Planet Russell

July 04, 2009

Planet DebianMike Hommey: Try your own monster

I’m more than halfway to an upload of xulrunner to experimental, but until I get iceweasel itself built, and xulrunner in an uploadable shape, you can download amd64 and i386 packages of xulrunner-1.9.1 from my p.d.o space. To get something that works, you only need libmozjs2d and xulrunner-1.9.1. Following are direct links to the relevant files:

I only tested the amd64 binary, which doesn’t have JIT javascript, so if you have particular problems with the i386 binaries, please report them in the comments. You can obviously leave comments for problems with the amd64 binaries, by the way.

Since iceweasel 3.5 is not ready yet, you may still want something to try this xulrunner out. You can try your own monster, for that purpose. The steps involved to create the monster are actually simple:

  • Edit the /usr/lib/iceweasel/application.ini file and change the MaxVersion value in the [Gecko] section to 1.9.1
  • Replace the /usr/lib/iceweasel/xulrunner symbolic link with a symbolic link to /usr/lib/xulrunner-1.9.1 (ln -sfn ../xulrunner-1.9.1 /usr/lib/iceweasel/xulrunner)

With these changes, running iceweasel will start the monster.

If you still want to have iceweasel running the “normal” version, skip the second step above and start xulrunner-1.9.1 /usr/lib/iceweasel/application.ini instead.

Don MartiNetworkManager on Debian says: Device not managed

Just upgraded NetworkManager and nm-applet among other things and got this in the nm-applet popup that normally displays the available networks:

device not managed

The fix is in this Debian bug report:

  1. Either (a) edit /etc/network/interfaces to comment out the interfaces you want NetworkManager to handle or (b) change managed=false to managed=true in /etc/NetworkManager/nm-system-settings.conf.

  2. sudo killall nm-system-settings

(It doesn't look like you need to bounce /etc/init.d/networking or /etc/init.d/network-manager—I tried those but that nm-system-settings process is what you really need to kill.) If you can read this the Debian laptop is back on the net.

365 TomorrowsDead Men Died For Your Freedom

Author : Lillian Cohen-Moore

I died for this country. Then..

…I came back.

Mock me all you want. Say, no, what I mean to say is, “I would have died for this country.”

Or, “I nearly died for this country.”

You weren’t there, were you? With the grit in your eyes and the suns streaming down on you. The sand eating away at the tanks. Filling our uniforms with dirt. You didn’t see how empty the deserts seemed, except for the automata of war. You weren’t there when the night talked to us.

It took Jack first, out into the ravine of water we couldn’t drink, and left him lifeless.

It devoured Trina’s screams as much as it devoured her flesh from her mid-section, leaving her staring up into nothing after she died. Her last memory embedded in her eyes–vitreous fluid showing us a cloud. Something. A shape.

Artifacts, they say. Too much adrenaline. Too much fear. Blurring the picture in her eyes. Unusable in court or for investigative purposes. They said it must have been an animal.

It took others. So many others. Till it took me.

It didn’t come again, after it took me.

I came back. I got discharged. Honorable. Combat duty conducted with bravery, they told me. I took stupid risks, because risks don’t mean anything to me anymore. I just needed some way to cover it all up, to get out.

I know the truth. I saw its face, under the moon, under the refracted light of too many suns on a planet that shouldn’t have mattered. I know it’s what is native to that planet. That place.

I think. Maybe fear. That it’s what I’m becoming.

I felt my blood gurgle out into the sand dunes, as it kissed my wounds, sticky sweet, hot and cold, steaming, saliva-and-blood. Flesh and flesh.

They call me a hero. When they talk… I swallow saliva. I feel it feel my mouth, and I swallow it. I stay away,now. From everyone. Women and man alike. Anyone who approaches me. Till you. You wanted a story.

I’ll tell you a story.

I felt my heart stop, the night I died for my country.

Tonight, you’ll die for me.

Discuss the Future: The 365 Tomorrows Forums
The 365 Tomorrows Free Podcast: Voices of Tomorrow
This is your future: Submit your stories to 365 Tomorrows

DocunextStrange OCSInventory-Agent Process Halt

I have no idea why this is happening on my laptop, but I found a lame-o workaround. When I would try and run ocsinventory-agent on my laptop, it would freeze, so I added the debug flag and noticed it was freezing here:

ocsinventory-agent --devlib --debug
[debug] Ocsinventory unified agent for UNIX and Linux1.0.1
[debug] Log system initialised (Stderr)
[debug] the --server passed doesn't have a protocle, assume http as default
[debug] Accountinfo file: /var/lib/ocsinventory-agent/http:__dev-4x.com_ocsinventory/ocsinv.adm
[debug] OCS Agent initialised
[debug] Calling handlers : `start_handler'
[debug] Compress::Zlib is avalaible.
[debug] sending XML
[debug] Calling handlers : `prolog_writers'
[debug] =BEGIN=SERVER RET======
[debug] $VAR1 = '

  
    DOWNLOAD
    
  
  SEND
  24

‘;
[debug] =END=SERVER RET======
[debug] PROLOG_FREQ has not changed since last process
[debug] Calling handlers : `prolog_reader’
[debug]  run func: `Ocsinventory::Agent::Option::Download::download_prolog_reader’
[debug] sending XML
[debug] Calling handlers : `inventory_handler’
[debug]  run func: `Ocsinventory::Agent::Option::Download::download_inventory_handler’

I did an strace and noted that there was some sort of illegal seek going on, and an option to cancel or retry. I tried again without strace and simply pressed the “c” key whenver it halted. Finally the process went through to the end:

[debug] Ocsinventory::Agent::Backend::IpDiscover check function failed
[debug] Ocsinventory::Agent::Backend::OS::AIX check function failed
[debug] Ocsinventory::Agent::Backend::OS::BSD check function failed
[debug] Ocsinventory::Agent::Backend::OS::Generic::Ipmi check function failed
[debug] Ocsinventory::Agent::Backend::OS::Generic::Packaging::BSDpkg check function failed
[debug] Ocsinventory::Agent::Backend::OS::Generic::Packaging::Gentoo check function failed
[debug] Ocsinventory::Agent::Backend::OS::Generic::Screen check function failed
[debug] Ocsinventory::Agent::Backend::OS::Linux::Archs::PowerPC check function failed
[debug] Ocsinventory::Agent::Backend::OS::Linux::Distro::NonLSB::Fedora check function failed
[debug] Ocsinventory::Agent::Backend::OS::Linux::Distro::NonLSB::Gentoo check function failed
[debug] Ocsinventory::Agent::Backend::OS::Linux::Distro::NonLSB::Knoppix check function failed
[debug] Ocsinventory::Agent::Backend::OS::Linux::Distro::NonLSB::Mandrake check function failed
[debug] Ocsinventory::Agent::Backend::OS::Linux::Distro::NonLSB::Mandriva check function failed
[debug] Ocsinventory::Agent::Backend::OS::Linux::Distro::NonLSB::Redhat check function failed
[debug] Ocsinventory::Agent::Backend::OS::Linux::Distro::NonLSB::Slackware check function failed
[debug] Ocsinventory::Agent::Backend::OS::Linux::Distro::NonLSB::SuSE check function failed
[debug] Ocsinventory::Agent::Backend::OS::Linux::Distro::NonLSB::Trustix check function failed
[debug] Ocsinventory::Agent::Backend::OS::Linux::Distro::NonLSB::Ubuntu check function failed
[debug] Ocsinventory::Agent::Backend::OS::Linux::Storages::3ware check function failed
[debug] Ocsinventory::Agent::Backend::OS::Linux::Storages::Adaptec check function failed
[debug] Ocsinventory::Agent::Backend::OS::Linux::Storages::HP check function failed
[debug] Ocsinventory::Agent::Backend::OS::Linux::Storages::Lsilogic check function failed
[debug] Ocsinventory::Agent::Backend::OS::Linux::Storages::ServeRaid check function failed
[debug] Ocsinventory::Agent::Backend::OS::MacOS check function failed
[debug] Ocsinventory::Agent::Backend::OS::Solaris check function failed
[debug] Ocsinventory::Agent::Backend::OS::Linux::Distro::NonLSB disabled because of a 'runMeIfTheseChecksFailed' in 'Ocsinventory::Agent::Backend::OS::Linux::Distro::NonLSB'
[debug] Ocsinventory::Agent::Backend::OS::Linux::Distro::NonLSB::Debian disabled because of a 'runMeIfTheseChecksFailed' in 'Ocsinventory::Agent::Backend::OS::Linux::Distro::NonLSB'
[debug] Running Ocsinventory::Agent::Backend::AccessLog
[debug] Running Ocsinventory::Agent::Backend::DeviceID
[debug] Running Ocsinventory::Agent::Backend::OS::Generic
[debug] Running Ocsinventory::Agent::Backend::OS::Generic::Dmidecode
[debug] Running Ocsinventory::Agent::Backend::OS::Generic::Dmidecode::Bios
[debug] Running Ocsinventory::Agent::Backend::OS::Generic::Dmidecode::Memory
[debug] Running Ocsinventory::Agent::Backend::OS::Generic::Dmidecode::Ports
[debug] Running Ocsinventory::Agent::Backend::OS::Generic::Dmidecode::Slots
[debug] Running Ocsinventory::Agent::Backend::OS::Generic::Hostname
[debug] Running Ocsinventory::Agent::Backend::OS::Generic::Lspci
[debug] Running Ocsinventory::Agent::Backend::OS::Generic::Lspci::Controllers
[debug] Running Ocsinventory::Agent::Backend::OS::Generic::Lspci::Modems
[debug] Running Ocsinventory::Agent::Backend::OS::Generic::Lspci::Sounds
[debug] Running Ocsinventory::Agent::Backend::OS::Generic::Lspci::Videos
[debug] Running Ocsinventory::Agent::Backend::OS::Generic::Packaging
[debug] Ocsinventory::Agent::Backend::OS::Generic::Packaging has no run() function -> ignored
[debug] Running Ocsinventory::Agent::Backend::OS::Generic::Packaging::Deb
[debug] Running Ocsinventory::Agent::Backend::OS::Generic::Packaging::RPM
[debug] Running Ocsinventory::Agent::Backend::OS::Generic::Users
[debug] Running Ocsinventory::Agent::Backend::OS::Linux
[debug] Running Ocsinventory::Agent::Backend::OS::Linux::CPU
[debug] Running Ocsinventory::Agent::Backend::OS::Linux::Controllers
[debug] Running Ocsinventory::Agent::Backend::OS::Linux::Distro::LSB
[debug] Running Ocsinventory::Agent::Backend::OS::Linux::Domains
[debug] Running Ocsinventory::Agent::Backend::OS::Linux::Drives
[debug] Running Ocsinventory::Agent::Backend::OS::Linux::Mem
[debug] Running Ocsinventory::Agent::Backend::OS::Linux::Network::IPv4
[debug] Running Ocsinventory::Agent::Backend::OS::Linux::Network::Networks
[debug] Running Ocsinventory::Agent::Backend::OS::Linux::Sounds
[debug] Running Ocsinventory::Agent::Backend::OS::Linux::Storages
[debug] Running Ocsinventory::Agent::Backend::OS::Linux::Sys
[debug] Running Ocsinventory::Agent::Backend::OS::Linux::Uptime
[debug] Section BIOS has changed since last inventory
[debug] Section VIDEOS has changed since last inventory
[debug] Section HARDWARE has changed since last inventory
[debug] Section SOUNDS has changed since last inventory
c[debug] Section SOFTWARES has changed since last inventory
[debug] Section MEMORIES has changed since last inventory
[debug] Section CONTROLLERS has changed since last inventory
[debug] Section STORAGES has changed since last inventory
[debug] Section NETWORKS has changed since last inventory
[debug] Section DRIVES has changed since last inventory
[debug] Section SLOTS has changed since last inventory
c

c[debug] =BEGIN=SERVER RET======
[debug] $VAR1 = '

  NO_ACCOUNT_UPDATE

‘;
[debug] =END=SERVER RET======
[debug] Calling handlers : `end_handler’
[debug]  run func: `Ocsinventory::Agent::Option::Download::download_end_handler’

Accelerating Future3 Miles of Rock Away from Gigadeath?

Seismologists/geologists? You tell me. My understanding is that there is substantial pressure in the magma chamber beneath Yellowstone.

Accelerating FutureWired Roasts Singularity University

As some of you may have already noticed, WIRED published a mocking “letter of acceptance” on Singularity University. This extends a long trend of WIRED simultaneously boosting and insulting Singularitarians and Transhumanists, a mighty confusing one.

For instance, the WIRED science blog is written by two people who seem pretty damn transhumanistic. They wrote about saving the “mind uploading” article on Wikipedia, which is so obscure and niche that even I decided not to bother posting about it. In contrast, here’s another anti-Singularity (anti-Kurzweil, specifically) article on WIRED from last year, presumably to counterbalance the article focused on Ray.

Adam Mann says that “the magazine has also long been a backer of the pro-Kurzweil, go Singularity movement”, then says:

I feel like the stance among the general staff may be changing. And this month they ran a humorous dig at Kurzweil’s Singularity University. Has even Wired adopted an anti-Singularity stance?

Probably not. I think it’s just the fact that Kurzweil and the Singularity are on an upswing in the media and his assumptions are being held out in the full light of day. Maybe Kurzweil is reaching the peak of his own public-attention-exponential-growth curve? As more people start to follow his movement, perhaps there will start to be larger skepticism for it as well. I can only hope.

But Mr. Mann, if WIRED were pro-Singularity all along, why would the upswing make any difference? They’ve been exposed to the ideas since day one. The fact of the matter is that WIRED is a lot of different people, some pro-Singularity, some anti. My conception of the Singularity is quite different than Ray’s anyway, so I am not tremendously concerned about skepticism or support — except when it comes to specific points. That is why I responded aggressively to Horgan’s criticism of the “Singularity”, but ignore other criticisms, like PZ Myers’.

I’ve been in this pro/anti-Singularity shtick for what seems like so long (since I was 17), that nowadays the communication here is mostly automatic. What I notice are little personality quirks and traits, for instance that Horgan is badass enough to insult Newsweek (”I didn’t think anyone read that anymore”) while being paid by then. The main thing I am concerned about is that Friendly AI projects are funded. A friendly seed, that’s all I want. Everything else is ultimately cultural.

“For just as every seed holds the power and magic of creation, so too do you, and every other creature in this world.” — Magi Lune, Fern Gully

July 03, 2009

DocunextMoving to Movable Type

I have been having a great time with Movable Type recently, and so I plan to migrate the Docunext blog to MTOS very soon. I still have a lot to learn with ikiwiki, so for now I’m sticking with MediaWiki.

DocunextLearning About the Awesome Window Manager (WM)

I’m enjoying the learning process involved with setting up Awesome. Its working for me, though I did encounter quite a few gotchas:

Here’s what I setup:

.xinitrc / .Xsession

nm-applet &
exec awesome

Then I copied the default rc.lua:

cp /etc/xdg/awesome/rc.lua ~/.config/awesome/rc.lua

I messed around with rc.lua for awhile, but just couldn’t figure out anything useful. Eventually I’ll figure it out, but first I have to figure out the tags.



I’m glad the config file is written in Lua, as I’ve been trying to learn more of it lately.

Planet SE LinuxShintaro Fujiwara: segatex-7.769 will be released soon

Well, I reinstalled my notepc, which cannot type last alphabet, F11.
I installed segatex-7.768 but segatex policy could not be installed.
I found slite bug in it, so I fixed segatex policy.
It will be shipped as segatex-7.769 with an UNINSTALL script which is convenient for those who test segatex.
Please wait until I get the job done.

Planet DebianSandro Tosi: Mid 2009 bts-link update

Several months had passed since I started acting bts-link maintainer and I've never issued a "state of the union" message, so I'm fixing it now :)

I'm going to enlist some of the most relevant facts that have happened:
  • bts-link now runs on merkel, that will help it to be identified as an official Debian tool, in particular from upstream projects that doesn't like to be "flooded" by a pick of requests;
  • it's executed almost always twice a week (this also reduce load on remote issue tracking systems); now I tried to standardize on Monday and Thursday, but since it's still executed by hand, days may change;
  • we now have a log of each execution, and we added to it several additional information to help use drive it the right way;
  • the logs are publicly available (even if a bit hidden until now) here;
  • we created a scripts to parse those logs and create a couple of graphs (using matplotlib) for each execution, available at the same location of logs; they show us the summary of all logged bts-link executions and (mainly) what are the projects with a lot of forwarded bugs that are still not handled by bts-link (images links are from last run);
  • as you can see from the summary graph, the Unconfigured forwarded bugs count is drastically reduced; this is due to mainly 2 reasons: 1. we recently added Roundup (python, gnupg, darcs, mercurial, etc) and Google Code (tesseract, and many small others) issue tracking systems support; 2. we added several missing project for remote BTSes already supported.
  • Recap - we are now able to configure packages with remote issue tracking system that uses these tools: berlios, bugzilla, gnats, launchpad, mantis, rt, savane, sourceforge, trac, gforge, googlecode, roundup.
  • we have a really active contributor: Olivier Berger. Thanks a lot, Olivier! But we want mooooore;
  • we got also a changelog.
It's a lot, but there is still more to do:
  • add more remote issue tracking systems: php is the next big one, and meebey just told me it has a XMLRPC backend, so it's an easy one; let's hope MySQL has the same XMLRPC enabled, since they based their BTS on php one;
  • add more Debian packages under bts-link monitoring: those are packages with forwarded bugs to upstreams with a supported remote BTSes - here we need your help!
  • make bts-link more a general purpose tool, not Debian specific - and here Olivier is working really hard, let's hope I can help him achieve this (for example reviewing and merging his changes ;) ).
  • have a more suitable summary output, with elapsed time, already grouped up information from results, ready to be parsed and graphed; something is already done, but some code refactoring is needed to complete it;
  • [long term] convert it to "some sort of" daemon; run executed by cron is a beginning, but there were talks about a real daemon, continuously checking forwarded bugs, with a reasonable amount of delay to not bother that much on BTSes;
  • [long term] integrated with Debian bts;
  • we got also a TODO list.
What can you do for bts-link? a lot!
  • do you maintain a package with forwarded bugs to a supported remote issue tracking system not yet checked by bts-link? let us know, and we'll add it;
  • do you maintain a package with forwarded bugs to a not yet supported remote issue tracking system? let us know, and we'll add it (it's welcome if you already contact upstream to alert them of the possibility of automatic tool checking their BTS and to find out if their BTS support some sort of programmatic querying, like CSV exporting, XMLRPC, etc.);
  • do you want to help? contact us, there's always something to do :)
Have fun!

