Here s my (twentieth) monthly update about the activities I ve done in the F/L/OSS world.
Debian
This was my 29th month of actively contributing to Debian.
I became a DM in late March 2019 and a DD on Christmas 19! \o/
Interesting month, surprisingly. Lots of things happening and lots of moving parts; becoming the new normal , I believe.
Anyhow, working on Ubuntu full-time has its own advantage and one of them is being able to work on Debian stuff!
So whilst I couldn t upload a lot of packages because of the freeze, here s what I worked on:
Mentoring for newcomers and assisting people in BSP.
Moderation of -project mailing list.
Ubuntu
This was my 4th month of actively contributing to Ubuntu.
Now that I ve joined Canonical to work on Ubuntu full-time, there s a bunch of things I do! \o/
This month, by all means, was dedicated mostly to PHP 8.0, transitioning from PHP 7.4 to 8.0.
Naturally, it had so many moving parts and moments of utmost frustration, shared w/ Bryce. :D
So even though I can t upload anything, I worked on the following stuff & asked for sponsorship.
But before, I d like to take a moment to stress how kind and awesome Gianfranco Costamagna,
a.k.a. LocutusOfBorg is! He s been sponsoring a
bunch of my things & helping with re-triggers, et al. Thanks a bunch, Gianfranco; beers on me
whenever we meet!
Debian (E)LTS
Debian Long Term Support (LTS) is a project to extend the lifetime of all Debian stable releases to (at least) 5 years. Debian LTS is not handled by the Debian security team, but by a separate group of volunteers and companies interested in making it a success.
And Debian Extended LTS (ELTS) is its sister project, extending support to the Jessie release (+2 years after LTS support).
This was my twentieth month as a Debian LTS and eleventh month as a Debian ELTS paid contributor.
I was assigned 29.75 hours for LTS and 40.00 hours for ELTS and worked on the following things:
LTS CVE Fixes and Announcements:
Issued DLA 2654-1, fixing CVE-2021-29472, for composer.
For Debian 9 stretch, these problems have been fixed in version 1.2.2-1+deb9u1.
Issued DLA 2662-1, fixing CVE-2021-32027 and CVE-2021-32028, for postgresql-9.6.
For Debian 9 stretch, these problems have been fixed in version 9.6.22-0+deb9u1. This update for done by the maintainer, Christoph Berg. I just took care of announcing and publishing the update.
Uploaded ruby-rack-cors to buster-security, fixing CVE-2019-18978.
For Debian 10 buster, these problems have been fixed in version 1.0.2-1+deb10u1.
Pandemic Situation in India.
I don t know from where I should start. This is probably a good start. I actually would recommend Indiacable as they do attempt to share some things happening in India from day to day but still there is a lot thatt they just can t cover, nobody can cover. There were two reports which kind of shook me all inside. One which sadly came from the UK publication Independent, probably as no Indian publication would dare publish it. The other from Rural India. I have been privileged in many ways, including friends who have asked me if I need any financial help. But seeing reports like above, these people need more help, guidance and help than I.
While I m never one to say give to Foundations. If some people do want to help people from Maharashtra, then moneylifefoundation could be a good place where they could donate. FWIW, they usually use the foundation to help savers and investors be safe and help in getting money when taken by companies with dubious intentions. That is their drive. Two articles show their bent. The first one is about the Algo scam which I have written previously about the same in this blog. Interestingly, when I talk about this scam, all Modi supporters are silent. The other one does give some idea as to why the Govt. is indifferent. That is going to a heavy cross for all relatives to bear. There has been a lot that has been happening. Now instead of being limited to cities, Covid has now gone hinterland in a big way. One could ask also Praveen as he probably knows what would be good for Kerala and surrounding areas.
The biggest change, however, has been that India is now battling not just the pandemic but also Mucormycosis also known as black fungus and its deadlier cousin the white fungus. Mucormycosis came largely due to an ill-advise given that applying cow dung gives protection to Corona. And many applied it due to faith. And people who know science do know that in fact it has that bacteria.
Sadly, those of us who are and were more interested in law, computer science etc. has now also have to keep on top of what is happening in the medical field. It isn t that I hate it, but it has a lot of costs. From what I could gather on various social media and elsewhere, a single injection of anti-fungal for the above costs INR 3k/- and that needs to be 5 times in a day and that course has to be for three weeks. So even the relatively wealthy people can and will become poor in no time. No wonder thousands of those went to UK, US, Dubai or wherever they could find safe-harbor from the pandemic with no plans of arriving back soon.
There was also the whole bit about FBS or Fetal Bovin Serum. India ordered millions of blood serum products from abroad and continues to. This was quickly shut down as news on Social Media. Apparently, it is only the Indian cow which is worthy of reverence. All other cows and their children are fair game according to those in power. Of course, that discussion was quickly shut down as was the discussion about IGP (Indian Genome Project). People over the years had asked me why India never participated for the HGP (Human Gnome Project). I actually had no answer for that. Then in 2020, there was idea of IGP which was put up and then it was quickly shot down as the results could damage a political party s image. In fact, a note to people who want to join Indian civil services tells the reason exactly. While many countries in the world are hypocrites, including the U.S. none can take the place that India has made for itself in that field.
The Online experience
The vaccination process has been made online and has led to severe heartburn and trouble for many including many memes. For e.g.
Daily work, get up, have a bath, see if you got a slot on the app, sleep. People trying desperately to get a slot, taken from Hindi Movie Dilwale Dulhania Le Jaygenge.
Just to explain what is happening, one has to go to the website of cowin. Sharing a screenshot of the same.
Cowin app. sceeenshot
I have deliberately taken a screenshot of the cowin app. in U.P. which is one of the areas where the ruling party, BJP has. I haven t taken my state for the simple reason, even if a slot is open, it is of no use as there are no vaccines. As have been shared in India Cable as well as in many newspapers, it is the Central Govt. which holds the strings for the vaccines. Maharashtra did put up an international tender but to no effect. All vaccine manufacturers want only Central Govt. for purchases for multiple reasons. And GOI is saying it has no money even though recently it got loans as well as a dividend from RBI to the tune of 99k crore. For what all that money is, we have no clue.
Coming back though, to the issue at hand. the cowin app. is made an open api. While normally, people like us should and are happy when an API is open, it has made those who understand how to use git, compile, etc. better than others. A copy of the public repo. of how you can do the same can be found on Github. Now, obviously, for people like me and many others it has ethical issues.
Kiran s Interview in Times of India (TOI)
There isn t much to say apart from I haven t used it. I just didn t want to. It just is unethical. Hopefully, in the coming days GOI does something better. That is the only thing we are surviving on, hope.
The Toolkit saga
A few days before, GOI shared a toolkit apparently made by Congress to defame the party in power. That toolkit was shared before the press and Altnews did the investigation and promptly shredded the claims. Congress promptly made an FIR in Chhattisgarh where it is in power. The gentleman who made the claims Mr. Sambit Patra refused to appear against the police without evidence citing personal reasons and asking 1 week to appear before them. Apart from Altnews which did a great job, sadly many people didn t even know that there is something called WYSIWYG. I had to explain that so many Industries, whether it is politics, creative industries, legal, ad industries, medical transcription, and imaging all use this, and all the participants use the same version of the software. The reason being that in most Industries, there is a huge loss and issue of legal liabilities if something untoward happens. For e.g. if medical transcription is done in India is wrong (although his or her work will be checked by a superior in the West), but for whatever reason is not, and a wrong diagnosis is put (due to wrong color or something) then a patient could die and the firm who does that work could face heavy penalties which could be the death of them.
There is another myth that Congress has unlimited wealth or huge wealth. I asked if that was the case, why didn t they shift to Mac. Of course, none have answers on this one.
There is another reason why they didn t want to appear. The Rona Wilson investigation by Arsenal Experts also has made them cautious. Previously, they had a free run. Nowadays, software forensic tools are available to one and all. For e.g. Debian itself has a good variety of tools for the same. I remember Vipin s sharing few years back. For those who want to start, just install the apps. and try figuring out. Expertise on using the tools takes years though, as you use the tool day in night.
Update 25/05/2021 Apparently because Twitter made and showcased few tweets as Manipulated Media , those in Govt. are and were dead against it. So they conducted a raid against Twitter India headquarters, knowing fully well that there would be nobody except security. The moment I read this, my mind went to the whole Fruit of the poisonous tree legal doctrine. Sadly though, India doesn t recognize it and in fact, still believes in the pre-colonial era that evidence however collected is good. A good explanation of the same can be found here. There are some exceptions to the rule, but they are done so fine that more often than not, they can t be used in the court of law in India. Although a good RTI was shared by Mr. Saket Gokhale on the same issue, which does raise some interesting points
Twitter India Raid, Saket Gokhale RTI 1 Saket Gokhale RTI query , Twitter India Raid 2
FWIW, Saket has been successful in getting his prayers heard either as answers to RTI queries or then following it up in the various High Courts of India. Of course, those who are in the ruling party ridicule him but are unable to find faults in his application of logic. And quite a few times, I have learned from his applications as well as nuances or whatever is there in law, a judgment or a guideline which he invokes in his prayer. For e.g. the Lalitha Kumari Guidelines which the gentleman has shared in his prayer can be found here. Hence now, it would be upto the Delhi Police Cell to prove their case in response to RTI. He has also trapped them as he has shared they can t give excuses/exemptions which they have tried before.
As I had shared earlier, High Courts in India have woken up, whether it is Delhi, Mumbai, Aurangabad, Madhya Pradesh, Uttar Pradesh, Odisha or Kerala. Just today i.e. on 25th May 2021, Justices Bela Trivedi and Justice Kalra had asked how come all the hospitals don t have NOC from the Fire De[partment. They also questioned the ASG (Assistant Solicitor General) as how BU (Building Use Certificate) has been granted as almost all the 400 hospitals are in residential area. To which the ASG replies, it is the same state in almost 4000 schools as well as 6000 odd factories in Ahemdabad alone, leave the rest of the district and state alone. And this is when last year strict instuctions were passed. They chose to do nothing sadly. I will share a link on this when bar and bench gives me
The Hindu also shared the whole raid on twitter saga.
Conclusion
In conclusion, I sincerely do not where we are headed. The only thing I know is that we cannot expect things to be better before year-end and maybe even after that. It all depends on the vaccines and their availability.
After that ruralindia article, I had to see quite a few movies and whatnot just to get that out of my head. And this is apart from the 1600 odd teachers and workers who have died in the U.P. poll duty. Now, what a loss, not just to the family members of the victims, but a whole generation of school children who would not be able to get quality teaching and be deprived of education. What will be their future, God only knows.
The only good Bollywood movie which I saw was Ramprasad ki Teravi . The movie was an accurate representation of most families in and around me. There was a movie called Sansar (1987) which showed the breakup of the joint family and into a nuclear family. This movie could very well have been a continuation of the same. Even Marathi movies which at one time were very progressive have gone back to the same boy, girl love story routine. Sameer, though released in late 2020, was able to see it only recently. Vakeel Saab was an ok copy of Pink . I loved Sameer as, unlike Salman Khan films, it showed pretty much an authentic human struggle of a person who goes to the Middle East without any qualifications and works as a laborer and the trials he goes through. Somehow, Malayalam movies have a knack for showing truth without much of budget. Most of the Indian web series didn t make an impact. I think many of them were just going through the motions, it seems as everybody is concerned with the well-being of their near and dear ones. There was also this (Trigger Warning: This story discusses organized campaigns glorifying and advocating sexual violence against Muslim women.) Hoping people somehow make it to the other side of the pandemic.
