come on down to clug park and meet some geeks online

Congratulations

First off, congratulations to the Launchpad.net team for reaching bug #1000000. They’ve managed to build a huge platform that scales very well. Very few bug trackers live to that milestone and it’s amazing how they have managed to keep it snappy and also keep downtime so low by doing continuous roll-out.

1 000 000 x 67

A million bugs are a lot, but even more mind-blowing: for every bug filed in Launchpad.net, 67 iPads have been sold. Educational institutions everywhere are jumping on the iPad bandwagon, and in the Edubuntu project, we believe that the tools are quickly coming together that allows us to deliver a product that can be truly competitive with the iPad in educational environments.

We’re currently re-designing the Edubuntu website and will soon have a dedicated section to this project, but in the meantime, please join us on the edubuntu-devel mailing list and introduce yourself, or on the #edubuntu IRC channel on Freenode.

Meta Track?

I’m glad you asked! At the Ubuntu Developer Summit, sessions are arranged by track. There are some topics that don’t have official tracks, but you end up seeing the same people in the same kind of sessions and it ends up being a track for all practical intents and purposes. One of these “meta-tracks” that emerged at this UDS was about software packages in Ubuntu. These were discussions related to how packages are organised in Ubuntu, how they’re maintained and synced with Debian, how to get upstream software developers excited about Ubuntu and more.

These were the sessions where I could walk in and be sure to find some combination of Stefano Rivera, Allison Randal, Asheesh Laroia, Evan Broder, Iain Lane, Andrew Starr-Bochiccio, Daniel Holbach, Andrew Mitchell, Micah Gersten, Bhavani Shankar and more in there

These sessions included:

• APT Improvements
• Upstream App Developer Documentation
• App Developer events
• software-center-q-client
• Backports BoF
• Continuing Packaging Guide Improvements
• Refine our SRU process to be more agile while avoiding too many pitfalls
• App Developer external outreach
• software-center-q-server
• Promote and encourage upstream delivery in Ubuntu
• Packaging requirements for Apps in Ubuntu
• LTS backport testing in 12.04
• Phased updates of software packages
• Merging / onto /usr
• Discussions of what should get uploaded to -proposed and when
• Review of the ARB process using MyApps
• Application Review Board
• Debian Health Check
• Developer Membership Board Discussion
• MOTU BOF Session
• Transition the archive to Java 7
• Finish the archive reorg
• Advertise new apps in the Software Center
• working session result of apt-improvements
• MyApps submission experience and expectations for upstreams
• Ubuntu App Developer Site incremental improvements
• Reaching out to future Ubuntu developers
• If a crash is already fixed by an update, prompt to install it

Archive Re-organisation

I’ll jump in with the big and controversial topic. When Ubuntu was founded, Canonical and the Ubuntu community was small and could only support a subset of the Debian archives. This supported subset became known as main. Initially it was less than 1GB large, the rest of what you’d usually find in the Debian main archive became known as Universe, and a group of people, named in jest after a he-man series, became known as the Masters of the Universe (MOTU) team.

Main was maintained mostly by Canonical staff and the universe archive was maintained by Canonical staff and community members. Over time, more and more community members started to maintain packages in main. Flavours such as Edubuntu, Kubuntu and Xubuntu were later allowed to install from universe and it was later enabled by default. In the initial LTS release, only main packages were supported long-term. These days, there are many packages in universe that are supported for the full 5 years on LTS releases. Previously, only packages in main had translations shipped for them. This is also no longer true. The lines between main and universe have become so blurred that having the separation no longer made any sense. Around the last LTS release (10.04), the topic of an archive re-organisation emerged. It was a big discussion, and when the Developer Membership Board was formed the MOTU Council was disbanded (which in my opinion was a bad idea) in part of that and also in anticipation for the archive re-organisation. Some people took that as meaning that MOTU is dead or that it would stop to exist. That is certainly not the case.

Unfortunately, the archive re-organisation became very complicated very quickly. There still needs to be a way for Canonical to identify packages that they officially support if someone wants to throw money at them for supporting it. We can’t have everything translated because the language packs would just grow too big. How would we deal with managing build-dependencies and make sure that people depend on high-quality tools and libraries? Soon after the initial archive re-organisation was started, it stalled. In my opinion this caused lots of confusion and did damage to the Ubuntu project.

Having said that, I’m glad to report that the discussion at this UDS was extremely positive and it seems like the archive re-organisation might actually be completed over the next two releases. Other benefits will include how support meta-data is stored. The tools that currently use the support fields (update-manager, ubuntu-support-status, software-center, etc) will now get the support metadata from an external file, which means that packages in Ubuntu wouldn’t need a diff with Debian’s packages anymore for support meta-data. Also, the archive layout will be simpler and easier to understand. MOTU would probably change from “Masters of the Universe” to “Masters of the Unseeded”. Packages that are seeded are packages that are provided on standard Ubuntu flavours (Ubuntu Core, Ubuntu Desktop, Ubuntu Server, Edubuntu, Kubuntu, Xubuntu, Lubuntu, etc). The rest of the archive that are unseeded would then still be maintained by a newly defined MOTU group.

It’s a big hairy issue and I’ve just touched on some of the areas, but what’s great is that progress is being made again and that people are serious about making it happen. Colin Watson has a work item to take the discussion further on the Ubuntu development mailing list. I’m positive that things will be moving forward on that front for this cycle, even if it ends up taking another cycle to iron out some of the smaller kinks.

Application Review Board

In a previous cycle, Canonical put together a process by which application developers could get their non-free, commercial applications in to the Software Center via authenticated PPA. It seemed unfair to have a process where non-free software could make it into the Ubuntu software center but free software couldn’t, so a process was formed to let apps in the software center via an extras repository. This process is overseen by the Application Review Board. I joined this board right about 6 months ago. We’ve had the usual problems that Ubuntu teams have (because, in reality the ARB is more of a team than a board, the name is a misnomer, I wish less Ubuntu teams had this issue), like lack of time, getting sporadically distracted by other work, but on top of that, we didn’t have our process quite smoothed out yet. The web interface that we used to manage apps had some huge issues (like making apps completely disappear from the interface when requesting feedback from the developer).

For the last weeks, quite a few people have worked hard to help fix the issues in the process and in the web app. There were *many* sessions at this UDS regarding upstream developers, the ARB, the MyApps web interface, etc. At times I thought that there were too many, but it was just right. A lot of issues were discussed, problems were solved, and while I felt like the ARB process was in an alpha stage during the last cycle, I think it’s more like a beta-state process now. I think we’re very close to having a process that’s smooth and easy for both the people that submit these apps, and the people who review them.

Currently the ARB has some backlog that we need to sort through, we’ll probably use that to help improve the process further and make Ubuntu a fun and welcoming platform to develop for.

We also absolutely want people to contribute their software to the right place. If a package belongs in Debian, Ubuntu, a PPA or any other archive instead, we’d like to advise the user properly. I took a work item to put together a flowchart to help people decide where to submit their app, because there’s way to many guides and howtos and someone could read the entire New Maintainers Guide and still won’t know where to submit their app

I know I’m a bit thin on the details on the sessions here, but I’ll do more blog posts on that. I just wanted to provide some background and explain that good progress is made, and that things are greatly improving with the ARB process. In the ARB, many of us are aspiring to becoming Debian Developers so that we can help sponsor packages there when it’s appropriate.

