X-Git-Url: http://pere.pagekite.me/gitweb/homepage.git/blobdiff_plain/b7184165426f45201036148961464f306641dd8b..2d047348b0dfe1d3bab7955e9bf9b52223e84373:/blog/index.html diff --git a/blog/index.html b/blog/index.html index 0f4f36948a..7ee76c94b8 100644 --- a/blog/index.html +++ b/blog/index.html @@ -20,39 +20,96 @@
-
Of course USA loses in cyber war - NSA and friends made sure it would happen
-
19th December 2014
-

So, Sony caved in -(according -to Rob Lowe) and demonstrated that America lost its first cyberwar -(according -to Newt Gingrich). It should not surprise anyone, after the -whistle blower Edward Snowden documented that the government of USA -and their allies for many years have done their best to make sure the -technology used by its citizens is filled with security holes allowing -the secret services to spy on its own population. No one in their -right minds could believe that the ability to snoop on the people all -over the globe could only be used by the personnel authorized to do so -by the president of the United States of America. If the capabilities -are there, they will be used by friend and foe alike, and now they are -being used to bring Sony on its knees.

- -

I doubt it will a lesson learned, and expect USA to lose its next -cyber war too, given how eager the western intelligence communities -(and probably the non-western too, but it is less in the news) seem to -be to continue its current dragnet surveillance practice.

- -

There is a reason why China and others are trying to move away from -Windows to Linux and other alternatives, and it is not to avoid -sending its hard earned dollars to Cayman Islands (or whatever -tax haven -Microsoft is using these days to collect the majority of its -income. :)

+
Simpler recipe on how to make a simple $7 IMSI Catcher using Debian
+
9th August 2017
+

On friday, I came across an interesting article in the Norwegian +web based ICT news magazine digi.no on +how +to collect the IMSI numbers of nearby cell phones using the cheap +DVB-T software defined radios. The article refered to instructions +and a recipe by +Keld Norman on Youtube on how to make a simple $7 IMSI Catcher, and I decided to test them out.

+ +

The instructions said to use Ubuntu, install pip using apt (to +bypass apt), use pip to install pybombs (to bypass both apt and pip), +and the ask pybombs to fetch and build everything you need from +scratch. I wanted to see if I could do the same on the most recent +Debian packages, but this did not work because pybombs tried to build +stuff that no longer build with the most recent openssl library or +some other version skew problem. While trying to get this recipe +working, I learned that the apt->pip->pybombs route was a long detour, +and the only piece of software dependency missing in Debian was the +gr-gsm package. I also found out that the lead upstream developer of +gr-gsm (the name stand for GNU Radio GSM) project already had a set of +Debian packages provided in an Ubuntu PPA repository. All I needed to +do was to dget the Debian source package and built it.

+ +

The IMSI collector is a python script listening for packages on the +loopback network device and printing to the terminal some specific GSM +packages with IMSI numbers in them. The code is fairly short and easy +to understand. The reason this work is because gr-gsm include a tool +to read GSM data from a software defined radio like a DVB-T USB stick +and other software defined radios, decode them and inject them into a +network device on your Linux machine (using the loopback device by +default). This proved to work just fine, and I've been testing the +collector for a few days now.

+ +

The updated and simpler recipe is thus to

+ +
    + +
  1. start with a Debian machine running Stretch or newer,
    2. + +
  2. build and install the gr-gsm package available from +http://ppa.launchpad.net/ptrkrysik/gr-gsm/ubuntu/pool/main/g/gr-gsm/,
    3. + +
  3. clone the git repostory from https://github.com/Oros42/IMSI-catcher,
    4. + +
  4. run grgsm_livemon and adjust the frequency until the terminal +where it was started is filled with a stream of text (meaning you +found a GSM station).
    5. + +
  5. go into the IMSI-catcher directory and run 'sudo python simple_IMSI-catcher.py' to extract the IMSI numbers.
    6. + +
+ +

To make it even easier in the future to get this sniffer up and +running, I decided to package +the gr-gsm project +for Debian (WNPP +#871055), and the package was uploaded into the NEW queue today. +Luckily the gnuradio maintainer has promised to help me, as I do not +know much about gnuradio stuff yet.

+ +

I doubt this "IMSI cacher" is anywhere near as powerfull as +commercial tools like +The +Spy Phone Portable IMSI / IMEI Catcher or the +Harris +Stingray, but I hope the existance of cheap alternatives can make +more people realise how their whereabouts when carrying a cell phone +is easily tracked. Seeing the data flow on the screen, realizing that +I live close to a police station and knowing that the police is also +wearing cell phones, I wonder how hard it would be for criminals to +track the position of the police officers to discover when there are +police near by, or for foreign military forces to track the location +of the Norwegian military forces, or for anyone to track the location +of government officials...

+ +

It is worth noting that the data reported by the IMSI-catcher +script mentioned above is only a fraction of the data broadcasted on +the GSM network. It will only collect one frequency at the time, +while a typical phone will be using several frequencies, and not all +phones will be using the frequencies tracked by the grgsm_livemod +program. Also, there is a lot of radio chatter being ignored by the +simple_IMSI-catcher script, which would be collected by extending the +parser code. I wonder if gr-gsm can be set up to listen to more than +one frequency?

- Tags: english, personvern, surveillance. + Tags: debian, english, personvern, surveillance.
@@ -60,64 +117,37 @@ income. :)

-
Klarer ikke Microsoft å holde på hemmeligheter?
-
18th December 2014
-

Må Microsoft virkelig ha hjelp av unger for å holde på -hemmelighetene sine?

- -

I dag kom det en fascinerende artikkel i Aftenposten om -hva -Microsoft har foreslått at foreldre går med på for å la ungene -delta på Lær kidsa koding på -skolen. De ber foreldrene om å få bruke bilder og video av ungene -kommersielt og gratis i all fremtid, hvilket var så drøyt at -Arbeiderpartiets bystyrerepresentant -Per Anders -Torvik Langerød tok opp saken opp under bystyrets muntlige -spørretime onsdag. Resultatet av dette er at Microsoft har trukket -tilbake teksten i samtykkeerklæringen og kommunikasjonsdirektør -Christine Korme i Microsoft sier i artikkelen at «Vi vil presentere en -ny erklæring som gjør det helt klart i hvilken forbindelse materialet -skal brukes, altså ikke-kommersielt», hvilket jo er fint. Jeg lurer -virkelig på hvordan teksten kunne slippe ut til foreldrene i første -omgang. Her har noen på skolen ikke fulgt med i timen, eller mangler -grunnleggende personverntrening.

- -

Men bildet av samtykkeerklæringen inneholder også en annen -problematisk klausul, som ikke omtales overhodet i -Aftenposten-artikkelen. Neste punkt i erklæringen lyder:

- -

-«Du aksepterer ikke å bruke eller videreformidle til en tredjepart -noen hemmelige eller fortrolige opplysninger som gis av Microsoft i -løpet av elevens deltagelse.» -

- -

Mener Microsoft virkelig at foreldre og barn skal ta ansvar for at -Microsoft ikke klarer å holde hemmelig og fortrolig informasjon for -seg selv når de besøker en offentlig norsk skole? Jeg ville nektet -plent å signert på en avtale med en slik klausul, da det er Microsofts -ansvar å holde på sine hemmeligheter, og ikke noe mine barn og min -familie tar på oss erstatningsansvar for hvis de kommer på avveie.

