I've put up my nearly unedited, unsorted, and uncommented photos from my recent trip to Santiago de Compostela, Spain, for the Libre Software World Conference. It was a beautiful place (and a great conference) -- I hope to write more about it soon.

not much to report this week, still a short summary:

• #685476 pcp: "pcp: CVE-2012-3418 CVE-2012-3419 CVE-2012-3420 CVE-2012-3421"
  do a versioned close, fixed package already in unstable
• #687398 src:rhash: "rhash: FTBFS: plug_openssl.c:142: undefined reference to dlopen'"
  add patch from Asheesh Laroia, fix build dependencies, upload to DELAYED/2, & cancelled again ...
• #688069 liblocale-subcountry-perl: "liblocale-subcountry-perl: Version checks fail ("our $VERSION" moved before "package Locale::SubCountry")"
  add patch from Ivan Kohler (pkg-perl, not wheezy-related)
• #688891 psad: "psad: modifies conffiles (policy 10.7.3): /etc/psad/psad.conf"
  send another patch to the BTS
• #690355 libfile-data-perl: "libfile-data-perl: (virtually) empty binary package"
  add patch to Makefile.PL (pkg-perl, not wheezy-related)
• #691723 libbusiness-onlinepayment-ippay-perl: "libbusiness-onlinepayment-ippay-perl: New upstream release 0.07"
  add patch from Ivan Kohler (pkg-perl, unstable + stable)

I'm off to Spain to attend and speak at the Libre Software World Conference. If you're going to be there too, let me know.

It was a surprisingly busy week. The commit notification service CIA was shut down about a week ago, so I spammedsent some messages to announce that KGB could be used as a replacement, and Don Armstrong wrote a great tutorial on how to set it up. As a result, many people came to us to use our bots, or to set-up their own instances. Since then, 14 Debian sub-projects started using our bots, and we know of at least two other bots being run independently. For a small project that was mainly developed and maintained for our own use, this was quite some unexpected popularity! With bug reports and feature requests starting to flow in, Damyan Ivanov (who's basically the one doing most of the work these days) sat down and produced a new release. So, I present you, KGB 1.16! What's new

• Added support for CVS.
• Ability to pass a commit URL along with the commit, to provide a direct link to the change-set. This requires both client and server to be updated.
• Some changes in the colour-scheme.
• A new script, kgb-add-project, eases the addition of new projects to the server configuration.

Bug fixes

• Honour 'repository' setting in client configuration file.
• Make the server not die on reloading.
• Re-open server log properly on reload.
• Fix forced single-line commit mode.
• Documentation fixes, brushed-up packaging.

Coming up soon

• Short URL support!
• Broadcast channels that report commits from all repositories (like CIA did on #commits).
• New --fake option to kgb-client, to test configurations.
• Add --save option to kgb-add-project to save changes to the config file.
• Move URL shortening to bot (configurable).
• Ability to use client-driven color schemes. Can be used to disable all color.

Tags: Planet Debian, KGB

FreedomBox 0.1 Ian Sullivan posted a release announcement today regarding the first FreedomBox public release, which we're calling 0.1. This release is, frankly, long overdue. Getting here has been harder and taken much longer than any of us intended. Fortunately, now that we've reached this milestone, I believe that making regular progress towards the vision we have for a "1.0" release will get easier. FreedomBox is far from the only thing that I'll be working on after my upcoming early retirement from HP, but hopefully I will succeed in putting far more time towards the project soon than I have been able to in the past.

UK Readers Can Now Purchase DRM-Free Books From Tor UK

We believe that making our Tor ebooks DRM-free is the best for our readers, allowing you to use legitimately-purchased ebooks in perfectly legal ways, like moving your library from one ereader to another, says Jeremy Trevathan, Publisher at Pan Macmillan. We understand that DRM can make your ebooks less easy to read. It also makes building and maintaining your digital library more complicated. For these reasons, we are committed to remaining DRM-free.

I'm really happy to see this and I hope more ebook sellers follow suit. Some of the others already doing DRM-free can be found on our list at Defective by Design. Also see StoryBundle, which just launched and offers a set of DRM-free ebooks on a pay-what-you-want basis, with some of the money going to charity.

