B345BDD3 A40F862E

Yay! Debian is in the Google Summer of Code!
We've had a suggestion today for a GUI that makes Debian packages. Here's my mock up:

If you have any better ideas, please submit them at http://wiki.debian.org/SummerOfCode2009.

As requested at FOSDEM, please find below the new shiny design for lenny t-shirts.
Thanks to Ben Hutchings for the inspiration.

This should act as a reminder to anyone who gets accomodation with the Debian UK lot that I need to know by the 14th if you want somewhere to stay. Wiki page is advertised in the usual places, or catch me on IRC if you've forgotton!

I'm currently sat in the formal dinner for DebConf8 in Argentina. As part of the presentations, our glorious leader, the forever DPL Sledge announced that we'd recently won an award for... wait for it... MOST EPIC FAIL!

In recognition of this, I present to you the following:

I'm currently sat at the Debian stand at LRL08 with Wolverhampton, and have finally got around to signing up and becoming a supporter of the Open Rights Group, paying them £10 per month (although you can pay less). It's been something I've been meaning to do for a while, but haven't got around to it.

For those who haven't heard of ORG, they protect 'digital rights', and actually make a difference. Go sign up if you haven't already.

For info, as I've been asked by a couple of people, I've been elected as a city councillor for King's Hedges in Cambridge

Full results:

Candidate	Votes
Neil McGovern (Liberal Democrat)	762
Geri Bird (Labour)	560
Cyril Weinman (Conservative)	419
James Youd (Green)	129

This gave me a majority of 198, a massive improvement of last year's majority of just 18. Huge thank you to everyone who supported me and helped during the campaign period, I'm really grateful.

In follow-up to my previous post, in which the phrase "google for gerri bird cambridge" (which turned up a rather poor lack of reply to a survey) was printed on some campain leaflets, I've come across a slightly different example of how traditional PR ideas may not work online if the people who are doing it don't understand the technology.

The Cambridgeshire County Council have placed on their transport page a link inviting people to view some videos of their new mis^WGuided Busway on YouTube. They've even gone so far as to create a YouTube account for the purpose. Unfortunately, the comments on their first video aren't too favourable, with the vast majority of people hating the idea. Not content with this, a second video was also posted, with exactly the same effect. In retaliation, it seems that their PR department has tried to fake some good reviews, but have been caught out.

So, some simple lessons:

1. Don't trust user generated content to do your job for you
2. Don't trust sites you have little control over
3. Don't try and stuff the ballot by writing like a PR person

For those that don't know, I'm running for local government as the Liberal Democrat candidate for King's Hedges City Councillor in Cambridge.
Part of this involves seeing what the other parties do. I had a leaflet come through the door for the potential Labour candidate, Gerri Bird. It contained the usual bumpf, and a suggestion at the end; "google for gerri bird cambridge".
This could present a problem for Gerri. You're not asking someone to go to a site, where the information you have is constant and of a known quality. In this case, Gerri not replying to a survey from the local cycling organisation is the top hit on Google. As these leaflets are already out in the wild, the instructions can't be changed.

Something to be careful of.

As some people may know, I'm a member of the Debian testing security team. As well as tracking all CVE IDs with which packages they affect, we also keep a list of known embedded code copies. Embedded code copies are a bad thing, as they cause no end of problems for the security teams.

One of the problems we've had to find a solution for is: How do we know what statically compiles against a library, or even worse, ships it's own copy?
So, we're looking for something that looks a particular set of bytes in arbitary executeables; a signature of the library if you will. And we do have a rather good tool that can be used to scanning for binary signatures: clamav :)

Step 1Create a clamav signature Clamav have a nice guide on how to create signatures on their site. The method I use is fairly simple: find a unique binary string and pass it to sigtool --hex-dump and place it in a nbd file. Step 2Scan the archive

for I in  find /mirror/debian/pool/ -name *all.deb ; do 
	clamscan -i -d smarty.ndb --deb --tempdir=/home/maulkin --no-summary \
	--max-space=1024m --stdout $I >> /home/maulkin/smarty.log; 
done;

Step 3??? Step 4PROFIT!!!

While I'm talking about testing security, we're all rather busy at the moment in the team, so we could do with some help! If you fancy helping, have a quick read of the intro and come onto #debian-security on irc.debian.org and say hi!

Sweden	UK
Victory for topless bathers Court gives thumbs up to anal massage technique Postcard arrives 25 years late Swedish prostitution: gone or just hidden? Ninety pythons left to die in Swedish cottage	Parted-at-birth twins 'married' Pound at record low against euro Vomiting bug 'hits three million' Mr Potato Head makes octopus pal Ngugi laments Kenya violence

An interesting discussion appeared on #debian on OFTC regarding TOR. One person was of the view that "many intelligence and other agencies are probably heavily involved in tor". As the discussion continued (yes, I should have pointed out it was OT for the channel...) it appeared that privicy and anonymity were getting confused.

Now, I'm not a huge TOR fan (being an oper on OFTC), but I seriously doubt that government agencies are 'heavily involved'. I was pointed at an article to back this claim up, but the article doesn't. Instead, it (and the original claim) raises a couple of interesting issues.

Firstly, there is a difference between privacy and anonymity, although closely related. Privacy allows you to keep information about yourself secret, and anonymity allows you to keep you yourself secret. In the case linked, although the people browsing were anonymous, and maintained privacy, this was broken when they revealed information about themselves. Breaking this privacy broke their anonymity. TOR doesn't even grantee complete anonymity:

Tor can't solve all anonymity problems. It focuses only on protecting the transport of data. You need to use protocol-specific support software if you don't want the sites you visit to see your identifying information. For example, you can use web proxies such as Privoxy while web browsing to block cookies and withhold information about your browser type. Also, to protect your anonymity, be smart. Don't provide your name or other revealing information in web forms.

[http://www.torproject.org/overview.html.en]

Used properly, TOR can be a very powerful tool to help, but certainly isn't a silver bullet. It needs to be used properly to prevent your identity being known (anonymity). However, without privacy, this is nothing.
Even without these safeguards, it would require significant resources (and may not be possible) to reliably retrieve useful information about one particular person. This leads to the Greater Internet Fuckwad Theory, which is the main issue I have with TOR, but that's a different post.

So, the question is: do you want privacy or anonymity when using the internet? You need to know what you want before you use a tool, as nothing can beat user education on how to keep your browsing details out of the 'wrong hands'.

So they say.
So, yes, lets wait, even if that means waiting with the trembling heart of the foreigner in Juan Jos Arreola's "El Guardagujas". Sometimes, the wait will be only eight minutes long - who knows? Sometimes, the wait will last for months, even a lifetime - be ready, stay at the nearby hotel, and be ready to rush out once the moment comes.
What cannot ever be guaranteed, though, is what happens after the train has arrived - Whether it will travel according to your personal (and extremely na ve) plans, or it will take you to a whole different life you never envisioned before. So... Well, I'm waiting for my train to R. We shall in due time see about it

Providing a lot of information in a bug report is useful. It helps the developer work out what's wrong. However, you should be careful not to reveal too much information as one submitter did to Gnome in their bug report. Have a look (if you're not in work) at the .xsession-errors at the end of their report to see what movies they were playing.

Update: mind you, at least they were vaguely covert, compared to the brutal honesty of this report. Thanks to Florent Bayle for that link.