Debian Health Check

The Debian Health Check session as become a regular session at UDS. We had a bunch of DD’s in the room that could comment on the Debian-Ubuntu relationship, but we didn’t have someone who specifically represented Debian. Some of the issues I’ve mentioned previously (like the ARB) were discussed. Also the Ayatana patches from Ubuntu that are hard to get into Debian (which includes Unity).

What is nice is that we have quite a few people who started out with Ubuntu that became Debian Developers. The relationship between Debian and Ubuntu seems quite healthy and it seems that both projects gain great benefit from each other.

MOTU Birds of a Feather

The archive-reorg was discussed, and MOTUs future role was discussed in anticipation of it. There was some discussion about things that have worked well in the last few cycles that should be revitalised. MOTU needs some more announcements of what it’s doing to cause some buzz around its activities. Too few people know what MOTU does and how it does it. Evan Broder and I plan to try some experiments with Facebook ads to see what kind of people/interest they bring in MOTU

The MOTU team is also very eager to get long-term ARB apps into the archive. Having apps in universe would mean less work and restrictions than having them in extras.

As MOTU we’re very committed to it and its goals, but there needs to be some restructuring/updating of the current documentation. It might also need a new vision/mission-statement, etc. This cycle is going to be a revitalisation cycle for MOTU in whatever form it will continue to exist. We hope that many people will get excited about packaging and quality in the Ubuntu archive and help contribute to that

Getting it all down is impossible

I wish I could do a better job at this blog post, but I’m still somewhat suffering from information overload from last week, and if I try to get it perfect and get everything in there then this post will never get finished. If you have questions, feel free to give a poke on #ubuntu-motu on freenode, there’s bound to be someone who could answer questions on any of these topics if you’re willing to hang around a bit. I still haven’t even touched on Backports, APT improvements, SRU streamlining, etc, but you should be able to find most of the information from those sessions in their blueprints. If you’ve made it this far, thanks for reading!

Media week..

• Monday, woke up at Andrew’s house, events meeting, press release writing.
• We moved around the office again at the end of last week.. ended up closer to the creative team.

• “Mxit musical chairs.. grab a seat when the music stops.” — Dirk about office moves.

• Tuesday, woke up with a stiff neck, Chinese back massage, did not make it to Netprophet this year, more press release writing, sunset podcast walk, Mia visit.
• Wednesday, Gusted a smoothie, had my ADSL line at home installed, beer with Parri and Alex, Mia’s school cheese and wine.
• GUST the news this week: BandwidthBlog, Memeburn, TechCentral, BizCommunity, Memeburn, ITWeb, Times Live.
• GUST mentioned on Podcasts this week: ZA Tech Show (at 54:37 and 1:10:50), Talk Central (at 7:40).
• TrustFabric in the news this week: ITWeb.
• Pro tip: Form first.
• Thursday, Gusted a smoothie, Gust meeting, Gino’s #hackstb planning meeting, dinner at Paul’s house and a blind wine tasting.
• Friday, Mxit Formal Friday, beer with Werner at De Akker, braai at Dirk’s house.
• Saturday, tea, Mia and I watched Star Wars Episode 2, botanical gardens with the family, Wakaberry frozen yoghurt, Star Wars Episode 3.
• Mia’s new party trick: making heart shapes out of cable ties.
• Sunday, woke up at 7:00 after having been migrated to three different beds during the night, Star Wars Episode 4, braai at Al’s house with Paul and Henk.
• I’m speaking at the ITWeb Securuty Summit 2012 on Wednesday.

Have a fun week, crazy kids.

Edubuntu 12.10 Plans

Today at the Ubuntu Developer Summit we had a session to plan out the next release of Edubuntu.

For the Edubuntu 12.10 core product, we’re doing some typical Edubuntu updates and features, which include:

• Authentication step in the installer for AD/Samba4/LDAP
• We’ll be reviewing the installed apps, add gnote, refresh the kde-edu apps selection
• Dynamic installer slideshow, based on options selected
• Juju charms for educational web apps (Moodle, WordPress Multisite, etc)
• Remote Live Installer (booting an Edubuntu/Ubuntu livecd over the network
• Education-specific software highlights in Software Center
• Speed-up installation by optimising the way we ship language packs
• A variety of Desktop/Artwork tweaks and fixes

Edubuntu Labs: Get Excited and Make Things

On Tuesday I had 2.5 minutes to speak about Edubuntu during a plenary session where I presented some of our more ambitious plans in Edubuntu. We want to make it easier for people to work on their ideas and projects that might be good for Edubuntu, but that doesn’t necessarilly fit into our main product yet or in a 6 month release cycle. For that, we’re starting Edubuntu Labs (subject to namechange). A playground for experimental and exciting features that might one day make it as a supported Edubuntu product. Internally, we’re starting two of these projects to kick it off.

1. Edubuntu Server

Edubuntu Server is a product we discontinued a few years back. Due to popular demand, we’re considering reviving it as a product. Aspects we’re currently investigating:

• Zentyal Small Business Server
• A built-in disk-cloning tool using LTSP
• A remote installer for Ubuntu based installer media
• Schooltool
• Schooltool integration into Zentyal
• Samba4

2. Edubuntu Tablet

All of this is still early work, but I wanted to get it out there as early as possible. Over the next 2 weeks there’ll be more official announcements on the Edubuntu website. We’re looking for more contributors to help us out with this, please join us on #edubuntu and add it to your autojoin and introduce yourself on the edubuntu-devel mailing list

If you’ve been for a walk around Stellenbosch with Alan Knott-Craig in the last few weeks you would probably have seen a demo of a new geo-fenced mobile payment system. These walks usually end on the top floor of Mxit‘s office where the barista is busy making coffee.

The idea with the Gust project was to design a really quick mobile payment experience (without NFC).

Mxit staff can buy lunch at about 15 places around Stellenbosch using their mobile phones. One restaurant had poor GSM signal which made the payment process a bit unpredictable and slow. While walking back to the office, ideas for a better payment experience were discussed. Six weeks later the Gust payment system was launched at a Mxit party.

Gust runs on an iPhone. The merchant side runs on an iPad. When two devices are close to each other the merchant can request a payment from the mobile phone. Unlike other payment systems which use geo-fencing logic, Gust does not need a GPS device or even a GSM connection. It will happily run on an entry level iPod Touch.

Gust devices on the same wifi network will discover each other. All communication happens over the wifi network which makes the payment process really fast. That’s where the name Gust comes from… rapid burst of wind.

Gust simply uses wifi, your name and our photo to make a payment. When a user’s phone joins a payment location the merchant’s iPad shows a list of names and photos of Gust users connected to that payment location. After a user places an order the merchant sends a payment request. The user sees a payment request and approves it.

The Alpha version video (quick hack):

Mxit staff have been using an Alpha version of Gust around Stellenbosch since early April. The first public demo was at a recent #hackstb meetup.

The Beta is in development and should be out in June. Stellenbosch only for now.

