ( 9/10) [    0]
ftp.nl.debian.org                       22 ms  15 hops   90% ok ( 9/10) [   62]
ftp.debian.org                          22 ms  15 hops   90% ok ( 9/10) [   60]
    0 ftp.ch.debian.org

And if you re too lazy to optimize your sources.list with netselect manually, just use the netselect-apt package. It will do it for you.

My trusty somewhat-old laptop has been under the weather lately. It will not boot when it's cold, and it's fairly picky. ~20 C seems too cold already; so I have to heat it up at little.
Now that winter is coming, this needs to be done almost every morning, and that is extremely annoying. Does anybody have an idea of what could be wrong? It seems that the problem is not just a loose connection, as the laptop goes up in stages:

1) when the power button is pressed the power LED will blink for a split-second and nothing will happen,
2) the LED will light up for slightly longer, but the laptop still will not boot,
3) the laptop starts booting but shuts off spontaneously after while on the BIOS screen,
4) the laptop goes through the BIOS screen, but shuts down before showing the boot menu.
Past that, apparently the CPU generates enough heat for stable operation.
This is fairly complicated behaviour for a hardware problem. I wonder, maybe the power supply is at fault? Any ideas, anyone? This is a good excuse to buy a new laptop, but I would rather not splurge right before Christmas season.

Yesterday and today I attended Ruxcon the leading technical security conference in Australia [1]. The first lecture I attended was Breaking Linux Security Protections by Andrew Griffiths. This included a good overview of many current issues with Linux security. One thing that was particularly noteworthy was his mention of SE Linux policy, he cited the policy for the FTP server as an example of policy that can be regarded as too lax but also noted the fact that to get SE Linux used the policies had to be more liberal than we might desire. There is probably scope for someone to give a good lecture about how we are forced to make uncomfortable choices between making security features stronger and making them more usable.The next lecture I attended was Breaking Virtualisation by Endrazine. It makes me wonder how long it will be before someone cracks one of the major cloud hosting services such as EC2 it s not an appealing thought.Billy Rios gave a really interesting lecture titled Will it Blend? about blended exploits. The idea is to try and find a few programs which do things that are slightly undesired (arguably not even bugs) but which when combined can result in totally cracking a system. One example was a way of tricking IE into loading a DLL from the desktop and a way of tricking Safari into saving arbitrary files to the desktop, combine them and you can push a DLL to a victim and make them load it. Learning about these things can really change the way you think about misbehaving programs!Ben Nagy gave an interesting lecture about Prospecting for Rootite . His systematic way of finding test cases that cover a large portion of the code of a large application such as MS-Word seems quite effective. Once you have test cases that cover a lot of code then you can use fuzzing to find flaws.Edward Farrell gave an informative lecture about RFID Security , I didn t really learn that much though, he confirmed my suspicions that RFID implementations generally suck.Mark Goudie gave a very informative lecture titled We ve been Hacked! What Went Wrong and Why . Mark works for Verizon and often with the US Secret Service in investigating security breaches. He presented a lot of information that I have not seen before and made some good arguments in support of companies being more proactive in protecting their systems from attack.Stephen Glass and Mark Robert gave a lecture titled Security in Public Safety Radio Systems which mainly focussed on digital radios used by the Australian police. It would be good if the police got people like them to test out new kit before ordering it in bulk, it seems that they will be using defective radios for a long time (it s not easy or cheap to replace them once they are deployed).Edward Farrell gave an interesting lecture titled Hooray for Reading: The Kindle & You about hacking the Kindle. Unfortunately they haven t worked out how to get GUI code going on a hacked Kindle yet so there are some limitations as to what can be done.I think that the most interesting lecture of the conference was This Job Makes you Paranoid by Alex Tilley of the Australian Federal Police. He gave some interesting anecdotes about real cases to illustrate his points and he advocated the police position really well. I ve attended several lectures by employees of law enforcement agencies, but none of them demonstrated anywhere near the understanding of their audience that Alex did.The last lecture I attended was Virtualisation Security State of the Union by David Jorn of Red Hat. He gave an interesting summary of some of the issues including mentioning how SE Linux is being used for confining KVM virtual machines.Ruxcon was a great conference and I definitely recommend attending it. I have to note that even though there are police attending and lecturing it s not entirely a white-hat affair. One thing that I hope they do next year is to get a bigger venue. The foyer was rather crowded and because it had a hard floor was really noisy between lectures. Space and carpet are two really important things when you have lots of people in one room!

