Search Results: "lutin"

19 May 2012

Richard Hartmann: Motherland's bosom

I read a translated poem about Russia being "the Motherland" and its vast bosom years ago. Having driven through a significant part of it, I can agree on the "vast" part... Also, as I am on a train and without access to the Internet, I will refrain from linking to a lot of pages; sorry. (Turns out I am posting this a week later, but I will still not link to stuff now; no time). Russia in general Moscow Sights Kreml Our remaining time in Moscow was spent with touring the usual suspects; the Kreml is a lot less impressive in real life, the Red Square is tiny when compared to the stories I heard about it and the Chapel ofi St. Basil is even more colorful and impressive in real life. Lenin's body was inaccessible because workers built seats for the May 9th parade to the left and the right of it and they apparently thought it would be a good idea to block access to one of the main tourist attractions while doing so. A river tour of Moscow was a nice cool-off and we got to see quite a few things. We managed to see the weekly military parade within the Kreml grounds, but it was mostly pomp and little substance. The National Treasure which you can access with an extra ticket within the Kreml grounds is nice, but less impressive than the tourist guides would make you believe. That being said... There's another museum within the museum and.... Whoah... Tourists pay extra, visitors go through the only non-security-theater check I encountered in Russia, guards are armed, people can only enter and leave in batches, and the stuff which is presented is mind-boggling. Disregarding the fist-to-calf-sized chunks of gold and platinum which are still in their original form directly from the mine, there is real, actual treasure galore. Little heaps of uncut and cut diamonds, an outline of Russia filled with cut diamonds and other random "we have this stuff" displays can be found as well. Then, you have various tiaras and other jewellery made from various gems. Not incorporating, but largely made of. All that pales in comparison to the crown, royal apple, scepter, etc. It's hard to put the amount of tiny multi-colored light points that shine at you into words. I was just standing there, swaying back and forth to catch the moving pattern of pinpoints. It's said that this collection is equalled only by the ones in the Tower of London and the one Shaw of Iran had and boy do I believe it. TV Tower Getting up there was funny. The old-style Soviet queuing system was used: "Security" for approaching the tower was multi-level, the guards see you approach along a long walkway way in advance and the main guard shed had several small cabins separated by thick glass. So good so menacing. But in a twist that would make Bizarro and Garry Larson proud, I was required, by means of metal detector gate, metal detector wand and even an x-ray machine to remove every shred of metal and other hard objects from myself and the camera bag and put them onto a table. Once I was without anything except my clothes and the bag was completely empty, I could pass. Everything I had had to remove was just laying there, not inspected in the least, for me to stuff back into pockets and bag and to take with me. This "everything" included a Spot Messenger 2 with lots of green and red blinky lights. The guard did not even glance and it. Security theater? Security theater. The view from 364 meters down on Moscow was nice, but there was a lot of Smog so I couldn't see very far. Jumping on the glass floor while looking down was a lot of fun, though. Subway to Thiefing I bet Christopher Nolan rode the subway in Moscow at least once. That unnerving sound you hear during several key scenes in "The Dark Knight"? Two thirds of all subways make the same sound while moving. Also, I had an encounter with a pickpocket down there; very classical, too. Guy approaches quickly, talks loudly and sounds as if it's really important (in Russian... duh... that's sure to keep me interested). His approach made me turn and protect my left leg pocket automatically, most likely marking the target for the tiny woman standing behind me. Now, I have to tell you something about my usual travel layout. As my normal pockets are very deep, it looks as if their content was in the leg pocket. Plus, there's an extra, hidden leg pocket where I keep the passports and train tickets. The outermost leg pocket is protected by a velcro flap, but it contains nothing of value; usually the appropriate phrasebook, local map, maybe a tissue or chewing gum. Due to this layering, the outermost pocket looks as if it's full to the brim with stuff. Also, I took pains to make it a habit to protect said leg pocket with my hand, nothing else. This looks as if that's the target, but what I am actually doing is protect my normal pocket with my forearm. The right side is different, but the most easily accessibly pocket always holds some small change. I pay from that stash but my actual wallet is well out of reach. Anyway, once the guy ran off, talking to several others, most likely marking all them for the actual pickpockets, I wanted to enter the subway. While the Russian-style queuing took place, I felt an unusual tug at the velcro flap. I looked down and saw a tiny woman to the left of me with a jacket held over her right side with the left arm; I look up to check no one is trying to steal from my permanently assigned female, feel another tug, look the woman into the eyes, look up again and around me, look down again and she is gone. All that took maybe three seconds and I had boarded the subway after an additional two. In hindsight, it makes sense to choose the time of entry for attack. It's crowded, you are being pushed around, and once you are in the subway, it will start moving more or less immediately while the thief remains in the station. In this case, she would only have gotten a grubby map of Moscow's subway and an English-Russian phrasebook, but she got nothing at all. Moscow-Novosibirsk Where to begin... If you think a few hours on a train are a long time, try over fifty hours. Things get so bad, you start getting land-sick while not in a moving train. You even start missing the familiar tunk-cachunk, tunk-cachunk, tunk-cachunk... of driving over rails with gaps in them when you are not moving. The defining element of the Trans-Siberian Railway are birch trees. And birch trees. And then more birch trees. You would not believe how many birch trees there are. This is made "worse" by the way the Russian Railway protects their rails. Left and right of the track, there's a cleared area of maybe ten to twenty meters, sometimes as little as three. Outside of that, they plant ten to twenty meters of birch trees, presumably to catch snow during winter. Beyond that protective perimeter, there's the normal landscape.As a result, on top of the near endless stretches of birch woods, you see most if not all scenery through a layer of birch trees. You get sick sick of birch trees after a few hours and you see them for days on end. Bullet points to save myself some typing and you some reading... Novosibirsk The non-existent hostel We arrived at ~0200 local and made our way to the hostel we had booked a room with. Walking to the correct address, we saw several signs but they all turned out to be for a police station and some other state agency. We walked back, forth, double-checked, triple-checked: no hostel. We then walked around the building through some not-quite-nice back alleys, but other than a few entries to private flats, there was nothing. Thankfully, the booking slip included a number which we called and after at least twenty rings (no kidding), when I had given up and wanted to hang up, it stopped ringing. Dead silence. After maybe ten seconds, someone started talking in Russian. I asked him if he spoke English and told him that we could not find the hostel. He mumbled something about being sorry and that we should wait, he would come down. Fast forward a minute or two and someone walked towards us. Again, he mumbled about being sorry, that the hostel "did not work" at the moment and that we would need to sleep in his private apartment. He ushered us into some back alley entrance, into his flat, and proceeded to remove the sheets from the couch on which he had slept; after putting on new sheets, we had our "hostel" bed, ready to sleep on. We briefly considered if he would murder us in our sleep, but him and me even got to talking a bit. Over cheese, sausage and rum (at 0300), he admitted that the hostel did not exist and he merely planned to turn his flat into a hostel for the summer while he and his family moved into their summer house (the Russian term of which escapes me, at the moment) in the countryside. He had accepted our reservation as he thought he would be finished by that time. He did not even get started, though. While he sent us an overbooking notice through booking.com two days before, we were on the train at that time, so... booking.com even called him to check what happenend to us as we did not book another place through them. Good customer service/protection, that. Next morning, he didn't even want to take our money (we paid anyway) and, as a means of compensation, drove us into the city in the morning and to a train museum well outside the city limits, one of the fabled scientist cities, and a large lake which everyone in Novosibirsk claims is an ocean, in the afternoon. Foreigners, foreigners! All in all, Novosibirsk was relatively uneventful, safe for one bizarre episode. We took our lunch in a local fast food joint (why do all the good stories happen there, and not at the various truly local places?) and threw the cashier our well-rehearsed "Niet Russkie; anglisky?" with phrasebook in hand and he actually understood a few words of English (beef, chicken, fries). We told him, in our worst Russian, that we are from Germany wished him a nice day and went to sit down. A few minutes later, a girl approached us, literally hopping from one foot to the other and wringing her hands. She told us that the cashier had told her that we spoke English and if it would be OK if she talked to us. We suspected some sort of elaborate ruse, but went with it. Turns out, she had English at school and really wanted someone to practice English on. Two young men passed our table and exchanged a few words with her, sitting down out of sight. When she told us that she had to leave now but if it would be OK if the two boys joined us we suspected a ruse yet again. But those two were law students, one with a minor in English and one with a minor in German; both of them also extremely nervous, asking us if we would talk to them. When they had to leave, they told us that the three of them worked at the burger joint and that their shift was just about to start when the news that foreigners were here spread amongst staff like wildfire. The girl stopped by several times in between cleaning tables, getting in a sentence or two before being cussed at by her supervisor. All in all, this took about twenty minutes and seeing three people so nervous and grateful to talk with us felt beyond absurd. On the other hand, not a single traveller we met even considered stopping in Novosibirsk during their transit so there really does seem to be a shortage of non-Russians there. Weird, and memorable. Novosibirsk-Irkutsk Irkutsk / Listvianka / Lake Baikal Listvianka Aah, lake Baikal... the oldest and deepest lake on Earth which holds a fifth of the global non-salt water reserves; a must-see in my book. Quad tours at break-neck speeds, dry-suit diving with Russian regulators, walking barefoot in between and across drift ice that made its way onto the shorei, and extended hiking around the lake's coast... All of which I could not do because I was ill and had to spend two solid days in bed. The draft from the open window in between Novosibirsk and Irkutsk was enough to give me a rather bad cold which peaked at Lake Baikal. Still, the area was lovely and we were glad to be out of a train and able to unpack our stuff without having to repack immediately for once. I am not sure where my current losing streak with regards to diving is coming from (Grimsey, diving north of the Arctic circle with birds that plummet into the water and hunt fish: Only guy who does this is on the Icelandic mainland that day; Svalbard, diving north of the Arctic circle in permanent darkness: The few people who do this privately did not reply while I was there; Baikal, oldest, deepest, largest lake on Earth: ill), but I will most likely return to Russia for a week of ice diving in Lake Baikal next winter or the one after that. As an aside, I saw several people walking to Lake Baikal with buckets to get their water. Other people got it from a well which was still half frozen. If you have running water consider yourself lucky... Irkutsk Nice city, largely uneventful. The farther east you get within Russia, the more normal women look. In Moscow, just as in Paris, they are way over-dressed and even service personnel will walk with high heels. Thankfully, I don't have to wear heels, but for the other males out there: Walking and standing in these things hurts and thus most if not all people who stand and walk for a living have flat shoes. We happened upon preparations for a military parade, complete with cordon, viewing podests, at least half a dozen TV cameras etc, but were not sure if it would start soon enough for us to catch our train.We asked someone who told us it would start at 2100 local, at 1945 local it seemed about to start, and sure enough at 1955 sharp, the whole thing went under way. About a dozen groups of 50-100 people each, all in their own, respective uniforms stood against one side of a cordoned-off street and several higher-ups on the other side. Two highest-ups shouted into microphones and the throng of people on the other side shouted back answers. Then, the two highest-ups stood in the back of a jeep each and drove past said throng, stopping in front of each group, shouting into microphones mounted in the back of the jeeps and the groups shouted back once again. After that, all groups marched around the make-shift plaza once, saluting the higher ups. Once they were done, and they took ages, two trucks drove by with soldiers jumping out of the moving trucks and moving into crouching positions. They ran around in a circle a few times and engaged in pretend hand-to-hand combat. I am sure they are skilled at whatever style they wanted to show, but they were overdoing things so badly, they were funny, not imposing. When they jumped over some barriers, the barriers fell to pieces and everyone scrambled to make it look as if that was part of the show. While carrying off the gear, it fell into further pieces which was even more funny. An armoured personnel carrier ended the show; several tougher looking guys jumped off of that one and their mock combat involved fully automatic fire (of blanks), several flashbangs, smoke grenades and, to top things off, the machine gun mounted on the APC moving down the opposing team with blanks. I never witnessed a "real" military parade in person but this one was somewhat disappointing. On the one hand, there was a distinct lack of ballistic missile carriers and tanks like you see in movies, documentaries and games, on the other hand, the whole thing had a make-do feeling to it. The cordoning police had designated spots to stand on, yet walked around. They were standing to attention, yet checking their cell phones. Several people in one uniformed group were wearing track suits and jeans. Another uniformed guy had a grocery bag with him; yet another one was carrying a huge water bottle. Bikers zig-zagged through the cordon and when the whole show was just about to wrap up the police finally started putting up barriers around the unmoving pedestrians, not blocking the bikers. One little girl was standing well within the cordoned area, watching with big eyes and after she did not react to the police talking to her, they just built the barriers in a curve around her. And to top it all off, some guy with a cane walked all through the parade with his personal camcorder, trying to direct the whole show while being ignored by everyone. Still, I am sure he managed to mess up some otherwise perfectly good TV scenes. Irkutsk-Russian border TL;DR 3000 kilometers of birch trees