My newsletter Le Courrier du hacker (3,800 subscribers, 176 issues) is 3 years old and Mailchimp costs were becoming unbearable for a small project ($50 a month, $600 a year), with still limited revenues nowadays. Switching to the Open Source Mailtrain plugged to the AWS Simple Email Service (SES) will dramatically reduce the associated costs.
First things first, thanks a lot to Pierre-Gilles Leymarie for his own article about switching to Mailtrain/SES. I owe him (and soon you too) so much. This article will be a step-by-step about how to set up Mailtrain/SES on a dedicated server running Linux.
What s the purpose of this article?
Mailchimp is more and more expensive following the growth of your newsletter subscribers and you need to leave it. You can use Mailtrain, a web app running on your own server and use the AWS SES service to send emails in an efficient way, avoiding to be flagged as a spammer by the other SMTP servers (very very common, you can try but you have been warned against
Prerequisites
You will need the following prerequisites :
An AWS account with admin rights
Full control over the domain name you use to send your newsletter
A baremetal or virtual Linux Debian server you have the root access to
NodeJS installed (8x and 10x are ok with Mailtrain)
A MySQL/MariaDB instance with the root access to
Redis 3x (not 5) if you want to use Redis (not mandatory)
Steps
This is a fairly straightforward setup if you know what you re doing. In the other case, you may need the help of a professional sysadmin.
You will need to complete the following steps in order to complete your setup:
Configure AWS SES
Configure your server by:
configuring your database
install Mailtrain
configuring your web server
Configure your Mailtrain setup
Configure AWS SES
Verify your domain
You need to configure the DKIM to certify that the emails sent are indeed from your own domain. DKIM is mandatory, it s the de-facto standard in the mail industry.
Ask to verify your domain
Ask AWS SES to verify a domain
Generate the DKIM settings
Generate the DKIM settings
Use the DKIM settings
Now you have your DKIM settings and Amazon AWS is waiting for finding the TXT field in your DNS zone.
Configure your DNS zone to include DKIM settings
I can t be too specific for this section because it varies A LOT depending on your DNS provider. The keys is: as indicated by the previous image you have to create one TXT record and two CNAME records in your DNS zone. The names, the types and the values are indicated by AWS SES.
If you don t understand what s going here, there is a high probabiliy you ll need a system administrator to apply these modifications and the next ones in this article.
Am I okay for AWS SES ?
As long as the word verified does not appear for your domain, as shown in the image below, something is wrong. Don t wait too long, you have a misconfiguration somewhere.
AWS SES pending verification
When your domain is verified, you ll also receive an email to inform you about the successful verification.
SMTP settings
The last step is generating your credentials to use the AWS SES SMTP server. IT is really straightforward, providing the STMP address to use, the port, and a pair of username/password credentials.
AWS SES SMTP settings and credentials
Just click on Create My SMTP Credentials and follow the instructions. Write the SMTP server address somewhere and store the file with credentials on your computer, we ll need them below.
Configure your server
As we said before, we need a baremetal server or a virtual machine running a recent Linux.
Configure your MySQL/MariaDB database
We create a user mailtrain having all rights on a new database mailtrain.
MariaDB [(none)]> create database mailtrain;
Query OK, 1 row affected (0.00 sec)
MariaDB [(none)]> CREATE USER 'mailtrain' IDENTIFIED BY 'V3rYD1fF1cUlTP4sSW0rd!';
Query OK, 0 rows affected (0.01 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON mailtrain.* TO 'mailtrain'@localhost IDENTIFIED BY 'V3rYD1fF1cUlTP4sSW0rd!';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> show databases;
+--------------------+
Database
+--------------------+
information_schema
mailtrain
mysql
performance_schema
+--------------------+
6 rows in set (0.00 sec)
MariaDB [(none)]> Bye
Configure your web server
I use Nginx and I ll give you the complete setup for it, including generating Let s Encrypt.
Configure Let s Encrypt
You need to stop Nginx as root:
systemctl stop nginx
Then get the certificate only, I ll give the Nginx Vhost configuration:
certbot certonly -d mailtrain.toto.com
Install Mailtrain
On your server create the following directory:
mkdir -p /var/www/ cd /var/www wget https://github.com/Mailtrain-org/mailtrain/archive/refs/tags/v1.24.1.tar.gz tar zxvf v1.24.1.tar.gz
Modify the file /var/www/mailtrain/config/production.toml to use the MySQL settings:
Now Mailtrain is launched and should be running. Yeah I know it s ugly to launch like this (root process in a screen, etc) you can improve security with the following commands:
To register the following systemd unit and to launch the new Mailtrain daemon, use the following commands (do not forget to kill your screen session if you used it before):
Now Mailtrain is running under the classic user mailtrain of the mailtrain system group.
Configure the Nginx Vhost configuration for your domain
Here is my configuration for the Mailtrain Nginx Vhost:
This Nginx vhost will redirect all http requests coming to the Mailtrain process running on the 3000 port. Now it s time to setup Mailtrain!
Setup Mailtrain
You should be able to access your Mailtrain at https://mailtrain.toto.com
Mailtrain is quite simple to configure, Here is my mailer setup. Mailtrain just forwards emails to AWS SES. We only have to plug Mailtrain to AWS SES.
Mailtrain mailer setup
The hostname is provided by AWS SES in the STMP Settings section. Use the 465 port and USE TLS option. Next is providing your AWS SES username and password you generated above and stored somewhere on your computer.
One of the issues I encountered is the AWS SES rate limit. Send too many emails too fast will get you flagged as a spammer.
So I had to throttle Mailtrain. Because I m a lazy man, I asked Pierre-Gilles Leymarie his setup. Quite easier than determining myself the good one. Here is my setup. Works fine for my soon-to-be 4k subscribers. The idea is: if your AWS SES lets you know you send too fast then just slow down.
Mailtrain to throttle sending emails to AWS SES
Conclusion
That s it! You re ready! Almost. You need an HTML template for your newsletter and a list of subscribers. Buf if you re not new in the newsletter field, fleeing Mailchimp because of their expensive prices, you should have them both already.
After sending almost ten issues with this setup, I m really happy with it. Open/click rates are the same.
When leaving Mailchimp, do not leave any list of subscribers because they ll charge you $8 for a 0 to 500 contacts, that s crazy expensive!
About the author
I ve been experimenting with IMA/EVM. Here is the Sourceforge page for the upstream project [1]. The aim of that project is to check hashes and maybe public key signatures on files before performing read/exec type operations on them. It can be used as the next logical step from booting a signed kernel with TPM. I am a long way from getting that sort of thing going, just getting the kernel to boot and load keys is my current challenge and isn t helped due to the lack of documentation on error messages. This blog post started as a way of documenting the error messages so future people who google errors can get a useful result. I am not trying to document everything, just help people get through some of the first problems.
I am using Debian for my work, but some of this will apply to other distributions (particularly the kernel error messages). The Debian distribution has the ima-evm-utils but no other support for IMA/EVM. To get this going in Debian you need to compile your own kernel with IMA support and then boot it with kernel command-line options to enable IMA, in recent kernels that includes lsm=integrity as a mandatory requirement to prevent a kernel Oops after mounting the initrd (there is already a patch to fix this).
If you want to just use IMA (not get involved in development) then a good option would be to use RHEL (here is their documentation) [2] or SUSE (here is their documentation) [3]. Note that both RHEL and SUSE use older kernels so their documentation WILL lead you astray if you try and use the latest kernel.org kernel.
The Debian initrd
I created a script named /etc/initramfs-tools/hooks/keys with the following contents to copy the key(s) from /etc/keys to the initrd where the kernel will load it/them. The kernel configuration determines whether x509_evm.der or x509_ima.der (or maybe both) is loaded. I haven t yet worked out which key is needed when.
To get the below result I used the above script to generate a key, it is the /usr/share/doc/ima-evm-utils/examples/ima-genkey.sh script from the ima-evm-utils package but changed to use the key generated from kernel compilation to sign it. You can copy the files in the certs directory from one kernel build tree to another to have the same certificate and use the same initrd configuration. After generating the key I copied x509_evm.der to /etc/keys on the target host and built the initrd before rebooting.
Errors
Here are some of the kernel error messages I received along with my best interpretation of what they mean.
[ 1.062031] integrity: Loading X.509 certificate: /etc/keys/x509_ima.der
[ 1.063689] integrity: Problem loading X.509 certificate -74
Error -74 means -EBADMSG, which means there s something wrong with the certificate file. I have got that from /etc/keys/x509_ima.der not being in der format and I have got it from a der file that contained a key pair that wasn t signed.
FTP master
Things never turn out the way you expect, so this month I was only able to accept 38 packages and rejected none. Due to the freeze, the overall number of packages that got accepted was 88.
Debian LTS
This was my eighty-first month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian.
This month my all in all workload has been 30h. During that time I did LTS and normal security uploads of:
[DLA 2606-1] lxml security update for one CVE
[DSA 4880-1] lxml security update for one CVE
[DLA 2611-1] ldb security update for two CVEs
[DLA 2612-1] leptonlib security update for four CVEs
I also prepared debdiffs for unstable and/or buster for leptonlib and libebml, which for one reason or another did not result in an upload yet.
Last but not least I did some days of frontdesk duties.
Debian ELTS
This month was the thirty-third ELTS month.
During my allocated time I uploaded:
ELA-388-1 for zeromq3
ELA-390-1 for lxml
ELA-391-1 for jasper
ELA-393-1 for ldb
ELA-394-1 for leptonlib
Last but not least I did some days of frontdesk duties.
Other stuff
On my neverending golang challenge I uploaded (or sponsored for thola dependencies): golang-github-tombuildsstuff-giovanni, golang-github-apparentlymart-go-userdirs, golang-github-apparentlymart-go-shquot, golang-github-likexian-gokit, olang-gopkg-mail.v2, golang-gopkg-redis.v5, golang-github-facette-natsort, golang-github-opentracing-contrib-go-grpc, golang-github-felixge-fgprof, golang-ithub-gogo-status, golang-github-leanovate-gopter, golang-github-opentracing-basictracer-go, golang-github-lightstep-lightstep-tracer-common, golang-github-o-sourcemap-sourcemap, golang-github-igm-pubsub, golang-github-igm-sockjs-go, golang-github-centrifugal-protocol, golang-github-mna-redisc, golang-github-fzambia-eagle, golang-github-centrifugal-centrifuge, golang-github-chromedp-sysutil, golang-github-client9-misspell, golang-github-knq-snaker, cdproto-gen, golang-github-mattermost-xml-roundtrip-validator, golang-github-crewjam-saml, ssllabs-scan, golang-uber-automaxprocs, golang-uber-goleak, golang-github-k0kubun-go-ansi, golang-github-schollz-progressbar, golang-github-komkom-toml, golang-github-labstack-echo, golang-github-inexio-go-monitoringplugin
Debian has work-in-progress packages for Kubernetes, which work well enough enough for a testing and learning environement. Bootstraping a cluster with the kubeadm deployer with these packages is not that hard, and is similar to the upstream kubeadm documentation
Install necessary packages in a VMInstall a throwaway VM with Vagrant.
