robbat2 | Recent Entries

I'd like to thank the relevant parties (*waves at StartCom*) for bringing an important correction to my notice.

I previously followed somebody else's summary of the Mozilla CACert inclusion battle, rather than reading the 135 entries on the official Mozilla bug for the matter. More importantly, their summary unfortuntely lead me to make a bad conclusion (probably aided by a lack of sleep on my part when writing up my presentation on the morning of BarCamp, due to the cold, hard, concrete floors), which was the statement "CACert audit by 'We!' funded by StartCom".

This was brought to my attention this morning, and I slogged through the bug mentioned as well as other sources, and found that StartCom was audited by We! Consulting, and the same was only suggested for CACert. According to one source that commented on my previous post, CACert refused We! Consulting, but I can find nothing else to back up that statement. However, I do find nothing to indicate that they presently have anybody lined up to audit them. I'd like to repeat that for good measure however - CACert is not being audited presently, nor is any audit of them being funded by StartCom.

Some other research on the matter provides the following links from the CACert wiki, which include a TODO list on CACert's audit process (in short - not yet, there's still paperwork on CACert's side in the way); as well as an invitation page listing CACert's criterion for an auditor.

Current Mood: working

I've been looking at the photos from my wedding - I specifically ask the photographer if I could get a copy of all of the RAW images (and I gave him plenty of DVD-Rs to put them on).

I'd heard there was some difference in processing results, but I'm surprised to see that Linux seems to be huge leaps ahead of Windows in terms of results.

Here's a small sample I put together:
http://tinyurl.com/fkmw2

- One from the wedding photographer (He used either Adobe Photoshop CS2, or the Canon utility)
- UFRAW
- DCRAW (configuration #1)
- DCRAW (configuration #2)

All image were saved/resaved with jpeg-75 compression, so that the files wouldn't be too large for online comparison.

I would suggest that you download all of them, and then compare them side-by-side, piecewise.

Thereafter, could you please vote here (if you don't have a livejournal account, please leave a comment with your vote instead)?

[Poll #814130]

Results of which file was processed by what tool will be revealed in a few days.

Current Mood: hungry

BarCamp Vancouver 2006 took place August 25th and 26th. For those not aware of it, in plain terms, it's a geek un-conference without formal talk arrangements. You turn up, have a party, camp in an office building, have breakfast, come up with mostly impromptu talks, give said talks, have lunch, do more talks, go home. My talk was on CACert Assurances, and I was also a super-assurer for the purposes of the event.

( Long version )

[Edit: Please see the corrections regarding the CACert Audit posted here.]

This is the outline version of my Powerpoint presentation, created using information from the CACert site and wiki.

Title: CACert - Verified SSL without paying Verisign

Facets
- History
- Verification
- CACert point system
- Integration
- Assurance time!
History
- Thawte
  - Web-of-Trust
  - Notaries
  - Things killed by Verisign
Verification
- Why?
  - Identity implications
  - Legal requirements
  - Trying to avoiding Verisign-like screwups
- PGP/GnuPG keysigning
  - Checking IDs
  - (Known-data|shared secret) exchange
- CACert
  - Keysigning process + point allocation
CACert point system
Integration (why doesn’t it work in my browser right now?)
- Already in most Linux distributions
- IE: Microsoft requirements
  - WebTrust audit
    - $75K USD upfront, $10K USD yearly
  - Not likely to happen soon
- Mozilla requirements
  - Audit by any suitable company
  - CACert audit by ‘We!’ funded by StartCom
Assurance time!
- Quick guide to filling out the form
- Circulate!

Here are some notes I took during a presentation by Rob Cottingham of Social Signal.
Title: "Secrets to a Killer Technology Speech" / "End to End Speech Writing"

Start with an idea, and end with a powerful idea.
Don't spew bullshit, ever.

7 important techniques/items (you need all of them).

1. Know where to end off.
2.1. Structure - give audience exact idea of what you are covering, say there are 7 points ahead of time.
2.2. Explain it in the form of a story, using oral traditions to full effect. Hollywood uses 3 acts - your hero gets up tree first, then develop conflict, such as throwing rocks at the tree, and lastly the hero falls out of the tree.
2.3. a) Express problem (why it's needed, why we are vulnerable to it) b) Elaborate on problem, say how it affects audience c) Give them a solution, say how it will fix their issues.
3. Use visual thinking, avoid boring speakers. Give ways to escape, mental images, but pick ones that help your cause. Ujjal Dosajh used a childhood story of an ox-drawn cart on a dusty road.
4.1. Put the powerpoint AWAY. People are there for the STORY! Not the words on the screen. You can even do away with projectors entirely.
4.2. Exceptions are when walking through a new product, or you have visuals ABOUT the information, not charts.
5. Have passion for the idea. Convey passion even if you don't feel it.
6. Authenticity. Growing power. Transparency is big in new media. Don't have a speech like a speech writer would write, with stuff you would seldom say. Write your speech as you normally speak! Subject, Verb, Object!
7.1. Ending. The correct one! Use emotional High, Kathartic. Call to action. Encourge to go out and DO.
7.2 Don't give thank yous to poeple at the end of your speech, rather do it at the start!