5 January 2012

Patrick Schoenfeld: Bringing GVFS to a good use

One of the GNOME features I really liked since the beginning of my GNOME usage is the ability to mount various network file system by a few clicks and keystrokes. It enables me to quickly access NFS shares or files via SFTP. But so far these mounts weren't actually mounts in a classical sense, so they were only rudimentary useful.

As a user who often works with terminals I was always halfway happy with that feature and halfway not:

- Applications have to be aware and enabled to make use of that feature, so its often neccessary to workaround problems (e.g. movie players not able to open a file on a share)
- No shell access to files

Previously this GNOME feature was realised with an abstraction layer called GNOME VFS, which all applications needed to use if they wanted to provide access to the "virtual mounts". It did no efforts to actually re-use common mechanisms of Un*x-like systems, like mount points. So it were doomed to fail at certain degrees.

Today GNOME uses a new mechanism, called GVFS. Its realized by a shared library and daemon components communicating over DBUS. At first glance it does not seem to change anything, so I was rather disappointed. But then I heard rumors, that Ubuntu was actually making these mounts available in a special mount point in ~/.gvfs.
My Debian GNOME installation were not.

So I investigated a bit and found evidence about a daemon called gvfs-fuse-daemon, which eventually is handling that. After that I figured this daemon to be in a package called gvfs-fuse and learned that installing it and restarting my GNOME session is actually all needed to do.
Now getting shell access to my GNOME "Connect to server" mounts is actually possible, which makes these mounts really useful after all. Only thing to find out is, if e.g. the video player example now works from Nautilus. But if it doesn't I'm still able to use it via a shell.

The solution is quiet obvious, on the one side. But totally non-obvious on the other.

A common user eventually will not find that solutin without aid. After all the package name does not really suggest what the package is used for, since its referring to technologies instead of the problem it solves. Which is understandable. What I don't understand is, why this package is not a dependency of the gnome meta package. But I haven't yet asked the maintainer, so I cannot really blame anybody.

However: Now GVFS is actually useful.

17 July 2011

Cyril Brulebois: Thoughts on multiple webcams

Keeping an eye on something with a webcam is really easy: just a matter of setting up for example (c)vlc to multicast from /dev/videoX to the network, and done. Example:
# Streaming:
cvlc v4l2:///dev/video0 --no-audio --sout "#transcode vcodec=mp2v,vb=3072 :std access=udp,mux=ts,dst=224.0.0.1 "
# Playing, possibly on a remote machine:
vlc udp://@224.0.0.1:1234
Notes: Possible problems: Where to go from here:

5 June 2011

Russell Coker: Rallying for a Carbon Tax 5th June

It s not that common to have a rally in favor of creating a new tax, but today I attended the Melbourne rally in favor of a carbon tax [1], it was the second such event this year. The rally was held in front of the state library, there is a reasonable size park there and it s a great place for a few hundred people, and a few thousand can squeeze in there without any problem. But according to the best estimates 10,000 people attended and the venue was obviously a bad choice as all available space was used and the crowd was so great that it wasn t much fun to be there. This was a great contrast to the previous rally in favor of a carbon tax which had maybe about 8,000 people attend and a much larger area [2]. The state library is a great place to hold a small or medium size rally where people can see it, but if you are going to get 10,000 people you need a bigger venue as the exits were partially blocked by road work I m sure that the local government wouldn t have given a permit if so many people were expected. Usually the city center is very quiet on a Sunday afternoon, but this afternoon everything was packed. An extra 10,000 people really makes a difference although admittedly sunny weather would have helped. Australia wide there were apparently about 100,000 people attending similar rallies, that s 0.5% of the population of the country! The aim of the rally was to advocate a large enough tax on coal, oil, and other energy sources that emit CO2 to provide an economic incentive to minimise use and use alternate energy sources where possible. Currently billions of dollars are being given to polluting industries, instead those industries should be taxed and the money raised given to compensate needy people. looking north Looking North towards where I entered. looking east Two pictures from slightly different angles that are roughly East from where I was standing in the center of the crowd. looking east through the bandlooking south Pictures looking east through the band when people were starting to leave and looking south towards the exit I chose while on the way out.

