I must admit that I ve never been a big fan of the dash as /bin/sh change. I have three main problems with the switch: POSIX compliance as an argument Complying to standards is a really good thing. But when everybody is ignoring the standard because they want the comfort of newer features, maybe it s a sign that the standard should be updated to include those newer features. Most of the bashims used everywhere in scripts were signifiant improvements, like the ability to write:
cp short1/path1,short2/path2 /very/long/common/path/to/a/file
instead of:
cp short1/path1/very/long/common/path/to/a/file short2/path2/very/long/common/path/to/a/file The option to improve bash was not fully explored We started with the premise that bash is bloated, slow, and cannot be improved. Maybe you can help me with that, but I could only find a few simplistic benchmarks comparing dash and bash, and I could not find any analysis of why bash is slow, and why it cannot be improved.
One of the obvious problems is that bash is also an interactive shell, and is linked to ncurses and terminfo, which increases the startup time. But have we investigated the possibility to have a /bin/bash-non-interactive binary that would not be linked to ncurses? The change was brought to users While it is OK for Debian (or Ubuntu, in that case, since that change was done in Ubuntu first) to force its developers to use POSIX-compliant scripts, the switch could have been made only to Debian-created scripts (by switching them from a /bin/sh shebang to a /bin/dash shebang, for example). I have trouble justifying that this change was forced on users as well. Next: linker changes and we are doing it again. A set of linker changes (see also the Ubuntu page) was already done in Ubuntu, and is very likely to be done in Debian as well. This switch requires deep changes in some buildsystems (it requires ordering of libraries and forbids indirect dependencies), and is rather painful (it was reverted before the Ubuntu 11.04 release because it was not possible to fix all the packages during the natty release cycle, but is done in the 11.10 release). Of course, there are justifications for this change. But I m not sure that it s worth all the trouble created for users.

This is my monthly summary of my Debian related activities. If you re among the people who made a donation to support my work (170 , thanks everybody!), then you can learn how I spent your money. Otherwise it s just an interesting status update on my various projects. This month passed by very quickly since I attended both the Libre Software Meeting / RMLL and the DebConf. Libre Software Meeting / RMLL I attended only 3 days out of the 6 but that was a deliberate choice since I was also attending DebConf for a full week later in the month. During those 3 days I helped with the Debian booth that was already well taken care of by Fr d ric Perrenot and Arnaud Gambonnet. Unfortunately we did not have any goodies to sell. We (as in Debian France) should do better in this regard next time. One of the talks I attended presented EnVenteLibre. This website started as an online shop for two French associations (Ubuntu-fr, Framasoft). They externalize all the logistic to a company and only have to care about ordering goodies and delivering to the warehouse of the logistic company. They can also take some goodies from the warehouse and ship them for a conference, etc. We discussed a bit to see how Debian France could join, they are even ready to study what can be done to operate at the international level (that would be interesting for Debian with all the local associations that we have throughout the world). Back to the LSM, while I had 3 good days in Strasbourg, it seems to mee that the event is slowly fading out it s far from being an international event and the number of talks doesn t make for a better quality. BTW, do you remember that Debconf 0 and Debconf 1 were associated to this event while it was in Bordeaux? dpkg-source improvements During my time in Strasbourg (and in particular the travel to go there and back!) I implemented some changes to 3.0 (quilt) source format. It will now fail to build the source package if there are upstream changes that are not properly recorded in a quilt patch:

dpkg-source: info: local changes detected, the modified files are:
 2ping-1.1/README
dpkg-source: info: you can integrate the local changes with dpkg-source --commit
dpkg-source: error: aborting due to unexpected upstream changes, see /tmp/2ping_1.1-1.diff.cki8YB

As the error message hints, there s a new --commit command supported by dpkg-source that will generate the required quilt patch to fix this. In the processe you will have to submit a name and edit the patch header (pre-formatted with DEP3 compatible fields). You can get back the old behavior with the --auto-commit option. Build flags changes Ever since we adopted the Ubuntu changes to let dpkg-buildpackage set some build related environment variables (see #465282), many Debian people expressed their concerns with this approach both because it broke some packages and because those variables are not set if you execute debian/rules directly. In the end, the change was not quickly reverted and we fixed the package that this change broke. Despite this we later decided that the correct approach to inject build flags would be a new interface: dpkg-buildflags. Before changing dpkg-buildpackage to no longer set the compilation flags, I wanted to ensure dpkg-buildflags had some decent coverage in the archive (to avoid breaking too many packages again). My criteria was that CDBS and dh (of debhelper) should be using it. With the recent debhelper change (see #544844) this has been reached so I changed dpkg-buildpackage accordingly. Makefile snippets provided by dpkg At the same time, I also wanted an easy way for maintainers not using dh or CDBS to be able to fix their package easily and go back to injecting the compilation flags in the environment but doing it from the rules files. Starting with the next version of dpkg, this will be possible with something like this:

DPKG_EXPORT_BUILDFLAGS = 1
include /usr/share/dpkg/default.mk

Without DPKG_EXPORT_BUILDFLAGS the variables are not exported in the environment and have no effect unless you use them somewhere. More than build flags, this will also provide a bunch of other variables that can be useful in a rules files: all the variables provided by dpkg-architecture, vendor related variables/macro and some basic package information (mainly version related). dpkg-buildflags improvements Given the renewed importance that dpkg-buildflags will take now that dpkg-buildpackage no longer sets the corresponding environment variables, I thought that I could give it some love by fixing all the open issues and implementing some suggestions I got. I also had a chat with a few members of the technical committee to discuss how hardening build flags could be enabled in Debian and this also resulted in a few ideas of improvements. In the end, here are the main changes implemented:

• new prepend directive to inject flags at the start (see commit);
• new strip directive to strip flags from the result returned by dpkg-buildflags (see commit);
• new environment variables DEB_flag_MAINT_directive that can be set by the maintainer to adjust what dpkg-buildflags will return (see commit);
• new --export=configure command to inject build flags on the ./configure command line (see commit);
• new --dump command that is the default (see #603435).

Will all those changes, the complete set of compilation flags can be returned by dpkg-buildflags (before it would only return the default flags and it was expected that the Debian packaging would add whatever else is required afterwards). Now the maintainer just has to use the new environment variables to ensure the returned values correspond to what the package needs. DebConf: rolling and hardening build flags I spent a full week in DebConf (from Sunday 24th to Sunday 31th) and as usual, it s been a pleasure to meet again all my Debian friends. It s always difficult to find a good balance between attending talks, working in the hacklab and socializing but I m pretty happy with the result. I did not have any goal when I arrived, except managing the Rolling Bof (slides and video here) but all the discussions during talks always lead to a growing TODO list. This year was no exception. The technical committee BoF resulted in some discussions of some of the pending issues, in particular one that interests me: how to enable hardening build flags in Debian (see #552688). We scheduled another discussion on the topic for Tuesday and the outcome is that dpkg-buildflags is the proper interface to inject hardening build flags provided that it offers a mean to drop unwanted flags and a practical way to inject them in the ./configure command line. Given this I got to work and implemented those new features and worked with Kees Cook to prepare a patch that enables the hardening build flags by default. It s not ready to be merged but it s working already (see my last update in the bug log). A few words about the Rolling BoF too. The room was pretty crowded: as usual the topic generates lots of interest. My goal with the BoF was very limited, I wanted to weigh the importance of the various opinions expressed in the last gigantic discussion on debian-devel. It turns out a vast majority of attendants believe that testing is already usable. But when you ask them if we must advertise it more, answers are relatively mixed. When asked if we can sustain lots of testing/rolling users, few people feel qualified to reply but those that do tend to say yes. More dpkg work Lots of small things done:

• I did again some bug triaging on Launchpad. But Brian Murray did a lot of it and the result is impressive, we re down to 154 bugs (from more than 300 a month ago!).
• I updated my multiarch branch multiple times. I was hoping to meet Guillem during DebConf to make some progress on this front but alas he did not attend. I have been asked a status update multiple times during my time in DebConf.
• I fixed a regression in update-alternatives (#633627), a test-suite failure when run as root (#634961), a segfault in findbreakcycle. There have been a bunch of minor improvements too (#634510, #633539, #608260, #632937).