I have published PowerDNS version 3.1-1.0 on https://ivanova.notwork.de/~mh/debian/pdns/ This is a preliminary package and a release candidate to be 3.1-2 in Debian. If you re interested in PowerDNS on Debian, please test this package. I plan to upload next week. This package will vanish from the web server once the package is visible in Debian.

My curiosity was definitely nookd by this story. While this doesn't seem to have been an act of censorship or anything nefarious by Barnes and Noble itself, this does point to just how terrifying ebooks can be if we aren't careful. In the future, when we are dealing with the entirety of human knowledge, we better be careful with the find and replace function. And we better make sure we control our computer systems so that other people can't nook us without our permission. See also:

• War and Nookd
• Nookd

As someone who read War and Peace in paper form, much of it in bed, I definitely empathized with this:

Some weeks ago I decided that I wanted to read Tolstoy's War and Peace. Lou Ann loaned me her copy. At more than 1100 pages, reading it in bed required as much strength as balancing a box of bricks in my hands. In my senior years I have developed arthritis in my thumbs, which made the effort not only difficult, but painful.

I put up (with almost no filtration) the photos I took while visiting Brussels for FOSDEM in February. Most are from the Atomium.

Sarah's Mum had accrued too much annual leave and had to take some time off work, so Sarah did some (very mild) arm twisting and convinced her to come over for 3 weeks, and do a 5 day cruise to Mexico out of New Orleans. Unfortunately, my annual leave situation wasn't quite so abundant, and I had a lot going on at work, so regretfully I didn't join them on the cruise, and instead went to New Orleans for a four day weekend when they returned. From all reports, the cruise was very good. Zoe handled it well, although she did say "home" a lot. One of the two stops in Mexico was to check out some Mayan ruins, which looked awesome from the photos. The other stop involved a dolphin encounter. I was incredibly envious of all that they got to do, and would have loved to have gone with them, as I've never been on a cruise ship either. I can also report that no cats were lost during this bachelor stint. I had a night flight on the Wednesday evening to get there, which was scheduled to get in at around midnight, and I'd booked a motel room near the airport for that night, and we'd booked a vacation rental home for Thursday to Sunday nights. Unfortunately, my flight ended being delayed something like 2.5 hours, so I didn't get into New Orleans until around 2am. The house we rented did the trick nicely. It was a small "shotgun" duplex in what looked like a nice neighbourhood. It was advertised as being close to the street car line, but they were doing some work on the tracks, so the street car didn't seem to be running as far down the line as it usually did, so it ended up being a bit more of a trek to get to it. It was also extremely slow, and there was a marathon on the Sunday, which closed everything down for a long time, making it a generally pretty unreliable form the transport. We ended up renting a car for Saturday and Sunday, which was something of a saga in itself, as Enterprise didn't have any cars at the location we'd booked one, so after a couple of hours cooling our heels there (Zoe was incredibly well-behaved, all things considered), they shuttled us over to another location and we ended up with a minivan instead of a compact, which for the same price, allayed our concerns about being able to transport all of our luggage to the airport on Monday morning. We had a very early morning flight on Monday morning to come back, which got into SFO at around 9am, and I went directly to work from there. Thursday We all arrived at the house, separately. It ended up taking them 2 hours to disembark the ship when it came back into port, with Customs taking an eternity to process everyone. I think we went exploring the local area that afternoon, and took a street car into the city to check out Bourbon Street, having a Cajun dinner at Remoulade. Friday In the morning, we went to check out Lafayette Cemetery Number 2. Sarah took Zoe back to the house for a nap, and Sarah's Mum and I continued back to explore the French Quarter some more, walking down the length of Royal Street (which was vastly different from Bourbon Street, just one block over). We had lunch at the French Market. The cemetery was interesting, as pretty much all of the graves were these huge above ground tombs, that seemed to have multiple family members interred in them. Apparently the cemetery filled up quite quickly courtesy of a Yellow Fever outbreak. After lunch, Sarah's Mum and I continued wandering around the French Quarter. We went and took a look at the Mississippi River, and I had an encounter with a grifter who was so good at his job I couldn't bring myself to argue with him over the $20 he diddled me out of. We tried to get to the Civil War Museum, but it closed at 4pm. We looked at the Robert E. Lee Monument, which seemed to be draped in drunks, and then I think we rendezvoused with Sarah and Zoe back on Canal Street for dinner at The Court of Two Sisters (which apparently we were under-dressed for, as Sarah and her Mum said we were getting a lot of dirty looks from other patrons). Saturday On Saturday morning, we had the aforementioned car rental experience from hell, and by the time we had the car it was lunchtime, so Zoe napped in the car after lunch on the way out to Oak Alley Plantation, where we were introduced to the delightful beverage known as the mint julep, and took a tour of the house and wandered the grounds. Sunday On Sunday, Sarah and her Mum did a swamp tour, and Zoe and I went to the zoo. As I said earlier, there was a marathon that completely closed down Saint Charles Avenue, which is where the street cars run, so after walking down to where the street cars started operating (which ended up being most of the way down South Carrollton Avenue), the driver informed me that the street cars were queuing up at the corner of South Carrollton and Saint Charles, and I should get off her street car and get on the one at the front of the queue. I did this, but the driver of the front street car informed me that she wouldn't be leaving for an hour and half. At this point, I started considering a bus instead. Zoe and I went to check out the Mississippi River, which was quite close to where we were, and then I went back, and despite a street car having left (without any passengers) the driver of the current street car couldn't tell me when she'd be leaving, so I started walking down Saint Charles Avenue. Unfortunately, Zoe's going through a phase where she wants to be carried everywhere, so I was lugging her all over the place on my hip. Sarah didn't take a stroller with her, and instantly regretted it. Lesson learned. Eventually we managed to get onto a bus, which dropped us off at Audubon Park, which had Audubon Zoo at the other end of it. There was a playground near the Saint Charles Avenue end of the park, so Zoe had a bit of a play on that, and then we continued through the park to the zoo. Mercifully, the zoo had dodgy strollers for rent, and there was no way in the world I wasn't going to rent one of them, so that made getting around with Zoe a lot easier on my back. We had a really good time at the zoo. There was some sort of a music festival on in the parklands within the zoo grounds, and that included a jumping castle, which Zoe expressed a desire to have a go on. She had a fabulous time on it. I think she probably spent about 15 minutes in there, without any tears. I was very impressed. I took a brief video of some of her antics. It was getting close to Zoe's nap time, and she was getting tired, but fortunately Sarah and her Mum were able to pick us up from the zoo after their swamp tour and Zoe got to nap back at the house. Monday We had a very early start. Unfortunately, our flight (with United) was a couple of days after United and Continental officially merged, and despite having checked in online, we had to queue up with everyone else (for an extended period of time) to drop off our checked luggage. Then there was a 45 minute line for security screening. We pulled the "toddler going to melt down" card and jumped to the head of the line, but Sarah's Mum had to wait. The flight ended up being delayed because people were stuck in the security line. Overall impressions of New Orleans Fabulous architecture. There were so many gorgeous houses on Saint Charles Avenue and the surrounding area. I'd have loved to do an architecture tour. Crap (but cheap) public transport. $3 gets you a day pass. The street cars are cute, but slow and unpredictable. The drivers were remarkably unhelpful. The buses were okay. Great food. Zoe seemed to have a liking for the spicy stuff. I gave her some fresh alligator jerky, and after some initial coughing and spluttering at the spiciness of it, she came back for more. Post-Katrina recovery. We really only saw a very small part of the city, but there were still some houses with boarded up windows, and some vacant blocks where buildings had been demolished, but largely you'd not have been able to tell that large parts of the city had been underwater, from casual inspection. I really enjoyed the trip, even though it was brief, I feel like I got a good feel for the place. We were there just after Mardi Gras, and there were still beads everywhere. Draped all over fences. Over power lines. Trees on the parade route were absolutely covered in beads. I'd have loved to have been there for Mardi Gras. My friend Brandon, who is an excellent street photographer, took some great photos that capture some of it. Photos from Sarah's cruise and our time in New Orleans are here.

In mailing list discussions, I've noticed that the practice of replying "+1" to messages with which one agrees has become very widespread. I think this is interesting for a lot of reasons, such as what it shows about habits picked up in communicating via social network sites that grew out of e-mail percolating back to e-mail. We seem to have really grown to like this idea of "voting" for people's messages, and if there's no "Like" or "+1" button on their message, we'll make our own. (Likewise, apparently a person's name is no longer sufficient to indicate that one is addressing them in an e-mail -- am I right, @dear_reader?) The problem for me is that I have my venerable awesome e-mail client Gnus set to hide quoted text in messages by default with (add-hook 'gnus-article-prepare-hook (lambda () (gnus-article-hide-citation 1))), and it thinks that "+" is the start of a quoted line -- so it hides the "+1". While there's a certain poetic justice to that, it confuses me because it makes the message look empty, and someone could do something like "+1 I'm pregnant too", causing me to miss some very important news. The fix for this is to change the regexp pattern Gnus uses to decide if a line is a message quote or not. gnus-message-cite-prefix-regexp is built using message-cite-prefix-regexp, so I changed the value of the latter, removing the literal "+". I also found while investigating this that I already configure that variable in order to add "#>" which someone sometime during my 9 years of using Gnus must have used. The net result is (setq message-cite-prefix-regexp "\\([ ]*[-_.#[:word:]]+>+\\ [ ]*[]> ]\\)+"). (Note that some of those whitespace characters are tabs, which probably won't display properly here, but you can compare to the default value to see what I actually changed). +1?

At FOSDEM, John Sullivan delivered an interesting talk titled Is copyleft being framed? to verify alleged claims on the decline of GPL-d software. (Slides are available.) The crux of the talk is the analysis he performed on the Debian archive to discover the amount of software we distribute that is covered by GPL, LGPL, or AGPL ("GPL-d" for short in the remainder). John's talk steps in an interesting and long running debate (a recent summary of which is available in this ITWire article). The most interesting part is the discrepancy among John's results and Blackduck's, which are often used to argue how the popularity of the GPL license is declining. That might be the case. Or not. The more analyses we do to find it out, the better. The underlying assumption on John's work is that Debian is a representative sample of the Free Software out there, which I think is a reasonable assumption. I find the analysis presented in the talk completely satisfactorily from a purely scientific point of view. The same cannot be said about Blackduck's result: both their methods and data are secret, making it impossible to reproduce their experiments. Highly unscientific. Still, John's results are surprising: as much as 87 percent of Lenny's packages and 93 percent of Squeeze's are GPL-d. That seems a lot. Puzzled about that, John discussed with me the issue before his talk, in search for pitfalls in his methods or data. Finding none, I pointed him to the almighty DktrKranz for some extra review; who found nothing either. To stay on the safe side, even during his talk John called for independent reviews of his results. What could be wrong? The tool used to gather the data is license-count from the debian-policy package. Input data are the debian/copyright files of all Debian source packages. If license-count is not bugged, our debian/copyright files might be. One thing that occurred to me only a few days ago is the habit of declaring a different license for Debian packaging (the files under debian/) than the software being packaged itself. That's a bad habit because it might cause unwanted license mixtures via patches that live under debian/ but I've seen several occurrences of it in the Debian archive. For name and (self-)shame: I've also been guilty of it in the past, when I was young . Is that reason enough to skew results and overestimate GPL-d software? I don't think so, I hope not, but ultimately I don't know. It'd be nice to rule out the possibility entirely. So if anyone is willing to do some sampling of affected debian/copyright files and propose patches for license-count to exclude those "false positives", please shout. (As a bonus point: that would also help to take more sound decision for the typical use case of license-count, i.e. deciding when a license should be added to /usr/share/common-licenses.) Other independent reviews of the results are equally welcome. Note: the above, as well as John's analysis, would be a trivial exercise if DEP-5 were already widely deployed in the Debian archive.

---

Update: add link to John's slides
Update 19/02/2012: Russ Allbery, author of license-count, posted a way more likely cause of data skew in John's analysis: double counting among the different types of copyleft licenses

Rain Friday was something of a rare day for February in Kansas. Starting at about 2AM, the wind picked up, blowing so hard that our windows rattled. That part isn t so rare. Then the cold rain started, dropping almost 2.5 throughout the day. As I worked, I had the blinds on the windows open, but they didn t let in very much light. Still, the wind had calmed down, so the intermittent rain outside was peaceful. Jacob went out to play for a little while, so every so often I saw a warmly-dressed and excited-looking 5-year-old run past my window. A little while after he came in, I told Jacob, I saw you playing outside. His response: Oh good! I got wet! Which, despite the fact that it was about 50 degrees, seemed to excite him. After the blustery start, the calm, slow, and peaceful rain was a pleasant thing to see throughout the day. Funeral My great aunt Alice Goerzen passed away last Sunday. So today, for the third time in a little over a year, I was at the funeral of a Goerzen relative and neighbor. Alice s husband, Milt, passed away in late 2010, and it was while I was at his funeral that Jacob got run over by a tractor. That memory certainly came back to me today. But I think I should set the stage and explain what funerals are like in this small, rural Kansas community. At the church, while people file in, family and close friends generally defined as loosely as desired meet in some other room before the funeral. Memories may be shared, or songs sung, or maybe just a brief meditation or prayer. Then the man from the funeral home there s only one in town will step in. Ivan Miller owned the business for decades, and although he s now retired, his replacement seems pretty similar. Kindly, respectful, and pretty much unchanging. This group then files into the church sanctuary to sit up front, while the rest of the congregation is standing and music is played. We typically sing some hymns, hear memories from the family, a message from a pastor, and then do downstairs for faspa: an light meal with coffee, zwieback, funeral cheese , and some relishes and dessert. You can, by the way, go to the local grocery store and find a product labeled funeral cheese . It s a sharp cheddar, sliced thick and cut into pie piece-shaped wedges. After everyone has picked up their food, microphones are passed around, and anybody that wants to can share memories and stories. These are often hilarious, or touching, and can be more random than anyone could expect. Today we heard a lot about how Aunt Alice loved her flowers and garden. We even saw a video of her giving a tour of her garden, with Milt s mower in the background occasionally accidentally causing a distraction (or maybe it wasn t so accidental; he d never miss an opportunity to cause some mischief ) I tend to think of attending funerals around here as a good time. Sadness is inevitable, but there are so many amazing stories that it is hard to leave feeling sad. Excitement This afternoon, Jacob found me in the office and as he often does, said, Dad, I want to do something with you. Usually I ask him what he d like to do, but his first instinct is usually to ask for watching train videos on Youtube. So sometimes I make other suggestions. Today we played hide and seek with radios, in which the person that is counting is supposed to radio to the other person when they are done. Today was the first time that Jacob came up with the trick of talking into the radio while I was hiding so he could hear where I was. I was sort of proud of him, and he failed to completely hide his smile when I told him I had to turn off my radio or else he d find me too fast. Then later, we played with Jacob s computer, a Linux-based command-line-only machine. I have set up a few shell scripts and aliases for him. Since it doesn t play videos, he doesn t use it as much as he does mine, but it is really fun to watch how his interaction with it changes as he gets older. He can now read amazingly well for a 5-year-old, and is starting to learn how to spell. He loves word games, writing, and typing. I thought I would install an ASCII art program for him. I told Jacob I had some ideas for a new game, and he was irresistibly intrigued. I offered him a choice between figlet and toilet. And, as is probably no surprise to anyone with a 5-year-old, he chose toilet based on its name, Jacob and Oliver both loved typing things and seeing them displayed bigger. I showed Jacob how I could make a freight train by typing ,<@-[]-(*)-@> (that s the comma-shaped snowplow, engine, boxcar [], tank car (*), and caboose @>). Then toilet drew them big, and though abstract, caused great excitement. I hooked up one of the speech synthesizers in Debian to a simple shell script named talk , which is a huge hit with the boys. They enjoy typing in nonsense and hearing the funny result, or in typing in real words and hearing how the computer says them right (or doesn t). All told, we had a good hour s worth of excitement up there.

In a few hours, I'll be flying to Brussels with Ivan, for a new edition of FOSDEM, undoubtedly the best Free Software conference in Europe. I'm looking forward to hang out with Debian, GNOME and #dudes people, as well as to explore some other quiet and cool spots in the city with our hosts Ra l and Vir. I'll probably be around the CrossDistro and CrossDesktop rooms most of the time, but before that I'll be at the Delirium caf not long after landing in Brussels. For someone who doesn't enjoy cold weather that much, this is going to be a special edition oh dear, -10 , this is fucking crazy!

good news: from looking through RC bugs in the BTS, it seems that more & more people are starting to join the RCBW effort!

& here's my usual list for the past week:

• #633935 src:fim: "fim: Please Build-Depends on libjpeg-dev, not libjpeg62-dev"
  do as the bug report says, upload to DELAYED/2
• #634400 src:morituri: "morituri: FTBFS: tests failed"
  add upstream patch (via Ubuntu / Daniel T Chen), upload to DELAYED/2
• #643464 src:radeontool: "radeontool: FTBFS: radeontool.c:42:5: error: format not a string literal and no format arguments [-Werror=format-security]"
  apply patch from Jonathan Nieder, upload to DELAYED/2
• #643473 src:python-kinterbasdb: "python-kinterbasdb: FTBFS with firebird-dev (2.5) -- removed defines"
  do a QA upload with the patch from Damyan Ivanov
• #650788 src:python-osd: "python-osd: binary-indep doesn't build python-osd"
  update build-* target in debian/rules, upload to DELAYED/2
• #652245 src:tomoe: "tomoe: FTBFS: dpkg-buildpackage: error: dpkg-source --after-build tomoe-0.6.0 gave error exit status 1"
  send ideas for fix to BTS, later NMUd by a fellow DD
• #652700 haildb: "haildb ftbfs if libcloog-ppl0 is not installed"
  sponsor NMU by Tobias Frost, upload to DELAYED/2
• #654255 src:cmucl: "cmucl: FTBFS: Error: Unbound symbol."
  suggest manual close, done by maintainer
• #654257 src:newlib: "newlib: FTBFS: cannot find the library sys/linux/liblinux.la' or unhandled argument sys/linux/liblinux.la'"
  apply patch from Ubuntu / Wookey and Steve Langasek, upload to DELAYED/2

As a Debian administrator, power user or contributor, one often goes to look for information about a package, a bug, a developer or a message from the mailing lists. If you are in this case, you may be interested in the Firefox/Iceweasel extension Debian buttons , written by Damyan Ivanov and packaged by myself. Description When installed, this extension provides five buttons, that you can place in your Firefox or Iceweasel toolbar. These buttons take the text from the X11 PRIMARY selection and act as shortcuts to the web pages corresponding to:

• a package from the archive;
• the development of a package (Package Tracking System);
• a bug report (Bug Tracking System);
• a Debian Developer's packages (Developer's Packages Overview);
• a message from the mailing-lists.

Typical use case Let us imagine you see the following sentence on IRC:

12:42 < Tanguy> I am packaging a cool Firefox/Iceweasel extension (ITP #654896)!

If you want to check out the corresponding ITP report, just double-click on the bug number to select it (do not worry about the leading hash or even the possible trailing bracket, it will be handled), and click on the BTS button on your browser toolbar: here you are! Depending on your needs and habits, this extension may considerably speed up and simplify your quests for information. At least, it does for me, so I hope you will enjoy it too!

I was on the brink of mindlessly clicking through the ACLU action center as usual to send an email opposing SOPA. But then I read their boilerplate text, and ended up cancelling the letter to my rep and instead sending this quick note to the ACLU:

Your SOPA suggested letter text supports current copyright law, and also backhandedly supports PIPA (the Senate version of the bill). This is far too weak of a position. As a donor, I ask you to take a stronger position that current copyright law unjustly restricts free speech, and that no further enforcement measures should be instituted until that fundamental problem is addressed. At least take on BOTH of these bills strongly. Most of the significant Internet is blacked out today to oppose both bills -- why would you cede so much ground to copyright maximalists? We have the support to oppose and defeat both bills.

For reference, here was their text:

While I believe it's important to protect copyrighted material online, the language of the Stop Online Piracy Act (SOPA) is flawed and will lead to the blocking of lawful content. Unlike the Senate version of the bill, SOPA eliminates the concept of sites 'dedicated to infringing activity' and enables law enforcement to target all sites that contain some infringing content -- no matter how trivial. The potential for impact on non-infringing content is much greater under SOPA than under other versions of this bill. Sites with user-generated content, like YouTube, Twitter, and Facebook, would be especially vulnerable, as one small piece of infringing content could lead to blocking the entire site. Even though proposed changes would narrow the amount of lawful content impacted, the changes don't go far enough. It is still likely that search engines will end up blocking access to perfectly legal online content. Congress should focus not just on the goal of protecting copyright owners, but also protecting the speech rights of consumers and providers who are reading and producing wholly non-infringing content. Congress must eliminate the collateral damage to protected non-infringing content. Only in that way will Congress truly achieve its goal of protecting authors while respecting the constitutional right to free speech.

Maybe I'm overreacting, but I dislike it when good organizations take weak positions unnecessarily. Usually this is not a problem with the ACLU, for me. It doesn't help that I keep seeing this meme everywhere in the anti-SOPA/PIPA conversation: "I agree we need to do something about piracy, but not this..." I don't think we need to do anything to fix violations of an extraordinarily unjust law until the law itself is fixed. I don't find that to be a very radical position.

I will be helping to represent the FSF at FOSDEM next month in Brussels. I'm speaking in the Legal Issues Devroom on Saturday 2012-02-04. The presentation is called "Is copyleft being framed?":

This short talk will address the following questions, to inspire discussion and contemplation about how we frame descriptions of the state of licensing in free software.

• Numbers are increasingly being cited to show that the use of copyleft licenses, specifically the GPL, is declining. What do these numbers actually show, who is propagating them, and why? What do or might other numbers show?
• Is the "percentage of free software projects which use copyleft licenses" a useful way to judge the success of copyleft? Does an increase in the percentage of projects using non-copyleft permissive licenses indicate a failure of copyleft?
• As a small related case study, what role have the licensing terms of popular mobile application stores played in this debate, and how have those terms changed the frame of the discussion?

Let me know if you'll be there too!

Google Maps is now mapping the indoors. I saw an ad for this while passing through MSP yesterday (given how much time I spend on the Internet, it's strange and a little embarrassing to learn about new things on the Internet from airport billboards), since one of their initial targets is the infamous Mall of America.

Detailed floor plans automatically appear when you re viewing the map and zoomed in on a building where indoor map data is available. The familiar blue dot icon indicates your location within several meters, and when you move up or down a level in a building with multiple floors, the interface will automatically update to display which floor you re on. All this is achieved by using an approach similar to that of My Location for outdoor spaces, but fine tuned for indoors.

Thoughts about this:

• Okay, having a map of Ikea or an airport on my phone might be kind of nice.
• Shouldn't they have launched this years ago when people still went to malls?
• Shouldn't they have launched this at least earlier in the year, in time for people to know about it and have it before the one time each year when people who don't go to malls still maybe go to the mall?
• How does it know where you are, when cell and GPS so often don't work in these places? "fine tuned for indoors" is a very mysterious phrase. Based on nearby access points?
• Is your location also being transmitted if you use this service? In other words, will Google now know which stores you shop at, how many times you use the restroom, and whether you were actually shopping for gifts for other people?
• Relatedly, will this be free software? Or will it rely on proprietaryness in order to do things users would prefer it didn't do? (Answer: It's proprietary software, part of the existing proprietary Google Maps mobile application.)
• Will they sell data to the stores and malls?
• Will they start indicating various promotions on the maps?
• Will these promotions be targeted based on your past meandering behavior?
• Are they mapping less-commercial spaces, like museums?
• Are they making the map data available for others to use? Especially for truly public spaces?
• How do we get the functional part of this into OpenStreetMap?
• Is Google secretly working on computer-piloted mobility scooters?
• Where am I?

Title from John Ashbery

After recently reading a number of SSL/TLS-related articles, I decided to experiment and look for the ideal OpenSSL configuration for Apache (using mod_ssl since I haven't tried mod_gnutls yet) and nginx.

By "ideal" I mean that this configuration needs to be compatible with most user agents likely to interact with my website as well as being fast and secure.

Here is what I came up with for Apache:

SSLProtocol TLSv1
SSLHonorCipherOrder On
SSLCipherSuite RC4-SHA:HIGH:!kEDH

and for nginx:

ssl_protocols  TLSv1;
ssl_ciphers  RC4-SHA:HIGH:!kEDH;
ssl_prefer_server_ciphers   on;

Cipher and protocol selectionIn terms of choosing a cipher to use, this configuration does three things:

• disables all weak ciphers and protocols
• disables very slow ciphers that use ephemeral Diffie-Hellman exchanges
• gives priority to the RC4 cipher to minimize CPU usage and defend against the BEAST attack

Testing toolsThe main tool I used while testing various configurations was the SSL labs online tool. The CipherFox extension for Firefox was also quite useful to quickly identify the selected cipher.

Of course, you'll want to make sure that your configuration works in common browsers, but you should also test with tools like wget, curl and httping. Many of the online monitoring services are based on these.

Other considerationsTo increase the performance and security of your connections, you should ensure that the following features are enabled:

• SSL session caching with a session store shared between all of your web servers
• HSTS headers to let browsers know that they should always visit your site over HTTPS