14 April 2011

Mirco Bauer: The Big Split: Mono 2.10 Debian Packaging

Most probably haven't noticed yet but I finished the Mono 2.10.1 debian packaging effort of the past 3 months and uploaded it to Debian/Experimental. With Mono 2.10 I had to make the biggest changes in Mono packaging since the big Mono 2.0 upload. The runtime no longer supports the 1.0 and 2.0 runtime profile, instead it now supports the 2.0 and 4.0 runtime profile. This meant I had to drop all libmono*1.0-cil packages and add libmono*4.0-cil packages. This sounds like a lot of s/1.0/4.0/ work but it actually wasn't. Mono 2.10 ships a lot of new libraries over 2.6 and I had again to decide where they should go. "Where should this $library go?" I have been playing this game for the past 7 years maintaining Mono and I finally gave up on it... What, where, when, why? I could give now a 2 hours talk of the issues behind the current packaging approach (keeping the number of library packages low) but instead I will do something else. Please, just take a look at this picture for a second: Brain Melting Device If your browser crashed, your eyes hurt or your brain simply melted, I think you have got the idea. The Big Split The cure? cli-common-dev! This is a package that contains 2 extremely important debhelper packaging tools for packaging Mono/CLI related packages called dh_makeclilibs and dh_clideps. If you don't know these, they do exact the same thing as dh_makeshlibs and dh_shlibdeps do. dh_makeclilibs generates library dependency tracking information and dh_clideps consumes that information to automatically generate the package dependencies for you. So each library of the 4.0 runtime profile has now it's own package, simple as that, the rest does cli-common-dev for me and you. "Hey, that Mono packaging bastard is polluting the Debian archive because of his laziness!" No, I am not. This packaging change not only has the advantage of simplifying the packaging and with that bringing new Mono versions faster to you but also reduces the typical install size for applications as they will only pull in the really used libraries of Mono instead of groups of them. I don't have any numbers handy right now as none of the applications are built against Mono 2.10 (yet), but when the transition starts we will get numbers. New Features There is also a new SGen flavor of Mono available called mono-runtime-sgen which is no longer using the conservative non-generational Boehm's garbage collector but SGen which is a simple generational garbage collector with promising advantages. And here some more Mono 2.8/2.10 news from /usr/share/doc/mono-runtime/NEWS.Debian.gz: Architecture Regressions With the initial upload of Mono 2.10.1 to Debian/Experimental the architecture world broke apart and it regressed on all Mono architectures except for i386 and amd64 :-D There is a reason it's called experimental isn't there? In mono 2.10.1-3 I could solve all regressions except for kfreebsd-* and armel. Jo Shields fixed the remaining regressions and the world started to look good again in mono 2.10.1-4! He also took care of mono-basic, mod-mono and xsp, but mod-mono and xsp are still waiting for the translation call deadline to pass by so they can also be uploaded to Debian/Experimental. Planned Transition As mentioned above, there will be a Mono 2.10 transition needed when the packages hit Debian/Unstable. There is no ETA yet on this when it will happen as I have to coordinate this with debian-release first. But as things are not showtime ready in experimental anyhow, this will not happen too soonish. The Mono 2.10 transition plan will be covered in a following post. GIVMENOWPLX OMG, all this rumbling about Mono 2.10 and I still haven't said a word on how to obtain it, sorry about this, just do this and I will shut up now:
echo "deb http://ftp.debian.org/debian experimental main" >> /etc/apt/sources.list
apt-get update
apt-get install -t experimental mono-complete
(this is the easiest way of getting only mono 2.10.1 from experimental)

6 March 2011

Stefano Zacchiroli: on the influence of Debian and derivatives

Counting derivatives In the news, there's an article by Bruce Byfield discussing the influence of Debian and its (transitive) derivatives on the ecosystem of GNU/Linux distributions: Linux Leaders: Debian and Ubuntu Derivative Distros. The article is a sort of review of what you can find in the vast ecosystem of distributions rooted at Debian: from embedded to supercomputer distro, from netbook to scientific computing distros. The articles cites the Debian derivatives front desk and is a study similar to what we might tackle with the derivatives census by Paul Wise. (By the way: did you check if your favorite Debian derivative is already in? No? Do it!) With this article, Bruce has made me quite a favor in harvesting distrowatch to refresh the figures about the number of derivatives that I often use in speeches. The need of doing that has been polluting my LaTeX "% TODO" comments for a while now Here they are: Update: update figures that Bruce misinterpreted; live data are available, thanks to Loris (see comments) for noticing

18 January 2011

Stefano Zacchiroli: cross-distribution meeting on application installer

saluting the cross-distro app installer meeting I just want to wish luck to the cross-distribution meeting on applications installers, which is starting today. For some background, check out Vincent's nice blog post on the subject. As far as my memory goes, this is one of the first attempts if not the first one to get representative of as many distros as possible around the same table to design, hack, and discuss a common topic of interest. We don't know yet how it will turn out, but the approach to the meeting has been a commendable one: aim at as much diversity as possible (first gathering people informally to get some ballpark dates, then with an announcement sent to the most appropriate place), be transparent about the organization, and engage in keeping others informed ex post. As they say here in France, chapeau for this attempt at factual cross-distro collaboration. Debian is present at the meeting, represented by Enrico Zini and David Kalnischkies. Thanks to them (for being there), to Vincent Untz (for the organization), to Novell/SUSE (for sponsoring part of Debian attendees' expenses), and to Debian donors (whose donations have been used to sponsor the rest).

17 February 2010

Martin F. Krafft: Privacy discussion mailing list

Dear lazyweb: I am in search of a mailing list for discussion on matters related to digital identity and privacy in the information age. Unfortunately, my (limited) searching has not unveiled results, mostly because many mailing lists have privacy agreements or somesuch, polluting the results with pointers to those. If you know such a list, or you don t but you are interested in the topic, don t hesitate to drop me a line. I will then either let you know when my search was successful, or subscribe you when I have created a list to fill the void. NP: Sola Rosa: Solarized

31 December 2009

Debian News: New Debian Developers (December 2009)

The following developers got their Debian accounts in the last month: Congratulations!