• [1] http://www.ruxcon.org.au/

Can I count myself in a majority of people that feel that, while the USB standard is a great advance regarding the way we used to connect our stuff to the computer some years ago (when we used a different cable for every friggin' device we had, and we had to care about having only one parallel and two seral ports in regular configurations, and don't even get me started on port settings speed, parity, etc.), every time we hold a USB cable in our hand we feel one of the designer teams decided to play a prank on humanity by making the connector's orientation basically unguessable? By the frustration this square thingy inflinges on us (being any other decent cable used on a computer either have a visually recognizable shape or just round and thus omnidirectional) I think that the rate by which I get the connector with the correct side up (or front, or right, or whatever) is way lower than 50%. Anyway, I found that the standard does provide for a (IMO quite dubious but still better than guesswork at the port) way to distinguish which way up - Quoting from Wikipedia's entry on USB connectors:

( )The side of the connector on a USB cable or other product with the "USB Icon" (trident logo) should be "visible" to the user during the mating process.( ) Officially, the USB 2.0 specification states that the required USB Icon is to be "embossed" ("engraved" on the accompanying diagram) on the "topside" of the USB plug, which "provides easy user recognition and facilitates alignment during the mating process."

There are several caveats which make this less than ideal, some of which you already thought of, some others are in the referred article and I won't reproduce them. I am just amazed that... USB has been around for almost 15 years (and has been the most popular connection type for ~10 years). And I have never seen anybody apparently knowing this rule. This was a public service announcement in the hopes you will be happier people armed with its knowledge.

About six years ago, I spent a chunk of my very first salary on a portable music player, the iRiver H140, a relatively bulky and large hard-disk based player, with a capacity of 40G. Uniquely for music players before or since, the iRiver features both digital and analogue line ins and outs. It also has (more common) recording facilities and an FM tuner, the latter of which I used a great deal (and rules out just about all the iPods). This remarkable player has lasted nearly six years of moderate daily use. For the majority of that time, I've ran the rockbox open source firmware on the player, which has provided me with really wide codec support and excellent recording facilities. In the last month I finally had to replace the iRiver. I bought a Sansa Fuze player, featuring 8G of flash storage and a microsd expansion slot. The Fuze is also capable of running rockbox. This year, 32G microsd cards have arrived. Adding one of those brings the capacity of the new player right back up to 40G. For those who are curious: yes, a Sandisk 32G microsd does work in the Fuze, at least with rockbox, for playback. At the moment, rockbox cannot write to storage on the Fuze, so you need to either use the original firmware or an external reader/writer to manipulate the contents of the microsd. However, I am not sure how well the original firmware can handle the 32G. Whenever I boot it, I see a "refreshing your media" message which lasts longer than my patience. I will write an update once I've established further the degree of support. I kept a canonical copy of my music library on a desktop computer and used rsync to keep the iRiver up-to-date. I can use almost exactly the same procedure for the new player (with some small changes to cope with the split-storage) I now have a 40G player running rockbox exactly as I had before, albeit at a fraction of the size and weight (and cost: approximately half as expensive), and with a nicer display including colours, album art, etc. They both can even play doom (although the controls are even more awkward than iPhone Doom).

I'm in the process of setting up a mail server, which will eventually accept mail for a given domain. I am also changing name servers for said domain (to make use of zoneedit.com). So far, I have the new server accepting mail for the domain, and the new name server serving records for the domain, including an MX pointing at the new server. However, I haven't updated the domain record, so the authorative nameservers haven't changed. Despite this, somehow, spammers are already attempting to submit mail for the domain in question to the new MX server. Not only that, but it's targetted at particular users with non-obvious local parts. The new MX advertises itself as "a-sub-domain.example.org", for values of "example.org", so it's possible in theory to derive "example.org" from the banner. But unlikely. Are they psychic? Or is a spammer somehow getting notified of new MX records hosted at zoneedit (no matter whether glue records point at them)?

