The Surge and War for Oil

September 18, 2007 | etbe

On scienceblogs.com there is an interesting article about statistics and “The Surge” in Iraq [1]. It explains how there is not yet enough data to statistically determine whether The Surge is succeeding in improving the situation in Iraq. Some of the comments point out that the “ethnic cleansing” in some parts of Iraq has been mostly completed. When one of the groups in a disputed area is annihilated or driven out you can expect a reduction in violence.

The Guardian reports that Alan Greenspan has stated in his memoirs [2] “I am saddened that it is politically inconvenient to acknowledge what everyone knows: the Iraq war is largely about oil“. His meoirs are published as The Age of Turbulence: Adventures in a New World. I’ve added it to my Amazon Wish List.

Web-Scabs

September 17, 2007 | etbe

I have just read an interesting post by Ted Ts’O about copyright protection on the net [1]. Ted is well known as a free software programmer, but it’s slightly less well known that he is an avid Science-Fiction fan. In the Free Software community most people seem to be interested in Sci-Fi, but Ted is more interested than most.

Ted’s post concerns the irresponsible actions of the Science Fiction and Fantasy Writers of America [2] (SFWA). To summarise it they issued DMCA [3] take-down notices for any web page that matched a search on the names “Asimov” or “Silverberg“. I don’t approve of the DMCA laws as a collection, but take-down notices are not necessarily bad (I have issued such notices for unauthorised copies of my own work in the past). The problem in this case is that the words in question are extremely common, not only might they be used as the names for other people (authors or characters) but Asimov in particular is a well known term when describing the potential development of intelligent computers that operate robots (see the Three Laws of Robotics [4]), the term “not Asimov Compliant” has been used by Alastair Reynolds in Century Rain to refer to a class of military robots that have no compunction about killing humans.

Among the fall-out of the SFWA actions was the removal of a free novel by Cory Doctorow [4]. Incidentally my favourite free to download Cory Doctorow book is Eastern Standard Tribe [5]. craphound.com has Cory’s blog as well as links to other free Sci-Fi that he’s written.

Reading the links from Ted’s post took me to a blog entry by the current SFWA vice-president [6] which describes authors such as Cory Doctorow as “webscabs“. This offends me greatly. My work and that of my friends in writing free software could be described in the same way (and in fact is described in a similar way by some software monopolists). Every blogger could have their work described in a similar way by paid journalists.

The fact that the SFWA VP is not representing SFWA when writing such comments does little to allay concern about this. It seems to me that people with such ideas are intent on attacking my community, and that it would be wrong of me to give any of them $0.50 by buying one of their books. I resolve to not buy any more Sci-Fi books until I have read all the freely available books that I want to read. After that I will prioritise my book purchases with a significant factor being how well the author gets the concepts of copyright etc. If nothing else an author who can’t understand how copyright (something that is essential to their own livelyhood) interacts with current computer systems will have significant difficulties in predicting how technology and society will develop over the next hundred or thousand years.

My problem in reading Sci-Fi books is not in discovering books that are enjoyable and which contain interesting concepts, but in finding time to read them. Thanks to SFWA for giving me an extra criteria to cull the list of books to read.

iRiver H320 and Liquid

September 16, 2007 | etbe

Recently my iRiver [1] H320 had some milk based drink spilt on it. I’m not sure what the drink was (I discovered it when my iRiver stopped working and the drink was dry) but it smelled like coffee or hot chocolate when I washed it off (I considered tasting it but decided that knowing exactly which drink had damaged my iRiver probably wouldn’t help me fix it).

The initial problem was that no buttons other than the play button (which is also used to turn it on) worked. When I first discovered this I had no way of hitting the reset button so my iRiver played until the battery ran flat. I tried to disassemble it by removing the five tiny phillips-head screws from the sides, but that didn’t make any part of it loose. I tried using a small amount of force on the front piece of plastic and broke two of the clips that hold it in place while getting another two loose without breaking (but there were still at least four clips to go).

Then I realised that the problem was that the keys were physically sticking and that maybe if I washed the keypad out I might get it to work. So I spent some time in a cycle of dripping water into my iRiver, pressing the buttons to get some of the nasty stuff dissolved, and then using a towel to soak up some of the water with milk or whatever. After repeating this for a while the buttons all seemed to work well apart from the play button which kept registering presses when I wasn’t touching it. This meant that it always automatically turned on and then played a song in a stuttering manner as the play button is also the pause button and it paused and played as rapidly as it could.

Finally I left it in the sun to dry for a few hours, which seemed to do some good. The play button mostly works now. Also it seems quite easy to get water between the front layer of protective plastic and the layer behind (which actually houses the keypad). So I have several large drops of water spread out between the layers which move around as I squeeze it. I think that if I get that dried out before algae can grow then everything will be fine.

[1] http://www.iriver.com/

More About Google Earth

September 14, 2007 | etbe

I recently wrote about problems with Google Earth [1]. In comments it was pointed out to me that there are some Debian packages of it in contrib. Installing the package ttf-bitstream-vera solved the font problem and running it directly (not through ssh -Y) on a machine with DRI support made it run reasonably fast on a machine with identical hardware to my mother’s.

The animation is quite slick when the hardware works, and I have used it a bit.

However I’m still disappointed in the program. The animation should be disabled for hardware that doesn’t support it at a reasonable speed (a reasonable default would be to disable animation if the display is :10.0 so that it doesn’t try to do animation over ssh). Also the feature of having movement continue should be disabled if there is any question about the performance. When performance (of scrolling and network access) is good it’s nice to be able to swipe with the mouse and have the scenery slide past until you tell it to stop. When performance is bad it’s annoying to have it keep trying to slide somewhere and make the entire machine run slowly.

[1] http://etbe.coker.com.au/2007/09/11/google-earth-almost-a-great-program/

Multiple Pointers in X

September 13, 2007 | etbe

After having read Brice Goglin’s post about what to expect in X for Lenny [1] the thing that seemed most exciting is the support for Multi-Pointer X [2]. This allows multiple keyboards and mouses with a separate keyboard focus for each. So you can have two people typing two different things on the one desktop.

This should be good for training related to GUI programs and will also have some interesting possibilities for large displays. I wonder if the concept of Pair Programming [3] could benefit from having two keyboards and mouses. The idea is that one person isn’t actively coding, but following what the active coder is doing may require reviewing other code that is not visible on screen.

Another interesting feature is XACE [4] the X Access Control Extension. Among other things this is used for Security Enhanced X. Hopefully I’ll be able to find time to work on SE-X in Debian before Lenny is released.

Some Good and Bad Ideas for Recruiting

September 12, 2007 | etbe

Eweek has an interesting article about Microsoft’s latest bad hiring idea [1] (their previous one was hiring a model to try and give the idea that IT work is cool [2]). They have created a web site hey-genius.com to try and get people who consider themselves to be geniuses to work for them.

One significant problem with this idea is that the amount of ego required to claim the title of genius is significantly greater than the amount of ego that makes it impossible for two people to work in the same office. Google’s methods of trying to attract candidates are much more sensible, for example setting mathematical and logical problems and inviting people who can solve them to apply for work. People who can solve maths and logic puzzles tend to be good programmers because essentially programming is about solving such puzzles while also relying on having memorised a huge number of facts and numbers. If you can solve the logic puzzles then you are probably half-way to becoming a decent programmer.

The next problem is that the web site doesn’t work very well. In fact it works so badly that some people have suggested that the aim of the exercise is to make job offers to the people who give the best suggestions as to how to improve the web site. It gave a black window with Konqueror and with Firefox it didn’t appear to offer full functionality (and required a pop-up for no good reason too).

But one useful thing about it is that it links to the Microsoft Jobs Blog [3] which is a really good recruiting idea. There are posts about various benefits that MS offers it’s employees, about visits by MS representatives to schools, and other things that will surely be of interest to people who like MS. I recommend that everyone who works in HR reads that blog and considers whether something similar would work for them (I think it would work for all large companies). Another interesting thing to note is that there are glamour photos of recruiting agents. I suggested in my previous post that they should “find some cute female MS employees and get them to do the promotion”, well it seems that MS was already doing similar things before I suggested it!

One significant thing that they could do to improve their jobs blogging is to have a blog with job adverts with category based feeds for all the different categories. This would permit someone who is interested in XML work to get a feed of the XML jobs category and wait for something suitable to come up. I believe that every company that advertises more than two positions per year should have a RSS feed of the job adverts. It allows syndication feeds of adverts from multiple companies which job seekers can poll for positions that match their skills.

Google Earth – Almost a Great Program

September 11, 2007 | etbe

My mother just asked me to get Google Earth (link to download page [1]) working on her machine so she can see where my sister [2] lives.

So I download all 20 megs of the sucker (of course it had a horrible license agreement that precludes packaging for Debian or any other sane distribution) and ran it (under a different account of course because I don’t trust non-free software). It’s unfortunate that Google weren’t prepared to put in the extra effort of making Debian and RPM packages for it. When I examined the contents of the file there were sym-links from FreeBSD, NetBSD, and OpenBSD to Linux and from amd64 and x86_64 to x86. So much for portability, just assume that everything is an i386 running Linux!

The first problem I encountered is that it doesn’t support installing in text mode and demands X access, have the Google people never heard of sys-admins who do their work over low-bandwidth links and don’t use X? What happens if your sys-admin is using a braille terminal?

When I enabled X by “ssh -X” I encountered the error below (Error 1). It seems that the installation program was not written with the X11 Security Restrictions in mind and only works with “ssh -Y“. The same applies to actually running the program once it’s installed.

Finally it gave me a GNOME error dialogue about the Bitstream Vera Sans font not being installed. If they had made a Debian package then it could have depended on the package that provides the font in question. Now I’m left wondering which package provides it, and whether it’s even available (maybe they depend on non-free fonts).

Once I got it working I found it to be incredibly slow on my Pentium-M laptop with 1.5G of RAM. I ran it on a Pentium-D desktop system in a Xen DomU (it’s only 32bit and I couldn’t figure out how to get the AMD64 version of Debian to run i386 programs without a chroot or a Xen instance). But it still wasn’t particularly fast. One problem is that the GUI is not well written, so I drag the Earth to rotate it from the initial view and the Earth moves slowly long after I have released my mouse button. Another is that my X server started using significantly more memory while it was running (and has not returned to it’s previous size).

Google Earth is a really neat program that does some nice things. But I’m not going to buy a new Thinkpad to run it, and the experience of running it on a Pentium-D server is not that great either. I’ve just rm’d it from my laptop, I’ll leave it installed on the server but probably won’t run it often.

I’ll try installing it on my mother’s computer (Celeron 2.4GHz with 512M of RAM) but I am not expecting it to run well. The machine is still new to her, I replaced her Pentium3 800MHz with 384M of RAM about a week ago. She never found the Pentium3 to be slow (and I don’t think that Google Earth is a good reason for an upgrade).

Continue reading →

Gear Acquisition Syndrome

September 10, 2007 | etbe

I have just read an interesting post about Gear Acquisition Syndrome [1] as applied to the guitar industry. Apparently it’s common for people to spend a lot of time and money buying guitar equipment instead of actually playing a guitar. I think that this problem extends way beyond guitars and to most aspects of human endeavour, and that actively trying to avoid the problem is a key to getting things done. I believe that the author however makes a strategic error by then going on to advise people on how to buy gear that won’t become obsolete. Sure it’s good to have gear that will suit your future needs and not require replacement, but if you are repeatedly buying new gear then your problem usually is not that the gear doesn’t do the job but that you want to buy more.

I used to suffer from this problem to a degree with my computer work, and still have problems controlling myself when I see tasty kit going cheap on auction.

Here is a quick list of things to do to avoid GAS:

Recognise the problems with getting new gear. It costs money (thus requiring you to do more paid work or skip something else that you enjoy). It needs to have the OS installed and configured which takes time away from other things (unless your job is related to installing software on new machines). Finally it might be flawed. Every time you buy a new computer you risk having a failure, if it’s a failure that happens some time after deploying the machine then it can cause data loss and down-time which is really annoying.
Keep in mind what you do. I primarily do software work (programming and sys-admin). While some knowledge of hardware design is required for sys-admin work and the ability to make my own hardware work is required for my own software development I don’t need to be an expert on this. I don’t need to have the latest hardware with new features, the old stuff worked well when I bought it and still works well now. My main machine (which I am using to write this post) is a Thinkpad T41p, it’s a few years old and a little slow by today’s standards but for everything that really matters to me it performs flawlessly. If your job really requires you to have experience with all the latest hardware then you probably work in a computer store and get access to it for free!
When you have a problem think about whether new gear is the correct solution. There are a couple of areas in which performance on my Thinkpad is lower than I desire, but they are due to flaws in software that I am using. As I am primarily a programmer and the software in question is free it’s better for me (and the world) if I spend my time fixing the software rather than buying new hardware.
Buy decent (not hugely expensive) gear so that you don’t need to continually buy new stuff. EG if a machine is going to store a moderate amount of data then make sure it has space for multiple hard drives so you can easily add new drives.
Don’t buy the biggest and baddest machine out there. New hardware is developed so quickly that the fastest gear available now will be slow by next-year’s standards. Buy the second-fastest machine and it’ll be a lot cheaper and often more reliable.
Determine your REAL requirements that match what you do. As I do software it makes sense for me to have the most reliable hardware possible so I can avoid stuffing around with things that don’t interest me so much (and which I’m not so good at). So I need reliable machines, I will continue buying Thinkpads (I plan to keep my current one until it’s 5 years old and then buy another), I believe that the Thinkpad is the Rolls-Royce of laptops (see the Lenovo Blogs site for some interesting technical information [2]) and that continuing to use such hardware will keep me effectively using my time on software development rather than fooling with hardware. For desktop machines I have recently wasted unreasonable amounts of time due to memory errors which inspired me to write a post about what a company like Dell could do to address what I consider the real needs of myself and other small business owners [3] (note that Dell is actually producing more suitable hardware in this regard than most companies – they just don’t market it as such).
Keep in mind the fact that most things you want to do don’t require special hardware. In fact for most tasks related to computers people were doing similar things 10 years ago with much less hardware. If you believe that it’s just the lack of hardware that prevents you from doing great work then your problem is self-confidence not hardware availability.