30 October 2009

Jordi Mallach: Dead PowerBook G4

A few weeks ago I was trying to get GRUB2 for PowerPC back to work on my PowerBook G4 15", and had some problems getting OF doing the right thing. Not being an OF expert at all, I found myself making things a bit worse, ending up with an unbootable laptop and, what a classic, unable to boot my old rescue CD to get yaboot back in its place. So I googled a bit and ended up deciding that, given the boot parametres and some other stuff like the system's clock were doing strange stuff, reset-nvram would help getting things in a better shape that would at least permit CD booting. So there, reset-nvram, followed by reset-all, as found in all the OpenFirmware cheatsheets I found all over the web, and damn it, nothing changed and I was back into the OpenFirmware prompt. I used the power button to reset the laptop once again, and that was the last time I saw something functional on the PowerBook. Now, when I start the computer, all I hear is the Apple startup sound, followed by the sound of the CD drive (which has eaten an Ubuntu 5.10 CD) trying to spin up for a pair of seconds, and then nothing. There's nothing displayed on the LCD, or any other sign of life . My searches in Google indicate this is a logic board failure and you can imagine that is not cheap to get fixed by Apple support. I've tried numerous keyboard combo tricks I didn't even know about, and none seem to work. The computer doesn't seem to be responding to the builtin keyboard, an Apple USB keyboard I borrowed, or an external display. I'm annoyed because I've looked after this laptop really well and it was in a really good condition, so I'm going to see if it can be fixed for a reasonable amount. Apple care in Val ncia is not an option. They say a logic board (if this is really what is causing trouble) costs around 500 , so I'll have to explore other ways. The first one is trying to find out if these symptoms (nothing on the display, key combos don't appear to work, etc.) really point to a fried logic board or could be something else. I've tried removing the RAM and replacing it with my old one, but that didn't work either. So, if anyone reading this has some Apple PowerPC hardware experience and can share some of their knowledge and suggestions, I'd be really, really grateful. Plan B involves hiring a coworker, who I believe is the son of McGyver, to try to get it repaired for me. This would involve buying spare parts in eBay or some other place to try to get the replaced. Again, suggestions, donations and ideas are welcome in this front too. :) Jose Vicente loves fixing stuff, and right before the Summer he already showed what he can do with a screwdriver and some patience. Some weeks before, I had managed to shatter the LCD screen of my Nokia 6500s when I lost my grip while climbing down a mountain in El Cad , and the phone in my pocket hit a big rock. The phone worked, but I all I could see in the screen were some cracks in random colours. People suggested I should get a new phone, but I really don't want to generate even more polluting waste when all that was needed was replacing a cheap component.


My phone during its stay in McGyver's hideout

20 October 2009

Gunnar Wolf: Among the reasons that brought me to Debian...

Every now and then, people ask me why Debian? Why, among so many projects to choose from, I first liked, then got into, and finally I got committed into Debian, and not anything else? Of course, one of the main points back in 2000-2001 when I started using it, and still to this very day is a strong identification with the ideological side. Yes, I am a strong Free Software believer, and Debian is what best suites my ideology. Still, I did not only get into Debian because of this And I was reminded about this by an article in this month's Usenix ;login: magazine: An anecdotal piece by Thomas A. Limoncelli titled Hey! I have to install and maintain this crap too, ya know! (article requires ;login: subscription, but I'll be glad to share it with whoever requests it to me I have of course no permission to openly put it here in whole online. Yes, I am expressly sending a copy of this text to the author, I will update this if/when I hear from him) [update] The author has kindly allowed me to redistribute his article's PDF Download it here. Before anything else I'll go on a short digression: I am writing a bit regarding the Free Software participants' culture, and this is a trait I love about it: The lack of formality. Even though ;login: (and Usenix as a whole) is not exactly Free Software, it runs quite close to it), it is a well regarded magazine (and association) with an academic format and good (not deep or highly theoretical, but good) contents. Still, it is quite usual to see titles as informal and inviting as this one. And it happens not only here I have been fearing having to explain at work, over and over, why I have requesting permissions to go to Yet Another Perl Conference, Festival de Software Libre or DebCamp, tagging them as academic settings. Or why I am wasting our library's resources on buying cookbooks, recipes and similar material on the most strange-sounding subjects. Anyway, back on track This article I found refers to the lack of value given to the system administrator's time when selling or purchasing (or more in general, as it happens also in Free Software, when offering or adopting) a product. Quoting Thomas:
A person purchasing a product is focused on the features and benefits and the salesperson is focused on closing the deal. If the topic of installation does come up, a user thinks, Who cares! My sysadmin will install it for me! as if such services are free. Ironically, it is the same non-technical executive who dismisses installation and upkeep as if they are free who might complain that IT costs are too high and go on a quest to kill IT spending. But I digress. I can understand why a product might be difficult to install. It is hard enough to write software, and with the shortage of software developers it seems perfectly reasonable that the installation script becomes an afterthought, possibly given to a low-ranking developer. The person purchasing the product usually requires certain features, and ease of installation is not a consideration during the procurement process. However, my ability to install a product affects my willingness to purchase more of the product.
Thomas goes on to explain his experience with Silicon Graphics, how Irix was so great regarding install automation and how they blew it when switching to Windows NT; talks very briefly about IBM AIX's smit, a very nifty sysadmin aid which is basically a point-and-click interface to system administration with the very nice extra that allows you to view the commands smit executes to perform a given action (and then you can copy into a script and send over to your hundreds of AIX machines) Incidentally, by the time I started digging out of what became the RedHat mess of the late 1990s and passed briefly through OpenBSD on my way to Debian enlightenment, I was temporarily the sysadmin for an AIX machine And I too loved this Smit approach, having it as the ultimate pedagogical tool you could ever find. Anyway, I won't comment and paraphrase the full article. I'll just point out to the fact that this was what ultimately sold me into Debian. The fact that I could just install anything and (by far) most of the times it will be configured and ready to use. Debian made my life so much easier! As a sysadmin, I didn't have to download, browse documentation, scratch head, redo from start until I got a package working Just apt-get into it, and I'd be set. Of course, one of the bits I learnt back then was that Debian was for lazy people Everything works in a certain way. Policy is enforced throughout. So as a sysadmin, I should better get well acquinted with the Debian policy and know it by heart. In order to be able to enjoy my laziness, I should read it and study it. And so I did, and fell in love. And that is where my journey into becoming a Debian Developer started. Why am I talking so nostalgic here? Because I got this magazine on the mail just last weekend And coincidentally, I also got bug report #551258 I packaged and uploaded the Haml Ruby library (Gem, as the Rubyists would call it). Haml is a great, succint markup language which makes HTML generation less of a mess. It is even fun and amazing to write Haml, and the result is always nicely formatted, valid HTML! And well, one of Haml's components is haml-elisp, the Emacs Lisp major mode to do proper syntax highlighting in Haml files. Of course, I am an Emacs guy (and have been for over 25 years), so I had to package it. But I don't do Emacs Lisp! So I just stuffed the file in its (supposed) place, copying some stuff over from other Emacs packages. During DebConf, I got the very valuable help of Axel Beckert to fix a simple bug which prevented my package from properly being installed, and thought I was basically done with it. I was happy just to add this to my ~/.emacs and get over with it:
  1. (require 'haml-mode)
  2. (add-to-list 'auto-mode-alist '("\\.haml$" . haml-mode))
  3. (require 'sass-mode)
  4. (add-to-list 'auto-mode-alist '("\\.sass$" . sass-mode))
However As Mike Castleman points out: This requires manual intervention. So it is not the Debian Way! Reading Mike's bug report, and reading Thomas' article, made me realize I was dilluting something I held so dearly as to commit myself to the best Free Software-based distribution out there. And the solution, of course, was very simple: Debian allows us to be very lazy, not only as sysadmins, but as Debian packagers. Just drop this (simplified version) as $pkgroot/debian/haml-elisp.emacsen.startup and you are set!
  1. (let ((package-dir (concat "/usr/share/"
  2. (symbol-name flavor)
  3. "/site-lisp/haml-elisp")))
  4. ;; If package-dir does not exist, the haml-mode package must have
  5. ;; removed but not purged, and we should skip the setup.
  6. (when (file-directory-p package-dir)
  7. ;; Use debian-pkg-add-load-path-item per 9 of debian emacs subpolicy
  8. (debian-pkg-add-load-path-item package-dir )
  9. (autoload 'haml-mode "haml-mode"
  10. "Major mode for editing haml-mode files." t)
  11. (add-to-list 'auto-mode-alist '("\\.haml\\'" . haml-mode))
  12. ;; The same package provides HAML and SASS modes in the same
  13. ;; directory - So repeat only the last two instructions for sass
  14. (autoload 'sass-mode "sass-mode"
  15. "Major mode for editing sass-mode files." t)
  16. (add-to-list 'auto-mode-alist '("\\.sass\\'" . sass-mode))
  17. ))
This will make the package just work as soon as it is installed, with no manual intervention required from the user. And it does not, contrary to what I feared, bloat up Emacs Adding it to the auto-mode-alist leaves it as known to Emacs, but is not loaded or compiled unless it is required. Deepest thanks to both of you! (and of course, thanks also to Manoj, for pointing out at the right spells in emacs-land)
AttachmentSize
Thomas A. Limoncelli: Hey! I have to install and maintain this crap too, ya know! (Usenix's ;login: October 2009144.5 KB

