While digging Debian Qt-KDE's bugs, it has become more common to find people reporting that their KDE is very slow. Most of the time (if not every time) it turns out that the loopback interface is down. Sometimes the user did something wrong, sometimes some network manager, but the end result is the same: KDE is terribly slow.

So, next time you find a KDE session is slow, you know what to do ;-)

Credit Unions are financial co-operatives where a community s savings are used to fund other community borrowing and both savers and borrowers can become members. Thursday 18 October 2012 is International Credit Union Day, as well as being in the United Nations International Year of Co-operatives. This year s theme is Members Matter Most which was suggested from Ireland. In the UK, there will be events including one at Westminster with speeches from Damian Hind MP, Chair of All Party Parliamentary Group on Credit Unions and Simon Hughes MP, its Vice Chair. I m a member of my local credit union. I can pay in at my bank or any PayPoint and withdraw by bank transfer. If you re fed up with the fat cat plc bankers, there s no better time to Move Your Money in general and Find Your Credit Union (international visitors, start at WOCCU) in particular, is there?

After some rants about the status of different Qt-based serial port libs, I'm happy to announce that today QExtSerialPort was accepted in Debian experimental (this last link may give a 404 for some time, that's ok).

A great effort was done upstream to put the source in a suitable state for being included in Debian. Thank you all guys!

I packaged a beta version, so I uploaded it to experimental.

In case you are wondering why packaging a lib with (yet) no apps depending on it, the answer is quite simple: there are lots of people already using it in it's home projects (me included). Now those projects have the chance to get into Debian too :-)

As a side note, there is also another nice implementation called QtSerialPort. I have also tested it and works pretty fine too. It aims to become part of Qt as an add-on someday.

I've released Obnam version 1.1, released 2012-06-30, but only announced now since I had trouble building the packages for code.liw.fi.

• Mark the --small-files-in-btree settings as deprecated.
• Obnam now correctly checks that --repository is set.
• Options in --help output are now grouped in random senseless ways rather than being in one randomly ordered group.
• Manual page clarification for --root and verify. Thanks, Saint Germain.
• Remove outdated section from manual page explaining that there is not format conversion. Thanks, Elrond of Samba-TNG.
• Added missing information about specifying a user in sftp URLs. Thanks, Joey Hess, for pointing it out.
• Manual page clarification on --keep from Damien Courouss .
• Make obnam forget report which generations it would remove without --pretend. Thanks, Neal Becker, for the suggestion.

I ve uploaded yesterday the rakudo package version 0.1~2012.01-1 to unstable. It ships the Rakudo upstream release from January, running on top of the Parrot stable release 4.0.0 (which was uploaded earlier). Rakudo is a compiler that implements the Perl 6 specification and runs on top of the Parrot virtual machine (if you are interested on Perl 6 you may have a look at some nice articles, and at the talk of Damian Conway, about Perl 6). This is the first upload since a few months, and the first release being uploaded to Debian based on the nom (New Object Model) development branch of Rakudo, which opened the door for substantial performance improvements. This release brings other nice things too, such as the support for meta-programming, better package and exception handling and more. The latest upstream release 2012.04 (which brings, among other things, improvements in startup times thanks to bounded serialization) has been released a few days ago and uses the new Parrot stable release 4.3.0 (which has been released about a week ago), so we hope to test and upload both in time for the Wheezy freeze (and hopefully we ll be a bit more timely for future updates too).

I'm currently updating the ISO-3166-2 list in the iso-codes package. This is the list of countries subdivisions and official codes for these subdivisions. The funny part is that I just updated the names of states of India, some of them being often (much) more populated than most countries in the world : Maharashtra, Tamil Nadu, Andhra Pradesh, etc. And some of them larger than most countries in the world. And a few minutes after, I end up adding the 17 "quarters" of the city of Monaco. Yes, Monaco, one of the smallest countries in the world, has official subdivisions or "quartiers":

• Quartier de La Condamine (MC-CO)
• Quartier de Fontvielle (MC-FO)
• Jadin Exotique (MC-JE) .... "Borough of the Exotic garden"
• Quartier de la Gare (MC-GA) .... "Train station borough"
• Monaco-Ville (MC-MO)....Monaco-City....as is there was something else than a city in Monaco....
• etc.

Real fun..:-). And the funny part is that all this is translatable..:-)

Some time ago I wrote about the status of Qt-based libs for using the serial port. Some days later I was pointed to the QtSerialPort project. The good news on this is that this is a project aimed to enter into Qt 5.

I have tested the lib with some apps that originally used QExtSerialPort. So far, so good. The license terms seems pretty OK (it wouldn't have got that far in the Qt code review if it weren't).

In the meantime, I received a reply to one of my messages from an upstream dev of QSerialPort (note that is Q and not Qt). He was very kind, but considering the effort to get QtSerialPort inside Qt itself, I think it's better to try to develop with this last lib.

Maybe I should try to package it and upload it to experimental.

Ten years ago, I joined the Debian project as a developer. At that time, I was 18 and in my first year at university, hanging out with the TuxFamily system administrators, which included 3 french Debian developers (sjg, igenibel and creis). I was learning Debian packaging while working on VHFFS, and decided to package one or two non-yet-packaged software for Debian. My friends pushed me into the NM process, and less than 2 months later I was a Debian developer. One have to admit that back in the days, the NM process was really fast if you were able to reply to the questions quickly. :-) I think I became the youngest developer among Debian's ones. That was my first steps in a Free Software project, and it was really exciting. In 10 years, I've been doing a lot of different things for Debian. Sure, I've been using it all the years long, but let's recap a bit what I did, from what I recall. My first Debian only project was apt-build around 2003, and later rebuildd in 2007. I built the Xen packaging team in 2005, I've been a Stable Release Manager for a year in 2006, and did heavy bug squashing to release Etch that same year. I also was an Application Manager in 2006 and managed the application of 2 Debian developers (Jose Parrella and Dami n Viano). I admit I've been less active in Debian after 2007, mainly because I was busy working on awesome, GNU Emacs and others software. Since 2011, I joined the OpenStack packaging team and I'm working on OpenStack on a (almost) daily basis. I don't know how many packages I touched, managed or updated, but that should be one or two hundreds. I still maintain 53 of them. After all, the adventure has been really pleasant, and I had the chance to work with and meet fabulous and smart people. I always liked this project and what it's trying to do. After all these years, I'm definitively staying! See you in another 10 years, folks! :)