Follow @GustPay

Star Wars and playing single dad..

• Monday, family lunch at Glen Carlou, watched UP with Mia.
• Tuesday, public holiday, Mia watched UP while I sorted out some camping equipment, family outing to Cape Town, gym, swim, Deer Park, Jimmy the Fish with Mia, UP.
• Winter. Drinking lots of tea. For some reason Mia still wants her rooibos tea in a bottle.
• Wednesday, dropped Mia at school, gym, fetched Mia, got some duct tape and fixed my tent, we watched Eight Below.. and we both had a bit of a cry, walked to Wijnhuis for pasta.. the food and service was not great but I enjoyed dining with Mia.
• Thursday, dropped Mia at school, gym, Gust meeting, fetched Mia, pizza at Gino’s.
• The next round of Gust dev has officially started.. expect a Beta around mid June.
• Friday, Mia was not feeling well so we skipped school, worked at home, Mia watched UP, office, calamari, red velvet cupcake at Nook, found a new home for my offsite backup disk, lemon meringue with Petr, Piet and Parri, Mia made an artwork with duct tape and cable ties, we watched Star Wars episode 4 – May the 4th is a good day to watch the first episode for the first time.
• Seems I need about 3500 Vitality points to get to Diamond status.
• After watching UP a few times Mia made me a Book of Adventures with 14 countries I’ve visited (13 actually, she added a page for AfrikaBurn).
• Saturday, tea, Star Wars episode 4, Cape Town, gym, swim, Deer Park with Sarah, a beer at Carlyle’s with Georg while Mia played at Sarah’s house, we watched Star Wars episode 5.
• Sunday, tea, we watched Star Wars episode 6, Blaauklippen market, a Guinness at Erinvale, Naulene fetched Mia, Andrew visit.

Have a fun week, crazy kids.

This is probably old news for most serious Apple users, but I just discovered it yesterday. As a Geek I feel disappointed in myself.  I should have read the documentation and known from the start, but alas, I just installed OSX Lion and did not read much about it before I installed.  I just read the normal stuff Apple had on thier website.
But then, Apple did not advertise the information too, I stumbled onto it yesterday in the Apple Support forum.

read more

You charged me a R114 connection fee, but it’s been six days since I signed a contract with you, and my cellphone number still has not been ported from Virgin Mobile. I paid, but you didn’t do the work.

This morning the Virgin SIM stopped working, so now my friends and co-workers cannot reach me. Having been stranded between Cell C and Virgin Mobile’s incompetence, I’m now using a pre-paid 8ta SIM, on the phone you sold me with the contract… that is how lame you are.

I wouldn’t have bitched about this on this blog, but I don’t know how else to get the message to you:

• Your normal support call center number does not work from either my (Telkom) office line, or from my Virgin mobile SIM (before it stopped working completely). If I call the Cell C general reception, they are able to put me through to support, who then put me through to your porting center, who consistently shift the blame to Virgin Mobile, and tell me to wait another day for the port to be completed.
• The “contact us” form on your web site is broken, but also sadistic in two ways: The CAPCHA images themselves are unusually difficult to decode (as a human), and after about the 10th attempt that you’re fairly convinced you decoded correctly, you realize that it always rejects your inputs, correct or not.

Since Virgin Mobile is an MVNO customer of yours, I won’t buy the excuse that you can’t quickly coordinate with them to make the number porting succeed.

I’m beginning to regret signing up with you. Perhaps I should have taken the MTN deal.

If you want to turn me into a happy customer, fix the problem, today, or if you can’t (eg, you can only fix it tomorrow or later), also refund the connection fee as a show of good faith.

Yours sincerely,
Simeon.

Is Mandela dead yet? Find out now!

UPDATE: Site is dead, so link removed.

This is the fourth post in a series of articles about Mantissa.

In the previous article I described how an offering can provide powerups to be included in a product, which will then be installed on a user store; in this installment, I will discuss what form these powerups can actually take, and how they allow you to expose your application’s functionality to the user.

One of the most commonly-implemented powerup interfaces in Mantissa is INavigableElement. Mantissa has a somewhat generalized idea of “navigation”, whereby a nested menu structure can be defined through INavigableElement powerups, and then displayed by different implementations for different protocols; for example, the web view has a visual dropdown menu system, whereas the SSH server presents a textual menu system. A typical INavigableElement powerup implementation will look something like this:

from zope.interface import implements
from axiom.item import Item
from axiom.attributes import integer
from xmantissa.ixmantissa import INavigableElement
from xmantissa.webnav import Tab

class PonyCreator(Item):
    """
    Powerup for creating and managing ponies.
    """
    implements(INavigableElement)
    powerupInterfaces = [INavigableElement]

    ponyQuota = integer(allowNone=False, default=10)

    def getTabs(self):
        return [Tab('ZOMG PONIES!', self.storeID, 1.0)]

INavigableElement only has one method, getTabs, which returns a list of “tabs” or menu items to be presented in the nav. The primary components of a tab are a title (which is how the item is displayed in the UI), the storeID of an item in the same store which the tab points to, and a float between 0.0 and 1.0 indicating the sort priority of the tab (higher values sort sooner). In this case, we have the tab pointing directly at the PonyCreator item itself; in order for this to work, we’ll need some extra code to allow PonyCreator to be exposed via the web.

In order for an item in a user’s store to be privately accessible via the web by that user, it needs to be adaptable to the (somewhat poorly-named) INavigableFragment interface. This is almost always done by defining an adapter from the item type to INavigableFragment:

from twisted.python.components import registerAdapter
from nevow.athena import LiveElement
from xmantissa.webtheme import ThemedDocumentFactory
from xmantissa.ixmantissa import INavigableFragment, ITemplateNameResolver

class PonyCreatorView(LiveElement):
    """
    Web view for Pony management.
    """
    implements(INavigableFragment)

    title = u'Pony management'
    docFactory = ThemedDocumentFactory('pony-creator', 'resolver')

    def __init__(self, ponyCreator):
        super(PonyCreatorView, self).__init__()
        self.ponyCreator = ponyCreator
        self.resolver = ITemplateNameResolver(self.ponyCreator.store.parent)

registerAdapter(PonyCreatorView, PonyCreator, INavigableFragment)

Our element will be wrapped in the Mantissa shell when it is rendered, so we cannot control the page title directly from the template, but the title attribute provides a way for our element to specify the page title. ThemedDocumentFactory is used to retrieve the template through the theme system; the arguments are the name of the template (‘pony-creator’) and the name of the attribute holding the ITemplateNameResolver implementation used to retrieve the template. This attribute is set in __init__ using a slightly awkward method; the template resolver should really be passed in by Mantissa somehow, but currently there is no mechanism for doing this, so instead we retrieve the default resolver ourselves from the site store.

This is all that is needed for hooking some code up to the web view; any further UI behaviour would be implemented in HTML / JavaScript in PonyCreatorView, usually by invoking additional methods defined on PonyCreator.

Next up: Sharing, or “How do I publish public / shared content?”