20 May 2009

Martin F. Krafft: Sardines in Zurich's public transport

Yesterday was my first appearance as a sardine in Zurich s public transport vehicles, as part of a campaign by the Swiss group for sustainable mobility, umverkehR, which I support: Martin and Sandro as sardines at Z rich Stadelhofen We handed out flyers and answered questions, and the general reaction was very positive. The fact that we got covered in Switzerland s most popular newspaper, 20 Minuten will add greatly to the reconnaisance factor, so that in the months to come, us sardines will be immediately recognised, hopefully provoking thought and chat over the roots of the campaign. Most of us know the sardine as a dead fish perched into a can with many others in a way to minimise space. Human-sized, walking sardines are a great way to increase awareness of the issue of over-crowded public transport. It was fun to see even the Really Serious Newspaper Readers unable to suppress a smile. Talking to friends about the campaign, I ve often been met with expressions of how absurd such a campaign is in Switzerland, possibly the country with the best public transport system world-wide. I agree, but that doesn t mean that we should not keep working on further improving it. If you ve ever been stuck in a commuter train during rush-hour, standing around in stifling heat and jealously eyed those that managed to grab a seat before you, you ll probably agree that even in Switzerland, we could be doing it better. These days, with the financial crisis weighing heavy on everyone s budgets, and with environmental concerns on the rise, we are witnessing a never-before level of readiness of the public to make sustainable choices. Confronting those people with stuffed trains doesn t reconfirm those decision. Instead, it will make those people crave their air-conditioned cars and possibly switch back to polluting the air with exhaust and noise, because it surely is more comfortable to sit in your own cool car than it is to be perched in public transport like a sardine. Thus, umverkehR s message goes mainly to the politicians: prioritise public transport in your future mobility plans, keep the prices affordable, and help get people off the road in the interest of our environment. You can see more pictures in the gallery and a short film on Youtube. We have a separate sardine blog, a Facebook account and there s even a chance for you to win travel coupons: all you have to do is submit an original photo of anything to do with over-crowded public transport by e-mail or MMS to sardine t umverkehr.ch by October 2009. You can browse all submissions on Flickr. I hope that we can spread the idea as far as New Zealand and the countries between. There are always chances in any crisis. NP: Porcupine Tree: Stupid Dream

11 February 2009

Joachim Breitner: Openmoko User Meeting in Karlsruhe

About one hour ago we have finished the first Openmoko user meeting in Karlsruhe. Twelve FreeRunner (and Neo1973) owners have gatherd in the rooms of Entropia (the local CCC club), and discussed the various distributions, learned aboutt the FSO-alternative PyNeo, which was advocated by Josh, compared GPS applications and talked about various other projects and issues.
I collected some statistics about Distribution usage. Most common was SHR, with five users, followed by OM 2008.12 with three users. Single users had Debian, OM testing from pre 2008.12, PyNeo, EmDebian and OM 2008.9 installed. Only counting those who use their FreeRunner as their day-to-day phone, three are using SHR, one OM 2008.12 and one OM testing. I conclude that SHR seems to be a good choice if you want to have a working phone.Asked about their primary use case for the FreeRunner, almost all mentioned telephony and GPS. Half of the participants want to use it to browse the web, a little less think that games are important. Two people, who came from Stuttgart, see CellHunter as an important use caseConsidering that we filled three hours without running out of topics and the good feedback, we will likely have a sequel to this. A date has not been fixed yet, but will be discussed on the openmoko-community mailing list.BTW: I m still planning to package the SHR applications for Debian as soon as possible. Only one dependency (libetk) is missing, but according to Lutin from the pkg-e team, it s almost ready.

22 December 2008

Josselin Mouette: Dear friendly people,

during the ongoing avalanche of posts on Planet and on Debian mailing lists where you ask everyone to be friendly and considerate, you have so far: Pretty please. What you mean is Go fuck yourself , but the way you are saying it is no more friendly and actually much more rude. If you meant Go fuck yourself , why not just say it? You are just lying to yourselves if you think your contributions to a flamewar are more friendly than others. As for those starting discussions on the community and on the code of conduct: do you want a community like Ubuntu where everyone can be scornful and prepare lousy tricks, but always preserving the appearances (thanks to a mandatory broomstick), or a community like the Linux kernel, where people say frankly what they think, even if what they think is I hope you were on crack while writing that ? I know which one I choose. I may disagree with their technical development model, but at least they know that a software community is not a group of friends. And that is a sign of maturity.

31 October 2008

Gunnar Wolf: How (and how not) to create cyclist awareness

Michael blogs about Critical Mass.
What is Critical Mass in case you are too lazy to go to Michael's or to the Wikipedia? A cyclist-awareness movement, showing how bikers are safer (i.e. more visible) when there are more of them. The (dis)organizational nature of this movement (at least according to Wikipedia's information) seems quite fun and interesting.
However, I have to oppose what Michael says is a strong point of CM in Austria - At least, given my country's culture.
People who don't bike often say we have the least bike-aware culture, and that this city must be like hell to cyclists. It is not - Mexicans tend to believe this is the worst place possible on many accounts, and I'm happy to prove the contrary. I do feel that bringing people out to the streets, as our local government's Mu vete en bici program pushes, is completely right: It shows people how fast they can move in real streets in the city, taking away the fear of being run over by a bus, and people will gradually understand we can all excercise the right to use the streets without polluting, and gives us a better idea on how to behave with traffic (even if the traffic is made of fellow bikers) around us. I know this program works - At least, because it worked on me. Whenever possible, I go everywhere in this (not small or friendly by any measure) city by bike.
Anyway - What criticism do I have for Michael's post? That he states they:
Bicycling ludicrously slowly for a good hour, we managed to claim some fairly busy streets while many people tried to get home by car.
IMHO, what we should be doing is to demand the drivers to respect us, not to make them want to run us over. They should not be driven into hating bikers because of the chaos they generate - It is terrible to sit in a car for two hours when you usually take 30 minutes. There is simply no justification for that.
When I took part of the World Naked Bike Ride, some people wanted to take all four lanes of Reforma. Fortunately, reason prevailed, and we took only the lane we were assigned. And we should keep that in mind! Whenever possible, we should protest and make ourselves heard, but without interfering, without damaging, other people's lives!
Oh, by the way: If anybody in Mexico wants to have some nice hours of healthy fun: I am still pondering whether to join, as it is a huge effort, but I am very inclined to do so. Next week, November 9, we will go by bike from Mexico City's Z calo to Pachuca. We face 95Km and close to four hours. The road to Pachuca is basically flat, and going in a large group is a great experience. Hope to see you there!

22 June 2008

Cameron Dale: apt-p2p 0.1.5: IMPORTANT update to expunge bittorrent nodes

I have just uploaded an important update to apt-p2p that is highly recommended for all users. At some point over the last 48 hours bittorrent nodes have started to infiltrate the apt-p2p DHT (you may have noticed many ValueError tracebacks in your log file). The (mainline) bittorrent DHT is very similar in protocol to apt-p2p, and so the nodes are able to partially communicate and pollute each others routing table. I didn't think this would ever happen, as there wouldn't seem to be a reason for them to ever come into contact, but somehow it did. I've made some minor changes that exploit the differences between the two protocols to exclude bittorrent nodes from the apt-p2p routing table, and to drop any requests from bittorrent nodes (which should prevent apt-p2p nodes from polluting the bittorrent DHT). However, it is very important that all users upgrade to this new version to prevent any further mixing of the DHTs.

19 June 2008

Martin F. Krafft: IPv6 with Debian

Even though I ve dealt with IPv6 for almost a decade, have delivered presentations, and given multi-day courses on IPv6 security aspects, I ve never actually added IPv6 to my own server/home network infrastructure because it seemed that Linux and/or Debian just weren t ready for it. This seems to have changed (although there are still a number of problems) and in less than a day, I put a few of my machines online. In the following, I d like to share with you how I did it.