Planet DebianJeff Bailey: Taxes; Bixi

Finally filed our Quebec, Canada, California and US taxes today - two stops for local tax agencies and then the post office.

Another "How awesome is Montreal" moment: Biking downtown on a rental bike for which I pay ~$80CAD/year, going past cars that were stuck in traffic, past the jazz festival on a warm sunny day. Drop off the rental bike a stand, and walk the 2 or 3 blocks to the destination, pick it up to return.

Less than an hour of time to make up for work, all included.

Bixi takes a bit of getting used to since they don't have all the supply and demand quirks worked out, but I've been remarkably lucky with it.

Planet LCAIF YOU ARE A BRASS MONKEY, I STRONGLY ADVISE YOU TO STAY IN THE CONTROL ROOM

Dammit, it's 1.4 degrees, and it's *raining*, not snowing. Why can't it snow? Ok, so it's a phase change and phase changes take energy and are hard. But it was already frozen when it was in the clouds, so it takes more energy to heat it up to falling rain water drops, rather than let it stay frozen and give me my snow!

OK, so next you'll use the excuse that it's not falling from the clouds and hence never was in the form of hail; it's just precipitating from the fog surrounding the mountain[1], but pishtosh. I want my snow.


PS. The subject of this post was the easter egg featuring in the old CCS control system (they dedicated 40+ words[3] out of the 2.5Mwords available to an easter egg‽) if you entered an atmospheric temperature of 0degC or below. I found it only once in the 2 two winters I worked with it before the CCS was replaced. I tried to convince the other software guy up here to add that to the status display of the new TCS when he encountered -0.4degC a couple of weeks ago.

PPS. US patent 4634021 is cool. As is Stanthorpe, Queensland. Quite cool.

[1] Last time I was on shift, I had my motorbike up here, and *really* had to get it down off the mountain at the end of shift so I could go riding on the 5 day long weekend[2]. And I woke to a torrential downpour. But I knew all I needed was 5 minutes to get off the mountain, and I'd be fine to get home. I had to wait more than 2 hours for that 5 minute gap, and not before 90mm of rain fell. Indeed, at the bottom of the mountain, the road was relatively dry -- in town, 5mm had fallen the whole day. Who decided to build an observatory in a dam rainforest? (sorry, I'm channeling the American sitting across from me waiting to finally get some observing in one of these days).

[2] The weather was bad. I decided to stay inside instead.

[3]
      INTEGER*2 MBM(38)
C
      DATA MEM / 'ENTER METEOROLOGICAL PARAMETERS '/
      DATA MCU / '(CURRENTLY  #^^ DEG C,  #^^^ MM HG) '/
      DATA MMP / 'METEOROLOGICAL PARAMETERS:'/
      DATA MT  / '  TEMPERATURE  =  #^^  DEG C'/
      DATA MP  / '  PRESSURE     = #^^^  MM HG'/
      DATA MBM / 'IF YOU ARE A BRASS MONKEY, I STRONGLY AD',
     :                 'VISE YOU TO STAY IN THE CONTROL ROOM'/
...
      IF (T .GT. 0.0) GO TO 300
      CALL IODO('OW.',6,MBM,76)
      GO TO 300

CryptogramThe Pros and Cons of Password Masking

Usability guru Jakob Nielsen opened up a can of worms when he made the case for unmasking passwords in his blog. I chimed in that I agreed. Almost 165 comments on my blog (and several articles, essays, and many other blog posts) later, the consensus is that we were wrong.

I was certainly too glib. Like any security countermeasure, password masking has value. But like any countermeasure, password masking is not a panacea. And the costs of password masking need to be balanced with the benefits.

The cost is accuracy. When users don't get visual feedback from what they're typing, they're more prone to make mistakes. This is especially true with character strings that have non-standard characters and capitalization. This has several ancillary costs:

  • Users get pissed off.
  • Users are more likely to choose easy-to-type passwords, reducing both mistakes and security. Removing password masking will make people more comfortable with complicated passwords: they'll become easier to memorize and easier to use.

The benefits of password masking are more obvious:

  • Security from shoulder surfing. If people can't look over your shoulder and see what you're typing, they're much less likely to be able to steal your password. Yes, they can look at your fingers instead, but that's much harder than looking at the screen. Surveillance cameras are also an issue: it's easier to watch someone's fingers on recorded video, but reading a cleartext password off a screen is trivial.

    In some situations, there is a trust dynamic involved. Do you type your password while your boss is standing over your shoulder watching? How about your spouse or partner? Your parent or child? Your teacher or students? At ATMs, there's a social convention of standing away from someone using the machine, but that convention doesn't apply to computers. You might not trust the person standing next to you enough to let him see your password, but don't feel comfortable telling him to look away. Password masking solves that social awkwardness.

  • Security from screen scraping malware. This is less of an issue; keyboard loggers are more common and unaffected by password masking. And if you have that kind of malware on your computer, you've got all sorts of problems.

  • A security "signal." Password masking alerts users, and I'm thinking users who aren't particularly security savvy, that passwords are a secret.

I believe that shoulder surfing isn't nearly the problem it's made out to be. One, lots of people use their computers in private, with no one looking over their shoulders. Two, personal handheld devices are used very close to the body, making shoulder surfing all that much harder. Three, it's hard to quickly and accurately memorize a random non-alphanumeric string that flashes on the screen for a second or so.

This is not to say that shoulder surfing isn't a threat. It is. And, as many readers pointed out, password masking is one of the reasons it isn't more of a threat. And the threat is greater for those who are not fluent computer users: slow typists and people who are likely to choose bad passwords. But I believe that the risks are overstated.

Password masking is definitely important on public terminals with short PINs. (I'm thinking of ATMs.) The value of the PIN is large, shoulder surfing is more common, and a four-digit PIN is easy to remember in any case.

And lastly, this problem largely disappears on the Internet on your personal computer. Most browsers include the ability to save and then automatically populate password fields, making the usability problem go away at the expense of another security problem (the security of the password becomes the security of the computer). There's a Firefox plugin that gets rid of password masking. And programs like my own Password Safe allow passwords to be cut and pasted into applications, also eliminating the usability problem.

One approach is to make it a configurable option. High-risk banking applications could turn password masking on by default; other applications could turn it off by default. Browsers in public locations could turn it on by default. I like this, but it complicates the user interface.

A reader mentioned BlackBerry's solution, which is to display each character briefly before masking it; that seems like an excellent compromise.

I, for one, would like the option. I cannot type complicated WEP keys into Windows -- twice! what's the deal with that? -- without making mistakes. I cannot type my rarely used and very complicated PGP keys without making a mistake unless I turn off password masking. That's what I was reacting to when I said "I agree."

So was I wrong? Maybe. Okay, probably. Password masking definitely improves security; many readers pointed out that they regularly use their computer in crowded environments, and rely on password masking to protect their passwords. On the other hand, password masking reduces accuracy and makes it less likely that users will choose secure and hard-to-remember passwords, I will concede that the password masking trade-off is more beneficial than I thought in my snap reaction, but also that the answer is not nearly as obvious as we have historically assumed.

CryptogramThe Pros and Cons of Password Masking

Usability guru Jakob Nielsen opened up a can of worms when he made the case for unmasking passwords in his blog. I chimed in that I agreed. Almost 165 comments on my blog (and several articles, essays, and many other blog posts) later, the consensus is that we were wrong.

I was certainly too glib. Like any security countermeasure, password masking has value. But like any countermeasure, password masking is not a panacea. And the costs of password masking need to be balanced with the benefits.

The cost is accuracy. When users don't get visual feedback from what they're typing, they're more prone to make mistakes. This is especially true with character strings that have non-standard characters and capitalization. This has several ancillary costs:

  • Users get pissed off.
  • Users are more likely to choose easy-to-type passwords, reducing both mistakes and security. Removing password masking will make people more comfortable with complicated passwords: they'll become easier to memorize and easier to use.

The benefits of password masking are more obvious:

  • Security from shoulder surfing. If people can't look over your shoulder and see what you're typing, they're much less likely to be able to steal your password. Yes, they can look at your fingers instead, but that's much harder than looking at the screen. Surveillance cameras are also an issue: it's easier to watch someone's fingers on recorded video, but reading a cleartext password off a screen is trivial.

    In some situations, there is a trust dynamic involved. Do you type your password while your boss is standing over your shoulder watching? How about your spouse or partner? Your parent or child? Your teacher or students? At ATMs, there's a social convention of standing away from someone using the machine, but that convention doesn't apply to computers. You might not trust the person standing next to you enough to let him see your password, but don't feel comfortable telling him to look away. Password masking solves that social awkwardness.

  • Security from screen scraping malware. This is less of an issue; keyboard loggers are more common and unaffected by password masking. And if you have that kind of malware on your computer, you've got all sorts of problems.

  • A security "signal." Password masking alerts users, and I'm thinking users who aren't particularly security savvy, that passwords are a secret.

I believe that shoulder surfing isn't nearly the problem it's made out to be. One, lots of people use their computers in private, with no one looking over their shoulders. Two, personal handheld devices are used very close to the body, making shoulder surfing all that much harder. Three, it's hard to quickly and accurately memorize a random non-alphanumeric string that flashes on the screen for a second or so.

This is not to say that shoulder surfing isn't a threat. It is. And, as many readers pointed out, password masking is one of the reasons it isn't more of a threat. And the threat is greater for those who are not fluent computer users: slow typists and people who are likely to choose bad passwords. But I believe that the risks are overstated.

Password masking is definitely important on public terminals with short PINs. (I'm thinking of ATMs.) The value of the PIN is large, shoulder surfing is more common, and a four-digit PIN is easy to remember in any case.

And lastly, this problem largely disappears on the Internet on your personal computer. Most browsers include the ability to save and then automatically populate password fields, making the usability problem go away at the expense of another security problem (the security of the password becomes the security of the computer). There's a Firefox plugin that gets rid of password masking. And programs like my own Password Safe allow passwords to be cut and pasted into applications, also eliminating the usability problem.

One approach is to make it a configurable option. High-risk banking applications could turn password masking on by default; other applications could turn it off by default. Browsers in public locations could turn it on by default. I like this, but it complicates the user interface.

A reader mentioned BlackBerry's solution, which is to display each character briefly before masking it; that seems like an excellent compromise.

I, for one, would like the option. I cannot type complicated WEP keys into Windows -- twice! what's the deal with that? -- without making mistakes. I cannot type my rarely used and very complicated PGP keys without making a mistake unless I turn off password masking. That's what I was reacting to when I said "I agree."

So was I wrong? Maybe. Okay, probably. Password masking definitely improves security; many readers pointed out that they regularly use their computer in crowded environments, and rely on password masking to protect their passwords. On the other hand, password masking reduces accuracy and makes it less likely that users will choose secure and hard-to-remember passwords, I will concede that the password masking trade-off is more beneficial than I thought in my snap reaction, but also that the answer is not nearly as obvious as we have historically assumed.

CryptogramThe Pros and Cons of Password Masking

Usability guru Jakob Nielsen opened up a can of worms when he made the case for unmasking passwords in his blog. I chimed in that I agreed. Almost 165 comments on my blog (and several articles, essays, and many other blog posts) later, the consensus is that we were wrong.

I was certainly too glib. Like any security countermeasure, password masking has value. But like any countermeasure, password masking is not a panacea. And the costs of password masking need to be balanced with the benefits.

The cost is accuracy. When users don't get visual feedback from what they're typing, they're more prone to make mistakes. This is especially true with character strings that have non-standard characters and capitalization. This has several ancillary costs:

  • Users get pissed off.
  • Users are more likely to choose easy-to-type passwords, reducing both mistakes and security. Removing password masking will make people more comfortable with complicated passwords: they'll become easier to memorize and easier to use.

The benefits of password masking are more obvious:

  • Security from shoulder surfing. If people can't look over your shoulder and see what you're typing, they're much less likely to be able to steal your password. Yes, they can look at your fingers instead, but that's much harder than looking at the screen. Surveillance cameras are also an issue: it's easier to watch someone's fingers on recorded video, but reading a cleartext password off a screen is trivial.

    In some situations, there is a trust dynamic involved. Do you type your password while your boss is standing over your shoulder watching? How about your spouse or partner? Your parent or child? Your teacher or students? At ATMs, there's a social convention of standing away from someone using the machine, but that convention doesn't apply to computers. You might not trust the person standing next to you enough to let him see your password, but don't feel comfortable telling him to look away. Password masking solves that social awkwardness.

  • Security from screen scraping malware. This is less of an issue; keyboard loggers are more common and unaffected by password masking. And if you have that kind of malware on your computer, you've got all sorts of problems.

  • A security "signal." Password masking alerts users, and I'm thinking users who aren't particularly security savvy, that passwords are a secret.

I believe that shoulder surfing isn't nearly the problem it's made out to be. One, lots of people use their computers in private, with no one looking over their shoulders. Two, personal handheld devices are used very close to the body, making shoulder surfing all that much harder. Three, it's hard to quickly and accurately memorize a random non-alphanumeric string that flashes on the screen for a second or so.

This is not to say that shoulder surfing isn't a threat. It is. And, as many readers pointed out, password masking is one of the reasons it isn't more of a threat. And the threat is greater for those who are not fluent computer users: slow typists and people who are likely to choose bad passwords. But I believe that the risks are overstated.

Password masking is definitely important on public terminals with short PINs. (I'm thinking of ATMs.) The value of the PIN is large, shoulder surfing is more common, and a four-digit PIN is easy to remember in any case.

And lastly, this problem largely disappears on the Internet on your personal computer. Most browsers include the ability to save and then automatically populate password fields, making the usability problem go away at the expense of another security problem (the security of the password becomes the security of the computer). There's a Firefox plugin that gets rid of password masking. And programs like my own Password Safe allow passwords to be cut and pasted into applications, also eliminating the usability problem.

One approach is to make it a configurable option. High-risk banking applications could turn password masking on by default; other applications could turn it off by default. Browsers in public locations could turn it on by default. I like this, but it complicates the user interface.

A reader mentioned BlackBerry's solution, which is to display each character briefly before masking it; that seems like an excellent compromise.

I, for one, would like the option. I cannot type complicated WEP keys into Windows -- twice! what's the deal with that? -- without making mistakes. I cannot type my rarely used and very complicated PGP keys without making a mistake unless I turn off password masking. That's what I was reacting to when I said "I agree."

So was I wrong? Maybe. Okay, probably. Password masking definitely improves security; many readers pointed out that they regularly use their computer in crowded environments, and rely on password masking to protect their passwords. On the other hand, password masking reduces accuracy and makes it less likely that users will choose secure and hard-to-remember passwords, I will concede that the password masking trade-off is more beneficial than I thought in my snap reaction, but also that the answer is not nearly as obvious as we have historically assumed.

The Reid ReportMahmoud and Dick, together at last

Apparently, the government of Iran is waterboarding detainees. From the Huffpo's Jason Linkins comes the sad irony:

[h/t; The Daily Dish] From ABC News' Lara Setrakian, comes this tweet:

Tehrani source close to those detained says some have been beaten heavily and waterboarded with hot water #iranelection

In my younger years, I would simply expect this news to be greeted with universal outrage, knowing that the techniques being described had long been deemed to be well across the Bridge Too Far. Now that I've lived through the Bush administration, however, I am forced to contemplate the possibility that Iran is merely taking legitimate steps to obtain critical information in their nations' vital national security interests. One mustn't preclude the possibility that many of those being waterboarded are privy to information about "time bombs" that may, at this moment, be "ticking." ...

Thanks, Dick.

Meanwhile, Andrew Sullivan tries for balance (I'll leave it to you to decide if he succeeds.)

More on Ayatollah Khameini's application of The Cheney Method here.