You may have been using the repository as described on a previous blog post. You may also have noticed that despite a lack of announcement, all beta releases but 4.0beta6 have been subsequently made available on that repository (moreover, within 24 hours of the upstream release). I just made a change to that repository which will most likely make your APT complain, but all the necessary instructions are given on the repository itself.

Answering the call from the Gnash project for buildbot slaves to test the current source, I have set up a virtual KVM machine on the Debian Edu/Skolelinux virtualization host to test the git source on Debian/Squeeze. I hope this can help the developers in getting new releases out more often. As the developers want less main-stream build platforms tested to, I have considered setting up a Debian/kfreebsd machine as well. I have also considered using the kfreebsd architecture in Debian as a file server in NUUG to get access to the 5 TB zfs volume we currently use to store DV video. Because of this, I finally got around to do a test installation of Debian/Squeeze with kfreebsd. Installation went fairly smooth, thought I noticed some visual glitches in the cdebconf dialogs (black cursor left on the screen at random locations). Have not gotten very far with the testing. Noticed cfdisk did not work, but fdisk did so it was not a fatal problem. Have to spend some more time on it to see if it is useful as a file server for NUUG. Will try to find time to set up a gnash buildbot slave on the Debian Edu/Skolelinux this weekend.

Next article highlighting some new features which will come in phpMyAdmin 3.4 is about relations export. This feature is not much known anyway, so if you have not seen it in phpMyAdmin, just try it out on our demo server or configure phpMyAdmin configuration storage in your copy. In previous versions, it was possible to export database relational schema into PDF format. The 3.4 release comes with modular system for exporting schema adding SVG, Dia, EPS or Microsoft Visio. Especially SVG and EPS are useful for embedding schema into other documents. This feature was implemented by Muhammad Adnan during Google Summer of Code 2010.

Filed under: Phpmyadmin 0 comments Flattr this!

Cython is now considering options where to move the main (mercurial) repository, and Robert Bradshaw (one of the main Cython developers) has asked me about my experience with regards to Google Code and GitHub, since we use both with SymPy.

Google Code is older, and it was the first service that provided free (virtually unlimited) number of projects that you could easily and immediately setup. At that time (4 years ago?) that was something unheard of. However, the GitHub guys in the meantime not only made this available too, but also implemented features, that (as far as I know) no one offers at all, in particular hosting your own pages at your own domain (but at GitHub's servers, some examples are sympy.org and docs.sympy.org), commenting on git branches and pull requests before the code gets merged in (I am 100% convinced that this is the right approach, as opposed to comment on the code after it gets in), allow to easily fork the repository and it has simply more social features, that the Google Code doesn't have.

I believe that managing an opensource project is mainly a social activity, and GitHub's social features really make so many things easier. From this point of view, GitHub is clearly the best choice today.

I think there is only one (but potentially big) problem with GitHub, that its issue tracker is very bad, compared to the Google Code one. For that reason (and also because we already use it), we keep our issues at Google Code with SymPy.

The above are the main things to consider. Now there are some little things to keep in mind, that I will briefly touch below: Google Code doesn't support git and blocks access from Cuba and other countries, when you want to change the front page, you need to be an admin, while at GitHub I simply add push access to all sympy developers, so anyone just pushes a patch to this repository: https://github.com/sympy/sympy.github.com, and it automatically appears on our front page (sympy.org), with Google Code we had to write long pages (in our docs) about how to send patches, with GitHub we just say, send us a pull request, and point to: http://help.github.com/pull-requests/. In other words, GitHub takes care of teaching people how to use git and figure out how to send patches, and we can concentrate on reviewing the patches and pushing them in.

Wikipages at github are maintained in git, and they provide the webfrontend to it as opensource, so there is no vendor lock-in. Anyone with github account can modify our wiki pages, while the Google Code pages can only be modified by people that I add to the Google Code project, which forced us to install mediawiki on my linode server (hosted at linode.com, which by the way is an excellent VPS hosting service, that I have been using for couple of years already and I can fully recommend it), and I had to manage it all the time, and now we are moving our pages to the github wiki, so that I have one less thing to worry about.