Kernel versions and stateful connection tracking Unfortunately, I have to start off with some bad news: even though Debian etch, our current stable release, which uses a Linux kernel version 2.6.18, speaks IPv6, I cannot recommend it for deployment, as the 2.6.18 kernel does not support proper stateful connection tracking for IPv6, and thus makes it impossible to firewall hosts in a sensible manner (I always add local packet filters to all my hosts, and if only to guard against the situation when a user installs a malicious programme to listen on a high port). Of course, it is possible to configure a packet filter statelessly in an acceptable manner once you know the use case, so do with this information what you wish; I prefer to stay general for now. For me, a remedy is almost around the corner: the 2.6.24 kernel seems to support stateful connection tracking for IPv6, and it s even available for etch as it will be included in the upcoming etch-and-a-half release. I simply ended up using the kernel packages pre-release, and so far have not had a problem with it. To do so, add the following line to your /etc/apt/sources.list, making sure to use a close archive mirror:
deb http://ftp.xx.debian.org/debian etch-proposed-updates main

I then just upgraded the system and pulled in all proposed updates. As that may have let in software that won t be part of etch-and-a-half, or even lenny, you may want to pin the archive and only upgrade the kernel packages, by adding to /etc/apt/preferences (replacing amd64 with your architecture):
Package: *
Pin: release a=proposed-updates
Pin-Priority: -1
Package: linux-image-2.6.24-etchnhalf.1-amd64
Pin: release a=proposed-updates
Pin-Priority: 600

Alternatively, you could use the 2.6.24 linux kernel packages on backports.org.

Xen and IPv6 One drawback of switching to 2.6.24 is that you cannot run a dom0 on that machine any longer, so by practical extension, you cannot connect it to the IPv6 network with a packet filter in place. Supposedly, running 2.6.24 instances on a 2.6.18 dom0 is reported to work, however.

Configuring the packet filter The first thing I did was to configure the packet filter on each host appropriately. Unfortunately, this is harder than it should be, because to quote one of the netfilter developers when ip6tables was conceived, someone had a big bad brainfart : rather than adding IPv6 rules to your existing iptables ruleset, you have to create a new ruleset, duplicate all chains, networks, hosts, and individual rules, and maintain the two in parallel. Even though there are efforts of unification on the way, I speculate it ll take another couple of years until PF_INET6 will be fused into PF_INET and one will be able to do sensible cross-address-family packet filtering with Linux. Since I ve recently started to look (again) at pyroman, maybe the most logical way forward would be to extend it to write both, IPv4 and IPv6 rulesets from its knowledge about the hosts and networks you configured. Anyway, we want to get stuff working now! Thus, let s configure ourselves a packet filter. (Almost) all IPv6-related filtering must be configured via ip6tables (read on further down about IPv6 in IPv4 tunneling, the reason I said almost ). The following is a simple default ruleset to start with, which I put into /etc/network/ip6tables to load with ip6tables-restore:
*filter
:INPUT REJECT [0:0]
:FORWARD REJECT [0:0]
:OUTPUT ACCEPT [0:0]
:in-new - [0:0]
### INPUT chain
# allow all loopback traffic
-A INPUT -i lo -j ACCEPT
# RT0 processing is disabled since 2.6.20.9
#-A INPUT -m rt --rt-type 0 -j REJECT
# allow all ICMP traffic
-A INPUT -p icmpv6 -j ACCEPT
# packets belonging to an establish connection or related to one can pass
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# packets that are out-of-sequence are silently dropped
-A INPUT -m state --state INVALID -j DROP
# new connections unknown to the kernel are handled in a separate chain
-A INPUT -m state --state NEW -j in-new
# pass SYN packets for SSH
-A in-new -p tcp -m tcp --dport 22 --syn -j ACCEPT
# log everything else
-A INPUT -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[INPUT6]: "
### OUTPUT chain
# RT0 processing is disabled since 2.6.20.9
#-A OUTPUT -m rt --rt-type 0 -j REJECT
# allow outgoing traffic, explicitly (despite chain policy)
-A OUTPUT -j ACCEPT
### FORWARD chain
# RT0 processing is disabled since 2.6.20.9
#-A FORWARD -m rt --rt-type 0 -j REJECT
# disallow forwarded traffic, explicitly (despite chain policy)
-A FORWARD -j REJECT
COMMIT

Note that this recipe is pretty much unusable on pre-2.6.20 kernels due to their broken implementation of stateful connection tracking. The ruleset should be fairly obvious, but you might wonder about my use of REJECT and allowing all ICMP after all, you ve heard for the past 30 years that ICMP is a bad hacker protocol , and Internet security is no domain for being nice to people, so to prevent any information disclosure, you should DROP connections, not let people know that they re simply not allowed. Well, to hell with all that! I don t see a single reason or attack vector that is foiled by DROP or disallowing ICMP. In fact, it s just security by obscurity, and might inconvenient at the same time. ICMP is also much more important with IPv6 than with IPv4 (it replaces ARP, for instance), and it s actually useful to be able to ping hosts, or get back informational messages on why something failed. Finally, rejecting traffic rather than dropping it doesn t suggest to a hacker that something s hidden here. Then there is RFC 4890, which almost made me puke. This document is part of the reason why I say: let s fix problems in the kernel, rather than shielding them with unreadable and unmanageable rulesets!

Getting connected If you already have an IPv6 address, you re basically ready to go, but may want to read further down on how to connect your local network to the IPv6 Internet as well. If you are searching for a provider, have a look at the list of providers with native IPv6 connectivity over at sixxs.net. If you are reading up to here, I assume you are connected to the Net with IPv4. There are two ways for you to move towards IPv6: 6to4 or by way of a tunnel provider. A Kiwi website explains how to setting up 6to4 connectivity, and thus I will concentrate only on the tunnel approach. Even though everyone can set up 6to4 in a breeze without any accounts or waiting, there are a number of security considerations, it s pretty ugly to debug (due in part to asymmetric routing), and makes your life unnecessarily difficult when all you have is a dynamic IP that changes from time to time. If you are stuck behind a NAT gateway, you cannot use 6to4 either. Thus, I prefer the tunnel approach. With the tunnel approach, IPv6 packets are wrapped up in IPv4 packets on your host, and sent to the IPv4 address of your tunnel provider, who has native IPv6 connectivity. The tunnel provider unwraps your packet and shoves the contained IPv6 packet onto the backbone. The IPv6 address you used as source address is routed to the tunnel provider, so any replies arrive at their machines, where they re again wrapped into IPv4 packets and sent to your (publicly-accessible) IPv4 address. Those IPv4 packets specify payload type 41 ( ipv6 ), which is why we need those -p ipv6 -j ACCEPT rules in the iptables ruleset. There are a few tunnel providers out there. I chose SixXS and have not regretted my choice. I shall thus assume that you do the same: sign up for an account right now, so that you have it by the time you finished reading this document! SixXS works on a credit system: tunnels and subnets cost credits, which you can accumulate by maintaining your tunnels properly. This ensures that everyone can play around, but to do more advanced stuff, you need to first display competence with the basic concepts. Your first step with SixXS will be to request a tunnel. SixXS offers three types of tunnels:
  • static tunnels, for those with static IPs,
  • heartbeat tunnels, for those with dynamic IPs, and
  • AYIYA tunnels, for those behind NAT gateways.
Each of these tunnels have advantages and disadvantages, as everything does: the first two types of tunnels use IP protocol 41 packets to encapsulate the IPv6 packets. As such, there are security considerations involving the impersonation by spoofing, and all upstream firewalls must let protocol 41 pass. AYIYA addresses these problems by using signed packets, but that solution comes with extra computation overhead and smaller MTUs. I suggest to use the first type of tunnel that fits your situation. Debian s aiccu package can take care of heartbeat and AYIYA tunnels for you, and it can even set up static ones. During registration, you will also need to choose a PoP , which stands for Point of Presence . If your country only has a single PoP, that s the one you will end up using (unless you have a good reason for another one), but if there are more options, I strongly suggest that you go through the list of PoPs and select the one with the best roundtrip time and lowest latency from your location! Note that you must answer ping requests (ICMP echo-request) from the PoP you chose, or else the tunnel will not be created. Once your tunnel request gets approved, you ll get a /64 prefix, in which you only use two addresses: the PoP will configure the :1 address and you need to configure your host to use the :2 address on the tunnel interface. You ll also be told the IPv4 address of your PoP endpoint . Joey Hess taught me that aiccu can set up the interface for you, using the data it queries from the SixXS registration (TIC) server. I tried it, and it works. However, I prefer the pure ifupdown approach, as it makes things explicit and allows me to use the hooks for stuff like loading the packet filter. So in my /etc/network/interfaces, you can find:
auto sixxs
iface sixxs inet6 v4tunnel
  endpoint 194.1.163.40
  address 2001:41e0:ff00:3b::2
  netmask 64
  gateway 2001:41e0:ff00:3b::1
  ttl 64
  pre-up ip6tables-restore < /etc/network/ip6tables
  up ip link set mtu 1480 dev $IFACE
  up invoke-rc.d aiccu start
  down invoke-rc.d aiccu stop