Evolution of a Linux desktop user:

1. Get XFree86 to work on your S3 graphics card under Linux, dabble with FVWM and Windowmaker.
2. Discover KDE in their 1.x days – become a fan of the heavyweight desktop environment.
3. Keep using KDE, notice how each release gets faster than the previous one, think you’ve found desktop nirvana with KDE 3.5.
4. KDE 4.0 is released, postpone package updates so that you can stay with 3.5.
5. Eventually give up and make a painless switch to Gnome2.
6. When Ubuntu makes Unity the default desktop, keep using Gnome2.
7. Gnome3 is released, postpone package updates so that you can stay with 2.
8. Eventually give up and try KDE ~4.5, watch it crash. Upgrade your Ubuntu to 11.08 to get KDE 4.7.
9. Use KDE 4.7 for three weeks, notice that it is still much worse than KDE 3.5 or Gnome2 was.
10. Realize that upgrading your Ubuntu nuked Gnome2.
11. Try Gnome3 for 2 minutes, notice it’s gone 10 years backwards in terms of features.
12. Try the Cinnamon interface for Gnome3, wonder how you move the workspace switcher to another panel. After discovering on a forum that it requires editing stuff in Dconfig – give up.
13. In a last act of desperation install MATE (the Gnome2 fork). Log in, watch it crash.
14. Install XFCE, customize it to behave like Gnome 2. Carry on with your life.

Of course, if XFCE becomes popular enough, hipster coders will remove all the features and make it look like the latest desktop environment from Apple. Then you’re off to install LXDE.

What is the sustainable solution?

Buy a Mac and get the hipster interface, but with more features and less bugs?

Today I upgraded. Yeah, it’s late — I delay my upgrades by a couple of months so that the early adopters set off all the landmines (thanks, guys).

It was a mostly painless upgrade. On the whole, Ubuntu’s compatibility with non-standard WMs (like Fluxbox) seems to be improving steadily — so to everyone who is still whinging about Unity: try another WM. It’s officially not hard anymore.

A quick rundown of issues:

Volume control

gnome-volume-control-applet is dead, and has been replaced by gnome-sound-applet. It’s a GTK3 app, so it’s going to be hideous until you set the GTK3 theme (see below).

Autostart

It looks like a few more of the config files in /etc/xdg/autostart/ have stopped dissing non-GNOME WMs for no reason (the one for the Network Manager applet, for example), so fbautostart starts a bunch more stuff and I don’t have to do it myself.

Goodbye, gnome-settings-daemon

I figured out how to set up compose keys without gnome-settings-daemon, and thus have been able to eliminate it. Good riddance.

update-notifier and privilege escalation

I fixed this The Right Way, so no more --force-gksu. The right way involves starting /usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1, which is sadly still dissing non-GNOME WMs. It would have been even more correct to edit the autostart file than to add it to .fluxbox/startup, but this way is shorter.

My current .fluxbox/startup (it’s shorter without the comments)


# (here I run an xrandr script to auto-detect the monitor layout)
# the thing that fixes update-notifier
/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1 &
# the thing that starts all the XDG autostart things
fbautostart &
# compose keys
setxkbmap -option compose:rwin
setxkbmap -option compose:lwin
# super old-school system monitor
gkrellm -w &
# the new sound applet
gnome-sound-applet &
# the thing that makes my screen red at night
gtk-redshift -l -33.92:18.42 -t 6500:5500 &
# the thing that gives me multiple clipboards
klipper &
# my awesome quakelike terminal
yakuake &
# the thing that actually launches Fluxbox
exec fluxbox


Themes and fonts (or OMGWTF, could you all possibly try to interoperate?)

The good news is that you can set themes and font hinting for all the things. The bad news is that with the arrival of GTK3, the number of config files where you need to set what is mostly the exact same information — unless you’re one of those weirdos who only run apps from one toolkit — has ballooned hilariously to four. Yes, four. And that’s assuming you don’t care about GTK1 or Qt3. Let’s take a tour:

GTK2

Theme: can be set with gtk-chtheme. That goes in .gtkrc-2.0. The generated file includes .gtkrc.mine, so that’s where you should put custom things, like…

Font config: goes in .gtkrc.mine, and looks like this:

gtk-xft-dpi=96
gtk-xft-hinting=1
gtk-xft-hintstyle=hintmedium
gtk-xft-rgba=rgb
gtk-xft-antialias=1

Qt4

Theme: can be changed with qtconfig-qt4.

Font config: goes in .Xresources, which looks like this:

Xft.dpi: 96
Xft.antialias: true
Xft.hinting: true
Xft.rgba: rgb
Xft.autohint: true
Xft.hintstyle: hintmedium
Xft.lcdfilter: lcddefault

I assume that KDE overrides these settings if you run enough of it.

.fonts.conf

I forget why this is important. I think Firefox needs it, or something. Anyway, it looks like this:

<?xml version='1.0'?>
<!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
<fontconfig>
<match target="font">
<edit mode="assign" name="rgba">
<const>rgb</const>
</edit>
</match>
<match target="font">
<edit mode="assign" name="hinting">
<bool>true</bool>
</edit>
</match>
<match target="font">
<edit mode="assign" name="hintstyle">
<const>hintmedium</const>
</edit>
</match>
<match target="font">
<edit mode="assign" name="antialias">
<bool>true</bool>
</edit>
</match>
<match target="font" >
<edit mode="assign" name="dpi" >
<double>96</double>
</edit>
</match>
</fontconfig>

GTK3

GNOME Tweak Tool won’t work unless you run the settings daemon. I’m afraid you currently have to do everything by hand, by editing .config/gtk-3.0/settings.ini, which looks like this:

[Settings]
gtk-theme-name = Adwaita
gtk-fallback-icon-theme = gnome
gtk-font-name = DejaVu Sans 10

gtk-xft-hinting = 1
gtk-xft-hintstyle = hintmedium
gtk-xft-rgba = rgb

Credits

Tumbleweed, Nitwit and the rest of #clug; and the good people who write documentation for Arch Linux (you have the best documentation, seriously).

ETA: oh, yeah, here’s how you turn off those stupid hide-and-seek scrollbars (they’ve been annoying me since Natty, but I only found out what they were called today).

I should have blogged a while ago about this, but didn't get around to it till now...

I decided a few months ago that I wanted to have an Ubuntu hour in Cape Town, as most of them happen out in Stellenbosch, and I don't really get the time to drive out there. In true open source style, if you want something done you need to do it yourself (not in a negative sense though, it's more like a self-help style thing), so I started organising it.

I eventually decided to hold it in Rondebosch, as that seems somewhat central, and after asking the Ubuntu-ZA mailing list and setting up a Doodle, it seemed the best day was the 11th of Feb.

I was rather worried that I would be the only person who could make it, since a few people indicated that they might not be able to make it, but in the end we had 8 people there. In terms of numbers it was a success, but I did rather wish there were more non-techie people so that we could answer questions people might have about open source software and Ubuntu.