Package Tracking System and DEHS Christoph Berg recently wrote a replacement for DEHS because the latter was not really reliable and not under control of the QA team. This is a centralized system that uses the watch files to detect new upstream versions of the software available in Debian. I updated the Package Tracking System to use this new tool instead of DEHS. The new thing works well but we re still lacking the mail notifications that DEHS used to send out. If someone wants to contribute it, that would be great! Misc packaging work I did some preliminary work to update the WordPress package to the latest upstream version (3.2). I still have to test the resulting package, replacing upstream shipped copies of javascript/PHP libraries is always a risk and unfortunately all of them had some changes in the integration process. I also updated nautilus-dropbox to version 0.6.8 released upstream. I also uploaded the previous version (that was in testing at that time) to squeeze-backports. So there s now an official package in all the Debian distributions (Squeeze, Wheezy, Sid and Experimental)! Thanks See you next month for a new summary of my activities.

No comment Liked this article? Click here. My blog is Flattr-enabled.

Next week, I ll head to Strasbourg for Rencontres Mondiales du Logiciel Libre 2011. On monday morning, I ll be giving my Debian Packaging Tutorial for the second time. Let s hope it goes well and I can recruit some future DDs! Then, at the end of July, I ll attend Debconf again. Unfortunately, I won t be able to participate in Debcamp this year, but I look forward to a full week of talks and exciting discussions. There, I ll be chairing two sessions about Ruby in Debian and Quality Assurance.

I have been wanting to post for several days already, at least since this last Sunday. I have repeatedly bragged about taking part in the Ciclot n: The last Sunday every month, the city's government closes to automotive transit a ~33Km circuit, for cyclists to enjoy. And by cyclists, I mean people from all expertise ranges Well, the very elite bikers will not take part of such a massive thing, but there are people pedalling a couple of blocks, people taking their small kids to drive a bit, and I recognized an amazingly large proportion of people doing the whole route. Well, this last Sunday one lap was not enough for me I did two laps, ~65Km. (oh, and just for keeping the complaint current: After all, SportsTracker did release a version of thier software for the N95... But it requires Flash for using the webpage at all. I have several pointers at other applications... but am time-starved right now to start reviewing :-/ ) Anyway, I decided to do this double ciclot n in order to train for next week. If you are anywhere near Mexico City, you are invited - this is meant to be a large group ride, and looks very fun! Doble Marat n Ciclista Urbano del Bicentenario We are two weeks away from the 200 year conmemoration of the beginning of the Independence War in Mexico. A group of cyclists came up with the idea to organize a Double Marathon to celebrate! 84Km of biking in Mexico City: For some reason, the distance numbers in that map were made... in miles :-P Anyway, the planned route will be:

1. Jardin de los periodistas ilustres (Delegaci n Venustiano Carranza)
2. Aeropuerto Internacional de la Ciudad de M xico
3. Circuito Bicentenario ( antes circuito interior )
4. Monumento a La Raza - Hospital La Raza
5. R o San Joaquin
6. Viaducto Bicentenario ( carril confinado sin interrumpir la circulacion )
7. Torres de Sat lite 50 aniversario
8. Presidencia municipal de Tlalnepantla
9. Presidencia municipal de Naucalpan
10. Anillo Periferico Sur
11. Secretar a de la Defensa
12. Bosque de Chapultepec 1 y 2 secci n
13. Segundo Piso del Distrito Federal
14. Ciudad Universitaria patrimonio cultural de la humanidad
15. Insurgentes Sur
16. Miguel ngel de Quevedo
17. Calzada de Tlapan
18. Z calo centro historico del distrito federal
19. Calle 16 de septiembre fin del recorrido

It looks very fun. Besides, although it is not that flat, it is one of the flattest long distance routes you will ever have. The toughest part will be IMO the Northern part of Circuito Bicentenario and possibly some bits of Perif rico towards Naucalpan. Then, a long flat stretch, with one long but not steep way up in Segundo Piso (near Las Flores), and a little stretch towards Ciudad Universitaria. Other than that, it looks very doable if you are in a moderately decent condition. And taking part in such a thing is very very worthy! As a final note... This same Sunday, it has been somewhat publicized the first D a Nacional de la Bicicleta (Bycicling National Day) will be held all over the country, kickstarting the National Cycling Crusade. Sounds nice, right? Even impressive? Yeah, but... If you look at the published information (in the page I just linked), you will see several cities are opening cyclist circuits. For one day only, which means, it does not build awareness among the population on how easy, how convenient and how fun it is to use the bicycle as means of transportation. And not only that The cyclist routes clearly make a point that cycling is a good way, at most, to have fun... But not a general habit we should all embrace. Lets see, as an example, the distances offered (only for the cities quoting route length):

• Guerrero: Chilpancingo, 2Km; Chilapa de lvarez, 4.5Km
• Sinaloa: Culiac n, 4.7Km
• Nuevo Le n:Monterrey, 1.9Km
• Quer taro: Quer taro, 3.2Km
• Sonora: Nacozari, 1.5Km; Naco, 1.5Km; Huasbas, 1Km; Granados, 1Km; Imuris, 1.5Km; Huatabampo, 1.5Km; Yecora, 1.5Km; Sahuaripa, 1Km; Caborca, 2Km; Navojoa, 3Km; Santa Ana: 2Km; San Luis R o Colorado: 2Km; Cd. Obreg n: 3Km; Hermosillo: 3Km; Nogales: 4Km; Magdalena: 3Km; Guaymas: 4Km; Empalme: 2Km
• Morelos: Cuernavaca: 2Km

...And so it goes. As you can see, several very important cities (i.e. Monterrey, Chilpancingo, Cuernavaca) put only a 2km route. 2Km by bike is... Nothing. 2Km is done at a leisurely pace in less than 15 minutes (I often sustain 20Km/h, which would mean 2Km in 6 minutes). And, in this short sample (the linked page has the information for several other states, but the pattern holds), most states are only making this in the largest city or two, completely forgetting the bulk of their territories. In my opinion, this "effort" was done backwardsly, and ends up delivering the exact opposite message to what should be done.

Something that has been annoying me recently with my bank has been that their website tells me that they will never ask for my password over the phone. And then their call centre asks me for my password. Over the phone. Of course the call centre doesn't mean my website password - they mean the special 'ultra-secure 5ekr1t code phrase', but they don't have a good, universally understood word to use for that. Hopefully they'll work one out, but they appear to have got the message anyway. This got me to thinking about how these phrases are used, and how insecure they are in reality. After all when I store a website password I go to significant lengths to ensure that the same password is not represented by the same string of characters in my database. How vulnerable are our secrets in the databases of organisations we do business with?
<!--break--> Simple Password Storage Surprisingly often people do store passwords in databases in plain text, so that should their website get hacked someone would quite possibly be able to download the whole password database. Please feel free to name and shame these organisations in the comments below. My own pet hate in this regard is the 'Mailman' mailing list software: by default on 'mailman day' - the first day of each month - it sends me my password. In plain text. Of course many developers recognise this flaw, and work around it by using a one-way hash to obscure the password. Usually they choose md5 for their hashing algorithm though, and they often fail to use a 'salt' to randomise the plaintext prior to hashing. This means that even though a password might seem obscure like 'Supercalifragilisticexpialidocious!', and no doubt it will hash to something that seems obscure like 'a7290d426b6a1764af6fd7fba5db214e', but you can often find it straighforwardly by looking it up through one of the friendly reverse hash lookup websites. There's even a Digest::MD5::Reverse perl module on CPAN to interface to a bunch of these in a more automated way! Oh dear. One way to go beyond this is using a 1-way hashing algorithm, with a random salt included into the plaintext before the hashing, so that if (god forbid) two users had 'password' for their password I might see two rows in my database like:

davical=# select username, password from usr;
  username                       password                          
-------------+------------------------------------------------
 user1          SSHA qCctCH5dirYCf29uxJiE68LvmLRDdnBkbldiWlE=
 user2          SSHA y8yOzjoh9fSkVwLaXGoVtWdiIYxmU2FCb2dOZXc=
(2 rows)

When the user wants to log in I apply the same transformation to their incoming password (appending the same salt) and compare against my stored hash. If they match then it must be the same password they used previously. Storing passwords in this way secures them from casual, or even reasonably determined access, although naturally they can still be logged at the beginning and end of the communication - or even in the middle, if we didn't encrypt that bit! The PHP function I use to salt and hash the password is as follows:

/**
* Make a salted SHA1 string, given a string and (possibly) a salt.  PHP5 only (although it
* could be made to work on PHP4 (@see http://www.openldap.org/faq/data/cache/347.html). The
* algorithm used here is compatible with OpenLDAP so passwords generated through this
* function should be able to be migrated to OpenLDAP.
*
* If no salt is supplied we will generate a random one.
*
* @param string $instr The string to be salted and SHA1'd
* @param string $salt Some salt to sprinkle into the string to be SHA1'd so we don't
*                     get the same PW always hashing to the same value.
* @return string  SSHA  followed by a base64 encoded SHA1 of the salted string.
*/
function session_salted_sha1( $instr, $salt = "" )  
  if ( $salt == "" )  
    $salt = substr( base64_encode(sha1(rand(100000,9999999),true))), 2, 9);
   
  return ( sprintf(" SSHA %s", base64_encode(sha1($instr.$salt, true) . $salt)));
 

What about Secret Code Phrases? The problem with these secret code phrases, apart from all of the forgetability and guessability problems that have repeatedly been identified elsewhere, is that they are much less likely to be stored in a one-way hash. Are you going to ask your call-centre staff to type in the customer's secret code phrase? Didn't think so. And if you did it's going to add pronouncability issues to the whole mix. So this means that those organisations who have our secret code phrases in their database will, in all likelihood, have them stored directly as plain text, displaying them to the random call-centre staffer along with all of our other account details, and especially making them vulnerable to accidental disclosure. Disclosure of a sort that doesn't necessarily involve knowing they have been disclosed. Proliferation of Use These things provide the appearance of security - 'Security Theatre' as Bruce Schneier terms it - and because of that they're taken up in a kind of a cargo cult of security: "if the banks do it that way it must be a really good form of security". This makes the problem much worse, because now I have to remember a secret code phrases not only for banks, but for ISPs, phone companies, online auction websites, and so on. How many mother's maiden names, favourite teachers and friend's phone numbers do I have? I'm sure I'm at well up whatever curve it is that measures the number of passwords a person has, because five years ago I had so many I started to store them all in an encrypted database - protected by a yet another password, of course. Now in order to get my story straight I have to store my 'secret code phrases' in there too. If I didn't store my secret code phrases in that database, I'd obviously be re-using them everywhere, from a very small set - perhaps the same one that everyone around me overhears, every time I have to ring my bank to authorise another payment from my account. Because the proliferation of use is not just the breadth of wannabe thespians hoping to climb on the stage of this latest play, but the way they want to use it all the time, too. In fact the only conversation I've had recently with my bank where they didn't want it was when they rang me. Obviously I was the only person who could answer a phone in my house, right? It isn't just security theatre: I think we can see that this analogy belongs much deeper into the sub-genre of 'Security Farce'. Is there a solution? I don't have any easy answers - other than the ones to my security questions, of course - but some improvements are possible. Other banks have quizzed me about stuff like recent expenditure or credit card limits from time to time, but I've usually passed those tests by reading my last bank statement - or failed them by not having it to hand! I don't really think that the answers can lie in that direction because the information is only quite loosely tied to my identity. For some parts of the call-centre handling of secret code phrases there are changes that could make them more secure, but in the fairly short term these organisations need to find a different way to perform these out of band identity checks. For the actual storage of the code phrases it would be a marginal improvement if the database did not contain the actual phrase. Perhaps it could be encrypted with some application-known key, so that it can be unencrypted when it needs to be displayed, but never stored in the clear. Of course there's still the problem with that key... Verification of the secret code phrase could be done by someone not involved in the transaction, so that the call could be temporarily passed into a 'verification stream' where a different person performed the verification step without the context of the account details or enquiry. Though this sort of complexity seems unlikely with call centres seemingly being outsourced to the cheapest supplier. One thing does seem likely to become increasingly true: there is less and less private data in our lives, and every time we share one of these little nuggets with our bank, or our electricity company, or our on-line associates-we-call-friends, is one more chance that it escapes into the hands of the foaming-at-the-mouth-terrorist-cracker-communist-nazi-right-wing-religious-fruitcake hordes. The highest bar for personal verification which any of my banks currently sets for me is a random choice from a set of personally entered questions, with a set of personally entered answers, for which I have to enter two randomly selected characters using my mouse. That's not bad for safe verification, and I'd have to be really impressed with their security if that was stored in the database by a passphrase-protected encryption key. With that bank I don't know what they do over the phone - I assume they've concluded they can trust my logged on persona enough that I can do what I want online, consequently I haven't had to call them and share those secrets with everyone in earshot. Maybe paranoid freaks like me will go back to a chequebook and close down on-line access to their bank accounts entirely when they find themselves having to supply a skin scraping in order to authorise their next $500 payment. "Please insert your finger in the AccuYou(tm) BloodSucker(tm) to proceed with this payment" - well, I guess it might cut down my spending! In any case, biometrics need to be understood before they can be used effectively and appropriately - and remotely over the phone is probably not one of the ways that they can be trusted to work.

The Debian Python Modules Team is discussing which DVCS to switch to from SVN. Ondrej Certik asked how to generate a list of commiters to the team s repository, so I looked at it and got this:
emilio@saturno:~/deb/python-modules$ svn log egrep "^r[0-9]+ cut -f2 -d sed s/-guest// sort uniq -c sort -n -r
865 piotr
609 morph
598 kov
532 bzed
388 pox
302 arnau
253 certik
216 shlomme
212 malex
175 hertzog
140 nslater
130 kobold
123 nijel
121 kitterma
106 bernat
99 kibi
87 varun
83 stratus
81 nobse
81 netzwurm
78 azatoth
76 mca
73 dottedmag
70 jluebbe
68 zack
68 cgalisteo
61 speijnik
61 odd_bloke
60 rganesan
55 kumanna
52 werner
50 haas
48 mejo
45 ucko
43 pabs
42 stew
42 luciano
41 mithrandi
40 wardi
36 gudjon
35 jandd
34 smcv
34 brettp
32 jenner
31 davidvilla
31 aurel32
30 rousseau
30 mtaylor
28 thomasbl
26 lool
25 gaspa
25 ffm
24 adn
22 jmalonzo
21 santiago
21 appaji
18 goedson
17 toadstool
17 sto
17 awen
16 mlizaur
16 akumar
15 nacho
14 smr
14 hanska
13 tviehmann
13 norsetto
13 mbaldessari
12 stone
12 sharky
11 rainct
11 fabrizio
10 lash
9 rodrigogc
9 pcc
9 miriam
9 madduck
9 ftlerror
8 pere
8 crschmidt
7 ncommander
7 myon
7 abuss
6 jwilk
6 bdrung
6 atehwa
5 kcoyner
5 catlee
5 andyp
4 vt
4 ross
4 osrevolution
4 lamby
4 baby
3 sez
3 joss
3 geole
2 rustybear
2 edmonds
2 astraw
2 ana
1 twerner
1 tincho
1 pochu
1 danderson
As it s likely that the Python Applications Packaging Team will switch too to the same DVCS at the same time, here are the numbers for its repo:

emilio@saturno:~/deb/python-apps$ svn log egrep "^r[0-9]+ cut -f2 -d sed s/-guest// sort uniq -c sort -n -r
401 nijel
288 piotr
235 gothicx
159 pochu
76 nslater
69 kumanna
68 rainct
66 gilir
63 certik
52 vdanjean
52 bzed
46 dottedmag
41 stani
39 varun
37 kitterma
36 morph
35 odd_bloke
29 pcc
29 gudjon
28 appaji
25 thomasbl
24 arnau
20 sc
20 andyp
18 jalet
15 gerardo
14 eike
14 ana
13 dfiloni
11 tklauser
10 ryanakca
10 nxvl
10 akumar
8 sez
8 baby
6 catlee
4 osrevolution
4 cody-somerville
2 mithrandi
2 cjsmo
1 nenolod
1 ffm
Here I m the 4th most committer And while I was on it, I thought I could do the same for the GNOME and GStreamer teams:
emilio@saturno:~/deb/pkg-gnome$ svn log egrep "^r[0-9]+ cut -f2 -d sed s/-guest// sort uniq -c sort -n -r
5357 lool
2701 joss
1633 slomo
1164 kov
825 seb128
622 jordi
621 jdassen
574 manphiz
335 sjoerd
298 mlang
296 netsnipe
291 grm
255 ross
236 ari
203 pochu
198 ondrej
190 he
180 kilian
176 alanbach
170 ftlerror
148 nobse
112 marco
87 jak
84 samm
78 rfrancoise
75 oysteigi
73 jsogo
65 svena
65 otavio
55 duck
54 jcurbo
53 zorglub
53 rtp
49 wasabi
49 giskard
42 tagoh
42 kartikm
40 gpastore
34 brad
32 robtaylor
31 xaiki
30 stratus
30 daf
26 johannes
24 sander-m
21 kk
19 bubulle
16 arnau
15 dodji
12 mbanck
11 ruoso
11 fpeters
11 dedu
11 christine
10 cpm
7 ember
7 drew
7 debotux
6 tico
6 emil
6 bradsmith
5 robster
5 carlosliu
4 rotty
4 diegoe
3 biebl
2 thibaut
2 ejad
1 naoliv
1 huats
1 gilir

emilio@saturno:~/deb/pkg-gstreamer$ svn log egrep "^r[0-9]+ cut -f2 -d sed s/-guest// sort uniq -c sort -n -r
891 lool
840 slomo
99 pnormand
69 sjoerd
27 seb128
21 manphiz
8 he
7 aquette
4 elmarco
1 fabian
Conclusions:
- Why do I have the full python-modules and pkg-gstreamer trees, if I have just one commit to DPMT, and don t even have commit access to the GStreamer team?
- If you don t want to seem like you have done less commits than you have actually done, don t change your alioth name when you become a DD (hint: pox-guest and piotr in python-modules are the same person)
- If the switch to a new VCS was based on a vote where you have one vote per commit, the top 3 commiters in pkg-gnome could win the vote if they chosed the same! For python-apps it s the 4 top commiters, and the 7 ones for python-modules. pkg-gstreamer is a bit special

qurzaw (0.0.0.0)                                                 Fri Nov 28 21:34:28 2008
Keys:  Help   Display mode   Restart statistics   Order of fields   quit
                             Last  60 pings
 1. 10.125.123.1             ............................................................
 2. 10.84.0.1                .??????.......??????.......??????......???????......??????..
 3. c9110002.virtua.com.br   .????????.....??????..?..?????????..??????????.?..?.??????.?
 4. embratel-G2-0-1-ngacc01. .??????.......??????.......??????......???????......??????..
 5. ebt-T0-5-5-0-21-tcore01. .??????.......??????.......??????......??????.......??????..
 6. 200.230.251.133          .??????.......??????.......??????......??????.......??????.?
 7. 200.230.251.154          .??????.......??????....?.???????......??????.......??????..
 8. ebt-G4-2-intl03.rjo.embr .??????.......??????......???????......??????.......??????..
 9. ebt-ge-5-2-0-intl02.mian .??????......???????......???????......??????.......??????..
10. p4-1-0-3.r01.miamfl02.us .??????......???????...?..???????......??????.?.....??????..
11. xe-1-3-0.r20.miamfl02.us .??????......???????......??????.......??????.....>.??????..
12. as-2.r21.asbnva01.us.bb. .??????......???????......??????.......??????.?...>.??????.
13. po-4.r05.asbnva01.us.bb. ???????.?.????????????...??????????..????????.???.?????????
14. 64.208.110.253           ???????......???????......??????.......??????..?...???????.
15. 208.178.61.66            ???????......???????......??????.......??????......???????.
16. vlan1455-10ge.c1.hmg.osl ???????......??????.......??????.......??????....>.???????.
17. c1.hmg.osl.no.webdealnet ???????......??????.......??????.......??????......???????.
18. vuizook.err.no           ??????.......??????.......??????.......??????......??????..
Scale:  .:41 ms  1:101 ms  2:161 ms  3:301 ms  a:661 ms  b:1002 ms  c:1602 ms

This is my current internet connectivity. Yay, or something.

A common way to debug a network server is to use 'telnet' or 'nc' to connect to the server and issue some commands in the protocol to verify whether everything is working correctly. That obviously only works for ASCII protocols (as opposed to binary protocols), and it obviously also only works if you're not using any encryption. But that doesn't mean you can't test an encrypted protocol in a similar way, thanks to openssl's s_client:

wouter@country:~$ openssl s_client -host samba.grep.be -port 443
CONNECTED(00000003)
depth=0 /C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
verify return:1
---
Certificate chain
 0 s:/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
   i:/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDXDCCAsWgAwIBAgIJAITRhiXp+37JMA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNV
BAYTAkJFMRAwDgYDVQQIEwdBbnR3ZXJwMREwDwYDVQQHEwhNZWNoZWxlbjEUMBIG
A1UEChMLTml4U3lzIEJWQkExFDASBgNVBAMTC3N2bi5ncmVwLmJlMR0wGwYJKoZI
hvcNAQkBFg53b3V0ZXJAZ3JlcC5iZTAeFw0wNTA1MjEwOTMwMDFaFw0xNTA1MTkw
OTMwMDFaMH0xCzAJBgNVBAYTAkJFMRAwDgYDVQQIEwdBbnR3ZXJwMREwDwYDVQQH
EwhNZWNoZWxlbjEUMBIGA1UEChMLTml4U3lzIEJWQkExFDASBgNVBAMTC3N2bi5n
cmVwLmJlMR0wGwYJKoZIhvcNAQkBFg53b3V0ZXJAZ3JlcC5iZTCBnzANBgkqhkiG
9w0BAQEFAAOBjQAwgYkCgYEAsGTECq0VXyw09Zcg/OBijP1LALMh9InyU0Ebe2HH
NEQ605mfyjAENG8rKxrjOQyZzD25K5Oh56/F+clMNtKAfs6OuA2NygD1/y4w7Gcq
1kXhsM1MOIOBdtXAFi9s9i5ZATAgmDRIzuKZ6c2YJxJfyVbU+Pthr6L1SFftEdfb
L7MCAwEAAaOB4zCB4DAdBgNVHQ4EFgQUtUK7aapBDaCoSFRWTf1wRauCmdowgbAG
A1UdIwSBqDCBpYAUtUK7aapBDaCoSFRWTf1wRauCmdqhgYGkfzB9MQswCQYDVQQG
EwJCRTEQMA4GA1UECBMHQW50d2VycDERMA8GA1UEBxMITWVjaGVsZW4xFDASBgNV
BAoTC05peFN5cyBCVkJBMRQwEgYDVQQDEwtzdm4uZ3JlcC5iZTEdMBsGCSqGSIb3
DQEJARYOd291dGVyQGdyZXAuYmWCCQCE0YYl6ft+yTAMBgNVHRMEBTADAQH/MA0G
CSqGSIb3DQEBBQUAA4GBADGkLc+CWWbfpBpY2+Pmknsz01CK8P5qCX3XBt4OtZLZ
NYKdrqleYq7r7H8PHJbTTiGOv9L56B84QPGwAzGxw/GzblrqR67iIo8e5reGbvXl
s1TFqKyvoXy9LJoGecMwjznAEulw9cYcFz+VuV5xnYPyJMLWk4Bo9WCVKGuAqVdw
-----END CERTIFICATE-----
subject=/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
issuer=/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
---
No client certificate CA names sent
---
SSL handshake has read 1428 bytes and written 316 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 1024 bit
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 65E69139622D06B9D284AEDFBFC1969FE14E826FAD01FB45E51F1020B4CEA42C
    Session-ID-ctx: 
    Master-Key: 606553D558AF15491FEF6FD1A523E16D2E40A8A005A358DF9A756A21FC05DFAF2C9985ABE109DCD29DD5D77BE6BC5C4F
    Key-Arg   : None
    Start Time: 1222001082
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
---
HEAD / HTTP/1.1
Host: svn.grep.be
User-Agent: openssl s_client
Connection: close
HTTP/1.1 404 Not Found
Date: Sun, 21 Sep 2008 12:44:55 GMT
Server: Apache/2.2.3 (Debian) mod_auth_kerb/5.3 DAV/2 SVN/1.4.2 PHP/5.2.0-8+etch11 mod_ssl/2.2.3 OpenSSL/0.9.8c
Connection: close
Content-Type: text/html; charset=iso-8859-1
closed
wouter@country:~$ 

As you can see, we connect to an HTTPS server, get to see what the server's certificate looks like, issue some commands, and the server responds properly. It also works for (some) protocols who work in a STARTTLS kind of way:

wouter@country:~$ openssl s_client -host samba.grep.be -port 587 -starttls smtp
CONNECTED(00000003)
depth=0 /C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
verify return:1
---
Certificate chain
 0 s:/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
   i:/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDBDCCAm2gAwIBAgIJAK53w+1YhWocMA0GCSqGSIb3DQEBBQUAMGAxCzAJBgNV
BAYTAkJFMRAwDgYDVQQIEwdBbnR3ZXJwMREwDwYDVQQHEwhNZWNoZWxlbjEUMBIG
A1UEChMLTml4U3lzIEJWQkExFjAUBgNVBAMTDXNhbWJhLmdyZXAuYmUwHhcNMDgw
OTIwMTYyMjI3WhcNMDkwOTIwMTYyMjI3WjBgMQswCQYDVQQGEwJCRTEQMA4GA1UE
CBMHQW50d2VycDERMA8GA1UEBxMITWVjaGVsZW4xFDASBgNVBAoTC05peFN5cyBC
VkJBMRYwFAYDVQQDEw1zYW1iYS5ncmVwLmJlMIGfMA0GCSqGSIb3DQEBAQUAA4GN
ADCBiQKBgQCee+Ibci3atTgoJqUU7cK13oD/E1IV2lKcvdviJBtr4rd1aRWfxcvD
PS00jRXGJ9AAM+EO2iuZv0Z5NFQkcF3Yia0yj6hvjQvlev1OWxaWuvWhRRLV/013
JL8cIrKYrlHqgHow60cgUt7kfSxq9kjkMTWLsGdqlE+Q7eelMN94tQIDAQABo4HF
MIHCMB0GA1UdDgQWBBT9N54b/zoiUNl2GnWYbDf6YeixgTCBkgYDVR0jBIGKMIGH
gBT9N54b/zoiUNl2GnWYbDf6YeixgaFkpGIwYDELMAkGA1UEBhMCQkUxEDAOBgNV
BAgTB0FudHdlcnAxETAPBgNVBAcTCE1lY2hlbGVuMRQwEgYDVQQKEwtOaXhTeXMg
QlZCQTEWMBQGA1UEAxMNc2FtYmEuZ3JlcC5iZYIJAK53w+1YhWocMAwGA1UdEwQF
MAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAAnMdbAgLRJ3xWOBlqNjLDzGWAEzOJUHo
5R9ljMFPwt1WdjRy7L96ETdc0AquQsW31AJsDJDf+Ls4zka+++DrVWk4kCOC0FOO
40ar0WUfdOtuusdIFLDfHJgbzp0mBu125VBZ651Db99IX+0BuJLdtb8fz2LOOe8b
eN7obSZTguM=
-----END CERTIFICATE-----
subject=/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
issuer=/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
---
No client certificate CA names sent
---
SSL handshake has read 1707 bytes and written 351 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 1024 bit
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 6D28368494A3879054143C7C6B926C9BDCDBA20F1E099BF4BA7E76FCF357FD55
    Session-ID-ctx: 
    Master-Key: B246EA50357EAA6C335B50B67AE8CE41635EBCA6EFF7EFCE082225C4EFF5CFBB2E50C07D8320E0EFCBFABDCDF8A9A851
    Key-Arg   : None
    Start Time: 1222000892
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
---
250 HELP
quit
221 samba.grep.be closing connection
closed
wouter@country:~$ 

OpenSSL here connects to the server, issues a proper EHLO command, does STARTTLS, and then gives me the same data as it did for the HTTPS connection. Isn't that nice.

At the dayjob, we've been evaluating various OS options for a customer project. Without going into details, it involves installing embedded software on a ThinCan for a special usage case. The basic needs are simple: graphic environment to run a custom application (OS neutral), plus a few drivers for hardware attached to the ThinCan. That's it. Nothing to excited about. Comparing various team members' proposals to implement the OS base was the real shocker: no matter how optimized the software base and compiler options, no matter which build environment was used (Thin Station, Open Embedded, Gentoo, etc.), we couldn't get a performance that was remotely usable:

• Boot time goes well over a minute, which is way too slow.
• The graphic environment is sluggish, to say the least. True enough, distributions like Thin Station come with rather outdated versions of everything, but still... that slow?!
• Refactoring IceWM to provide clean 95-ish functionalities using current XDG standards would require a fair amount of work. By the time we'd be done, IceWM would probably gain a thick footprint like XFCE progressively did.

Then came the proposal from our team's lone Windows guy: XP Embedded. Booted in less than 10 seconds, has a graphical environment that is usable out of the box and integrating the customer's application was a breeze. Heck, the demo is practically a finished product already and took just a couple of hours to assemble! To make matters worse, the total we'd be paying in licensing fees, for all the Windows components we choose, would amount to far less than what it would cost to polish either of the Free Software -based proposals. Before anyone goes and puts on their asbestos suit, I'm already aware that the point of Free Software is to keep people employed and to make the community at large benefit from everyone's code improvements by contributing patches to upstream. Please keep in mind that, in contrast, business requirements are to get results at a reasonable cost, reasonably fast and to produce a well-polished product. The Free Software community has finally conquered the challenges of the desktop and was already on the server ages ago, but we ain't quite there yet on embedded devices, I'm afraid. While I personally refuse to run anything else than Ubuntu on my laptop, let's face it, in the above case, the savings in time=money were obvious and the resulting product quality, even at demo stage, spoke for itself. Thus, another Tux bit the dust.

Incredible day here in Montreal. The temperature got over 31C today -- about 88 F -- which made for a steamy, jungly day. Remember how I said we had predictions of snow flurries two weeks ago? Things change quickly. Of course, hot weather and high humidity are a recipe for smog. Add on top of that the fact that Montreal is in the middle of a public transit strike, and you've got a serious air quality problem. Fortunately we should have some rain this weekend to shake that out. tags: weather montreal hot smog

EC2 I spent a big part of my day twiddling around getting a nice Ubuntu server running on Amazon Web Services. Amazon's EC2 is an innovative server-provisioning API; beta testers for EC2 can build or tear down servers for any purpose in a few minutes using EC2 and Amazon S3. I wrote a few years ago, in a widely-reproduced email, a reply making fun of Jeff Bezos and Amazon's supposed innovations. But let me be frank: Amazon Web Services are a shithouse crazy idea. I think that Jeff Bezos must have been a complete nutjob to bet the company on these zany technologies; I also think it's brilliant, and it's going to change the way we think about using computers. I included EC2 in Ten Web 2.0 APIs you can really use. I think that decision was really justified. My EC2 instances now run Ubuntu Feisty Fawn; lighty, MySQL and PHP. It seems to be a winning combination; I'm looking forward to using EC2 for a production Web or database server. tags: ec2 amazonwebservices amazon jeffbezos oneeyedman

rel-edit I mentioned already the great work that AboutUs.org is doing to organize a Universal Wiki Edit Button. I decided to kick in on the machine-readable side and proposed a rel-edit microformat. So far the microformats-discuss mailing list has been pretty positive on the idea, but I'm going to wait a few days before posting a draft on the microformats wiki. tags: rel-edit microformats uweb mailinglist microformats-discuss

Salt I just finished reading Salt: A World History, a nice non-fiction book by researcher extraordinaire Mark Kurlansky. The book covers this important mineral, its importance to human life, and the many ways to extract it to make it available for us. The book covers mummification in ancient Egypt, salt taxes in China, fish sauce in Vietnam, and Mahatma Gandhi's great salt march in India. It's so comprehensive that it can really make your head spin; but it's also exciting to see world history refracted through these whitish crystals. I think it's a great book, and I'm looking forward to reading Cod: A Biography of the Fish That Changed the World, by the same author. But we just got Everything is Miscellaneous from Amazon this week, so I think I'll be digging through that before I get to Cod. tags: salt markkurlansky nonfiction nacl cod

reCAPTCHA I heard about recaptcha via Hugh's article about same. Brilliant idea; why didn't someone think of this before? (Update: it was about 5 minutes after I posted this that I realized, "Hey! That can't work!" So I went back and re-read the docs on reCAPTCHA again. Now I'm even more impressed.) tags: recaptcha ingenious ocr

I want to ride my I've been thinking of picking up a bicycle for a few weeks now, as the weather has cleared here in town. So today I went up to Garantie Bicycle on rue Marie-Anne and bought the cheapest damn bike they had that wasn't made specifically for pre-pubescent children. Woohoo! The last time I had I bike, I lived in San Francisco. It was a beautiful cherry-red Cannondale hybrid -- with that great fat Cannondale tube, but light enough that I could lift it with one finger. I rode it around SF a lot, and took it out for trail biking on weekends in Marin County and the Peninsula and even the Sierra Nevada. It was a tough bike to ride, but once you got used to it it was a dream to take up hills. But that bike was stolen at Burning Man 2001, during the actual Burn. It's a classic mistake: professional bike thieves go to Burning Man each year to snag bikes left unlocked by tired and idealistic Burners, especially at times when camps are left empty, like during the Burn. To be honest, it was kind of a relief: I'd already moved out of my apartment and was planning a trip around North America, and I didn't have room in my Citro n DS for a bike. Nor in my storage locker at the weird and wonderful Sunshine Storage in Oakland. But it was too nice a bike to throw away or give to one of my no-good friends, who were mostly too short for it anyways. So bicycle theft was the best solution. Sam Phillips had his bike stolen at the same time. The bike thieves left a lot of cheapo bikes around our camp. They liked mine and Sam's, though. Anyways, my new bike was quite inexpensive, and it weighs a metric ton. It's built like you're supposed to drive trains over it. I could never, ever carry it up a steep and muddy hill, and I wouldn't bother. Fortunately for me Montreal is really, really flat, so I don't really need to worry about riding this thing up hills. It will look pretty good with a baby seat on the back, though. tags: montreal garantiebicycle burningman bicycle theft samphillips sunshinestorage oakland cannondale

Now that the weekend is here, I've been catching up on the news of this weeks big astronomy announcement: the discovery of a possible "Super-Earth" exo-planet, Gliese 581 c. This is the first exoplanet likely to be within the so-called "Habitable zone" around its star, where life as we know it could be possible. Unfortunately the Irish Times "World Apart" weekend supplement article has been quite disappointing. Like Greg Laughlin at UCO Lick I get depressed when people give misleading information . It includes a very misleading "Artists impression" picture, simultaneously showing details we don't know and being incorrect about the few things we do know. Its easy to get annoyed at the concentration of facts that are guesswork or probably wrong in this article. Gl 581c is not 5 Earth masses: thats its minimum mass: due to radial velocity measurements, we can only measure M sin(i), where i is the inclination, currently unknown. It could easily be far more, and hence all predictions of what the planet is like become moot. Similarly, the radius is not necessarily 1.5 times Earths: thats a prediction, based on the mass, and current theories. Unfortunately, there is no mention that current theories of planetary size are coming under scrutiny as they fail to match other recent exoplanet discoveries. This makes other speculation about the planet such as the gravity on the surface quite misleading. The BBC News summary is much better: it refers to the radius as "the radius should be", rather than "is". But it too includes the incorrect picture. While its article is couched in more conservative language, it doesn't explain what facts it quotes are speculation and why they may be wrong. None of the media reports I have yet seen mention current missions, such as COROT, which is the most likely to find Earth-sized planets in the near future (launched late last year, it is due to finish its first observing run in April. Results awaited with anticipation). They also ignore Darwin and the The Terrestrial Planet Finder, the most likely missions to discover life on other planets, but currently sitting in funding limbo. Concentration on purely the known facts would of course make the news reports short and boring. Instead they should emphasise more of the work of the scientists involved: we teach science as a set of cut-and-dried facts that often bore school students and drive them away. Instead, when faced as the cutting edge of an important discovery like this, we could show how an amateur could be partially credited with getting this result; with the fact that, since the planet has a short "year" astronomers are already lining up to investigate transit measurements of it on May 7 and that with a magnitude of 10.6 (only 20 light years from Earth, after all) its within range of amateur astronomers to observe and determine its true size and details. How about getting people excited to get involved themselves?

Another good day at South by Southwest. I had the night out last night, so I stopped at the Frogdesign Party for a while to see people and have some beers. I left to try to see Douglas Coupland's new movie, Everything's Gone Green. As a speaker I got a "gold" pass, which means I get to go see some of the films in the festival, but by the time I got to the theatre, it was at capacity. Too bad! Over to Club de Ville to see old friend Ben Cerveny, then trying to catch up with Niko, then an early night getting home. This morning I went to see Identity Woman (Kaliya Hamlin) talk about OpenID at the identity panel. It was a good discussion about identity and privacy, and I also got to meet Scott Kveton in person, too. Mike Linksvayer was there too, which was nice; it's great catching up with such a sympatico person. This afternoon I watched the incredibly valuable Everything You Always Wanted to Know About the Mobile Web...but Were Afraid to Ask. Great practical information for people willing to give mobile a try. I came away enthused and ready to make wikitravel.mobi a reality. Best of all was seeing Ben on his panel about virtual identity and avatars. Ben's got a talent for identifying the most intellectually stimulating thread in a conversation and following it with gusto, so it was really cool to see him talk on stage. tags: sxsw07 austin douglas coupland identity woman mobile web ben cerveny

La Traviata We stopped in for dinner at La Traviata, an Italian restaurant on Congress that Maj had heard good things about. The menu was nice but not too friendly to us pescevegetarians; we were excited when we heard that there was a seafood special that night. But the waiter came back to tell us that they weren't available. After we ordered, I heard the waitress behind me saying to her very big table, "...and we have two plates of the mahi-mahi available..." I stopped our waiter when he came by, and he was sheepish. "The chef was keeping those two plates for this big party." Oh. Our food was great -- I had a mushroom fettuccine, Maj had a grilled salmon with greens -- and we forgot about it. But the waiter came out later and said, "I talked about it with the chef and we want to extend our apologies. We should offer the specials to every customer equally. The chef wants to offer you dessert on the house." OK, sounds good. It doesn't take much to make up for a mistake, especially in the restaurant industry. La Traviata had good food, a really nice building, and great service up until then, but going that extra mile to make up for a mistake -- a debatable mistake I probably would have never thought about again -- gained my trust. More restaurants -- no, more businesses -- should have service like that. tags: la traviata austin italian restaurant

Blog review roundup I wanted to quickly shout-out to people who mentioned my talk at SXSW (Talks/SXSW07) in their blogs:

• Mike Linksvayer, SXSW: Commercialization of Wikis.
• Angela Beesley, Commercialization of wikis. I hope she saw that she was thanked at the end!
• Liz Henry, SXSWi panel on commercialization of wikis. The canonical notes, better than my own.
• Adam Darowski, SXSWi: Commercialization of Wikis. Adam's doing some wiki projects himself, and he found the talk helpful. Great!
• Mathieu Ouellet, Commercialization of Wikis. I hadn't seen Mathieu's great travel/tourism blog before, but it's bookmarked now. Great reading.

I'm really glad to see so much positive response to the talk. I worked really hard on it, and the subject is obviously very dear to my heart. It's great when your work pays off and people appreciate it. tags: sxsw07 me talk blogs wiki

Wiki BOF We're having a Wiki BOF lunch tomorrow at the 4th-floor coffee lounge. It should be fun. Thanks for announcing it, Liz! tags: wiki sxsw07 bof flock together

What a great day it was in the Bay Area today -- just beautiful. It's Rose Bowl weather, of course -- Nature blesses California on the day of the Rose Bowl, just so people in the rest of the USA say, "Damn those Californians and their great weather!" Still, there's something so rejuvenating every year around the 10th-11th of Niv se. I wonder what it is? Oh, and: no, we don't have the Rose Bowl in northern California. It's just one of the few times of year that San Franciscans are happy to share the state with their southern neighbors. tags: niv se rose bowl california weather

Fruitcake So, there's a comedy tradition around the holidays that marks the crappiest possible gift you can get for Christmas as a fruitcake. This is stupid; fruitcake is delicious. Candied fruit + nuts + cake + rum = hooray for fruitcake. My parents got a couple of fruitcakes for Christmas, and they tasted great. I've been noshing on them a bit at a time all week. Great stuff! Rumtastic. Anyone who says otherwise is full of malarkey. In conclusion, fruitcake is delicious and Carthage must be destroyed. tags: fruitcake christmas delicious carthage malarkey

New Year's Eve Maj, Amita June and I had a hard New Year's Eve. Our friends Earl and Sue have an NYE party in Walnut Creek every year, and a lot of our friends from Pigdog Journal are there every year. We had planned to have a room at the nearby Embassy Suites, and have friends over before the party to see Amita June (who needs to be asleep by New York midnight, i.e. 9PM PST). But Maj is feeling really sick -- flu-y and nauseous -- and we had to cancel this pre-event. Bad feelings about this; we've missed seeing this group of friends a few times since the baby was born, and some of them have never met her. Eventually, we all managed to go to Earl and Sue's party together, then left early so Amita could get to sleep. A pretty good solution all around. I got to see a lot of old friends, including Sam and Shannon who just announced that she's blogging for two now. (Congrats!) Tjames was there with his ladyfriend Robyn, which was really nice. They made out a lot, which makes me pretty happy. We saw Dan, Johnny, Randy, Dave, and of course Earl and Sue themselves. A really good party. tags: nye earl sue sick maj amitajune sam shannon pigdog

All is quiet I had a pretty mild shom-pan-yah hangover this morning, so we were fully able to go see friends Zach and Wendy in El Cerrito for brunch. We hit delicious Picante off of Gilman Street, which is a massive Mexican restaurant, near the Berkeley Gourmet Ghetto and showing some of the foodie-ism of the weird East Bay scene. I had a really good plate of chilaquiles, and Maj had some huevos rancheros and made a pretty good dent in them -- the first food she's really eaten in a few days. Amita June got a great quesadilla with queso fresco that tasted really good. Then, everyone was ready for a nap, so we said goodbye and cut the visit short by heading back to Los Altos Hills. tags: zach wendy picante berkeley chilaquiles

Ads on Wikipedia So, there's been quite a dust-up on Wikimedia Foundation lists about their recent fund-raising drive. The WMF is having its annual fundraising drive (and, if you can, please help with a donation), and the Virgin Group's charity organization, Virgin Unite, set up a matching fund a few days ago so that all donations to the WMF were effectively doubled. All fine so far, right? But a small logo in the donations notice -- seen by non-logged-in users on every page of every WMF site -- was considered by many Wikipedians and other WMF editors as dangerously close to the line on advertising -- or over it. There have been several prominent users who have left the project because of it. I'm not sympathetic with these folks; in fact, I'm in solid opposition. I think that Wikipedia's huge amount of Web traffic is a resource that the Foundation is squandering. Traffic like Wikipedia's is worth tens of millions if not hundreds of millions of dollars in ad revenue per year. That's money that could go to disseminate free (libre and gratis) paperback pocket encyclopedias to millions of schools and millions of children, in their own language, around the world. It's irresponsible to abuse that opportunity. Brion Vibber's defense of the logo on the Wikimedia Foundation's mailing list is really interesting and instructive. tags: wikipedia wikimedia ads virgin unite

The Lexus GS 450 hybrid petrol/electric car has been given the award for Australia's best luxury car!

The judging for this contest rated fuel efficiency as low importance, because luxury car owners traditionally aren't very concerned about such things. The Lexus won because of it's quiet engine (can't beat an electric motor at low speed), high performance (3.5L petrol engine that outperforms mode 4L engines because of the electric motor assistance), safety, security, and other factors.

There has been an idea that hybrid cars are only for people who want to protect the environment at all costs. The result of this contest proves that idea to be false. The Lexus won by simply being a better luxury car, the features that benefit the environment also give a smoother and quieter ride and higher performance - which are factors that are very important to that market segment! Also it wasn't even a close contest, the nearest rival achieved an aggregate score of 9% less (a significant difference as there was a mere 2.5% difference in score between the 2nd place and 5th place).

This of course shouldn't be any surprise. The high torque that electric motors can provide at low speed is well known - it's the reason for Diesel-electric hybrid power systems in locomotives. It was only a matter of time before similar technology was introduced for cars for exactly the same reasons. The next development will be hybrid Diesel-electric trucks.

The BarCamp Zurich 2006 is over. On the way there I thought about what I would do during time slots with no interesting talks. But when I tried to make up my personal schedule, I noticed that I rather would have the opposite problem: Too many interesting talks at the same time… Well, to many interesting talks at all, although I only went to tech talks and left out the biz talks. I first went to the Podcasting & Co. talk by Timo Hetzel, since I never heard or made a podcast, but was curious about podcasts in general. Besides statistics and rankings he spoke about where people listen to podcast (most listeners seem to do that during commuting), what people like in podcasts, why companies podcast, etc. And that a very big share of all podcast listeners use iTunes as podcast client and except juice (never heard of it before) all other podcast clients seem to be irrelevant. My conclusion: I haven’t missed anything not having listened to or made podcasts neither do I need to listen or make podcasts in the future. They’re irrelevant. To me. :-) Then I had to choose between the talks AJAX@localhost (PDF) by Harry Fuecks and Realtime Collaborative Text Editing and SubEthaEdit by the Coding Monkeys. I heard about realtime collaborative editing once know that it’s a challenging task for the developer. I also know what AJAX is (and that I would only use or recommend it for bells and whistles, but not for content in general), but “AJAX@localhost” sounded like writing normal applications using AJAX. It sounded interesting and evil at the same time. I had to go there! ;-) Others had similar expectations after reading the talk’s title, so I was quite surprised that it was about something completely different, namely about debugging AJAX on the localhost but under conditions usually only appearing if you’re running AJAX application not from localhost but from somewhere on the net: You may have different lags with every request, so some requests may reach the server before others, which may screw up the whole AJAX application, if the developers didn’t think about it and only tested it on localhost. (Hence the talk’s title…) My conlusion: I will use and recommend AJAX even more seldom, since there seem to be even more design misconceptions than I thought before. But I’ll once have a look at the Webtuesday meeting, he mentioned. For the third time-slot, I didn’t need long to decide where to go: I already knew a little bit about Microformats and I wanted to know more. Tag Trade also sounded interesting, but the second part of the talk’s title, Paid Learning sounded like business and so I had no scruples to cold-shoulder that talk. I probably didn’t learn anything really new in the microformats talk, but my knowledge about microformats is now more concrete, and after talking with Cédric Hüsler later during a break, I would even trust myself to start and define a new microformat. Then I went to the HG Caféteria together with Gürkan and two German guys. While waiting in the queue, we were talking about our jobs and our favourite Linux distributions. I got some rhubarb pie and a rum truffles, assuming that the Caféteria uses no alcohol in their products like all other SV restaurant I know. But this one seemed to have quite a lot of alcohol, since it felt like my breath was burning… Well, this resulted in my second SV feedback form submission… Next I went to Alex Schröder’s talk about multilingual websites, Oddmuse and the Emacs Wiki, although also the talk A-Life about simulating evolution sounded promising. Alex asked the listeners about their experiences with multilingual websites and showed what Oddmuse offers as partial solution to the general multilingualism problems. But regarding the comments from the auditorium, there probably won’t be a perfect solution until computers can translate perfectly… The next talk I visited was Gabor’s talk about his master thesis Organizing E-Mail which resulted in a soon to be released Mozilla Thunderbird extension called BuzzTrack. From the other concepts he showed, I found Microsoft’s SNARF (Social Network and Relationship Finder) and IBM’s Thread Arcs most interesting as well as the fact that there is no e-mail client seems to have a majority at all. Directly after Gabor I had my own talk about Understanding Shell Quoting, so I also couldn’t go to Adrian Heydecker’s talk about Learning with Hypertext and Search Engines. I had only about three and a half listeners of whom several to my surprise where here because they didn’t know what “shell quoting” is. I really didn’t expect that. But that seems to be one of the differences between a BarCamp and a Linux Conferences: People come here to see something new, something they haven’t heard about before. On Linux events most people come, because they already heard about some special topic and want to know more or learn something about it. On Linux event my shell talks usually were attracting many visitors while at a BarCamp, talks presenting an idea, a concept or a tool seem to much more interesting for the attendees. So for the next BarCamp I perhaps exhume my Website Meta Language talk which never seemed to hit the nerve of Linux event attendees, since it tried to “sell” a different concept of generating website than most were used to. At least one listener excepted the talk to be named “shell escaping”, but IMHO escaping is only one quoting technic and it’s not only used for quoting. But perhaps I should take the word “escaping” in the title though for the next time. Happily most of the listeners seem to have learned something new from the talk and Silvan Gebhardt was really happy about his new knowledge about ssh ~ escapes, although I mainly talked about how to quote them than how to use them. :-) During the last slot I visited the session about the upcoming BarCamp Alsace 2 and the yet to be planned BarCamp Rhine, a BarCamp to be held on a ship traveling from Basel in Switzerland down the Rhine, stopping in Strasbourg, Karlsruhe, Rhein-Main-Area and perhaps even Cologne and Amsterdam. Contrary to my initial thoughts, the day was over very fast and I had no single boring minute during the BarCamp. Wow! After we’ve been kicked out of the building by ETH janitors, we joined again at the Bar N-68. On the way there I met Urban M ller who attended BarCamp Zurich, too. We talked quite a lot and it was very interesting to see behind the scenes of e.g. map.search.ch. Later I joined the French speaking table, talking with Gregoire Japiot from WineCamp France and Alex Schröder. Around 9pm I left the N-68 as one of the last BarCampers, tired but with new knowledge, new ideas, new acquaintances and a new hobby: BarCamping. What a luck that BarCamps aren’t that often, otherwise I couldn’t afford this new hobby. ;-) As a relaxing end I met with Alex Schröder and Christophe Ducamp on Sunday morning for brunch in the restaurant Gloria in the Industriequartier. When we were leaving the Gloria I noticed their book board with a lots of BookCrossing books and I took “The Da Vinci Code” with me, since I saw the movie and people were telling me that the book is much better. I’ll see…

This arrived in the post today: Brazil Sitio Boa Sorte coffee, freshly ground yesterday. It won Cup Of Excellence last year and Has Bean bought the entire supply. It's good. At £4.99 a packet it's not really expensive, but it's not cheap. I must avoid buying the other Cup Of Excellence winners, for example El Salvador San Roberto which is fourteen pounds a bag. I'm probably going to buy most of my coffee from Has Bean in the future: the coffee is good and the delivery is fast. They freshly grind on demand so it's always fresh, and it comes in airtight re-sealable bags (none of that fold it over and sticky bit of plastic nonsense) that sit nicely in the fridge. All in all: heavily recommended. NP: Buena Vista Social Club

Dear German part of the Debian Lazyweb, I want to study Computer Sciences beginning with the winter semester this year. But where should I do that? I live in Southern Germany, near Strasbourg. So my primary choice was Freiburg. I went there to check it out, but all they had to offer to interested pupils was a two hours lecture about programming sets in Java. Hey, every other computing faculty says that it's not that important to know specific programming languages. Additionally I would rather put an accent on functional programming languages than on traditional ones. So Freiburg is most likely not my choice. Another question which was rised when I was there was the comparision of Bachelor and Master to the old-school diploma. I guess on most universities WS 2006 is the last chance to enter this course. What's better and why? I guess that's highly subjective, but well, I guess those who currently study CS will most probably have an opinion about that. Karlsruhe still offers the diploma. Although commuting to Freiburg is even easier, it wouldn't be hard for Karlsruhe neither (at least for the first semester or so). I don't know if Strasbourg would be an option. I guess the lectures there are in French and although I knew a fair bit of it, most got lost in the last three years. So not a primary choice, neither. But why should I be restricted to the South in my choice. What about Aachen? Well, it would be hard to find a flat from here, but I wouldn't have a problem to go that far away from home. Any comments? (Of course you could reply in German.)

A rosary is a string of beads that Catholics use for prayer. There is a very similar apparatus in the Islam, called tasbih - They look like this:

Ok, now why is this relevant?
Yesterday I was at a meeting with two people who were a couple for a long time, let's call them he and she. We had a talk along the following lines:

Me: Ok, I'll have you the system running on time. Just please remember to bug me every now and then. Torture me if I don't answer you.
She: Ok, but you must know I can be quite heavy when torturing!
He: She really means it. Sometimes she can be like a rosary of watermelons.

...I loved the image :)