Make sure to read about MTU values of the tunnel and adjust the 1480 value in the above to your tunnel settings and ISP connectivity. Also set ipv6_interface sixxs in /etc/aiccu.conf, if you are using aiccu, or else aiccu will bring up a duplicate/additional interface. If you tell it to use the same interface, it will actually execute all the same commands (which will fail), but won t report any errors. A future version will have a switch to prevent it from configuring the interface. Unfortunately, this will probably not work. The reason is that your regular IP packet filter (iptables, without the 6) doesn t let those encapsulating IPv4 packets pass, unless we tell it to; we probably want to do this early on in the chain, and also limit it to our tunnel peer, so:
iptables -I INPUT -p ipv6 -s 194.1.163.40/32 -j ACCEPT

For AYIYA, you need to open port 5072, either for UDP, TCP, or SCTP, depending on how you configured it. Also have a look at this FAQ entry on what a firewall needs to pass. If it still doesn t work, you have an upstream packet filter that needs some of those holes poked. Good luck. In most situations, the FORWARD chain does not get such a rule, since the tunnel terminates at the gateway, which routes to a native IPv6 network, or another tunnel. Allowing tunnels through a gateway is almost always a bad thing, as it would allow undetected and untraceable traffic from compromised boxes in the local network. The OUTPUT chain also does not need such a rule, if you have configured stateful filtering properly. Now bring up the interface and verify the connection:
# ifup sixxs
# ping6 -nc1 2001:41e0:ff00:3b::1
PING 2001:41e0:ff00:3b::1(2001:41e0:ff00:3b::1) 56 data bytes
64 bytes from 2001:41e0:ff00:3b::1: icmp_seq=1 ttl=64 time=74.0 ms
[...]
# ping6 -nc1 ipv6.aerasec.de
PING ipv6.aerasec.de(2001:a60:9002:1::184:1) 56 data bytes
64 bytes from 2001:a60:9002:1::184:1: icmp_seq=1 ttl=55 time=91.5 ms
[...]

Welcome to the Internet of the future!

Setting up an IPv6-capable gateway Your IPv6 connection works, but it s limited to a single address, and you do not get to specify the reverse DNS PTR record for it. Since the concept of NAT is mostly absent from IPv6 (thanks! thanks! thanks!), you will not be able to connect any other hosts to the IPv6 network. If your local network has a few hosts behind a gateway, you will need to request a subnet from SixXS and configure your gateway (which has the tunnel connection) appropriately. Don t worry, this is not really very difficult. First, request a subnet for your tunnel from your PoP via your SixXS homepage. Once approved, you will get a /48 prefix for your own use: 2^80 1.2 heptillion addresses which are yours to assign to every dust particle in your office or home, if you so desire. The way I set it up is to add the first of these addresses to your internal interface on the gateway, by adding the following two lines to the interface s stanza in /etc/network/interfaces; you will need the iproute package installed (which you should be using for everything network-related anyway):
up ip -6 addr add 2001:41e0:ff12::1/64 dev $IFACE
down ip -6 addr del 2001:41e0:ff12::1/64 dev $IFACE

Instead of bringing the interface down and up, just run ip -6 addr add 2001:41e0:ff12::1/64 dev eth0. Note the use of the /64 prefix instead of the /48 that got assigned, leaving only 20 pentillion addresses. Oh no! The reason for this is buried in the specs: basically, /48 is a site prefix, but individual networks should not be larger than /64, which is the prefix length of links in the IPv6 domain. Now is also a good time to enable IPv6 forwarding, e.g. like so:
# echo net.ipv6.conf.all.forwarding = 1 >> /etc/sysctl.conf
# sysctl -p /etc/sysctl.conf

Obviously, you will also need to change the policy on the ip6tables FORWARD chain. For now, let s just set it to accept. You should later create a proper ruleset, though!
# ip6tables -I FORWARD -j ACCEPT

Bringing IPv6 to your local network The final step is to spread the love to your local network. Refrain from selecting addresses from your subnet and assigning them to the local hosts, or wondering how to configure the DHCP server, because IPv6 does it differently: your gateway will advertise its routes (which includes a default route) to your network, and each host will pick an address based on its MAC address (unless it already has an EUI-64 address assigned. This all happens automagically, at least with current Debian and Windows machines. On the gateway, you need to install radvd and simply tell it which prefix to use on which interface. My /etc/radvd looks like this, and I won t explain it:
interface eth0
 
  AdvSendAdvert on;
  prefix 2001:41e0:ff12::/64
   
   ;
 ;

Note again how we advertise a /64 network rather than the /48 we own . You cannot advertise smaller networks if you want automatic configuration to work, and you should not use networks larger than /64 in any case. If 2^64 addresses are not enough for you, I trust you ll be able to figure out how to advertise another of your 65536 /64 prefixes in the /48 subnet to appropriate hosts. Restart radvd and run over to another host to witness how it automagically gets connected to the IPv6 network by scanning /var/log/kern.log and watching the output of ip -6 addr and ip -6 route. Try ping6ing from there! Find the dancing turtle! It should all work. If you don t like the automagic aspect of this, look into stateful configuration, using DHCPv6, as provided by dibbler-server and ?wide-dhcpv6-server.

Resolving names Take note of the IPv6 address of each host. There s a way to determine it given the host s MAC address, but this is easier (ipv6calc is also useful). You might want to let your local DNS server know by adding AAAA records in parallel to the existing A records, and possibly even adding PTR entries. If you re serious about IPv6, you can tell SixXS to delegate reverse lookups for the IPv6 addresses to your DNS servers, but you ought to refrain from polluting the DNS namespace. Note that bind9-host provides an improved host tool, which fetches all kinds of information about names, not just the one single information configured as default:
% host pulse.madduck.net
pulse.madduck.net has address 130.60.75.74
pulse.madduck.net has IPv6 address 2001:41e0:ff1a::1
pulse.madduck.net mail is handled by 99 b.mx.madduck.net.
pulse.madduck.net mail is handled by 10 a.mx.madduck.net.
% host 2001:41e0:ff1a::1
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.a.1.f.f.0.e.1.4.1.0.0.2.ip6.arpa
domain name pointer pulse.madduck.net.

Oh, and if you re really that curious about how IPv6 addresses are computed from MAC addresses, read RFC 2464. Basically, given a prefix 2001:41e0:ff1a:: and a MAC address aa:bb:cc:dd:ee:ff, the resulting IPv6 address is obtained by:
  1. inserting ff:fe into the middle of the MAC address to yield aa:bb:cc:ff:fe:dd:ee:ff;
  2. flipping the second lowest bit of the first octet to yield a8:bb:cc:ff:fe:dd:ee:ff;
  3. removing the odd colons to yield a8bb:ccff:fedd:eeff, the EUI-64;
  4. concatenating the prefix and this result to get 2001:41e0:ff1a::a8bb:ccff:fedd:eeff.
If you find your (Windows) IPv6 addresses changing all the time, you might be faced by privacy features .

Remaining issues Even though my IPv6 connectivity works, I have two remaining issues.