So as you can see, I, as admin, have less things to worry about, as github manages everything for me now, while with Google Code, I had to manage lots of things on my linodes.

One other thing to consider is that GitHub is only for git, but they also provide svn and hg access (both push and pull, they translate the repository automatically between git and svn/hg), I never really used it much, so I don't know how stable this is. As I wrote before, I think that git is the best tool now for maintaining a project, and I think that github is now the best choice to host it (except the issue tracker, where Google Code is better).

The documentation on ld's symbol versioning syntax is a little bit vague on "dependencies", which it talks about but doesn't give many details on. Let's construct a small example: In words, we create two libraries; a version 1 and a version 2, where we provide a new version of foo in the version 2 library. The soname is set in the libraries, so v1 and v2 can distinguish the correct library to use. In the updated 2.ver version, we say that VERSION_2 depends on VERSION_1. So, the question is, what does this mean? Does it have any effect? We can examine the version descriptors in the library and see that there is indeed a relationship recorded there. Looking at the specification we can see that each version definition has a vd_aux field which is a linked list of, essentially, strings that give "the version or dependency name". This is a little vague for a specification, however it appears to mean that the first entry is the name of the version specification, and any following elements are your dependencies. At least, this is how readelf interprets it when it shows you the "Parent" field in the output above. This implies something that the ld documentation doesn't mention; in that you may list multiple dependencies for a version node. That does work, and readelf will just report more parents if you try it. So the question is, what does this dependency actually do? Well, as far as I can tell, nothing really. The dynamic loader doesn't look at the dependency information; and doesn't have any need to it is looking to resolve something specific, foo@VERSION_2 for example, and doesn't really care that VERSION_1 even exists. ld does enforce the dependency, in that if you specify a dependent node but leave it out or accidentally erase it, the link will fail. However, it doesn't really convey anything other than its intrinsic documenation value.

Okay, I've finally settled on something. I decided to pass on the ASRock box. The price was just too high for my liking, and I've ordered a Zotac ZBOX HD-ID11. Yes, it's going to have a dirty proprietary NVIDIA graphics chipset. The interwebs tell me that it's the only one that will do H.264 decoding in hardware. I'm not sure I particularly care, for my application. It comes with DVI and HDMI, and a DVI-to-VGA dongle, so I should still be able to plug it into whatever floats my boat. What I did did just realise, about 15 minutes after I placed the order and was changing Zoe's diaper, was that I don't have a remote control solution now. The ASRock box included a remote control. I figure I can use one of the 6 USB ports and get some sort of USB infra-red adapter, and probably keep using the Hauppauge remote that came with my PVR-350 card. With the money I've saved buying the ZBOX, I've ordered a 40Gb Intel SSD, so that should make for a nice, no-moving-parts front end (assuming everything works). Everything should arrive before Thanksgiving, so I'll have a few days off work to tinker. Here's hoping I haven't bought a lemon.

The upcoming 3.4 release will bring lot of new functionality. Some of that has been developed by core members, but many contributions were made thanks to Google Summer of Code program, where five students were working on improving phpMyAdmin. If you want to try new features, you can do that on the phpMyAdmin demo server. And I will introduce them in series of blog posts. One of long requested features was ability to change configuration for each user. And phpMyAdmin now has it. If you have configured the phpMyAdmin configuration storage, settings are permanently stored in the database, otherwise in session and optionally in web storage in your browser. You can configure any aspect of phpMyAdmin not affecting security or server performance, like confirming DROP queries, default export settings, user interface tweaks and so on. This feature was implemented by Piotr Przybylski during Google Summer of Code 2010.

Filed under: Phpmyadmin 0 comments Flattr this!