I am currently working on a Qt-based app that needs to communicate through the serial port. Apart from all the benefits that a normal lib with a serial port implementation will bring in this case, having a Qt-based serial port lib would make even more sense, as it should be as multiplatform as possible and use the signal/slot mechanism. Also it should have a DFSG-compatible license, so I can package it for Debian, of course :-)

So I have found two libs which seemed to have the above mentioned features: QExtSerialPort and QSerialPort.

QExtSerialPort seems to be the most recommended lib in the web. It features polled and signal-based functionality; it uses Qt's standard types inheriting QIODevice. But it does not states the license in any file within the source code. The original project page at SourceForge says it's in public domain. And the newer project page at Google code says it's under the new BSD license. I have asked in the mailing list for a clarification. So far nothing has changed (although in further threads the authors showed some willing to change this). And then I got to the point of finding a bug, but I don't want to spend time to track it down and make a patch without a clear license.

QSerialPort it's another lib with more or less the same features as QExtSerialPort. It's main LICENSE file says it's under the LGPL2, but licensecheck will say that the present files are LGPL3. Also, on reviewing the code, I found some minor stuff that could be improved. Well, I could contact the author and see if [s]he would receive the patches... but his site seems down. And I could not find a real-person's name in the code so far :-/

So I made a last attempt to try to get QExtSerialPort in a suitable license. If it doesn't suceed, I think I'll have to start writing one myself. The downside: I only use Linux, so there will be no multiplatform features unless someone else contributes it. Of course, if you have another option or any idea to share, I'll be happy to know it :-)

By the way, this should be my first post on Planet Debian in english, so hello planet!

So, in 2002 I attended my first SPUG meeting. Also in attendance were Randal, Tim, J.P. (I think) and quite a few of the other usual suspects. The guest speaker was the inestimable Dr. Damian Conway. This night might be the single most important event in my career as a builder of the internets. I was already set in my ways regarding my operating system, and I knew enough perl to get by, but I wasn t in touch with any users groups until then. The crown jewel of the night was Damian s recital in full of his poem, I Am The Very Model of A Poster To CLPM (sung to the tune of that song from Pirates of Penzance). I must admit that I d never heard of CLPM and that it all sounded like gobble-de-gook at the time. If I recall correctly, this happened just after he took about 10 minutes to teach us all to pronounce the name of then-Pumpking, Jarkko Hietaniemi. This was the same year that the following video was made <iframe allowfullscreen="allowfullscreen" frameborder="0" height="315" src="http://www.youtube.com/embed/XkU_GQVOCqo" width="420"></iframe> With that in mind, there s one more thing I need to share with you before disclosing the lyrics. This piece was developed during a time when it was common for members of the perl community to flame one another on news feeds, take their anger and frustration out on newbies and generally be the bane of most of the internet. I like to think that it helped to shape me into a kinder, gentler perl programmer, debian user and general netizen over the years. I would also like to think that it will do the same for future members of our communities. And so, without further ado, Damian Conway s

---

I Am The Very Model of a Poster to CLPM Now everything I need to know about the Perl community
I learned in kindergarten when I was a little lad of three
And in these next few minutes I ll relate those five apothegm
For I am the very model of a poster to c.l.p.m. The first truism I was ever taught upon my mother s knee
Was that our dad s a better dad than their s could ever hope to be.
His name is Larry Wall, and that s determinism nom native
Since of the mural attributes he demonstrates proof positive. He s eight feet tall and ten feet wide; of granite-like solidity.
He wards us from the serpent s tabs and coffee bean s stupidity.
He guards us from that Gallic tower s B&D urbanity,
And makes sure we don t see sharp code that might cut loose our sanity. He watches over each of us, like Odin of the Norse belief
The stern All-Father figure and, at times, the comical relief.
So, if you vaunt our patriarch s supreme linguistic acumen,
You are a model sychophantic poster to c.l.p.m. The second tenet that I learned concerns, of course, the fairer sex
And why they are in short supply, while geek-boy JAPHs are multiplex.
As every schoolboy knows each conversation has single aim:
To raise one s own significance, whilst razing others down in flame. And thus good men and true who hold this principle as sacrosanct
Will all pursue beligerence as though they were from Mars. Or tanked.
It is the tenor of your newgroup posts that she from Venus flies:
Because most threads devolve into comparisons of ..meanness, guys. When every post affronts their own collaborative sorority
It must exasperate them, for it renders the majority
Of female Perl geeks absent, till we re forced to rename blonde Dutch men
To act as female models of a poster to c.l.p.m. The third grand aphorism that was drummed into my youthful head
Was: if you can t say something nice about someone, you should instead
Say every nasty thing you can impart, imagine, or invent
In any public forum that it happens you should both frequent. This goes especially for the young, and new, and shy, and innocent.
To flame a newbie is a joy, t will make you feel omnipotent.
To watch them squirm and bleat and bleed and scurry back into their hole,
The surge of ecstasy it brings is worth the way it eats your soul. So never hesitate to turn the wrath of your vocabul ry
Upon the hapless supplicant for Perl epistomology
And if you flame each FAQ, and every question that s beneath you then
You ll be the very model of curmudg nly R.T.F.M. The next point I should like to make s the obverse of the previous
For while it s true that to be newbie is a sin most grieveous
It ain t as bad as being old and greyed and staid and tedious
And sitting at the keys all day dispensing thoughts invidious. What right have you to tell me not to ask about my CGI???
I thought that Perl was all about website development, and I
Expect that you d extend to me the simple human courtesy
Of dropping everything so you can do this homework now for me. The Internet exists so I need never read the manual
And so my inane questioning can form a stream continual
While pleading for an email since I never read this group, as well
As posting them in jeopardy, in caps, and in HTML. The rule I learned in kinder that explains where this approach springs from
Is fundamental to a certain class of Gen-X hackerdom
The single principle that guides their Internet activity
Is: me, me, me, me, me, me, me, me, me, me, me, me, me, me, ME! So if you are prepared to treat the Net as your god-given right
And suck the newsgroups dry like some goodwill-devouring parasite
And use them as a help-desk and a perldoc substitute, well then
You are the very model clueless poster to c.l.p.m. The final precept that my pre-school inculcated in my head
Is one I would commend as antithetical to all I ve said.
It is a noble concept that once used to garner more elan
The idea that, when I grow up ..I want to be a fireman. The fire-fighter s job s to help, despite the inconvenience
And spare the inexperienced the cost of their own ignorance
And put out fires when the flames ignite the common living space
And through it all maintain an air of competence and skill and grace. And this, my friends, I recommend to all of our community
That rather than a careless match or carefully lit incendiary
You spray out knowledge, patience, and a gentle stream of good advice
And save the newbies from themselves, and oldies from their prejudice. And be yea more as Larry is, a fire-Wall against the threat
Of ignorance and arrogance, with both of which we re still beset.
For if you choose to help your fellow JAPHs instead of scorching them,
You ll be the next burnt offering we spit-roast on c.l.p.m. ;-) [edit]

