one more monkey...

moved to google+

2012-01-19T17:28:00.001+05:30

Well it had to happen someday. I referred to it obliquely in
http://sitaramc.blogspot.com/2011/07/veracity.html but at that time I
did not expect to actually stop using blogspot.

There are in fact some advantages blogspot has. The blog-specific
search is one thing (G+ will search the whole world so you have to add
your name or something to make it focus on your "stream" or whatever
the heck they call it).

The URL itself is a big turnoff in G+. Compare blogspot's
http://sitaramc.blogspot.com/2011/07/veracity.html to G+'s
https://plus.google.com/115609618223925128756/posts/PDPdXTxAvZk.
Uggh!

In fact the only reason I'm moving there is because my online world
has now pretty much reduced to git, gitolite, and related areas. And
most of those people are on G+. I reach, and am reached by, so many
more people there, it's an enormous difference from blogspot.

Microsoft makes .txt files dangerous!

2011-09-23T14:31:00.000+05:30

This security update resolves a publicly disclosed vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user opens a legitimate rich text format file (.rtf), text file (.txt), or Word document (.doc) that is located in the same network directory as a specially crafted dynamic link library (DLL) file.

-- Microsoft makes .txt files dangerous

(Courtesy http://lwn.net/Articles/459240/ )

git for computer scientists -- my version

2011-09-17T07:00:00.001+05:30

http://sitaramc.github.com/gcs/

It's quite similar to the original, classic version, but extends the
whole thing to explain detached HEAD, and the difference between reset
and checkout

Fwd: Git - Authenticate from Active Directory....

2011-08-09T23:24:00.001+05:30

India in general is very "age conscious" as in, "respect people [significantly] older than you". But among Indians, Punjabis are particularly so. Not unlike Japan and Italy [which I used to call our "country-in-law" at one time ;-)]

So anyway, I decided to shamelessly play on this; see the last sentence of the email below ;-) It may not have any short term effect, but who knows...!

---------- Forwarded message ----------
From: Sitaram Chamarty <sitaramc@gmail.com>
Date: Tue, Aug 9, 2011 at 11:07 PM
Subject: Re: Git - Authenticate from Active Directory....
To: [an obviously Punjabi name elided]

Although this link sounds like it is only about ssh, if you read it carefully it answers your question and it should help you: http://sitaramc.github.com/gitolite/doc/authentication-vs-authorisation.html

On a more personal note, I won't help anyone with Microsoft stuff. I won't actively prevent gitolite from working with MS, but I will not actively help either. For example, if someone sends me a write up on how to get gitolite to work with OpenLDAP, I will either add it to my docs, or link to it (whatever he wants). But if you send me a document about how to make it work with AD, I will not do that.

Sorry if that sounds rude, arrogant, or whatever, but at my age (I'm close to 50) I'm entitled to my opinions, puttar ;-)

regards

sitaram

On Tue, Aug 9, 2011 at 10:49 PM, elided
<elided> wrote:
> Hi,
>
> A question on gitolite:
>
> I have git repository hosted on a Linux RedHat Enterprise machine.
> I am able to checkin/checkout using http (apache is configured for this).
> The users are setup using .htpasswd.
>
> I want to authenticate from Active Directory instead. Is this possible with
> gitolite?
> Also this access has to be given only to certain Active Directory users.
>
> If not, is this even possible?
>
> Looking forward to your response.
>
> Thanks
> <elided>

--
Sitaram

(WTF, mac idiocy!) oh yeah, about that "silky smooth OS X style"...

2011-08-02T16:54:00.001+05:30

"git gui" and "gitk" are nice GUIs that come with git. The latter especially is *very* powerful and even Linus uses it when needed.

GitX (http://gitx.frim.nl/) is what folks use on Macs. Per its website, "GitX is a git GUI made for Mac OS X. It currently features a history viewer much like gitk and a commit GUI like git gui. But then in silky smooth OS X style!"

Nice. Except, I learn while casually hanging around on #git, that you cannot open two GitX views on the same repo.

And this is not a GitX limitation. It's damn well not a *Git* limitation, since the tools that GitX claimed to be "much like" don't have that limit.

No... it's apparently an OS X limitation not to allow GitX to open a repo twice. Apparently a repo is a "document" so it "makes sense" to the poor brain-washed guy who told me this.

Damn... all the trouble Linus goes to avoid the need for locking, with stable objects and NFS-safe renames, and such.

And Mac OS X says "meh!"

Tell me again, why do *developers* use this piece of shit?

IE users stupid?

2011-08-01T15:28:00.001+05:30

http://www.theregister.co.uk/2011/07/29/aptiquant_iq_survey/

quote: "The comparison clearly suggests that more people on the higher side of IQ scale have moved away from Internet Explorer in the last 5 years," AptiQuant concludes.

I wish this were actually true, but sadly, it isn't very likely to be. I call bullshit.

I do believe most IE users are seriously lacking **in information technology skills**, but even in my worst anti-MS rant I have never equated that with stupidity as a general trait.

My doctor uses IE. My accountant uses IE. 99% of TCS' senior management probably uses it simply because it is the damn default and *they* didn't feel there was anything wrong with it.

In fact, I am coming to the opposite conclusion. I suspect that most IE users are of the kind (see previous para) who would not even *bother* to visit an IQ measurement site. And I am saddened that among Chrome/Opera/FF users, the more intelligent ones actually have the time to waste on trivial pursuits like "gee I wonder what's my IQ" (here's a hint: if you care, it's not high enough!)

And that doesn't mean IE is somehow being credited here. It just happens to be the "incumbent", as they say in politics.

veracity

2011-07-29T20:32:00.001+05:30

placeholder for https://plus.google.com/115609618223925128756/posts/PDPdXTxAvZk

I posted my comments on veracity there because a lot *more* of my gitolite/git contacts are there.

----

meta comment on blogs and g+: at some point we'll have to choose one; we can't update both. I'd love to move to G+ for my blogging also, but it doesn't have a search box anywhere that I can see. I depend on that a lot to find stuff I wrote about long ago, and without that I can't really make it the main outlet for my random typing!

Dijkstra endorses perl (well, I'm stretching it a wee bit... ;-)

2011-07-21T15:56:00.001+05:30

Dijkstra quote: If we wish to count lines of code, we should not regard them as "lines produced" but as "lines spent".

debugging "clever" code

2011-07-20T09:58:00.001+05:30

""Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it."

— Brian W. Kernighan and P. J. Plauger in The Elements of Programming Style.

This came up in a comment about an LWN article on how subtle and tricky some of [the Linux kernel] core code has become. Some of the more interesting quotes from that article and its links:

(in the original email from Hugh Dickins):

That -ENOENT in walk_component: isn't it assuming we found a negative dentry, before reaching the read_seqcount_retry which complete_walk (or nameidata_drop_rcu_last before 3.0) would use to confirm a successful lookup? And can't memory pressure prune a dentry, coming to dentry_kill which __d_drops to unhash before dentry_iput resets d_inode to NULL, but the dentry_rcuwalk_barrier between those is ineffective if the other end ignores the seqcount?

Let's call this "establishing the baseline" -- anyone who did not understand at least 75% of this will be lost as far as the real problem is concerned. But what about the people who *did* understand it (or at least, had the best chance to):

There is a sobering conclusion to be drawn from this episode, though. The behavior of the dentry cache is, at this point, so subtle that even the combined brainpower of developers like Linus, Al, and Hugh has a hard time figuring out what is going on. These same developers are visibly nervous about making changes in that part of the kernel. Our once approachable and hackable kernel has, over time, become more complex and difficult to understand. Much of that is unavoidable; the environment the kernel runs in has, itself, become much more complex over the last 20 years. But if we reach a point where almost nobody can understand, review, or fix some of our core code, we may be headed for long-term trouble.

uh oh...!

Forbes columnist on "Microsoft's Android Shakedown"

2011-07-14T12:04:00.002+05:30

http://blogs.forbes.com/timothylee/2011/07/07/microsofts-android-shakedown/

Nice quote: "Getting software patents takes a lot of work, but it's not primarily engineering effort. The complexity of software and low standards for patent eligibility mean that software engineers produce potentially patentable ideas all the time. But most engineers don't think of these relatively trivial ideas as 'inventions' worthy of a patent. What's needed to get tens of thousands of patents is a re-education campaign to train engineers to write down every trivial idea that pops into their heads, and a large and disciplined legal bureaucracy to turn all those ideas into patent applications."

But I think there's one more point to be made here.

The decades-old Sun/IBM incident, narrated as the intro to that article, doesn't describe what would happen today. The alternative the "blue suit" suggested was one where IBM would actually spend the time to find *real* infringements, if Sun refused to buckle.

That was the 80s. Today, if HTC resisted, MS would proceed directly to litigation even if they knew the specific claims being made were without merit.

In other words, while Sun capitulated due to the fear of real infringement being found, I believe today's defendants pay up due to fear of the litigation itself!

Big difference!

Jon's impressions of Chromium

2011-07-11T16:17:00.001+05:30

http://lwn.net/SubscriberLink/450359/0c7b485f10ca5225/

I guess I'll stick to Firefox -- NoScript is kind of a necessity right now :-)

It might not be bad as a second browser though, although one has to watch out for the Chromium/Chrome distinction!

[And by the way, I never understood Google's need to call a browser by the internal name for the UI component of a competing browser!]

the lure of apple products...

2011-06-29T11:29:00.001+05:30

awesome punchline:

It took me several years to find someone I could give mine to for free. What is the world coming to?

--
Sitaram

the new nook (aka Nook second edition, nook simpletouch, etc)

2011-06-24T22:04:00.006+05:30

Well I happened to be in the US after many years, and despite being sent a nook 1, (wifi only model) by my brother a couple of months ago I was tempted enough by the reviews of the nook 2 to buy one.

[By the way, the nook 1 (wifi only version) was $150 when my brother bought it for me. A scant few weeks after he sent it to me, they announced the Nook 2 at $139, and dropped the price of the nook 1 to $119! Timing issues like this have been the story of my life, <sigh>...]

So here're the pros and cons of this one compared to the old one.

Summary: lighter and smaller and better navigation make it attractive. But there are lots of negatives to consider, and if I'd known all of them before I bought it I may not have done so. Even now, I'm sorta tempted to attempt returning it but that's only fueled by "righteous indignation" so I will probably just laze around until it's time for my flight home and then claim I didn't have time!

Pros:

much better interface -- the main screen is a touch screen now! (For people who're wondering what's the big deal, remember this is e-ink, non-backlit display -- totally different technology to the normal stuff on your Androids!)
much smarter navigation. Both because the main screen is touch, as well as the fact that you can reverse the meaning of the top and bottom buttons if the size of your hand makes it so that the upper button is better for your thumb to hit when you hold it. Reading is a real pleasure with this thing!
reviews say it has a much better battery life. Sounds believable, because there's no longer a battery draining lighted touchpad! I can only hope, because the old one sucked rocks through a pipette in terms of battery life!
no touchpad means it's much smaller and lighter, while having the same actual screen size (800x600)
has a built-in dictionary (accessible only from EPUB files, not from PDFs... wonder why)
(minor: now actually knows about GMT+0530 in its time zone list! yeaaay!)

Cons:

no device password. This is a big problem for someone like me; limits what I can use it for. I can no longer grab a quick PDF of some work document I need to read and take it with me, in case the device gets stolen.

You may think you can use encrypted PDFs, but that won't work. There's no way to make it "forget" the password short of completely shutting down, so if you opened a document it's now visible to anyone who grabs the device. (In the old nook, the moment you open another document (even an un-encrypted one), the password for the previous one was forgotten. Not great but I was happy enough to use it as a workaround...)
no document delete. If you did take along a sensitive file, you can't delete it once you've read it, to limit exposure. The old nook would let you delete documents from its interface; this one needs a PC to do that. This is the worst problem from my point of view because it could have somewhat mitigated the previous one.
non-replacable battery. This is the second worst problem as far as I am concerned. For people who live outside the US, like me, this could be a killer. I'm crossing my fingers hoping I don't get burned...
mandatory registration. A new nook 2 won't even get to the home screen unless you register. Fortunately, it doesn't insist on a credit card for a new registration, but even so, that's badbadbad(tm)! [And I'm willing to bet some corporate fsckwit at BN will read this and make a note to make the credit card mandatory for nook 3!]

I have no intention of ever buying any content -- most of my reading is PDFs from work or web pages converted to EPUBs with my own script built around calibre's ebook-convert program. So the question: at $139, do they still have to resort to the razor/blade revenue model?
probably for the same reason, only 236 MB for "sideloaded" documents. ["sideloaded" apparently is the phrase to describe docs you install through USB instead of from BN using their interface]. This is barely one-fifth of the 1.3 GB the old nook had. The nook 2 reserves the rest of the free space for BN content, which means in my case it's just sitting idle. To be honest, this is not a big deal, but one does feel somewhat cheated at the forced space wastage.
no music. I never used the music on the old nook anyway so I don't care.
no browser. Well the browser on the old nook was crap so I don't miss it, but it could actually have been usable on this one, because of the touch screen! Why did they do this?

And finally, here's the biggest WTF: when you start the machine and eventually read the 100-page user manual, it says somewhere toward the end "You can purchase a Nook only if you have a billing address in the United States".

Huh? Why? What earthly logic do you have for this? We're the best customers -- we don't have much opportunity to return it, call your customer complaints, and generally make your life miserable if we don't like it.

More importantly, how the fsck am I supposed to know that before buying it? The sales clerk at BN, Stevens Creek (CA) didn't even ask. Clearly he is smart enough not to lose a sale for crappy reasons, so what's with the corporate stupidity?

And don't tell me it's legal reasons to do with geography specific licensing for books, like DVD region codes. You're not going to let me buy content until I give you a credit card with a US billing address anyway ...

All in all, psychologically very disappointing. So now that I have "pensieve"d all these comments, I will try and purge them from my mind and try and enjoy the damn thing...

rule #1 for a home user

2011-06-12T23:11:00.001+05:30

don't let your mom do your packing/unpacking. She'll drop the 1TB
hard disk that contains your only backup while trying to help you.

-- my son

happy passwords, here I come!

2011-06-02T14:11:00.000+05:30

http://orderedlist.com/blog/articles/the-psychology-of-happy-passwords/

Interesting... I know what my future passwords are going to be themed around now!

scale fail: cloud addiction

2011-05-25T11:00:00.001+05:30

I've always been wary of anything that is being hyped. Until the hype dies, I'm prejudiced against it, and I won't give it a fair chance.

This is not just for technology issues -- I do that to movies and books also. I still won't bother to read Da Vinci Code, although I finally did see Forrest Gump years later, when I became convinced it was OK.

But it's much more true for technology. Here, unlike a movie I have not seen or a book I have not read, I can actually expect to have an intuitive feel for the truth already, so the prejudice lasts longer and very rarely reverses.

----

The "cloud", to me, has always been just that: a bit of water and a lot of hot air. I can certainly see some uses for cloud computing in small and medium enterprises -- the smaller the better. An extreme case is an individual running his own web-based business -- finding a cloud provider is ideal for him in terms of bang for the buck.

But I've always believed that the larger you get, the more you lose by going to the cloud. At some point, the economies of shared infrastructure disappear simply because as you get bigger and bigger, you are less amenable to sharing.

Josh Berkus (of Postgres) wrote a very fantastic 2-part article series called "Scale Fail" for LWN. Part 2 of this, at http://lwn.net/SubscriberLink/443775/a17084926dbefa54/ , has a section called "Cloud Addiction", which is well worth a read. Here're some extracts:

Several of our clients are refusing to move off of cloud hosting even when it is demonstrably killing their businesses. This problem is at its worst on Amazon Web Services (AWS) because Amazon has no way to move off their cloud without leaving Amazon entirely, but I've seen it with other public clouds as well.

[...]

[restrictions on memory, processing power, storage throughput and network configuration inherent on a large scale public cloud, as well as the high cost of round-the-clock busy cloud instances] are "good enough" for getting a project off the ground, but start failing when you need to make serious performance demands on each node.

[...]

That's when you've reached scale fail on the cloud. At that point, the company has no experience managing infrastructure, no systems staff, and no migration budget. More critically, management doesn't have any process for making decisions about infrastructure. Advice that a change of hosting is required are met with blank stares or even panic.

(heard on slashdot) WMI

2011-05-11T13:21:00.001+05:30

WMI is great. If you liked the complexity of CORBA, COBOL, VB Script, and the syntax of SQL, you will love WMI.

do you still want an Apple ipod/ipad/iphone?

2011-05-05T11:47:00.001+05:30

Here's a completely different take on the issue than my normal "freedom" rant:

http://www.dailymail.co.uk/news/article-1382396/Workers-Chinese-Apple-factories-forced-sign-pledges-commit-suicide.html

And by the way, this is not new. The suicides were reported months
ago. The response from the guilty parties is what is new.

And this is not the first time something like this has been found
about US companies either. I think the most famous such scandal
involved Nike, in 97 or so.

And I'm not saying Apple is the only guilty party -- I'm sure there
are many others. However, with the amount of customer mindshare Apple
has, it ought to be leading the way in preventing this sort of abuse.
It ought to be caring about ethics and morality, not just legality.

But I don't think it will -- most corporations have a "duty" to not
care about anything except making money, actually. And they made a
lot of it -- 14 billion dollars PROFIT, (after taxes) last year!

Now you have to think: do I want to help them make more?

facebook as the ultimate spy network

2011-05-03T10:06:00.001+05:30

http://rt.com/news/wikileaks-revelations-assange-interview/

quote:

"Facebook in particular is the most appalling spying machine that has ever been invented. Here we have the world's most comprehensive database about people, their relationships, their names, their addresses, their locations and the communications with each other, their relatives, all sitting within the United States, all accessible to US intelligence. Facebook, Google, Yahoo – all these major US organizations have built-in interfaces for US intelligence. It's not a matter of serving a subpoena. They have an interface that they have developed for US intelligence to use.

Now, is it the case that Facebook is actually run by US intelligence? No, it's not like that. It's simply that US intelligence is able to bring to bear legal and political pressure on them. And it's costly for them to hand out records one by one, so they have automated the process. Everyone should understand that when they add their friends to Facebook, they are doing free work for United States intelligence agencies in building this database for them." (emphasis mine -- Sitaram).

unbelievable (operation pumpkin; prince william's wedding)

2011-05-03T09:59:00.001+05:30

http://www.theregister.co.uk/2011/04/28/operation_pumpkin/

no words can summarise this. I'm wondering if this is a joke...

I want!!!

2011-04-11T17:21:00.001+05:30

http://www.commodoreusa.net/CUSA_C64.aspx

very very cool! I would *love* to have a computer like this...

Michael Geist: piracy is a market failure, not a legal failure

2011-04-06T16:04:00.001+05:30

http://www.thestar.com/business/article/956637--geist-canadian-backed-report-says-music-movie-and-software-piracy-is-a-market-failure-not-a-legal-one

nice article...

with friends like these, who needs enemies? [Gates and Allen]

2011-04-01T08:46:00.001+05:30

http://www.computerworlduk.com/news/it-business/3267807/bill-gates-tried-to-rip-me-off-claims-microsoft-co-founder-allen/

Interesting article. The title is "Bill Gates tried to rip me off",
which sounds, to people who are taken in by Gates' so-called charity
work and his persona, like it might be a severe case of journalistic
license.

However, to people who long ago realised that he's probably the most
unethical, even borderline criminal (white collar only, so far as the
public knows) individual they've ever heard of, the following quotes
from the article will not come as a surprise:

- "scheming to rip me off"
- "I'd been taught that a deal was a deal and your word was your
bond. Bill was more flexible; he felt free to renegotiate agreements
until they were signed and sealed."
- overheard Gates and Ballmer complaining about his declining
contribution to the company during his cancer treatment in 1982
- "...It was mercenary opportunism, plain and simple."

CS and the real world (seen on slash)

2011-03-31T17:36:00.001+05:30

quote from http://developers.slashdot.org/comments.pl?sid=2054932&cid=35621288 :

"This is a CS program we are talking about. Much like economics, in these disciplines the real world is often considered a special case."

of winks and nooks...

2011-03-26T11:29:00.001+05:30

So I finally got myself an ebook reader. I'd been thinking about it for a while, but when my brother got a "wink" reader, I jumped. In short order, I'd asked my other brother (currently temporarily in the land of the un-free) to get me a Barnes and Noble Nook.

My only reason was that it has a real browser. Turns out the browser is more than somewhat crippled -- it can't even manage the redirection from chamarty.net to sitaramc.blogspot.com!

Getting stuff onto the device

It won't let you download anything using the browser either -- the only way to get PDFs and EPUBs on the box is either from B&N or via USB.

The wink, on the other hand, doesn't have a browser, for all practical purposes anyway. What it does have is an email client, which -- surprise -- lets you download stuff to the device. So you have two ways to get stuff onto the device, which is nice.

Deleting stuff you already read

The Nook will let you delete content from the device's interface. The wink won't; you have to do it from a host computer via USB.

Reading oddball stuff

The biggest thing the wink has is that the reader software is much better than on the Nook (gasp!) Firstly, it actually supports rotated reading for wide text if you want to do that, which is quite useful for some comics and cartoons. Secondly, it does not force everything into "reflow" mode. Of course, zooming while not in reflow mode makes a document wider than the screen and you have to pan left to right for every sentence, but at least it allows you to do that (this is important for figures in PDFs, for instance).

The Nook forces reflow on everything so it is crap at PDFs with bulleted lists, indents, tables, and such.

Hardware

Now that i realise the browser isn't that great, about the only thing the Nook has going for it is the hardware quality. It feels a little better built, and the buttons (there are only 4 by the way) have an "embedded" feel to them. The wink's keyboard is bad -- sometimes you have to hit twice for a button to register, and sometimes you hit once and it registers twice. (I guess a statistician would say that on the average the keyboard works fine then!)

I didn't get much of a chance to compare battery life but I suspect the Nook is crap. I'm getting far, far, less than what the ads and even reviews led me to believe. I'll have to wait till my usage stabilises somewhat, because the color LCD at the bottom is definitely a huge drain!

Security

Oh yeah -- the other reason I like the nook is it actually has a device password. There may be ways to get around it, but at least it'll keep out casual snooping...

Summary

Nook: if you absolutely need a password protected device. And/or you absolutely need a browser, even if it can't do most sites.
Wink: if you want to be able to receive content via email while on the road without your own laptop. And/or you want a better reader software in general (subjective opinion)

Indian English strikes again

2011-03-21T20:27:00.001+05:30

Just saw a very detailed account of a wedding. There was lavish
description of dress, decorations, and food, and the narration of the
ceremony included this:

"And the chanting of Mantras became louder, the sound of Shennai [sic]
became shriller and on dot [sic] at [elided] each of them placed the
Jeela Karra Bellam on the other's heads and the marriage was
consummated."

I want to say to him: I do not think it means what you think it means.

Would have been *totally* appropriate too, since he also said the
bride looked like a princess ;-)

pointy-clicky on gitolite

2011-02-25T17:52:00.000+05:30

someone was looking for a gitolite equivalent "with an interface". I first told him gitolite has a great interface; it's called "vim".

Then someone else said "but it's not pointy-clicky".

I told the original guy maybe he should use an ipad ;-)

I can just imagine vi on an ipad. Definition of hell I suppose (and yes, I know for most people the hell is the vi; for me it's the ipad!)

Oh Em Geeeee!

2011-02-21T09:56:00.002+05:30

For a long while now, I've been ranting at kids (and many adults, sadly) who type "u" for "you", "gr8" for "great", "dat" for "that" (I mean really, how much did you save there?), and so on. I sometimes ask them: does your computer come with just a phone keypad? (And some of them even understand the joke!)

But a few days ago I saw this pathetic display of illiteracy move to a new dimension.

I heard a barely-teen kid say O-M-G in speech. I mean "Oh", "Em", "Geee" -- spoken out as 3 individual letters.

To all the people who lament the demise of Hindi, Telugu, and other mother languages, may I suggest that death by disuse is more dignified than this death by misuse?

lid starts closing on Nokia coffin

2011-02-18T15:50:00.001+05:30

When people like Miguel Icaza start praising the deal, you know it's time to say goodbye to one of your favourite (till last week) companies.

http://www.networkworld.com/community/node/71380

Apparently he said "the Microsoft/Nokia partnership will save Nokia and increase the relevance of Microsoft's fledgling mobile operating system."

He didn't say "saved from whom" but I presume he means Apple and Android.

Personally, I was very much looking forward to MeeGo, which was looking to be a much more full featured Linux than Android (for hackers who hate Java, Android is just an appliance).

Oh well... I guess I'll stick to my plain (not even a camera or bluetooth) cell phone, and use a laptop/netbook if I really need something smarter.

starting to become mainstream!

2011-02-18T14:47:00.000+05:30

http://www.developer.com/open/10-git-version-control-utilities-to-make-you-more-effective.html

look at item #4 :)

cynicism...

2011-02-10T09:55:00.001+05:30

There was a fire at Bombay House last night which claimed 3 lives.

Very sad.

But here's what's even more sad: someone apparently asked "I wonder if there were any records lost in the fire".

I don't think what was implied is actually true. The sad part is that before Radia no one would even have *thought* of that when it comes to the Tatas.

Of course, with Reliance, this will never happen. They don't even keep records I am sure ;-)

cvs, svn, and git -- a tangential revisit

2010-12-08T10:21:00.001+05:30

http://lwn.net/Articles/414051/

A long-ish article about a talk that Michael Meeks gave about Libre Office, in which you find this gem (the emphasis is mine, not in the original):

OpenOffice.org has a somewhat checkered history when it comes to revision control. CVS was used for some years, resulting in a fair amount of pain; simply tagging a release would take about two hours to run. Still, they lived with CVS for some time until OpenOffice.org launched into a study to determine which alternative revision control system would be best to move to. The study came back recommending Git, but that wasn't what the managers wanted to hear, so they moved to Subversion instead - losing most of the project's history in the process. Later, a move to Mercurial was done, losing history again. The result is a code base littered with commented-out code; nobody ever felt confident actually deleting anything because they never knew if they would be able to get it back. Many code changes are essentially changelogged within the code itself as well. Now LibreOffice is using Git and a determined effort is being made to clean that stuff up.

This brings me back to my major beef with most "corporate" IT (even if the end product is open source): the people who have the knowledge don't have the power, and the people who have the power don't have the knowledge and won't listen.

the insecurity of religious people

2010-11-22T23:25:00.004+05:30

Well, yesterday I attended my first ever Christian wedding. I guess it wasn't a true Christian wedding; the bride (Indian) and groom (Canadian, or Quebecois, as he would remind me) were members of a church called "the international church of christ".

Anyway, I took an instant dislike to the person who was officiating in the wedding. He talked patronisingly of India traditionally having many barriers against inter-caste, inter-language, and inter-state weddings, etc., and patted himself and his church on the back that this wedding was therefore unique or at least very special.

Of course, he conveniently left out "inter-religion". Probably because his church expressly prohibits it ;-)

Anyway, I'd say http://carm.org/what-international-church-christ (esp the last 2 paras) is more accurate than Wikipedia's wimpy "it is difficult to make any generalizations about the organization collectively". Google around for more if you're curious. Add the word "banned" to see even more interesting results.

----

Which brings me to my subject line. Why do most ultra-religious people feel the need to convince *you* of it? Or at least to praise it/themselves? Are they trying to justify their choice, maybe? Convince themselves, more than you?

I'm not against religion. I'm against the public display of religion. With few exceptions, my experience has been that people who feel compelled to *show* their religious affiliations overtly are, to put it delicately, very "imperfect".

There are two very good reasons I'm putting it "delicately" :-)

And oh... "against the public display of religion" also means "I won't tell you whether I believe in God or not" :-)

switching from Mandriva to Fedora

2010-11-22T22:07:00.003+05:30

Well... all good things must come to an end, and so -- very regretfully, I should add -- I parted ways with Mandriva. I'd been a Mandrake user since '99 or so, and a die hard fan and evangelist since not long after.

Today I switched my work(horse) desktop from MDV to Fedora. The upgrade went amazingly smoothly, partly because ever since I started using git, almost everything I have except "documents" is in git; all I really did was restore my repos, my mail, and a "workdata" directory that contained all the ODT/ODP/ODS junk. A few commands here and there and it's all set. Pidgin, FF, TB, all setup exactly as they were before.

So.... why?

Well, it's not just that Fedora is using gitolite, it's also that Linux itself has come far enough in the usability department (much more thanks to Fedora than people realise due to Ubuntu's machinations of the press) that a "developer's" distro can probably be used by the neophyte now.

My focus has always been to help completely non-techie users switch to Linux, and Mandriva was just perfect. For a looooong time. But some issues linger...

(1) Every time I install MDV, I have to go to urpmi.zarb.org and setup the repos for plf to get libdvdcss and other goodies. With Fedora and livecd-creator, I just create a custom spin that already contains all of that and I carry that around. Done.

(2) MDV's repos for India suck. Actually, I take that back -- something that doesn't exist can't suck :-) And I hate the bloody Chinese mirror that MDV always ends up picking from geolocation.

[And I'd hate it even if the Chinese weren't trying to hack everyone on the planet. Fedora people: please give us a choice to exclude certain locations if we wish to. Or make gpg-signature checking mandatory if the packages are coming from certain locations. (And yes, I know "locations" is hard to pin down easily)]

(3) Curiously, 2 of my "non-technical" users have the Tata Photon or equivalent USB modem. And MDV's network control center just does *not* like that card. wvdial works fine, so it wouldn't be so bad if MDV supplied wvdial on the liveCD, but they don't. Catch-22, in the worst case.

stay off my master branch, off-shore dude!

2010-11-22T06:21:00.001+05:30

someone on #git posted a link to a neat little website with a bunch of
git tips. One of them was
http://ryanflorence.com/git-hosting-solutions/ , which uses the phrase
"stay off my master branch, off-shore dude!" as an example of
gitolite's main feature (per branch permissions).

I'm sure he didn't know that gitolite is *written* by an "offshore dude" ;-)

with all due respect ;-)

2010-11-17T18:51:00.005+05:30

http://www.thevarguy.com/2010/11/15/tensions-between-ubuntu-fedora-mount-over-new-website/

what's with this fad of putting "open" in front of everything to do with the FOSS world? Openssl, openssh -- fine. Openoffice I can understand.

Openrespect? Is there also closed respect somewhere then?

And whatever the hell it means, I find the concept totally hilarious, and I can't see *any* possible use for such a fruitless exercise. It almost sounds like a Government project of some kind -- like Tom Lehrer's "National Brotherhood Week".

Anyway, for the record, I've been increasingly getting pissed off by Mark Shuttleworth and his gang. Installing mono by default is a big no-no for me. That's almost black-list worthy in itself -- wilfully enabling Microsoft's future lawsuits. [And if you have kept up with news in the FOSS world in general for the past few years and still believe MS will not -- ever -- sue the open source community, or a major player, over Mono, well... I *respect*fully call you a moron. A blind, deaf, and illiterate moron, actually. I think that was respectful enough ;-)]

And then there is their copyright policy for contributions -- horrible; it's like MySQL all over again...

So... with great *respect*, Mark: let me say you're a freeloader off of other FOSS projects. Or, in Hindi (English cannot convey respect the way Indian languages can): Mark-ji, aap chor hain. Choron key badshah hain. Aapki chori ki jitni taareef ke jaye, utni kam hai!

Let me break the respectful words down to explain. A "-ji" suffix is loosely like "-san" in Japanese, for those who know that. It denotes respect -- taking the name without a "-ji" attached (or equivalent in other languages) is... not disrespectful, but a sign of familiarity. The "aap" is the respectful version of "tum", which is "you". All Indian languages have respectful variants of the second and third person pronouns.

Chor is thief. Hain means "are", but again, the respectful variety. Without respect, that sentence would be "tum chor ho".

Choron key badshah is "king of thieves". The next sentence basically says "however much praise I heap on your thievery, it falls short" or something like that.

Phew... I think that's enough respect for one day.

best rant against C++ I've ever seen

2010-11-16T10:01:00.002+05:30

http://developers.slashdot.org/comments.pl?sid=1865828&cid=34209842

I don't even know enough to summarise!

[edited to add a link to an excellent rant by Linus on C++ :-)

(job) security

2010-11-10T22:56:00.001+05:30

context: some features of gitolite, and in this case of git itself -- the fact that in git, every developer has the entire repo on his machine.

<someone> wrote:

> In fact, our security team worries about having the full
> development history on "everyone's machine".

At least in a corp. env., I think this is somewhat specious. Even if you were using SVN or similar, it is trivial for a dev to just collect daily snapshots anyway. Actually, in terms of IP, even one snapshot has all of it, if it's the latest (it's rare that only old versions have IP and new ones don't).

----

That's what I replied to him. But if I could, I would add this to my response above:

I've always maintained that most "security" is about the job security of the person responsible for security :-) Security people are a lukcy lot, by and large. They get to make a lot of noise, cry wolf far more than 3 times and get budget, so when nothing happens, they get an attaboy for "doing so much to protect us".

And if something happens, ironically enough, the fact that they cried wolf so many times and spent so much money works in their favour -- the logic being "he did far more than you could have expected him to do, and if something happened even after all that, who can blame him?".

The secret to this brilliant escape from the consequences of attacking the wrong problem (forcing passengers to take off their shoes *after* Richard Reid, for instance!) is that no one else actually feels he is qualified to do the job properly anyway. Everyone is too busy thinking "<phew> there but for the grace of God go I" and so they cut him a lot of slack!

consultant-speak for "crap"

2010-10-30T16:18:00.001+05:30

'This model is showing signs of extreme organic growth,' I said, which
is consultant-speak for 'This model is a heap of @#$%! '

:-)

from http://blogs.computerworld.com/17138/oh_right?source=rss_sharkey

The Economist on the fallibility of biometrics

2010-10-17T04:06:00.001+05:30

http://www.economist.com/blogs/babbage/2010/10/biometrics -- fairly short article, but packed with good stuff. Anyone who has any interest in this field should read it.

Specifically, people involved in the UID project in India should read this. Yes, this article is aimed at more at terrorism prevention than mass-scale UID, but many of the points mentioned still apply. And if you take the problems described in that article, and add in collusion by the operator, which is very, *VERY* likely in India UID, you have the potential for massive fraud and systematic abuse by whoever is in power.

Some quotes:

- But in its rush to judgment, the FBI did more than anything, before or since, to discredit the use of fingerprints as a reliable means of identification.

- What the Mayfield case teaches about biometrics in general is that, no matter how accurate the technology used for screening, it is only as good as the system of administrative procedures in which it is embedded.

- The panel of scientists, engineers and legal experts who carried out the study concludes that biometric recognition is not only "inherently fallible", but also in dire need of some fundamental research on the biological underpinnings of human distinctiveness.

- The body of case law on the use of biometric technology is growing, with some recent cases asking serious questions about the admissibility of biometric evidence in court.

someone bites back at HTC

2010-10-16T21:41:00.001+05:30

kudos to Matt, author of Hg for this: http://lwn.net/Articles/409864/

full text (it's small enough anyway):

On Wed, 2010-10-13 at 11:32 +0800, martin_liu@htc.com wrote:
> Dear Matt:
>
> Recently, I got an oops at pagemap_read(). I've tried to
> searched some patches and found a patch as below link.
> http://kerneltrap.org/mailarchive/git-commits-head/2010/4...

Dear Martin,

Are you from the same HTC mentioned here?

http://www.freedom-to-tinker.com/blog/sjs/htc-willfully-violates-gpl-t-mobiles-new-g2-android-phone

If so, please ask again in 90-120 days. Until then, you're on your own.

HTC in my personal bl again

2010-10-16T15:01:00.001+05:30

IIRC the first time is for entering into a patent deal with MS.

Now it's for this:

HTC Willfully Violates the GPL in T-Mobile's New G2 Android Phone
(Freedom to Tinker) -- http://lwn.net/Articles/409548/

it's not rocket science!

2010-10-08T17:07:00.001+05:30

http://www.f-secure.com/weblog/archives/00002040.html

Very crisp. I didn't know it propagated through USB sticks -- those bozos deserve it if it did.

And screw you, ISRO, if India's INSAT 4B died due to stuxnet -- you guys deserve more like this before you'll come to your senses and stop using Windows.

Honestly, is Linux that hard that ROCKET SCIENTISTS can't use it?

----

Meanwhile, some funny stuff from the first link, since I like their sense of humour so much:

----

Q: Which factory is it looking for?
A: We don't know.

Q: Has it found the factory it's looking for?
A: We don't know.

----

Q: What's the relation between Realtek and Jmicron?
A: Nothing. But these companies have their HQs in the same office park in Taiwan. Which is weird.

----

Q: When did Stuxnet start spreading?
A: In June 2009, or maybe even earlier. One of the components has a compile date in January 2009.

Q: When was it discovered?
A: A year later, in June 2010.

Q: How is that possible?
A: Good question.

Q: Was Stuxnet written by a government?
A: That's what it would look like, yes.

Q: How could governments get something so complex right?
A: Trick question. Nice. Next question.

Q: Was it Israel?
A: We don't know.

Q: Was it Egypt? Saudi Arabia? USA?
A: We don't know.

Q: Was the target Iran?
A: We don't know.

----

Q: What happened on 9th of May, 1979?
A: Maybe it's the birthday of the author? Then again, on that date a Jewish-Iranian businessman called Habib Elghanian was executed in Iran. He was accused to be spying for Israel.

Q: Oh.
A: Yeah.

----

Gosling: Oracle is ethically challenged, micro-managed, and creepy

2010-10-08T06:59:00.001+05:30

Why I Quit "Creepy" Oracle: The Father Of Java James Gosling Speaks
Out -- http://www.eweekeurope.co.uk/interview/why-i-quit-oracle-the-father-of-java-james-gosling-speaks-out-9995/print

Quite a few hard hitting comments on the new villain for the open
source crowd (as if we needed another!).

Well at least he did it after leaving, unlike my old boss, who ranted
against his (then) employer (and my current employer) to a reporter
even *before* he had left -- talk about ethically challenged!

But while it's perfectly fine to talk about Oracle being "ethically
challenged" and "micro-managed", it just doesn't seem proper for a
senior person to talk about salary etc., or to say that the CEO "gives
me the creeps" to the press.

A friend of mine who reads a lot more than I do mentioned that this
was in line with any of Gosling's past writings that he had read --
nothing to learn, nothing to take away -- unlike people like Larry
Wall or Guido van Rossum, where you almost always learn something new
or get a new perspective on something old, etc. (We're talking about
"learn" in the academic sense here, not "I learned that Ellison is a
creep, so isn't that learning?")

And finally, I have to say this. I'm not a big fan of Gosling anyway.
I hate Java -- I call it the "COBOL of the internet", and I think it
has done a lot to remove any fun that programming could have had for
lots and lots of people, and made it a bloody chore. Comments like
this would have had a lot more weight for me if they had come from
Larry or Guido, but they're not the kind to stoop to this, I suspect,
even if they were in that situation.

And even if he felt compelled to, I bet Larry would say it with a heck
of a lot more humour and panache :-)

hacking embedded systems

2010-09-30T11:07:00.001+05:30

http://lwn.net/Articles/407459/

One of the scariest articles I have seen recently.

The linked PDF is nice too, but the article about it just flows better.

found on a random list of funnies somewhere...

2010-09-28T12:20:00.001+05:30

"I think part of a best friend's job should be to immediately clear your computer history if you die"

Awesome!

bikeshedding the twittube!

2010-09-24T15:08:00.001+05:30

http://lwn.net/Articles/405810/

Lovely humour from a lady I'm starting to admire as much as JR (that's Joanna Rutkowska, not the zero-EQ JKR of Harry Potter fame).

There's no need to click the link unless you're a file systems maven though... the funny parts are right here:

----- quote -----

This series is the core mount and lookup infrastructure from union mounts, split up into small, easily digestible, bikeshed-friendly pieces. All of the (non-documentation, non-whitespace) patches in this series are less than 140 lines long. It's like Twitter for kernel patches.

VFS developers should be able to review each of these patches in 3 minutes or less. If it takes you longer, email me and I'll post a video on YouTube making fun of you.

Fwd: Consumerization and Corporate IT Security

2010-09-14T16:21:00.001+05:30

I can't recall when was the last time Bruce Schneier said something I did not quite agree with. The last paragraph could have at least hedged a little, instead of making it sound so unequivocal. Oh well...

-------- Original Message --------

Consumerization and Corporate IT Security

via Schneier on Security by schneier on 9/7/10

If you're a typical wired American, you've got a bunch of tech tools you like and a bunch more you covet. You have a cell phone that can easily text. You've got a laptop configured just the way you want it. Maybe you have a Kindle for reading, or an iPad. And when the next new thing comes along, some of you will line up on the first day it's available.

So why can't work keep up? Why are you forced to use an unfamiliar, and sometimes outdated, operating system? Why do you need a second laptop, maybe an older and clunkier one? Why do you need a second cell phone with a new interface, or a BlackBerry, when your phone already does e-mail? Or a second BlackBerry tied to corporate e-mail? Why can't you use the cool stuff you already have?

More and more companies are letting you. They're giving you an allowance and allowing you to buy whatever laptop you want, and to connect into the corporate network with whatever device you choose. They're allowing you to use whatever cell phone you have, whatever portable e-mail device you have, whatever you personally need to get your job done. And the security office is freaking.

You can't blame them, really. Security is hard enough when you have control of the hardware, operating system and software. Lose control of any of those things, and the difficulty goes through the roof. How do you ensure that the employee devices are secure, and have up-to-date security patches? How do you control what goes on them? How do you deal with the tech support issues when they fail? How do you even begin to manage this logistical nightmare? Better to dig your heels in and say "no."

But security is on the losing end of this argument, and the sooner it realizes that, the better.

The meta-trend here is consumerization: cool technologies show up for the consumer market before they're available to the business market. Every corporation is under pressure from its employees to allow them to use these new technologies at work, and that pressure is only getting stronger. Younger employees simply aren't going to stand for using last year's stuff, and they're not going to carry around a second laptop. They're either going to figure out ways around the corporate security rules, or they're going to take another job with a more trendy company. Either way, senior management is going to tell security to get out of the way. It might even be the CEO, who wants to get to the company's databases from his brand new iPad, driving the change. Either way, it's going to be harder and harder to say no.

At the same time, cloud computing makes this easier. More and more, employee computing devices are nothing more than dumb terminals with a browser interface. When corporate e-mail is all webmail, corporate documents are all on GoogleDocs, and when all the specialized applications have a web interface, it's easier to allow employees to use any up-to-date browser. It's what companies are already doing with their partners, suppliers, and customers.

Also on the plus side, technology companies have woken up to this trend and -- from Microsoft and Cisco on down to the startups -- are trying to offer security solutions. Like everything else, it's a mixed bag: some of them will work and some of them won't, most of them will need careful configuration to work well, and few of them will get it right. The result is that we'll muddle through, as usual.

Security is always a tradeoff, and security decisions are often made for non-security reasons. In this case, the right decision is to sacrifice security for convenience and flexibility. Corporations want their employees to be able to work from anywhere, and they're going to have loosened control over the tools they allow in order to get it.

This essay first appeared as the second half of a point/counterpoint with Marcus Ranum in Information Security Magazine. You can read Marcus's half here.

the effect of snake oil security

2010-09-14T09:50:00.001+05:30

http://threatpost.com/en_us/blogs/effect-snake-oil-security-090710

it's just a coincidence that the author's nickname is "rsnake" :-)

he makes a valid point, but as the comments show, not everyone agrees. The most useful comment is the one that says "aah but this will apply equally to non-snake oil remedies" or some such... worth thinking about

apple bashing...

2010-09-13T20:49:00.001+05:30

...is always fun. Even more so when it happens on otherwise staid and
sedate sites like LWN:

http://lwn.net/Articles/404259/

----

Broadcom releases an open-source driver for its wireless chipsets
Posted Sep 9, 2010 16:09 UTC (Thu) by djcapelis (subscriber, #53964)
Parent article: Broadcom releases an open-source driver for its
wireless chipsets

Oh my!

This is an amazing development. One of the last problems with a
macbook I was having was a broadcom chip.

Posted Sep 9, 2010 16:39 UTC (Thu) by lkundrak (subscriber, #43452) [Link]
The last one is being a macbook I presume ;)

Hg easy to use?

2010-09-01T09:50:00.001+05:30

http://groups.google.com/group/vim_dev/msg/7e494fa0fe6cc732

If Bram, author of vim, cannot do some simple version cutovers in Hg, is it really that easy to use?

The other thread at http://groups.google.com/group/vim_dev/browse_thread/thread/1ce709f61e5424e5/f70ea0132796c96a?hide_quotes=no#msg_f70ea0132796c96a is even more illustrative (and, as a friend on #git said, too fatiguing to read).

Branching it seems is still a mess in Hg...

fixups on an existing commit using tig and the new autosquash option on rebase

2010-08-30T16:42:00.002+05:30

This shows how to use tig and the new option in rebase to do fixups very quickly.

What you need first is this line in your ~/.gitconfig:

# fixup, from http://permalink.gmane.org/gmane.comp.version-control.git/154460
fixup = "!f() { git commit -m\"fixup! $(git log -1 --pretty=%s $1)\"; }; f"

and these lines in your ~/.tigrc:

bind main = !git fixup %(commit)
bind main R !git rebase --autosquash -i %(commit)
bind generic s view-status

We need to make a quick change in conf/example.gitolite.rc. We first make the
change, then start tig

type 's' for status view, then cursor down to the file that you just changed

type 'u' to stage that file

type 'q' to quit status view and go back to main view; cursor down to the
commit you want to "fixup"

hit enter to make sure it is the right one; it is... the filelist confirms it

hit 'q' to get rid of the commit details, then '=' to invoke the "git fixup"

Notice the commit message?

hit enter to get past that commit confirmation message, then arrow down 1 line

hit "R" to rebase with respect to the selected commit

save and exit the editor

hit enter to see the new commits

long time Mandriva user tries Fedora

2010-08-10T12:15:00.001+05:30

I have switched my laptop over to Fedora 13 LXDE to check things out properly in normal use; here are my findings so far. (Remember I have > 10 years of history as a Mandriva user!)

Plus points

recognises the Tata Photon+ CDMA data stick out of the box. The GUI is identical, except for color, to the one in Linux Mint; now why can't Mandriva also use that same software, whatever it is? In Mandriva, you have to use wvdial (which means you have to install it first!). The normal drakconf-spawned config screen asks you for a "PIN number" (huh?) and regardless of what you type or not, it responds saying "have you inserted your SIM card" or some such message I can't recall.

the ability to create a custom live CD with everything I want on it. Thanks to my friend Raj, I now have a nice live CD (actually USB stick) that contains more than 200 packages of my choice. This means I truly don't have to take my laptop around to many places, while still getting a LOT of work done.

having a sane set of package repos automatically configured even if you live in India! Mandriva would always select some mirror in China that, consistently across the last 2-3 releases of Mandriva, has been dead or unresponsive or overloaded any time I try it. I'd gotten to the point that I'd pretend to be in some US time zone, then change it to India after the install is all done. Or go to easyurpmi.zarb.org and do a manual mirror selection.

Minus points

missing or outdated packages. (For example, "recoll" -- if I ever have to switch my work desktop this would be a show stopper! And "atop" is unmaintained. And unison is apparently deprecated... in favour of what, I wonder?)

However, the saving grace is that the Fedora ecosystem is just too big for anyone to ignore, so either the upstream themselves will have an RPM available (as in the case of recoll and atop), or someone else (like Dag) might, or -- worst case -- my PFE (personal Fedora expert/evangelist, a person who shall remain nameless in his own interest, lest he be swamped by others' requests for help!) will find me a link from somewhere!

keychain doesn't work. I had to add these 3 magic lines into my own .bash_profile because the one in /etc/profile.d didn't seem to work. I should probably dig deeper and report it if needed

keychain ~/.ssh/id_rsa . ~/.keychain/$HOSTNAME-sh . ~/.keychain/$HOSTNAME-sh-gpg

There is no way to have the screen lock before suspend/hibernate. This is not secure. I finally had to put "xscreensaver-command -lock; sleep 2" somewhere inside a file called "pm-action". There is just no other way as far as I know. From a non-techie user perspective this is horrible, horrible, horrible. (I realise this may be only the LXDE spin and perhaps the KDE or GNOME versions do it ok).

The touchpad doesn't let you click. You have to run gnome-mouse-properties and change the settings, which would be fine, but they don't persist across a logout/login. Each time you login you have to run that command again. (Weirdly enough, you don't have to touch the settings; they're all there. But the GUI has to come up once...)

Still, all in all it was a pleasant experience, especially because my friend Raj showed me how to make my own live image with whatever packages I want in it. In the end that might be a bigger point than all the rest :-)

making a multi-boot USB (and mandriva troubles)

2010-08-05T22:08:00.003+05:30

So today my young colleague Vignesh and I spent some time figuring out how to put more than one live CD onto a USB stick. Without using any external tools (except "unetbootin").

In brief:

make ext2/3 partitions for each live CD you want to install; make sure you add about 10-20% extra space (moving from iso9660 to ext2 seems to do that!)
run unetbootin for each live CD in turn, to its respective partition
on the first partition, edit extlinux.conf to remove any cruft, and then tack on to the end of it just the one or two relevant paragraphs from the same file of the other partitions (i.e., the other live CDs that you unetbootin-ed). Make the identifiers sequential (not sure it works if they repeat; by default they all start with 0)
make sure all the vmlinuz files and initrd files mentioned in these extract are all copied to the first partition. Watch for name duplication, extra components in the pathnames in the conf file paras that you didn't create (you just dumped 'em all into the first partition's top level directory!) etc., and change the conf lines to fit the filenames
make one final "extlinux -i /dev/first-partition"
make sure this is the one marked "bootable" in fdisk

and you're done.

----

Unless one of the live CDs you want is Mandriva :-(

God what a pain. First of all, without initrd tweaking it cannot be "unetbootin"-ed. This is because the extlinux.conf entries don't come with UUID= options, so unless it's the first partition it won't get past that. Worse, the "linuxrc" file inside the initrd.gz hardcodes"-t iso9660". Come on.... why? The mount command should be able to figure out the partition type dammit!

What Vignesh finally did to make it work was

add a root=UUID= parameter to the "kernel" lines in the config (2 of them; one for live, one for install)
patch linuxrc to comment out all the stuff to do with labels and add this line in their place:
sh -c 'root=`grep -o "UUID=[a-zA-Z0-9\-]*" /proc/cmdline`; mount -o ro $root /live/media'

And that seemed to work for me too.

Once.

After that it never worked again (back to sqshfs errors). And after a couple more attempts I just gave up... Mandriva is not really worth it as a quick-check-your-email-on-a-borrowed-laptop live CD anyway so there's no point:

it's too slow (an *installed* Mandriva boots slower than mint or F13 running off a USB stick)
it doesn't support my Tata Photon+ USB thingie (what do they use, WiMax? not sure) out of the box -- you have to install wvdial, which it doesn't come with!
and most important, it's the only one that needs 5 clicks before it gets to the desktop. It's like they didn't intend to make it a real "live CD", but only as an installer

----

Looks like my MDV days may be numbered, and not just because I promised a friend of mine (who favours Fedora) that I'd switch to Fedora if they start using gitolite either. Sad... The future looks Fedora-ish blue for my machines and minty-green for the ones I manage for my non-tech f&f.

(gitolite) a non-techie explanation of "distributions"...

2010-07-30T20:49:00.001+05:30

(...and why a couple of recent announcements have me sporting a 70-mm smile these days!)

When you install Windows, you're used to doing this:

install Windows from one CD
install drivers for all your hardware, one from each CD
install MS-Office from another CD
install CD-burning software from yet another CD
install PowerDVD or some other DVD player (maybe you don't like Windows Media Player or maybe someone told you WMP reports to MS on all movies you watch!)
install Yahoo messenger or Gmail chat or Skype from the websites

When people install Linux, (especially if it's from a DVD) most of these things come with it. And most of them have more than one choice:

various web browsers (Firefox, Konqueror, Epiphany, ...)
word processors (OpenOffice, KOffice, AbiWord, ...)
chat clients (pidgin, empathy, ... -- by the way you can use one chat client for both Yahoo and Gmail chat!)
music and video players (mplayer, xine, vlc, ...)
common tools like cd-writers (k3b, xcdroast, gnome-burner, ...)
not to mention games (I like tuxracer, my wife and mom love kshisen, my kids and nephews/nieces like tuxkart or something. And for Solitaire fans, the "kpat" game contains 12 variations of Solitaire, and if that's not enough, "pysol" contains 50 or so!)

Great. So who writes all this stuff?

If you guessed "Linus Torvalds", you'd be wrong. Of course, he created Linux, but he's only interested in the core of the operating system itself (called the "kernel"). Which is great because he's damn good at it, and really, if that doesn't work well, none of the others will. When you hear people talk of Linux machines running for months together without a reboot, you can thank Linus and the hundreds of people all around the world that help him maintain the kernel.

So once again, who writes all the stuff you see, and how does it get to you?

Well there are people. Lots of them. Or, in some cases, there are organisations (like the Mozilla Foundation, which produces the Firefox browser and Thunderbird email client, etc.)

Just for fun, let's refer to all this software as upstream software and to their authors as upstream authors.

The problem is, each of them puts his software on their own website. And most of the time they only give source code -- you're expected to compile and install it yourself.

Now how would someone who just installed Linux for the first time be expected to:

know that he needs to do this
figure out what software he needs (for example, who would ever guess that the best "photoshop"-like program on Linux is called "gimp"? Or the best dvd/cd-writer software is called k3b?)
figure out where to go for each item on his list (what is the "upstream website"?)
be able to "compile" and "install" anything?

In fact, how would he solve the chicken-and-egg problem of not having the tools to build the tools?

What you want is to just pop in a CD, click Yes a few times, and have a brand new, working, Linux machine on your table.

That's where distributions come in. Red Hat is one such company (perhaps the most famous), Mandriva is another, and recently Canonical (who make Ubuntu) is also becoming well-known. There are many community-driven ones too, which are often better, depending on your special circumstances. [Why there are so many distributions is a whole another story, but the short answer is that "one size does not fit all". Some people want ease of use, some want raw power and a simple GUI, some want all sorts of whizz-bang, some want a rock solid system that they can use as a server and put it in a backroom, while some people want one that can fit within a 52-MB "business card CD" (see http://en.wikipedia.org/wiki/Bootable_business_card ) and so on and on...]

But whatever the size, scope,or goals, what a distribution does is:

take all the various pieces of software that a user might want
compile them all
put them all together in one CD
put a nice graphical "installer" tool to make things as painless as possible
take all the additional software they couldn't fit on the CD/DVD and put it on a series of websites/ftp servers
give you a nice graphical "package manager" to search for and grab stuff from those servers

All this is a lot of hard work. Plus they have to:

keep track of all the upstream software
when a new version of the upstream software comes out, they get it, compile it, make sure it works ok, etc.
make any simple fixes if needed
make sure it works well with all the other software they're putting on the same CD
keep track of bug reports submitted by their users, determine the cause of the bug, and either fix it themselves or send it to "upstream" so that the upstream knows and has a chance to fix it. (And once upstream fixes it, they have to bring those changes in, compile, test... the whole cycle repeats)

(In addition, they also have to look for security issues that get reported by the upstream author or by third parties, and if something comes up they have to do all this on an emergency basis).

[For those of you who know how the newspaper business works, I'd say this is not far from what goes into creating a newspaper or a weekly newsmagazine. Each section has its own editor, they have to get stories from their sources, write them up, edit them, put pictures on them, and send it to someone who will put all of them together]

Now Fedora is one of the more popular distributions. They have 10,000 repositories, and over 1000 "package maintainers". Each of these maintainers is constantly working on one or more of the activities listed above, and, as the deadline for a major release comes closer, things get hectic.

Fedora needs a central sever to manage all this hectic activity, one where each of these package maintainers can log onto, and be able to change only the packages they volunteered to maintain.

Which means that server needs what is called "access control" -- prevent one person from changing stuff belonging to another, really.

And so we come to what gitolite does: it provides access control to a server hosting several thousand source projects with several hundred developers. It wasn't originally designed for that -- I just wrote it for myself to use at work here. It just turned out to be good enough, (with lots of help from others, of course, since that is how open source works) for something as ambitious as this!

----

Hope that helped.

And finally, the announcements themselves:

http://lists.fedoraproject.org/pipermail/devel-announce/2010-July/000647.html -- fedora moves to gitolite as the access control layer for their git server (4th para is about gitolite)
http://www.omat.nl/2010/07/07/move-to-git-the-progress-so-far/ -- kde sysadmin reports on progress migrating to git. Note the first line in the gitolite para "Gitolite is the heart of our migration" :-)
http://permalink.gmane.org/gmane.comp.kde.scm-interest/1437 -- older, KDE email that describes their evaluation of various options and why decided gitolite should be a part of their future direction. Probably irrelevant now but useful if someone is looking for those comparisions

Fedora is one of the most popular distributions of Linux.

KDE is one of the 2 most popular/powerful "desktop environments" available for Linux. See http://en.wikipedia.org/wiki/Kde for more on this.

Absolutely. The. Funniest. CFP. Ever.

2010-07-22T12:42:00.001+05:30

http://lwn.net/Articles/396786/

CFP == call for papers, in case you're wondering, and this is a hacker conf in NZ called, (what else?) "Kiwicon"

(apple) 5 ways iPhone users get ripped off

2010-07-12T13:45:00.001+05:30

"Using an iPhone is like taking a holiday to some corrupt country: It may be beautiful and offer simple pleasures, but you're going to pay bribes to people who shamelessly charge you for what's free elsewhere. "

-- http://www.computerworld.com/s/article/9178836/5_ways_iPhone_users_get_ripped_off?source=CTWNLE_nlt_wktop10_2010-07-09

Fwd: [gitolite] Anybody knows a gitolite ready AMI

2010-07-06T10:24:00.001+05:30

is it a good sign if people are looking around for AMIs with your software already installed?

;-)

/me is tickled pink!

-------- Original Message --------

Subject:	[gitolite] Anybody knows a gitolite ready AMI
Date:	Mon, 5 Jul 2010 06:33:00 -0700 (PDT)
From:	[elided]
To:	gitolite <gitolite@googlegroups.com>

Anybody knows a gitolite ready AWS' AMI ?  Tks.

after a few days, the core starts stinking

2010-06-24T10:44:00.001+05:30

An old friend of mine asked me about buying an iPad. My first response to him was this:

---------- (1) ----------

iDon'tknow. iDon'tEvenCare. iHateApple. iThinkJobsStinks

;-)

jokes apart, I don't mind recommending apple to my technically challenged (but financially non-challenged) friends, but I would never use one. Ever.

I have several reasons.

The vaunted "intuitiveness" was lost on me during my first experience with an Apple in 1996, where I had to finally be told by someone that ejecting a floppy (yeah, those days!) required moving the floppy icon to the trashcan. How that is intuitive I have never understood.

My real reason is that I hate control freaks like Jobs, who will not let you do what you want with your machine, in general. That might be OK for a lot of people, but not for me.

I have, when in a facetious mood, said the following: "more money than brains? use Apple. more brains than money? use Linux. neither money nor brains? use (pirated) Windows". clearly applicable mainly in India (and China I guess).

There's a backhanded compliment to Apple in there, if you look hard enough ;-)

---------- (end 1) ----------

He responded with something about innovation and consumer products and marketing and so on. Here's my reply:

---------- (2) ----------

My whole point is that a computer (and even an iPad is one, perhaps even an iPhone, arguably) never was, and never will be, a consumer product like a DVD player or a stereo system. Those things have only one (or a few well-known-in-advance) functions, and no one expects a toaster to even become a microwave via software upgrade.

Looks don't matter to me, so now it's just an expensive piece of hardware you cannot customise or do what you want with. For the "sheeple" who just take what they've been given, that's fine. You know me better than that, but I also thought I knew *you* better than that :-)

The bottom line is that if you love the word freedom in *any* sense, you need to think about supporting this joker. Probably the best comment (though not the funniest) is at http://apple.slashdot.org/comments.pl?sid=963229&cid=24996553 -- which I quote in its entirety because it's short:

I was exclusively a Mac user from 1990 through 1997. >From 1997 through 2000 I was a three platform user. Windows for games, Mac for art and linux for servers. Steve Jobs' return to Apple crushed the core of the spirit that made me a loyal user. My computer is not a status symbol. It's not a lifestyle choice. It's not a part of my image. It's a tool. When Apple shifted back to the current "Image above all else" mode, I went to Win/Lin PCs. I don't have the time of the money to stroke Steve Jobs' ego.

Some more links are below. Two things I will ask: (1) don't let the tone of the first one fool you into ignoring the others; it was just too funny to let go, and (2) do follow the first level links within those links (one level only) also, even the ones that didn't turn into hyperlinks -- just copy-paste them into your browser. Some of the comments are really insightful, despite the language used.

http://sitaramc.blogspot.com/2010/03/erm-some-of-my-friends-shouldnt-read.html
http://sitaramc.blogspot.com/2010/03/they-should-however-see-this.html
http://sitaramc.blogspot.com/2008/09/apple-idiocy.html (the Adithya in the comments is a young, NON-techie, nephew of mine who has -- independently it seems, seen the light)

---------- (end 2) ----------

But the main point I forgot to address was this. He said, "The business user is not really interested in the gory details of coding".

The correct response is "sure, but shouldn't he care that if his son, or his friend, or his IT dept, can code it up for him, he still cannot use it unless Jobs allows him to?"

LinkedIn going the facebook way?

2010-06-06T20:35:00.001+05:30

I got a LinkedIn invite from someone whose name was vaguely familiar,
but did not really recognise. So I asked her "who are you and how do
you know me"?

Her reply:

> sorry sir we dont know each other....i think i have got u from my gmail
> where i usually forward my resume for jobs.

Is this how networks are built up now? Is Linkedin becoming like bloody
facebook?

Is this how some people have hundreds of contacts?

fake job acceptance letters

2010-06-03T14:58:00.001+05:30

I just heard of a spate of fake job acceptance letters being sent out in the name of TCS, as well as many other large and small IT companies in India. Typical phishing-type mails, all sorts of promises, bad spelling and grammar, and a "fee" for the "process" (not exact words; but then do the exact words matter?)

I spoke to a few guys here and there, turns out it's happening to many companies, and quite a few people are getting duped, then filing police complaints.

A friend and I were talking, and he says: "I can understand if a blue-collar worker gets duped looking for a job in Dubai. But these guys are supposed to have bachelors or masters degrees, often in some branch of Engineering or Science!"

I agree. My question to anyone who got duped by these guys is: were you *so* desperate for a job that you stopped thinking?

an agnostic's delight

2010-06-03T05:12:00.000+05:30

http://www.fullmoon.nu/articles/art.php?id=tal

read the whole thing, but the following was really nice:

Seriously though, species who hold on to religion past its sell-by date tend to be most likely to self destruct. They spend so much energy arguing about my true nature, and invest so much emotion in their wildly erroneous imagery that they end up killing each other over differences in definitions of something they clearly haven't got a clue about. Ludicrous behaviour, but it does weed out the weaklings.

And even though he speaks of "killing each other", I'm not just thinking about the terrorists here. You'll find such people, albeit with far less damage potential, much closer to home than you think. In your family. At work. They're bloody everywhere. All religions seem to be subject to such stupidity, although only a few carry it to extremes.

The next couple of paras after this are very funny, though I can't help feeling the author either caved in to the PC brigade or got scared of a fatwa ;-)

All in all, a very fun read...

a couple of funny ones...

2010-06-01T10:17:00.001+05:30

First, on facebook:

Amy Schumer: Facebook Is Weird

via Comedy Central's Jokes.com: Joke of the Day by Comedy Central on 4/2/10

Now every idiot from high school's like, 'I'm back!' We weren't supposed to meet again. Stop poking me and inviting me to your weird vampire parties. No, I don't want to follow you on Twatter. Like, nobody's interested in you. I don't want to see you in real life, why would I want to follow you in the imaginary one?

--------------------

Next, on MTV (and book stores these days!)

Daniel Tosh: Not Music Television

via Comedy Central's Jokes.com: Joke of the Day by Comedy Central on 10/29/08

The worst television is MTV. 'Music Television' -- they call it that, they don't even play music. How's that legal? What if everybody did that? 'Hey, thanks for calling New York Pizza.' 'Yeah, give me two large pepperoni pizzas.' 'Oh, we don't sell pizza.' 'What?' 'No, we just have raccoon hats and eye patches. Call a book store if you're hungry.'

why should anyone trust this bstrd now?

2010-05-30T13:47:00.003+05:30

http://www.theregister.co.uk/2010/05/24/zuckerberg_privacy_mea_culpa/

Apparently facebook CEO Mark Zuckerberg is promising to improve fb's privacy record.

I don't see why anyone should trust him anymore. I've seen and read enough about his opinions on his users' privacy to NEVER trust him.

Here's a sample, from that article (and this was something I had not known till now, by the way, so it just makes things worse): "Recently unearthed IM transcripts from the early days of Facebook showing Zuckerberg describing early adopters at Harvard "dumb fucks" for trusting him with their data have hardly helped Facebook's cause."

wow... calling your users "dumb fucks". Even Microsoft and Apple can't beat that; they at least don't come right out and *say* so ;-)

----

The article itself, and the comments on that article are all equally sceptical. In particular, take a look at http://forums.theregister.co.uk/post/771675 followed by http://forums.theregister.co.uk/post/771757 -- at the same time Zuckerberg was making these statements, people were being forced to either delete their "interests" data or make it public.

Re: Take a look at my photos on Facebook

2010-05-05T08:42:00.001+05:30

someone sent me an invitation from facebook, with about 15 names and pictures (of which I recognised four). This was my reply, and now that this post has been made I intend to just reply with this link from now on :-)

--------------------

sorry, do I know you?

even if I do, please don't send me this stuff.

I predict facebook (and others like it) will be the single biggest problem in individual security over the next couple of years. I think it will surpass all the so-called phishing and pharming attacks in impact, because unlike them, facebook attacks can move beyond e-security into physical and personal security.

sitaram

on 04/05/10 22:38 <deleted> wrote:

<deleted invitation text/pictures>

(funny) VBA

2010-05-03T16:40:00.002+05:30

"It was at this point that Jason decided Skynet wasn't a rogue military AI, but a mail merge macro trying to recover from a badly formatted postal code"

-- http://thedailywtf.com/Articles/Poke-a-Dot.aspx

or this:

"You see, the dots weren't dots. The original author wanted a place to store some variables, and couldn't think of a better place than the body of the document, "hidden" in a 1pt font. And then, in the four places those variables were used, a 22-line version of "Selection.Find" was used to retrieve them."

a refreshingly frank article about cloud security...

2010-04-29T15:54:00.001+05:30

...focusing on the audit aspect.

http://itmanagement.earthweb.com/netsys/article.php/11075_3878811_2/How-Cloud-Computing-Security-Resembles-the-Financial-Meltdown.htm

The basic thrust is that cloud computing security claims rely on SAS70 type audits, which have an inherent conflict of interest of the kind that was at the heart of the recent financial meltdown. Jay Heiser, a Gartner analyst who specializes in security, [says] "I found more parallels between what happened in the financial services and cloud computing than I anticipated."

The second point, which is probably even more important in my personal opinion, is that SAS70 is an auditing standard for financial statements, and never had anything to do with IT in the first place. And the people who conduct them are, more often than not, accountants. The kind of questions I asked Raghavan when we were discussing the TQMS cloud setup are probably not even asked in a SAS 70 audit ;-)

We Have Met the Enemy and He Is PowerPoint

2010-04-29T09:50:00.001+05:30

a GREAT article in the NY Times. The best line goes to Gen. Stanley A. McChrystal. Referring to this slide, he said: "When we understand that slide, we'll have won the war".

More quotes:

"PowerPoint makes us stupid," Gen. James N. Mattis of the Marine Corps, the Joint Forces commander, said this month at a military conference in North Carolina. (He spoke without PowerPoint.) Brig. Gen. H. R. McMaster, who banned PowerPoint presentations when he led the successful effort to secure the northern Iraqi city of Tal Afar in 2005, followed up at the same conference by likening PowerPoint to an internal threat.

"It's dangerous because it can create the illusion of understanding and the illusion of control," General McMaster said in a telephone interview afterward. "Some problems in the world are not bullet-izable."

----

Commanders say that behind all the PowerPoint jokes are serious concerns that the program stifles discussion, critical thinking and thoughtful decision-making. Not least, it ties up junior officers -- referred to as PowerPoint Rangers -- in the daily preparation of slides, be it for a Joint Staff meeting in Washington or for a platoon leader's pre-mission combat briefing in a remote pocket of Afghanistan.

----

Senior officers say the program does come in handy when the goal is not imparting information, as in briefings for reporters.

The news media sessions often last 25 minutes, with 5 minutes left at the end for questions from anyone still awake. Those types of PowerPoint presentations, Dr. Hammes said, are known as "hypnotizing chickens."

I don't fit in this group anymore

2010-04-24T00:26:00.001+05:30

...or what I see of it anyway.

They're so much more affluent and powerful and just plain money-smart,
politics-smart, and street-smart than I ever will be or want to be.
Are we really all products of the same college?

Someone said something praising Pratap Reddy for bringing Apollo to
its supposed greatness, professionalism, and whatnot from supposedly
corrupt beginnings. I had already had 2 drinks by then, but that
would not have mattered anyway:

"I wouldn't go to Apollo even if I were dying". Not my drink
speaking. Stone cold sober I'd just say it louder and include my
family and loved ones also in the statement. I've had personal
experience of Apollo's "professionalism".

"That's your problem, not theirs. They're making money" [or words to
that effect; can't quite recall now].

It's amazing how big a disconnect there is between me and the guy(s)
who said/endorsed this. None of these guys will ever be "middle
class" like I am. They'll never feel "the system" is getting them
down because they *are* part of the system, or help to sustain it.
One guy is an entrepreneur whose turnover has doubled in the last year
(we're talking more than a few millions of USD). One is a very senior
person in the state bureaucracy -- pretty close to the top. The other
are all construction and real-estate czars, or at least mini-czars, in
their own right. One is a CEO of a small part of one of India's
largest (and IMNSHO most corrupt) industrial houses. One of the
absentees is a guy who's already made so much money he's on a 1-year
sabbatical to play golf. What a life...

And what a contrast to a guy whose most expensive possession is a flat
that cost about 32 lakhs (about 70,000 USD) and still has 11 years of
the mortgage to go.

That doesn't mean all 160+ of the batch are like this -- not at all.
But the group that tends to meet often... They'll never be able to
explain to me how they can idolise someone who essentially made his
millions the way I firmly believe he did (and they aren't even
contesting it; they seem to agree it is true but it is just not
relevant!)

And I'll never be able to explain to them how much fun I'm having,
say, building and supporting gitolite, or any of the other things that
drive me (all, sadly, to do with computers... maybe it is true I don't
have a life!)

I definitely don't fit. Too bad... they're really nice guys inside,
every single one of them. But sometimes that's just not enough.

I'm so proud...

2010-04-23T11:55:00.001+05:30

http://arstechnica.com/tech-policy/news/2010/04/indias-copyright-proposals-are-un-american-and-thats-bad.ars

The Music And Film Industry Associations are trying to get India to toe the line. India says "sure" but it's actually "nice try, buddy!".

Highlights:

- I can still watch DVDs on my Linux box. Since I refuse to install any proprietary software on any computer that I own, and don't have a TV or consumer DVD player, the only way I watch movies is either at the theater (often enough, actually) or by buying a DVD. The Music And Film Industry Associations and their friends would try to ban DeCSS, which is of course critical to watch DVDs on Linux.

- these b*st*rds [ you know when Sitaram brings out the swear words that someone is threatening open source or some other freedom dear to his heart ;-) ] apparently want to add India's borderline friendliness to open source as a matter of concern.

I couldn't care less if I never got to watch another movie for the rest of my life (and the music I like best is stuff like Tchaikovsky so that doesn't matter either). If DeCSS was made illegal I would have been slightly inconvenienced, but may have considered buying a personal DVD player to use occasionally.

But this... this means war!

With that one sentence thrown into the end of their PDF, they've lost the moral high ground. It's very clear that copyright infringement is NOT their main priority -- if it were, they should be applauding the move toward open source for its impact in reducing software piracy.

If you take this to its logical conclusion, is it really that different (in it's **attempted** scope, even if not achieved) from the salt issue? I thought this "forcing people to buy imported stuff they can't afford even if they have local, cheaper, stuff" went out with the British Raj!

bureaucracy gone crazy

2010-04-22T17:49:00.001+05:30

http://www.theregister.co.uk/2010/04/21/ken_thompson_take_our_test/

Google won't allow the co-inventor of Unix and the C language to check-in code, because he won't take the mandatory language test.

Obama outdoing Kalam? Nice...

2010-04-22T12:04:00.001+05:30

http://lwn.net/Articles/384312/

it's a short article, so:

The White House - the seat of the US presidency - has announced that it is releasing some of its improvements to the Drupal content management system. "By releasing some of our code, we get the benefit of more people reviewing and improving it. In fact, the majority of the code for WhiteHouse.gov is already open source as part of the Drupal project. The code we're releasing today adds to Drupal's functionality in three key ways." It is nice to see that the president's office cares about such things.

facebook's privacy issues

2010-04-21T11:45:00.001+05:30

Let me make this point clear with an example. I met a teen whose abusive father was recently released from jail. Recognizing that a restraining order would not be enough protection, the teen and her mother moved thousands of miles away. As the teen began making friends in her new school, she begged for a Facebook account. Her mother caved and both the daughter and mother worked to make the account as private as possible; neither of them wanted to face the consequences of being found. In December, when Facebook changed its privacy settings, this teen and her mother didn't realize what the change in privacy settings meant until someone else pointed them out after the fact. Is putting her at-risk an acceptable bi-product of Facebook's changes?

-- http://www.danah.org/papers/talks/2010/SXSW2010.html

disgusting...

2010-04-16T15:51:00.001+05:30

http://www.eff.org/deeplinks/2010/04/entertainment-industrys-dystopia-future

Matt Blaze and the afterword

2010-04-15T12:16:00.001+05:30

[...] but basically, not much has changed in 15 years. If I had it to do over again, I wouldn't really need to change a word. If I had to tweak it, I might add something about human factors in security, a poorly understood and hugely important subject if ever there was one.

-- http://www.crypto.com/blog/afterword

Since about 2005 or so, the "brief profile" I send out whenever I have a speaking engagement of any kind, has had this line in it: He also has a good breadth of knowledge on e-security and related issues, ranging from technology aspects to the human factor aspects that are so important in implementations.

Looks like I'm in good company!

Not that claiming it means I can do it, or do it well, but I just wanted to reinforce the importance of this -- it's not just the algorithms that are important, it's how the algorithms fit into your big picture that counts.

PS: Matt Blaze is a well known crypto and security guru; currently he's at UPenn. He's not just an eSecurity guru -- he's also an expert safe-cracker and lock picker, as far as I can remember :) He runs http://www.crypto.com/ and his blog and articles are always interesting...

Matt Blaze on SSL certificates

2010-04-13T13:21:00.001+05:30

A decade ago, I observed that commercial certificate authorities protect you from anyone from whom they are unwilling to take money. That turns out to be wrong; they don't even do that much.

-- http://www.crypto.com/blog/spycerts/

(git) first time Jon said something I didn't agree with :)

2010-04-09T11:46:00.000+05:30

[background: I have a lot of admiration for Jon Corbet, kernel hacker and editor of LWN. His writing skill, sense of humour, and clarity of thought are legendary in the Linux community]

But in http://lwn.net/Articles/382090 , Jon tried to draw a parallel between two recent heated discussions on LWN -- one in response to SVN's grandiose, disingenuous, borderline-FUDding (against DVCS), "vision" statement (hah!), and one about some UI change that Ubuntu had made. Jon seemed to be trying to get people to calm down and be a little more mature in their reactions -- a sort of admonishment of their responses perhaps. Considering that the last such debate I am aware of (Monty trying to steal MySQL back) did not get such a response from Jon, this was interesting.

I don't use or recommend Ubuntu anymore due to its installing Mono by default, so that discussion is out of my radar. Reading the comments from the perspective of an all-out git fan, however, a few interesting comments stand out:

http://lwn.net/Articles/382459/ -- [...] another difference, is that the complaints about SVN are from people who want it to die and the complaints about Ubuntu are from people who want it be to be great.

http://lwn.net/Articles/382138/ -- Subversion, on the other hand, probably annoyed most people by a vision statement that implied it had a legitimate claim to be superior in those areas, which it doesn't - note that the latter found arguments (large binary blobs, among others) weren't in that statement, but that the claims it did make were at the expense of the "competition". It read like "DVCS: not simple to use, not controlled, don't support centralized work-flows". Of course that annoyed the hell out of DVCS users. There's more good stuff in that comment, by the way.

http://lwn.net/Articles/382142/ -- The community has always responded rapidly to incorrect information. With the amount of FUD thrown our way from the outside, the responses have gotten faster and stronger. This is a good thing when the people making the false statements are companies like SCO, it's not as good when it's something like the Subversion vision statement. However I don't think that you can get one without the other.

The rest of the comments were details of how to do something or other in DVCSs and so on. For the record, I have always suggested that folks whose main work product is binary formats like doc/xls/ppt should stick to a VCS that allows mandatory locking, such as VSS. This holds true for OOo files also, even if they are XML underneath, so the key point is they are difficult to merge if parallel development happebs.

I also know that extremely large files do cause a problem for git, and checking out a partial tree is complicated by the SHA calculations being thrown out of gear (although in theory this *is* solvable).

...too late

2010-04-01T09:40:00.001+05:30

OK, I'm ready. Let's go.

No. You forgot something.

What?

Your smile :)

----

She was almost always in a temper at her brothers and parents. I was 16 or 17, the same age as her younger brothers. But I had two things going for me: I was sane enough to have a conversation with, and I was a cousin who just visited once in a while.

So I could risk her wrath, and say something cheeky or funny. I could make her smile :)

----

I never did try and catch up with that smile in later years, even after I moved back to India and to the same city where she lived. I just never bothered. I can't explain why.

And now it's too late.

----

And I realised something today. I tear up too easily.

99% approval rating for git

2010-03-21T12:26:00.001+05:30

according to Martin Fowler anyway: http://martinfowler.com/bliki/VcsSurvey.html

The accompanying subjective article at http://martinfowler.com/bliki/VersionControlTools.html has more nuggets.

- for all you VSS fans out there: "Before I finish with those behind the threshold, I just want to say a few things about a particularly awful tool: Visual Source Safe, or as I call it: Visual Source Shredder. We see this less often now, thank goodness, but if you are using it we'd strongly suggest you get off it. Now. Not just is it a pain to use, I've heard too many tales of repository corruption to trust it with anything more valuable than foo.txt."

- the indictment of proprietary tools like clearcase and TFS: "I will, at least for the moment, leave it with the fact that developers I respect have worked extensively with, and do not recommend, these products."

- on git: "Git certainly seems to be liked for its power. Folks go ga-ga over it's near-magical ability to do textual merges automatically and correctly, even in the face of file renames. I haven't seen any objective tests comparing merge capabilities, but the subjective opinion favors git."

- and the best one: "Our view now is that msysgit is good enough to make comparison with Mercurial a non-issue for Windows." Amen to that, buddy!

"scripts don't automate well"

2010-03-18T09:31:00.001+05:30

enterprisestorageforum, its columnist Drew Robb, and "Mike Karp, an analyst with Ptak Noel and Associates" are now on my blacklist.

Not the one I reserve for arrogant media giants who install rootkits on your computer because you dared to buy an audio CD from them, no...

This is the one reserved for terminally clueless morons :-)

I am only thankful that the offending sentence was in the very first item on that list, saving me the time to read the rest of it.