I have long been in Bruce Schneier s camp, thinking that the TSA is a joke: nothing but security theater. A few recent examples come to mind:

• In the famous recent event, a man refuses to go through the backscatter machine, and then refuses to be groped. They tell him he can t board the plane, take a report, and say he is free to leave. Then they say he has to go back to the screening area and be screened before leaving the airport, despite his wishes. Obviously they don t believe he really had a bomb, because if he did, would they really want him in a cramped area surrounded by hundreds of civilians? So why make him go back?
• Reading about these screenings, one of my thoughts was, I sure wouldn t want to have my kids have to go through that, or a millimeter wave machine whose health effects are completely unknown! Then I read the TSA s bulletin, intended to calm people like me: don t worry, kids under 13 will never be patted down. OK TSA, so either your patdowns are completely ineffective or you are so naive that you think that nobody under 13 could ever be an attacker. If the latter, why fuss with making them go through security in the first place?

I don t get it. They have been completely reactionary since they began. They have a complete failure of institutional imagination. Something happens, and then a new rule comes out to prevent the thing that everybody is now expecting. And what happens about the thing that people aren t expecting yet? Nothing. So we now have to take off our shoes because one guy tried to use them for something nefarious. OK, fine, but the next guy is probably going to try something other than shoes. Which is why, I m sure, many people are pointing out that the TSA is over-reliant on technology and device detection and completely underemphasizing evildoer detection as, we are repeatedly reminded, the Israelis excel at. The TSA s attempt to remedy that was foolish at best, and, according to a recent report, not grounded in science. Which is why I am heartened that, almost a decade after 9/11, Americans are starting to let go of their fear and be ready to reclaim some sense of intelligence at the security line. The fact that politicians think there is something to be gained by being tough on TSA s invasive screening procedures, rather than risk looking soft on terrorism, is evidence of this. So, what I haven t yet worked out is this: What gives, TSA? Are they:

• Stupid or incompetent? Do they really, deep down, actually believe it when they say this is excellent, best in the world security? Do they really not see how stupid it is?
• Afraid? Are they afraid that if they don t deploy every possible technological solution, and then there is an attack, that they will be fired? (This surely doesn t explain the botched behavioral screening program though)
• Pressured? Are the vendors of security technology getting at them directly or indirectly via politicians forcing them to deploy this stuff?
• Apathetic? They simply have a job, don t really care about it at all, and are just doing the minimum necessary to bring home a paycheck?
• Stuck in a culture of rigidity? Unable to come up with any sort of process that gives screeners the ability to use discretion, they insist that everyone be treated equally and that those that aren t are treated differently on a completely random basis. Some bureaucrats probably spent years on the plan, which is totally useless.

(Note: this criticism is directed mostly at the upper levels of TSA management; I do not believe the people most of us see have the ability to change the system, even if they wanted to.) One final word: I also get annoyed at all the people that grouse at the TSA checking 80-year-olds as thoroughly as everyone else. An 80-year-old could be wearing a hidden device just as much as anyone else could, and if we don t check them, then someday they probably will. The key is to be smart about who we check carefully. Use data, behavioral analysis, simple questioning, etc it works, and is a lot better than exempting people under 13 and over 80 from screening on arbitrary grounds. Also, it might help anyone with a blurry groin. And it might just save a bunch of us from getting cancer.

Most of my talks are either talks about commandline basics (Commandline Helpers about GNU Coreutils and Findutils usage; Understanding Shell Quoting) or collections of small tips and tricks, e.g. about SSH, History Expansion, or commandline tools. Valentin Haenel called this second type of talks nugget talks . I like that term. My newest talk (German only so far, next occasion at the LUGS meeting in Zurich on 16th of December 2010) is such a nugget talk and is about useful but unknown tools. While preparing that talk I noticed that the amount of neat but less known tools I collected for possible inclusion into that talk would be enough for a whole day or so. I noticed that I ll never be able to give a talk about all that stuff. To not letting these tips rot in that file uncommented, I decided that I ll write (more or less) short blog postings about these tools, similar to and inspired by Myon s blog postings about Cool Unix Features as well as the no more existing or at least broken Debian Package of the Day and Debian Package a Day. While Myon mostly posted long-time but still unknown features, my postings will mostly cover useful but unknown packages available in Debian and most debian-derived distributions like grml and Ubuntu. Some postings may also just highlight some features of common tools or packages like e.g. GNU Coreutils. You can subscribe to these tips via RSS or just view all of them in your web browser at http://noone.org/blog/English/Computer/Debian/CoolTools/.