I mentioned this briefly yesterday, but now I'll try to summarize the story of a great surprise and a big moment for me. All this started when my wife Elizabeth and my son Jean-Baptiste wanted to do something special for my 50th birthday. So, it indeed all started months ago, probably early March or something (I don't yet have all the details). Jean-Baptiste described this well on the web site, so I won't go again into details, but basically, this was about getting birthday wishes from my "free software family" in, as you might guess, as many languages as possible. Elizabeth brought the original idea and JB helped her by setting up the website and collecting e-mail addresses of people I usually work with: he grabbed addresses from PO files on Debian website, plus some in his own set of GPG signatures and here we go. And then he started poking dozens of you folks in order to get your wishes for this birthday. Gradually, contributions accumulated on the website, with many challenges for them: be sure to get as many people as possible, poking and re-poking all those FLOSS people who keep forgetting things... It seems that poking people is something that's probably in the Perrier's genes! And they were doing all this without me noticing. As usually in Debian, releasing on time is a no-no. So, it quickly turned out that having everything ready by April 2nd wouldn't be possible. So, their new goal was offering this to me on Pentecost Sunday, which was yesterday. And...here comes the gift. Aha, this looks like a photo album. Could it be a "50 years of Christian" album? But, EH, why is that pic of me, with the red Debconf5 tee-shirt (that features a world map) and a "bubulle" sign, in front of the book? But, EH EH EH, what the .... are doing these word by H0lger, then Fil, then Joey doing on the following pages? And only then, OMG, I discover the real gift they prepared. 106, often bilingual, wishes from 110 people (some were couples!). 18 postcards (one made of wood). 45 languages. One postcard with wishes from nearly every distro representatives at LinuxTag 2011. Dozens of photos from my friends all around the world. All this in a wonderful album. I can't tell what I said. Anyway, JB was shooting a video, so...we'll see. OK, I didn't cry...but it wasn't that far and emotion was really really intense. Guys, ladies, gentlemen, friends....it took me a while to realize what you contributed to. It took me the entire afternoon to realize the investment put by Elizabeth and JB (and JB's sisters support) into this. Yes, as many of you wrote, I have an awesome family and they really know how to share their love. I also have an awesome virtual family all around the world. Your words are wholeheartedly appreciated and some were indeed much much much appreciated. Of course, I'll have the book in Banja Luka so that you can see the result. I know (because JB and Elizabeth told me) that many of you were really awaiting to see how it would be received (yes, that includes you, in Germany, who I visited in early May!!!). Again, thank you so much for this incredible gift. Thank you Holger Levsen, Phil Hands, Joey Hess, Lior Kaplan, Martin Michlmayr, Alberto Gonzalez Iniesta, Kenshi "best friend" Muto, Praveen Arimbrathodiyil, Felipe Augusto van de Wiel, Ana Carolina Comandulli (5 postcards!), Stefano Zacchiroli (1st contribution received by JB, of course), Gunnar Wolf, Enriiiiiico Zini, Clytie Siddall, Frans Pop (by way of Clytie), Tenzin Dendup, Otavio Salvador, Neil McGovern, Konstantinos Margaritis, Luk Claes, Jonas Smedegaard, Pema Geyleg, Meike "sp tzle queen" Reichle, Alexander Reichle-Schmehl, Torsten Werner, "nette BSD" folks, CentOS Ralph and Brian, Fedora people, SUSE's Jan, Ubuntu's Lucia Tamara, Skolelinux' Paul, Rapha l Hertzog, Lars Wirzenius, Andrew McMillan (revenge in September!), Yasa Giridhar Appaji Nag (now I know my name in Telugu), Amaya Rodrigo, St phane Glondu, Martin Krafft, Jon "maddog" Hall (and God save the queen), Eddy Petri or, Daniel Nylander, Aiet Kolkhi, Andreas "die Katze geht in die K che, wunderbar" Tille, Paul "lets bend the elbow" Wise, Jordi "half-marathon in Banja Luka" Mallach, Steve "as ever-young as I am" Langasek, Obey Arthur Liu, YAMANE Hideki, Jaldhar H. Vyas, Vikram Vincent, Margarita "Bronx cross-country queen" Manterola, Patty Langasek, Aigars Mahinovs (finding a pic *with* you on it is tricky!), Thepittak Karoonboonyanan, Javier "nobody expects the Spanish inquisition" Fern ndez-Sanguino, Varun Hiremath, Moray Allan, David Moreno Garza, Ralf "marathon-man" Treinen, Arief S Fitrianto, Penny Leach, Adam D. Barrat, Wolfgang Martin Borgert, Christine "the mentee overtakes the mentor" Spang, Arjuna Rao Chevala, Gerfried "my best contradictor" Fuchs, Stefano Canepa, Samuel Thibault, Eloy "first samba maintainer" Par s, Josip Rodin, Daniel Kahn Gillmor, Steve McIntyre, Guntupalli Karunakar, Jano Gulja , Karolina Kali , Ben Hutchings, Matej Kova i , Khoem Sokhem, Lisandro "I have the longest name in this list" Dami n Nicanor P rez-Meyer, Amanpreet Singh Alam, H ctor Or n, Hans Nordhaugn, Ivan Mas r, Dr. Tirumurti Vasudevan, John "yes, Kansas is as flat as you can imagine" Goerzen, Jean-Baptiste "Piwet" Perrier, Elizabeth "I love you" Perrier, Peter Eisentraut, Jesus "enemy by nature" Climent, Peter Palfrader, Vasudev Kamath, Miroslav "Chicky" Ku e, Mart n Ferrari, Ollivier Robert, Jure uhalev, Yunqiang Su, Jonathan McDowell, Sampada Nakhare, Nayan Nakhare, Dirk "rendez-vous for Chicago marathon" Eddelbuettel, Elian Myftiu, Tim Retout, Giuseppe Sacco, Changwoo Ryu, Pedro Ribeoro, Miguel "oh no, not him again" Figueiredo, Ana Guerrero, Aur lien Jarno, Kumar Appaiah, Arangel Angov, Faidon Liambotis, Mehdi Dogguy, Andrew Lee, Russ Allbery, Bj rn Steensrud, Mathieu Parent, Davide Viti, Steinar H. Gunderson, Kurt Gramlich, Vanja Cvelbar, Adam Conrad, Armi Be irovi , Nattie Mayer-Hutchings, Joerg "dis shuld be REJECTed" Jaspert and Luca Capello. Let's say it gain:

• Danke
• Thank you
• (RTL or not?) / toda
• Gracias
• / arigat
• / n ndi
• Obrigado
• Grazie
• C m n
• Kadin chey la
• / Efharisto
• Dank je wel
• Tak
• D ngge
• Merci
• Kiitos
• Tika hoki
• / dhanyavaadhamulu
• Thank you and God save the Queen
• Mul umesc
• Tack
• / didi madloba
• Gr cies
• Dakujem
• / Aabhar
• / Dhanyavadagalu
• Paldies
• / kop khun krap
• Terima kasih
• Hvala (hr)
• / Dhanyavad
• / Hvala (sr)
• Hvala (sl)
• / Akun
• / Sukriya
• Takk
• / Nandri
• Maki biyen jianbakik
• D kuji
• / Xiexie
• / Aabhari aahe
• Faleminderit
• / Kam sah ham ni da
• / Blagodaram
• / Xiexie
• Hvala (bs)

I mentioned this briefly yesterday, but now I'll try to summarize the story of a great surprise and a big moment for me. All this started when my wife Elizabeth and my son Jean-Baptiste wanted to do something special for my 50th birthday. So, it indeed all started months ago, probably early March or something (I don't yet have all the details). Jean-Baptiste described this well on the web site, so I won't go again into details, but basically, this was about getting birthday wishes from my "free software family" in, as you might guess, as many languages as possible. Elizabeth brought the original idea and JB helped her by setting up the website and collecting e-mail addresses of people I usually work with: he grabbed addresses from PO files on Debian website, plus some in his own set of GPG signatures and here we go. And then he started poking dozens of you folks in order to get your wishes for this birthday. Gradually, contributions accumulated on the website, with many challenges for them: be sure to get as many people as possible, poking and re-poking all those FLOSS people who keep forgetting things... It seems that poking people is something that's probably in the Perrier's genes! And they were doing all this without me noticing. As usually in Debian, releasing on time is a no-no. So, it quickly turned out that having everything ready by April 2nd wouldn't be possible. So, their new goal was offering this to me on Pentecost Sunday, which was yesterday. And...here comes the gift. Aha, this looks like a photo album. Could it be a "50 years of Christian" album? But, EH, why is that pic of me, with the red Debconf5 tee-shirt (that features a world map) and a "bubulle" sign, in front of the book? But, EH EH EH, what the .... are doing these word by H0lger, then Fil, then Joey doing on the following pages? And only then, OMG, I discover the real gift they prepared. 106, often bilingual, wishes from 110 people (some were couples!). 18 postcards (one made of wood). 45 languages. One postcard with wishes from nearly every distro representatives at LinuxTag 2011. Dozens of photos from my friends all around the world. All this in a wonderful album. I can't tell what I said. Anyway, JB was shooting a video, so...we'll see. OK, I didn't cry...but it wasn't that far and emotion was really really intense. Guys, ladies, gentlemen, friends....it took me a while to realize what you contributed to. It took me the entire afternoon to realize the investment put by Elizabeth and JB (and JB's sisters support) into this. Yes, as many of you wrote, I have an awesome family and they really know how to share their love. I also have an awesome virtual family all around the world. Your words are wholeheartedly appreciated and some were indeed much much much appreciated. Of course, I'll have the book in Banja Luka so that you can see the result. I know (because JB and Elizabeth told me) that many of you were really awaiting to see how it would be received (yes, that includes you, in Germany, who I visited in early May!!!). Again, thank you so much for this incredible gift. Thank you Holger Levsen, Phil Hands, Joey Hess, Lior Kaplan, Martin Michlmayr, Alberto Gonzalez Iniesta, Kenshi "best friend" Muto, Praveen Arimbrathodiyil, Felipe Augusto van de Wiel, Ana Carolina Comandulli (5 postcards!), Stefano