Install kubernetes binaries. This will install kubelet, the system service which will manage the containers, and kubectl the user/admin tool to manage the cluster.
Although it is not technically mandatory, we will use kubeadm, the most popular installer to create a Kubernetes cluster. Kubeadm is not packaged in Debian, we have to download an upstream binary.
finally we need to help kubelet find the components needed for container networking
echo 'KUBELET_EXTRA_ARGS="--cni-bin-dir=/usr/lib/cni"' sudo tee /etc/default/kubelet
Create a clusterInitialize a cluster with kubeadm: this will download container images for the Kubernetes control plane (= the brain of the cluster), and start the containers via the kubelet service. Yes a good part of Kubernetes itself run in containers.
sudo kubeadm init --pod-network-cidr=10.244.0.0/16 ... ... Your Kubernetes control-plane has initialized successfully!
To start using your cluster, you need to run the following as a regular user:
After a dozen of seconds your node should be in ready status.
kubectl get nodes NAME STATUS ROLES AGE VERSION testing Ready control-plane,master 16m v1.20.5
Deploy a test applicationOur node is now in Ready status, but we cannot run application on it, since we only have a master node, an administrative node which by default cannot run user applications.
curl 192.168.121.63:30000 ... Thank you for using nginx.
NotesI will try to get this blog post in a Debian Wiki article, or maybe in the kubernetes-node documentation. Blog posts deprecate and disappear, wiki and project docs live longer.
Prince Caspian is the second book of the Chronicles of Narnia in
the original publication order (the fourth in the new publication order)
and a direct sequel to The Lion, the Witch
and the Wardrobe. As much as I would like to say you could start here
if you wanted less of Lewis's exploration of secondary-world Christianity
and more children's adventure, I'm not sure it would be a good reading
experience. Prince Caspian rests heavily on the events of
The Lion, the Witch and the Wardrobe.
If you haven't already, you may also want to read
my review of that book for some introductory
material about my past relationship with the series and why I follow the
original publication order.
Prince Caspian always feels like the real beginning of a re-read.
Re-reading The Lion, the Witch and the Wardrobe is okay but a bit
of a chore: it's very random, the business with Edmund drags on, and it's
very concerned with hitting the mandatory theological notes. Prince
Caspian is more similar to the following books and feels like Narnia
proper. That said, I have always found the ending of Prince
Caspian oddly forgettable. This re-read helped me see why: one of the
worst bits of the series is in the middle of this book, and then the
dramatic shape of the ending is very strange.
MAJOR SPOILERS BELOW for both this book and The Lion, the
Witch and the Wardrobe.
Prince Caspian opens with the Pevensie kids heading to school by
rail at the end of the summer holidays. They're saying their goodbyes to
each other at a train station when they are first pulled and then dumped
into the middle of a wood. After a bit of exploration and the discovery
of a seashore, they find an overgrown and partly ruined castle.
They have, of course, been pulled back into Narnia, and the castle is Cair
Paravel, their great capital when they ruled as kings and queens. The
twist is that it's over a thousand years later, long enough that Cair
Paravel is now on an island and has been abandoned to the forest. They
discover parts of how that happened when they rescue a dwarf named
Trumpkin from two soldiers who are trying to drown him near the supposedly
haunted woods.
Most of the books in this series have good hooks, but Prince
Caspian has one of the best. I adored everything about the start of this
book as a kid: the initial delight at being by the sea when they were on
their way to boarding school, the realization that getting food was not
going to be easy, the abandoned castle, the dawning understanding of where
they are, the treasure room, and the extended story about Prince Caspian,
his discovery of the Old Narnia, and his flight from his usurper uncle.
It becomes clear from Trumpkin's story that the children were pulled back
into Narnia by Susan's horn (the best artifact in these books), but
Caspian's forces were expecting the great kings and queens of legend from
Narnia's Golden Age. Trumpkin is delightfully nonplussed at four
school-age kids who are determined to join up with Prince Caspian and
help.
That's the first half of Prince Caspian, and it's a solid magical
adventure story with lots of potential. The ending, alas, doesn't
entirely work. And between that, we get the business with Aslan and Lucy
in the woods, or as I thought of it even as a kid, the bit where Aslan is
awful to everyone for no reason.
For those who have forgotten, or who don't care about spoilers, the kids
plus Trumpkin are trying to make their way to Aslan's How (formerly the
Stone Table) where Prince Caspian and his forces were gathered, when they
hit an unexpected deep gorge. Lucy sees Aslan and thinks he's calling for
them to go up the gorge, but none of the other kids or Trumpkin can see
him and only Edmund believes her. They go down instead, which almost gets
them killed by archers. Then, that night, Lucy wakes up and finds Aslan
again, who tells her to wake the others and follow him, but warns she may
have to follow him alone if she can't convince the others to go along.
She wakes them up (which does not go over well), Aslan continues to be
invisible to everyone else despite being right there, Susan is
particularly upset at Lucy, and everything is awful. But this time they
do follow her (with lots of grumbling and over Susan's objections). This,
of course, is the right decision: Aslan leads them to a hidden path that
takes them over the river they're trying to cross, and becomes visible to
everyone when they reach the other side.
This is a mess. It made me angry as a kid, and it still makes me angry
now. No one has ever had trouble seeing Aslan before, so the kids are
rightfully skeptical. By intentionally deceiving them, Aslan puts the
other kids in an awful position: they either have to believe Lucy is
telling the truth and Aslan is being weirdly malicious, or Lucy is
mistaken even though she's certain. It not only leads directly to
conflict among the kids, it makes Lucy (the one who does all the right
things all along) utterly miserable. It's just cruel and mean, for no
purpose.
It seems clear to me that this is C.S. Lewis trying to make a theological
point about faith, and in a way that makes it even worse because I think
he's making a different point than he intended to make. Why is religious
faith necessary; why doesn't God simply make himself apparent to everyone
and remove the doubt? This is one of the major problems in Christian
apologetics, Lewis chooses to raise it here, and the answer he gives is
that God only shows himself to his special favorites and hides from
everyone else as a test. It's clearly not even a question of intention to
have faith; Edmund has way more faith here than Lucy does (since Lucy
doesn't need it) and still doesn't get to see Aslan properly until
everyone else does. Pah.
The worst part of this is that it's effectively the last we see of Susan.
Prince Caspian is otherwise the book in which Susan comes into her
own. The sibling relationship between the kids is great here in general,
but Susan is particularly good. She is the one who takes bold action to
rescue Trumpkin, risking herself by firing an arrow into the helmet of one
of the soldiers despite being the most cautious of the kids. (And then
gets a little defensive about her shot because she doesn't want anyone to
think she would miss that badly at short range, a detail I just love.) I
identified so much with her not wanting to beat Trumpkin at an archery
contest because she felt bad for him (but then doing it anyway). She is,
in short, awesome.
I was fine with her being the most grumpy and frustrated with the argument
over picking a direction. They're all kids, and sometimes one gets grumpy
and frustrated and awful to the people around you. Once everyone sees
Aslan again, Susan offers a truly excellent apology to Lucy, so it seemed
like Lewis was setting up a redemption arc for her the way that he did for
Edmund in The Lion, the Witch and the Wardrobe (although I maintain
that nearly all of this mess was Aslan's fault). But then we never see
Susan's conversation with Aslan, Peter later says he and Susan are now too
old to return to Narnia, and that's it for Susan. Argh.
I'll have more to say about this later (and it's not an original opinion),
but the way Lewis treats Susan is the worst part of this series, and it
adds insult to injury that it happens immediately after she has a chance
to shine.
The rest of the book suffers from the same problem that The Lion,
the Witch and the Wardrobe did, namely that Aslan fixes everything in a
somewhat surreal wild party and it's unclear why the kids needed to be
there. (This is the book where Bacchus and Silenus show up, there is a
staggering quantity of wine for a children's book, and Aslan turns a bunch
of obnoxious school kids into pigs.) The kids do have more of a role to
play this time: Peter and Edmund help save Caspian, and there's a
(somewhat poorly motivated) duel that sends up the ending. But other than
the brief battle in the How, the battle is won by Aslan waking the trees,
and it's not clear why he didn't do that earlier. The ending is, at best,
rushed and not worthy of its excellent setup. I was also disappointed
that the "wait, why are you all kids?" moment was hand-waved away by
Narnia giving the kids magical gravitas.
Lewis never felt in control of either The Lion, the Witch and the
Wardrobe or Prince Caspian. In both cases, he had a great hook
and some ideas of what he wanted to hit along the way, but the endings are
more sense of wonder and random Aslan set pieces than anything that
follows naturally from the setup. This is part of why I'm not commenting
too much on the sour notes, such as the red dwarves being the good and
loyal ones but the black dwarves being suspicious and only out for
themselves. If I thought bits like that were deliberate, I'd complain
more, but instead it feels like Lewis threw random things he liked about
children's books and animal stories into the book and gave it a good stir,
and some of his subconscious prejudices fell into the story along the way.
That said, resolving your civil war children's book by gathering all the
people who hate talking animals (but who have lived in Narnia for
generations) and exiling them through a magical gateway to a conveniently
uninhabited country is certainly a choice, particularly when you wrote the
book only two years after the
Partition of
India. Good lord.
Prince Caspian is a much better book than The Lion, the Witch
and the Wardrobe for the first half, and then it mostly falls apart. The
first half is so good, though. I want to read the book that this could
have become, but I'm not sure anyone else writes quite like Lewis at his
best.
Followed by The Voyage of the Dawn Treader, which is my absolute
favorite of the series.
Rating: 7 out of 10
Not long ago, I posted a roundup of secure messengers with off-the-grid capabilities. Some conversation followed, which led me to consider some of the problems with P2P protocols.
P2P and Privacy
Brave adopting IPFS has driven a lot of buzz lately. IPFS is essentially a decentralized, distributed web. This concept has a lot of promise. But take a look at the IPFS privacy document. Some things to highlight:
Nodes announce a variety of information essential to the DHT s function including their unique node identifiers (PeerIDs) and the CIDs of data that they re providing and because of this, information about which nodes are retrieving and/or reproviding which CIDs is publicly available.
those DHT queries happen in public. Because of this, it s possible that third parties could be monitoring this traffic to determine what CIDs are being requested, when, and by whom.
nodes unique identifiers are themselves public your PeerID is still a long-lived, unique identifier for your node. Keep in mind that it s possible to do a DHT lookup on your PeerID and, particularly if your node is regularly running from the same location (like your home), find your IP address Additionally, longer-term monitoring of the public IPFS network could yield information about what CIDs your node is requesting and/or reproviding and when.
So in this case, you have traded giving information about what you request to specific sites to giving it to potentially hundreds of untrusted peers, some of which may be logging this for nefarious purposes. Worse, you have a durable PeerID that can be used for tracking and tied to your IP address a data collector s dream. This PeerID, combined with DHT requests and the CIDs (Content ID) of the things you host (implying you viewed them in the past), can be used to establish a picture of what you are requesting now and requested recently.
Similar can be said from everything like Scuttlebutt to GNU Jami; any service that operates on a P2P basis will likely reveal your IP, and tie your identity to it (and your IP address history). In some cases, as with Jami, this would be limited to friends you add; in others, as with Scuttlebutt and IPFS, it could be revealed to anyone.