- -

Jeg lurer på om noen har fått se den nye samtykkeerklæringen? -Inneholder den fortsatt klausul om hemmelighold? Hvor mange er det -som hittil har signert på den gamle samtykkeerklæringen? Hvor har den -vært brukt? Savnet svar på disse spørsmålene i artikkelen, da de som -har signert på den gamle vel vil være bundet av den selv om ingen -flere signerer på den.

- -

Lær kidsa koding er et glimrende initiativ, og jeg skulle ønske -noen av foreningen NUUGs medlemmer -hadde kapasitet til å delta i initiativet på NUUGs vegne. Selv tar -jobb, familie og eksisterende prosjekter allerede all tid. Slik -Microsoft tydeligvis holder på er det behov for noen med et annet syn -på livet som bidragsyter her.

+
Norwegian Bokmål edition of Debian Administrator's Handbook is now available
+
25th July 2017
+

+ +

I finally received a copy of the Norwegian Bokmål edition of +"The Debian Administrator's +Handbook". This test copy arrived in the mail a few days ago, and +I am very happy to hold the result in my hand. We spent around one and a half year translating it. This paperbook edition +is available +from lulu.com. If you buy it quickly, you save 25% on the list +price. The book is also available for download in electronic form as +PDF, EPUB and Mobipocket, as can be +read online +as a web page.

+ +

This is the second book I publish (the first was the book +"Free Culture" by Lawrence Lessig +in +English, +French +and +Norwegian +Bokmål), and I am very excited to finally wrap up this +project. I hope +"Håndbok +for Debian-administratoren" will be well received.

- Tags: norsk, nuug, personvern. + Tags: debian, debian-handbook, english.
@@ -125,115 +155,50 @@ på livet som bidragsyter her.

-
Opphavsretts-status for «Empty Socks» fra 1927?
-
12th December 2014
-

For noen dager siden -annonserte -Nasjonalbiblioteket gladnyheten om at de i sine arkiver hadde -funnet et nitratfilm-eksemplar av en 87 år gammel Disney-film ved navn -Empty Socks, en film som tidligere var antatt tapt og der det i følge -nyhetsmeldinger var kun ca. 25 sekunder bevart for ettertiden. -Nasjonalbiblioteket hadde 5 minutter og 30 sekunder av filmen i sitt -magasin. Dette er flott for bevaringen av verdens kulturarv. 5,5 -minutter mindre tapt enn vi trodde av vår felles historie.

- -

Men hvordan kunne filmen gå tapt, når arkivlovene i USA krevde at -publiserte filmer på den tiden ble deponert i bibliotek? Forklaringen -har jeg fra Lawrence Lessig og boken -Free Culture, som jeg holder på -å -oversette til norsk:

- -

-

Dette er delvis på grunn av loven. Opphavsrettseiere var tidlig i - amerikansk opphavsrettslov nødt til å deponere kopier av sine verk i - biblioteker. Disse kopiene skulle både sikre spredning av kunnskap, - og sikre at det fantes en kopi av verket tilgjengelig når vernetiden - utløp, slik at andre kunne få tilgang til og kopiere verket.

- -

Disse reglene gjaldt også for filmer. Men i 1915 gjorde - kongressbiblioteket et unntak for film. Filmer kunne bli - opphavsrettsbeskyttet så lenge det ble gjort slik deponering. Men - filmskaperne fikk så lov til å låne tilbake de deponerte filmene - - så lenge de ville uten noe kostnad. Bare i 1915 var det mer enn 5475 - filmer deponert og “lånt tilbake”. Dermed var det ikke noe eksemplar - i noe bibliotek når vernetiden til filmen utløp. Eksemplaret - eksisterer - hvis den finnes i det hele tatt - i arkivbiblioteket - til filmselskapet.

-

- -

Nyheten gjorde meg nysgjerrig på om filmen kunne være falt i det -fri. En 87 år gammel film kunne jo tenkes å ha blitt en del av -allemannseiet, slik at vi alle kan bruke den til å bygge videre på vår -felles kultur uten å måtte be om tillatelse - slik Walt Disney gjorde -det i starten av sin karriere. Jeg spurte nasjonalbiblioteket, og de -sa nei. Hvordan kan det ha seg med en så gammel film? Jeg besteme -meg for å undersøke nærmere. En kan finne informasjon om den norske -vernetiden på -Lovdata -og Wikipedia. Her er et relevant utsnitt fra -siden om opphavsrett i den norske Wikipedia:

+
«Rapporten ser ikke på informasjonssikkerhet knyttet til personlig integritet»
+
27th June 2017
+

Jeg kom over teksten +«Killing +car privacy by federal mandate» av Leonid Reyzin på Freedom to +Tinker i dag, og det gleder meg å se en god gjennomgang om hvorfor det +er et urimelig inngrep i privatsfæren å la alle biler kringkaste sin +posisjon og bevegelse via radio. Det omtalte forslaget basert på +Dedicated Short Range Communication (DSRC) kalles Basic Safety Message +(BSM) i USA og Cooperative Awareness Message (CAM) i Europa, og det +norske Vegvesenet er en av de som ser ut til å kunne tenke seg å +pålegge alle biler å fjerne nok en bit av innbyggernes privatsfære. +Anbefaler alle å lese det som står der. + +

Mens jeg tittet litt på DSRC på biler i Norge kom jeg over et sitat +jeg synes er illustrativt for hvordan det offentlige Norge håndterer +problemstillinger rundt innbyggernes privatsfære i SINTEF-rapporten +«Informasjonssikkerhet +i AutoPASS-brikker» av Trond Foss:

- Ifølge åndsverkloven §§ 40-41 utløper vernetiden for et åndsverk 70 - år etter utløpet av opphavspersonens dødsår. [...] For filmverk - gjelder særlige regler: Her kommer ikke alle mulige opphavspersoner - i betraktning, men kun hovedregissøren, manusforfatteren, - dialogforfatteren og komponisten av filmmusikken. Vernetiden - begynner å løpe etter utgangen av dødsåret til den lengstlevende av - disse. [...] Der opphavspersonen er ukjent, utløper opphavsretten 70 - år etter første kjente offentliggjørelse av verket. Det er kun de - økonomiske rettighetene som faller bort i det vernetiden er - utløpt. De ideelle rettighetene må fortsatt respekteres, noe som - blant annet innebærer at man plikter å navngi opphavspersonen ved - tilgjengeliggjøring. +«Rapporten ser ikke på informasjonssikkerhet knyttet til personlig + integritet.»

-

I følge nettstedet -The -Encyclopedia of Disney Animated Shorts er følgende personer gitt -æren for denne kortfilmen:

- -
- -
Regissør
-
Walt Disney (1901-12-05 – 1966-12-15) +70 år = 2037
- -
Animasjon -
Ub Iwerks (1901-03-24 – 1971-07-07) +70 år = 2042 -
Rollin "Ham" Hamilton (1898-10-28 - 1951-06-03) +70 år = 2022 -
Hugh Harman (1903-08-31 – 1982-11-25) +70 år = 2053
- -
Kamera -
Mike Marcus (?-?)
- -
- -

Alle fødsels- og dødsdatoene er fra engelske Wikipedia. Det er -ikke oppgitt navn på manusforfatter, dialogforfatter og komponist, men -jeg mistenker at tegnerne vil få opphavsrettigheter på tegnefilmer her -i Norge, og tar derfor med disse. Kameramannen vil ikke få noen -rettigheter så vidt jeg forstår, og er derfor ignorert her.