If you're in a masochist mood, however, you can hit http://www.enterprisestorageforum.com/management/features/article.php/3867506/Top-10-Data-Storage-Technologies-That-Coul

Fwd: Fwd: Bhopal

2010-03-18T08:44:00.001+05:30

Dear friends,

Some of you know I've always been against the nuclear deal as well as questioning the motivations, even patriotism (as if bloody politicians ever had any in the first place) of the people at the centre.

There has been an uproar about the way in which a future Bhopal is being almost legitimised, favouring American business over even the safety, leave alone financial security, of Indians.

Whether you go to the Greenpeace link below and add your signature to the petition or not, and how much you are willing to spread the word, is upto you. But please do not ignore the issue.

Regards,

Sitaram

top few paras of http://www.deccanchronicle.com/op-ed/liability-bill-nuclear-hara-kiri-610 :

The United Progressive Alliance government deferred the introduction of the controversial Civil Liability for Nuclear Damage Bill, 2010, (CLNDB) in the Lok Sabha on Monday. The aim of this bill is to meet specific American concerns which have arisen post Bhopal gas tragedy, by providing immunity to American nuclear plant suppliers from any victim-related litigation in the event of a major nuclear disaster. The bill transfers the liability, or compensation, to the Indian taxpayer instead. This proposal is risky for several reasons, including the fact that it provides the nuclear reactor manufacturers the option to maximise profits by reducing building and safety standards without fear of prosecution.
Since Russia and France will supply reactors to India from their government-owned companies, this bill is really meant to cater to the United States where nuclear plants are not only owned and maintained by private companies like Westinghouse and General Electric, but it is the private "operator" and not the private "reactor supplier" who is held accountable for payment (through insurance) in case of a nuclear accident. No American "reactor supplier" would be willing to build nuclear plants in India unless the CLNDB is passed.

The bill is crucial to the operationalisation of the Indo-US nuclear deal, but India is under no international obligation to pass this bill which, in reality, attempts to convert the liability of a foreign reactor supplier (FRS) into a rather pathetic compensation, to be paid by the Indian taxpayer.

Though the bill is America-centric, if passed it will apply equally to reactors supplied by France and Russia for which presumably different, and as yet unpublicised, conditions would have been put in the contracts.

---------- Forwarded message ----------

From: Karuna Raina, Greenpeace India <Greenpeace.india@mailing.greenpeace.org>
Date: Wed, Mar 17, 2010 at 11:41 AM
Subject: Bhopal
To: sitaramc@gmail.com

If you are unable to see the message below, click here to view.

Click here to sign this petition: "India must hold a public consultation before changing the liability rules for any nuclear accidents caused by U.S. corporations."

Dear Sitaram,

Last week, Prime Minister Singh was ready to introduce the nuclear liability bill, which would let U.S. corporations off the hook for any nuclear accidents in India. But over 50,000 of us signed a petition asking him to hold this bill. Now he's not introducing the bill in this session of parliament after all!

In case of an accident at Indian nuclear plants, U.S. companies would get away by paying a small amount, and Indian tax payers would bear the bulk of the expenses involved. Imagine if this law passes, then we face a disaster even worse than Bhopal.

The bill has only been deferred until the next parliamentary session in a few weeks. Now's the time to increase pressure on the PM to drop this bill.

Can you sign our petition right away?

http://www.greenpeace.org/india/nuclear-bill

The petition says: "India must hold a public consultation before changing the liability rules for any nuclear accidents caused by U.S. corporations."

Your signature will be faxed to Dr. Manmohan Singh's office.

As The Times of India reports:

"Isolated over the civil nuclear liability bill, the government was forced to back off in the Lok Sabha on Monday when it decided to defer introducing the legislation in the face of spirited opposition..." ^[1]

The victims of the Bhopal gas tragedy are still struggling to get their due 25 years later. In spite of this, the government is pushing for this ridiculous bill which violates our right to life.

We cannot allow American companies to reap benefits without any responsibility. Sign the petition now to tell the PM what you want:

http://www.greenpeace.org/india/nuclear-bill

Thanks a billion!

Karuna Raina
Nuclear Campaigner
Greenpeace India

Source:
1. "Govt backs off on nuclear liability Bill," The Times of India, 15 March 2010
http://timesofindia.indiatimes.com/india/Govt-backs-off-on-nuclear-liability-Bill/articleshow/5688159.cms

Greenpeace on the web
We're also on Facebook, Twitter and Youtube - join our friends list.

Why have I received this mail?
Either because you signed up as a Greenpeace India cyber-activist or a friend forwarded this mail to you.

How do I subscribe?
To receive regular updates from Greenpeace India, sign up here.

How do I unsubscribe?
To stop receiving messages on how you can help the planet click here.

How can I help more?
You can help by forwarding this message to everyone on your email list. You can also donate to keep us going strong!

Where do I send feedback?
Please send all feedback to ocampaig@greenpeace.org Greenpeace India, #60 Wellington Street, Richmond Town, Bangalore 560025

--
Sitaram

(malware) malware see, malware do

2010-03-14T17:28:00.001+05:30

You may have noticed I always classify Microsoft stories as "malware" (not using blogspot's tagging system, but -- when I remember -- in the subject line itself, like in this post).

This is because I consider Microsoft to be the biggest piece of malware floating around. Mostly legal, (although some posts are tagged "criminal" also; what can I say, a spade is a fscking shovel!).

Now there is proof that the 800-lb legal malware company is inspiring the really illegal malware authors. Here's an excerpt from http://www.theregister.co.uk/2010/03/12/new_zeus_features/ :

The latest version of the Zeus do-it-yourself crimeware kit goes to great lengths to thwart would-be pirates by introducing a hardware-based product activation scheme similar to what's found in Microsoft Windows.

[...]

The hardware-based licensing system isn't the only page Zeus creators have borrowed from Microsoft. They've also pushed out multiple flavors of the package that vary in price depending on the capabilities it offers. Just as Windows users can choose between the lower-priced Windows 7 Starter or the more costly Windows 7 Business, bot masters have multiple options for Zeus.

(funny) Rick Moen on forking... an excerpt

2010-03-11T20:41:00.001+05:30

The version numbers were a minor problem: The GNU/Linux guys had already reached 5.4.47, while FSF was just hitting 2.0. They probably pondered for about a millisecond asking Stallman to make his next version 6.0 for their benefit. Then they laughed, said "This is Stallman we're talking about, right?", and decided out-stubborning Richard was not a wise idea. So, the convention is that Linux libc version 6.0 is the same as glibc 2.0.

http://linuxmafia.com/faq/Licensing_and_Law/forking.html

(geek stuff) starving in an elevator

2010-03-11T09:10:00.001+05:30

I've always read that an "elevator scheduler has obvious starvation issues", but somehow it was never obvious to me. I know how an elevator works, and the only time an elevator keeps you waiting is if it's stuck on some floor because someone held the door open or too many people were getting on/off.

I just naturally assumed that the analogy breaks down there; after all, if the disk head stops on a sector, it's a hardware fault so this cannot happen. Hence the puzzlement about the "obvious" starvation.

Well, duh! The analogy actually breaks down *much* earlier. Your average elevator has at most 20 stops. The largest ones maybe a hundred. So as long as you keep moving and take short (occasionally longer) stops, you're bound to reach any floor soon enough, relatively speaking.

A 500GB disk effectively has a billion "floors", (a sector is 512 bytes, for now anyway). If someone decides to do a streaming IO before the head gets to your sector, you're effectively starved until that whole stream is done. And if that's a multi-gigabyte movie or whatever, you'll be waiting a loooong time!

Oh well, at least now I understood the "long distance bus with an enormous number of request stops" scheduler :)

they should, however, see this:

2010-03-10T14:07:00.001+05:30

http://www.theregister.co.uk/2010/03/09/iphone_developer_agreement/

excerpts:

It's no news that the iPhone, the iPod touch, and the forthcoming iPad are closed systems. Reading the Agreement, however, reveals just how closed those systems are, and just how committed how Apple is to reversing decades of developers' abilities to publish and market apps as they see fit - not to mention the user's right to load whatever software they want onto devices they have purchased.

[...]

[...] even if you follow Apple's directives to the letter, Apple may, in the words of the Agreement, "reject Your Application for distribution for any reason, even if Your Application meets the Documentation and Program Requirements."

[...]

The reasoning behind Apple's seeming arbitrariness and demonstrable capriciousness was explained over 30 years ago by comedienne Lily Tomlin when she lampooned "the Phone Company" with a mocking summary of their attitude to customer service: "We don't care. We don't have to."

erm, some of my friends shouldn't read this ;-)

2010-03-01T10:56:00.002+05:30

http://seenonslash.com/node/3842

designing/certifying an encryption algorithm

2010-02-18T10:19:00.000+05:30

[sometimes I write emails that are pedagogic enough that I like to blog the main points of it for my future quick reference].

Dear [elided],

Designing a crypto algorithm is not easy. There's a saying in the crypto world: "anyone can create an algorithm that he himself cannot break". The point is to design it so that no one else can break it.

Which brings us to certifying someone else's algorithm... Certifying an encryption algorithm is not easy either. In fact, it is never done by a single individual, but by a large, public, peer review process. NIST spent more than 3 years from initial proposal to final selection of AES (see http://csrc.nist.gov/archive/aes/index2.html#overview ).

An honest cryptographer or a conscientious security analyst will refuse to design or certify any crypto algorithm on his personal say so. That's just not the way things work in the crypto world. If you want to know how many facets there are to actual cryptanalysis, and how much deep mathematics is involved in doing a good job of analysing a cipher, skim through section 6 of http://www.schneier.com/paper-self-study.pdf . Once that has suitably scared you, read section 7 ("Conclusion", page 15) properly. It's just 2 paras :-)

A more well known page, for someone wanting to become a cryptographer, is http://www.schneier.com/crypto-gram-9910.html#SoYouWanttobeaCryptographer

And finally, I just love this one: http://www.schneier.com/crypto-gram-9902.html#snakeoil!

Now, I realise that all 3 of my referenced links come from the same guy, but that's Bruce Schneier -- he writes well, and is willing to descend to the level of mere mortals like you and me to say what he needs to say in a way that we can understand it!

To come back to your problem, therefore, I'd be more comfortable trying my damnedest to fit TEA (or XTEA, or XXTEA) into the platform you're constrained to use, than try to design a new algorithm that is smaller than those *and* is secure enough for me (or TCS) to stand behind it.

Regards,

Sita

I am soooo tempted to send this to someone I know...

2010-02-15T08:53:00.001+05:30

but he'd probably freak out!

-------- Original Message --------
Lightbulb... Christians
via Comedy Central's Jokes.com: Joke of the Day by Comedy Central on
10/30/08

How many Christians does it take to screw in a lightbulb?

None. The Bible makes no mention of lightbulbs.

that explains most of the religious people I know....

2010-02-14T22:56:00.001+05:30

(except one)
/. says

Brain Surgery Linked To Sensation of Spirituality

Apparently if they chop off bits of your brain you become spiritual. Nice...

[of course the actual article is much more positive. Brainwashed, no doubt...]

tcs.com was NOT hacked...

2010-02-08T09:19:00.000+05:30

[Disclaimer: I'm an employee of TCS, though naturally I'm posting this in my personal capacity]

tcs.com was NOT hacked yesterday. What did happen was that the DNS records that supply the IP were reset to some other IP.

Whether that was done by actually hacking tracom/netsol or by social engineering a valid change request I do not know.

I know the site was fine because going through the internal DNS got me the correct IP address and the correct content.

I believe the problem started sometime before 1am IST [this is a wild guess, from other symptoms; don't ask!], and was resolved around noon or so [this guess is more accurate because I was semi-actively monitoring it].

In both instances, it would have taken a few hours for the bad data to expire from DNS caches. Depending on who your DNS provider is, you may have seen it "come back" at different times. If you were running your own DNS, you could have purged your DNS cache manually and would know more accurately when it came back.

Regards,

Sitaram

LCA 2010: Allison warns of patent traps in Mono

2010-01-27T22:30:00.001+05:30

http://www.itwire.com/content/view/30629/1090/

Patents are the only threat that Microsoft can brandish against free and open source software and that is exactly why people should be wary of the Mono project, free software advocate and Samba hacker Jeremy Allison told a packed auditorium at the 11th LCA.

interesting tidbit on page 2 of the article:

He said the the importance of the patent lawsuit that Microsoft launchd against GPS maker TomTom last year could not be over-emphasised. "The suit was launched by the legal department, and the open source group at the company was horrified to learn of it - through the media," he claimed.

would you have been able to spot this?

2010-01-27T09:27:00.001+05:30

http://www.krebsonsecurity.com/2010/01/would-you-have-spotted-the-fraud/

nice pictures...

MVF

2010-01-20T21:03:00.003+05:30

http://tirania.org/blog/archive/2010/Jan-11-1.html

reminds me of a rather nasty slashdot comment someone made on Miguel's obvious "love" for MS... if you know where to look, (or how), you'll find it ;-)

(funny, malware) Chinese Pirates Launch Ubuntu That Looks Like XP

2010-01-15T15:27:00.001+05:30

Chinese Pirates Launch Ubuntu That Looks Like XP

via Seen On Slash - Funny by speculatrix on 1/1/10

Original post:

"Ylmf, famous for pirating Windows XP, have just released a version of Ubuntu that looks just like Windows XP. Really, really similar. Apparently because Microsoft were cracking down on the actual Windows XP pirating — though I think they will still suffer for ripping off the GUI exactly."

----

Re:why?
by ozmanjusri (601766)

Just add a cron script that has a 5% chance to reboot the system every half hour, and you're there! :P

Not quite.

You'd need to find some way of slowing down file transfers too, add an a few dozen random "utilities" to the systray, set it to check in with Ylmf every few weeks and nag you about it, run another dozen or so malware and anti-malware apps in the background to eat some extra RAM and cpu cycles, send all your financial details off to the Russian mafia, deduct $90+ from your bank account for every app you've installed and lock itself so only 3 themes work.

That'd be a bit closer to the Windows Genuine Advantage experience...

(funny) "changed genders once"

2010-01-14T13:59:00.001+05:30

http://news.cnet.com/8301-13860_3-10423985-56.html

forget the actual article...

the byline says "...changed genders once...". No big deal in this day and age, of course.

but her blog is called "Beyond Binary".

hmm.... interesting!

EnterpriseDB responds to Monty's "no credible alternative" comment

2010-01-04T09:38:00.002+05:30

In a rather melodramatically-titled [*] post ( http://monty-says.blogspot.com/2009/12/help-keep-internet-free.html ), Monty says there is no credible alternative to MySQL.

For some of the techies I respect highly, MySQL itself has never been a credible choice, they always seem to prefer Pg. Be that as it may, EnterpriseDB has answered this sanely and unemotionally (which is a lot more than you can say for Monty!) at http://blogs.enterprisedb.com/2009/12/29/postgresql-the-credible-alternative-to-mysql/

The punch line in that post, to me, is this: "EnterpriseDB brings the same value to the Postgres community that Red Hat brings to the Linux community". I'll bet they didn't want to twist the knife by expanding on that statement ;-)

--
Sitaram

[*] I am beginning to joke that he's planning to run for office or maybe even unseat Al Gore, just based on the title of that post

the MySQL campaign; my thoughts...

2010-01-01T11:26:00.006+05:30

Monty Program and the flying EC petition

[In this article, MP means Monty Program AB, which I believe is the name of the commercial entity behind the campaign to get the EC to stop Oracle buying MySQL as part of the Sun acquisition].

(Disclaimer: I have no connection of any kind with Oracle, MySQL, MP, Sun, or Postgres. I use none of their products myself, although some open source software I use may be using Pg or MySQL underneath. I work for an IT services company that probably has partner agreements with every major vendor of anything, hardware or software, but it's a pretty large company, and I have no visibility into those things. This article has nothing to do with my employer, and I do not speak for my employer. It is the point of view of an individual who is an open source user/enthusiast/evangelist of 15 years standing, has some strong opinions on what is going on and is using blogspot as a pulpit to stand up on and rant).

[Anonymous comments are ok, but please do sign off with a name. If you find any *factual* errors, please also cc sitaramc@gmail.com so I might see it faster.]

NQOSS
"infrastructure", vendor lock-in, and fungibility
emulating a US bank :-)
true open source
an open question to MP
the last word

MP is appealing to the EC to block the sale of MySQL to Oracle, with arguments of various kinds, all built around the idea that Oracle will have the power to kill MySQL.

Here're my thoughts on this, for what they are worth.

NQOSS

MySQL is an open source product, but the development model is not quite what one normally associates with other OSS products. Everyone is not equal. One single commercial entity holds all the copyrights to MySQL, and requires all contributions to be copyright-assigned to them.

(The word "commercial" is in there to differentiate entities like the FSF, ASF, etc., who have requirements that sound similar, but whose terms are actually much more consistent with the open source ethos, and thus much more palatable to individual contributors).

I call this NQOSS ("not quite open source software") because such products have no (or very few) contributors from the outside world. MP have themselves said (see section 5.3 of this pdf):

[...] MySQL was almost fully developed by employees of MySQL Ab and later Sun's MySQL division.

In fact, from that statement I would even say MySQL has a closed source development model, even if the code is open source.

However, as far as I can find, no one in MP has ever admitted that it is the copyright assignment clause that keeps external contributors away, thus necessitating development to be internal.

As Jon Corbet (whose general clarity of thought and articulation, as seen in his LWN articles, has earned him innumerable fans) says here:

Agreements like Sun's and SugarCRM's are common when dealing with corporate-owned projects; they clearly prioritize control and the ability to take things proprietary over the creation of an independent development community.

That LWN article is more about Canonical, however. For more on the general issue of copyright assignment, see this rather long piece from Michael Meeks. A couple of quotes from that page:

I am not aware of a single project that mandates copyright assignment to a corporation that has a diverse, and thriving developer community.

and

some of the most successful open source projects require no copyright assignment: Linux, Busybox, Xorg, Mozilla/Firefox, GNOME, KDE, GStreamer, and a whole clutch of others too many to mention; indeed this is arguably the normal state of Free software projects

To put it bluntly, there isn't sufficient developer mindshare for MySQL to be a proper open source project because they wanted it that way -- they wanted to be the only one to be able to make money off of it.

infrastructure, vendor lock-in, and fungibility

There is a tacit assumption in all of MP's arguments that people who use MySQL cannot easily migrate to Postgres or something else. That's usually called vendor lock-in. Doesn't matter if it was intentional (as it often is with some other companies one could name) or otherwise. In fairness in this case it was probably unintentional; I have no way of knowing.

Meanwhile, Monty says "MySQL is not an end user application, but an infrastructure project that is quite deep in the system stack".

I don't know about you, but I've always felt that infrastructure should be fungible. You should be able to replace one for another with not too high an effort, for the vast majority of apps using a database.

[There will always be apps that require specific feature(s) and are therefore locked-in to one product; this discussion does not pertain to them. It's not "vendor lock-in" if you walked into it with your eyes open because you like/need something special that only that product has. That's a genuine competitive advantage being used the way it was intended to be. My point is simply that this is not needed for the majority of apps.]

For most apps, though, if you needlessly locked yourself into MySQL, you do have a problem, and sooner or later you'll have to deal with it. Remember that the code is the most important thing -- don't worry about the backend tools; migrating those is likely to be an O(1) effort compared to migrating your application code itself. Keeping your code as db-neutral as possible would make that even easier.

Personal note: Years ago, I used to convert Burroughs DMS-II (a hierarchical database!) apps to IBM DB2 or DB/400, including all the COBOL programs of course. Each of them was a challenge, made worse by the fact that, unlike modern languages like perl or php or even C++ or Java, each COBOL is different in innumerable subtle ways from another -- even within the same manufacturer there would be huge differences between one COBOL and another! I also wrote/maintained tools to convert almost any type of COBOL+ISAM files to OS/400, DB/400, and COBOL/400.

Thankfully those days are gone, and by and large this sort of lock-in has disappeared. I'd expect this to be much simpler today, but I don't have direct, recent, experience of writing an app that uses a db.

emulating a US bank :-)

Consider:

MySQL creates an open source product
they make lots of money selling licenses for a few years
they make even more money selling the whole thing to Sun at some point
and now they want to prevent Sun from selling it to whomever they want to

Regardless of how you look at it, this is crazy. Once I sell you something, I should not be able to dictate what you get to do with it, should I?

And in this case it's not even anti-trust. Even after they buy it, Oracle is far from being a monopoly in databases.

MP are essentially asking for a bailout. From the effects of their own choices and decisions. Not in direct financial terms, but indirectly, via policy!

true open source

Let's consider what would happen if Oracle bought it, and -- as MP fears -- kills it off:

someone takes the last GPL version and forks it
since they do not own the copyright on this, demanding (or even getting) copyright assignment does no good -- they can't dual license anyway.
Oracle can't demand copyright assignment either, because it's a fork, not their version being changed
now the external developer community starts trickling in, because it finally makes sense for them to contribute
all the supposedly great stuff currently being done by MySQL's partners (see that same URL above) comes out into the open, and gets done by the real open source community. Some of it will be slow, some will be fast, but it will happen.

Wait a minute -- am I actually saying that Oracle "killing" MySQL will be a good thing for... MySQL?

Yes :-)

It'll become like Linux. No single company stranglehold. A vibrant, open, development community. And lots of money to be made still, just in a different model, that's all.

Anyone who claims to be an open source evangelist should be happy ;-)

an open question to MP

Feel free to assume the worst that Oracle can do, and analyse the effects on a real, pure open source, project that uses MySQL (and can only use MySQL, for technical reasons). Show how such a project is harmed by this sale. Post the analysis on your site and a link to it as a comment here. (Don't post the analysis here).

That could help your case far more than all the rest of your efforts, as far as I am concerned.

Or... don't...! You don't really have to care what I say and react to it; I'm not really a big fish in any way, luckily for you.

the last word

I'll let Michael Meeks have the last word:

There is, of course hope - that individuals, smaller corporations and consultants will see the dangers, rebel against them and invest and adopt only the truly open technologies.

Amen to that...

hilarious... CIP (Ch* in progress)

2009-12-30T19:18:00.001+05:30

http://www.fakingnews.com/2009/11/three-letter-word-invented-by-an-indian-mba-creates-stir-in-the-world/

quote (but read the whole thing on the original page, it's great stuff!):

Mumbai. Mr. Murali Chetankar, 29, an MBA from a top tier management institute of India has created a stir around the world. He has invented an all encompassing TLA (Three Letter Acronym or Three Letter Abbreviation), which can be used to describe the work that management graduates do. The acronym – CIP (Ch*tiyaps in Progress) is now universally accepted and understood. Oxford is planning to debate, discuss and include this TLA in its dictionary in the next revision. This is probably the first engineered Indian word to be included in the Oxford Dictionary.

The story of how this was invented is fascinating. Murali was perturbed by the frequent probing of his engineering college classmates as to what work he was doing post his MBA. Frustrated by the repeated questions like 'Wazzup' and 'Whats happening', Murali decided to take the road less travelled and discover a word to explain what work he did. After much deliberation he realized that all he did for the last 3-4 years was nothing but Ch*tiyaps. In a fit of rage he updated his GMail status to "CIP – Ch*tiyaps in Progress".

no comment...

2009-12-20T20:03:00.001+05:30

http://code.flickr.com/blog/2009/12/02/flipping-out/

A previous blog post of mine was about the above link... well lets just say it was very frank :-)

After 2 people (including one person on #git I have a lot of respect for) seemed to not like it, I took it down.

However, since this blog is as much a sort of "historical bookmarking device for Sitaram", I need that link in there, so here it is.

You, my gentle reader, can draw your own conclusions.

some things in life...

2009-12-19T20:02:00.001+05:30

- a brand new Yamaha Fazer for your son: Rs 81,000
- driving classes and test for son: Rs 4000
- 2 tickets to New Moon: Rs 300
- taking your pre-teen daughter on a snazzy "young man's" bike to a
crap movie and having her say "dad I owe you bigtime": priceless

one more monkey...

moved to google+

Microsoft makes .txt files dangerous!

git for computer scientists -- my version

Fwd: Git - Authenticate from Active Directory....

(WTF, mac idiocy!) oh yeah, about that "silky smooth OS X style"...

IE users stupid?

veracity

Dijkstra endorses perl (well, I'm stretching it a wee bit... ;-)

debugging "clever" code

Forbes columnist on "Microsoft's Android Shakedown"

Jon's impressions of Chromium

the lure of apple products...

the new nook (aka Nook second edition, nook simpletouch, etc)

rule #1 for a home user

happy passwords, here I come!

scale fail: cloud addiction

(heard on slashdot) WMI

do you still want an Apple ipod/ipad/iphone?

facebook as the ultimate spy network

unbelievable (operation pumpkin; prince william's wedding)

I want!!!

Michael Geist: piracy is a market failure, not a legal failure

with friends like these, who needs enemies? [Gates and Allen]

CS and the real world (seen on slash)

of winks and nooks...

Indian English strikes again

pointy-clicky on gitolite

Oh Em Geeeee!

lid starts closing on Nokia coffin

starting to become mainstream!

cynicism...

cvs, svn, and git -- a tangential revisit

the insecurity of religious people

switching from Mandriva to Fedora

stay off my master branch, off-shore dude!

with all due respect ;-)

best rant against C++ I've ever seen

(job) security

consultant-speak for "crap"

The Economist on the fallibility of biometrics

someone bites back at HTC

HTC in my personal bl again

it's not rocket science!

Gosling: Oracle is ethically challenged, micro-managed, and creepy

hacking embedded systems

found on a random list of funnies somewhere...

bikeshedding the twittube!

Fwd: Consumerization and Corporate IT Security

the effect of snake oil security

apple bashing...

Hg easy to use?

fixups on an existing commit using tig and the new autosquash option on rebase

long time Mandriva user tries Fedora

making a multi-boot USB (and mandriva troubles)

(gitolite) a non-techie explanation of "distributions"...

Absolutely. The. Funniest. CFP. Ever.

(apple) 5 ways iPhone users get ripped off

Fwd: [gitolite] Anybody knows a gitolite ready AMI

after a few days, the core starts stinking

LinkedIn going the facebook way?

fake job acceptance letters

an agnostic's delight

a couple of funny ones...

why should anyone trust this b*st*rd now?

Re: Take a look at my photos on Facebook

(funny) VBA

a refreshingly frank article about cloud security...

We Have Met the Enemy and He Is PowerPoint

I don't fit in this group anymore

I'm so proud...

bureaucracy gone crazy

Obama outdoing Kalam? Nice...

facebook's privacy issues

disgusting...

Matt Blaze and the afterword

Matt Blaze on SSL certificates

(git) first time Jon said something I didn't agree with :)

...too late

99% approval rating for git

why should anyone trust this bstrd now?