Planet DebianDavid Welton: ruby-oci8 and libaio

Not of concern to most people reading this via a feed, but it's one of those things I think is nice to write up as a public service, should anyone else encounter the same error. I'm stuck doing some Rails work with Oracle, and so I needed to get ruby-oci8 working:

http://ruby-oci8.rubyforge.org/en/InstallForInstantClient.html

These instructions are pretty good. I followed them, the gem said it had been installed correctly.... and yet:

ERROR: ActiveRecord oracle_enhanced adapter could not load ruby-oci8 library. Please install ruby-oci8 library or gem.
/usr/lib/ruby/gems/1.8/gems/activerecord-2.3.2/lib/active_record/connection_adapters/abstract/connection_specification.rb:76:in
`establish_connection':RuntimeError: Please install the oracle_enhanced adapter:
`gem install activerecord-oracle_enhanced-adapter` (LoadError)

Argh! After some straceing, I finally figured out what was missing: the libaio1 package. You need to have it or things will fail like this. It's very odd that the installation doesn't complain about it.

Planet SE LinuxKaiGai Kohei: 懇親会

そして、懇親会へ移動。

f:id:kaigai:20090613195529j:image

特にお世話になった人に対して、id:haradatsさんから一人一人、

捻りの聞いたお礼の言葉と共に感謝状を贈っていた。

会場では、日本SELinuxユーザ会の草創期に活躍されていた懐かしい人にもお会いする。

そしてまぁ、次にメインライン化すべき大物と言えばもちろん、SE-PostgreSQLだよな。。。

と、決意も新たに帰宅の途へ。

帰り道、挽き肉と玉ネギとデミソースを購入して明日の食材の準備。

Planet SE LinuxKaiGai Kohei: 勉強会

本日は恵比寿のSGIホールでTOMOYO Linuxメインライン化記念勉強会&懇親会。

まっちゃだいふくさんから、本日の進行についての説明と、

日本各地のセキュリティ勉強会コミュニティの紹介

f:id:kaigai:20090613162322j:image

ちなみに、タイムテーブルはこんな感じ。

  • 16:30〜16:30/全国で開催されているセキュリティ勉強会の紹介(まっちゃだいふく)
  • 16:30〜17:00/【基調講演】TOMOYOで学ぶKernel Watchの秘密(小崎さん)
  • 17:00〜17:30/TOMOYO Linuxプロジェクト メインライン化のご報告
  • 17:30〜17:50/NILFSのメインライン化について(小西さん)
  • 17:40〜18:10/2.6.30でこっそり入ったLIM/IMAって何?(宗籐さん)
  • 18:10〜18:30/強敵よ!〜SELinuxとの比較〜(海外)
  • 18:30〜18:50/カーネル読書会とTOMOYO Linux(吉岡さん)

平日の16:00〜というアグレッシブな時間設定にも関わらず、

ざっと100名以上は参加して頂けたように思える。

f:id:kaigai:20090613164707j:image

続いて、某社の小崎さんによる基調講演。

高橋メソッド初挑戦とのことだが、相変わらずテンポのよい喋り。

f:id:kaigai:20090613174106j:image

続いて、本日の主役、TOMOYO Linux Projectの原田さん。

プロジェクトの歴史を振り返りつつ、カーネル2.6.30でのメインライン化に至るまでの道程を振り返る。やっぱ、メインライン化を決意してから2年以上の歳月が流れてて、オタワやカリフォルニアやホバートに飛んでTOMOYO Linuxをアピールし続けてきて、やっと認められるまでの長い道程は一つの歴史だね。

f:id:kaigai:20090613175214j:image

TOMOYO Linuxコングラチュレーションの寄せ書き。

本日の勉強会&懇親会に参加の皆さんに書いてもらいました。

続いて、同じくv2.6.30でマージされたNILFSの発表。

サーセン、いい写真が撮れなかったw

3年前のOSDL(当時)のBoFでAndrew Mortonの前で発表してたのを俺も覚えてる。

こっちも長かったなぁ…。

もう一つ、v2.6.30でマージされたLIM/IMAの紹介を宗籐さんから。

これは、プログラムの改ざん検知機能で、TPMと連携してTrusted Chainを作るためのモノ

続いて、俺の発表。(当然、写真はない)

資料は近々TOMOYO Linuxのwikiで公開されると思うので、しばし待たれい。

タイトルは「強敵よ!〜SELinuxとの比較〜」となっているが、「強敵よ!」の部分の読み方は、当然「ともよ!」です。反論は認めません。

内容自体は、SELinuxとTOMOYO Linuxの比較、、、よりもむしろ、互いのバックボーンとなっているリファレンスモニタの考え方を紹介するのが中心に。

それと、セキュリティポリシーに対する考え方を突き詰めていくと

  • SELinux
    • ポリシーを作るのは専門家の役目。ベストプラクティスはそこにある。
    • システムがポリシーに上手く合わなかったら、システムが悪い
    • 常に"俺is正義"の米国流
  • TOMOYO Linux
    • ポリシーを作るのはシステム管理者の役目。
    • アプリケーションの振る舞いは、あるべき姿を教えてくれる
    • お客様は神様ですの日本流

みたいになってそれはそれで面白いという結論に。

タイムキーパーをお願いしていたid:hshinjiさんが「1分」というのを掲げるのとほぼ同時に喋りは終了。最近の俺、時間ぴったり行きすぎじゃね?

f:id:kaigai:20090613185419j:image

勉強会の締めは吉岡さん。

ProBloggerMyAds: Promote Your Blog, Product or Service on MySpace

At the bottom of this post is a coupon code to give you a $50 credit at MyAds - this is not an affiliate promotion, just a take it or leave it offer from MyAds.

Over the last week or so I’ve had the opportunity to see inside the MyAds from MySpace.

MyAds have been an advertiser here on ProBlogger for a month or two now (consider that a disclaimer) so I wanted to see for myself how it worked. What I found was a very easy to use and pretty affordable way to advertise a product, service or even your blog.

In short - MyAds is a pay per click banner advertising system where you can advertise on MySpace and get your message in front of potentially millions upon millions of MySpace users.

You can use it with an advertising budget of as little as $5 a day and have a pretty good looking ad set up to run within just a few minutes using their ad building tool (or you can upload your own using an uploader).

Worth noting before we go any further is that to run a campaign you need a US address and credit card. As someone without either of these I could only go as far as designing an ad and testing out the targeting features. I did however talk to a number of MyAds advertisers to get their feedback (see below).

Setting up an ad is easy. Even me as a design challenged guy got one set up in a few minutes. I put a mock ad together for my 31 Days to Build a Better Blog Workbook. Here’s a screenshot of the page where you set up the ads (click to enlarge):

Picture 3 14-48-39.png

As you’ll see there are three ad size options and it’s as simple as typing in your ad copy, adding an image, choosing a background color and adding in a destination URL.

You can then preview your and move on to working out who you want to see it as well as setting a budget.

On the following screenshot you’ll see the section to choose your target audience:

Picture 4 14-48-39.png

As you make your choices about who you want to see the ad the grey area the bottom of the screen changes. It shows you how many users on MySpace will potentially see your ad as well as giving you a suggested bid price for how much the ad might cost per click to run.

The targeting options look pretty good - not only can you target by demographics (gender, age, education, relationships, parental status and location within the US) but you can also choose categories of interests and occupations of the type of person you want to reach with your ad. I tried a number of options and got the target number of people to reach quite focused and the suggested cost per click quite a bit lower than what you see in the above screenshot.

This enables you to increase the chances of conversion with your ad quite considerably.

All in all from where I stand MyAds seems like something that I’d like to use if I were running an ad campaign for a product, service or even to launch a new blog. I’ve previously used similar ad systems on other social networks with some success and the easy of use of MyAds plus what looks like great targeting make it an attractive option.

How Does it Perform? Testimony from a Heavy User of MyAds

As I was unable to go much further in the process (as a non US resident) I approached a number of people to get their feedback on the ads. One of those I talked with was Joe Frevola from Globalizer who uses MyAds quite extensively. I asked Joe a number of questions to get his insight on the why and how of MyAds:

How have you used MyAds and How has it performed?

Globalizer uses Myspace MyAds to buy media for our GlobalizerNetwork advertisers. We have had tremendous success with several campaigns on MySpace and have been impressed with its powerful targeting tools, which we have utilized to target the demographics and interests of our audience.

In comparison with Facebook, it’s hard to pick a clear cut winner and both should be a part of your media buy in most cases. Each has advantages and disadvantages and the best choice of the two will vary based on the type of campaign you are running.

While MySpace’s targeting tool is more organized and allows you to select keywords sorted by categories and sub categories, Facebook’s keyword search tool allows you to access a more robust database of target interest. MySpace does have useful demographic targeting that you can’t get with Facebook, such as the ability to specifically target mothers or recently married individuals.

Both MySpace and Facebook have solid targeting tools that should allow you to push positive ROI. While the Facebook ad platform is global, you can only target US users on MySpace currently, however word is MySpace is adding new countries later in the year. I would highly recommend the use of both ad networks to just about any advertiser.

Do you have any tips for using MyAds to share with ProBlogger readers?

There are some tricks to getting the most out of MySpace MyAds. Globalizer runs a lot of lead generation campaigns that drive a very high response, but don’t pay high bounties per conversion and therefore don’t allow us to pay very high CPC’s.

Often, when you start a campaign with a very low CPC, the ads delivers very little or no volume at all. We find that in order to kick start this sort of campaign, we overpay on CPC in the beginning and fully expect to take a short term loss as MySpace’s optimization system values the quality of our offers.

In the end, the system just wants to back into the highest eCPM, so the fact that our ads are driving very high click through rates more than compensates for the lower CPC. Once the campaign starts getting significant delivery, we are able to adjust our rate down to a profitable number and continue to experience a great a volume of traffic.

Also, when you first start running a new campaign on MySpace, definitely go with your gut and select targets that you feel will have the best chance of success with your offer. However, don’t neglect to test various demographics that you might not think would typically perform with your ads. You will often be surprised at the demos that respond to your offers.

Get $50 Credit with This Code

If you’d like to test MyAds for yourself (IF you’re in the US) they’ve given me a coupon code for ProBlogger readers to try it out and get $50 credit to use in doing so. You need to be new to MyAds to redeem it (ie if you’ve already used MyAds it’s not redeemable).

To use it - just design an ad and at the end of the process use the coupon code of Pro50. Of course this is only for those who are residents of the US and have US address and credit card details.

Post from: Blog Tips at ProBlogger.
468x60.jpg

MyAds: Promote Your Blog, Product or Service on MySpace


Michael TiemanPresident Lula's Speech at FISL 10 (English Translation)

The following is an English translation of the speech President Luis Ignatio Lula de Silva gave at the 10th FISL conference. I was there and heard a live, simultaneous translation of this speech courtesy of former OSI board member Bruno Souza.

Well, actually, Dilma spoke for the Brazillian government. There was no need for me to say absolutly nothing in here today, because I think that passing through that 'Polish corridor', which I passed to get here, it was worth at least four speeches. But I wanted to congratulate my comrades from the Ministry who are here with us.

I would like to congratulate the federal deputies, our senators, our former Governor Olivio Dutra, the mayor Fogaça. I would like to greet a special guest who arrived late here, our comrade Lourdes Munhoz, from Spain, a congresswoman for Barcelona and who advises the President Zapatero in Free Software. I do not see her face because she hasn't presented herself yet. Stand up.

I want to congratulate our dear Dean Joaquim Clutê. I want to congratulate our dear comrade Marcelo Branco, general coordinator of the 10th Free Software International Forum. I greet the comrades of the Brazilian public institutions who are here. I see in front of me the Bank of Brazil and Serpro. I greet the foreign guests. I salute that child who is there, and must be thinking: what are we doing here and why her parents brought her here? One day, she will know.

And I want to congratulate a special person who is here, which is Sergio Amadeu, because now that the dish is prepared ... I also want to greet the comrad Tigre, our chairman of the Industry Federation of Rio Grande do Sul.

Now that the dish is prepared, is very easy for people to eat it. But to prepare this dish was not a joke. I remember the first meeting we had, at Granja do Torto, which I understood absolutely nothing of this language that this people were deciding, and that was a huge tension between those who advocated for the adoption of free software by Brazil and those who thought we should do the sameness of always, buying, paying for others intelligence and, thanks God, prevailed in our country the issue and the decision of free software. We had to choose: or we were going to the kitchen to prepare this dish the way we wanted to eat, with the seasoning that we wanted, to give a Brazilian taste to our food, or we would eat what Microsoft wanted us to eat. Prevailed, simply, the idea of freedom.

read more

CryptogramThe Insecurity of Secrecy

Good essay -- "The Staggering Cost of Playing it 'Safe'" -- about the political motivations for terrorist security policy.

Senator Barbara Boxer has led an effort to at least put together a public database of ash storage sites so that people can judge the risk to the areas where they live. However, even this effort has been blocked not by coal companies or utilities, but by the DHS. How could it possibly be a national security interest to cover up the location of material that's "not toxic or anything?" It's not. In fact, even if the ash turns out to be as bad as its worst critics fear, blocking the database is far more dangerous than revealing the location of these sites. Not only has there not been any threat against these sites by terrorists, and no workable scenario by which they might cause a problem, coal slurry impoundments are already failing with regularity, dousing parts of America with millions of gallons of this material. It doesn't take terrorists to make this happen.

Blocking the release of this information doesn't protect the citizens of the United States in any way. It's just another example of the same creeping secrecy that makes cities more difficult to manage because of secrecy over facilities. The same creeping secrecy that "blurs" national monuments from images and puts intentional gaps in public information. The same creeping secrecy that increasingly elevates the most unlikely attack -- the shoe bombers of the world -- above our right to know what's going on around us so that we can make informed decisions. The same secrecy that defends torturers.

CryptogramThe Insecurity of Secrecy

Good essay -- "The Staggering Cost of Playing it 'Safe'" -- about the political motivations for terrorist security policy.

Senator Barbara Boxer has led an effort to at least put together a public database of ash storage sites so that people can judge the risk to the areas where they live. However, even this effort has been blocked not by coal companies or utilities, but by the DHS. How could it possibly be a national security interest to cover up the location of material that's "not toxic or anything?" It's not. In fact, even if the ash turns out to be as bad as its worst critics fear, blocking the database is far more dangerous than revealing the location of these sites. Not only has there not been any threat against these sites by terrorists, and no workable scenario by which they might cause a problem, coal slurry impoundments are already failing with regularity, dousing parts of America with millions of gallons of this material. It doesn't take terrorists to make this happen.

Blocking the release of this information doesn't protect the citizens of the United States in any way. It's just another example of the same creeping secrecy that makes cities more difficult to manage because of secrecy over facilities. The same creeping secrecy that "blurs" national monuments from images and puts intentional gaps in public information. The same creeping secrecy that increasingly elevates the most unlikely attack -- the shoe bombers of the world -- above our right to know what's going on around us so that we can make informed decisions. The same secrecy that defends torturers.

CryptogramThe Insecurity of Secrecy

Good essay -- "The Staggering Cost of Playing it 'Safe'" -- about the political motivations for terrorist security policy.

Senator Barbara Boxer has led an effort to at least put together a public database of ash storage sites so that people can judge the risk to the areas where they live. However, even this effort has been blocked not by coal companies or utilities, but by the DHS. How could it possibly be a national security interest to cover up the location of material that's "not toxic or anything?" It's not. In fact, even if the ash turns out to be as bad as its worst critics fear, blocking the database is far more dangerous than revealing the location of these sites. Not only has there not been any threat against these sites by terrorists, and no workable scenario by which they might cause a problem, coal slurry impoundments are already failing with regularity, dousing parts of America with millions of gallons of this material. It doesn't take terrorists to make this happen.

Blocking the release of this information doesn't protect the citizens of the United States in any way. It's just another example of the same creeping secrecy that makes cities more difficult to manage because of secrecy over facilities. The same creeping secrecy that "blurs" national monuments from images and puts intentional gaps in public information. The same creeping secrecy that increasingly elevates the most unlikely attack -- the shoe bombers of the world -- above our right to know what's going on around us so that we can make informed decisions. The same secrecy that defends torturers.

Planet Linux AustraliaJeremy Visser: Nazi Noodles

Today, Dad brought home a bag full of Asian nibblies. Among them were some packs of ramen noodles. I found this pack to be particularly striking:

Ramen noodles with swastika on packaging

Yes, yes, I know. It’s a Hindu or Buddhist swastika, not the Nazi form. But I’m pretty sure the noodles would be banned in Germany in one way or another. And yes, I just Godwined my blog. Ah well — it was fun while it lasted.

Planet DebianKartik Mistry: Some updates


* While chatting, Samay told me that he has started his company. I was so excited to hear this. A just passedout student in Ahmedabad can do this? I visited their place and its real Garage kind of startup. They are still setting up things but I loved their energy and ideas. Thanks Samay, Tanmay and Puja (or Pooja). However, their company’s name is ‘Entourage Solution’ and I just warned Samay that Entourage is also name of Microsoft’s product :P

* Updated many pending packages, specially for debian-in repository. Fontypython is waiting for some testing from user side and will upload 0.4 soon after that..