- -

Slik jeg forstår den norske opphavsretten vil dermed dette -filmverket bli allemannseie (også kalt å falle i det fri) i 2053, 126 -år etter at det ble utgitt. Hvis kun regissørens rettigheter er -relevante, vil det skje i 2037, 110 år etter at det ble utgitt. Etter -det vil enhver kunne dele det med alle de har lyst til, fremføre det -offentlig eller klippe og lime i det for å lage sin egen film basert -på det - helt uten å måtte spørre noen om lov.

- -

Måtte så Nasjonalbiblioteket spørre om lov før de kunne kopiere -sitt nitrat-eksemplar over på mer varig format? Nei, heldigvis. -Åndsverklovens § 16 sier at arkiv, bibliotek, museer og undervisnings- -og forskningsinstitusjoner har rett til å fremstille eksemplar av verk -for konserverings- og sikringsformål og andre særskilte formål.

+

Så enkelt kan det tydeligvis gjøres når en vurderer +informasjonssikkerheten. Det holder vel at folkene på toppen kan si +at «Personvernet er ivaretatt», som jo er den populære intetsigende +frasen som gjør at mange tror enkeltindividers integritet tas vare på. +Sitatet fikk meg til å undres på hvor ofte samme tilnærming, å bare se +bort fra behovet for personlig itegritet, blir valgt når en velger å +legge til rette for nok et inngrep i privatsfæren til personer i +Norge. Det er jo sjelden det får reaksjoner. Historien om +reaksjonene på Helse Sør-Østs tjenesteutsetting er jo sørgelig nok et +unntak og toppen av isfjellet, desverre. Tror jeg fortsatt takker nei +til både AutoPASS og holder meg så langt unna det norske helsevesenet +som jeg kan, inntil de har demonstrert og dokumentert at de verdsetter +individets privatsfære og personlige integritet høyere enn kortsiktig +gevist og samfunnsnytte.

- Tags: freeculture, norsk, opphavsrett, video. + Tags: norsk, personvern, sikkerhet.
@@ -241,70 +206,66 @@ for konserverings- og sikringsformål og andre særskilte formål.

-
How to stay with sysvinit in Debian Jessie
-
22nd November 2014
-

By now, it is well known that Debian Jessie will not be using -sysvinit as its boot system by default. But how can one keep using -sysvinit in Jessie? It is fairly easy, and here are a few recipes, -courtesy of -Erich -Schubert and -Simon -McVittie. - -

If you already are using Wheezy and want to upgrade to Jessie and -keep sysvinit as your boot system, create a file -/etc/apt/preferences.d/use-sysvinit with this content before -you upgrade:

- -

-Package: systemd-sysv
-Pin: release o=Debian
-Pin-Priority: -1
-

- -

This file content will tell apt and aptitude to not consider -installing systemd-sysv as part of any installation and upgrade -solution when resolving dependencies, and thus tell it to avoid -systemd as a default boot system. The end result should be that the -upgraded system keep using sysvinit.

- -

If you are installing Jessie for the first time, there is no way to -get sysvinit installed by default (debootstrap used by -debian-installer have no option for this), but one can tell the -installer to switch to sysvinit before the first boot. Either by -using a kernel argument to the installer, or by adding a line to the -preseed file used. First, the kernel command line argument: - -

-preseed/late_command="in-target apt-get install --purge -y sysvinit-core"
-

- -

Next, the line to use in a preseed file:

- -

-d-i preseed/late_command string in-target apt-get install -y sysvinit-core
-

- -

One can of course also do this after the first boot by installing -the sysvinit-core package.

- -

I recommend only using sysvinit if you really need it, as the -sysvinit boot sequence in Debian have several hardware specific bugs -on Linux caused by the fact that it is unpredictable when hardware -devices show up during boot. But on the other hand, the new default -boot system still have a few rough edges I hope will be fixed before -Jessie is released.

- -

Update 2014-11-26: Inspired by -a -blog post by Torsten Glaser, added --purge to the preseed -line.

+
Updated sales number for my Free Culture paper editions
+
12th June 2017
+

It is pleasing to see that the work we put down in publishing new +editions of the classic Free +Culture book by the founder of the Creative Commons movement, +Lawrence Lessig, is still being appreciated. I had a look at the +latest sales numbers for the paper edition today. Not too impressive, +but happy to see some buyers still exist. All the revenue from the +books is sent to the Creative +Commons Corporation, and they receive the largest cut if you buy +directly from Lulu. Most books are sold via Amazon, with Ingram +second and only a small fraction directly from Lulu. The ebook +edition is available for free from +Github.

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Title / languageQuantity
2016 jan-jun2016 jul-dec2017 jan-may
Culture Libre / French3615
Fri kultur / Norwegian710
Free Culture / English142716
Total243431
+ +

A bit sad to see the low sales number on the Norwegian edition, and +a bit surprising the English edition still selling so well.

+ +

If you would like to translate and publish the book in your native +language, I would be happy to help make it happen. Please get in +touch.

- Tags: bootsystem, debian, english. + Tags: docbook, english, freeculture.
@@ -312,75 +273,59 @@ line.

-
Hvordan vurderer regjeringen H.264-patentutfordringen?
-
16th November 2014
-

For en stund tilbake spurte jeg Fornyingsdepartementet om hvilke -juridiske vurderinger rundt patentproblemstillingen som var gjort da -H.264 ble tatt inn i statens -referansekatalog over standarder. Stig Hornnes i FAD tipset meg -om følgende som står i oppsumeringen til høringen om -referansekatalogen versjon 2.0, som jeg siden ved hjelp av en -innsynsforespørsel fikk tak i -PDF-utgaven av -datert 2009-06-03 (saksnummer 200803291, saksbehandler Henrik -Linnestad).

- -

Der står det følgende om problemstillingen:

+
Release 0.1.1 of free software archive system Nikita announced
+
10th June 2017
+

I am very happy to report that the +Nikita Noark 5 +core project tagged its second release today. The free software +solution is an implementation of the Norwegian archive standard Noark +5 used by government offices in Norway. These were the changes in +version 0.1.1 since version 0.1.0 (from NEWS.md): -

-4.4 Patentproblematikk - -

NUUG og Opera ser det som særlig viktig at forslagene knyttet til -lyd og video baserer seg på de royalty-frie standardene Vorbis, Theora -og FLAC.

- -

Kommentarene relaterer seg til at enkelte standarder er åpne, men -inneholder tekniske prosedyrer som det i USA (og noen andre land som -Japan) er gitt patentrettigheter til. I vårt tilfelle berører dette -spesielt standardene Mp3 og H.264, selv om Politidirektoratet peker på -at det muligens kan være tilsvarende problematikk også for Theora og -Vorbis. Dette medfører at det i USA kan kreves royalties for bruk av -tekniske løsninger knyttet til standardene, et krav som også -håndheves. Patenter kan imidlertid bare hevdes i de landene hvor -patentet er gitt, så amerikanske patenter gjelder ikke andre steder -enn USA.

- -

Spesielt for utvikling av fri programvare er patenter -problematisk. GPL, en "grunnleggende" lisens for distribusjon av fri -programvare, avviser at programvare kan distribueres under denne -lisensen hvis det inneholder referanser til patenterte rutiner som -utløser krav om royalties. Det er imidlertid uproblematisk å -distribuere fri programvareløsninger under GPL som benytter de -aktuelle standardene innen eller mellom land som ikke anerkjenner -patentene. Derfor finner vi også flere implementeringer av Mp3 og -H.264 som er fri programvare, lisensiert under GPL.

- -

I Norge og EU er patentlovgivningen langt mer restriktiv enn i USA, -men det er også her mulig å få patentert metoder for løsning av et -problem som relaterer seg til databehandling. Det er AIF bekjent ikke -relevante patenter i EU eller Norge hva gjelder H.264 og Mp3, men -muligheten for at det finnes patenter uten at det er gjort krav om -royalties eller at det senere vil gis slike patenter kan ikke helt -avvises.

- -

AIF mener det er et behov for å gi offentlige virksomheter mulighet -til å benytte antatt royaltyfrie åpne standarder som et likeverdig -alternativ eller i tillegg til de markedsledende åpne standardene.

+
    -

+
  • Continued work on the angularjs GUI, including document upload.
    • +
  • Implemented correspondencepartPerson, correspondencepartUnit and + correspondencepartInternal
    • +
  • Applied for coverity coverage and started submitting code on + regualr basis.
    • +
  • Started fixing bugs reported by coverity
    • +
  • Corrected and completed HATEOAS links to make sure entire API is + available via URLs in _links.
    • +
  • Corrected all relation URLs to use trailing slash.
    • +
  • Add initial support for storing data in ElasticSearch.
    • +
  • Now able to receive and store uploaded files in the archive.
    • +
  • Changed JSON output for object lists to have relations in _links.
    • +
  • Improve JSON output for empty object lists.
    • +
  • Now uses correct MIME type application/vnd.noark5-v4+json.
    • +
  • Added support for docker container images.
    • +
  • Added simple API browser implemented in JavaScript/Angular.
    • +
  • Started on archive client implemented in JavaScript/Angular.
    • +
  • Started on prototype to show the public mail journal.
    • +
  • Improved performance by disabling Sprint FileWatcher.
    • +
  • Added support for 'arkivskaper', 'saksmappe' and 'journalpost'.
    • +
  • Added support for some metadata codelists.
    • +
  • Added support for Cross-origin resource sharing (CORS).
    • +
  • Changed login method from Basic Auth to JSON Web Token (RFC 7519) + style.
    • +
  • Added support for GET-ing ny-* URLs.
    • +
  • Added support for modifying entities using PUT and eTag.
    • +
  • Added support for returning XML output on request.
    • +
  • Removed support for English field and class names, limiting ourself + to the official names.
    • +
  • ...
    • + + -

    Det ser dermed ikke ut til at de har vurdert patentspørsmålet i -sammenheng med opphavsrettsvilkår slik de er formulert for f.eks. -Apple Final Cut Pro, Adobe Premiere Pro, Avid og Sorenson-verktøyene, -der det kreves brukstillatelse for patenter som ikke er gyldige i -Norge for å bruke disse verktøyene til annet en personlig og ikke -kommersiell aktivitet når det gjelder H.264-video. Jeg må nok lete -videre etter svar på det spørsmålet.

    +

    If this sound interesting to you, please contact us on IRC (#nikita +on irc.freenode.net) or email +(nikita-noark +mailing list).

    - Tags: multimedia, norsk, opphavsrett, standard, video, web. + Tags: english, nuug, offentlig innsyn, standard.
    @@ -388,81 +333,99 @@ videre etter svar på det spørsmålet.

    -
    A Debian package for SMTP via Tor (aka SMTorP) using exim4
    -
    10th November 2014
    -

    The right to communicate with your friends and family in private, -without anyone snooping, is a right every citicen have in a liberal -democracy. But this right is under serious attack these days.

    - -

    A while back it occurred to me that one way to make the dragnet -surveillance conducted by NSA, GCHQ, FRA and others (and confirmed by -the whisleblower Snowden) more expensive for Internet email, -is to deliver all email using SMTP via Tor. Such SMTP option would be -a nice addition to the FreedomBox project if we could send email -between FreedomBox machines without leaking metadata about the emails -to the people peeking on the wire. I -proposed -this on the FreedomBox project mailing list in October and got a -lot of useful feedback and suggestions. It also became obvious to me -that this was not a novel idea, as the same idea was tested and -documented by Johannes Berg as early as 2006, and both -the -Mailpile and the Cables systems -propose a similar method / protocol to pass emails between users.

    - -

    To implement such system one need to set up a Tor hidden service -providing the SMTP protocol on port 25, and use email addresses -looking like username@hidden-service-name.onion. With such addresses -the connections to port 25 on hidden-service-name.onion using Tor will -go to the correct SMTP server. To do this, one need to configure the -Tor daemon to provide the hidden service and the mail server to accept -emails for this .onion domain. To learn more about Exim configuration -in Debian and test the design provided by Johannes Berg in his FAQ, I -set out yesterday to create a Debian package for making it trivial to -set up such SMTP over Tor service based on Debian. Getting it to work -were fairly easy, and -the -source code for the Debian package is available from github. I -plan to move it into Debian if further testing prove this to be a -useful approach.

    - -

    If you want to test this, set up a blank Debian machine without any -mail system installed (or run apt-get purge exim4-config to -get rid of exim4). Install tor, clone the git repository mentioned -above, build the deb and install it on the machine. Next, run -/usr/lib/exim4-smtorp/setup-exim-hidden-service and follow -the instructions to get the service up and running. Restart tor and -exim when it is done, and test mail delivery using swaks like -this:

    +
    Idea for storing trusted timestamps in a Noark 5 archive
    +
    7th June 2017
    +

    This is a copy of +an +email I posted to the nikita-noark mailing list. Please follow up +there if you would like to discuss this topic. The background is that +we are making a free software archive system based on the Norwegian +Noark +5 standard for government archives.

    + +

    I've been wondering a bit lately how trusted timestamps could be +stored in Noark 5. +Trusted +timestamps can be used to verify that some information +(document/file/checksum/metadata) have not been changed since a +specific time in the past. This is useful to verify the integrity of +the documents in the archive.

    + +

    Then it occured to me, perhaps the trusted timestamps could be +stored as dokument variants (ie dokumentobjekt referered to from +dokumentbeskrivelse) with the filename set to the hash it is +stamping?

    + +

    Given a "dokumentbeskrivelse" with an associated "dokumentobjekt", +a new dokumentobjekt is associated with "dokumentbeskrivelse" with the +same attributes as the stamped dokumentobjekt except these +attributes:

    + +
      + +
    • format -> "RFC3161" +
    • mimeType -> "application/timestamp-reply" +
    • formatDetaljer -> "<source URL for timestamp service>" +
    • filenavn -> "<sjekksum>.tsr" + +
    + +

    This assume a service following +IETF RFC 3161 is +used, which specifiy the given MIME type for replies and the .tsr file +ending for the content of such trusted timestamp. As far as I can +tell from the Noark 5 specifications, it is OK to have several +variants/renderings of a dokument attached to a given +dokumentbeskrivelse objekt. It might be stretching it a bit to make +some of these variants represent crypto-signatures useful for +verifying the document integrity instead of representing the dokument +itself.

    + +

    Using the source of the service in formatDetaljer allow several +timestamping services to be used. This is useful to spread the risk +of key compromise over several organisations. It would only be a +problem to trust the timestamps if all of the organisations are +compromised.

    + +

    The following oneliner on Linux can be used to generate the tsr +file. $input is the path to the file to checksum, and $sha256 is the +SHA-256 checksum of the file (ie the ".tsr" value mentioned +above).

    + +

    +openssl ts -query -data "$inputfile" -cert -sha256 -no_nonce \
+  | curl -s -H "Content-Type: application/timestamp-query" \
+      --data-binary "@-" http://zeitstempel.dfn.de > $sha256.tsr
+

    + +

    To verify the timestamp, you first need to download the public key +of the trusted timestamp service, for example using this command:

    -torsocks swaks --server dutlqrrmjhtfa3vp.onion \
-  --to fbx@dutlqrrmjhtfa3vp.onion
+wget -O ca-cert.txt \
+  https://pki.pca.dfn.de/global-services-ca/pub/cacert/chain.txt

    -

    This will test the SMTP delivery using tor. Replace the email -address with your own address to test your server. :)

    - -

    The setup procedure is still to complex, and I hope it can be made -easier and more automatic. Especially the tor setup need more work. -Also, the package include a tor-smtp tool written in C, but its task -should probably be rewritten in some script language to make the deb -architecture independent. It would probably also make the code easier -to review. The tor-smtp tool currently need to listen on a socket for -exim to talk to it and is started using xinetd. It would be better if -no daemon and no socket is needed. I suspect it is possible to get -exim to run a command line tool for delivery instead of talking to a -socket, and hope to figure out how in a future version of this -system.

    - -

    Until I wipe my test machine, I can be reached using the -fbx@dutlqrrmjhtfa3vp.onion mail address, deliverable over -SMTorP. :)

    +

    Note, the public key should be stored alongside the timestamps in +the archive to make sure it is also available 100 years from now. It +is probably a good idea to standardise how and were to store such +public keys, to make it easier to find for those trying to verify +documents 100 or 1000 years from now. :)

    + +

    The verification itself is a simple openssl command:

    + +

    +openssl ts -verify -data $inputfile -in $sha256.tsr \
+  -CAfile ca-cert.txt -text
+

    + +

    Is there any reason this approach would not work? Is it somehow against +the Noark 5 specification?

    - Tags: debian, english, freedombox, personvern, surveillance. + Tags: english, offentlig innsyn, standard.
    @@ -470,192 +433,61 @@ SMTorP. :)

    -
    First Jessie based Debian Edu released (alpha0)
    -
    27th October 2014
    -

    I am happy to report that I on behalf of the Debian Edu team just -sent out -this -announcement:

    - -
    -The Debian Edu Team is pleased to announce the release of Debian Edu
-Jessie 8.0+edu0~alpha0
-
-Debian Edu is a complete operating system for schools. Through its
-various installation profiles you can install servers, workstations
-and laptops which will work together on the school network. With
-Debian Edu, the teachers themselves or their technical support can
-roll out a complete multi-user multi-machine study environment within
-hours or a few days. Debian Edu comes with hundreds of applications
-pre-installed, but you can always add more packages from Debian.
-
-For those who want to give Debian Edu Jessie a try, download and
-installation instructions are available, including detailed
-instructions in the manual[1] explaining the first steps, such as
-setting up a network or adding users. Please note that the password
-for the user your prompted for during installation must have a length
-of at least 5 characters!
-
- [1] <URL: https://wiki.debian.org/DebianEdu/Documentation/Jessie >
-
-Would you like to give your school's computer a longer life? Are you
-tired of sneaker administration, running from computer to computer
-reinstalling the operating system? Would you like to administrate all
-the computers in your school using only a couple of hours every week?
-Check out Debian Edu Jessie!
-
-Skolelinux is used by at least two hundred schools all over the world,
-mostly in Germany and Norway.
-
-About Debian Edu and Skolelinux
-===============================
-
-Debian Edu, also known as Skolelinux[2], is a Linux distribution based
-on Debian providing an out-of-the box environment of a completely
-configured school network. Immediately after installation a school
-server running all services needed for a school network is set up just
-waiting for users and machines being added via GOsa², a comfortable
-Web-UI. A netbooting environment is prepared using PXE, so after
-initial installation of the main server from CD or USB stick all other
-machines can be installed via the network.  The provided school server
-provides LDAP database and Kerberos authentication service,
-centralized home directories, DHCP server, web proxy and many other
-services.  The desktop contains more than 60 educational software
-packages[3] and more are available from the Debian archive, and
-schools can choose between KDE, Gnome, LXDE, Xfce and MATE desktop
-environment.
-
- [2] <URL: http://www.skolelinux.org/ >
- [3] <URL: http://people.skolelinux.org/pere/blog/Educational_applications_included_in_Debian_Edu___Skolelinux__the_screenshot_collection____.html >
-
-Full release notes and manual
-=============================
-
-Below the download URLs there is a list of some of the new features
-and bugfixes of Debian Edu 8.0+edu0~alpha0 Codename Jessie. The full
-list is part of the manual. (See the feature list in the manual[4] for
-the English version.) For some languages manual translations are
-available, see the manual translation overview[5].
-
- [4] <URL: https://wiki.debian.org/DebianEdu/Documentation/Jessie/Features >
- [5] <URL: http://maintainer.skolelinux.org/debian-edu-doc/ >
-
-Where to get it
----------------
-
-To download the multiarch netinstall CD release (624 MiB) you can use
-
- * ftp://ftp.skolelinux.org/skolelinux-cd/debian-edu-8.0+edu0~alpha0-CD.iso
- * http://ftp.skolelinux.org/skolelinux-cd/debian-edu-8.0+edu0~alpha0-CD.iso
- * rsync -avzP ftp.skolelinux.org::skolelinux-cd/debian-edu-8.0+edu0~alpha0-CD.iso .
-
-The SHA1SUM of this image is: 361188818e036ce67280a572f757de82ebfeb095
-
-New features for Debian Edu 8.0+edu0~alpha0 Codename Jessie released 2014-10-27
-===============================================================================
-
-
-Installation changes
---------------------
-
- * PXE installation now installs firmware automatically for the hardware present.
-
-Software updates
-----------------
-
-Everything which is new in Debian Jessie 8.0, eg:
-
- * Linux kernel 3.16.x
- * Desktop environments KDE "Plasma" 4.11.12, GNOME 3.14, Xfce 4.10,
-   LXDE 0.5.6 and MATE 1.8 (KDE "Plasma" is installed by default; to
-   choose one of the others see manual.)
- * the browsers Iceweasel 31 ESR and Chromium 38 
- * !LibreOffice 4.3.3
- * GOsa 2.7.4
- * LTSP 5.5.4
- * CUPS print system 1.7.5
- * new boot framework: systemd
- * Educational toolbox GCompris 14.07 
- * Music creator Rosegarden 14.02
- * Image editor Gimp 2.8.14
- * Virtual stargazer Stellarium 0.13.0
- * golearn 0.9
- * tuxpaint 0.9.22
- * New version of debian-installer from Debian Jessie.
- * Debian Jessie includes about 42000 packages available for
-   installation.
- * More information about Debian Jessie 8.0 is provided in the release
-   notes[6] and the installation manual[7].
-
- [6] <URL: http://www.debian.org/releases/jessie/releasenotes >
- [7] <URL: http://www.debian.org/releases/jessie/installmanual >
-
-Fixed bugs
-----------
-
- * Inserting incorrect DNS information in Gosa will no longer break
-   DNS completely, but instead stop DNS updates until the incorrect
-   information is corrected (Debian bug #710362)
- * and many others.
-
-Documentation and translation updates
-------------------------------------- 
-
- * The Debian Edu Jessie Manual is fully translated to German, French,
-   Italian, Danish and Dutch. Partly translated versions exist for
-   Norwegian Bokmal and Spanish.
-
-Other changes
--------------
-
- * Due to new Squid settings, powering off or rebooting the main
-   server takes more time.
- * To manage printers localhost:631 has to be used, currently www:631
-   doesn't work.
-
-Regressions / known problems
-----------------------------
-
- * Installing LTSP chroot fails with a bug related to eatmydata about
-   exim4-config failing to run its postinst (see Debian bug #765694
-   and Debian bug #762103).
- * Munin collection is not properly configured on clients (Debian bug
-   #764594).  The fix is available in a newer version of munin-node.
- * PXE setup for Main Server and Thin Client Server setup does not
-   work when installing on a machine without direct Internet access.
-   Will be fixed when Debian bug #766960 is fixed in Jessie.
-
-See the status page[8] for the complete list.
-
- [8] <URL: https://wiki.debian.org/DebianEdu/Status/Jessie >
-
-How to report bugs
-------------------
-
-<URL: http://wiki.debian.org/DebianEdu/HowTo/ReportBugs >
-
-About Debian
-============
-
-The Debian Project was founded in 1993 by Ian Murdock to be a truly
-free community project. Since then the project has grown to be one of
-the largest and most influential open source projects. Thousands of
-volunteers from all over the world work together to create and
-maintain Debian software. Available in 70 languages, and supporting a
-huge range of computer types, Debian calls itself the universal
-operating system.
-
-Contact Information
-For further information, please visit the Debian web pages[9] or send
-mail to press@debian.org.
-
- [9] <URL: http://www.debian.org/ >
-
    +
    NÃ¥r nynorskoversettelsen svikter til eksamen...
    +
    3rd June 2017
    +

    Aftenposten +melder i dag om feil i eksamensoppgavene for eksamen i politikk og +menneskerettigheter, der teksten i bokmåls og nynorskutgaven ikke var +like. Oppgaveteksten er gjengitt i artikkelen, og jeg ble nysgjerring +på om den fri oversetterløsningen +Apertium ville gjort en bedre +jobb enn Utdanningsdirektoratet. Det kan se slik ut.

    + +

    Her er bokmålsoppgaven fra eksamenen:

    + +
    +

    Drøft utfordringene knyttet til nasjonalstatenes og andre aktørers +rolle og muligheter til å håndtere internasjonale utfordringer, som +for eksempel flykningekrisen.

    + +

    Vedlegge er eksempler på tekster som kan gi relevante perspektiver +på temaet:

    +
      +
    1. Flykningeregnskapet 2016, UNHCR og IDMC +
    2. «Grenseløst Europa for fall» A-Magasinet, 26. november 2015 +
    + +
    + +

    Dette oversetter Apertium slik:

    + +
    +

    Drøft utfordringane knytte til nasjonalstatane sine og rolla til +andre aktørar og høve til å handtera internasjonale utfordringar, som +til dømes *flykningekrisen.

    + +

    Vedleggja er døme på tekster som kan gje relevante perspektiv på +temaet:

    + +
      +
    1. *Flykningeregnskapet 2016, *UNHCR og *IDMC
      2. +
    2. «*Grenseløst Europa for fall» A-Magasinet, 26. november 2015
      3. +
    + +
    + +

    Ord som ikke ble forstått er markert med stjerne (*), og trenger +ekstra språksjekk. Men ingen ord er forsvunnet, slik det var i +oppgaven elevene fikk presentert på eksamen. Jeg mistenker dog at +"andre aktørers rolle og muligheter til ..." burde vært oversatt til +"rolla til andre aktørar og deira høve til ..." eller noe slikt, men +det er kanskje flisespikking. Det understreker vel bare at det alltid +trengs korrekturlesning etter automatisk oversettelse.

    - Tags: debian edu, english. + Tags: debian, norsk, stavekontroll.
    @@ -663,32 +495,67 @@ mail to press@debian.org.
    -
    I spent last weekend recording MakerCon Nordic
    -
    23rd October 2014
    -

    I spent last weekend at Makercon -Nordic, a great conference and workshop for makers in Norway and -the surrounding countries. I had volunteered on behalf of the -Norwegian Unix Users Group (NUUG) to video record the talks, and we -had a great and exhausting time recording the entire day, two days in -a row. There were only two of us, Hans-Petter and me, and we used the -regular video equipment for NUUG, with a -dvswitch, a -camera and a VGA to DV convert box, and mixed video and slides -live.

    - -

    Hans-Petter did the post-processing, consisting of uploading the -around 180 GiB of raw video to Youtube, and the result is -now becoming -public on the MakerConNordic account. The videos have the license -NUUG always use on our recordings, which is -Creative -Commons Navngivelse-Del på samme vilkår 3.0 Norge. Many great -talks available. Check it out! :)

    +
    Epost inn som arkivformat i Riksarkivarens forskrift?
    +
    27th April 2017
    +

    I disse dager, med frist 1. mai, har Riksarkivaren ute en høring på +sin forskrift. Som en kan se er det ikke mye tid igjen før fristen +som går ut på søndag. Denne forskriften er det som lister opp hvilke +formater det er greit å arkivere i +Noark +5-løsninger i Norge.

    + +

    Jeg fant høringsdokumentene hos +Norsk +Arkivråd etter å ha blitt tipset på epostlisten til +fri +programvareprosjektet Nikita Noark5-Core, som lager et Noark 5 +Tjenestegresesnitt. Jeg er involvert i Nikita-prosjektet og takket +være min interesse for tjenestegrensesnittsprosjektet har jeg lest en +god del Noark 5-relaterte dokumenter, og til min overraskelse oppdaget +at standard epost ikke er på listen over godkjente formater som kan +arkiveres. Høringen med frist søndag er en glimrende mulighet til å +forsøke å gjøre noe med det. Jeg holder på med +egen +høringsuttalelse, og lurer på om andre er interessert i å støtte +forslaget om å tillate arkivering av epost som epost i arkivet.

    + +

    Er du igang med å skrive egen høringsuttalelse allerede? I så fall +kan du jo vurdere å ta med en formulering om epost-lagring. Jeg tror +ikke det trengs så mye. Her et kort forslag til tekst:

    + +

    + +

    Viser til høring sendt ut 2017-02-17 (Riksarkivarens referanse + 2016/9840 HELHJO), og tillater oss å sende inn noen innspill om + revisjon av Forskrift om utfyllende tekniske og arkivfaglige + bestemmelser om behandling av offentlige arkiver (Riksarkivarens + forskrift).

    + +

    Svært mye av vår kommuikasjon foregår i dag på e-post.  Vi + foreslår derfor at Internett-e-post, slik det er beskrevet i IETF + RFC 5322, + https://tools.ietf.org/html/rfc5322. bør + inn som godkjent dokumentformat.  Vi foreslår at forskriftens + oversikt over godkjente dokumentformater ved innlevering i § 5-16 + endres til å ta med Internett-e-post.

    + +

    + +

    Som del av arbeidet med tjenestegrensesnitt har vi testet hvordan +epost kan lagres i en Noark 5-struktur, og holder på å skrive et +forslag om hvordan dette kan gjøres som vil bli sendt over til +arkivverket så snart det er ferdig. De som er interesserte kan +følge +fremdriften på web.

    + +

    Oppdatering 2017-04-28: I dag ble høringuttalelsen jeg skrev + sendt + inn av foreningen NUUG.

    - Tags: english, nuug, video. + Tags: norsk, offentlig innsyn, standard.
    @@ -696,96 +563,52 @@ talks available. Check it out! :)

    -
    listadmin, the quick way to moderate mailman lists - nice free software
    -
    22nd October 2014
    -

    If you ever had to moderate a mailman list, like the ones on -alioth.debian.org, you know the web interface is fairly slow to -operate. First you visit one web page, enter the moderation password -and get a new page shown with a list of all the messages to moderate -and various options for each email address. This take a while for -every list you moderate, and you need to do it regularly to do a good -job as a list moderator. But there is a quick alternative, -the -listadmin program. It allow you to check lists for new messages -to moderate in a fraction of a second. Here is a test run on two -lists I recently took over:

    - -

    -% time listadmin xiph
-fetching data for pkg-xiph-commits@lists.alioth.debian.org ... nothing in queue
-fetching data for pkg-xiph-maint@lists.alioth.debian.org ... nothing in queue
-
-real    0m1.709s
-user    0m0.232s
-sys     0m0.012s
+      
    Offentlig elektronisk postjournal blokkerer tilgang for utvalgte webklienter
    
+      
    20th April 2017
    
+      
    Jeg oppdaget i dag at nettstedet som
+publiserer offentlige postjournaler fra statlige etater, OEP, har
+begynt å blokkerer enkelte typer webklienter fra å få tilgang.  Vet
+ikke hvor mange det gjelder, men det gjelder i hvert fall libwww-perl
+og curl.  For å teste selv, kjør følgende:
    
+
+
    +% curl -v -s https://www.oep.no/pub/report.xhtml?reportId=3 2>&1 |grep '< HTTP'
+< HTTP/1.1 404 Not Found
+% curl -v -s --header 'User-Agent:Opera/12.0' https://www.oep.no/pub/report.xhtml?reportId=3 2>&1 |grep '< HTTP'
+< HTTP/1.1 200 OK
 %
-
    
-
-
    In 1.7 seconds I had checked two mailing lists and confirmed that
-there are no message in the moderation queue.  Every morning I
-currently moderate 68 mailman lists, and it normally take around two
-minutes.  When I took over the two pkg-xiph lists above a few days
-ago, there were 400 emails waiting in the moderator queue.  It took me
-less than 15 minutes to process them all using the listadmin
-program.
    
-
-
    If you install
-the listadmin
-package from Debian and create a file ~/.listadmin.ini
-with content like this, the moderation task is a breeze:
    
-
-
    -username username@example.org
-spamlevel 23
-default discard
-discard_if_reason "Posting restricted to members only. Remove us from your mail list."
-
-password secret
-adminurl https://{domain}/mailman/admindb/{list}
-mailman-list@lists.example.com
-
-password hidden
-other-list@otherserver.example.org
-
    
-
-
    There are other options to set as well.  Check the manual page to
-learn the details.
    
-
-
    If you are forced to moderate lists on a mailman installation where
-the SSL certificate is self signed or not properly signed by a
-generally accepted signing authority, you can set a environment
-variable when calling listadmin to disable SSL verification:
    
-
-
    -PERL_LWP_SSL_VERIFY_HOSTNAME=0 listadmin
-
    
-
-
    If you want to moderate a subset of the lists you take care of, you
-can provide an argument to the listadmin script like I do in the
-initial screen dump (the xiph argument).  Using an argument, only
-lists matching the argument string will be processed.  This make it
-quick to accept messages if you notice the moderation request in your
-email.
    
-
-
    Without the listadmin program, I would never be the moderator of 68
-mailing lists, as I simply do not have time to spend on that if the
-process was any slower. The listadmin program have saved me hours of
-time I could spend elsewhere over the years.  It truly is nice free
-software.
    
-
-
    As usual, if you use Bitcoin and want to show your support of my
-activities, please send Bitcoin donations to my address
-15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b.
    
-
-
    Update 2014-10-27: Added missing 'username' statement in
-configuration example.  Also, I've been told that the
-PERL_LWP_SSL_VERIFY_HOSTNAME=0 setting do not work for everyone.  Not
-sure why.
    
+
    + +

    Her kan en se at tjenesten gir «404 Not Found» for curl i +standardoppsettet, mens den gir «200 OK» hvis curl hevder å være Opera +versjon 12.0. Offentlig elektronisk postjournal startet blokkeringen +2017-03-02.

    + +

    Blokkeringen vil gjøre det litt vanskeligere å maskinelt hente +informasjon fra oep.no. Kan blokkeringen være gjort for å hindre +automatisert innsamling av informasjon fra OEP, slik Pressens +Offentlighetsutvalg gjorde for å dokumentere hvordan departementene +hindrer innsyn i +rapporten +«Slik hindrer departementer innsyn» som ble publiserte i januar +2017. Det virker usannsynlig, da det jo er trivielt å bytte +User-Agent til noe nytt.

    + +

    Finnes det juridisk grunnlag for det offentlige å diskriminere +webklienter slik det gjøres her? Der tilgang gis eller ikke alt etter +hva klienten sier at den heter? Da OEP eies av DIFI og driftes av +Basefarm, finnes det kanskje noen dokumenter sendt mellom disse to +aktørene man kan be om innsyn i for å forstå hva som har skjedd. Men +postjournalen +til DIFI viser kun to dokumenter det siste året mellom DIFI og +Basefarm. +Mimes brønn neste, +tenker jeg.

    - Tags: debian, english. + Tags: norsk, offentlig innsyn.
    @@ -793,114 +616,101 @@ sure why.

    -
    Debian Jessie, PXE and automatic firmware installation
    -
    17th October 2014
    -

    When PXE installing laptops with Debian, I often run into the -problem that the WiFi card require some firmware to work properly. -And it has been a pain to fix this using preseeding in Debian. -Normally something more is needed. But thanks to -my isenkram -package and its recent tasksel extension, it has now become easy -to do this using simple preseeding.

    - -

    The isenkram-cli package provide tasksel tasks which will install -firmware for the hardware found in the machine (actually, requested by -the kernel modules for the hardware). (It can also install user space -programs supporting the hardware detected, but that is not the focus -of this story.)

    - -

    To get this working in the default installation, two preeseding -values are needed. First, the isenkram-cli package must be installed -into the target chroot (aka the hard drive) before tasksel is executed -in the pkgsel step of the debian-installer system. This is done by -preseeding the base-installer/includes debconf value to include the -isenkram-cli package. The package name is next passed to debootstrap -for installation. With the isenkram-cli package in place, tasksel -will automatically use the isenkram tasks to detect hardware specific -packages for the machine being installed and install them, because -isenkram-cli contain tasksel tasks.

    - -

    Second, one need to enable the non-free APT repository, because -most firmware unfortunately is non-free. This is done by preseeding -the apt-mirror-setup step. This is unfortunate, but for a lot of -hardware it is the only option in Debian.

    - -

    The end result is two lines needed in your preseeding file to get -firmware installed automatically by the installer:

    - -

    -base-installer base-installer/includes string isenkram-cli
-apt-mirror-setup apt-setup/non-free boolean true
-

    - -

    The current version of isenkram-cli in testing/jessie will install -both firmware and user space packages when using this method. It also -do not work well, so use version 0.15 or later. Installing both -firmware and user space packages might give you a bit more than you -want, so I decided to split the tasksel task in two, one for firmware -and one for user space programs. The firmware task is enabled by -default, while the one for user space programs is not. This split is -implemented in the package currently in unstable.

    - -

    If you decide to give this a go, please let me know (via email) how -this recipe work for you. :)

    - -

    So, I bet you are wondering, how can this work. First and -foremost, it work because tasksel is modular, and driven by whatever -files it find in /usr/lib/tasksel/ and /usr/share/tasksel/. So the -isenkram-cli package place two files for tasksel to find. First there -is the task description file (/usr/share/tasksel/descs/isenkram.desc):

    - -

    -Task: isenkram-packages
-Section: hardware
-Description: Hardware specific packages (autodetected by isenkram)
- Based on the detected hardware various hardware specific packages are
- proposed.
-Test-new-install: show show
-Relevance: 8
-Packages: for-current-hardware
-
-Task: isenkram-firmware
-Section: hardware
-Description: Hardware specific firmware packages (autodetected by isenkram)
- Based on the detected hardware various hardware specific firmware
- packages are proposed.
-Test-new-install: mark show
-Relevance: 8
-Packages: for-current-hardware-firmware
-

    - -

    The key parts are Test-new-install which indicate how the task -should be handled and the Packages line referencing to a script in -/usr/lib/tasksel/packages/. The scripts use other scripts to get a -list of packages to install. The for-current-hardware-firmware script -look like this to list relevant firmware for the machine: +

    Free software archive system Nikita now able to store documents
    +
    19th March 2017
    +

    The Nikita +Noark 5 core project is implementing the Norwegian standard for +keeping an electronic archive of government documents. +The +Noark 5 standard document the requirement for data systems used by +the archives in the Norwegian government, and the Noark 5 web interface +specification document a REST web service for storing, searching and +retrieving documents and metadata in such archive. I've been involved +in the project since a few weeks before Christmas, when the Norwegian +Unix User Group +announced +it supported the project. I believe this is an important project, +and hope it can make it possible for the government archives in the +future to use free software to keep the archives we citizens depend +on. But as I do not hold such archive myself, personally my first use +case is to store and analyse public mail journal metadata published +from the government. I find it useful to have a clear use case in +mind when developing, to make sure the system scratches one of my +itches.

    + +

    If you would like to help make sure there is a free software +alternatives for the archives, please join our IRC channel +(#nikita on +irc.freenode.net) and +the +project mailing list.

    + +

    When I got involved, the web service could store metadata about +documents. But a few weeks ago, a new milestone was reached when it +became possible to store full text documents too. Yesterday, I +completed an implementation of a command line tool +archive-pdf to upload a PDF file to the archive using this +API. The tool is very simple at the moment, and find existing +fonds, series and +files while asking the user to select which one to use if more than +one exist. Once a file is identified, the PDF is associated with the +file and uploaded, using the title extracted from the PDF itself. The +process is fairly similar to visiting the archive, opening a cabinet, +locating a file and storing a piece of paper in the archive. Here is +a test run directly after populating the database with test data using +our API tester:

    -#!/bin/sh
-#
-PATH=/usr/sbin:$PATH
-export PATH
-isenkram-autoinstall-firmware -l
+~/src//noark5-tester$ ./archive-pdf mangelmelding/mangler.pdf
+using arkiv: Title of the test fonds created 2017-03-18T23:49:32.103446
+using arkivdel: Title of the test series created 2017-03-18T23:49:32.103446
+
+ 0 - Title of the test case file created 2017-03-18T23:49:32.103446
+ 1 - Title of the test file created 2017-03-18T23:49:32.103446
+Select which mappe you want (or search term): 0
+Uploading mangelmelding/mangler.pdf
+  PDF title: Mangler i spesifikasjonsdokumentet for NOARK 5 Tjenestegrensesnitt
+  File 2017/1: Title of the test case file created 2017-03-18T23:49:32.103446
+~/src//noark5-tester$

    -

    With those two pieces in place, the firmware is installed by -tasksel during the normal d-i run. :)

    - -

    If you want to test what tasksel will install when isenkram-cli is -installed, run DEBIAN_PRIORITY=critical tasksel --test ---new-install to get the list of packages that tasksel would -install.

    - -

    Debian Edu will be -pilots in testing this feature, as isenkram is used there now to -install firmware, replacing the earlier scripts.

    +

    You can see here how the fonds (arkiv) and serie (arkivdel) only had +one option, while the user need to choose which file (mappe) to use +among the two created by the API tester. The archive-pdf +tool can be found in the git repository for the API tester.

    + +

    In the project, I have been mostly working on +the API +tester so far, while getting to know the code base. The API +tester currently use +the HATEOAS links +to traverse the entire exposed service API and verify that the exposed +operations and objects match the specification, as well as trying to +create objects holding metadata and uploading a simple XML file to +store. The tester has proved very useful for finding flaws in our +implementation, as well as flaws in the reference site and the +specification.

    + +

    The test document I uploaded is a summary of all the specification +defects we have collected so far while implementing the web service. +There are several unclear and conflicting parts of the specification, +and we have +started +writing down the questions we get from implementing it. We use a +format inspired by how The +Austin Group collect defect reports for the POSIX standard with +their +instructions for the MANTIS defect tracker system, in lack of an official way to structure defect reports for Noark 5 (our first submitted defect report was a request for a procedure for submitting defect reports :). + +

    The Nikita project is implemented using Java and Spring, and is +fairly easy to get up and running using Docker containers for those +that want to test the current code base. The API tester is +implemented in Python.

    - Tags: debian, english, isenkram, sysadmin. + Tags: english, nuug, offentlig innsyn, standard.
    @@ -915,6 +725,83 @@ install firmware, replacing the earlier scripts.

    Archive