The advantages of P2P are undeniable and profound, but few are effectively addressing the privacy implications. The one I know of that is, Briar, routes all traffic over Tor; every node is reached by a Tor onion service.
Federation: somewhat better
In a federated model, every client connects to a server, and there are many servers participating in a federation with each other. Matrix and Mastodon are examples of a federated model. In this scenario, only one server your own homeserver can track you by IP. End-to-end encryption is certainly possible in a federated model, and Matrix supports it. This does give a third party (the specific server you use) knowledge of your IP, but that knowledge can be significantly limited.
A downside of this approach is that if your particular homeserver is down, you are unable to communicate. Truly decentralized P2P solutions don t have that problem thought they do have a related one, which is that clients communicating with each other must both be online simultaneously in order for messages to be transmitted, and this can be a real challenge for mobile devices.
Centralization and Signal
Signal is centralized; it has one central server farm, and if it is down, you can t communicate or choose any other server, either. We saw it go down recently after Elon Musk mentioned it.
Still, I recommend Signal for the general public. Here s why.
Signal brings encryption and privacy to meet people where they re at, not the other way around. People don t have to choose a server, it can automatically recognize contacts that use Signal, it has emojis, attachments, secure voice and video calling, and (aside from the Musk incident), it all just works. It feels like, and is, a polished, modern experience with the bells and whistles people are used to.
I m a huge fan of Matrix (aka Element) and even run my own instance. It has huge promise. But it is Not. There. Yet. Why do I saw this about Matrix?
Synapse, the only currently viable Matrix server, is not ready. My Matrix instance hosts ONE person, me. Synapse uses many GB of RAM and 10+GB of disk space. Despite extensive tuning, nothing helped much. It s caused OOMs more than once. It can t be hosted on a Raspberry Pi or even one of the cheaper VPSs.
Now then, how about choosing a Matrix instance? Well, you could just tell a person to use matrix.org. But then it spent a good portion of last year unable to federate with other popular nodes due to Synapse limitations. Or you could pick a random node, but will it be up when someone needs to say my car broke down? Some are run from a dorm computer, some by a team in a datacenter, some by one person with EC2, and you can t really know. Will your homeserver be stable and long-lived? Hard to say.
Voice and video calling are not there yet in Matrix. Matrix has two incompatible video calling methods (Jitsi and built-in), neither work consistently well, both are hard to manage, and both have NAT challenges.
Matrix is so hard to set up on a server that there is matrix-docker-ansible-deploy. This makes it much better, but it is STILL terribly hard to deploy, and very simple things like how do I delete a user or let me shrink down this 30GB database are barely there yet, if at all.
Encryption isn t mandatory in Matrix. E2EE has been getting dramatically better in the last few releases, but it is still optional, especially for what people would call group chats (rooms). Signal is ALWAYS encrypted. Always. (Unless, I guess, you set it as your SMS provider on Android). You ve got to take the responsibility off the user to verify encryption status, and instead make it the one and only way to use the ecosystem.
Again, I love MAtrix. I use it every day to interact with Matrix, IRC, Slack, and Discord channels. It has a ton of promise. But would I count on it to carry a my car s broken down and I m stranded message? No.
How about some of the other options out there? I mentioned Briar above. It s fantastic and its offline options are novel and promising. But in common usage, it can t deliver a message unless both devices are online simultaneously, and doesn t run on iOS (though both are being worked on). It also can t send photos or do voice or video calling.
Some of these same limitations apply to most of the other Signal alternatives also. either that, or they are encryption-optional, or terribly hard to set up and use. I recently mentioned Status, which shows a ton of promise, but has no voice or video calling capabilities. Scuttlebutt is a fantastic protocol with extremely difficult onboarding (lengthy process, error-prone finding a pub, multi-GB initial download, etc.) And many of these leak IP addresses as discussed above.
So Signal gives people:
Dead-simple setup
Store-and-forward delivery (devices need not be online simultaneously)
Encrypted everything, including voice and video calls, and the ability to send photos and video encrypted
If you are going to tell someone, it s so EASY to get your texts away from Facebook and AT&T , then Signal is the thing you ve got to point them to. It may not be in two years, but for now, it is. Do not let the perfect be the enemy of the good. It advances the status quo without harming usability, which nothing else does yet.
I am aware of all of the very legitimate criticisms of Signal. They are real and they are why I am excited that there are so many alternatives with promise, some of which I use actively. Let us technical people use, debug, contribute to, and evangelize the alternatives.
And while we re doing that, tell Grandma to contact us on Signal.
Year 2020. What a year! Sure, already around early January there were rumours/noise about Covid-19, but who would have thought where it will end up! Thankfully, none of my close or extended family was directly (medically) affected by Covid, so I/we had a privileged year compared to so many other people.
I thought how to write a mini-summary, but prose is too difficult, so let s just go month-by-month. Please note that my memory is fuzzy after 9 months cooked up in the apartment, so things could 1 month compared to what I wrote.
Timeline
January
Ski weekend. Skiing is awesome! Cancelling a US work trip since there will be more opportunities soon (har har!).
February
Ski vacation. Yep, skiing is awesome. Can t wait for next season (har har!). Discussions about Covid start in the office, but more is this scary or just interesting? (yes, this was before casualties). Then things start escalating, work-from-home at least partially, etc. etc. Definitely not just intersting anymore.
In Garmin-speak, I got ~700+ intensity minutes in February (correlates with activity time, but depends on intensity of the effort whether 1:1 or 2 intensity minutes for one wall-clock minute).
March
Sometimes during the month, my workplace introduces mandatory WFH. I remember being the last person in our team in the office, on the last day we were allowed to work, and cleaning my desk/etc., thinking all this, and we ll be back in 3 weeks or so . Har har!
I buy a webcam, just in case WFH gets extended. And start to increase my sports - getting double the intensity minutes (1500+).
April
Switzerland enters the first, hard, lockdown. Or was it late March? Not entirely sure, but in my mind March was the opening, and April was the first main course.
It is challenging, having to juggle family and work and stressed schedule, but also interesting. Looking back, I think I liked April the most, as people were actually careful at that time.
I continue upgrading my home office - new sound system, so that I don t have to plug in/plug out cables.
1700+ intensity minutes this month.
May
Continued WFH, somewhat routine now. My then internet provider started sucking hard, so I upgrade with good results. I m still happy, half a year later (quite happy, even).
Still going strong otherwise, but waiting for summer vacation, whatever it will be. A tiny bit more effort, so 1800 intensity minutes in May.
June
Switzerland relaxes the lock down, but not my company, so as the rest of the family goes out and about, I start feeling alone in the apartment. And somewhat angry at it, which impacts my sports (counter-intuitively), so I only get 1500 intensity minutes.
I go and buy a coffee machine a real one, that takes beans and grinds them, so I get to enjoy the smell of freshly-ground coffee and the fun of learning about coffee beans, etc. But it occupies the time.
On the work/job front, I think at this time I finally got a workstation for home, instead of a laptop (which was ultra-portable too), so together with the coffee machine, it feels like a normal work environment. Well, modulo all the people. At least I m not crying anymore every time I open a new tab in Chrome
July
Situation is slowly going better, but no, not my company. Still mandatory WFH, with (if I recall correctly) one day per week allowed, and no meeting other people. I get angrier, but manage to channel my energy into sports, almost doubly my efforts in July - 2937 intensity minutes, not quite reaching the 3000 magic number.
I buy more stuff to clean and take care of my bicycles, which I don t really use. So shopping therapy too.
August
The month starts with a one week family vacation, but I take a bike too, so I manage to put in some effort (it was quite nice riding TBH). A bit of changes in the personal life (nothing unexpected), which complicates things a bit, but at this moment I really thought Switzerland is going to continue to decrease in infections/R-factor/etc. so things will get back to normal, right? My company expands a bit the work-from-office part, so I m optimistic.
Sports wise, still going strong, 2500 intensity minutes, preparing for the single race this year.
September
The personal life changes from August start to stabilise, so things become again routine, and I finally get to do a race. Life was good for an extended weekend (well, modulo race angst, but that s part of the fun), and I feel justified to take it slow the week after the race. And the week after that too.
I end up the month with close, but not quite, 1900 intensity minutes.
October
October starts with school holidays and a one week family vacation, but I feel demotivated. Everything is closing down again (well, modulo schools), and I actually have difficulty getting re-adjusted to no longer being alone in the apartment during the work hours.
I only get ~1000 intensity minutes in October, mainly thanks to good late autumn weather and outside rides. And I start playing way more computer games. I also sell my PS4, hoping to get a PS5 next month.
November
November continues to suck. I think my vacation in October was actually detrimental - it broke my rhythm, I don t really do sport anymore, not consistently at least, so I only get 700+ intensity minutes. And I keep playing computer games, even if I missed the PS5 ordering window; so I switch to PC gaming.
My home office feels very crowded, so as kind of anti-shopping therapy, I sell tons of smallish stuff; can t believe how much crap I kept around while not really using it.
I also manage to update/refresh all my Debian packages, since next freeze approaches. Better than for previous releases, so it feels good.
December
December comes, end of the year, the much awaited vacation - which we decide to cancel due to the situation in whole of Switzerland (and neighbouring countries). I basically only play computer games, and get grand total of 345 activity minutes this month.
And since my weight is inversely correlated to my training, I m basically back at my February weight, having lost all the gains I made during the year. I mean, having gained back all the fat I lost. Err, you know what I mean; I m back close to my high-watermark, which is not good.
Conclusion
I was somehow hoping that the end of the year will allow me to reset and restart, but somehow - a few days into January - it doesn t really feel so. My sleep schedule is totally ruined, my motivation is so-so, and I think the way I crashed in October was much harder/worse than I realised at the time, but in a way expected for this crazy year.
I have some projects for 2021 - or at least, I m trying to make up a project list - in order to get a bit more structure in my continued stuck inside the house part, which is especially terrible when on-call. I don t know how the next 3-6 months will evolve, but I m thankful that so far, we are all healthy. Actually, me personally I ve been healthier physically than in other years, due to less contact with other people.
On the other side, thinking of all the health-care workers, or even service workers, my IT job is comfy and all I am is a spoiled person (I could write many posts on specifically this topic). I really need to up my willpower and lower my spoil level. Hints are welcome :(
Wish everybody has a better year in 2021.
I have updated my debpkg plugin for IDEA (e.g. IntelliJ, PyCharm, Android Studios) to v0.0.8. Here are some of the changes since last time I wrote about the plugin.
New file types supported
.dsc (as a generic deb822 file)
.buildinfo and .changes (as a generic deb822 provided the base name looks like it follows the package_version_arch pattern)
debian/copyright (as a DEP-5 / machine-readable copyright file if the Format field exists).
Links for URLs and bug closes
There are often links in deb822 files or the debian/changelog and as of v0.0.8, the plugin will now highlight them and able you to easily open them via your browser. In the deb822 case, they generally appear in the Homepage field, the Vcs-* fields or the Format field of the debian/copyright field. For the changelog file, they often appear in the form of bug Closes statements such as the #123456 in Closes: #123456 , which is a reference to https://bugs.debian.org/123456.
Improvements to debian/control
The dependency validator now has per-field knowledge. This enables it to flag dependency relations in the Provides field that uses operators other than = (which is the only operator that is supported in that field). It also knows which fields support build-profile restrictions. It in theory also do Architecture restrictions, but I have not added it among other because it gets a bit spicy around binary packages. (Fun fact, you can have Depends: foo [amd64] but only for arch:any packages.)