Summary: idea at start, then thanks yous, then climax, then ending.

Sometimes I'm astounded by the other Gentoo developers, in unusual ways. In this case, I'd always thought Spanky was devious, but it wasn't until I saw his Cafepress store that it really came to light just how devious he was.

Behold, Gentoo Thongs! (link is work safe as long as you don't work with anybody that thinks underwear on a white background is evil).

I personally disagree with the concept of thongs. Insufficent fabric covering parts of the body that need it simply to avoid chafing and scraping, because they're damn tender! However that shouldn't stop anybody from buying them. Support Spanky's Gentoo-development-addication, and buy the Gentoo Thong^TM. Maybe even send him action shots of the thong? ;-)

Edit: amethest adds that her concern is more of them riding up; she didn't think marketing a wedgie would be so popular.

Current Mood: amused

After being told my posts are written in binary, and that they are "all geek, all the time", I thought a general post might be in order.

I am getting married on 2006/August/19, to amethest.

Now to proceed with my TODO list for today.

Thursday:

Pickup replacement server mobo in North Burnaby.
Deposit 3 cheques at bank.
Pickup GPS cable from NCIX-Metrotown.
Go to ICBC driver services @ Metrotown to renew license if I don't need to hand over the old one.
Mop kitchen

Argh.

There was a faint acrid smell, then a loud pop, and thereafter my server went off...
Unplugged/disconnected/etc, and opened it up, to find that it had blown a capacitor.
I have taken pics, but obviously can't put them until until the server is functioning in some way again.
A friend with a spare mobo that's a close match is coming over a bit later, but until then, my email and website are offline.

Hopefully the board in the server is still under warranty.
If it isn't then it's time to explore a new server, maybe in one of those shuttle-style mini cases.
Is anybody aware of a SFF system that has a PCI slot and TWO LAN ports?
It would need to fit 2x 3.5" drives as well, for my 3ware RAID.

If applicable (if it's actually going to happen), could whomever of my friend is planning my bachelor party please give me some subtle warning as to which day it is happening?

On the day I returned from Portland (July 28th), I turned 24. It has solidified one thing I've been thinking about for a few years now with birthdays and christmas. Beyond an excuse to speak to family or grab dinner, these annual occurances mean absolutely nothing. I went out for dinner Friday evening with my parents.

My maternal grandfather (still residing in East London, Eastern Cape province, South Africa) phoned my cellphone on Thursday evening to wish me the best, and express regrets at being unable to attend my wedding due to age and deterioriating health. It was nice to talk to him out of the blue.

Marissa gave me a gift right before I left for Portland. It was a giant wooden puzzle, that unfortuntely turned out to have a nasty crack in the middle, so I need to return it at some point very soon, possibly Saturday morning.

Monday this week I decided to get myself a gift - I mean, there's no reason I can't. I'm not generally a materialist - there have been christmas/birthdays in the past where I specifically asked for various items of clothing, because I actually needed them, not because I wanted them. However, just as much as the next person, having a new toy to play with is worthwhile. I do actively limit my unnessicary budgetary expenditures where possible, and occasionally sell off old computer gear (buy my FibreChannel stuff folks!).

Anyway, I picked up a Samsung 940B-HAS 19" LCD for $250CDN, and a Bluetooth GPS unit for $110CDN, both on special at NCIX. The LCD works great, ddccontrol in Linux provides _more_ controls than the Windows Samsung utility, and now I've got a lot more space on my desk (and no excuse not to finish cleaning up my desk now.

The GPS unit works great with Bluetooth, but I'm mildly disappointed with it otherwise, because of the manufacters decision to use a USB mini-B connector on it for charging the battery, but NOT being able to use a normal USB mini-B to A cable to connect to the device in a serial port mode. Apparently I need to buy a special $20 cable, so I'll have to see about that tommorow. I strongly suspect that the manufacter (Holux) cheated and abused the Data+/Data- pins on the mini USB socket to be TTL-level RS-232 TX/RX on the GPS unit. I'll dismantle the magic cable to confirm this, and let other people know about it too.

In the LJCut, is the public portion of my report-back on OSCON2006 to the rest of the phpMyAdmin development team. I decided to post it here, as it is a good summary of my travels to Portland.

This is the photo I refer to in it, http://www.flickr.com/photos/calevans/201270101/in/set-72157594210410472/.