Planet DebianMJ Ray: Small is beautiful or big is better? (#coop09 sw audio download)

There were several interesting conferences last week. An honourable mention to the Worker Co-operative Forum, but the most interesting for me was the Cooperatives-SW annual conference in Plymouth on Tuesday 23 June 2009.

This free event was split into three parts: the formal business (reports, accounts and so on), an interesting direction-finding session facilitated by Marc from the Zebra Collective and a debate on the question “small is beautiful or big is better”? At the moment, there are a few massive UK co-ops emerging, particularly in retail, but also a thriving range of small independents. Must co-ops grow to survive? Are large co-ops as democratic?

The question was debated by Alan Bonner, chief exec of Radstock Cooperative Society, Chris Herries, board member of the Cooperative Group, Alex Lawrie, of Somerset Cooperative Services and Steve Guy of (I think) City of Plymouth Credit Union.

Download it in Ogg Vorbis format (5.3Mb, about 49 minutes, instructions on how to play, hosted by TTLLP). The recording was taken on an s1mp3 player I quickly threw on the table, but it performed remarkably well. There should be a video too, but it needs some codecs I don’t have.

So who do you agree with? Is it the old software question: do you merge, collaborate or fork to survive?

Planet DebianJulien Danjou: awesome: larger open-source team than LXCDE one of the largest open-source teams in the world

I just found this blog post on LXDE blog while reading LWN.net.

It made me smile because that's what Ohloh says for awesome:

Over the past twelve months, 70 developers contributed new code to awesome. This is one of the largest open-source teams in the world, and is in the top 2% of all project teams on Ohloh. For this measurement, Ohloh considered only recent changes to the code. Over the entire history of the project, 99 developers have contributed.

So awesome project is roughly twice bigger than LXDE. Impressive! ;-)

Planet Linux AustraliaJason Parker-Burlingham: Pure cheek on my part


LED bulb casts a rainbow
Originally uploaded by Nooks

I happened across a rainbow being cast on the floor of our building's lobby while I was walking to the car with a gift of LED light bulbs from work so I took a few minutes to try for this pretty obvious picture. Fun shot, finding an angle to reduce shadow was somewhat difficult and I had to get all the way down onto the floor to make it really work.


365 TomorrowsThe Amazing Transported Man

Author : David Bradshaw

I always believed that magic was simply what science had yet to explain or tame. When Ashford’s empty frame crashed to the ground, the wild forces at work became far more significant.

“It’s going to be one of mankind’s defining moments!” Ashford ranted in the bunker’s cafeteria earlier that day, “And I’m going to be in the middle of it…” He trailed off, wistfully.

Since we got clearance to run a human trial, he’d been like this, cycling between raving and muttering. Ashford was supposed to be the world’s first living human to undergo transportation.

Ingram snapped at him, “Don’t be a show off. Sit down and eat something.”

“Hell no. Anything in my stomach will just be more for the machine to chug. Besides, I’ve been too jittery to eat much today, too excited,” said Ashford. He kept good spirit, I had to give him that.

I excused myself to get to work preparing the apparatus for the afternoon’s test. The hours disintegrated into minutes, then seconds, and blew away.

Eventually various personnel from the labs trickled in, huddled around the camera for a good view. Despite not being known to the press or public, this was going to be a popular show.

When the whole team assembled, Ashford stepped forward to address his audience.

“This is test 5.1, the first living, human transportation. As you can see behind me, two tanks are positioned side-by-side. I, Dr. Joseph Ashford, will enter the chamber on the left and be transported to the chamber on the right. I assure you,” he said with a grin, “this is not a trick or a joke.”

Ingram could hardly contain a groan. Ashford was just a natural showman, or at least too charismatic for just a scientist.

He stepped into the chamber and gazed confidently upon his fans. The bright white lights on the equipment became stage lighting. The door sealed behind him, a red curtain descending.

All eyes were on the video feed. I began counting down. In my head, a calming habit of mine, I thought the numbers in Latin: Decem, novem, octo, septem, sex, quinque, quattor, tres, duo, unus.

As I stabbed the button deep into the terminal, a thought appeared at the forefront of my mind, “Magic is what science cannot yet explain. We’re standing on the edge of something magic cannot explain.”

In the first chamber, Ashford went to dust. In the second, dust went to bone, to flesh, to skin, to hair, and to a body. It lamely collapsed against the cool metal. As the door automatically pulled open, Ashford’s sepulcher gave birth to his limp corpse.

A dozen scientists in the room, we all started talking. Rushed yet hushed chatter. A skittering cacophony flying across every surface like a cockroach. Ingram checked the thing’s pulse and, finding none, let its arm drop to the ground, unceremoniously.

I looked down at the button I pressed that initiated the sequence that teleported Ashford. I doubted that anything could pull me away from the image of what was let. Guilt couldn’t drive out the horror.

A small voice in the crowd of sound and fury pierced every other word uttered, “Did we… Get his soul?”

Discuss the Future: The 365 Tomorrows Forums
The 365 Tomorrows Free Podcast: Voices of Tomorrow
This is your future: Submit your stories to 365 Tomorrows

Planet LCAOff to GUADEC

Heading to the airport shortly to fly to GUADEC/GCDS.

Doing a bit of an airport tour: Perth, Singapore, Paris, Madrid, Las Palmas; then Las Palmas, Madrid, Gatwick; then Heathrow, Paris, Singapore, Perth. It's like the days of yore, when you had to stop all the time to refuel.

When I get home, there's a week left in Perth before our stuff is uplifted for the move to Melbourne. Have spent the morning packing books into boxes. Steph is going to finish most of the packing while I'm away.

sevastopol is taken!!

365 TomorrowsSix Degrees of Separation and the Collapse of the Interstellar Flyway System

Author : Patricia Stewart, Staff Writer

In the twenty fifth century, scientists were convinced that the longest single jump possible through hyperspace within the spiral arms of the Milky Way was 3.3 parsecs. This limit was the consequence of the density of dark matter and its effect on the stability of tachyon waves. When longer jumps were attempted, the tachyon waves lost their cohesion, and there was significant distortion of the meson matter when it returned to normal space-time. Such occurrences gave new meaning to the phrase, “having a bad hair day.”

Because of the hyperspace jump limit, “Way Stations” were positioned near the intersections of high density traffic corridors at roughly 2.5-3.0 parsec intervals. The largest of these Way Stations was simply called “The Oasis.” It was located 2.7 parsecs from the high velocity Terran Throughway and 5.8 parsecs from the Orion Interchange.

***

Philip Coleman rejoined his friend in the spacious Oasis lounge.

“Where have you been?” asked Manfred Sola.

“Just stretching my legs.”

“Well, now that you’re back, I just wanted to say again that you made the right decision to take a vacation after those bastards rejected your PhD dissertation. A few weeks on Orion II will do you good.”

“Oh, we won’t be going to Orion II,” replied Coleman. “That was just a ruse I used to get to The Oasis. I intend to show the review panel that my equations are flawless.”

“Show them?”

“Yeah,” Coleman replied with a chuckle. “My mathematical equations proved irrefutably that space travel must adhere to the Law of Six Degrees of Separation. Right now, Earth’s influence is limited to a sphere just under 20 parsecs in diameter. My formula dictates that Earth cannot expand any further into the galaxy until we can increase the distance of a single hyperspace jump.”

“What are you talking about?”

“Nodes, of course. Within the sphere, there are dozens of uniformly spaced Way Stations. They’re called nodes in my thesis. In order to get from point A to point B within the sphere you cannot pass through more than six nodes. It’s a fundamental law of the universe. It establishes the maximum diameter of the sphere.”

“What a minute. Are you saying that if we build a Way Station three parsecs beyond the furthest one, we can’t get to it?”

“No. What I’m saying is that you can’t get to it if you need to make seven jumps. Six jumps is the absolute limit. Those dimwitted professors said my logic was flawed. They wanted empirical evidence to substantiate the analysis. Proof, in other words. As if my derivations weren’t enough!”

“If I concede your point, which I don’t, how is coming to The Oasis going to prove it?”

“It’s simple. Part of the Law of Six Degrees of Separation specifies that some nodes are more important than others. They’re called ‘Hubs.’ Because of their strategic locations, Hubs are used more often than the average node. In fact, 72% of all interstellar trips across the diameter of the sphere pass through The Oasis. Therefore, if the primary and secondary power transfer couplings on The Oasis were to be destroyed, this station could not function as a Hub. Interstellar travel would collapse because so many trips would require 7 jumps, which is not possible. Such a scenario would prove my dissertation.” Just then the station shuttered. Seconds later, the lights in the lobby flickered and went out. In the darkness, the waiting passengers began screaming. “Heeheehee,” snickered Coleman. “It’s proof they wanted, it’s proof they’ll get.”

Discuss the Future: The 365 Tomorrows Forums
The 365 Tomorrows Free Podcast: Voices of Tomorrow
This is your future: Submit your stories to 365 Tomorrows

Accelerating FutureR.U. Sirius Interview on Transhumanism at 10 Zen Monkeys

It’s here. Lots of interesting questions and answers. Nice look into the mind of R.U. By the way, he just started teaching an online class on transhumanism at the Evolver Academy. You can probably still join the course for $120, though I haven’t double-checked on that.

Accelerating FuturePrizes at CyBeRev

CyBeRev is offering cash and other prizes (like cool video recording sunglasses) for people whose mindfiles do the best at conversing like people. I’m not sure exactly how mindfiles converse, but if you figure that out, you can win. If you win, be sure to take pictures of yourself with your cool shades.

Planet Linux AustraliaAdam Harvey: Let me fire up the DeLorean

Found and reported a couple of PHP 5.3 bugs yesterday. That isn’t such a surprise; it’s a new release, after all, and we’re currently in the midst of developing code for the first time against 5.3 here at work. One of them is a crasher, but an obscure one reliant on the new-in-5.3 INI_SCANNER_RAW mode in parse_ini_file and a rather odd configuration file, so as these things go, it’s pretty minor, and scottmac has jumped on it very promptly indeed (thanks!). The response from Jani was interesting, though:

Thanks for not reporting this before release..

Now, Jani does a tremendous amount of work triaging PHP bugs and I — and every other PHP developer (particularly those of us who does this for a living) — owe him a huge debt for that. But frankly, I resent the implication that I’ve somehow sat on a crasher since before 5.3.0 was released and only submitted it now as some sort of weird vendetta against the PHP internals team. Funnily enough, I only found it while I was reducing the other, more trivial bug down to a minimal test case.

I get far worse things implied in my direction when I’m out on a Saturday night in Northbridge, so really, I’m not that fussed. (I’m obviously a bit fussed, though, since I’m writing this.) I do wonder how somebody new to the PHP community would feel, though — my guess is that you could forget about future bug reports in some cases, and that just isn’t a win for anyone.

Planet Linux AustraliaKylie Willison: Rust Dyeing Fabric

Rust Dyeing Fabric - Hobby Farms

Shared via AddThis

I'm trying out this rust dyeing because I'd heard about it at college. We've just finished a whole dyeing unit and now we're doing printing and stamping!!! Lots of fun!!!

Harald WelteWireshark packet dissector for GSM 12.21 (A-bis OML)

During the last weeks I've been spending some time to start a wireshark dissector plugin for GSM 12.21, which is the Organization and Maintenance protocol between BSC and BTS. Using this protocol, many aspects of a BTS are configured by the BSC.

I have already implemented the BSC side of 12.21 inside OpenBSC, and OpenBSC contains parsing code and debug logs about what is happening on this protocol. However, I think it is much better to remove most of that debug printing code from OpenBSC and move it into wireshark. Whoever needs per-message debugging, can start wireshark and look at the output - with the advantage of extensive filtering capabilities.

The protocol is quite complex and has many different messages with each their own set of attributes. So the current work is far from being complete, but it's already at a point where it is really useful.

I've put a specific focus on implementing the vendor-specific bits for ip.access, since those are hard to figure out and much more difficult to implement for anyone who hasn't spent as many weeks looking at hexdumps from their Abis-IP protocol as me. Parsing standard 12.21 messages is easy, just read the publicly-available spec and add wireshark code for it.

In case you're interested, the plugin is available from this path in the OpenBSC git tree

TEDHow to watch TEDGlobal 2009 live from home with friends or family

Later this month, you can watch the TEDGlobal 2009 conference live from the UK through an Associate membership -- offering a virtual front-row seat at the conference via a private, live web stream of the main-stage events.

TEDGlobal Associate membership costs $995 and includes a password-protected, single-computer, live web stream of TEDGlobal 2009 as it unfolds in Oxford, and the right to watch with up to 10 other people. Most talks from TEDGlobal 2009 will eventually become TEDTalks, available free on TED.com. But Associate members will be able to watch the full main-stage sessions live as they happen, including introductions, short talks, musical performances, video interstitials and audience interactions that are not shown on the website. Associate membership groups who watched the last TED conference live from Long Beach gave us enthusiastic feedback, persuading us to repeat this service. We learned that people who carve out the time and gather with friends for a multi-day virtual TED experience can gain as much inspiration as those attending live.

TEDGlobal 2009 will explore "The Substance of Things Not Seen." Speakers this year include world-renowned philosophers, scientists, religious leaders, entertainers, artists, musicians and technologists -- see the lineup here. The event will take place July 21-24 in Oxford, UK.

TEDGlobal Associate members will be issued a noncommercial license that allows them to share their webcast with up to 10 viewers in the same room. Also included with each Associates membership: a full year of the legendary TED Media Club, with 5 shipments of books, DVDs and other media throughout the year; enhanced social networking on TED.com; and an exclusive welcome kit that's not available to any other TEDsters, with a viewing diary, postcards and other keepsakes.

Learn more about TEDGlobal Associates membership >>

July 02, 2009

The Reid ReportI ain't sayin' she's a gold digger... Debbie Rowe wants the kids

The lady with the Jay Leno Chin, who has alternately described herself as merely a "vessel" and a "thoroughbred," for the production of Michael Jackson's progeny; who said she merely "offered her womb to Michael as a gift" (and for the gift of money for herself,) and who has said that she has no relationship with the children she served as surrogate mother for, and that she doesn't want to see them, now says, totally coincidentally a day after Jackson's will was released, and perhaps after figuring out exactly how much money is on the table, says she wants "her" children. Debbie Rowe is apparently willing to separate Paris and Prince Jackson from their younger brother and the only family they know, and take them from their grandmother ... because...?

Rowe would apparently have a strong legal case, if not a moral one, even though she may be no more the biological mother of those children than Jackson was the biological father (though he actually was a parent to them, unlike, say ... her...) and we could even see the surrogate mother of the third child, "Blanket," come forward for her piece of the action ... I mean the love of her child ... too. Well, if it's headed to court, here are a few alleged Debbie Rowe statements the court might want to take into consideration:

On her maternal instincts and parenting ability:
""I was just the vessel. It wasn't Michael's sperm. Just like I stick the sperm up my horse, this is what they did to me. I was his thoroughbred."....

"I know I will never see them again. I was never cut out to be a mother - I was no good. I don't want these children in my life. My children are my animals now."
On her rent-a-womb:

"I offered him my womb - it was a gift. It was something I did to keep him happy."

"I got paid for it, and I've moved on. I know I will never see my children again."

And this:

"I was never a good mother, I never felt any attachment to them. It was a better feeling giving them to him than it was keeping them as my own.

So what changed, Debbie dear? Well ... maybe it's this, as reported by TMZ:

We've learned who's getting what in Michael Jackson's trust. Here's how it breaks down.

Katherine Jackson will get 40% of the assets.
Michael's 3 kids will get another 40%.
And the remaining 20% goes to several children's charities. We're told the charities have not been designated yet and are not specified in the trust.
What's 40% of $1 billion? I'll bet Debbie's done the math ... and would it be too much to create a charity called The Deborah Jean Rowe Foundation, like, yesteray???

Care to vote on whether she should get custody of the money ... I mean the kids? Here you go!

Flashback: Debbie before she gave birth to their second child, pretends to be really married to Michael, but admits their "friendship is more important." Now, of course, she's blabbing to anyone who'll talk to her that their marriage was a sham (not to mention outing Jackson as not the kids' bio father.)

Flashback 2: Debbie defends giving up custody of her kids back in 2003, adding: "my kids don't call me mom because I don't want them to." Watch:



Plus: will the nanny also enter the custody sweepstakes?

Ah, dying rich!

Google AdsenseSpeeding up: Attracting more visitors with content and community

We're well under way with our five-week educational series about speeding up your business in a slowdown, which we kicked off two weeks ago. This week, you'll hear tips from Jack Herrick, the founder of wikiHow.com, about attracting new visitors to your site. As we share more tips over the next two weeks about increasing your revenue potential and attracting more advertiser budget, we hope you'll leave comments with your own suggestions for growing your business. You can also follow the series at www.google.com/ads/speedingup.

Jack Herrick is the founder of wikiHow, a collaborative writing project to build the world's largest, highest quality how-to manual. wikiHow is a wiki, which means that any visitor to the site can create or edit wikiHow articles. wikiHow is currently ranked as the 100th most popular site on the web by Quantcast, and receives over 16 million unique visitors each month. Today, Jack shares three of his favorite tips to attract visitors. We hope they'll help you come up with new ways to entice visitors to your sites as well.



Tip #1: Produce great content

The first tip is obvious, but it's also the most important. The articles on wikiHow vary widely in quality. We have some of the highest quality how-tos on the net, for example How to Hard Boil an Egg, and we also have some fairly ugly, unfinished drafts we call stubs. Interestingly, the high-quality articles don't get just a little more traffic than the mediocre articles, they get hundreds of times more. When you can produce the single best page on the Internet on any given topic, people will find it and share it with their friends. Don't settle for acceptable content, always strive to produce amazing content that your readers can't resist sharing.

Tip #2: Learn to share

My second tip is more counterintuitive. To attract more readers to your website, consider putting your content under a Creative Commons license so it can be widely distributed. Everything on wikiHow is under a license that allows other websites to publish and even modify or adapt our content for re-use on their sites. In fact, we have a button at the bottom of every article that allows webmasters to copy and paste the HTML right onto their site. Many webmasters are afraid to share their content, because they worry they will only be aiding competition. By sharing, what you are really doing is encouraging your competitors to provide free advertising for you. The more people who see your content on other sites, the more likely they are to eventually come straight to you.

Tip #3: Make your community a team

Finally, I'd encourage you to allow real collaboration on your site. Lots of websites try to create online communities. To use a basketball analogy, most online communities are just groups of individuals shooting freethrows alone. On wiki websites, people play together as a real team. Humans are hard wired to want to work in groups and collaborate. By allowing this to happen, you can create a passionate community of people that will build something bigger than any one person could accomplish on their own. And that will in time attract a large audience.

Hopefully Jack's tips will help you come up with some new techniques to attract visitors to your site. In addition to Jack's tips, here are a few extra resources focused on attracting more visitors.

  • Learn the basics of Search Engine Optimization with Google's SEO guide.
  • Submit your content so that Google can help you distribute it across Google Web Search, Maps, Product Search, iGoogle, and more.
  • Drive more traffic to your site with programs like AdWords.


Planet SAGE-AUDomainKeys and OpenSSL have Defeated Me

I have previously written about an error that valgrind reported in the STL when some string operations were performed by the DKIM library [1]. This turned out to be a bug, Jonathan Wakely filed GCC bug report #40518 [2] about it, Jonathan is one of many very skillful people who commented on that post.

deb http://www.coker.com.au lenny gcc

I’m still not sure whether that bug could actually harm my program, Nathan Myers strongly suggested that it would not impact the correct functionality of the program but mentioned a possible performance issue (which will hurt me as the target platform is 8 or 12 core systems). Jaymz Julian seems to believe that the STL code in question can lead to incorrect operation and suggested stlport as an alternative. As I’m not taking any chances I built GCC with a patch from Jonathan’s bug report for my development machines and then built libdkim with that GCC. I created the above APT repository for my patched GCC packages. I also included version 3.4.1 of Valgrind (back-ported from Debian/Unstable) in that repository.

Nathan Myers also wrote: “Any program that calls strtok() even once may be flagged as buggy regardless of any thread safety issues. Use of strtok() (or strtok_r()) is a marker not unlike gets() of ill thought out coding.” I agree, I wrote a program to find such code and have eliminated all such code where it is called from my program [3].

I think it’s unfortunate that I have to rebuild all of GCC for a simple STL patch. My blog post about the issue of the size and time required to rebuild those packages [4] received some interesting comments, probably the most immediately useful one was to use --disable-bootstrap to get a faster GCC build, that was from Jonathan Wakely. Joe Buck noted that the source is available in smaller packages upstream, this is interesting, but unless the Debian developers package it in the same way I will have to work with the large Debian source packages.

I have filed many bug reports against the OpenSSL packages in Debian based on the errors reported by Valgrind [5]. I didn’t report all the issues related to error handling as there were too many. Now my program is often crashing when DomainKeys code is calling those error functions, so one of the many Valgrind/Helgrind issues I didn’t report may be the cause of my problems. But I can’t report too many bugs at once, I need to give people time to work on the current bug list first.

Another problem I have is that sometimes the libdkim code will trigger a libc assertion on malloc() or free() if DomainKeys code has been previously called. So it seems that the DomainKeys code (or maybe the OpenSSL code it calls) is corrupting the heap.

So I have given up on the idea of getting DomainKeys code working in a threaded environment. Whenever I need to validate a DomainKeys message my program will now fork a child process to do that. If it corrupts the heap while doing so it’s no big deal as the child process calls exit(0) after it has returned the result over a pipe. This causes a performance loss, but it appears that it’s less than 3 times slower which isn’t too bad. From a programming perspective this was fairly easy to implement because a thread of the main program prepares all the data and then the child process can operate on it – it would be a lot harder to implement such things on an OS which doesn’t have fork().

DomainKeys has been obsoleted by DKIM for some time, so all new deployments of signed email should be based on DKIM and systems that currently use DomainKeys should be migrating soon. So the performance loss on what is essentially a legacy feature shouldn’t impact the utility of my program.

I am considering uploading my libdomainkeys package to Debian. I’m not sure how useful it would be as DomainKeys is hopefully going away. But as I’ve done a lot of work on it already I’m happy to share if people are interested.

Thanks again for all the people who wrote great comments on my posts.

Planet DebianJoey Hess: DebConf9

I'm going to DebConf, and will be giving what I think is the first talk I've ever done about debhelper there. Incidentially, debhelper in experimental has some nice new features.

I have no idea how I'm getting from the Madrid airport to Cáceres, and would rather spend time working on my talk than trying to book tickets internationally, so I hope buying train tickets at the station is not a foolish plan..

Global GuerillasJOURNAL: Financial Capitalism's Failure?

Here's an article from the premier financial newspaper in the world, the Financial Times, on a situation that I believe is catalyzing the current crisis (hoisted from Paul Kedrosky's blog).  

Just why is there so much debt in the Anglo-Saxon world? Bankers and regulators know well that it is in nobody’s long-term interests to have allowed borrowing to escalate to a position where the US now owes far more, as a multiple of the economy, than at the start of the Great Depression.  

The answer is capitalism’s dirty little secret: excessive lending was the only way to maintain the living standards of the vast bulk of the population at a time when wealth was being concentrated in the hands of an elite.  The amount by which the elite has benefited is startling, and illustrates the problem with lightly regulated free markets: the rich get much richer while the rest do not get richer at all. According to Société Générale economists, the inflation-adjusted income of the highest-paid fifth of US earners has risen by 60 per cent since 1970, while it has fallen by more than 10 per cent for the rest. As was recently pointed out in the New York Review of Books, the Walton family, of Wal-Mart fame, is wealthier than the bottom third of the US population put together – about 100m people. These are staggering statistics, confirmed by measures such as the US and UK’s ever-rising Gini coefficients, which estimate income disparity. Another way of putting this is that the share of profits in gross domestic product is at a 100-year high, or was until very recently.

NOTE:  The reason I posted about this and think it is interesting is simple.  Like Kennan (the intellectual architect of Cold War's "containment" policy), it's important to recognize what really generates a long term victory in a protracted conflict.  Then, like now, real victory requires a long term improvement in the quality of life -- from incomes to wealth to societal trust to fairness -- of the maximal number of people (to slow/reverse communism in his case and to slow/reverse disorder in ours) while at the same time, blunting the kinetic advance of the collective opposition at the least possible expense/disruption to the first goal.  We appear to be failing at both of the goals required for long term victory.  Incomes and societal trust are evaporating while we spend tens of millions to kill each insurgent (of which there is an endless supply, particularly if you seek them out).

Planet DebianDebian Sysadmin Team: Martin Zobel-Helas: Howto mess up the Debian Project homepage

I recently blogged about the GeoDNS setup we plan for security.debian.org. Even though all DSA team members agree that the GeoDNS setup for security.debian.org should come alive as soon as possible, we still fear to break an important service like security.d.o.

Yesterday I decided without further ado to float a trial balloon and converted DNS entries for the Debian Project homepage to our GeoDNS setup. While doing so, we found out that some part of our automatic deployment scripts still need to be adjusted to serve more than one subdomain of the project.

That setup is live for about eighteen hours now, and the project homepage now resolves it IPs via GeoDNS. For now, we are using senfl.d.o for Northern America, www.de.debian.org and www.debian.at for Europe and klecker.d.o for the rest of the world. From what I can see from GeoDNS logs, it seems to work fine, and the load stays reasonably low, so after a short test period we might add additional services like security.debian.org to GeoDNS.

Global GuerillasLINKS: GG news

Interesting items of interest:

  • Efficient markets and entrepreneurial guerrillas: CNN. "This soldier and three Afghan soldiers were captured by low-level militants and then quickly "sold" to the clan and network led by warlord Siraj Haqqani -- believed to be deeply involved in the action."

  • The new counter-insurgency "beltway think tank" at CNAS (the Center for New American Security) gets some push-back from Bill Lind and The American Conservative.   The reason?  They abhor the idea that military, armed with a "new" counter-insurgency doctrine bulked up by social welfare programs, can manufacture democratic capitalists in every corner of the world.  Essentially, they think this is merely a reprise of  the now thoroughly discredited neo-con theory (as in, all you need to do is topple the government and the people will immediately become democratic capitalists auto-magically), and doomed to failure/tears.

  • One more point on CNAS.  Isn't this organization really the brain child of Tom Barnett given the sys-admin approach to foreign policy they are promoting?  I believe it is.

  • Samuel Logan, fresh from his new book on the MS-13, thinks that looming leadership crisis/rift between the Gulf Cartel and the growing Zetas, will spark widespread violence/death not only Mexico, but in US cities. 

The Reid ReportHELP on the way?

when you want something done right, get Teddy Kennedy to do it. It seems Kennedy has swooped in and delivered a health care plan with a public option that has the support of all 13 Democrats on the relevant Senate committee, called HELP. The cost of the bill is also way down: from $1 trillion for the previous try, to $611 billion, with 97 percent of Americans covered. Nice. It's called the Affordable Health Choices Act. Read it for yourself here. The committee members are as follows. As you'll see, the committee doesn't include any of the Democrat Refusniks. The Republican side: not so much (includes the cranky old man himself, John Sydney McCain.)

Democrats by Rank:

Edward Kennedy (MA) - Chairman
Christopher Dodd (CT)
Tom Harkin (IA)
Barbara A. Mikulski (MD)
Jeff Bingaman (NM)
Patty Murray (WA)
Jack Reed (RI)
Bernard Sanders (I) (VT)
Sherrod Brown (OH)
Robert P. Casey, Jr. (PA)
Kay Hagan (NC)
Jeff Merkley (OR)

Republicans by Rank:

Michael B. Enzi (WY) - Ranking member
Judd Gregg (NH)
Lamar Alexander (TN)
Richard Burr (NC)
Johnny Isakson (GA)
John McCain (AZ)
Orrin G. Hatch (UT)
Lisa Murkowski (AK)
Tom Coburn, M.D. (OK)
Pat Roberts (KS)

The Reid ReportMeanwhile, in another corner of neocon crazyland...

John Bolton sees the Iran uprising as a chance to "explain" to our little brown friends how wonderful an Israeli airstrike would be! It wouldn't be the first time ... this month even ... that Bombs Away Bolton has tried to turn the Green Revolution into a turkey shoot. I think the appropriate response is laughter... or an intervention at the Washington Post.

Lenovo Blogs - ConnectionsLenovo netbook evolution

The S10-2  and the S12, two of Lenovo’s newest netbooks are now available for sale, and while there are plenty of reviews and detailed discussion about the systems already circulating, I thought it might be interesting to talk to someone who has been involved in Lenovo’s netbook program.   

 This week, I caught up with fellow Lenovo blogger, Brandon Hoe.

Brandon shares a bit about himself and the various projects that he’s involved with, the S10 evolution, and his thoughts on some of the trends he’s seeing for netbooks in the future.    I hope Brandon explores some of these points in more depth on his blog in the near future.

 

The video is a bit long at over six mins (I think 2-3 would be ideal for this kind of thing), but Brandon was a great sport and shared his thoughts naturally.  I learned a few things while doing this,  and will ensure better camera work and audio for future endeavors.

CryptogramInformation Leakage from Keypads

Can anyone guess the entry codes for these door locks?

digital lock security keypad

There are 10,000 possible four-digit codes, but you only have to try 24 on these keypads. The first is most likely 1986 or 1968. The second is almost certainly 1234.

CryptogramInformation Leakage from Keypads

Can anyone guess the entry codes for these door locks?

digital lock security keypad

There are 10,000 possible four-digit codes, but you only have to try 24 on these keypads. The first is most likely 1986 or 1968. The second is almost certainly 1234.

CryptogramInformation Leakage from Keypads

Can anyone guess the entry codes for these door locks?

digital lock security keypad

There are 10,000 possible four-digit codes, but you only have to try 24 on these keypads. The first is most likely 1986 or 1968. The second is almost certainly 1234.

Planet Linux AustraliaStewart Smith: Dogfooding a pastebin

http://pastebin.flamingspork.com/

A pastebin running Drizzle and the Drizzle PHP Extension (which is on top of libdrizzle).

TEDHappy anniversary, T.G.I.M.B.O.E.J.

tgimboej.jpg

T.G.I.M.B.O.E.J. stands for The Great Internet Migratory Box Of Electronic Junk, and it's celebrating its first anniversary this week. Do think of it as partly a social experiment, but more so a free-range parcel service-based electronics grab bag that circulates among hardware hackers who are eager to discover useful, cool, old, or even rare treasures from the world of circuits old and new. According to their own description:

[It] is a progressive lending library of electronic components. An internet meme in physical form halfway between P2P zip-archive sharing and a flea market. It arrives full of wonderful (and possibly useless) components, but you will surely find some treasures to keep. You will be inspired look through your own piles, such as they are, and find more mysterious components that clearly need to be donated to the box before it is passed on again.

If you're a tinkerer, a smart hardware geek, a fab-lab fan or aspiring aeronaut who wants to put that dusty old pile of circuit boards, switches, magnets, transistors, transformers, LCDs, CRTs and LEDs to a greater use (and perhaps find some interesting or useful new treasures to fiddle with), T.G.I.M.B.O.E.J. has a useful wiki that will tell you how you can get started.

The Reid ReportCrazed wingers hoping Osama bin Laden can save America

... by attacking us, preferably with a "major weapon." Seriously. You know, when you get called out by people at the Free Republic and Little Green Footballs, you know you're on the wrong track. Here's crazy Glenn Beck and his Fox News guest, former head of the CIA's Bin Laden unit (seriously...) and self-described "lifelong Republican," Michael Sheuer, who appears to have been driven mad by the revocation of Bush-era rendition, torture and domestic spying policies. (And note how Beck does his best to channel Osama's thoughts):



And here's Jon Stewart's take:

The Daily Show With Jon StewartMon - Thurs 11p / 10c
Osama bin Laden Needs to Attack America
www.thedailyshow.com
Daily Show
Full Episodes
Political HumorJason Jones in Iran

The Reid ReportTip of the hat: Stephen Colbert, motivating the GOP through hunger

He serves a Republican state representative who wants to withhold food from needy children ... by recommending that she stop being served. Enjoy:

The Colbert ReportMon - Thurs 11:30pm / 10:30c
Tip/Wag - Cynthia Davis & Fox News
www.colbertnation.com
Colbert Report Full EpisodesPolitical HumorJeff Goldblum


Crunch!

Michael TiemanOpen Source Incentives

My recent visit to Brazil was a wonderful validation of the belief that I've held for more than 20 years: if you give people a better way to do things, they'll do better things. The Brazilian government continues to expand its adoption of open source, both across more and more ministries and deeper within each ministry. I had the pleasure of talking with one of Brazil's top IT strategists, and she told me some very interesting things, both encouraging and alarming.

read more

ProBloggerFeedburner Add Customizable Subject Lines to Email Subscriptions

One month ago I wrote an open letter to Google/Feedburner suggesting that it might be time to add some more features to Feedburner - particularly the ability to customize subject lines of those subscribing to a feed via RSS.

It seems that they’ve been hard at work on that very feature.

Today I logged into my Feedburner account and noticed this in the ‘Email Branding’ area.

feedburner-update.jpg

Yep - it’s the feature we’ve been waiting for! All you need to do now is add the tag ${latestItemTitle} into the subject line and it looks like you’re set to have new subject lines on each email sent.

There’s no official word on this new feature yet from Feedburner.

Ironically it was only a few hours ago that I emailed a few questions to Feedburner who have agreed to an interview here on ProBlogger. Expect to hear more from Feedburner in the coming few days - hopefully this is a sign of things to come as they take Feedburner to the next level!

Thanks for listening Feedburner.

A hat tip to Carrie who emailed me about this new feature - nice pick up!

Post from: Blog Tips at ProBlogger.
468x60.jpg

Feedburner Add Customizable Subject Lines to Email Subscriptions


Planet Linux AustraliaPaul Wayper: Look Mum, no bugs!

I recently encountered a bug in RhythmBox where, if you rename a directory, it thinks that all the files in the old directory have disappeared and there's a whole bunch of new files. You lose all the metadata - and for me that was hours of ratings as I worked my way through my time-shiftings of the chillout stream of Digitally Imported. Worse, if RhythmBox was running during the rename, when you try to play one of those files that has 'gone missing' it will just say "output error"; when you restart it because (naturally) you think it's borked its codecs or something, it then removes all those previous entries (giving you no chance to fix the problem if you'd just renamed the directory in error).

I decided to try to be good, so I found the GNOME bugzilla and tried to search for "directory", or "rhythmbox", or anything. Every time it would spend a lot of time waiting and then just finish with a blank page. Deciding that their Bugzilla was hosed, I went and got a Launchpad account and logged it there. Then, in a fit of "but I might have just got something wrong", I went back to the Bugzilla and tried to drill down instead of typing in a keyword.

Lo and behold, when I looked for bugs relating to "Rhythmbox", it turned up in the search bar as product:rhythmbox. Sure enough, if I typed in product:rhythmbox summary:directory then it came up with bugs that mentioned 'directory' in their summary line. If you don't get one of those keywords right, it just returns the blank screen as a mute way of saying "I don't know how to deal with your search terms".

So it would seem that the GNOME bugzilla has hit that classic problem: developer blindness. The developers all know how to use it, and therefore they don't believe anyone could possibly use it any differently. This extends to asserting that anyone using it wrong is "obviously" not worth listening to, and therefore the blank page serves as a neat way of excluding anyone who doesn't know the 'right' way to log a bug. And then they wonder why they get called iconoclastic, exclusive and annoying...

Sadly, the fix is easy. If you can't find any search terms you recognise, at least warn the user. Better still, assume that all terms that aren't tagged appropriately search the summary line. But maybe they're all waiting for a patch or something...

Worse Than FailureThe Confidential Upgrade

Twenty five years ago, when Steve W. worked for a military subcontractor, he'd often roll his eyes when meetings were denoted "CONFIDENTIAL". It's not that he didn't take confidentiality seriously, it's just that everything they did was confidential. By labeling most everything "CONFIDENTIAL", there was no way of knowing when some things – like performance reviews and should-we-fire-so-and-so discussions – were really, really confidential. At least, not until you were actually in the meeting.

At one meeting, it was was really, really confidential. It was a one-on-one and across the table from Steve sat the Project Manager. These kind of solitary meetings took place either because you're doing something very wrong... or you're getting canned.

"Hey Steve," the project manager started, "I need a fresh set of eyes on a performance problem we've been facing with the EC Unit."

Steve perked up at this. And not just because he wasn't getting fired, but because the EC Unit — EC being short for Electrical Capabilities — was a pretty big deal as of late. It was a "switch" on one of their new automated testing stations with hundreds of relays configurable to variety of electrical ratings: 50 Milliamps at 0.01 Volts, 400 Volts at 200 Amps, you name it. Being about the size of a VW Bug and having a panel of blinking indicator lights which actually meant something, it was an impressive sight... and had an equally impressive budget to boot.

The project manager continued, "it's taking in the neighborhood of eight hours to run through an engineer test script and that is really hurting us on turnaround. If you can crack this nut, you just might be the hero of the project."

A HERO'S WORK

Eagerly, Steve got to work on familiarizing himself with the EC's software. Basically, the idea behind the program was that, as part of a test, the engineer would write a statement like "Apply X amps at Y volts to circuit C with waveform..." and the program would compute the least electrically expensive path.

Developed by the primary contractor, the code weighed in at about 5,000 lines of Pascal and, with a myriad of functions and high math, it was certainaly no picnic. For days, he poured through the logic. After single stepping though the program and creating enough flow charts and flow diagrams to cover two walls, nothing jumped out at him. However, when Steve added a global counter in every function in the application (as there was no profiler available), he hit paydirt.

While most functions were called proportionally to the number of connections to be analyzed, the following worst offending function was called over a billion times.

function eval_strings_are_equal(s1:string[255], s2:string[255]):Integer

    «reasonably efficient string compare function implementation here»
end

The funny thing about that innocent looking function was how the program handled the parameters. Can you see it? No matter what the size of the string data — even as few as two characters — the program would copy two 255 byte sequences to the stack, one byte at a time. Steve found that if he changed the parameter declaration to the *even* number 256, the parameters would be copied to the stack *two* bytes at a time and reduced the runtime by half!

But, was 256 bytes...overkill? Steve looked further and found that the longest strings ever passed would only be 8 bytes long - he reduced the parameter length to match. The end result: an analysis that would ordinarily take an entire business day would be done in a half hour.

No doubt about it - Steve was the man. And better yet, it wasn't even his company's fault: the primary contractor was responsible for that particular module.

AFTERMATH

At their next "CONFIDENTIAL" meeting, the Project Manager started without a word of small talk. "So do you have something for me?"

Steve smirked and nodded, with a smug Yeah, you better believe I do! and handed over the documentation with a very nice "before and after" graph on the first page.

"WOW!" the project manager was shocked, "This is good!...REALLY GOOD!"

Before Steve could even explain how he did it, the project manager jumped in again. "However," he said slowly, "we're going to have to sit on this for now. We can't tell them about this."

Steve shot back a quizzical look as the project manager explained. As it turned out, there was a big political fight going on with the primary contractor about the project. The primary was blaming Steve's company for overall Electrical Capabilities slowness and Steve's company was blaming the hardware supplied by the primary. Not that it really mattered, because there was a planned upgrade to the Electrical Capabilities system that, among other things, promised much higher performance.

"It's only a single line code change," Steve implored, "it would take all of five seconds to explain. Then the users would be up and run-"

"Yeah, yeah," he brushed off, "we'll keep it as our 'ace in the hole' in case they complain about slowness after the upgrade. We'll show 'em that we're not the ones who are causing all the problems."

"But isn't the upgrade several months away?" Steve rhetorically asked, "we can get them to implement it now and save thousands of client man hours in the mean time."

The project manager glared, "you're not going to share the patch information. It's confidential."

As the planned upgrade date came closer and closer, the likelihood of actually upgrading seemed less and less likely. When the date had come and gone, the upgrade project was "put on hold until next quarter". And it stayed on hold for quarter after quarter after quarter.

Five years later, when it came time for budget cuts, the entire Electrical Capabilities project — military personnel and all — was cut for good. Apparently, the auditors weren't too thrilled that engineers just sat around all day, waiting for some program to run.




Brought to you by the Non-WTF Job Board:




Planet Linux AustraliaPia Waugh: My top 10 songs of all time

So I didn’t actually get to vote in the Triple J top 100 of all time. I feel really stupid to have missed it! I was just asked (live on radio) whether I had voted and I stupidly said yes intending to get straight off the phone and onto the voting, but it was closed! So below are my top 10 songs of all time, some for technical reasons, all for emotional. Thought it might be of interest to some :)

Meme time!

In no particular order:

  • Gorecki – Lamb. Our wedding song :) About finding that person that just completes you, that complements and helps you want to be a better person. A beautiful song and a beautiful voice.
  • Smells Like Teen Spirit – Nirvana. Changed everything, and yet so simple. Influenced a generation.
  • Shame – Stabbing Westward. My favourite angsty teenage song. Once went to a Live (the band) concert just to see Stabbing Westward play support, and then left ;) The man has an incredible voice.
  • H – Tool. I love a lot of the older Tool music, this particular one reminds me of a close friend who died very young in very unfortunate circumstances.
  • We’re in this together – Nine Inch Nails. I love pretty much every NIN song, but this one really talks to me about regardless of everything going on, none of us are truly alone.
  • Fade to Black – Metallica. One of their best songs, and one that influenced me to learn guitar in the first place.
  • Burn – The Cure. an amazing (and dark) song from The Crow soundtrack. One of their best in my opinion. Admittedly takes me back to school :)
  • Cornflake Girl – Tori Amos. Beautiful, powerful and disturbing. Worth looking into the deeper meaning.
  • Classical Gas – Mason Williams. An incredible guitar piece that puts me in an almost meditative state when I play it. Technically challenging but also a joy to play and listen to.
  • Pathetique – Beethoven. Such an exquisite piano piece, and when played well covers about the entire scope of human emotion. Fun to play too, but I’ve yet to master it :)

There are so many more songs I love, and I’m sure given more time I’d rejig this another dozen times. So I’ll leave it there :) Apart from one last honorary mention:

  • Space Cadet – Kyuss. Couldn’t leave this off. This 3 person rock band had such a big sound, such a complex and incredible mix. Great fun to play on the bass. Demon Cleaner also very worth listening to.

CryptogramMore Security Countermeasures from the Natural World

The plant caladium steudneriifolium pretends to be ill so mining moths won't eat it.

She believes that the plant essentially fakes being ill, producing variegated leaves that mimic those that have already been damaged by mining moth larvae. That deters the moths from laying any further larvae on the leaves, as the insects assume the previous caterpillars have already eaten most of the leaves' nutrients.

Cabbage aphids arm themselves with chemical bombs:

Its body carries two reactive chemicals that only mix when a predator attacks it. The injured aphid dies. But in the process, the chemicals in its body react and trigger an explosion that delivers lethal amounts of poison to the predator, saving the rest of the colony.

The dark-footed ant spider mimics an ant so that it's not eaten by other spiders, and so it can eat spiders itself:

M.melanotarsa is a jumping spider that protects itself from predators (like other jumping spiders) by resembling an ant. Earlier this month, Ximena Nelson and Robert Jackson showed that they bolster this illusion by living in silken apartment complexes and travelling in groups, mimicking not just the bodies of ants but their social lives too.

Now Nelson and Robert are back with another side to the ant-spider's tale - it also uses its impersonation for attack as well as defence. It also feasts on the eggs and youngsters of the very same spiders that its ant-like form protects it from. It is, essentially, a spider that looks like an ant to avoid being eaten by spiders so that it itself can eat spiders.

My previous post about security stories from the insect world.

CryptogramMore Security Countermeasures from the Natural World

The plant caladium steudneriifolium pretends to be ill so mining moths won't eat it.

She believes that the plant essentially fakes being ill, producing variegated leaves that mimic those that have already been damaged by mining moth larvae. That deters the moths from laying any further larvae on the leaves, as the insects assume the previous caterpillars have already eaten most of the leaves' nutrients.

Cabbage aphids arm themselves with chemical bombs:

Its body carries two reactive chemicals that only mix when a predator attacks it. The injured aphid dies. But in the process, the chemicals in its body react and trigger an explosion that delivers lethal amounts of poison to the predator, saving the rest of the colony.

The dark-footed ant spider mimics an ant so that it's not eaten by other spiders, and so it can eat spiders itself:

M.melanotarsa is a jumping spider that protects itself from predators (like other jumping spiders) by resembling an ant. Earlier this month, Ximena Nelson and Robert Jackson showed that they bolster this illusion by living in silken apartment complexes and travelling in groups, mimicking not just the bodies of ants but their social lives too.

Now Nelson and Robert are back with another side to the ant-spider's tale - it also uses its impersonation for attack as well as defence. It also feasts on the eggs and youngsters of the very same spiders that its ant-like form protects it from. It is, essentially, a spider that looks like an ant to avoid being eaten by spiders so that it itself can eat spiders.

My previous post about security stories from the insect world.

CryptogramMore Security Countermeasures from the Natural World

The plant caladium steudneriifolium pretends to be ill so mining moths won't eat it.

She believes that the plant essentially fakes being ill, producing variegated leaves that mimic those that have already been damaged by mining moth larvae. That deters the moths from laying any further larvae on the leaves, as the insects assume the previous caterpillars have already eaten most of the leaves' nutrients.

Cabbage aphids arm themselves with chemical bombs:

Its body carries two reactive chemicals that only mix when a predator attacks it. The injured aphid dies. But in the process, the chemicals in its body react and trigger an explosion that delivers lethal amounts of poison to the predator, saving the rest of the colony.

The dark-footed ant spider mimics an ant so that it's not eaten by other spiders, and so it can eat spiders itself:

M.melanotarsa is a jumping spider that protects itself from predators (like other jumping spiders) by resembling an ant. Earlier this month, Ximena Nelson and Robert Jackson showed that they bolster this illusion by living in silken apartment complexes and travelling in groups, mimicking not just the bodies of ants but their social lives too.

Now Nelson and Robert are back with another side to the ant-spider's tale - it also uses its impersonation for attack as well as defence. It also feasts on the eggs and youngsters of the very same spiders that its ant-like form protects it from. It is, essentially, a spider that looks like an ant to avoid being eaten by spiders so that it itself can eat spiders.

My previous post about security stories from the insect world.

Planet SE LinuxShintaro Fujiwara: segatex-7.768 released !

Now you can yum install or update SELinux related packages which includes minimal policy and mod_selinux by Kaigai.

Planet SAGE-AUTwo years ago today....

Two years ago today, a very tired J and I arrived at the front door of our new home in Brisbane, and were delighted to walk into our own home. After so many years of renting it was a fantastic feeling to be able to walk in and know that yes, we could put a hook in the wall if we wanted (and where we wanted), and that all this was ours. (Well, modulo the mortgage!)

Home, sweet home. Love it!

Planet DebianCyril Brulebois: Porting is fun

In the next hours or even days, I might be quite verbose so that people can have a tiny idea of what porting looks like. Or eventually what being in a bootstrapping phase looks like.

I love it when a plan comes together!

One important goal was trying to get sbuild installable within sid. Of course it is already installed on the buildds, but having it handy should help developers hack on their own boxes.

The chain of dependencies wasn’t very long, but still:

sbuild → libsbuild-perl           [not installable]
libsbuild-perl → schroot          [not built]
schroot → libboost-dev            [not built]
libboost-dev → libboost1.38-dev   [not built]
libboost1.38-dev → libopenmpi-dev [not installable]

First of all, I filed #535202 so that libibverbs can be built on GNU/kFreeBSD, which was needed because libopenmpi-dev depends on one of its binaries. We weren’t sure it was appropriate, though, since it looked like pretty much Linux-specific. So I filed #535225 to get installability issues of libopenmpi-dev on non-Linux architectures fixed (by excluding libibverbs-dev from the Depends on those architectures, matching what was already done for the build dependencies). A fixed package was uploaded in some hours only!

In the meanwhile, I gave mpi-defaults a shot, using the locally-built libopenmpi-dev package. It could have gone flawlessly if I didn’t stumble upon an FTBFS due to a toolchain change. #535230 got filed accordingly, and fixed some hours later too!

Building boost1.38, then boost-defaults, and finally schroot went smoothly, and all the above-mentioned packages are now installable on the porter box. And thanks to the responsiveness of those maintainers, plus some extra bits of wanna-build magic (give-backs using dep-waits), packages got tried (and built successfully) when their build dependencies became available on the buildds.

In the meanwhile, the maintainer of libibverbs confirmed that it’s not worth building useless binaries on non-Linux architectures, so I closed #535202 and opened a bug against buildd.debian.org instead, requesting the addition of libibverbs to the Packages-arch-specific list (aka. P-a-s): #535360.

Now, there are still some issues when trying to use sbuild, but it’s at least installable and people can try it out.

Working on another package also made me noticed that there was a bug in a FreeBSD kernel header: #535243. The fix is already in the repository, and it looks like I’m going to be added to the Uploaders of the kfreebsd-kernel-headers source package so that it gets uploaded quickly.

I hate impromptu toolchain-related FTBFSes

While I’m all for making tools as strict as possible (especially build-related tools), I really think it would be very nice for toolchain maintainers to deliver advance warnings.

GCC folks do that perfectly: File bugs, provide patches, raise severity when the new version is around, NMU if needed.

Dpkg folks prefer making a parser stricter, without caring at all which packages they might break. The previously-mentioned mpi-defaults was one of them.

The list of FTBFSes triggered by dpkg 1.15.3 (at least, the ones I spotted using 3 basic UNIX commands and spending a few seconds in lintian’s lab on lintian.debian.org, see how difficult that was!) follows: #535230, #535276, #535279, #535283, #535284, #535287, #535292, #535297, #535299, #535301, #535303, #535304, #535306, #535310, #535312 (all of them with tested patches because I didn’t feel like being lazy and shrugging over IRC after being notified).

At least it’s not about trying to sneak *FLAGS handling into a frozen testing this time. But that’s still annoying.

Planet DebianStephan Peijnik: update-manager weekly update #5

Firstly I have to apologize again for not providing you with weekly update #4, but again I didn’t have the time to write one, so this post is going to sum up everything that happened since my last update.

Let’s have a look at my previous TODO list:

Documentation

Even though my TODO list entry contained a more detailed entry I have updated the UpdateManager documentation as a whole, leaving only a few blank spots right now.

Ubuntu distribution specific code

I implemented changelog fetching for Ubuntu, which works just as fine as its Debian counterpart now.

More unit tests

There are plenty of unit tests now, but not everything is being tested yet. I am especially proud of my Python interface validation code, that is being used in unit tests to check if handlers implement an interface correctly.

Update list downloading

Checking for updates is what caused me major trouble in the past few days. Basically I had all the code ready, but for some reason the UI froze, with no apparent reason.
However, today I was able to finally identify and fix the problem. As I expected my code was just fine, but python-apt was messing up. I am going to discuss the exact problem and its solution later on, but first: a screenshot. :-)

Update Manager update check

Note: As you probably noticed I replaced the default progressbar with a pulsating one, because we cannot get exact information on how many items/bytes to fetch and would likely get a progress bar moving backwards, which isn’t beautiful.

Further changes

The TODO list was rather short and I did a lot of other work, which I want to elaborate on.

Dynamic selection of frontend, backend and distribution specific modules

Even though this is probably not of any interest to John Doe, it helps a great deal when debugging code as all three components can be selected via separate command line switches now.
Additionally some magic has been put in place that automatically detects the system’s distribution and loads the corresponding distribution specific module. This is done via lsb_release and the newly introduced code in UpdateManager.Util.lsb.

Pylint cleanup

Just out of curiosity I decided to start a pylint run on the codebase and quite a few problems were detected, which I then fixed. To be honest though I added quite some code afterwards that probably needs pylint checking and fixes again.

update-manager IPC

My original plan and IPC design involved using callback functions and passing them between the different modules. Even though this worked out fine I had the feeling this wasn’t clean enough and decided to ditch this approach and replace it with handler classes.
The handler base classes now provide an interface of methods that are called on certain events and their implementations act accordingly. The main benefit was that I could easily drop a lot of enums and rather have different methods handling different events.

Gtk, threads and python-apt

With the new IPC approach it became easier to use threads that do the actual work in the background, which I had implemented in next to no time, but a few problems showed up.
Whilst cache reloading from within a thread worked just fine checking for updates did not, and until today I didn’t know why. I spent a good amount of time debugging this issue, even using python profiling, but nothing obvious showed up. The background process was running, whilst the UI froze.
Today I finally found the root of the problem: python-apt. Even though I assumed that the python-apt worker threads must be stealing CPU time from the thread running gtk.main I wasn’t sure how this could be happening, having two completely independent threads.

Now, the cause of all this mess was that Python has a global threading lock and it seems as if this one is *LOCKED* when running C-code, such as the one python-apt comes with. The solution lies in calling Py_BEGIN_THREADS_ALLOW and Py_END_THREADS_ALLOW from within the C code, to release the global lock and let the Python interpreter do some work every now and then.

As with the python-apt acquire code I was able to allow other threads to work as soon as the fetching code starts working and only disallow threads when actually modifying Python objects or calling methods and/or functions. Surprisingly python-apt already made use of this in its cache loading code, but not the fetch progress code.
Fixing this problem took me less than half an hour and you probably can’t believe how glad I was to finally get things working again.

UI updates & other changes

Some details in the UI were anything but optimal, like horizontal scrollbars in a few places, which I removed. Additionally I saw the need to move some code out of the Gtk frontend’s __init__.py file and to a separate ui.py file.
A full list of all changes I made is available from the bzr changelog at bzr.debian.org.

A few more screenshots

Finally, I would like to provide you with two more screenshots (don’t worry about my system being insecure because of not applied updates – this is a testing machine that is  not up-to-date on purpose):

Update Manager main screen

Update Manager main screen with details & changelog

TODO list

My TODO list for next week:

  • Downloading and installing of updates
  • Checking that everything is documented
  • Even more unit tests
  • Pylint checking
  • If time permits and everything else works correctly: working on an aptdaemon backend

Planet Linux AustraliaSteven Hanley: [comp/linux] A regression for WPA2

So for a while I was wondering why I could not use the ANU's WPA2 secure network from my laptop. I had heard reports that some Ubuntu hardy machines had worked. I run Debian unstable and a kernel.org 2.6.29.3 on this laptop.

I thought maybe there was some problem with my laptop hardware and maybe the iwl4965 chipset simply would not do it under Linux. However searching online suggested I should be able to make it do WPA2.

Thinking maybe the Ubuntu people had done it right and Debian was missing something I tried booting a Jaunty live cd. I also discovered the rather neat feature of suspend to disk (hibernate) in that you can hibernate your computer, boot off a live cd, use it, reboot and have your existing session come right back up normally on the next boot.

Anyway I booted up Jaunty and tried to authenticate, still failed in a similar manner to my Debian installation. Out of curiosity as I had heard of hardy working I booted my laptop on a hardy live cd. So network manager and iwlagn driver combined on either Debian sid or Ubuntu jaunty had failed to authenticate. Ubuntu hardy on the other hand, using an older version of network manager and the iwl4965 driver in the kernel worked fine. WPA2 authentication and use on the ANU Secure wireless network.

So now I need to find out where the regression has happened that means WPA2 is broken in more recent releases of the software (kernel drivers, wpa supplicant, network manager) on either Debian or Ubuntu.

Planet DebianColin Watson: Python SIGPIPE handling

Enrico writes about creating pipelines with Python's subprocess module, and notes that you need to take care to close stdout in non-final subprocesses so that subprocesses get SIGPIPE correctly. This is correct as far as it goes (and true in any language, although there's a Python bug report requesting that subprocess be able to do this itself), but there's an additional gotcha with Python that you missed.

Python ignores SIGPIPE on startup, because it prefers to check every write and raise an IOError exception rather than taking the signal. This is all well and good for Python itself, but most Unix subprocesses don't expect to work this way. Thus, when you are creating subprocesses from Python, it is very important to set SIGPIPE back to the default action. Before I realised this was necessary, I wrote code that caused serious data loss due to a child process carrying on out of control after its parent process died!

import signal
import subprocess

def subprocess_setup():
    # Python installs a SIGPIPE handler by default. This is usually not what
    # non-Python subprocesses expect.
    signal.signal(signal.SIGPIPE, signal.SIG_DFL)

subprocess.Popen(command, preexec_fn=subprocess_setup)

I filed a patch a while back to add a restore_sigpipe option to subprocess.Popen, which would take care of this. As I say in that bug report, in a future release I think this ought to be made the default, as it's very easy to get things dangerously wrong right now.

Planet DebianEvan Prodromou: 14 Messidor CCXVII

It's been one year since the public launch of identi.ca on July 2, 2008.

At the time, I'd been working on the software for a few months, and after some friendly beta testing by Montreal tech folks and autonomo.us members, I felt that it was time to Release Early, Release Often. So on vacation in Lake Tahoe with my pregnant wife and in-laws, and jetlagged and unable to sleep, I sent out an announcement email to beta users at 5:30AM PDT. You can see my status update on the subject, which in turn links to our press release and my personal blog post of Journal/14 Messidor CCXVI. We had 10K users within 30 hours; I switched hosting providers and did a new release of the software within 72. It was a busy time.

I had no idea that identi.ca and Laconica would become such an important part of my life and of the Internet landscape. In the intervening year, we've received seed funding from Montreal Start Up, done 4 major point releases of the software (from last year's 0.4.x to this week's 0.8.x), and become the indisputably most important Open Source microblogging platform on the planet.

I'd like to take moment to give my personal thanks to folks who've helped make this project such a success:

  • My wife @majnoona and children @amitajune and @stavro who've been so patient with my work and travel schedule over the last 12 months.
  • My innumerable friends and colleagues who've set up accounts on identi.ca and used them. You learn who your friends are when you start a new project like this.
  • The thousands and thousands of people who've become new friends through the site. I've been awed by how many folks have caught onto the dream of Open Source, distributed microblogging and made it their own.
  • The dozens of developers who've written code for Laconica, or plugins, or API clients that use the software.
  • The team of developers and admins at Control Yourself: @zach, @csarven, @millette, @nate, @foucault and @cvollick. They've put in long hours and done some really impressive technical feats to keep us going in the face of growth and technology changes.

I'm looking forward to another big year.

tags:

Planet DebianDaniel Silverstone: Dear Lazyweb…

I am currently stuck taking four times the suggested daily dose of two anti-histamines in order to combat my body and its reaction to plants having sex all around me.

I am taking two 10mg Loratadine tablets, and two 10mg Cetirizine Hydrochloride tablets, twice daily. This is effectively four times the recommended dose of twice as many anti-histamines as I should need.

I wasn’t this bad last year, but the year before was similar. Irritatingly, once the drugs kick in (45 minutes to an hour after taking) my runny nose, itchy/burny eyes, slight dopeyness induced by feeling crap, etc. all fade away. Yesterday I needed my second dose a mere 8 hours after the first, but I didn’t need to re-dose until this morning after that.

I guess what I’m asking is—what is the expected side-effects of taking such a high dose of antihistamines. Do any of you out there have to take such high doses, have you seen a doctor about this? All I expect a doctor to do is to either supply me more loratadine on prescription (which is of dubious value unless I get a lot given prescription charges in the UK), or to try me on a nasal spray, which tend to induce nosebleeds for me. If you’ve found other ways to cope, I’m interested. Otherwise I guess I’ll make an appointment to see the doctor in the next week or so.

Planet Linux AustraliaChris Smart: Say Goodbye to Reboots with Ksplice

My latest article for Linux Magazine is about Ksplice, the awesome new technology which lets you apply kernel patches without needing a reboot!

I first came across Ksplice at Linux.conf.au earlier this year when Co-Founder Jeff Arnold gave a presentation. It’s great to see it maturing to the point where you can install a client on your Ubuntu Jaunty machine. Sweeeet.

If you dig it, then digg it! :-)

-c

Planet SAGE-AUWeb Hosting After Death

Steve Kemp writes about his concerns for what happens to his data after death [1]. Basically everything will go away when bills stop being paid. If you have hosting on a monthly basis (IE a Xen DomU) then when the bank account used for the bill payment is locked (maybe a week after death) the count-down to hosting expiry starts. As noted in Steve’s post it is possible to pay for things in advance, but everything will run out eventually.

One option is to have relatives keep the data online. With hard drives getting bigger all the time it wouldn’t be difficult to backup the web sites for everyone in your family to a USB flash device and then put it online at a suitable place. Of course that relies on having relatives with the skill and interest necessary.

The difficult part is links, if the domain expires then links will be broken. One way of alleviating this would be to host content with Blogger, Livejournal, or other similar services. But then instead of the risk of a domain being lost you have the risk of a hosting company going bankrupt.

It seems to me that the ideal solution would be to have a hosting company take over the web sites of deceased people and put adverts on them to cover the hosting costs. As the amount of money being spent on Internet advertising will only increase while the costs of hosting steadily go down it seems that collecting a lot of content for advertising purposes would be a good business model. If the web sites of dead people are profitable then they will remain online.

It wouldn’t be technically difficult to extract the data from a blog server such as Wordpress (either from a database dump or crawling the web site), change the intra-site links to point to a different domain name, and then put it online as static content with adverts. If a single company (such as Google) had a large portion of the market of hosting the web sites of dead people then when someone died and had their web site transferred the links on the other sites maintained by the same company could be automatically adjusted to match. A premium service from such a company could be to manage the domain. If they were in the domain registrar business it would be easy to allow someone to pay for 10 or 20 years after their death. Possibly with a portion of the advertising revenue going towards extending the domain registration. I think that this idea has some business potential, I don’t have the time or energy to implement it myself and my clients are busy on other things so I’m offering it to the world.

Cory Doctorow has written an article for the Guardian about a related issue – how to allow the next of kin to access encrypted data when someone is dead [2]. One obvious point that he missed is the possibility that he might forget his own password, a small injury from a car accident could cause that problem.

It seems strange to me that someone would have a great deal of secret data that needs strong encryption but yet has some value after they are dead. Archives of past correspondence to/from someone who is dead is one category of secret data that is really of little use to anyone unless the deceased was particularly famous. Probably the majority of encrypted data from a dead person would be best wiped.

For the contents of personal computers the best strategy would probably be to start by dividing the data into categories according to the secrecy requirements. Publish the things that aren’t secret, store a lot of data unencrypted (things that are not really secret but you merely don’t want to share them with the world), have a large encrypted partition that will have it’s contents lost when you die, and have a very small encrypted device that has bank passwords and other data that is actually useful for the executors of the will.

One thing that we really need is to have law firms that have greater technical skills. It would be good if the law firms that help people draw up wills could advise them on such issues and act as a repository for such data. It seems to me that the technical skills that are common within law firms are not adequate for the task of guarding secret electronic data for clients.

The Reid ReportLeave him, Jenny. Leave him now.

When your husband calls somebody other than you his "soul mate," and talks openly about having the fall back in love with you? It's time to admit it's over. (Just ask any of Rudy Giuliani's former wives, including the one who was dumped on television...) Meanwhile, the freshness date has clearly expired on Mark Sanford's political future. Or has it...?

Planet Linux AustraliaAndrae Muys: Scala and Various Things.

Not quite ready to move across yet - however capturing some links to make life that little bit easier when I do. I'm hoping these approaches will work as well for Elmo/OTM as they do for Hibernate.

I'll be updating this with any more links I want to save for a sunny day.

A couple more links worthy of rereading:

The Reid ReportNew Florida polls, same as the old Florida polls

The news out of the latest Mason-Dixon poll is essentially status quo:

Nobody really knows who Alex Sink and Kendrick Meek are ... but at least they're not Michael Arth and Corinne Brown. Sink fares best among the members of the vaunted Democratic "unity slate" (gagging ...) posting 24% favorable ratings, just 9% unfavorable, 28% neutral and 39% "Alex who???" Meek gets 11% favorable, 5% unfavorable, 22% neutral and a whopping 62% "you want me to sign what? And who are you again...???" Their would-be primary challengers (stop laughing!) don't do as well. Hell, I'm a political junkie and I'm with the 93% who have no earthly idea who Arth is, and while Corinne's dunnos are a percentage point lower than Kendrick's, her unfavorables outweigh the love by nearly three to one (15% vs. 4%.)

Out of the handful of Republicans who know who Marco Rubio is, and the 100 percent who know who Charlie Crist is, they like to two about equally. Crist still crushes Rubio in a head-to-head when you factor all Republicans in (51% to 23% with 26% undecided,) but in what is perhaps the only interesting news in the poll, when you factor in Republicans who know both candidates, Crist and Rubio are essentially tied, 33% to 31% with 36% undecided. That should provide a kernel of hope to Rubio: though 48% of those polled have no idea who he is and the percentage who have formed no opinion about him equals his favorers (23% and 24% respectively,) he seems to have some room for growth -- if his Club for Growth and RedState.com winger friends can raise enough dough to buy him some name recognition outside Miami and those god-awful tea parties...

Bill McCollum has managed to leave barely any impression on Floridians, even after 10 terms in Congress in two different districts, two runs for governor and his current stint as attorney general. McCollum, who might as well change his middle name to Whatever, is 6 points ahead of Alex Sink, but that's small consolation since, to reiterate point one, not a lot of peole know who she is. McCollum has the highest "neutral" ratings of any of the somewhat known candidates, at 45%. Sad, since he's been swimming in Florida's political bloodstream longer than anybody running. Still, at 13%, McCollum's unfavorables are remarkably low for a guy whose crowning achievement was being a member of the Clinton impeachment brigade. The key factor for Sink is women -- if she can improve her name ID, and do better than her current margin of error lead over Bland Bill with women voters, she should be in pretty good shape.

Florida is still not a blue state (I keep telling my Democratic friends this, but they don't believe me. I think it's the Obama Uphoria.) The large share of the state that leans independent, still seems to favor Republicans over Democrats. Indies in this poll favored McCollum over Sink (41% to 27%), Crist over Meek (47% to 23%.) Democrats will have to change that if they mean to win.

Floridians like Charlie Crist, but not as much as the media says they do. Crist gets a 49 percent favorable rating in this poll, a far cry from his 60 percent plus approval ratings in other polls. Still, with the GOP brand being currently flushed down the toilet by people like Sarah "It Came From Wasila" Palin, John "The Homewrecker" Ensign and Mark "TMI" Sanford, Crist's rating, and the fact that at least for now, he would grab an incredible 28% of Democrats if he faces Kendrick Meek, and 34% if for some reason Kendrick quites the race to become ambassador to Haiti and Corinne Brown gets the nomination by default, makes him practically a GOP Jonas Brother.

Nobody cares about the other cabinet races. The undecideds are in the 70s for the most part, and none of the candidates has a dime's worth of name I.D. Wow, sure wish we had an exciting main event primary going on on the Democratic side, so voters would tune in and maybe check out the other races ... oops, never mind!

Care to read the polls for yourself? Here you go, you political nerd, you!

Florida Cabinet Poll
Florida Senate poll

Planet Linux AustraliaJason Parker-Burlingham: A study in yellow


Hard-workin' bees
Originally uploaded by Nooks

Closeups of bees are tricky as all get-out, on account of their skittishness and apparent six sense with regard to when you'll try to open the shutter. But I can't stop trying.


365 TomorrowsMorning Rounds

Author : Gavin Raine

When he entered the room, Olivia was sitting on the edge of her bed and looking out of the window. He allowed the door to close noisily behind him and waited to see if she would notice, but it was hopeless. She was looking at the gardens without seeing them. The corners of her mouth were damp and her jaw was working slowly, as if kneading at invisible gum. Apparently, this was not going to be one of Olivia’s good days.

He adjusted the volume and pitch of his voice to levels that suited Olivia’s ruined hearing. “Good morning Mrs Jones,” he boomed. “How are you today?”

Olivia whirled around, startled. “What are you?” she said. “Where’s my Harry?”

“It’s all right Mrs Jones. I’m Andrew, your robot care assistant. You see me every day – remember?” She looked blank, so he tried another approach. “Your husband, Harry, died almost twenty years ago. You do remember that, don’t you?”

Olivia smoothed-down her nightdress in a gesture she often used to cover her confusion. “Oh yes of course,” she said, “so where’s my boy John then?”

“Your son lives at this facility also”, said Andrew, moving forward smoothly and placing a breakfast tray on a small table. “You’ll see him in the day room later and don’t forget to wish him a happy birthday. He’s one hundred and fourteen today.”

Olivia began running her hands over her nightdress again and he made a quick exit before she could frame another question. “I’ll be back later,” he said, pulling the door closed behind him. “Drink your tea now, before it gets cold.”

Taking another breakfast tray from the trolley, Andrew moved to the next door and knocked. There was no response, so he pushed it open calling, “Good morning Mr Jackson.”

As soon as he entered the room, it was obvious that something was wrong. Mr Jackson was slumped across his bed at an unnatural angle, with his eyes open and his mouth hanging slack. Andrew checked his pulse, which was a strong as ever, and then spread his hand to place his fingertips at specific points on the man’s scalp.

A minute or more passed, while the sensors in Andrew’s fingertips monitored the electrical activity inside Mr Jackson’s skull. As he had suspected, there was nothing to detect. He sent a command to Mr Jackson’s mechanical heart, telling it to cease operation, and eased his body back into the bed, covering it with the sheet.

It was usually a brain haemorrhage that got them in the end. The doctors could cure their cancers and replace or re-grow their organs, but their brains had to last a lifetime. However, brains degenerated with age, until synapses barely fired at all, and blood vessels became as fragile as dry autumn leaves.

Andrew left the room and fired a message to the care home’s core computer: “Escapee in room 15248”. He knew the core appreciated a little gentle irony.

Then, he took another tray from the breakfast trolley and tapped on the door of room 15249.

Discuss the Future: The 365 Tomorrows Forums
The 365 Tomorrows Free Podcast: Voices of Tomorrow
This is your future: Submit your stories to 365 Tomorrows

July 01, 2009

Planet DebianCyril Brulebois: ikiwiki dates

Some time ago, the box on which my blog is hosted went dramatically down, and I had to restore the blog by populating the git repository again, from my local copy.

Unfortunately, that means that the wiki had to be rebuilt from scratch, and all creation dates were messed up, leading some planet-like sites to show all of my posts again.

To ensure that this won’t happen again (even if I switch branches in the git repositories, move some files around, trash the ikiwiki cache, etc.), it looks like using meta dates is the way to go, for example:

 [[meta date="2009-07-02"]]

(One can use 2009-07-02 00:00:00 and 2009-07-02 01:00:00 to sort several entries on the same day, too.)

This way, all pages are rendered identically on every system.

To help maintaining those extra dates (kind of a burden, to be honest), I’ve written a tiny Perl script to automate it, and specified an alias in .git/config for that repository:

 [alias]
 ikiwiki-check = "!blog/2009/07/02/ikiwiki-dates.pl"

Inline replacement (in case of conflicts: same date without time, or with same time) or additions are then performed, and git status will show what needs tweaking.

More work that I initially imagined, but robustness should follow.

Planet DebianDavid Welton: Custom Twitter Sites, BikeChatter.com Updates

I've been hacking away at http://www.bikechatter.com, adding a few things like votes and tags so that you can choose which broad categories you want to follow. The first will let people vote for the most interesting tidbits that come through twitter, whereas the second will let me add more people without overloading those who are, say, not interested in reading what coaches have to say, or are only interested in professional women racers, etc... I don't think I'll bother with individuals - if you want that, just add them to twitter yourself! At most I might see about putting in an 'exclude list'... but we'll see; I'd prefer to keep things simple.

Since I love cycling so much, adding stuff to this site has always just been kind of a fun side project, something to relax with in the evenings, rather than something I thought about in monetary terms. However, the basic idea seems to be popular, and as luck would have it, I've been approached by someone looking to buy the code behind BikeChatter to drive their own custom twitter site. If someone has gone to the trouble of writing me, there must be other people interested too, so I thought I'd publicly state that I'd be willing to do similar deals with people interested in having their own custom twitter site. Interested? Write me at davidw@dedasys.com . I'd be happy to tell you what the code can and cannot do, and discuss any ideas you may have, in order to let you know if it's a good fit, or if you'd have to do a lot of work.

The code is pretty straightforward Ruby on Rails. I use Postgres as a database, but others should work fine too. As is obvious, I'm not much of a design guy, but it shouldn't be too hard to plug in your own look and feel.

Planet DebianAdam Rosi-Kessel: MBTA Blocking TPM

I’ve been happy to see WiFi appearing on nearly every MBTA commuter rail car recently. I was less happy to see this:

No TPM on MBTA

No TPM on MBTA

I guess I’ll have to wait until I get home to find out why this bothered Steve so much.

Oddly, the MBTA’s web filter also blocked access to my WordPress editor, but unlike the TPM block, I could select “yes, I really want to do this” to get here.

I’ve never understood why web filters so often block these sorts of sites on apparently generic settings. “General News/Blogs/Wikis” are dangerous? Reputation “neutral”? I’d be surprised if anyone at the T actually did this on purpose, but I suppose it would fit the general pattern of operational incompetence.

Update: the problem appears to be real.

Cory DoctorowHugo voting deadline!


Diane from the World Science Fiction Convention sez, "Just wanted to drop you a quick note to say that the voting deadline for the Hugo awards is this Friday. Eligible voters must vote online by July 3rd, 23:59PM EST. People should vote as early as possible in case of computer problems and to ensure their ballot is received before the deadline."


You get a vote if you're signed up to attend the WorldCon (it's in Montreal this year). It's one of the best Hugo ballots I've seen in all my years as an sf reader. And yes, I'm eligible twice, once for best novel (Little Brother) and again for best novella (True Names, with Ben Rosenbaum).

Final Ballot for the 2009 Hugo Awards
and John W. Campbell Award


CryptogramMD6 Withdrawn from SHA-3 Competition

In other SHA-3 news, Ron Rivest seems to have withdrawn MD6 from the SHA-3 competition. From an e-mail to a NIST mailing list:

We suggest that MD6 is not yet ready for the next SHA-3 round, and we also provide some suggestions for NIST as the contest moves forward.

Basically, the issue is that in order for MD6 to be fast enough to be competitive, the designers have to reduce the number of rounds down to 30-40, and at those rounds, the algorithm loses its proofs of resistance to differential attacks.

Thus, while MD6 appears to be a robust and secure cryptographic hash algorithm, and has much merit for multi-core processors, our inability to provide a proof of security for a reduced-round (and possibly tweaked) version of MD6 against differential attacks suggests that MD6 is not ready for consideration for the next SHA-3 round.

EDITED TO ADD (7/1): This is a very classy withdrawal, as we expect from Ron Rivest -- especially given the fact that there are no attacks on it, while other algorithms have been seriously broken and their submitters keep trying to pretend that no one has noticed.

TEDAtheist summer camp, funded by Richard Dawkins' foundation

Via Boing Boing via The First Post, we learn that Richard Dawkins' foundation is funding a summer camp to teach children reason, skepticism and science. From the article:

Alongside the more traditional activities of tug-of-war, swimming and canoeing, children at the five-day camp in Somerset will learn about rational scepticism, moral philosophy, ethics and evolution.

Camp-goers aged eight to 17 will also be taught how to disprove phenomena such as crop circles and telepathy. In the Invisible Unicorn Challenge, any child who can prove that unicorns do not exist will win a £10 note -- which features an image of Charles Darwin, the father of evolutionary theory -- signed by Dawkins, Britain's most prominent atheist.

Related TEDTalks:
+ Richard Dawkins on militant atheism
+ Dan Dennett says religion should be taught in schools -- objectively
+ Michael Shermer on why people believe strange things
+ Diane Benscoter on escaping a cult
+ Julia Sweeney on letting go of god

Or visit the TED.com theme Is There a God?

ProBloggerWin an Omni Bean Bag Worth $149 in the Next 48 Hours at @ProBloggerDeals

Update: Congratulations to @GemmaWent who has won this competition. Thanks to SumoLounge again for sponsoring this - check out their bean bag chairs here.

gear_diary_sumo_lounge_omni_05.jpgToday’s ProBlogger Deal is simply - follow @ProBloggerDeals on Twitter and you’ll automatically go into the running to win the ultimate blogger’s chair - the Omni Bean Bag Chair from SumoLounge.

You’ve got 48 hours to enter!

Valued at $149 USD the Omni Bean Bag Chair comes in a range of 10 great colors, measures 4.5’ X 5.5, is made from rip-proof and easy to clean nylon and is filled with high quality beads which will stay fluffy for ages!

Can’t you just picture yourself lazing around with your laptop on your knee in this baby?

To win the Omni chair - simply head to our @ProBloggerDeals twitter page and hit ‘follow’. On that account we promote discounts for bloggers, competitions and special offers exclusive to ProBlogger Deals followers (there are already a few up in the last few tweets on the account).

I’ll draw the winner of the Omni chair 48 hours after I first announce this on Twitter and will update this page and @ProBloggerDeals with the winner’s Twitter handle once I do.

PS: check out the reviews of SumoLounge products. They’ve certainly impressed some pretty cool bloggers over the last year or two!

Post from: Blog Tips at ProBlogger.
468x60.jpg

Win an Omni Bean Bag Worth $149 in the Next 48 Hours at @ProBloggerDeals


Planet Linux AustraliaJason Parker-Burlingham

My day started with a blow from a tiny little knee to the groin. How's your day?

CryptogramNew Attack on AES

There's a new cryptanalytic attack on AES that is better than brute force:

Abstract. In this paper we present two related-key attacks on the full AES. For AES-256 we show the first key recovery attack that works for all the keys and has complexity 2119, while the recent attack by Biryukov-Khovratovich-Nikolic works for a weak key class and has higher complexity. The second attack is the first cryptanalysis of the full AES-192. Both our attacks are boomerang attacks, which are based on the recent idea of finding local collisions in block ciphers and enhanced with the boomerang switching techniques to gain free rounds in the middle.

In an e-mail, the authors wrote:

We also expect that a careful analysis may reduce the complexities. As a preliminary result, we think that the complexity of the attack on AES-256 can be lowered from 2119 to about 2110.5 data and time.

We believe that these results may shed a new light on the design of the key-schedules of block ciphers, but they pose no immediate threat for the real world applications that use AES.

Agreed. While this attack is better than brute force -- and some cryptographers will describe the algorithm as "broken" because of it -- it is still far, far beyond our capabilities of computation. The attack is, and probably forever will be, theoretical. But remember: attacks always get better, they never get worse. Others will continue to improve on these numbers. While there's no reason to panic, no reason to stop using AES, no reason to insist that NIST choose another encryption standard, this will certainly be a problem for some of the AES-based SHA-3 candidate hash functions.

Planet Linux AustraliaTim Riley: Using RSpec Ordered Message Expectations to Tighten your Specs

I quite enjoy the competitive undercurrent of ping pong pair programming. As the person writing the implementation code, it is fun to write something that will turn a test green, but still not necessarily do what my partner was expecting. Taking this approach has also been helpful for improving our specs. Take this example controller spec:

describe ArticlesController do describe "handling create" do before(:each) do @article = mock_model(Article, :save => nil) Article.stub(:new).and_return(@article) @user = mock_model(User) controller.stub(:current_user).and_return(@user) end it "should build a new article from posted data" do Article.should_receive(:new).with('title' => 'Test Post') post :create, :article => {:title => 'Test Post'} end it "should assign the current user as the article's author" do @article.should_receive(:author=).with(@user) post :create end it "should save the article" @article.should_receive(:save) post :create end end
end

This looks like a reasonable set of concise, clear examples, but you can easily make them all pass and without building a controller action that does what you expect:

class ArticlesController < ApplicationController def create @article = Article.new(params[:article]) @article.save @article.author = current_user end
end

This satisfies the examples, but saving the article before assigning the current user as author isn’t what we would have intended. Enter RSpec’s ordered message expectations. These allow you to specify the order in which you expect an object to receive message calls.

describe ArticlesController do describe "handling create" do it "should save the article after assigning the current user as author" @article.should_receive(:author=).with(@user).ordered @article.should_receive(:save).ordered post :create end end
end

This example would fail with the above controller action, and force us to write it properly:

class ArticlesController < ApplicationController def create @article = Article.new(params[:article]) @article.author = current_user @article.save end
end

The result is a controller that does what you expect, a stronger set of specs, and an increased capacity for true behaviour driven development. Win, win, win!

Planet DebianEugene V. Lyubimkin: cupt: time to feedback

Cupt, the re-implementation of APT suite, continues growing.

Since the previous post a lot of bugs were fixed, several versions were uploaded to Debian. As always, many bugs were hunted out, and now, last 0.2.3 version hasn't any open bugs in BTS.

I claim this is a good time for anyone who experienced bugs with APT to at least try typing one's favorite package manager command (update, full-upgrade, install, remove etc.) with cupt. Not being Swiss knife, Cupt already works for many known cases. If it doesn't, file a bug.

I claim this is a good time for anyone who feels that Perl is bad programming language to show practical objective statistics (speed, memory footprint etc.).

I claim this is a good time for anyone who has some words to say about Cupt (good or bad) to say them. Using private e-mail or via #cupt channel on OFTC IRC network.

Several people asked me before, do I want to replace APT by Cupt in some future. Well, if APT will stay unmaintained as it is now, then the answer is probably 'yes'.


In the meantime, a half-pilot implementation of source packages is ready. It's possible the next uploaded version of Cupt will strike out the 'experimental' word from the tool's description.

Planet DebianCyril Brulebois: Best questions ever

Would someone guess the link between:

  • What mail client are you using?

  • Are you around during the next two weeks?

GNU/kFreeBSD logo

After answering those, I’ve been offered to take care of the GNU/kFreeBSD buildds, which is yet another experience. \o/

Quite a good timing since I’ve recently tried to get involved with the GNU/kFreeBSD ports again, prodding maintainers, uploading fixed packages (usually thanks to Petr Salinger’s patches), or providing patches myself.

Planet DebianRobert Millan: Mono is not a patent threat for Debian


I read Richard Stallman’s post in which he expresses his concern about a serious danger with reliing on .NET for free software development. I think Richard makes very good points here, and I do agree that there’s a serious danger, but I don’t think Microsoft would ever bring all .NET implementations underground. If you think that, my opinion is you’re underestimating them.

Microsoft is smarter than that. They are a sworn enemy of free software, they’re ruthless, and they know all the anti-competitive tactics in the IT world. There’s no doubt they want to make our community divided and helpless. And when they look at the free software development ecosystem, they see two big groups:

A- Highly profitable vendors like Red Hat or Sun/Oracle.
B- Non-profit communities like Debian or Ubuntu (technically, Canonical is a for-profit venture, but they operate at loss).

There’s also 3rd parties that sell hardware or services and contribute “collateral” improvements to our codebase. I’ll ignore those for the sake of simplicity.

It would be silly to try harm group B with their patents, since it’s composed of grass-root efforts which can’t be unrepairably injured just by bringing a company out of bussiness. Besides, group B actually helps them promote their patent-encumbered standards. Why attack those who are helping you?

Ah, but as for group A, maybe they could use patents to shut it down? Perhaps, but I think they’re even smarter than that. Sun Tzu said: “When you surround an army, leave an outlet free. Do not press a desperate foe too hard.” If Mono-based applications become a significant competitive advantage (and it is in their agenda that they do), and their competitors are forbidden from using them, they will put all their effort in pushing for alternatives, even at great expense. I really think they know better.

I recently came across this very interesting article, written in 1999, which details the tactics used by Microsoft to fight IBM. They obviously saw OS/2 as a threat. Back then, Windows 95 was the trading token. They could have caused IBM a great deal of harm shall they refused to license it to them, but it seems the idea of subjugating IBM was more appealing. This is how Garry Norris (IBM) put it:

Microsoft repeatedly said we would suffer in terms of prices, terms, conditions and support programs, as long as we were offering competing products.

[Microsoft] insisted that IBM sell 300,000 copies of Windows 95 in the first five months or face a 20 percent price increase

Nice deal, eh? Make your dependancy on Windows 95 stronger, or else we’ll use your existing dependancy on Windows 95 against you. No surprise IBM abandoned the PC market. Are Red Hat and Sun/Oracle set on the same direction?

Draw your own conclussions. In my point of view, projects like Debian and Ubuntu are completely safe from direct patent threat. Should we care if Red Hat or Sun/Oracle succumb? Perhaps not, after all, what are they doing for us?

TEDTeaching life lessons through tinkering: Gever Tulley on TED.com

Gever Tulley uses engaging photos and footage to demonstrate the valuable lessons kids learn at his Tinkering School. When given tools, materials and guidance, these young imaginations run wild and creative problem-solving takes over to build unique boats, bridges and even a rollercoaster! (Recorded at TED University 2009, February 2009 in Long Beach, California. Duration: 4:05)

Short URL: http://on.ted.com/1K

Watch Gever Tulley's talk from TED University 2009 on TED.com where you can download this TEDTalk, rate it, comment on it and find other talks and performances from our archive of 450+ TEDTalks.

Get TED delivered:
Subscribe to the TEDTalks video podcast via RSS >>
Subscribe to the iTunes video podcast
Subscribe to the iTunes audio podcast
Get updates via Twitter >>
Join our Facebook fan page >>

Subscribe to the TED Blog >>