The plugin now suggests adding a Rules-Requires-Root field to the Source stanza along with a quick fix for adding the field. Admittedly, it was mostly done as exercise for me to learn how to do that kind of feature.
Support for machine-readable debian/copyright
The plugin now has a dedicated file type for debian/copyright that follows the machine-readable format. It should auto-detect it automatically based on the presence of the Format field being set to https://www.debian.org/doc/packaging-manuals/copyright-format/1.0. Sadly, I have not found the detection reliable in all cases, so you may have to apply it manually.
With the copyright format, the plugin now scans the Files fields for common issues like pointing on non-existing paths and invalid escape sequences. When the plugin discovers a path that does not match anything, it highlights the part of the path that cannot be found. As an example, consider the pattern src/foo/data.c and that src/foo exist but data.c does not exist, then the plugin will only flag the data.c part of src/foo/data.c as invalid.
The plugin will also suggest a quick fix if you a directory into the Files field to replace it with a directory wildcard (e.g. src/foo -> src/foo/* ), which is how the spec wants you to reference every file beneath a given directory.
Finally, when the plugin can identify part of the path, then it will turn it into a link (reference in IDEA lingo). This means that you can CTRL + click on it to jump to the file. As a side-effect, it also provides refactoring assistance for renaming files, where renaming a file will often be automatically reflected in debian/copyright. This use case is admittedly mostly relevant people, who are both upstream and downstream maintainer.
Folding support improvement for .dsc/.changes/.buildinfo files
The new field types appeared with two cases, where I decided to improve the folding support logic.
The first was the GPG signature (if present), which consists of two parts. The top part with is mostly a single line marker but often followed by a GPG armor header (e.g. Hash: SHA512 ) and then the signature blob with related marker lines around it. Both cases are folded into a single marker line by default to reduce their impact on content in the editor view.
The second case was the following special-case pattern:
For all other multi-line fields, the plugin still falls back to a list of known fields to fold by default as in previous versions.
Spellchecking improvements
The plugin already supported selective spell checking in v0.0.3, where it often omitted spell checking for fields (in deb822 files) where it did not make sense. The spell check feature has been improved by providing a list of known packaging terms/jargo used by many contributors (so autopkgtests is no longer considered a typo). This applies to all file types (probably also those not handled by the plugin as it is just a dictionary).
Furthermore, the plugin also attempts discover common patterns (e.g. file names or command arguments) and exempt these from spell checking in the debian/changelog. This also includes manpage references such as foo.1 or foo(1) . It is far from perfect and relies on common patterns to exclude spell checking. Nonetheless, it should reduce the number of false positive considerably.
Feedback welcome
Please let me know if you run into bugs or would like a particular feature implemented. You can submit bug reports and feature requests in the issue tracker on github.
A few years ago, the advertising industry introduced the ads.txt
project in order to defend against
widespread domain spoofing vulnerabilities in programmatic
advertising.
I decided to use this technology to opt out of having ads sold for my
domains, at least through ad exchanges which perform this check, by hosting
a text file containing this:
(In order to get this to work on my blog, running
Ikiwiki on
Branchable, I had to disable the txt
plugin in order to get ads.txt to be
served as a plain text file instead of being automatically rendered as
HTML.)
Specification
The key parts of the specification for our purposes are:
[3.1] If the server response indicates the resource does not exist (HTTP
Status Code 404), the advertising system can assume no declarations exist
and that no advertising system is unauthorized to buy and sell ads on the
website.
[3.2.1] Some publishers may choose to not authorize any advertising system
by publishing an empty ads.txt file, indicating that no advertising system
is authorized to buy and sell ads on the website. So that consuming systems
properly read and interpret the empty file (differentiating between web
servers returning error pages for the /ads.txt URL), at least one properly
formatted line must be included which adheres to the format specification
described above.
As you can see, the specification sadly ignores
RFC8615 and requires that the
ads.txt file be present directly in the root of your web server, like the
venerable robots.txt file, but unlike the
newer security.txt standard.
If you don't want to provide an email address in your ads.txt file, the
specification recommends using the following line verbatim:
This article documents how to install FORT Validator (an RPKI relying party software which also implements the RPKI to Router protocol in a single daemon) on Debian 10 to provide RPKI validation to routers. If you are using testing or unstable then you can just skip the part about apt pinnings.
The packages in bullseye (Debian testing) can be installed as is on Debian stable with no need to rebuild them, by configuring an appropriate pinning for apt:
cat <<END > /etc/apt/sources.list.d/bullseye.list
deb http://deb.debian.org/debian/ bullseye main
END
cat <<END > /etc/apt/preferences.d/pin-rpki
# by default do not install anything from bullseye
Package: *
Pin: release bullseye
Pin-Priority: 100
Package: fort-validator rpki-trust-anchors
Pin: release bullseye
Pin-Priority: 990
END
apt update
Before starting, make sure that curl (or wget) and the web PKI certificates are installed:
apt install curl ca-certificates
If you already know about the legal issues related to the ARIN TAL then you may instruct the package to automatically install it. If you skip this step then you will be asked at installation time about it, either way is fine.
This article documents how to install rpki-client (an RPKI relying party software, the actual validator) and gortr (which implements the RPKI to Router protocol) on Debian 10 to provide RPKI validation to routers. If you are using testing or unstable then you can just skip the part about apt pinnings.
The packages in bullseye (Debian testing) can be installed as is on Debian stable with no need to rebuild them, by configuring an appropriate pinning for apt:
cat <<END > /etc/apt/sources.list.d/bullseye.list
deb http://deb.debian.org/debian/ bullseye main
END
cat <<END > /etc/apt/preferences.d/pin-rpki
# by default do not install anything from bullseye
Package: *
Pin: release bullseye
Pin-Priority: 100
Package: gortr rpki-client rpki-trust-anchors
Pin: release bullseye
Pin-Priority: 990
END
apt update
Before starting, make sure that curl (or wget) and the web PKI certificates are installed:
apt install curl ca-certificates
If you already know about the legal issues related to the ARIN TAL then you may instruct the package to automatically install it. If you skip this step then you will be asked at installation time about it, either way is fine.
Previously: v5.6
Linux v5.7 was released at the end of May. Here s my summary of various security things that caught my attention:
arm64 kernel pointer authentication
While the ARMv8.3 CPU Pointer Authentication (PAC) feature landed for userspace already, Kristina Martsenko has now landed PAC support in kernel mode. The current implementation uses PACIASP which protects the saved stack pointer, similar to the existing CONFIG_STACKPROTECTOR feature, only faster. This also paves the way to sign and check pointers stored in the heap, as a way to defeat function pointer overwrites in those memory regions too. Since the behavior is different from the traditional stack protector, Amit Daniel Kachhap added an LKDTM test for PAC as well.
BPF LSM
The kernel s Linux Security Module (LSM) API provide a way to write security modules that have traditionally implemented various Mandatory Access Control (MAC) systems like SELinux, AppArmor, etc. The LSM hooks are numerous and no one LSM uses them all, as some hooks are much more specialized (like those used by IMA, Yama, LoadPin, etc). There was not, however, any way to externally attach to these hooks (not even through a regular loadable kernel module) nor build fully dynamic security policy, until KP Singh landed the API for building LSM policy using BPF. With this, it is possible (for a privileged process) to write kernel LSM hooks in BPF, allowing for totally custom security policy (and reporting).
execve() deadlock refactoring
There have been a number of long-standing races in the kernel s process launching code where ptrace could deadlock. Fixing these has been attempted several times over the last many years, but Eric W. Biederman and Ernd Edlinger decided to dive in, and successfully landed the a series of refactorings, splitting up the problematic locking and refactoring their uses to remove the deadlocks. While he was at it, Eric also extended the exec_id counter to 64 bits to avoid the possibility of the counter wrapping and allowing an attacker to send arbitrary signals to processes they normally shouldn t be able to.
slub freelist obfuscation improvements
After Silvio Cesare observed some weaknesses in the implementation of CONFIG_SLAB_FREELIST_HARDENED s freelist pointer content obfuscation, I improved their bit diffusion, which makes attacks require significantly more memory content exposures to defeat the obfuscation. As part of the conversation, Vitaly Nikolenko pointed out that the freelist pointer s location made it relatively easy to target too (for either disclosures or overwrites), so I moved it away from the edge of the slab, making it harder to reach through small-sized overflows (which usually target the freelist pointer). As it turns out, there were a few assumptions in the kernel about the location of the freelist pointer, which had to also get cleanedup.
RISCV page table dumping
Following v5.6 s generic page table dumping work, Zong Li landed the RISCV page dumping code. This means it s much easier to examine the kernel s page table layout when running a debug kernel (built with PTDUMP_DEBUGFS), visible in /sys/kernel/debug/kernel_page_tables.
array index bounds checking
This is a pretty large area of work that touches a lot of overlapping elements (and history) in the Linux kernel. The short version is: C is bad at noticing when it uses an array index beyond the bounds of the declared array, and we need to fix that. For example, don t do this:
int foo[5];
...
foo[8] = bar;
The long version gets complicated by the evolution of flexible array structure members, so we ll pause for a moment and skim the surface of this topic. While things like CONFIG_FORTIFY_SOURCE try to catch these kinds of cases in the memcpy() and strcpy() family of functions, it doesn t catch it in open-coded array indexing, as seen in the code above. GCC has a warning (-Warray-bounds) for these cases, but it was disabled by Linus because of all the false positives seen due to fake flexible array members. Before flexible arrays were standardized, GNU C supported zero sized array members. And before that, C code would use a 1-element array. These were all designed so that some structure could be the header in front of some data blob that could be addressable through the last structure member:
Converting all the zero- and one-element array members to flexible arrays is one of Gustavo A. R. Silva s goals, and hundreds of these changes started landing. Once fixed, -Warray-bounds can be re-enabled. Much more detail can be found in the kernel s deprecation docs.
However, that will only catch the visible at compile time cases. For runtime checking, the Undefined Behavior Sanitizer has an option for adding runtime array bounds checking for catching things like this where the compiler cannot perform a static analysis of the index values:
int foo[5];
...
for (i = 0; i < some_argument; i++)
...
foo[i] = bar;
...
It was, however, not separate (via kernel Kconfig) until Elena Petrova and I split it out into CONFIG_UBSAN_BOUNDS, which is fast enough for production kernel use. With this enabled, it's now possible to instrument the kernel to catch these conditions, which seem to come up with some regularity in Wi-Fi and Bluetooth drivers for some reason. Since UBSAN (and the other Sanitizers) only WARN() by default, system owners need to set panic_on_warn=1 too if they want to defend against attacks targeting these kinds of flaws. Because of this, and to avoid bloating the kernel image with all the warning messages, I introduced CONFIG_UBSAN_TRAP which effectively turns these conditions into a BUG() without needing additional sysctl settings.