( reportback )

Just a reminder that I'll be at OSCON2006 on Wednesday 26th and Thursday July 27th. I'll mostly be manning the phpMyAdmin booth, but I don't have much in the way of other plans yet.

I'm arriving in Portland by rail at 5.50pm on Tuesday, and departing 8.30am Friday morning by rail.

SuperLag: you mentioned a beer festival?

Tuesday evening, right after I arrive, if it's something quick I'll join in.
My Wednesday lunch is taken.

Here's a wonderful idea. Mash Google Maps with a wiki, and you get collaborative location documentation.

Here's Vancouver: http://www.wikimapia.org/#y=49280000&x=-123130000&z=11&l=0&m=a

Have you got access to DB2/Firebird/{Front,Sy,Open}Base ~~Oracle/DB2/SQLServer~~
Mind doing a little testcase for me?
You may need to change things slightly for other databases - I'd like to know what as well.

Give me the complete output - including what commands fail, and the exact numeric output.

CREATE TABLE test1 (i INTEGER PRIMARY KEY, n DECIMAL(30,10));
INSERT INTO test1 VALUES (1,12345678901234567890.0123456789);
INSERT INTO test1 VALUES (2,'12345678901234567890.0123456789');
INSERT INTO test1 VALUES (3,0.123456789012345678900123456789E20);
INSERT INTO test1 VALUES (4,'0.123456789012345678900123456789E20');
SELECT * FROM test1;

CREATE TABLE test2 (i INTEGER PRIMARY KEY, n DECIMAL);
INSERT INTO test2 VALUES (3,2.1);
INSERT INTO test2 VALUES (4,2.2);
INSERT INTO test2 VALUES (5,2.3);
INSERT INTO test2 VALUES (6,2.4);
INSERT INTO test2 VALUES (7,2.5);
INSERT INTO test2 VALUES (8,2.6);
INSERT INTO test2 VALUES (9,2.7);
INSERT INTO test2 VALUES (10,2.8);
INSERT INTO test2 VALUES (11,2.9);
INSERT INTO test2 VALUES (12,0.1234567890123456789012345678901234567890123456789012345678901234567890);
INSERT INTO test2 VALUES (13,1234567890123456789012345678901234567890123456789012345678901234567890);
INSERT INTO test2 VALUES (14,'0.1234567890123456789012345678901234567890123456789012345678901234567890');
INSERT INTO test2 VALUES (15,'1234567890123456789012345678901234567890123456789012345678901234567890');
SELECT * FROM test2;

Followup (2006/06/18 14h58):

So far I have submissions for SQL Server, Oracle 8i, Informix and PostgreSQL. I should have mentioned that I had already tested MySQL/Postgresql/Sqlite2/Sqlite3 myself ;-). These tests however have revealed some very interesting problems in using high precision numbers. What good is a column of DECIMAL(30,10), if Oracle decides to store it as 1.2346E+19? That's only 5 digits of precision. Informix stores it as 1.23456789012e19 - 12 digits of precision. Postgresql gets it right from the start.

The second interesting issue is SQL Server. If it's inserted in an unnormalized form, it works perfectly fine. However try to use a normalized form, and you get capped to 17 digits of precision. Alternatively, try to work around the apparent casting by giving it as a string (which incidently is required for MySQL), and it rejects the normalized form entirely.

Does anybody know how to get more precision out of Oracle? Or use normalized numbers in SQL Server without being truncated? - I don't want to have to store numbers in varchar(255) here - but if it comes to that, I may have to write code that optionally allows people to do that.

Bit of background: I'm trying to write complete decimal support for Ruby on Rail's ActiveRecord ;-).

So lately there have been a lot of complaints about nss_ldap-249+ breaking systems on boot. The source of this is actually not a breakage, but a change in behavior that exposed something that was always broken. Many of the comments below go for all NSS backends where the actual data source might not be available during the early phases of booting (because the LDAP server may not have started yet, or network may not be started).

In your /etc/nsswitch.conf file, you may have lines like:
passwd: files ldap
group: files ldap
If you have it the other way around, that's the first cause for breakage. The always-on sources need to be available at system boot time.

During boot, nearly every init script causes at least one lookup, in the cases of things like udev, it causes a lot of lookups, as it needs them. If it can find everything from the files nss backend, then it doesn't need to go to LDAP (or any other unavailable backend). In the case of udev, for a very long time there has been this rule:
/etc/udev/rules.d/50-udev.rules:KERNEL=="tpm*", NAME="%k", OWNER="tss", GROUP="tss", MODE="0600"
This causes udev to look up the user and group 'tss' (that's two lookups). Does your system have a 'tss' user and group? Unless you have the app-crypt/trousers package installed, you probably don't.

Ok, so if this has always been a problem, why did it suddenly turn up now? nss_ldap-249 has a change of behavior (badly documented by upstream unfortunetly). It changed from a hardcoded timeout numbers to using configurable timeout numbers, and greatly increased the timeout values. Previously, if the server was not available or otherwise had issues, nss_ldap failed out after at most 30 seconds (and a lot less if the server IP/port were actually unreachable). As of 249, it takes 124 seconds. It tries twice, then waits 4 seconds, then another 8 seconds, another 16 seconds, another 32 seconds, and finally another 64 seconds, with an attempt between each of the waits. Unfortuntely this behavior is serial, and happens for every lookup. udev tries to look up user 'tss', then group 'tss', etc. On some systems, this made the boot-up unbearly slow, as there were 30+ lookups that went to nss_ldap, at 2 minutes each, leading to an hour of waiting before the actual login prompt came up.

How do we fix this?
The proper way: For every Gentoo init script, we need to make sure that every value looked up is actually in the system files, so that no requests go to nss_ldap or any other remote backend. In the case of udev, this is a known flaw of udev, that it looks up stuff it doesn't need to. If somebody has enough time to look at the udev code, upstream would greatly appreciate it - they don't have enough time to do it. You can comment out the tss line temporarily as well if you want.
The temporary hack: I've commited nss_ldap-250-r1 that changes the default timeouts in the header files, as well documenting them, and the old ones, and even faster ones (read: more dangerous) in /etc/ldap.conf.

Side note: It does seem there is something that changed with regards to SSL behaviour in either openldap-2.3.* or nss_ldap between 239 and 249. In some setups, 'ssl on' no longer works, but specifying a plain ldap:// URL instead of ldaps://, and using 'ssl start_tls' works perfectly fine. If you run into this, move to TLS!

Stumbled over this wonderful commit to the tree earlier today.

In short, it allows you to dump pagecache/dentries/inodes for profiling stuff in the system. It's present in kernels newer than 2.6.16.

Cut from the docs:

To free pagecache:
 echo 1 > /proc/sys/vm/drop_caches
To free dentries and inodes:
 echo 2 > /proc/sys/vm/drop_caches
To free pagecache, dentries and inodes:
 echo 3 > /proc/sys/vm/drop_caches

As this is a non-destructive operation and dirty objects are not freeable, the
user should run `sync' first.

Current Music: Sigur Rós - Svo Hljótt

Interesting paper on the current differences between enterprise and consumer grade drives.
http://www.usenix.org/events/fast03/tech/anderson.html

Esp. see section 3.5 on reliability.
- Consumer drives are designed for 2400 POH (power-on hours) a year - running them for 9600 POH will double the failure rate.
- All drives are designed to run as cold as possible (25C room temperature) - an ambient temp of 40C will double the failure rate.

Ok, I'm back from my insane cycle now.

My legs are killing me.

Over the last 5 hours, I've cycled approximately 33km (best estimate via Google).

Route was as follows:

from home to charles and commercial drive (meet up with everybody else)

charles & commercial via dock road to the seawall

seawall to almost under the bridge, where it was closed. up and over the bypass road instead, stoping at the lookout point

continue around seawall to burrard bridge

stop at siegel's bagels just over the burrard bridge

split up into smaller groups heading home

follow false creek/1st to ontario

all the way up ontario to 37th, and then over to home

However, if I continue to do this, I'm bound to get healthier.

Current Mood: sore

As Marissa has gone off to an SCA this weekend (left this afternoon already), I figure I should actually try to do some non-coding things myself, beyond the Mother's Day dinner I'm attending with my parents.

So, I'm going to try out the Midnight Mass bike ride. Anybody interested, meet at Grandview Park, 11:45pm, second and fourth Thursdays of the month.

I'm just scoffing some Samosas now before I head out.

Move along, nothing to read

A dis-illusioned software engineer

Correction to BarCamp Vancouver 2006 posting about CACert Audit - Re: StartCom involvement

RAW processing of digital camera images

BarCamp Vancouver 2006

BarCamp Vancouver 2006 - Conferences notes - CACert - Robin Johnson

BarCamp Vancouver 2006 - Conferences notes - Secrets to a Killer Technology Speech - Rob Cottingham

Gentoo broke my brain

Been prodded into this

TODO list

Server Down

The inevitiable

Birthdays, growing older, and buying new toys for oneself

OSCON2006 phpMyAdmin reportback

OSCON2006 reminder

Wikis meet Google Maps

[Gentoo] Numeric Precision in DBs - Oracle/DB2/Firebird/MicrosoftSQLServer/{Sy,Front,Open}base

[Gentoo] Upgrading/using nss_ldap/nss_mysql/nss_nis/nss... and not breaking your system

[Gentoo] clearing pagecache/dentries/inodes without rebooting

(no subject)

Midnight Mass Cycle Event, May 11

Doing random things

Profile

May 2017

Syndicate

Most Popular Tags

Page Summary

Style Credit

Expand Cut Tags