Maia has some pictures of the event over on her blog: http://my-ubuntu-day.blogspot.com/2012/02/feb-ubuntu-hour-rondebosch.html

• apache2 - standard Apache 2.2 webserver on Ubuntu 11.10
• php-apc - Alternative PHP Cache, providing shared opcode cache
• libapache2-mod-fastcgi - FastCGI module capable of talking to php-fpm.
• php5-fpm - PHP FastCGI Process Manager. Does what it says on the box.
• APC Object Cache Backend - WP can use APC to retain objects between requests.
• WP Super Cache - cache pages to static HTML

<IfModule !mod_php5.c>
<IfModule mod_fastcgi.c>
        Alias /php5.fcgi /srv/wordpress/php5.fcgi
        FastCgiExternalServer /srv/wordpress/php5.fcgi -host 127.0.0.1:9000
        AddHandler php-fpm .php
        Action php-fpm /php5.fcgi
</IfModule>
</IfModule>

RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteRule ^files/(.+) wp-includes/ms-files.php?file=$1 [L]
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
RewriteCond %{REQUEST_URI} !^/php5.fcgi
RewriteRule . index.php [L]

Two friends of mine recently purchased iPads - Vernon asked me, as a computer fundi, to help him out on the installation. I always think it is useful to document first-time experiences - one adapts and forgets so easily.

Old timer

I have used Linux pretty much exclusively for the last 20 years. I have a pragmatic approach to my friends who use Windows - I have followed Microsoft's offerings from Windows98 through XP - I have an XP user's understanding of the later versions of Windows.

Apple I have pretty much never used. I have never owned one, I taught people how to use the original MacDraw, but pretty much have never used it since. So, when Vernon took advantage of First National Bank's interest-free loan to buy one, and asked my to check it out, I dashed over.

Fresh out of the box at his workplace in Cape Town, battery charged.

Internet

First hurdle - registration. There are a couple of Welcome.. screens, Name, country, etc. Pretty soon, it wants to get online to talk to Apple. Well, we had no wifi in his workplace, and the GSM SIM card was a "micro" variety, so I couldn't pull one out of my Nokia and get past that.

Failure.

Strike #1 - I can't even use this thing without Internet ? Ten years ago, this country only had dialup, and that was expensive. Requiring Internet before doing even the most basic things like taking a picture, writing a note, experiment with the touch screen ?

Vernon knew what to do - buy a SIM card, load with 100Mb data (costs R50, about $8). Weekend comes around - Andy, stop over. Some trouble getting cellular data to work through Vodacom. I had internet from my netbook tethered through my phone - google, ask on forums - ah, I need to enter "Internet" as the APN for the service provider. Would Vernon have figured that out on his own ? I don't think so.

As a side note - Ubuntu Linux knows all the main cellphone carriers in South Africa, and if I choose Vodacom on Ubuntu, it knows to put "Internet" as the APN (thanks, tumbleweed).

We walk through registration, no problems. Vernon had taken advantage of a free 1 hour course at the Apple store, and came away with "iCloud". So, we must hook that up.

An iPad manual

Back up a little - let's RTFM. Where is the iPad manual ? Nothing in the box - no paper, no CD (haha - no CD player on the ultra-thin iPad). A tap on Safari, a quick google - there is the manual, as a PDF on Apple's website. Old-Skool says:- "Save the pdf on the desktop". Safari has no options for that - wtf? Seems I am indeed old-school - the iPad has no desktop. Wait a minute - the out-of-the-box iPad comes with no manual, and there is no way to save a copy locally ?? More googling - oh - I must download the iBook application, and then get the (free !) iPad user manual. Sigh - consider it done.

Strike #2 - I need internet, some savvy, a new app, and a download just to read about how this thing works.

iCitizenship

Back to iCloud - Vernon had been told at the course that he needed a "United States" designation for his iCloud registration. Seems the only iCitizenship worth having is a US one - otherwise no music downloads and app restrictions, or something. I trust the Apple store man - how to do this? More googling - you need to attempt to get a free app from the Apple store, choose "None" as a method of payment, lie about your address, lie about a US phone number.

Strike #3 - to get the full benefits of this new iPad, one has to pretend to be a US citizen. South African simply doesn't cut it. You can buy it here, but there are heavy restrictions on its use.

GSM standards

OK - nearly there with the iCloud registration. Oops - I have no data left. Yep - I have burned through 100Meg of data just to get this far. A trip to the corner store - buy R110 pre-paid airtime, pull the micro-SIM out of the iPad, delicately put it in my phone (which takes a normal size) and walk through the USSD menus to load the airtime, and convert R100 of it to data bundles. R10 left behind as voice - whoopsie. Chalk that up to Vodacom ineptitude.

Strike #4 - the iPad comes with no SMS/USSD interface to the GSM network that would allow you to recharge a pre-paid SIM for data. You must take the SIM out and do it on a phone - that may not take the same size SIM.

Apple is using GSM - iOS (the operating system) is common with the iPhone - yet Apple stripped the GSM bits out of the codebase for the iPad.

OK - now we are sorted. I am unwilling to experiment much with iCloud - I have a feeling it could gobble up all my data again if I accidentally tap "backup" or something.

Games - nope - just a Games portal - go buy one. What, not even tetris or mines ? Oh well, was not really interested anyway.

Browsing is slick and fast, some study of the manual and gestures are easy and intuitive. Some struggle with outdated concepts like stopping running applications - I was pointed to this article by my Linux User Group.

Bluetooth

OK next - will it see my Nokia phone over Bluetooth ? My phone sees the iPad - tries to pair with it - nope. The iPad never sees my phone.

Strike #5 - Apple uses standards like Bluetooth for things like external keyboards, but does not bother to implement the standards properly.

Its like they think they are so big they don't have to bother. Receive a business card from my phone via bluetooth ? Pah - you must talk via Internet please. No matter that others value interoperability, here at Apple we have our own way of doing things.

I have paired my old Nokia phone with my newish netbook via bluetooth. I can easily move photos back and forth, and without even taking my phone out of my pocket the netbook will use it as a gateway onto the net. I can see that this brand new Apple iPad will not allow me to do that - either acting as a gateway, or being able to use my phone as a gateway for the iPad (which would have got over Strike #1 if I could have reached the settings menu, which I could not).

USB

And, last but by no means least - I cannot plug a USB stick into the iPad.

Strike #6 - there is not even a physical interface for a USB stick (or drive).

• Floppy disks were good in their day - but they got too small and unreliable. Snif - floppies are gone.
• CD were fantastic in their day - ubiquitous for two decades, they were the workhorse of transferable media. Now they seem bulky, small, and a tad unreliable. Snif - CDROM drives are fading from the landscape.
• USB disks are small, everywhere, fit on your keyring, and absolutely rule for data transfer. Even virus-writers target them, they are that convenient. The sun has by no means set on the USB thumb drive, but Apple, in their wisdom, choose not to provide an interface.

Now, that is just nasty. That was deliberate. I saw what you did there. And I am calling you on it.

And, just because of Strike #6, I am reviewing your motivations for Strikes 1 thru 5. I could have given you the benefit of the doubt over SMS, Bluetooth and Internet, but I see now this is deliberate.

Summary

The iPad lives up to its reputation as a beautiful piece of hardware. The Multitouch screen is a true Apple innovation, and is a pleasure to use. The few apps I tried seemed nice. Read about that elsewhere - it is all true. But the level of control that Apple assert over the products they sell brings the ugly out in me.