Zacchiroli (1st contribution received by JB, of course), Gunnar Wolf, Enriiiiiico Zini, Clytie Siddall, Frans Pop (by way of Clytie), Tenzin Dendup, Otavio Salvador, Neil McGovern, Konstantinos Margaritis, Luk Claes, Jonas Smedegaard, Pema Geyleg, Meike "sp tzle queen" Reichle, Alexander Reichle-Schmehl, Torsten Werner, "nette BSD" folks, CentOS Ralph and Brian, Fedora people, SUSE's Jan, Ubuntu's Lucia Tamara, Skolelinux' Paul, Rapha l Hertzog, Lars Wirzenius, Andrew McMillan (revenge in September!), Yasa Giridhar Appaji Nag (now I know my name in Telugu), Amaya Rodrigo, St phane Glondu, Martin Krafft, Jon "maddog" Hall (and God save the queen), Eddy Petri or, Daniel Nylander, Aiet Kolkhi, Andreas "die Katze geht in die K che, wunderbar" Tille, Paul "lets bend the elbow" Wise, Jordi "half-marathon in Banja Luka" Mallach, Steve "as ever-young as I am" Langasek, Obey Arthur Liu, YAMANE Hideki, Jaldhar H. Vyas, Vikram Vincent, Margarita "Bronx cross-country queen" Manterola, Patty Langasek, Aigars Mahinovs (finding a pic *with* you on it is tricky!), Thepittak Karoonboonyanan, Javier "nobody expects the Spanish inquisition" Fern ndez-Sanguino, Varun Hiremath, Moray Allan, David Moreno Garza, Ralf "marathon-man" Treinen, Arief S Fitrianto, Penny Leach, Adam D. Barrat, Wolfgang Martin Borgert, Christine "the mentee overtakes the mentor" Spang, Arjuna Rao Chevala, Gerfried "my best contradictor" Fuchs, Stefano Canepa, Samuel Thibault, Eloy "first samba maintainer" Par s, Josip Rodin, Daniel Kahn Gillmor, Steve McIntyre, Guntupalli Karunakar, Jano Gulja , Karolina Kali , Ben Hutchings, Matej Kova i , Khoem Sokhem, Lisandro "I have the longest name in this list" Dami n Nicanor P rez-Meyer, Amanpreet Singh Alam, H ctor Or n, Hans Nordhaugn, Ivan Mas r, Dr. Tirumurti Vasudevan, John "yes, Kansas is as flat as you can imagine" Goerzen, Jean-Baptiste "Piwet" Perrier, Elizabeth "I love you" Perrier, Peter Eisentraut, Jesus "enemy by nature" Climent, Peter Palfrader, Vasudev Kamath, Miroslav "Chicky" Ku e, Mart n Ferrari, Ollivier Robert, Jure uhalev, Yunqiang Su, Jonathan McDowell, Sampada Nakhare, Nayan Nakhare, Dirk "rendez-vous for Chicago marathon" Eddelbuettel, Elian Myftiu, Tim Retout, Giuseppe Sacco, Changwoo Ryu, Pedro Ribeoro, Miguel "oh no, not him again" Figueiredo, Ana Guerrero, Aur lien Jarno, Kumar Appaiah, Arangel Angov, Faidon Liambotis, Mehdi Dogguy, Andrew Lee, Russ Allbery, Bj rn Steensrud, Mathieu Parent, Davide Viti, Steinar H. Gunderson, Kurt Gramlich, Vanja Cvelbar, Adam Conrad, Armi Be irovi , Nattie Mayer-Hutchings, Joerg "dis shuld be REJECTed" Jaspert and Luca Capello. Let's say it gain:

• Danke
• Thank you
• (RTL or not?) / toda
• Gracias
• / arigat
• / n ndi
• Obrigado
• Grazie
• C m n
• Kadin chey la
• / Efharisto
• Dank je wel
• Tak
• D ngge
• Merci
• Kiitos
• Tika hoki
• / dhanyavaadhamulu
• Thank you and God save the Queen
• Mul umesc
• Tack
• / didi madloba
• Gr cies
• Dakujem
• / Aabhar li> / Dhanyavadagalu
• Paldies
• / kop khun krap
• Terima kasih
• Hvala (hr)
• / Dhanyavad
• / Hvala (sr)
• Hvala (sl)
• / Akun
• / Sukriya
• Takk
• / Nandri
• Maki biyen jianbakik
• D kuji
• / Xiexie
• / Aabhari aahe
• Faleminderit
• / Kam sah ham ni da
• / Blagodaram
• / Xiexie
• Hvala (bs)

Are you graduating this year? Or recently graduated? Do you want to work in Open Source? Do you have the right to work in the UK? Do you want to work with some of the best minds in the field: Chris Lord, of Happy Wombats fame; Damien Lespiau, the Clutter GST mastermind; Emmanuele Bassi, our Clutter super-hero; Jussi Kukkonen, who puts the clue in Geoclue; Ross Burton, our EDS magician; Srini Ragavan, Evolution shiny-thing maker; Thomas Wood, of the MX and control-center massive; Tomas Frydrych, our Antarctic naming scheme generator and of course pippin. Interested? Take a look at our job entry. I should be around as FOSDEM so feel free to corner me to talk.

Finally, after more than a year of preparation, and six months of very very hard work, DebConf8 has come and gone. Even if I'm not yet completely recovered from all that stress, I'm good enough to feel really happy about how things turned out. DebConf8 was a great success. We had great talks, many opportunities for developing interesting ideas, a lot of social interaction, an awesome video team that allowed more than 200 people from all around the world to be part of the conference even if they weren't in Argentina, and in general almost everyone had a very good time. It was really nice to have so many people from Debian over here, and it was specially nice to see them working and enjoying themselves so much. This was all possible thanks to our sponsors, thanks to the many hours spent during the previous months both by the DebConf orga-team (the usual suspects) and specially by the local team, which includes Tincho, Dami n, Romanella, Maxy, Sebas, Zero, Mendieta, Dererk, Melisa, Angasule, Lisandro, Nueces, and also thanks to the all help of the volunteers that came to work with us during DebCamp and DebConf, which include Tom s, Tinchito, M nica, Lucas, Germ n, Diego, Fefu, Nicol s, Mart n, Marcos, Hern n, Alejandro, Mat as, Rodrigo, Alberto and Joaqu n, and finally, DebConf wouldn't have been the great event it was without all the people that managed to travel thousands of kilometers to get here. To all of them, thanks, for making DebConf8 such a great conference Now, at last, DebConf8 is over (although there is some stuff that we still need to do before we can really forget all about it), and life goes on. Today, I did my first NMU after a long time. I'm particularly glad to have time for fixing bugs again, but I won't lie, I'm also extremely satisfied with how DebConf8 turned out. See you in Extremadura!

Couchdb came onto my radar since distributed stuff is interesting to me these days. But most of what was being written about it put me off, since it seemed to be very web-oriented, with javascript and html and stuff stored in the database, served right out of it to web browsers in an AJAXy mess. Also, it's a database. I decided a long, long time ago not to mess with traditional databases. (They're great, they're just not great for me. Said the guy leaving after 5 years in the coal mines.) Then I saw Damien Katz's talk about how he gave up everything to go off and create couchdb. Was very inspirational. Seemed it must be worth another look, with that story behind it. Now I'm reading the draft O'Rielly book, like some things, as expected don't like others[1], and am not sure what to think overall (plus still have half the book to get through yet), but it has spurred some early thoughts: ... vs DVCS Couchdb is very unlike a distributed VCS, and yet it's moved from traditional database country much closer to VCS land. It's document oriented, not normalized; the data stored in it has significant structure, but is also in a sense freeform. It doesn't necessarily preserve all history, but it does support multiple branches, merging, and conflict resolution. Oddly, the thing I dislike most about it is possibly its biggest strength compared to a VCS, and that is that code is stored in the database alongside the data. That means that changes to the data can trigger processing, so it is mapped, reduced, views are updated, etc, on demand. This is done using code that is included in the database, and so is always available, and runs in an environment couchdb provides -- so replicating the database automatically deploys it. Compare with a VCS, where anything that is triggered by changes to the data is tacked onto the side in hooks, has to be manually set up, and so is poorly integrated overall. Basically, what I've been doing with ikiwiki is adding some smarts about handling a particular kind of data, on top of the VCS. But this is done via a few narrow hooks; cloning the VCS repository does not get you a wiki set up and ready to go. There are good reasons why cloning a VCS repository does not clone the hooks associated with it. The idea of doing so seems insane; how could you trust those hooks? How could they work when cloned to another environment? And so that's Never Been Done[2]. But with couchdb's example, this is looking to me like a blind spot, that has probably stunted the range of things VCSs are used for. If you feel, like I do, that it's great we have these amazing distributed VCSs, with so many advanced capabilities, but a shame that they're only used by software developers, then that is an exciting thought.

---

[1] Javascript? Mixed all in a database with data it runs on? Imperative code that's supposed to be side-effect free? (I assume the Haskell guys have already been all over that.) Code stored without real version control? Still having a hard time with this. :) [2] I hope someone will give a counterexample of a VCS that does so in the comments?

Wednesday 1st

At the G20 protests, Londoner Ian Tomlinson collapses and is attended to by the emergency services; Metropolitan Police claim "during this time a number of missiles - believed to be bottles - were being thrown at them". Tomlinson dies that evening.

Thursday 2nd

The Evening Standard reports that "police were bombarded with bricks, bottles and planks of wood" as they helped Tomlinson.

Saturday 4th

Postmortem of Tomlinson finds he died of a heart attack.

Monday 6th

The EC Data Retention Regulations 2009 comes into force requiring internet service providers to retain details of emails, internet phone calls and other web traffic.

Tuesday 7th

The Guardian publishes a video of a police officer assualting Tomlinson on 1st April.

Wednesday 8th

Twelve Pakistani students are arrested on suspicion of planning terror attacks over the Easter holiday weekend.

Thursday 9th

The Guardian publishes a second video of Tomlinson's assualt, contributing that no missiles were thrown.

Monday 13th

Police arrest 114 climate protestors on conspiracy to cause criminal damage at Nottingham power plant. [ref]

Tuesday 14th

A video of a seperate assualt at the G20 protests is published.

Thursday 16th

Police claim tourist's photography of transport-related buildings is "strictly forbidden" and demand the photos are deleted. [ref]

Friday 17th

A second postmortem of Iam Tomlinson finds the cause of death to be an abdominal haemorrhage. A policeman is interviewed under caution on suspicion of manslaughter. [ref]

Saturday 18th

The Times reveals MP Damian Green private emails were searched by the police using the keywords "Shami Chakrabarti" (director of Liberty) after his arrest last year.

Monday 20th

The Guardian reveals police intelligence was given to E.On before the Nottingham climate demonstration, including movements of protesters and their meetings.

Tuesday 21st

Another video of the Tomlinson assault is revealed showing his head hitting the pavement. The Independent Police Complaints Commission fails to obtain an injunction to prevent broadcast.

Wednesday 22nd

Nine Pakistani students arrested during anti-terror raids are released after 13 days without charge and are passed to UK Border Agency custody for deportation. [ref]

Monday 27th

Home Secretary Jacqui Smith announces that ISPs and telecoms companies will be asked to record usage "to track murderers and paedophiles" without a warrant. [ref]

Tuesday 28th

Emails are revealed of the Home Office asking Phorm, the behavioural targeted advertising service, whether they are falling outside the law. Home Office claim Phorm would be legal if consent is obtained and that "providers of goods and services need only ensure they are compliant with relevant legislation". [ref]

Wednesday 29th

The Guardian documents the friends of the 7/7 bombers were denied bail on secret evidence - "the appellant asked the judge the question: why are you sending me to prison? To which the judge replied: 'I cannot tell you that.'"

This week I'm at PyCon in Chicago, helping to train and supervise the A/V team in recording the tutorials and talks. We have a lot of inexperienced volunteers but they're learning quickly. Carl Karsten (in charge of A/V) and Ryan Verner (another outsider with long experience from LCA) are organising things. Ryan, Dave Noble and I provide technical assistance to the rest of the team. I'm also working on my first Django app, which will be used for reviewing files. This is essentially a clone of the excellent work done by Gunnar Wolf and Damian Viano in Pentabarf. PyCon doesn't have a centralised database so this is a standalone application. Ryan is now applying styles to my horribly bare HTML, and I have a short list of bugs to fix before we ask the video team to start reviewing. The tutorials started yesterday and talks wil start tomorrow in different rooms, so we have to set up all the equipment again and reconfigure for multiple cameras. Hopefully by Saturday things will be running smoothly and I can spend some time in the city. It would be a shame to come all this way and stay by the airport for the entire time!

One thing that concerns me about using any online service is the security. When that service is a virtual server running in another country the risks are greater than average. I’m currently investigating the Amazon EC2 service for some clients, and naturally I’m concerned about the security. Firstly they appear to have implemented a good range of Xen based security mechanisms, their documentation is worth reading by anyone who plans to run a Xen server for multiple users [1]. I think it would be a good thing if other providers would follow their example in documenting the ways that they protect their customers. Next they seem to have done a good job at securing the access to the service. You use public key encryption for all requests to the service and they generate the keypair. While later in this article I identify some areas that could be improved, I want to make it known that overall I think that EC2 is a good service and it seems generally better than average in every way. But it’s a high profile service which deserves a good deal of scrutiny and I’ve found some things that need to be improved. The first problem is when it comes to downloading anything of importance (kernel modules for use in a machine image, utility programs for managing AMIs, etc). All downloads are done via http (not https) and the files are not signed in any way. This is an obvious risk that anyone who controls a router could compromise EC2 instances by causing people to download hostile versions of the tools. The solution to this is to use https for the downloads AND to use GPG to sign the files, https is the most user-friendly way of authenticating the files (although it could be argued that anyone who lacks the skill needed to use GPG will never run a secure server anyway) and GPG allows end to end encryption and would allow me to verify files that a client is using if the signature was downloaded at the same time. More likely problems start when it comes to the machine images that they provide. They have images of Fedora Core 4, Fedora Core 6, and Fedora 8 available. Fedora releases are maintained until one month after the release of two subsequent versions [6], so Fedora 8 will end support one month after the release of Fedora 10 (which will be quite soon) and Fedora Core 6 and Fedora Core 4 have been out of support for a long time. I expect that someone who wanted to 0wn some servers that are well connected could get a list of exploits that work on FC4 or FC6 and try them out on machines running on EC2. While it is theoretically possible for Amazon staff to patch the FC4 images for all security holes that are discovered, it would be a lot of work, and it wouldn’t apply to all the repositories of FC4 software. So making FC4 usable as a secure base for an online service really isn’t a viable option. Amazon’s page on “Tips for Securing Your EC2 Instance” [3] mostly covers setting up ssh, I wonder whether anyone who needs advice on setting up ssh can ever hope to run a secure server on the net. It does have some useful information on managing the EC2 firewall that will be of general interest. One of the services that Amazon offers is to have “shared images” where any Amazon customer can share an image with the world. Amazon has a document about AMI security issues [4], but it seems to only be useful against clueless security mistakes by the person who creates an image not malice. If a hostile party creates a machine image you can expect that you won’t discover the problem by looking for open ports and checking for strange processes. The Amazon web page says “you should treat shared AMIs as you would any foreign code that you might consider deploying in your own data center and perform the appropriate due diligence“, the difference of course is that most foreign code that you might consider deploying comes from companies and is shipped in shrink-wrap packaging. I don’t count the high quality free software available in a typical Linux distribution in the same category as this “foreign code”. While some companies have accidentally shipped viruses on installation media in the past it has been quite rare. But I expect hostile AMIs on EC2 to be considerably more common. Amazon recommends that people know the source of the AMIs that they use. Of course there is a simple way of encouraging this, Amazon could refrain from providing a global directory of AMIs without descriptions (the output of “ec2dim -x all“) and instead force customers to subscribe to channels containing AMIs that have not been approved by Amazon staff (the images that purport to be from Oracle and Red Hat could easily have their sources verified and be listed as trusted images if they are what they appear to be). There seems to be no way of properly tracking the identity of the person who created a machine image within the Amazon service. The ec2dim command only gives an ID number for the creator (and there seems to be no API tool to get information on a user based on their ID). The web interface gives a name and an Amazon account name. The next issue is that of the kernel. Amazon notes that they include “vmsplice root exploit patch” in the 2.6.18 kernel image that they supply [2], however there have been a number of other Linux kernel security problems found since then and plenty of security issues for 2.6.18 were patched before the vmsplice bug was discovered - were they patched as well? The file date stamp on the kernel image and modules files of 20th Feb 2008 indicates that there are a few kernel security issues which are not patched in the Amazon kernel. To fix this the obvious solution is to use a modern distribution image. Of course without knowing what other patches they include (they mention a patch for better network performance) this is going to be difficult. It seems that we need some distribution packages of kernels designed for EC2, they would incorporate the Amazon patches and the Amazon configuration as well as all the latest security updates. I’ve started looking at the Amazon EC2 kernel image to see what I should incorporate from it to make a Debian kernel image. It would be good if we could get such a package included in an update to Debian/Lenny. Also Red Hat is partnering with Amazon to offer RHEL on EC2 [5], I’m sure that they provide good kernels as part of that service - but as the costs for RHEL on EC2 more than double the cost of the cheapest EC2 instance I expect that only the customers that need the the larger instances all the time will use it. The source for the RHEL kernels will of course be good for CentOS (binaries produced from such sources may be in CentOS already, I haven’t checked). This is not an exhaustive list of security issues related to EC2, I may end up writing a series of posts about this.

• [1] http://developer.amazonwebservices.com/connect/entry.jspa?externalID=1697&categoryID=100


• [2] http://developer.amazonwebservices.com/connect/entry.jspa?externalID=1350


• [3] http://developer.amazonwebservices.com/connect/entry.jspa?externalID=1233&categoryID=100


• [4] http://docs.amazonwebservices.com/AWSEC2/latest/DeveloperGuide/index.html?AESDG-chapter-usingsharedamis.html#usingsharedamis-security


• [5] http://www.redhat.com/solutions/cloud/


• [6] http://fedoraproject.org/wiki/LifeCycle

Share This

So, DebConf8 is over (currently we have three machines left in the network, the video storage server, the video encoding server and my laptop...) and IMO it rocked! I really enjoyed being here, meeting many many known faces and getting to know quite some new ones and learning a bit here and there, even though I was mostly doing videoteam work :-)

And this should be the main message of this blog post: many many thanks to all the different members of the videoteam. You have been awesome! The camera operators, the sound and video mixers, the moderators (which strictly speaking are not part of the videoteam but nonetheless helped us very much), those of you who reviewed the videos, the debconf network admins, the localteam members who prepared the venue fantastically, those who prepaid for hardware (and Debian for paying in the end) and took it here, those who helped with the set up here, the hotel staff who generally were very helpful (for example they agreed to dig holes in their walls), the absent team members who helped via irc and very much Dami n Viano for his awesome work on pentabarf and Ben Hutchings for dvswitch and most of the debconf-video package.

Also I like to thank Amaya very much for bearing with me and for all the love and joy you give me! Te quiero!

Thank you all! Very very much.

(And now I'm curious who I forgot...)

I'm also really happy we got videoteam t-shirts this year and at the same time this is probably the biggest regret I have regarding the videoteam: We didn't have enough t-shirts for everyone who deserved one. But things can definitly be worse :-)

Recordings, as much as we have them, are being uploaded at the usual place. You can help us with post processing by adding comments about problems (non-obvious ones only, please. If a event is split into two files, thats an obvious problem), to our todo wikipage.

See you! Have fun!

So, I should be at DebCamp, but I'm back home after driving 800km in one day.  
Why?   I still don't know.

The main reason for this post is the irrational and unilateral response I got 
from the DebConf Orga Team, with no right to replica of any kind, and with 
the violence and humiliation we were treated with. I've helped to make 
3 DebConf's possible, and have been involved in many ways for the past years 
in Debian, so this shocked me deeply.

The short story is that there was an extra bed in the room I was staying in, the 
person who was suppose to be in that bed is a close friend of mine, so I asked 
if someone else could use it while they weren't, since that meant I could take 
the necessary equipment that I managed to get for DebConf, and also introduce 
to Debian someone who is very active and well known in our local community 
(and also part of the umbrella foundation used for local finance issues). 
I was excited about getting there, like every year. Just to make this extra 
clear, this person had already booked the full week of DebConf, just not 
DebCamp, as he previously thought he couldn't attend. When he found out he 
could, he was thrilled to be able to go and help setup. So, I made the mistake 
of not notifying the Orga team about the switch. I did this because it truly 
was harmless action, where a bed which would otherwise be wasted would get 
used, and, I did not notify the Orga team because they've been very 
aggressive, inflexible and unhelpful throughout the planning of the 
conference. This doesn't justify it, just explains why someone who generally 
is helpful decides to take the wrong path to solve something.

Up to here, nothing very exciting. What made this special, is that when one 
of the organizers, Margarita Manterola, found out about the switch, instead 
of coming to talk to me, even though she's known me for *years*, she went 
and informed the hotel that somebody had committed a crime, and checked in 
under a different name, as if me or the person that came with me where 
some random stranger. All I can say is, WTF?

Let me stress this, the email that was sent out[1] twisted the facts, to the 
extent that some of them are a lie, like the problem arrived at check-in, 
when it actually happened while we where napping a few hours after we had 
arrived, and any effort made by the Orga team with the hotel where wasted, 
as it was one of them who had originally created the problem.

Instead of solving this among us as a group, and, again, "solve" is a 
bureaucratic thing, because no one was being harmed, Marga decided to 
actually *harm* me personally, the person who I had brought, and DebConf 
as a group. What got solved?  Nothing. I left, along with someone who 
would of otherwise been helping out build DebConf, while the Orga team 
demanded a ridiculous fee for me to stay in the hotel.
Rules are rules, I understand, but I also understand everybody listens to 
downloaded music, people in Germany install[2] nmap, and a very long list 
of rules that we tend not to follow because they're unreasonable or 
unnecessarily complicated.
Is this really what DebConf is turning into?

All I can say is I'm very sad and shocked that the people I've worked with 
for so many years decided to condemn me over such a meaningless issue, and 
especially that the local team, Martin Ferrari, Damian Viano, Maximiliano 
Curia and Margarita Manterola would do such thing to "one of there own", 
and that the international Orga team would mindlessly follow through with it.

I apologized to the hotel, I do want to apologize to the innocent people who 
had to deal with this, and, even though my intentions where good and unselfish, 
I regret what happened.

Despite all of this, I'm still deeply committed to Debian, have worked during 
the year and deserve to relax and enjoy it, so I will be there for DebConf 
as a regular attendee.

See you there!

[1] http://lists.debconf.org/lurker/message/20080802.231856.66c7d3fd.en.html
[2] http://it.slashdot.org/article.pl?sid=07/05/31/1629259&from=rss