It’s interesting that a sports-shoe company has a slogan “Just Do It” while trying to convince people that having special shoes is required for sporting success. Most professional athletes started training with minimal equipment. Get some basic gear and Just Do It!.

References:

Comparing Debian and Fedora

September 9, 2007 | etbe

A common question is how to compare Fedora [1] and Debian [2] in terms of recent updates and support. I think that Fedora Rawhide and Debian/Unstable are fairly equivalent in this regard, new upstream releases get packaged quickly, and support is minimal. They are both aimed at developers only, but it seems that a reasonable number of people are running servers on Debian/Unstable.

Fedora releases (previously known as “Fedora Core” and now merely as “Fedora”) can be compared to Debian/Testing. The aim is that Fedora releases every 6 months and each release is supported until a release two versions greater is about to be released (which means that it’s about a year of support). The support however often involves replacing the upstream version of the program used to make a package (EG Fedora Core 5 went from kernel 2.6.15 to kernel 2.6.20). I believe that the delays involved in migrating a package from Debian/Unstable to Debian/Testing as well as the dependency requirements mean that you can get a similar experience running Debian/Testing as you might get from Fedora.

Stable releases of Debian are rare and the updates are few in number and small in scope (generally back-porting fixes not packaging new upstream versions). This can be compared to Red Hat Enterprise Linux (RHEL) [3] or CentOS [4] (a free re-compile of RHEL with minor changes).

Regarding stability and support (in terms of package updates) I think that Debian/Stable, RHEL, and CentOS are at about the same level. RHEL has some significant benefits in terms of phone support (which is of very high quality). But if you don’t want to pay for phone support then CentOS and Debian/Stable are both good choices. Recently I’ve been rolling out a bunch of CentOS 5 machines for clients who don’t want to pay for RHEL and don’t want to pay for extensive customisation of the installation (a quick kickstart install is what they want). The benefit of Fedora and Debian/Testing over RHEL, CentOS, and Debian/Stable is that they get newer packages sooner. This is significant when using programs such as OpenOffice which have a steady development upstream that provides features that users demand.

If you want to try new features then Fedora and Debian/Testing are both options that will work. One reason I had been avoiding serious use of Debian/Testing is that it had no strategy for dealing with security fixes, but it seems that there are now security updates for Testing [5] (I had not realised this until today).

References:

ISP Password Change by Untrusted People

September 8, 2007 | etbe

After dealing with Optus phone support [1] in regard to a routine request for a password change I have been thinking about better ways of managing password changes for a large ISP. The first criteria is that the user must have a password that is difficult to brute-force attack at all times. Changing a password to a supposedly temporary value that can be easily guessed (such as “changeme“) is never acceptable. The next criteria is that the help-desk operator should be trusted as little as possible and it would be ideal if they never knew the password.

One possibility that occurred to me is that each bill could have a six-digit pseudo-random number printed on it. This number could be used as an alternate password. When a customer calls up because they lost their password they almost always have their last bill (this is why they print the number for phone support on each bill). The help-desk operator could then push a button on a web based form that makes this pseudo-random number be their new password, thus the help-desk operator would not know the new password and the user would also have it printed out clearly which avoids the confusion from having a password read out in a foreign accent.

Another possibility is to have the password change infrastructure integrated with the CTI [2] system, then the help-desk operator could push a button and have the computer dictate the password without the help-desk operator being able to listen in.

There will always be corner cases where a help-desk operator has to change the password, but if these are rare because the automated system handles most cases then the potential for damage would be limited. Of course it would also be a really good idea to do some statistical tracking of the number of password change requests performed by each operator and investigate those who do significantly more than average. In the past AOL has experienced a variety of security problems related to trojans [3] which probably would have been discovered by such analysis.

Another possible option is that customers with mobile phones could have their new password sent to them by SMS. It’s quick, easy, cheap when done in bulk, and is much harder to intercept than most methods that might be used for transferring passwords.

References:

etbe – Russell Coker

Linux, politics, and other interesting things

The Surge and War for Oil

Web-Scabs

iRiver H320 and Liquid

More About Google Earth

Multiple Pointers in X

Some Good and Bad Ideas for Recruiting

Google Earth – Almost a Great Program

Gear Acquisition Syndrome

Comparing Debian and Fedora

ISP Password Change by Untrusted People