Apple - I will not be buying your products any time soon.

A few weeks ago I started receiving calls from this number on my cellphone. At first I got several a day. Then they slowed down to a trickle — one every one or two days, at random and inopportune times. If I answered, I heard complete silence until the call terminated. When I called back, I discovered that the number was invalid. When I searched for the number on the internet, I found similar reports about nuisance calls from other people, some of them overseas. This didn’t look like a deliberate crank caller — more like a misconfigured call centre. The calls were getting really annoying, though, and I wanted them to stop. So what were my options?

1. Software

If you have the right kind of smart phone, you can install software that will block specific numbers. I have a Nokia 6822, so I very much doubt that I can (if I’m wrong, please let me know in the comments).

2. My cellular provider

Surely MTN can block specific nuisance callers from making calls to your number? MTN Afghanistan can do it. How hard can it be? Impossible, apparently. According to MTN, all they can do is block all incoming calls to my number, which is not very helpful. The MTN representative suggested that I call the police to have the number investigated.

3. The police

Um… no. I’m not going to call the police to complain about a misconfigured call centre. I’m pretty sure they have actual work to do.

4. Telkom

Telkom issued this landline to someone, so they should be able to do something if they’re misusing it, right? I searched the Telkom page for an appropriate avenue for this kind of complaint. I couldn’t find anything specific, but they do have a crime hotline for reporting “criminal and unethical behaviour affecting Telkom”. I guess being negligent when configuring automated phone systems is “unethical behaviour”, so I gave it a shot yesterday, after receiving yet another call.

The crime hotline operator said that they had no ability to investigate issues of this nature, and instructed me to call Telkom directly (apparently the Telkom crime hotline isn’t Telkom). So I called the normal Telkom helpline, and after a lot of waiting and ignoring automated options I was redirected to an actual human. After hearing my story, he said, “Ooh, we have a department for just this kind of thing,” and dictated the number of the crime hotline.

After explaining that the crime hotline had just redirected me back to Telkom, I eventually persuaded him to look the landline number up. So he did. And then he said, “but that’s our call centre number!”

There you go, people googling this who are trying to find out who keeps robo-calling them. It’s Telkom! Mystery solved.

Telkom Guy said that he would escalate the issue to his supervisor, who would call me back (I hope after investigating why one of Telkom’s own call centres was randomly spamming people with silent calls).

About half an hour ago, I got another call from the call centre. I picked up, thinking that perhaps it was the promised return call from Telkom Guy’s supervisor. It wasn’t. It was a Telkom call centre operator trying to sell me an ADSL line. I explained that I already have a Telkom ADSL line, briefly summarised the problem, and asked to be removed from their call list. Did it work? I guess I will find out tomorrow.

Get your priorities straight
There is nothing more important than enjoying your life. Making sure that other people are enjoying their lives comes in at a close second. You are not a useful human being if you are not enjoying your own life.

Don’t sweat the small stuff
Gary Player famously said that the more he practiced the luckier he got. You can reprogram the way your brain reacts to truly stressful situations by practicing positive, stress-free, reactions to the little things that go wrong every day.

Get some perspective
Most of the stuff you worry about is simply not important. Your family and friends are what matter. They are irreplaceable. Your car getting stolen, your house burning down, losing your job, while all sad and frustrating, should not result in emotional trauma.

Emotional trauma is scar tissue
Years ago I broke my big toe by kicking a wall. It was stupid and every now and then my toe hurts for no reason. If you repeatedly kick a wall your toe is going to hurt all the time and you are not going to be able to enjoy your life.

It’s not over until you’re dead
Your health is important, but not more important than enjoying your life. I’m not suggesting you start a small heroin habit, but worrying about your health is futile unless you’re doing it while calling a doctor.

Put on your big girl panties when dealing with family
There are situations in life where you just need to make hay, even if you’re allergic and the sun isn’t shining. The normal rules of engagement do not apply for family. “Not talking” to some branch of your family is an incredibly sad outcome that should be avoided at all costs. No one is asking you to paint each other’s nails while watching Thelma and Louise on VHS, but for everyone’s mental health, including your own, sometimes you just need to just get out there in the rain and start throwing around some hay.

Appreciate what you have
Be thankful for the things you have, not because one day they might be gone or because others don’t have them, but simply because you do have them.

Stretch
This is not a computer game. When you die your life is over. Try and be incredible or die trying.

Yourself is the best you you can be
Countless Facebook posts will encourage you to sing like no one is listening. That is rubbish. Being yourself is the only way to be happy. This is not rocket science. If you want to sing, sing. If you want to spend your weekend reading a book to your cat, do that.

Stop
Close the door, put away your phone, sit down and spend some time thinking. Call it whatever you want but just do it, daily if possible.

This news is a few weeks old but I kept on meeting people who hadn’t heard so I figured a blog post was in order.

I have officially left TrustFabric and have joined Praekelt. Leaving TrustFabric was a hard decision. If Joe can pull of what he’s got planned, and I think he can, he will change the way we manage and share information online. I want that to be a reality.

My first few weeks at Praekelt have been great. I am now in a pure strategy role. Travelling back and forth between JHB and CPT, meeting amazing, talented people, having my mind expanded and learning constantly. My diverse background (travel, banking, advertising, telecoms, ISPs, online dating etc etc) is proving to be useful in ways that I never thought possible.

I’ll keep you posted.

A few days ago I needed to get into my parent’s house while they were on holiday. I was driving to my house to fetch their spare keys and fretting about having forgotten their alarm code. As I opened my front door the alarm keypad began beeping. I instinctively started punching in a code. As I was pressing the keys I became aware that the pin I was entering was not the pin for my house but a totally different pin.

When I pressed the last number I realised that he pin I had just entered was the pin for my parents house. A pin that I could not remember a few seconds ago.

Mind blown.

I didn’t blog about this when I first did it, because I didn’t know if it was going to work. Today I was relieved to discover that the water puddle in my kitchen was caused by an over-watered plant standing above the washing machine, and not the violent death of yet another y-shaped splitter, so I guess my solution is holding up nicely. But first, a description of the problem.

My flat, which was built sometime in the forties or fifties, has a single cold water inlet cemented into the kitchen wall. Since I have both a washing machine and a dishwasher, I need to split this inlet in two. The vast array of plumbing possibilities available for purchase in hardware stores near me comprises exactly one suitable part, which is a rigid white plastic y-shaped splitter.

The water inlet is a pipe which protrudes quite far out of the wall. When the rigid splitter is attached to it, and the ends of two inlet hoses are attached to the splitter, the resulting structure protrudes very, very far out of the wall. When people stand around in the kitchen chatting, and lean back on the appliances, as they are wont to do, they push the dishwasher further towards the wall. Subsequently, when the dishwasher is operated, its strong vibrations exert considerable force on the rigid assembly of pipes.

The dishwasher is made of metal, and the inlet pipe is made of metal, so the element which bears the brunt of the assault is the unfortunate y-shaped splitter, which is made of plastic. A fracture forms in the crotch area, water squirts through it at an alarming rate, and I soon have a small pond in one corner of my kitchen.