Fixing "additive" snprintf() usage
A common idiom in C for building up strings is to use sprintf()'s return value to increment a pointer into a string, and build a string with more sprintf() calls:
/* safe if strlen(foo) + 1 < sizeof(string) */
wrote = sprintf(string, "Foo: %s\n", foo);
/* overflows if strlen(foo) + strlen(bar) > sizeof(string) */
wrote += sprintf(string + wrote, "Bar: %s\n", bar);
/* writing way beyond the end of "string" now ... */
wrote += sprintf(string + wrote, "Baz: %s\n", baz);
The risk is that if these calls eventually walk off the end of the string buffer, it will start writing into other memory and create some bad situations. Switching these to snprintf() does not, however, make anything safer, since snprintf() returns how much it would have written:
/* safe, assuming available <= sizeof(string), and for this example
* assume strlen(foo) < sizeof(string) */
wrote = snprintf(string, available, "Foo: %s\n", foo);
/* if (strlen(bar) > available - wrote), this is still safe since the
* write into "string" will be truncated, but now "wrote" has been
* incremented by how much snprintf() *would* have written, so "wrote"
* is now larger than "available". */
wrote += snprintf(string + wrote, available - wrote, "Bar: %s\n", bar);
/* string + wrote is beyond the end of string, and availabe - wrote wraps
* around to a giant positive value, making the write effectively
* unbounded. */
wrote += snprintf(string + wrote, available - wrote, "Baz: %s\n", baz);
So while the first overflowing call would be safe, the next one would be targeting beyond the end of the array and the size calculation will have wrapped around to a giant limit. Replacing this idiom with scnprintf() solves the issue because it only reports what was actually written. To this end, Takashi Iwai has been landing a bunch scnprintf() fixes.
That's it for now! Let me know if there is anything else you think I should mention here. Next up: Linux v5.8.
Lower Ed (subtitled The Troubling Rise of For-Profit Colleges
in the New Economy) is the first book by sociologist Tressie McMillan
Cottom. (I previously reviewed her second book, the excellent essay
collection Thick.) It is a deep look at
the sociology of for-profit higher education in the United States based on
interviews with students and executives, analysis of Wall Street filings,
tests of the admissions process, and her own personal experiences working
for two of the schools. One of the questions that McMillan Cottom tries
to answer is why students choose to enroll in these institutions,
particularly the newer type of institution funded by federal student loans
and notorious for being more expensive and less valuable than non-profit
colleges and universities.
I was hesitant to read this book because I find for-profit schools
depressing. I grew up with the ubiquitous commercials, watched the
backlash develop, and have a strongly negative impression of the industry,
partly influenced by having worked in traditional non-profit higher
education for two decades. The prevailing opinion in my social group is
that they're a con job. I was half-expecting a reinforcement of that
opinion by example, and I don't like reading infuriating stories about
people being defrauded.
I need not have worried. This is not that sort of book (nor, in
retrospect, do I think McMillan Cottom would approach a topic from that
angle). Sociology is broader than reporting. Lower Ed positions
for-profit colleges within a larger social structure of education,
credentialing, and changes in workplace expectations; takes a deep look at
why they are attractive to their students; and humanizes and complicates
the motives and incentives of everyone involved, including administrators
and employees of for-profit colleges as well as the students. McMillan
Cottom does of course talk about the profit motive and the deceptions
surrounding that, but the context is less that of fraud that people are
unable to see through and more a balancing of the drawbacks of a set of
poor choices embedded in institutional failures.
One of my metrics for a good non-fiction book is whether it introduces me
to a new idea that changes how I analyze the world. Lower Ed does
that twice.
The first idea is the view of higher education through the lens of risk
shifting. It used to be common for employers to hire people without prior
job-specific training and do the training in-house, possibly through an
apprenticeship structure. More notably, once one was employed by a
particular company, the company routinely arranged or provided ongoing
training. This went hand-in-hand with a workplace culture of long tenure,
internal promotion, attempts to avoid layoffs, and some degree of mutual
loyalty. Companies expected to invest significantly in an employee over
their career and thus also had an incentive to retain that employee rather
than train someone for a competitor.
However, from a purely financial perspective, this is a risk and an
inefficiency, similar to the risk of carrying a large inventory of parts
and components. Companies have responded to investor-driven focus on
profits and efficiency by reducing overhead and shifting risk. This leads
to the lean supply chain, where no one pays for parts to sit around in
warehouses and companies aren't caught with large stockpiles of
now-useless components, but which is more sensitive to any disruption
(such as from a global pandemic). And, for employment, it leads to a
desire to hire pre-trained workers, retain only enough workers to do the
current amount of work, and replace them with new workers who already have
appropriate training rather than retrain them.
The effect of the corporate decision to only hire pre-trained employees is
to shift the risk and expense of training from the company to the
prospective employee. The individual has to seek out training at their
own expense in the hope (not guarantee) that at the conclusion of that
training they will get or retain a job. People therefore turn to higher
education to both provide that training and to help them decide what type
of training will eventually be valuable. This has a long history with
certain professional fields (doctors and lawyers, for example), but the
requirements for completing training in those fields are relatively clear
(a professional license to practice) and the compensation reflects the
risk. What's new is the shift of training risk to the individual in more
mundane jobs, without any corresponding increase in compensation.
This, McMillan Cottom explains, is the background for the growth in demand
for higher education in general and the the type of education offered by
for-profit colleges in particular. Workers who in previous eras would be
trained by their employers are now responsible for their own training.
That training is no longer judged by the standards of a specific
workplace, but is instead evaluated by a hiring process that expects
constant job-shifting. This leads to increased demand by both workers and
employers for credentials: some simple-to-check certificate of completion
of training that says that this person has the skills to immediately start
doing some job. It also leads to a demand for more flexible class hours,
since the student is now often someone older with a job and a family to
balance. Their ongoing training used to be considered a cost of business
and happen during their work hours; now it is something they have to fit
around the contours of their life because their employer has shifted that
risk to them.
The risk-shifting frame makes sense of the "investment" language so common
in for-profit education. In this job economy, education as investment is
not a weird metaphor for the classic benefits of a liberal arts education:
broadened perspective, deeper grounding in philosophy and ethics, or
heightened aesthetic appreciation. It's an investment in the literal
financial sense; it is money that you spend now in order to get a
financial benefit (a job) in the future. People have to invest in their
own training because employers are no longer doing so, but still require
the outcome of that investment. And, worse, it's primarily a
station-keeping investment. Rather than an optional expenditure that
could reap greater benefits later, it's a mandatory expenditure to
prevent, at best, stagnation in a job paying poverty wages, and at worst
the disaster of unemployment.
This explains renewed demand for higher education, but why for-profit
colleges? We know they cost more and have a worse reputation (and
therefore their credentials have less value) than traditional non-profit
colleges. Flexible hours and class scheduling explains some of this but
not all of it. That leads to the second perspective-shifting idea I got
from Lower Ed: for-profit colleges are very good at what they focus
time and resources on, and they focus on enrolling students.
It is hard to enroll in a university! More precisely, enrolling in a
university requires bureaucracy navigation skills, and those skills are
class-coded. The people who need them the most are the least likely to
have them.
Universities do not reach out to you, nor do they guide you through the
process. You have to go to them and discover how to apply, something that
is often made harder by the confusing state of many university web sites.
The language and process is opaque unless other people in your family have
experience with universities and can explain it. There might be someone
you can reach on the phone to ask questions, but they're highly unlikely
to proactively guide you through the remaining steps. It's your
responsibility to understand deadlines, timing, and sequence of
operations, and if you miss any of the steps (due to, for example, the
overscheduled life of someone in need of better education for better job
prospects), the penalty in time and sometimes money can be substantial.
And admission is just the start; navigating financial aid, which most
students will need, is an order of magnitude more daunting. Community
colleges are somewhat easier (and certainly cheaper) than universities,
but still have similar obstacles (and often even worse web sites).
It's easy for people like me, who have long professional expertise with
bureaucracies, family experience with higher education, and a support
network of people to nag me about deadlines, to underestimate this. But
the application experience at a for-profit college is entirely different
in ways far more profound than I had realized. McMillan Cottom documents
this in detail from her own experience working for two different
for-profit colleges and from an experiment where she indicated interest in
multiple for-profit colleges and then stopped responding before signing
admission paperwork. A for-profit college is fully invested in helping a
student both apply and get financial aid, devotes someone to helping them
through that process, does not expect them to understand how to navigate
bureaucracies or decipher forms on their own, does not punish unexpected
delays or missed appointments, and goes to considerable lengths to try to
keep anyone from falling out of the process before they are enrolled.
They do not expect their students to already have the skills that one
learns from working in white-collar jobs or from being surrounded by
people who do. They provide the kind of support that an educational
institution should provide to people who, by definition, don't understand
something and need to learn.
Reading about this was infuriating. Obviously, this effort to help people
enroll is largely for predatory reasons. For-profit schools make their
money off federal loans and they don't get that money unless they can get
someone to enroll and fill out financial paperwork (and to some extent
keep them enrolled), so admissions is their cash cow and they act
accordingly. But that's not why I found it infuriating; that's just
predictable capitalism. What I think is inexcusable is that nothing they
do is that difficult. We could being doing the same thing for prospective
community college students but have made the societal choice not to. We
believe that education is valuable, we constantly advocate that people get
more job training and higher education, and yet we demand prospective
students navigate an unnecessarily baroque and confusing application
process with very little help, and then stereotype and blame them for
failing to do so.
This admission support is not a question of resources. For-profit
colleges are funded almost entirely by federally-guaranteed student loans.
We are paying them to help people apply. It is, in McMillan
Cottom's term, a negative social insurance program. Rather than buffering
people against the negative effects of risk-shifting of employers by
helping them into the least-expensive and most-effective training programs
(non-profit community colleges and universities), we are spending tax
dollars to enrich the shareholders of for-profit colleges while
underfunding the alternatives. We are choosing to create a gap that routes
government support to the institution that provides worse training at
higher cost but is very good at helping people apply. It's as if the
unemployment system required one to use payday lenders to get one's
unemployment check.
There is more in this book I want to talk about, but this review is
already long enough. Suffice it to say that McMillan Cottom's analysis
does not stop with market forces and the admission process, and the parts
of her analysis that touch on my own personal experience as someone with a
somewhat unusual college path ring very true. Speaking as a former
community college student, the discussion of class credit transfer
policies and the way that institutional prestige gatekeeping and the
desire to push back against low-quality instruction becomes a trap that
keeps students in the for-profit system deserves another review this
length. So do the implications of risk-shifting and credentialism on the
morality of "cheating" on schoolwork.
As one would expect from the author of the essay
"Thick" about bringing context to sociology, Lower Ed is personal
and grounded. McMillan Cottom doesn't shy away from including her own
experiences and being explicit about her sources and research. This is
backed up by one of the best methodological notes sections I've seen in a
book. One of the things I love about McMillan Cottom's writing is that
it's solidly academic, not in the sense of being opaque or full of jargon
(the text can be a bit dense, but I rarely found it hard to follow), but
in the sense of being clear about the sources of knowledge and her methods
of extrapolation and analysis. She brings her receipts in a refreshingly
concrete way.
I do have a few caveats. First, I had trouble following a structure and
line of reasoning through the whole book. Each individual point is
meticulously argued and supported, but they are not always organized into
a clear progression or framework. That made Lower Ed feel at times
like a collection of high-quality but somewhat unrelated observations
about credentials, higher education, for-profit colleges, their student
populations, their business models, and their relationships with
non-profit schools.
Second, there are some related topics that McMillan Cottom touches on but
doesn't expand sufficiently for me to be certain I understood them. One
of the big ones is credentialism. This is apparently a hot topic in
sociology and is obviously important to this book, but it's referenced
somewhat glancingly and was not satisfyingly defined (at least for me).
There are a few similar places where I almost but didn't quite follow a
line of reasoning because the book structure didn't lay enough foundation.
Caveats aside, though, this was meaty, thought-provoking, and eye-opening,
and I'm very glad that I read it. This is a topic that I care more about
than most people, but if you have watched for-profit colleges with
distaste but without deep understanding, I highly recommend Lower
Ed.
Rating: 8 out of 10
Keepalived is a Linux implementation of VRRP. The usual role
of VRRP is to share a virtual IP across a set of routers. For each
VRRP instance, a leader is elected and gets to serve the IP address,
ensuring the high availability of the attached service. Keepalived
can also be used for a generic leader election, thanks to its
ability to use scripts for healthchecking and run commands on state
change.
A simple configuration looks like this:
The state keyword in instructs Keepalived to not take the leader
role when starting. Otherwise, incoming nodes create a temporary
disruption by taking over the IP address until the election settles.
The interface keyword in defines the interface for sending and
receiving VRRP packets. It is also the default interface to configure
the virtual IP address. The virtual_router_id directive in is
common to all nodes sharing the virtual IP. The priority keyword in
helps choosing which router will be elected as leader. If you need
more information around Keepalived, be sure to check the
documentation.
VRRP design is tied to Ethernet networks and requires a
multicast-enabled network for communication between nodes. In some
environments, notably public clouds, multicast is unavailable. In this
case, Keepalived can send VRRP packets using unicast:
vrrp_instance gateway1
state BACKUP
interface eth0
virtual_router_id 12
priority 101 unicast_peer 2001:db8::112001:db8::12 virtual_ipaddress 2001:db8:ff/64 dev lo
Another process, like a BGP daemon, should advertise the virtual IP
address to the network . If needed, Keepalived can trigger whatever
action is needed for this by using notify_* scripts.
Until version 2.21 (not released yet), the interface directive is
mandatory and Keepalived will transmit and receive VRRP packets on
this interface only. If peers are reachable through several
interfaces, like on a BGP on the host setup, you need a
workaround. A simple one is to use a VXLAN interface:
$ ip -6 link add keepalived6 type vxlan id 6 dstport 4789local2001:db8::10 nolearning
$ bridge fdb append 00:00:00:00:00:00 dev keepalived6 dst 2001:db8::11
$ bridge fdb append 00:00:00:00:00:00 dev keepalived6 dst 2001:db8::12
$ ip link set up dev keepalived6
Learning of MAC addresses is disabled and one generic entry for each
peer is added in the forwarding database: transmitted packets are
broadcasted to all peers, notably VRRP packets. Have a look at
VXLAN & Linux for additional details.
vrrp_instance gateway1
state BACKUP
interface keepalived6
mcast_src_ip 2001:db8::10 virtual_router_id 12
priority 101
virtual_ipaddress 2001:db8:ff/64 dev lo
Starting from Keepalived 2.21, unicast_peer can be used without
the interface directive. I think using VXLAN is still a
neat trick applicable to other situations where communication using
broadcast or multicast is needed, while the underlying network provide
no support for this.
The publisher MDPI is a spammer and lies.
If you upload a paper draft to arXiv, MDPI will send spam to the authors
to solicit submission. Within minutes of an upload I received the
following email (sent by MDPI staff, not some overly eager new editor):
We read your recent manuscript "[...]" on
arXiv, and sincerely invite you to submit it to our journal Future
Internet, if it has not been published or submitted elsewhere.
Future Internet (ISSN 1999-5903, indexed by Scopus, Ei compendex,
*ESCI*-Web of Science) is a journal on Internet technologies and the
information society. It maintains a rigorous and fast peer review system
with a median publication time of 35 days from submission to online
publication, and 3 days from acceptance to publication. The journal
scope is shown here:
https://www.mdpi.com/journal/futureinternet/about.
Editorial Board: https://www.mdpi.com/journal/futureinternet/editors.
Since Future Internet is an open access journal there is a publication
fee. Your paper will be published, with a 20% discount (amounting to 200
CHF), and provided that it is accepted after our standard peer-review
procedure.
First of all, the email begins with a lie. Because this paper clearly
states that it is submitted elsewhere. Also, it fits other journals
much better, and if they had read even just the abstract, they would have
known.
This is predatory behavior by MDPI. Clearly, it is just about getting as
many submissions as possible. The journal charges 1000 CHF (next year, 1400
CHF) to publish the papers. Its about the money.
Also, there have been reports that MDPI ignores the reviews, and always
publishes even when reviewers recommended rejection
The reviewer requests I have received from MDPI came with unreasonable
deadlines, which will not allow for a thorough peer review. Hence I asked
to not ever be emailed by them again. I must assume that many other qualified
reviewers do the same. MDPI boasts in their 2019 annual report a median
time to first decision of 19 days in my discipline the typical time window
to ask for reviews is at least a month (for shorter conference papers, not
full journal articles), because professors tend to have lots of other
duties, hence they need more flexibility. Above paper has been submitted in
March, and is now under review for 4 months already. This is an annoying long
time window, and I would appreciate if this were less, but it shows how
extremely short the MDPI time frame is. They also claim 269.1k submissions
and 106.2k published papers, so the acceptance rate is around 40% on average,
and assuming that there are some journals with higher standards there then some
must have acceptance rates much higher than this. I d assume that many
reputable journals have 40% desk-rejection rate for papers that are not even
on-topic
The average cost to authors is given as 1144 CHF (after discounts, 25% waived
feeds etc.), so they, so we are talking about 120 million CHF of revenue from
authors. Is that what you want academic publishing to be?
I am not happy with some of the established publishers such as Elsevier that
also overcharge universities heavily. I do think we need to change academic
publishing, and arXiv is a big improvement here.
But I do not respect publishers such as MDPI that lie and send spam.
XMPP is widely - and mabye better - known as Jabber. This was more or less the same until Cisco bought Jabber Inc and the trademark. You can read more about the story on the XMPP.org website. But is there still a Jabber around? Yes, it is!
But Cisco Jabber is a whole infrastructure environment: you can't use Cisco Jabber client on its own without the other required Cisco infrastructure as Cisco CUCM and CIsco IM&P servers. So you can't just setup Prosody or ejabberd on your Debian server and connect Cisco Jabber to it. But what are the differences of Cisco Jabber to "standard" XMPP clients?
Cisco Jabber
The above screenshot from the official Cisco Jabber product webpage shows the new, single view layout of the Cisco Webex Teams client, but you can configure the client to have the old, classic split view layout of Contact List and Chat Window. But as you can already see from above screenshot audio & video calls is one of the core functions of Cisco Jabber whereas this feature has been added only lately to the well-known Conversations XMPP client on Android. Conversations is using Jingle extension to XMPP whereas Jabber uses SIP for voice/video calls. You can even use Cisco Jabber to control your deskphone via CTI, which is a quite common setup for Jabber. In fact you can configure Jabber to be just a CTI client to you phone or a fully featured UC client.
When you don't want to have Ciscos full set of on-premise servers, you can also use Cisco Jabber in conjunction with Cisco Webex as Cisco Webex Messenger. Or in conjunction with Webex Teams in Teams Messaging Mode. Last month Cisco announced general availability of XMPP federation for Webex Teams/Jabber in Teams Messaging Mode. With that you have basic functionality in Webex Teams. And when I say "basic" I really mean basic: you can have 1:1 chat only, no group chats (MUC) and no Presence status will be possible. Hopefully this is just the beginning and not the end of XMPP support in Webex Teams.
XMPP Clients
Well, I'm sure many of you know "normal" XMPP clients such as Gajim or Dino on Linux, Conversations on Android or Siskin/Monal/ChatSecure on Apple IOS. There are plenty of other clients of course and maybe you used an XMPP client in the past without knowing it. For example Jitsi Meet is based on XMPP and you can still download the Jitsi Desktop client and use it as a full-featured multi-protocol client, e.g. for XMPP and SIP. In fact Jitsi Desktop is maybe the client that comes closest to Cisco Jabber as a chat/voice/video client. In fact I already connected Jitsi Desktop to Cisco CUCM/IM&P infrastructure, but of course you won't be able to use all those Cisco proprietary extensions, but you can see the benefit of open, standardized protocols such as XMPP and SIP: you are free to use any standard compliant client that you want.
So, while Jitsi supported voice/video calls for a long time, even before they focussed on Jitsi Meet as a WebRTC based conference service, Conversations added this feature last month, as already stated. This had a huge effect to the whole XMPP federation, because you need an XMPP server that supports XEP-0215 to make these audio/video calls work. The well-known Compliance Tester listed the STUN/TURN features first as "Informational Tests", but quickly made this a mandatory test to pass tests and gain 100% on the Compliance Tester. But you cannot place SIP calls to other sides, because that's a different thing.
As many of you are familiar with standard XMPP clients, I'll focus now on some similarity and differences between Cisco Jabber and standard XMPP...
Similarities & Differences
First, you can federate with Cisco Jabber users. Cisco IM&P can use standard XMPP federation with all other XMPP standard compliant servers. This is really a big benefit and way better than other solutions that usually results in vendor lock-in. Depending on the setup, you can even join from your own XMPP client in MUCs (Multi User Chats), which Cisco calls "Persistent Chat Room". The other way is not that simple: basically it is possible to join with Cisco Jabber in a MUC on a random server, but it is not as easy as you might thing. Cisco Jabber simply lacks a way to enter a room JID (as you can find them on https://search.jabber.network/. Instead you need to be added as participant by a moderator or an admin in that 3rd party MUC.
Managed File Transfers is another issue. Cisco Jabber supports Peer-to-Peer file transfers and Managed File Transfers, where the uploaded file get transferred to an SFTP server as storage backend and where the IM&P server is handling the transfer via HTTPS. You can find a schematic drawing in the Configuration Guides. Although it appears similar to HTTP Upload as defined in XEP-0363, it is not very likely that it will work. I haven't tested it yet, because in my test scenario there is a gatekeeper in the path: Cisco Expressway doesn't support (yet) Managed File Transfer, but you can upvote the idea in the ideas management of Cisco or other ideas such as OMEMO support.
OMEMO support? Yes, there is no end-to-end encryption (E2EE) currently planned for Cisco Jabber, while it is common nowadays for most modern XMPP clients. I think it would be good for Cisco Jabber to also (optionally) support OMEMO or its successor. Messaging clients without E2EE are not state of the art anymore.
Whereas Conversations is the de-facto standard on Android, Apple IOS devices are still lacking a similar well-working client. See my blog post "XMPP - Fun with Clients" for a summary. In that regard Cisco Jabber might be the best XMPP client for IOS to some degree: you have working messaging, voice/video calls, Push Notifications and integration into Apples Call Kit.
There are most likely many, many more differences and issues between Cisco Jabber and standard compliant XMPP servers and clients. But basically Cisco Jabber is still based on XMPP and extends that by proprietary extensions.