Sending larger amounts of data to the network I am experiencing a curious issue where outgoing ssh IPv6 connections time out and outgoing data transfers hiccup. I have yet to find out what s going on.

Mapping names to laptops Laptops generally have two interfaces, one with a cable, and the other wireless. Both of these interfaces will have separate MAC addresses, and by extension, the laptop will have different IPv6 addresses depending on how it is connected to the local network. I want to be able to connect to laptops without knowing the medium they use to connect to the network. Unfortunately, there seems to be no feasible way. The solutions I see are:
  • override the MAC address of one interface with that of the other, which is going to cause bgi problems in the case when the laptop (accidentally) gets connected to the same network twice;
  • add both IPv6 addresses as AAAA records to the laptop s DNS name, which will cause random delays when connecting as the resolver may return the currently inactive address first;
  • set up mobile IPv6, e.g. by following this Mobile IPv6 how-to, which would allow accessing the laptop uniformly, no matter where in the world it is. Unfortunately, Debian s support for Mobile IPv6 is severly lacking at time of writing. Also, Yves-Alexis Perez notes that this how-to is horribly outdated and promised to tend to it Real Soon Now .
The second solution works for me for now, but I am interested in the third. In response to this document, Andreas Henriksson has suggested the replace the stateless configuration (radvd) with stateful configuration, using DHCPv6. I have yet to investigate this option. Jeroen Massar suggests to unite cable and wireless into a bridged interface, which seems like a very good idea.

Credits Thanks to Bernhard Schmidt, William Boughton, and Jeroen Massar, and everyone on #ipv6/irc.freenode.org for their help over the past few weeks, and all those who fed back comments in response to this document!

17 May 2008

Uwe Hermann: Green energy from Lichtblick getting... cheaper!

You might remember that I wrote a blog entry about my switch to the green electric utility "Lichblick" (Germany) a while ago. I did that purely out of environmental reasons, I didn't want to continue to waste money on polluting and/or dangerous crap such as fossil or nuclear power. Yes, even if that meant a slightly higher price (but I really didn't compare prices much before switching — I was after an environmentally clean solution, not the cheapest solution). Quick status update: the switch went really nice and easy, no downtimes, no hassle. I've been a happy customer for more than 8 months now. Today in my snail mail inbox: a letter from Lichtblick that they're going to reduce the price per kWh from 20.25 to 19.99 (Euro) cents starting July 1st and they give you a guarantee that there won't be any price raises before the end of 2009 (more details also here). Now, that's a positive surprise there. Compare that to 98% of all other energy providers in Germany who have lately increased prices quite a lot for very obscure or non-existant reasons. Yes, I do realize that the reduced costs are not that dramatic, and Lichtblick is using this as a means to impress people and gain new customers. But I fully support them in doing so, the more people are switching to a green energy provider the better, if you ask me. I encourage everyone to consider switching, either to Lichtblick, or some of their competitors (in Germany) e.g. Greenpeace energy, Elektrizit tswerke Sch nau, or Naturstrom AG. There are various alternatives in other countries too, of course.

13 April 2008

Clint Adams: The Legend of Bagger Baggs

One day the Stranger arrived. He was a tall and lanky teen, his face peppered with acne and sparse pubescent hair. He wore a wide-brimmed hat, a long coat, a scarf, and he was Strange. Some newcomers prefer to observe, to gauge the breadth and nuance of Social Custom, and to keep low profiles until they are comfortable enough to risk a misstep. This newcomer preferred to wield a bean bag, and to go door to door, knocking, introducing himself, and asking if there might be any nice conversation lurking inside in which he might join. Predictably, most people were horrified, frightened, and offended. They responded in a hostile fashion, and branded him Bean Bag Boy, or Bag Boy for short. A few others viewed him instead as a free spirit, a visionary, a unique character, and a Cool Guy. Perhaps they bought into the crap that society spews forth as part of its Campaign for Cognitive Dissonance. Perhaps they were just confused. Those that admired him branded him Doctor Who, a moniker of affection and respect. I will never understand this, even though I know which drugs they were on (Prozac, Zoloft, LSD, THC, psylocybin, and PCP, respectively). Bag Boy learned to keep mostly to those who appreciated his insane ramblings. Had he been motivated and competent, he probably could have been a minor cult leader. Instead, he fell out of public view for a while. When he returned, he had two younger companions: a boy and a girl. It became immediately obvious what to call them. The female, whose name, eerily enough, was Baggs, would be Bag Girl. Since Bag Boy already possessed that name, the male would have to be Little Bag. Little Bag was an enigma unto himself, and went on to have many adventures of his own. Once he called me a Zenmaster, so I will refrain from mentioning him for a long time. Bag Girl was no less a character. She detested being called by either her given name or her surname, and instead preferred to brandish an agglutinative designation of her own choosing: one part temporal adjective, one part finite act of performance. This contrasted delightfully with her appearance, which was not dissimilar to a three-foot-tall chinchilla. Most were content to call her by her chosen appellation, though some would add her real surname (to which she fumed bitterly), and one insisted on calling her by her given name, as a hostile act of hatred. Bag Girl's main hobby was a menagerie of characters that she explained were her multiple personalities. Unlike persons suffering from dissociative identity disorder, Bag Girl had full knowledge of her personalities and their doings. One of these personalities was a 90-year-old elf named Galiganda Dulin. Another was a man named Sayjon, who bore a suspicious resemblance to Pink Floyd's fascist alter ego from The Wall. In fact, Bag Girl had been profoundly affected by The Wall, although she had watched it while on LSD, so interpolation based on these data may be tainted.

8 March 2008

Clint Adams: The Legend of Bagger Baggs

One day the Stranger arrived. He was a tall and lanky teen, his face peppered with acne and sparse pubescent hair. He wore a wide-brimmed hat, a long coat, a scarf, and he was Strange. Some newcomers prefer to observe, to gauge the breadth and nuance of Social Custom, and to keep low profiles until they are comfortable enough to risk a misstep. This newcomer preferred to wield a bean bag, and to go door to door, knocking, introducing himself, and asking if there might be any nice conversation lurking inside in which he might join. Predictably, most people were horrified, frightened, and offended. They responded in a hostile fashion, and branded him Bean Bag Boy, or Bag Boy for short. A few others viewed him instead as a free spirit, a visionary, a unique character, and a Cool Guy. Perhaps they bought into the crap that society spews forth as part of its Campaign for Cognitive Dissonance. Perhaps they were just confused. Those that admired him branded him Doctor Who, a moniker of affection and respect. I will never understand this, even though I know which drugs they were on (Prozac, Zoloft, LSD, THC, psylocybin, and PCP, respectively). Bag Boy learned to keep mostly to those who appreciated his insane ramblings. Had he been motivated and competent, he probably could have been a minor cult leader. Instead, he fell out of public view for a while. When he returned, he had two younger companions: a boy and a girl. It became immediately obvious what to call them. The female, whose name, eerily enough, was Baggs, would be Bag Girl. Since Bag Boy already possessed that name, the male would have to be Little Bag. Little Bag was an enigma unto himself, and went on to have many adventures of his own. Once he called me a Zenmaster, so I will refrain from mentioning him for a long time. Bag Girl was no less a character. She detested being called by either her given name or her surname, and instead preferred to brandish an agglutinative designation of her own choosing: one part temporal adjective, one part finite act of performance. This contrasted delightfully with her appearance, which was not dissimilar to a three-foot-tall chinchilla. Most were content to call her by her chosen appellation, though some would add her real surname (to which she fumed bitterly), and one insisted on calling her by her given name, as a hostile act of hatred. Bag Girl's main hobby was a menagerie of characters that she explained were her multiple personalities. Unlike persons suffering from dissociative identity disorder, Bag Girl had full knowledge of her personalities and their doings. One of these personalities was a 90-year-old elf named Galiganda Dulin. Another was a man named Sayjon, who bore a suspicious resemblance to Pink Floyd's fascist alter ego from The Wall. In fact, Bag Girl had been profoundly affected by The Wall, although she had watched it while on LSD, so interpolation based on these data may be tainted.

Next.

Previous.