I lost two splitters like this. I really wanted to extend the inlet pipe with another hose before attaching the splitter, to give the whole assembly more space to flex, but I couldn’t find a female-to-male hose anywhere. It’s possible that they don’t exist. My inlet is male, all appliance hoses appear to be female-to-female, the nozzles on the appliances are male, and the splitter is one-female-to-two-male.

When I noticed that the inlet nozzle on my dishwasher is in a deeply recessed area, I tried an alternative plan: I attached the splitter to the dishwasher, one leg of the splitter to the inlet (using the dishwasher hose, with the convenient 90° kink next to the wall), and the other leg to the washing machine hose. This moves the entire width of the splitter and hose ends into the recess.

This might work for you if you have a similar problem but no recessed nozzle — having the splitter protrude at a different height to the inlet pipe is probably still an improvement over having them right on top of one another.

• System: Base Memory=1024MB, Enable IO APIC=Ticked, Processors=2
• Storage: SATA Controller: sdb1.vmdk: Solid-state drive=Ticked
• Display: Enable 3D and 2D Acceleration. Video Memory=256MB

'the idea of immediate compilation and "unit tests" appeals to me only rarely, when I’m feeling my way in a totally unknown environment and need feedback about what works and what doesn’t. Otherwise, lots of time is wasted on activities that I simply never need to perform or even think about. Nothing needs to be "mocked up."'

Donald Knuth 25 April 2008

(Okay, so I'm slow to the party. As always.)

I went to the Whisky Live Festival in Cape Town last Friday evening - the last day of the Festival - definitely a good choice.

International Convention Centre

Emma, a visitor from Scotland, persuaded a group of us to go, and we made our way to the International Convention Centre. We got a group rate, and 12 redeemable coupons for tasting. We decided that we would specialise on the single malts - a whisky made from the product of a single distillery rather than a blend between distilleries.

The first surprise we got was that many of the stands asked for two coupons per taste, rather than the one we had been expecting. However, this did not turn out to be a problem - by the end of the evening nobody bothered asking for coupons as it was the last day.

The booth babes were gorgeous, and most seemed knowledgeable on their products.

A good early stop was made at the stand for the Whisky magazine, who issued awards for the whiskys. The gentleman on the stand said that the overall winner that year had been a Japanese whisky - but it appeared that there were no Japanese whiskys available for tasting in Cape Town, either on his stand (stocked with also-rans from the competition) or on other stands. He recommended the Independent bottlers stand as worth a visit.

I had an early taste of a Dalwhinnie - from a very impressive stand giving tastings. I learned from Emma about Speyside - one of the centres of the Scottish single malt industry.

Glen Grant

Another stand that stood out for me was the Glen Grant stand, where the very knowledgeable South African Marketing manager gave us a rundown of their products. They also had a whisky workshop, where they had three sessions explaining the process of making whisky.

I managed to get a seat in the workshop, where the white-haired gentleman explained the process - which starts very similar to beer. Malted barley is cooked and rinsed to extract the sugar - maltose, created by enzymes from the starch in the barley grain when it germinates.

The yeasts they use are different, however - the distiller's yeast can stand much higher concentrations of alcohol. The yeast is allowed to do its work, and the first distillation step produces Low wine - with alcohol concentrations up to 60%. Another distillation step is performed - being careful to skip the initial distillation products and the end distillation products, and keeping the 'heart' of the whisky.

The end result of this is a clear liquor - of quite high alcohol concentration, ready to be aged. Second hand barrels from the sherry industry are very popular, as well as Madiera wine barrels. It is this step that gives the whisky its colour and much of its taste. Scottish whiskys must be aged a minimum of three years, but can be kept as long as 21 years.

We got to taste in the workshop the Low wine (rough, strong), the 3 year, 10 year, and 12 year Glen Grant products.

Jack Daniels

I bumped into friends Ashley and Barbs there, and also made my way to the Jack Daniels stand, where I learned the differences between Bourbon Whiskey and scotch. American whiskeys all contain at least 51% of another grain, either corn, Rye, or wheat, though they also have a 51% barley product, Malt whiskey. The Glen Grant man had no nice things to say about any grain other than barley.

We tasted some nice Welsh whisky, and Ireland were also well represented. The coupon system was out of the window by the end, so most of the stands were offering free tastings.

A very pleasant evening.

My home network has a somewhat complicated setup where I have multiple PPPoE sessions across my ADSL connection, with various different ISPs. This allows me to take advantage of varying ISP properties such as cost and latency, by routing different traffic over different connections. Naturally, each of these connections only affords me a single IPv4 address, so I make use of NAT to allow the rest of my network access to the Internet. A potential problem arises, however, when connections go down and come back up. In the simple case, with only one connection, MASQUERADE takes care of all the details; when the interface goes down, all of the NAT entries associated with the connection are removed, so when it comes back up, it’s not a problem that your IP address has changed, because all of the NAT entries associated with the old address are gone. This works just as well in the multiple connections scenario; if an interface goes down resulting in traffic being routed over another interface, all of the old NAT entries have been dropped, so new ones will be established associated with the interface they are now travelling over. The problem arises when the interface that went down comes back up; traffic will now be routed over the first interface again, while still being rewritten to the second interface’s address, and this traffic is almost guaranteed to be dropped by either your ISP, or their upstream provider.

What’s the solution? Well, if you absolutely definitely want to start routing traffic over the first interface as soon as it comes back up, you’re going to need to flush the associated conntrack NAT entries as soon as it comes up, and let all your users reconnect (since their connections will be interrupted); I’m not entirely sure how to do this. In my case, however, I’m more concerned with maintaining existing connections without interruption, even if that means continuing to route them over the “wrong” interface. This also applies to incoming connections; ordinarily if somebody tries to establish a connection to the public IP address of one of your connections, they will need to connect to the same interface that outbound traffic to them would be routed over, which can be somewhat inconvenient.

My solution is something I’m going to call “connection pinning”. The idea is that once an outbound interface has been selected for a particular connection (by the Linux routing table), we “pin” the connection to that interface, so that traffic associated with that connection always travels over that interface even if the routing table changes. In order to achieve this, we can use a combination of Linux policy routing (ip rule), as well as firewall / conntrack packet marking. When a connection is first established, we set a connmark, which is a value stored in the conntrack table entry for that connection. In the case of an incoming connection, we set the mark based on the interface the packet arrived on; in the case of an outgoing connection, we set the mark in POSTROUTING based on the outbound interface already selected by the routing table. Then, for future outgoing traffic associated with that connection (as determined by conntrack), we set an fwmark based on the connmark, and bypass the normal routing table using policy rules for traffic marked thusly.

This is implemented in three parts. Firewall rules added using iptables, for the netfilter/conntrack bits; an ip-up script for establishing policy rules and routes when a PPP connection is established; and an ip-down script for flushing them again when the PPP connection is terminated.