Summary
While I have the impression that the free clients and servers are well doing and increased development in the past years (thanks to Conversations and the Compliance Tester), the situation of Cisco Jabber is a little different. As a customer you can sometimes get the impression that Cisco has lost interest in developing Cisco Jabber. It got better in the last years, but when Cisco Spark was introduced some years ago, the impression was that Cisco is heavily focussed on Spark (now: Webex Teams). It's not like Cisco is not listening to customers or the development has been stopped on Jabber, but my impression is that most customers don't give feedback or tell Cisco as the vendor what they want. You can either submit ideas via the Colaboration Customer Ideas Tool or provide feedback via your Cisco and partner channels.
I think it is important for the XMPP community to also have a large enterprise level vendor like Cisco. Otherwise the Internet will become more and more an Internet of closed silos like MS Teams, Slack, Facebook, etc. Of course there are other companies like ProcessOne (ejabberd) or Tigase, but I think you agree that Cisco is another level.
This review, for reasons that will hopefully become clear later, starts
with a personal digression.
I have been interested in political theory my entire life. That sounds
like something admirable, or at least neutral. It's not. "Interested"
means that I have opinions that are generally stronger than my depth of
knowledge warrants. "Interested" means that I like thinking about and
casting judgment on how politics should be done without doing the work of
politics myself. And "political theory" is different than politics in
important ways, not the least of which is that political actions have
rarely been a direct danger to me or my family. I have the luxury of
arguing about politics as a theory.
In short, I'm at high risk of being one of those people who has an opinion
about everything and shares it on Twitter.
I'm still in the process (to be honest, near the beginning of the process)
of making something useful out of that interest. I've had some success
when I become enough a part of a community that I can do some of the
political work, understand the arguments at a level deeper than theory,
and have to deal with the consequences of my own opinions. But those
communities have been on-line and relatively low stakes. For the big
political problems, the ones that involve governments and taxes and laws,
those that decide who gets medical treatment and income support and who
doesn't, to ever improve, more people like me need to learn enough about
the practical details that we can do the real work of fixing them, rather
than only making our native (and generally privileged) communities better
for ourselves.
I haven't found my path helping with that work yet. But I do have a
concrete, challenging, local political question that makes me coldly
furious: housing policy. Hence this book.
Golden Gates is about housing policy in the notoriously underbuilt
and therefore incredibly expensive San Francisco Bay Area, where I live.
I wanted to deepen that emotional reaction to the failures of housing
policy with facts and analysis. Golden Gates does provide some of
that. But this also turns out to be a book about the translation of
political theory into practice, about the messiness and conflict that
results, and about the difficult process of measuring success. It's also
a book about how substantial agreement on the basics of necessary
political change can still founder on the shoals of prioritization,
tribalism, and people who are interested in political theory.
In short, it's a book about the difficulty of changing the world instead
of arguing about how to change it.
This is not a direct analysis of housing policy, although Dougherty
provides the basics as background. Rather, it's the story of the
political fight over housing told primarily through two lenses: Sonja
Trauss, founder of BARF (the Bay Area Renters' Federation); and a Redwood
City apartment complex, the people who fought its rent increases, and the
nun who eventually purchased it. Around that framework, Dougherty writes
about the Howard Jarvis Taxpayers Association and the history of
California's Proposition 13, a fight over a development in Lafayette, the
logistics challenge of constructing sufficient housing even when approved,
and the political career of Scott Wiener, the hated opponent of every city
fighting for the continued ability to arbitrarily veto any new housing.
One of the things Golden Gates helped clarify for me is that there
are three core interest groups that have to be part of any discussion of
Bay Area housing: homeowners who want to limit or eliminate local change,
renters who are vulnerable to gentrification and redevelopment, and the
people who want to live in that area and can't (which includes people who
want to move there, but more sympathetically includes all the people who
work there but can't afford to live locally, such as teachers, day care
workers, food service workers, and, well, just about anyone who doesn't
work in tech). (As with any political classification, statements about
collectives may not apply to individuals; there are numerous people who
appear to fall into one group but who vote in alignment with another.)
Dougherty makes it clear that housing policy is intractable in part
because the policies that most clearly help one of those three groups hurt
the other two.
As advertised by the subtitle, Dougherty's focus is on the fight for more
housing. Those who already own homes whose values have been inflated by
artificial scarcity, or who want to preserve such stratified living
conditions as low-density, large-lot single-family dwellings within short
mass-transit commute of one of the densest cities in the United States,
don't get a lot of sympathy or focus here except as opponents. I
understand this choice; I also don't have much sympathy. But I do wish
that Dougherty had spent more time discussing the unsustainable promise
that California has implicitly made to homeowners: housing may be
impossibly expensive, but if you can manage to reach that pinnacle of
financial success, the ongoing value of your home is guaranteed. He does
mention this in passing, but I don't think he puts enough emphasis on the
impact that a single huge, illiquid investment that is heavily encouraged
by government policy has on people's attitude towards anything that
jeopardizes that investment.
The bulk of this book focuses on the two factions trying to make housing
cheaper: Sonja Trauss and others who are pushing for construction of more
housing, and tenant groups trying to manage the price of existing housing
for those who have to rent. The tragedy of Bay Area housing is that even
the faintest connection of housing to the economic principle of supply and
demand implies that the long-term goals of those two groups align.
Building more housing will decrease the cost of housing, at least if you
build enough of it over a long enough period of time. But in the short
term, particularly given the amount of Bay Area land pre-emptively
excluded from housing by environmental protection and the actions of the
existing homeowners, building more housing usually means tearing down
cheap lower-density housing and replacing it with expensive higher-density
housing. And that destroys people's lives.
I'll admit my natural sympathy is with Trauss on pure economic grounds.
There simply aren't enough places to live in the Bay Area, and the number
of people in the area will not decrease. To the marginal extent that
growth even slows, that's another tale of misery involving "super
commutes" of over 90 minutes each way. But the most affecting part of
this book was the detailed look at what redevelopment looks like for the
people who thought they had housing, and how it disrupts and destroys
existing communities. It's impossible to read those stories and not be
moved. But it's equally impossible to not be moved by the stories of
people who live in their cars during the week, going home only on weekends
because they have to live too far away from their jobs to commute.
This is exactly the kind of politics that I lose when I take a superficial
interest in political theory. Even when I feel confident in a guiding
principle, the hard part of real-world politics is bringing real people
with you in the implementation and mitigating the damage that any choice
of implementation will cause. There are a lot of details, and those
details matter. Without the right balance between addressing a long-term
deficit and providing short-term protection and relief, an attempt to
alleviate unsustainable long-term misery creates more short-term misery
for those least able to afford it. And while I personally may have less
sympathy for the relatively well-off who have clawed their way into their
own mortgage, being cavalier with their goals and their financial needs is
both poor ethics and poor politics. Mobilizing political opponents who
have resources and vote locally isn't a winning strategy.
Dougherty is a reporter, not a housing or public policy expert, so
Golden Gates poses problems and tells stories rather than describes
solutions. This book didn't lead me to a brilliant plan for fixing the
Bay Area housing crunch, or hand me a roadmap for how to get effectively
involved in local politics. What it did do is tell stories about what
political approaches have worked, how they've worked, what change they've
created, and the limitations of that change. Solving political problems
is work. That work requires understanding people and balancing concerns,
which in turn requires a lot of empathy, a lot of communication, and
sometimes finding a way to make unlikely allies.
I'm not sure how broad the appeal of this book will be outside of those
who live in the region. Some aspects of the fight for housing generalize,
but the Bay Area (and I suspect every region) has properties specific to
it or to the state of California. It has also reached an extreme of
housing shortage that is rivaled in the United States only by New York
City, which changes the nature of the solutions. But if you want to
seriously engage with Bay Area housing policy, knowing the background
explained here is nearly mandatory. There are some flaws I wish
Dougherty would have talked more about traffic and transit policy,
although I realize that could be another book but this is an important
story told well.
If this somewhat narrow topic is within your interests, highly
recommended.
Rating: 8 out of 10
What is the best tool to use for drawing vector pictures? For me and probably for many others, the answer is pretty obvious: Illustrator, or, maybe, Inkscape.
The EURion constellation (also known as Omron rings[1] or doughnuts[2]) is a pattern of symbols incorporated into a number of banknote designs worldwide since about 1996. It is added to help imaging software detect the presence of a banknote in a digital image. Such software can then block the user from reproducing banknotes to prevent counterfeiting using colour photocopiers. According to research from 2004, the EURion constellation is used for colour photocopiers but probably not used in computer software.[3] It has been reported that Adobe Photoshop will not allow editing of an image of a banknote, but in some versions this is believed to be due to a different, unknown digital watermark rather than the EURion constellation.[4][3]
This huge collection of non-scary optical illusions and fascinating visual phenomena emphasizes interactive exploration, beauty, and scientific explanation.
Generated photos are created from scratch by AI systems. All images can be used for any purpose without worrying about copyrights, distribution rights, infringement claims, or royalties.
Il termine sardo femina accabadora, femina agabbad ra o, pi comunemente, agabbadora o accabadora (s'agabbad ra, lett. "colei che finisce", deriva dal sardo s'acabbu, "la fine" o dallo spagnolo acabar, "terminare") denota la figura storicamente incerta di una donna che si incaricava di portare la morte a persone di qualunque et , nel caso in cui queste fossero in condizioni di malattia tali da portare i familiari o la stessa vittima a richiederla. In realt non ci sono prove di tale pratica, che avrebbe riguardato alcune regioni sarde come Marghine, Planargia e Gallura[1]. La pratica non doveva essere retribuita dai parenti del malato poich il pagare per dare la morte era contrario ai dettami religiosi e della superstizione.
Alright the people have spoken and they want more cat genetics. So,
I present to you all "Cat Coat Genetics 101: A Tweetorial", feat. pics of many real
life cats (for science, of course...this baby is Caterpillar).
The Hindu also 
Prerequisites
You will need the following prerequisites :
Ask AWS SES to verify a domain
Generate the DKIM settings
AWS SES pending verification
AWS SES SMTP settings and credentials
Mailtrain mailer setup
Mailtrain to throttle sending emails to AWS SES
Debian has work-in-progress packages for Kubernetes, which work well enough enough for a testing and learning environement. Bootstraping a cluster with the 
This article documents how to install 
Previously: 
The publisher MDPI is a spammer and lies.
If you upload a paper draft to arXiv, MDPI will send spam to the authors
to solicit submission. Within minutes of an upload I received the
following email (sent by MDPI staff, not some overly eager new editor):
Well, I'm sure many of you know "normal" XMPP clients such as Gajim or Dino on Linux, Conversations on Android or Siskin/Monal/ChatSecure on Apple IOS. There are plenty of other clients of course and maybe you used an XMPP client in the past without knowing it. For example Jitsi Meet is based on XMPP and you can still download the Jitsi Desktop client and use it as a full-featured multi-protocol client, e.g. for XMPP and SIP. In fact Jitsi Desktop is maybe the client that comes closest to Cisco Jabber as a chat/voice/video client. In fact I already connected Jitsi Desktop to Cisco CUCM/IM&P infrastructure, but of course you won't be able to use all those Cisco proprietary extensions, but you can see the benefit of open, standardized protocols such as XMPP and SIP: you are free to use any standard compliant client that you want.
So, while Jitsi supported voice/video calls for a long time, even before they focussed on Jitsi Meet as a WebRTC based conference service, Conversations added this feature last month, as already stated. This had a huge effect to the whole XMPP federation, because you need an XMPP server that supports XEP-0215 to make these audio/video calls work. The well-known