First, the firewall rules (using the excellent ferm tool):

@def $DEV_PRIVATE = eth0;
@def $NET_PRIVATE_V4 = 10.0.0.0/24;

domain ip table mangle {
    # Only match new connections; established connections should
    # already have a connmark, which should not be overwritten.
    chain (INPUT FORWARD) {
        # Unfortunately the set-mark rules need to be duplicated for
        # each ppp interface we have.
        mod conntrack ctstate NEW {
            interface ppp0 CONNMARK set-mark 1;
            interface ppp1 CONNMARK set-mark 2;
            interface ppp2 CONNMARK set-mark 3;
            interface ppp3 CONNMARK set-mark 4;
            interface ppp4 CONNMARK set-mark 5;
        }
    }
    chain POSTROUTING {
        mod conntrack ctstate NEW {
            outerface ppp0 CONNMARK set-mark 1;
            outerface ppp1 CONNMARK set-mark 2;
            outerface ppp2 CONNMARK set-mark 3;
            outerface ppp3 CONNMARK set-mark 4;
            outerface ppp4 CONNMARK set-mark 5;
        }
    }
    chain PREROUTING {
        # Copy the connmark to the fwmark in order to activate the
        # policy rules for connection pinning. Only do this for
        # traffic originating from the local network; other traffic
        # (such as traffic going *to* the local network) should be
        # left unmodified, to allow return traffic to be routed over
        # the correct interface.

        interface $DEV_PRIVATE daddr ! $NET_PRIVATE_V4 CONNMARK restore-mark;
    }
    chain OUTPUT {
        # Same as above, but for locally originating traffic.

        daddr ! $NET_PRIVATE_V4 CONNMARK restore-mark;
    }
}

# I am assuming you already have something like this:
domain ip table nat {
    chain POSTROUTING outerface (ppp0 ppp1 ppp2 ppp3 ppp4) MASQUERADE;
}

If you’re not using ferm, here’s what the raw iptables commands would be (these are exactly what ferm will install given the above, so this is just more verbose):

iptables -t mangle -A FORWARD --match conntrack --ctstate NEW --in-interface ppp0 --jump CONNMARK --set-mark 1
iptables -t mangle -A FORWARD --match conntrack --ctstate NEW --in-interface ppp1 --jump CONNMARK --set-mark 2
iptables -t mangle -A FORWARD --match conntrack --ctstate NEW --in-interface ppp2 --jump CONNMARK --set-mark 3
iptables -t mangle -A FORWARD --match conntrack --ctstate NEW --in-interface ppp3 --jump CONNMARK --set-mark 4
iptables -t mangle -A FORWARD --match conntrack --ctstate NEW --in-interface ppp4 --jump CONNMARK --set-mark 5
iptables -t mangle -A INPUT --match conntrack --ctstate NEW --in-interface ppp0 --jump CONNMARK --set-mark 1
iptables -t mangle -A INPUT --match conntrack --ctstate NEW --in-interface ppp1 --jump CONNMARK --set-mark 2
iptables -t mangle -A INPUT --match conntrack --ctstate NEW --in-interface ppp2 --jump CONNMARK --set-mark 3
iptables -t mangle -A INPUT --match conntrack --ctstate NEW --in-interface ppp3 --jump CONNMARK --set-mark 4
iptables -t mangle -A INPUT --match conntrack --ctstate NEW --in-interface ppp4 --jump CONNMARK --set-mark 5
iptables -t mangle -A POSTROUTING --match conntrack --ctstate NEW --out-interface ppp0 --jump CONNMARK --set-mark 1
iptables -t mangle -A POSTROUTING --match conntrack --ctstate NEW --out-interface ppp1 --jump CONNMARK --set-mark 2
iptables -t mangle -A POSTROUTING --match conntrack --ctstate NEW --out-interface ppp2 --jump CONNMARK --set-mark 3
iptables -t mangle -A POSTROUTING --match conntrack --ctstate NEW --out-interface ppp3 --jump CONNMARK --set-mark 4
iptables -t mangle -A POSTROUTING --match conntrack --ctstate NEW --out-interface ppp4 --jump CONNMARK --set-mark 5
iptables -t mangle -A PREROUTING --in-interface eth0 ! --destination 10.0.0.0/24 --jump CONNMARK --restore-mark
iptables -t mangle -A OUTPUT ! --destination 10.0.0.0/24 --jump CONNMARK --restore-mark

iptables -t nat -A POSTROUTING --out-interface ppp0 --jump MASQUERADE
iptables -t nat -A POSTROUTING --out-interface ppp1 --jump MASQUERADE
iptables -t nat -A POSTROUTING --out-interface ppp2 --jump MASQUERADE
iptables -t nat -A POSTROUTING --out-interface ppp3 --jump MASQUERADE
iptables -t nat -A POSTROUTING --out-interface ppp4 --jump MASQUERADE

Next, the ip-up script (to be placed in /etc/ppp/ip-up.d/ and made executable):

#!/bin/sh
TABLE="$PPP_IFACE"
MARK=$((${PPP_IFACE##ppp} + 1))
ip rule del lookup "$TABLE"
ip route flush table "$TABLE"
ip route add default dev "$PPP_IFACE" table "$TABLE"
ip rule add fwmark "$MARK" table "$TABLE"

Finally, the ip-down script (to be placed in /etc/ppp/ip-down.d/ and made executable):

#!/bin/sh
TABLE="$PPP_IFACE"
ip rule del lookup "$TABLE"
ip route flush table "$TABLE"

There are a couple of changes you will need to make to adapt these for your own network. In particular, you’ll need to duplicate the pppN iptables rules for each of the PPP interfaces you want to apply this to. Also, if you are already doing packet marking for some other reason, you’ll need to change the fwmark values I’ve used to ones that don’t interfere with your existing marks. I suspect there’s a better way to only mark outbound traffic than what I do above, but I wasn’t able to figure it out. If you have any improvements to suggest, feel free to mention them in the comments; I will try to keep this post updated with any improvements I make (either on my own, or based on other people’s suggestions).

Soon after Steve Jobs passed away, my wife sent me the following article, asking me what I thought of it: Steve Jobs: The Secular Prophet.  Interesting article.
The writer speculate that Steve Jobs was a prophet for people who believe in technology.  He also states that the Apple logo is a reference to the apple in the garden of Eden and speculate that the logo basically indicates that Apple wants to reverse the curse of the Fall in the garden of Eden.

read more

I took a look at the data from the Who in the World is reddit survey to see what it says about South African redditors. Only 83 survey entries listed their country of residence as South Africa, compared to 409 subscribers to /r/southafrica, so this data might not provide a complete picture.

To start off, it will surprise no-one to learn that most SA redditors are men in their twenties and thirties.

Despite the “forever alone” stereotype, just about half are in a relationship.

We’re a pretty well-educated lot, with almost two-thirds having some type of degree. I’m a little curious about the one associate’s degree, since I don’t think such a thing exists in South Africa. Could be an American expat, I suppose.

Income has quite a varied distribution. The original income ranges are given in multiples of US$20 000 — for the sake of having relatively round numbers, I used an exchange rate of seven rand to the dollar.

(And yes, I know this is a bad histogram, but it seems to be impossible to get Libreoffice Calc to draw a better one.)

I didn’t draw a chart of the answers to the “favourite subreddit” question, because the answers were widely varying. The top seven were:

Finally, there are the two really serious questions. It turns out that South African redditors are mostly dog people:

But we are a divided nation when it comes to the issue of cheese: