blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2           "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
   4   <head>
   5     <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
   6     <title>Petter Reinholdtsen</title>
   7     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css" />
   8     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/vim.css" />
   9     <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml" />
  10   </head>
  11   <body>
  12     <div class="title">
  13  <h1>
  14      <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16  </h1>
  17
  18 </div>
  19
  20
  21
  22     <div class="entry">
  23       <div class="title"><a href="http://people.skolelinux.org/pere/blog/Half_the_Coverity_issues_in_Gnash_fixed_in_the_next_release.html">Half the Coverity issues in Gnash fixed in the next release</a></div>
  24       <div class="date">29th April 2014</div>
  25       <div class="body"><p>I've been following <a href="http://www.getgnash.org/">the Gnash
  26 project</a> for quite a while now.  It is a free software
  27 implementation of Adobe Flash, both a standalone player and a browser
  28 plugin.  Gnash implement support for the AVM1 format (and not the
  29 newer AVM2 format - see
  30 <a href="http://lightspark.github.io/">Lightspark</a> for that one),
  31 allowing several flash based sites to work.  Thanks to the friendly
  32 developers at Youtube, it also work with Youtube videos, because the
  33 Javascript code at Youtube detect Gnash and serve a AVM1 player to
  34 those users. :) Would be great if someone found time to implement AVM2
  35 support, but it has not happened yet.  If you install both Lightspark
  36 and Gnash, Lightspark will invoke Gnash if it find a AVM1 flash file,
  37 so you can get both handled as free software.  Unfortunately,
  38 Lightspark so far only implement a small subset of AVM2, and many
  39 sites do not work yet.</p>
  40
  41 <p>A few months ago, I started looking at
  42 <a href="http://scan.coverity.com/">Coverity</a>, the static source
  43 checker used to find heaps and heaps of bugs in free software (thanks
  44 to the donation of a scanning service to free software projects by the
  45 company developing this non-free code checker), and Gnash was one of
  46 the projects I decided to check out.  Coverity is able to find lock
  47 errors, memory errors, dead code and more.  A few days ago they even
  48 extended it to also be able to find the heartbleed bug in OpenSSL.
  49 There are heaps of checks being done on the instrumented code, and the
  50 amount of bogus warnings is quite low compared to the other static
  51 code checkers I have tested over the years.</p>
  52
  53 <p>Since a few weeks ago, I've been working with the other Gnash
  54 developers squashing bugs discovered by Coverity.  I was quite happy
  55 today when I checked the current status and saw that of the 777 issues
  56 detected so far, 374 are marked as fixed.  This make me confident that
  57 the next Gnash release will be more stable and more dependable than
  58 the previous one.  Most of the reported issues were and are in the
  59 test suite, but it also found a few in the rest of the code.</p>
  60
  61 <p>If you want to help out, you find us on
  62 <a href="https://lists.gnu.org/mailman/listinfo/gnash-dev">the
  63 gnash-dev mailing list</a> and on
  64 <a href="irc://irc.freenode.net/#gnash">the #gnash channel on
  65 irc.freenode.net IRC server</a>.</p>
  66 </div>
  67       <div class="tags">
  68
  69
  70         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia</a>, <a href="http://people.skolelinux.org/pere/blog/tags/video">video</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
  71
  72
  73       </div>
  74     </div>
  75     <div class="padding"></div>
  76
  77     <div class="entry">
  78       <div class="title"><a href="http://people.skolelinux.org/pere/blog/Install_hardware_dependent_packages_using_tasksel__Isenkram_0_7_.html">Install hardware dependent packages using tasksel (Isenkram 0.7)</a></div>
  79       <div class="date">23rd April 2014</div>
  80       <div class="body"><p>It would be nice if it was easier in Debian to get all the hardware
  81 related packages relevant for the computer installed automatically.
  82 So I implemented one, using
  83 <a href="http://packages.qa.debian.org/isenkram">my Isenkram
  84 package</a>.  To use it, install the tasksel and isenkram packages and
  85 run tasksel as user root.  You should be presented with a new option,
  86 "Hardware specific packages (autodetected by isenkram)".  When you
  87 select it, tasksel will install the packages isenkram claim is fit for
  88 the current hardware, hot pluggable or not.<p>
  89
  90 <p>The implementation is in two files, one is the tasksel menu entry
  91 description, and the other is the script used to extract the list of
  92 packages to install.  The first part is in
  93 <tt>/usr/share/tasksel/descs/isenkram.desc</tt> and look like
  94 this:</p>
  95
  96 <p><blockquote><pre>
  97 Task: isenkram
  98 Section: hardware
  99 Description: Hardware specific packages (autodetected by isenkram)
 100  Based on the detected hardware various hardware specific packages are
 101  proposed.
 102 Test-new-install: mark show
 103 Relevance: 8
 104 Packages: for-current-hardware
 105 </pre></blockquote></p>
 106
 107 <p>The second part is in
 108 <tt>/usr/lib/tasksel/packages/for-current-hardware</tt> and look like
 109 this:</p>
 110
 111 <p><blockquote><pre>
 112 #!/bin/sh
 113 #
 114 (
 115     isenkram-lookup
 116     isenkram-autoinstall-firmware -l
 117 ) | sort -u
 118 </pre></blockquote></p>
 119
 120 <p>All in all, a very short and simple implementation making it
 121 trivial to install the hardware dependent package we all may want to
 122 have installed on our machines.  I've not been able to find a way to
 123 get tasksel to tell you exactly which packages it plan to install
 124 before doing the installation.  So if you are curious or careful,
 125 check the output from the isenkram-* command line tools first.</p>
 126
 127 <p>The information about which packages are handling which hardware is
 128 fetched either from the isenkram package itself in
 129 /usr/share/isenkram/, from git.debian.org or from the APT package
 130 database (using the Modaliases header).  The APT package database
 131 parsing have caused a nasty resource leak in the isenkram daemon (bugs
 132 <a href="http://bugs.debian.org/719837">#719837</a> and
 133 <a href="http://bugs.debian.org/730704">#730704</a>).  The cause is in
 134 the python-apt code (bug
 135 <a href="http://bugs.debian.org/745487">#745487</a>), but using a
 136 workaround I was able to get rid of the file descriptor leak and
 137 reduce the memory leak from ~30 MiB per hardware detection down to
 138 around 2 MiB per hardware detection.  It should make the desktop
 139 daemon a lot more useful.  The fix is in version 0.7 uploaded to
 140 unstable today.</p>
 141
 142 <p>I believe the current way of mapping hardware to packages in
 143 Isenkram is is a good draft, but in the future I expect isenkram to
 144 use the AppStream data source for this.  A proposal for getting proper
 145 AppStream support into Debian is floating around as
 146 <a href="https://wiki.debian.org/DEP-11">DEP-11</a>, and
 147 <a href="https://wiki.debian.org/SummerOfCode2014/Projects#SummerOfCode2014.2FProjects.2FAppStreamDEP11Implementation.AppStream.2FDEP-11_for_the_Debian_Archive">GSoC
 148 project</a> will take place this summer to improve the situation.  I
 149 look forward to seeing the result, and welcome patches for isenkram to
 150 start using the information when it is ready.</p>
 151
 152 <p>If you want your package to map to some specific hardware, either
 153 add a "Xb-Modaliases" header to your control file like I did in
 154 <a href="http://packages.qa.debian.org/pymissile">the pymissile
 155 package</a> or submit a bug report with the details to the isenkram
 156 package.  See also
 157 <a href="http://people.skolelinux.org/pere/blog/tags/isenkram/">all my
 158 blog posts tagged isenkram</a> for details on the notation.  I expect
 159 the information will be migrated to AppStream eventually, but for the
 160 moment I got no better place to store it.</p>
 161 </div>
 162       <div class="tags">
 163
 164
 165         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/isenkram">isenkram</a>.
 166
 167
 168       </div>
 169     </div>
 170     <div class="padding"></div>
 171
 172     <div class="entry">
 173       <div class="title"><a href="http://people.skolelinux.org/pere/blog/FreedomBox_milestone___all_packages_now_in_Debian_Sid.html">FreedomBox milestone - all packages now in Debian Sid</a></div>
 174       <div class="date">15th April 2014</div>
 175       <div class="body"><p>The <a href="https://wiki.debian.org/FreedomBox">Freedombox
 176 project</a> is working on providing the software and hardware to make
 177 it easy for non-technical people to host their data and communication
 178 at home, and being able to communicate with their friends and family
 179 encrypted and away from prying eyes.  It is still going strong, and
 180 today a major mile stone was reached.</p>
 181
 182 <p>Today, the last of the packages currently used by the project to
 183 created the system images were accepted into Debian Unstable.  It was
 184 the freedombox-setup package, which is used to configure the images
 185 during build and on the first boot.  Now all one need to get going is
 186 the build code from the freedom-maker git repository and packages from
 187 Debian.  And once the freedombox-setup package enter testing, we can
 188 build everything directly from Debian. :)</p>
 189
 190 <p>Some key packages used by Freedombox are
 191 <a href="http://packages.qa.debian.org/freedombox-setup">freedombox-setup</a>,
 192 <a href="http://packages.qa.debian.org/plinth">plinth</a>,
 193 <a href="http://packages.qa.debian.org/pagekite">pagekite</a>,
 194 <a href="http://packages.qa.debian.org/tor">tor</a>,
 195 <a href="http://packages.qa.debian.org/privoxy">privoxy</a>,
 196 <a href="http://packages.qa.debian.org/owncloud">owncloud</a> and
 197 <a href="http://packages.qa.debian.org/dnsmasq">dnsmasq</a>.  There
 198 are plans to integrate more packages into the setup.  User
 199 documentation is maintained on the Debian wiki.  Please
 200 <a href="https://wiki.debian.org/FreedomBox/Manual/Jessie">check out
 201 the manual</a> and help us improve it.</p>
 202
 203 <p>To test for yourself and create boot images with the FreedomBox
 204 setup, run this on a Debian machine using a user with sudo rights to
 205 become root:</p>
 206
 207 <p><pre>
 208 sudo apt-get install git vmdebootstrap mercurial python-docutils \
 209   mktorrent extlinux virtualbox qemu-user-static binfmt-support \
 210   u-boot-tools
 211 git clone http://anonscm.debian.org/git/freedombox/freedom-maker.git \
 212   freedom-maker
 213 make -C freedom-maker dreamplug-image raspberry-image virtualbox-image
 214 </pre></p>
 215
 216 <p>Root access is needed to run debootstrap and mount loopback
 217 devices.  See the README in the freedom-maker git repo for more
 218 details on the build.  If you do not want all three images, trim the
 219 make line.  Note that the virtualbox-image target is not really
 220 virtualbox specific.  It create a x86 image usable in kvm, qemu,
 221 vmware and any other x86 virtual machine environment.  You might need
 222 the version of vmdebootstrap in Jessie to get the build working, as it
 223 include fixes for a race condition with kpartx.</p>
 224
 225 <p>If you instead want to install using a Debian CD and the preseed
 226 method, boot a Debian Wheezy ISO and use this boot argument to load
 227 the preseed values:</p>
 228
 229 <p><pre>
 230 url=<a href="http://www.reinholdtsen.name/freedombox/preseed-jessie.dat">http://www.reinholdtsen.name/freedombox/preseed-jessie.dat</a>
 231 </pre></p>
 232
 233 <p>I have not tested it myself the last few weeks, so I do not know if
 234 it still work.</p>
 235
 236 <p>If you wonder how to help, one task you could look at is using
 237 systemd as the boot system.  It will become the default for Linux in
 238 Jessie, so we need to make sure it is usable on the Freedombox.  I did
 239 a simple test a few weeks ago, and noticed dnsmasq failed to start
 240 during boot when using systemd.  I suspect there are other problems
 241 too. :) To detect problems, there is a test suite included, which can
 242 be run from the plinth web interface.</p>
 243
 244 <p>Give it a go and let us know how it goes on the mailing list, and help
 245 us get the new release published. :) Please join us on
 246 <a href="irc://irc.debian.org:6667/%23freedombox">IRC (#freedombox on
 247 irc.debian.org)</a> and
 248 <a href="http://lists.alioth.debian.org/mailman/listinfo/freedombox-discuss">the
 249 mailing list</a> if you want to help make this vision come true.</p>
 250 </div>
 251       <div class="tags">
 252
 253
 254         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/freedombox">freedombox</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
 255
 256
 257       </div>
 258     </div>
 259     <div class="padding"></div>
 260
 261     <div class="entry">
 262       <div class="title"><a href="http://people.skolelinux.org/pere/blog/Spr_kkoder_for_POSIX_locale_i_Norge.html">Språkkoder for POSIX locale i Norge</a></div>
 263       <div class="date">11th April 2014</div>
 264       <div class="body"><p>For 12 år siden, skrev jeg et lite notat om
 265 <a href="http://i18n.skolelinux.no/localekoder.txt">bruk av språkkoder
 266 i Norge</a>.  Jeg ble nettopp minnet på dette da jeg fikk spørsmål om
 267 notatet fortsatt var aktuelt, og tenkte det var greit å repetere hva
 268 som fortsatt gjelder.  Det jeg skrev da er fortsatt like aktuelt.</p>
 269
 270 <p>Når en velger språk i programmer på unix, så velger en blant mange
 271 språkkoder.  For språk i Norge anbefales følgende språkkoder (anbefalt
 272 locale i parantes):</p>
 273
 274 <p><dl>
 275 <dt>nb (nb_NO)</dt><dd>Bokmål i Norge</dd>
 276 <dt>nn (nn_NO)</dt><dd>Nynorsk i Norge</dd>
 277 <dt>se (se_NO)</dt><dd>Nordsamisk i Norge</dd>
 278 </dl></p>
 279
 280 <p>Alle programmer som bruker andre koder bør endres.</p>
 281
 282 <p>Språkkoden bør brukes når .po-filer navngis og installeres.  Dette
 283 er ikke det samme som locale-koden.  For Norsk Bokmål, så bør filene
 284 være navngitt nb.po, mens locale (LANG) bør være nb_NO.</p>
 285
 286 <p>Hvis vi ikke får standardisert de kodene i alle programmene med
 287 norske oversettelser, så er det umulig å gi LANG-variablen ett innhold
 288 som fungerer for alle programmer.</p>
 289
 290 <p>Språkkodene er de offisielle kodene fra ISO 639, og bruken av dem i
 291 forbindelse med POSIX localer er standardisert i RFC 3066 og ISO
 292 15897.  Denne anbefalingen er i tråd med de angitte standardene.</p>
 293
 294 <p>Følgende koder er eller har vært i bruk som locale-verdier for
 295 "norske" språk.  Disse bør unngås, og erstattes når de oppdages:</p>
 296
 297 <p><table>
 298 <tr><td>norwegian</td><td>-> nb_NO</td></tr>
 299 <tr><td>bokmål   </td><td>-> nb_NO</td></tr>
 300 <tr><td>bokmal   </td><td>-> nb_NO</td></tr>
 301 <tr><td>nynorsk  </td><td>-> nn_NO</td></tr>
 302 <tr><td>no       </td><td>-> nb_NO</td></tr>
 303 <tr><td>no_NO    </td><td>-> nb_NO</td></tr>
 304 <tr><td>no_NY    </td><td>-> nn_NO</td></tr>
 305 <tr><td>sme_NO   </td><td>-> se_NO</td></tr>
 306 </table></p>
 307
 308 <p>Merk at når det gjelder de samiske språkene, at se_NO i praksis
 309 henviser til nordsamisk i Norge, mens f.eks.  smj_NO henviser til
 310 lulesamisk.  Dette notatet er dog ikke ment å gi råd rundt samiske
 311 språkkoder, der gjør
 312 <a href="http://www.divvun.no/">Divvun-prosjektet</a> en bedre
 313 jobb.</p>
 314
 315 <p><strong>Referanser:</strong></p>
 316
 317 <ul>
 318
 319   <li><a href="http://www.rfc-base.org/rfc-3066.html">RFC 3066 - Tags
 320     for the Identification of Languages</a> (Erstatter RFC 1766)</li>
 321
 322   <li><a href="http://www.loc.gov/standards/iso639-2/langcodes.html">ISO
 323     639</a> - Codes for the Representation of Names of Languages</li>
 324
 325   <li><a href="http://std.dkuug.dk/jtc1/sc22/wg20/docs/n897-14652w25.pdf">ISO
 326     DTR 14652</a> - locale-standard Specification method for cultural
 327     conventions</li>
 328
 329   <li><a href="http://std.dkuug.dk/jtc1/sc22/wg20/docs/n610.pdf">ISO
 330     15897: Registration procedures for cultural elements (cultural
 331     registry)</a>,
 332     <a href="http://std.dkuug.dk/jtc1/sc22/wg20/docs/n849-15897wd6.pdf">(nytt
 333     draft)</a></li>
 334
 335   <li><a href="http://std.dkuug.dk/jtc1/sc22/wg20/">ISO/IEC
 336     JTC1/SC22/WG20</a> - Gruppen for i18n-standardisering i ISO</li>
 337
 338 <ul>
 339 </div>
 340       <div class="tags">
 341
 342
 343         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>.
 344
 345
 346       </div>
 347     </div>
 348     <div class="padding"></div>
 349
 350     <div class="entry">
 351       <div class="title"><a href="http://people.skolelinux.org/pere/blog/S3QL__a_locally_mounted_cloud_file_system___nice_free_software.html">S3QL, a locally mounted cloud file system - nice free software</a></div>
 352       <div class="date"> 9th April 2014</div>
 353       <div class="body"><p>For a while now, I have been looking for a sensible offsite backup
 354 solution for use at home.  My requirements are simple, it must be
 355 cheap and locally encrypted (in other words, I keep the encryption
 356 keys, the storage provider do not have access to my private files).
 357 One idea me and my friends had many years ago, before the cloud
 358 storage providers showed up, was to use Google mail as storage,
 359 writing a Linux block device storing blocks as emails in the mail
 360 service provided by Google, and thus get heaps of free space.  On top
 361 of this one can add encryption, RAID and volume management to have
 362 lots of (fairly slow, I admit that) cheap and encrypted storage.  But
 363 I never found time to implement such system.  But the last few weeks I
 364 have looked at a system called
 365 <a href="https://bitbucket.org/nikratio/s3ql/">S3QL</a>, a locally
 366 mounted network backed file system with the features I need.</p>
 367
 368 <p>S3QL is a fuse file system with a local cache and cloud storage,
 369 handling several different storage providers, any with Amazon S3,
 370 Google Drive or OpenStack API.  There are heaps of such storage
 371 providers.  S3QL can also use a local directory as storage, which
 372 combined with sshfs allow for file storage on any ssh server.  S3QL
 373 include support for encryption, compression, de-duplication, snapshots
 374 and immutable file systems, allowing me to mount the remote storage as
 375 a local mount point, look at and use the files as if they were local,
 376 while the content is stored in the cloud as well.  This allow me to
 377 have a backup that should survive fire.  The file system can not be
 378 shared between several machines at the same time, as only one can
 379 mount it at the time, but any machine with the encryption key and
 380 access to the storage service can mount it if it is unmounted.</p>
 381
 382 <p>It is simple to use.  I'm using it on Debian Wheezy, where the
 383 package is included already.  So to get started, run <tt>apt-get
 384 install s3ql</tt>.  Next, pick a storage provider.  I ended up picking
 385 Greenqloud, after reading their nice recipe on
 386 <a href="https://greenqloud.zendesk.com/entries/44611757-How-To-Use-S3QL-to-mount-a-StorageQloud-bucket-on-Debian-Wheezy">how
 387 to use S3QL with their Amazon S3 service</a>, because I trust the laws
 388 in Iceland more than those in USA when it come to keeping my personal
 389 data safe and private, and thus would rather spend money on a company
 390 in Iceland.  Another nice recipe is available from the article
 391 <a href="http://www.admin-magazine.com/HPC/Articles/HPC-Cloud-Storage">S3QL
 392 Filesystem for HPC Storage</a> by Jeff Layton in the HPC section of
 393 Admin magazine.  When the provider is picked, figure out how to get
 394 the API key needed to connect to the storage API.  With Greencloud,
 395 the key did not show up until I had added payment details to my
 396 account.</p>
 397
 398 <p>Armed with the API access details, it is time to create the file
 399 system.  First, create a new bucket in the cloud.  This bucket is the
 400 file system storage area.  I picked a bucket name reflecting the
 401 machine that was going to store data there, but any name will do.
 402 I'll refer to it as <tt>bucket-name</tt> below.  In addition, one need
 403 the API login and password, and a locally created password.  Store it
 404 all in ~root/.s3ql/authinfo2 like this:
 405
 406 <p><blockquote><pre>
 407 [s3c]
 408 storage-url: s3c://s.greenqloud.com:443/bucket-name
 409 backend-login: API-login
 410 backend-password: API-password
 411 fs-passphrase: local-password
 412 </pre></blockquote></p>
 413
 414 <p>I create my local passphrase using <tt>pwget 50</tt> or similar,
 415 but any sensible way to create a fairly random password should do it.
 416 Armed with these details, it is now time to run mkfs, entering the API
 417 details and password to create it:</p>
 418
 419 <p><blockquote><pre>
 420 # mkdir -m 700 /var/lib/s3ql-cache
 421 # mkfs.s3ql --cachedir /var/lib/s3ql-cache --authfile /root/.s3ql/authinfo2 \
 422   --ssl s3c://s.greenqloud.com:443/bucket-name
 423 Enter backend login:
 424 Enter backend password:
 425 Before using S3QL, make sure to read the user's guide, especially
 426 the 'Important Rules to Avoid Loosing Data' section.
 427 Enter encryption password:
 428 Confirm encryption password:
 429 Generating random encryption key...
 430 Creating metadata tables...
 431 Dumping metadata...
 432 ..objects..
 433 ..blocks..
 434 ..inodes..
 435 ..inode_blocks..
 436 ..symlink_targets..
 437 ..names..
 438 ..contents..
 439 ..ext_attributes..
 440 Compressing and uploading metadata...
 441 Wrote 0.00 MB of compressed metadata.
 442 # </pre></blockquote></p>
 443
 444 <p>The next step is mounting the file system to make the storage available.
 445
 446 <p><blockquote><pre>
 447 # mount.s3ql --cachedir /var/lib/s3ql-cache --authfile /root/.s3ql/authinfo2 \
 448   --ssl --allow-root s3c://s.greenqloud.com:443/bucket-name /s3ql
 449 Using 4 upload threads.
 450 Downloading and decompressing metadata...
 451 Reading metadata...
 452 ..objects..
 453 ..blocks..
 454 ..inodes..
 455 ..inode_blocks..
 456 ..symlink_targets..
 457 ..names..
 458 ..contents..
 459 ..ext_attributes..
 460 Mounting filesystem...
 461 # df -h /s3ql
 462 Filesystem                              Size  Used Avail Use% Mounted on
 463 s3c://s.greenqloud.com:443/bucket-name  1.0T     0  1.0T   0% /s3ql
 464 #
 465 </pre></blockquote></p>
 466
 467 <p>The file system is now ready for use.  I use rsync to store my
 468 backups in it, and as the metadata used by rsync is downloaded at
 469 mount time, no network traffic (and storage cost) is triggered by
 470 running rsync.  To unmount, one should not use the normal umount
 471 command, as this will not flush the cache to the cloud storage, but
 472 instead running the umount.s3ql command like this:
 473
 474 <p><blockquote><pre>
 475 # umount.s3ql /s3ql
 476 #
 477 </pre></blockquote></p>
 478
 479 <p>There is a fsck command available to check the file system and
 480 correct any problems detected.  This can be used if the local server
 481 crashes while the file system is mounted, to reset the "already
 482 mounted" flag.  This is what it look like when processing a working
 483 file system:</p>
 484
 485 <p><blockquote><pre>
 486 # fsck.s3ql --force --ssl s3c://s.greenqloud.com:443/bucket-name
 487 Using cached metadata.
 488 File system seems clean, checking anyway.
 489 Checking DB integrity...
 490 Creating temporary extra indices...
 491 Checking lost+found...
 492 Checking cached objects...
 493 Checking names (refcounts)...
 494 Checking contents (names)...
 495 Checking contents (inodes)...
 496 Checking contents (parent inodes)...
 497 Checking objects (reference counts)...
 498 Checking objects (backend)...
 499 ..processed 5000 objects so far..
 500 ..processed 10000 objects so far..
 501 ..processed 15000 objects so far..
 502 Checking objects (sizes)...
 503 Checking blocks (referenced objects)...
 504 Checking blocks (refcounts)...
 505 Checking inode-block mapping (blocks)...
 506 Checking inode-block mapping (inodes)...
 507 Checking inodes (refcounts)...
 508 Checking inodes (sizes)...
 509 Checking extended attributes (names)...
 510 Checking extended attributes (inodes)...
 511 Checking symlinks (inodes)...
 512 Checking directory reachability...
 513 Checking unix conventions...
 514 Checking referential integrity...
 515 Dropping temporary indices...
 516 Backing up old metadata...
 517 Dumping metadata...
 518 ..objects..
 519 ..blocks..
 520 ..inodes..
 521 ..inode_blocks..
 522 ..symlink_targets..
 523 ..names..
 524 ..contents..
 525 ..ext_attributes..
 526 Compressing and uploading metadata...
 527 Wrote 0.89 MB of compressed metadata.
 528 #
 529 </pre></blockquote></p>
 530
 531 <p>Thanks to the cache, working on files that fit in the cache is very
 532 quick, about the same speed as local file access.  Uploading large
 533 amount of data is to me limited by the bandwidth out of and into my
 534 house.  Uploading 685 MiB with a 100 MiB cache gave me 305 kiB/s,
 535 which is very close to my upload speed, and downloading the same
 536 Debian installation ISO gave me 610 kiB/s, close to my download speed.
 537 Both were measured using <tt>dd</tt>.  So for me, the bottleneck is my
 538 network, not the file system code.  I do not know what a good cache
 539 size would be, but suspect that the cache should e larger than your
 540 working set.</p>
 541
 542 <p>I mentioned that only one machine can mount the file system at the
 543 time.  If another machine try, it is told that the file system is
 544 busy:</p>
 545
 546 <p><blockquote><pre>
 547 # mount.s3ql --cachedir /var/lib/s3ql-cache --authfile /root/.s3ql/authinfo2 \
 548   --ssl --allow-root s3c://s.greenqloud.com:443/bucket-name /s3ql
 549 Using 8 upload threads.
 550 Backend reports that fs is still mounted elsewhere, aborting.
 551 #
 552 </pre></blockquote></p>
 553
 554 <p>The file content is uploaded when the cache is full, while the
 555 metadata is uploaded once every 24 hour by default.  To ensure the
 556 file system content is flushed to the cloud, one can either umount the
 557 file system, or ask S3QL to flush the cache and metadata using
 558 s3qlctrl:
 559
 560 <p><blockquote><pre>
 561 # s3qlctrl upload-meta /s3ql
 562 # s3qlctrl flushcache /s3ql
 563 #
 564 </pre></blockquote></p>
 565
 566 <p>If you are curious about how much space your data uses in the
 567 cloud, and how much compression and deduplication cut down on the
 568 storage usage, you can use s3qlstat on the mounted file system to get
 569 a report:</p>
 570
 571 <p><blockquote><pre>
 572 # s3qlstat /s3ql
 573 Directory entries:    9141
 574 Inodes:               9143
 575 Data blocks:          8851
 576 Total data size:      22049.38 MB
 577 After de-duplication: 21955.46 MB (99.57% of total)
 578 After compression:    21877.28 MB (99.22% of total, 99.64% of de-duplicated)
 579 Database size:        2.39 MB (uncompressed)
 580 (some values do not take into account not-yet-uploaded dirty blocks in cache)
 581 #
 582 </pre></blockquote></p>
 583
 584 <p>I mentioned earlier that there are several possible suppliers of
 585 storage.  I did not try to locate them all, but am aware of at least
 586 <a href="https://www.greenqloud.com/">Greenqloud</a>,
 587 <a href="http://drive.google.com/">Google Drive</a>,
 588 <a href="http://aws.amazon.com/s3/">Amazon S3 web serivces</a>,
 589 <a href="http://www.rackspace.com/">Rackspace</a> and
 590 <a href="http://crowncloud.net/">Crowncloud</A>.  The latter even
 591 accept payment in Bitcoin.  Pick one that suit your need.  Some of
 592 them provide several GiB of free storage, but the prize models are
 593 quite different and you will have to figure out what suits you
 594 best.</p>
 595
 596 <p>While researching this blog post, I had a look at research papers
 597 and posters discussing the S3QL file system.  There are several, which
 598 told me that the file system is getting a critical check by the
 599 science community and increased my confidence in using it.  One nice
 600 poster is titled
 601 "<a href="http://www.lanl.gov/orgs/adtsc/publications/science_highlights_2013/docs/pg68_69.pdf">An
 602 Innovative Parallel Cloud Storage System using OpenStack’s SwiftObject
 603 Store and Transformative Parallel I/O Approach</a>" by Hsing-Bung
 604 Chen, Benjamin McClelland, David Sherrill, Alfred Torrez, Parks Fields
 605 and Pamela Smith.  Please  have a look.</p>
 606
 607 <p>Given my problems with different file systems earlier, I decided to
 608 check out the mounted S3QL file system to see if it would be usable as
 609 a home directory (in other word, that it provided POSIX semantics when
 610 it come to locking and umask handling etc).  Running
 611 <a href="http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html">my
 612 test code to check file system semantics</a>, I was happy to discover that
 613 no error was found.  So the file system can be used for home
 614 directories, if one chooses to do so.</p>
 615
 616 <p>If you do not want a locally file system, and want something that
 617 work without the Linux fuse file system, I would like to mention the
 618 <a href="http://www.tarsnap.com/">Tarsnap service</a>, which also
 619 provide locally encrypted backup using a command line client.  It have
 620 a nicer access control system, where one can split out read and write
 621 access, allowing some systems to write to the backup and others to
 622 only read from it.</p>
 623
 624 <p>As usual, if you use Bitcoin and want to show your support of my
 625 activities, please send Bitcoin donations to my address
 626 <b><a href="bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&label=PetterReinholdtsenBlog">15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b</a></b>.</p>
 627 </div>
 628       <div class="tags">
 629
 630
 631         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 632
 633
 634       </div>
 635     </div>
 636     <div class="padding"></div>
 637
 638     <div class="entry">
 639       <div class="title"><a href="http://people.skolelinux.org/pere/blog/EU_domstolen_bekreftet_i_dag_at_datalagringsdirektivet_er_ulovlig.html">EU-domstolen bekreftet i dag at datalagringsdirektivet er ulovlig</a></div>
 640       <div class="date"> 8th April 2014</div>
 641       <div class="body"><p>I dag kom endelig avgjørelsen fra EU-domstolen om
 642 datalagringsdirektivet, som ikke overraskende ble dømt ulovlig og i
 643 strid med borgernes grunnleggende rettigheter.  Hvis du lurer på hva
 644 datalagringsdirektivet er for noe, så er det
 645 <a href="http://tv.nrk.no/program/koid75005313/tema-dine-digitale-spor-datalagringsdirektivet">en
 646 flott dokumentar tilgjengelig hos NRK</a> som jeg tidligere
 647 <a href="http://people.skolelinux.org/pere/blog/Dokumentaren_om_Datalagringsdirektivet_sendes_endelig_p__NRK.html">har
 648 anbefalt</a> alle å se.</p>
 649
 650 <p>Her er et liten knippe nyhetsoppslag om saken, og jeg regner med at
 651 det kommer flere ut over dagen.  Flere kan finnes
 652 <a href="http://www.mylder.no/?drill=datalagringsdirektivet&intern=1">via
 653 mylder</a>.</p>
 654
 655 <p><ul>
 656
 657 <li><a href="http://e24.no/digital/eu-domstolen-datalagringsdirektivet-er-ugyldig/22879592">EU-domstolen:
 658 Datalagringsdirektivet er ugyldig</a> - e24.no 2014-04-08
 659
 660 <li><a href="http://www.aftenposten.no/nyheter/iriks/EU-domstolen-Datalagringsdirektivet-er-ulovlig-7529032.html">EU-domstolen:
 661 Datalagringsdirektivet er ulovlig</a> - aftenposten.no 2014-04-08
 662
 663 <li><a href="http://www.aftenposten.no/nyheter/iriks/politikk/Krever-DLD-stopp-i-Norge-7530086.html">Krever
 664 DLD-stopp i Norge</a> - aftenposten.no 2014-04-08
 665
 666 <li><a href="http://www.p4.no/story.aspx?id=566431">Apenes: - En
 667 gledens dag</a> - p4.no 2014-04-08
 668
 669 <li><a href="http://www.nrk.no/norge/_-datalagringsdirektivet-er-ugyldig-1.11655929">EU-domstolen:
 670 – Datalagringsdirektivet er ugyldig</a> - nrk.no 2014-04-08</li>
 671
 672 <li><a href="http://www.vg.no/nyheter/utenriks/data-og-nett/eu-domstolen-datalagringsdirektivet-er-ugyldig/a/10130280/">EU-domstolen:
 673 Datalagringsdirektivet er ugyldig</a> - vg.no 2014-04-08</li>
 674
 675 <li><a href="http://www.dagbladet.no/2014/04/08/nyheter/innenriks/datalagringsdirektivet/personvern/32711646/">-
 676 Vi bør skrote hele datalagringsdirektivet</a> - dagbladet.no
 677 2014-04-08</li>
 678
 679 <li><a href="http://www.digi.no/928137/eu-domstolen-dld-er-ugyldig">EU-domstolen:
 680 DLD er ugyldig</a> - digi.no 2014-04-08</li>
 681
 682 <li><a href="http://www.irishtimes.com/business/sectors/technology/european-court-declares-data-retention-directive-invalid-1.1754150">European
 683 court declares data retention directive invalid</a> - irishtimes.com
 684 2014-04-08</li>
 685
 686 <li><a href="http://www.reuters.com/article/2014/04/08/us-eu-data-ruling-idUSBREA370F020140408?feedType=RSS">EU
 687 court rules against requirement to keep data of telecom users</a> -
 688 reuters.com 2014-04-08</li>
 689
 690 </ul>
 691 </p>
 692
 693 <p>Jeg synes det er veldig fint at nok en stemme slår fast at
 694 totalitær overvåkning av befolkningen er uakseptabelt, men det er
 695 fortsatt like viktig å beskytte privatsfæren som før, da de
 696 teknologiske mulighetene fortsatt finnes og utnyttes, og jeg tror
 697 innsats i prosjekter som
 698 <a href="https://wiki.debian.org/FreedomBox">Freedombox</a> og
 699 <a href="http://www.dugnadsnett.no/">Dugnadsnett</a> er viktigere enn
 700 noen gang.</p>
 701
 702 <p><strong>Update 2014-04-08 12:10</strong>: Kronerullingen for å
 703 stoppe datalagringsdirektivet i Norge gjøres hos foreningen
 704 <a href="http://www.digitaltpersonvern.no/">Digitalt Personvern</a>,
 705 som har samlet inn 843 215,- så langt men trenger nok mye mer hvis
 706
 707 ikke Høyre og Arbeiderpartiet bytter mening i saken.  Det var
 708 <a href="http://www.holderdeord.no/parliament-issues/48650">kun
 709 partinene Høyre og Arbeiderpartiet</a> som stemte for
 710 Datalagringsdirektivet, og en av dem må bytte mening for at det skal
 711 bli flertall mot i Stortinget.  Se mer om saken
 712 <a href="http://www.holderdeord.no/issues/69-innfore-datalagringsdirektivet">Holder
 713 de ord</a>.</p>
 714 </div>
 715       <div class="tags">
 716
 717
 718         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/dld">dld</a>, <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
 719
 720
 721       </div>
 722     </div>
 723     <div class="padding"></div>
 724
 725     <div class="entry">
 726       <div class="title"><a href="http://people.skolelinux.org/pere/blog/ReactOS_Windows_clone___nice_free_software.html">ReactOS Windows clone - nice free software</a></div>
 727       <div class="date"> 1st April 2014</div>
 728       <div class="body"><p>Microsoft have announced that Windows XP reaches its end of life
 729 2014-04-08, in 7 days.  But there are heaps of machines still running
 730 Windows XP, and depending on Windows XP to run their applications, and
 731 upgrading will be expensive, both when it comes to money and when it
 732 comes to the amount of effort needed to migrate from Windows XP to a
 733 new operating system.  Some obvious options (buy new a Windows
 734 machine, buy a MacOSX machine, install Linux on the existing machine)
 735 are already well known and covered elsewhere.  Most of them involve
 736 leaving the user applications installed on Windows XP behind and
 737 trying out replacements or updated versions. In this blog post I want
 738 to mention one strange bird that allow people to keep the hardware and
 739 the existing Windows XP applications and run them on a free software
 740 operating system that is Windows XP compatible.</p>
 741
 742 <p><a href="http://www.reactos.org/">ReactOS</a> is a free software
 743 operating system (GNU GPL licensed) working on providing a operating
 744 system that is binary compatible with Windows, able to run windows
 745 programs directly and to use Windows drivers for hardware directly.
 746 The project goal is for Windows user to keep their existing machines,
 747 drivers and software, and gain the advantages from user a operating
 748 system without usage limitations caused by non-free licensing.  It is
 749 a Windows clone running directly on the hardware, so quite different
 750 from the approach taken by <a href="http://www.winehq.org/">the Wine
 751 project</a>, which make it possible to run Windows binaries on
 752 Linux.</p>
 753
 754 <p>The ReactOS project share code with the Wine project, so most
 755 shared libraries available on Windows are already implemented already.
 756 There is also a software manager like the one we are used to on Linux,
 757 allowing the user to install free software applications with a simple
 758 click directly from the Internet.  Check out the
 759 <a href="http://www.reactos.org/screenshots">screen shots on the
 760 project web site</a> for an idea what it look like (it looks just like
 761 Windows before metro).</p>
 762
 763 <p>I do not use ReactOS myself, preferring Linux and Unix like
 764 operating systems.  I've tested it, and it work fine in a virt-manager
 765 virtual machine.  The browser, minesweeper, notepad etc is working
 766 fine as far as I can tell.  Unfortunately, my main test application
 767 is the software included on a CD with the Lego Mindstorms NXT, which
 768 seem to install just fine from CD but fail to leave any binaries on
 769 the disk after the installation.  So no luck with that test software.
 770 No idea why, but hope someone else figure out and fix the problem.
 771 I've tried the ReactOS Live ISO on a physical machine, and it seemed
 772 to work just fine.  If you like Windows and want to keep running your
 773 old Windows binaries, check it out by
 774 <a href="http://www.reactos.org/download">downloading</a> the
 775 installation CD, the live CD or the preinstalled virtual machine
 776 image.</p>
 777 </div>
 778       <div class="tags">
 779
 780
 781         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/reactos">reactos</a>.
 782
 783
 784       </div>
 785     </div>
 786     <div class="padding"></div>
 787
 788     <div class="entry">
 789       <div class="title"><a href="http://people.skolelinux.org/pere/blog/Debian_Edu_interview__Roger_Marsal.html">Debian Edu interview: Roger Marsal</a></div>
 790       <div class="date">30th March 2014</div>
 791       <div class="body"><p><a href="http://www.skolelinux.org/">Debian Edu / Skolelinux</a>
 792 keep gaining new users.  Some weeks ago, a person showed up on IRC,
 793 <a href="irc://irc.debian.org/#debian-edu">#debian-edu</a>, with a
 794 wish to contribute, and I managed to get a interview with this great
 795 contributor Roger Marsal to learn more about his background.</p>
 796
 797 <p><strong>Who are you, and how do you spend your days?</strong></p>
 798
 799 <p>My name is Roger Marsal, I'm 27 years old (1986 generation) and I
 800 live in Barcelona, Spain. I've got a strong business background and I
 801 work as a patrimony manager and as a real estate agent.  Additionally,
 802 I've co-founded a British based tech company that is nowadays on the
 803 last development phase of a new social networking concept.</p>
 804
 805 <p>I'm a Linux enthusiast that started its journey with Ubuntu four years
 806 ago and have recently switched to Debian seeking rock solid stability
 807 and as a necessary step to gain expertise.</p>
 808
 809 <p>In a nutshell, I spend my days working and learning as much as I
 810 can to face both my job, entrepreneur project and feed my Linux
 811 hunger.</p>
 812
 813 <p><strong>How did you get in contact with the Skolelinux / Debian Edu
 814 project?</strong></p>
 815
 816 <p>I discovered the <a href="http://www.ltsp.org/">LTSP</a> advantages
 817 with "Ubuntu 12.04 alternate install" and after a year of use I
 818 started looking for an alternative.  Even though I highly value and
 819 respect the Ubuntu project, I thought it was necessary for me to
 820 change to a more robust and stable alternative.  As far as I was using
 821 Debian on my personal laptop I thought it would be fine to install
 822 Debian and configure an LTSP server myself.  Surprised, I discovered
 823 that the Debian project also supported a kind of Edubuntu equivalent,
 824 and after having some pain I obtained a Debian Edu network up and
 825 running.  I just loved it.</p>
 826
 827 <p><strong>What do you see as the advantages of Skolelinux / Debian
 828 Edu?</strong></p>
 829
 830 <p>I found a main advantage in that, once you know "the tips and
 831 tricks", a new installation just works out of the box. It's the most
 832 complete alternative I've found to create an LTSP network. All the
 833 other distributions seems to be made of plastic, Debian Edu seems to
 834 be made of steel.</p>
 835
 836 <p><strong>What do you see as the disadvantages of Skolelinux / Debian
 837 Edu?</strong></p>
 838
 839 <p>I found two main disadvantages.</p>
 840
 841 <p>I'm not an expert but I've got notions and I had to spent a considerable
 842 amount of time trying to bring up a standard network topology. I'm quite
 843 stubborn and I just worked until I did but I'm sure many people with few
 844 resources (not big schools, but academies for example) would have switched
 845 or dropped.</p>
 846
 847 <p>It's amazing how such a complex system like Debian Edu has achieved
 848 this out-of-the-box state. Even though tweaking without breaking gets
 849 more difficult, as more factors have to be considered. This can
 850 discourage many people too.</p>
 851
 852 <p><strong>Which free software do you use daily?</strong></p>
 853
 854 <p>I use Debian, Firefox, Okular, Inkscape, LibreOffice and
 855 Virtualbox.</p>
 856
 857
 858 <p><strong>Which strategy do you believe is the right one to use to
 859 get schools to use free software?</strong></p>
 860
 861 <p>I don't think there is a need for a particular strategy. The free
 862 attribute in both "freedom" and "no price" meanings is what will
 863 really bring free software to schools. In my experience I can think of
 864 the <a href="http://www.r-project.org/">"R" statistical language</a>; a
 865 few years a ago was an extremely nerd tool for university people.
 866 Today it's being increasingly used to teach statistics at many
 867 different level of studies.  I believe free and open software will
 868 increasingly gain popularity, but I'm sure schools will be one of the
 869 first scenarios where this will happen.</p>
 870 </div>
 871       <div class="tags">
 872
 873
 874         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/intervju">intervju</a>.
 875
 876
 877       </div>
 878     </div>
 879     <div class="padding"></div>
 880
 881     <div class="entry">
 882       <div class="title"><a href="http://people.skolelinux.org/pere/blog/Dokumentaren_om_Datalagringsdirektivet_sendes_endelig_p__NRK.html">Dokumentaren om Datalagringsdirektivet sendes endelig på NRK</a></div>
 883       <div class="date">26th March 2014</div>
 884       <div class="body"><p><a href="http://www.nuug.no/">Foreningen NUUG</a> melder i natt at
 885 NRK nå har bestemt seg for
 886 <a href="http://www.nuug.no/news/NRK_viser_filmen_om_Datalagringsdirektivet_f_rste_gang_2014_03_31.shtml">når
 887 den norske dokumentarfilmen om datalagringsdirektivet skal
 888 sendes</a> (se <a href="http://www.imdb.com/title/tt2832844/">IMDB</a>
 889 for detaljer om filmen) . Første visning blir på NRK2 mandag
 890 2014-03-31 kl. 19:50, og deretter visninger onsdag 2014-04-02
 891 kl. 12:30, fredag 2014-04-04 kl. 19:40 og søndag 2014-04-06 kl. 15:10.
 892 Jeg har sett dokumentaren, og jeg anbefaler enhver å se den selv.  Som
 893 oppvarming mens vi venter anbefaler jeg Bjørn Stærks kronikk i
 894 Aftenposten fra i går,
 895 <a href="http://www.aftenposten.no/meninger/kronikker/Autoritar-gjokunge-7514915.html">Autoritær
 896 gjøkunge</a>, der han gir en grei skisse av hvor ille det står til med
 897 retten til privatliv og beskyttelsen av demokrati i Norge og resten
 898 verden, og helt riktig slår fast at det er vi i databransjen som
 899 sitter med nøkkelen til å gjøre noe med dette.  Jeg har involvert meg
 900 i prosjektene <a href="http://www.dugnadsnett.no/">dugnadsnett.no</a>
 901 og <a href="https://wiki.debian.org/FreedomBox">FreedomBox</a> for å
 902 forsøke å gjøre litt selv for å bedre situasjonen, men det er mye
 903 hardt arbeid fra mange flere enn meg som gjenstår før vi kan sies å ha
 904 gjenopprettet balansen.</p>
 905
 906 <p>Jeg regner med at nettutgaven dukker opp på
 907 <a href="http://tv.nrk.no/program/koid75005313/tema-dine-digitale-spor-datalagringsdirektivet">NRKs
 908 side om filmen om datalagringsdirektivet</a> om fem dager.  Hold et
 909 øye med siden, og tips venner og slekt om at de også bør se den.</p>
 910 </div>
 911       <div class="tags">
 912
 913
 914         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/dld">dld</a>, <a href="http://people.skolelinux.org/pere/blog/tags/freedombox">freedombox</a>, <a href="http://people.skolelinux.org/pere/blog/tags/mesh network">mesh network</a>, <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
 915
 916
 917       </div>
 918     </div>
 919     <div class="padding"></div>
 920
 921     <div class="entry">
 922       <div class="title"><a href="http://people.skolelinux.org/pere/blog/Public_Trusted_Timestamping_services_for_everyone.html">Public Trusted Timestamping services for everyone</a></div>
 923       <div class="date">25th March 2014</div>
 924       <div class="body"><p>Did you ever need to store logs or other files in a way that would
 925 allow it to be used as evidence in court, and needed a way to
 926 demonstrate without reasonable doubt that the file had not been
 927 changed since it was created?  Or, did you ever need to document that
 928 a given document was received at some point in time, like some
 929 archived document or the answer to an exam, and not changed after it
 930 was received?  The problem in these settings is to remove the need to
 931 trust yourself and your computers, while still being able to prove
 932 that a file is the same as it was at some given time in the past.</p>
 933
 934 <p>A solution to these problems is to have a trusted third party
 935 "stamp" the document and verify that at some given time the document
 936 looked a given way.  Such
 937 <a href="https://en.wikipedia.org/wiki/Notarius">notarius</a> service
 938 have been around for thousands of years, and its digital equivalent is
 939 called a
 940 <a href="http://en.wikipedia.org/wiki/Trusted_timestamping">trusted
 941 timestamping service</a>.  <a href="http://www.ietf.org/">The Internet
 942 Engineering Task Force</a> standardised how such service could work a
 943 few years ago as <a href="http://tools.ietf.org/html/rfc3161">RFC
 944 3161</a>.  The mechanism is simple.  Create a hash of the file in
 945 question, send it to a trusted third party which add a time stamp to
 946 the hash and sign the result with its private key, and send back the
 947 signed hash + timestamp.  Both email, FTP and HTTP can be used to
 948 request such signature, depending on what is provided by the service
 949 used. Anyone with the document and the signature can then verify that
 950 the document matches the signature by creating their own hash and
 951 checking the signature using the trusted third party public key.
 952 There are several commercial services around providing such
 953 timestamping.  A quick search for
 954 "<a href="https://duckduckgo.com/?q=rfc+3161+service">rfc 3161
 955 service</a>" pointed me to at least
 956 <a href="https://www.digistamp.com/technical/how-a-digital-time-stamp-works/">DigiStamp</a>,
 957 <a href="http://www.quovadisglobal.co.uk/CertificateServices/SigningServices/TimeStamp.aspx">Quo
 958 Vadis</a>,
 959 <a href="https://www.globalsign.com/timestamp-service/">Global Sign</a>
 960 and <a href="http://www.globaltrustfinder.com/TSADefault.aspx">Global
 961 Trust Finder</a>.  The system work as long as the private key of the
 962 trusted third party is not compromised.</p>
 963
 964 <p>But as far as I can tell, there are very few public trusted
 965 timestamp services available for everyone.  I've been looking for one
 966 for a while now. But yesterday I found one over at
 967 <a href="https://www.pki.dfn.de/zeitstempeldienst/">Deutches
 968 Forschungsnetz</a> mentioned in
 969 <a href="http://www.d-mueller.de/blog/dealing-with-trusted-timestamps-in-php-rfc-3161/">a
 970 blog by David Müller</a>.  I then found
 971 <a href="http://www.rz.uni-greifswald.de/support/dfn-pki-zertifikate/zeitstempeldienst.html">a
 972 good recipe on how to use the service</a> over at the University of
 973 Greifswald.</p>
 974
 975 <p><a href="http://www.openssl.org/">The OpenSSL library</a> contain
 976 both server and tools to use and set up your own signing service.  See
 977 the ts(1SSL), tsget(1SSL) manual pages for more details.  The
 978 following shell script demonstrate how to extract a signed timestamp
 979 for any file on the disk in a Debian environment:</p>
 980
 981 <p><blockquote><pre>
 982 #!/bin/sh
 983 set -e
 984 url="http://zeitstempel.dfn.de"
 985 caurl="https://pki.pca.dfn.de/global-services-ca/pub/cacert/chain.txt"
 986 reqfile=$(mktemp -t tmp.XXXXXXXXXX.tsq)
 987 resfile=$(mktemp -t tmp.XXXXXXXXXX.tsr)
 988 cafile=chain.txt
 989 if [ ! -f $cafile ] ; then
 990     wget -O $cafile "$caurl"
 991 fi
 992 openssl ts -query -data "$1" -cert | tee "$reqfile" \
 993     | /usr/lib/ssl/misc/tsget -h "$url" -o "$resfile"
 994 openssl ts -reply -in "$resfile" -text 1>&2
 995 openssl ts -verify -data "$1" -in "$resfile" -CAfile "$cafile" 1>&2
 996 base64 < "$resfile"
 997 rm "$reqfile" "$resfile"
 998 </pre></blockquote></p>
 999
1000 <p>The argument to the script is the file to timestamp, and the output
1001 is a base64 encoded version of the signature to STDOUT and details
1002 about the signature to STDERR.  Note that due to
1003 <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742553">a bug
1004 in the tsget script</a>, you might need to modify the included script
1005 and remove the last line.  Or just write your own HTTP uploader using
1006 curl. :) Now you too can prove and verify that files have not been
1007 changed.</p>
1008
1009 <p>But the Internet need more public trusted timestamp services.
1010 Perhaps something for <a href="http://www.uninett.no/">Uninett</a> or
1011 my work place the <a href="http://www.uio.no/">University of Oslo</a>
1012 to set up?</p>
1013 </div>
1014       <div class="tags">
1015
1016
1017         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
1018
1019
1020       </div>
1021     </div>
1022     <div class="padding"></div>
1023
1024     <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14" /></a></p>
1025     <div id="sidebar">
1026
1027
1028
1029 <h2>Archive</h2>
1030 <ul>
1031
1032 <li>2014
1033 <ul>
1034
1035 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/01/">January (2)</a></li>
1036
1037 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/02/">February (3)</a></li>
1038
1039 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/03/">March (8)</a></li>
1040
1041 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/04/">April (7)</a></li>
1042
1043 </ul></li>
1044
1045 <li>2013
1046 <ul>
1047
1048 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/01/">January (11)</a></li>
1049
1050 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/02/">February (9)</a></li>
1051
1052 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/03/">March (9)</a></li>
1053
1054 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/04/">April (6)</a></li>
1055
1056 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/05/">May (9)</a></li>
1057
1058 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/06/">June (10)</a></li>
1059
1060 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/07/">July (7)</a></li>
1061
1062 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/08/">August (3)</a></li>
1063
1064 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/09/">September (5)</a></li>
1065
1066 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/10/">October (7)</a></li>
1067
1068 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/11/">November (9)</a></li>
1069
1070 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/12/">December (3)</a></li>
1071
1072 </ul></li>
1073
1074 <li>2012
1075 <ul>
1076
1077 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/01/">January (7)</a></li>
1078
1079 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/02/">February (10)</a></li>
1080
1081 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/03/">March (17)</a></li>
1082
1083 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/04/">April (12)</a></li>
1084
1085 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/05/">May (12)</a></li>
1086
1087 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/06/">June (20)</a></li>
1088
1089 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/07/">July (17)</a></li>
1090
1091 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/08/">August (6)</a></li>
1092
1093 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/09/">September (9)</a></li>
1094
1095 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/10/">October (17)</a></li>
1096
1097 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/11/">November (10)</a></li>
1098
1099 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/12/">December (7)</a></li>
1100
1101 </ul></li>
1102
1103 <li>2011
1104 <ul>
1105
1106 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/01/">January (16)</a></li>
1107
1108 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/02/">February (6)</a></li>
1109
1110 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/03/">March (6)</a></li>
1111
1112 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/04/">April (7)</a></li>
1113
1114 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/05/">May (3)</a></li>
1115
1116 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/06/">June (2)</a></li>
1117
1118 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/07/">July (7)</a></li>
1119
1120 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/08/">August (6)</a></li>
1121
1122 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/09/">September (4)</a></li>
1123
1124 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/10/">October (2)</a></li>
1125
1126 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/11/">November (3)</a></li>
1127
1128 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/12/">December (1)</a></li>
1129
1130 </ul></li>
1131
1132 <li>2010
1133 <ul>
1134
1135 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
1136
1137 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
1138
1139 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
1140
1141 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
1142
1143 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
1144
1145 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
1146
1147 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
1148
1149 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (13)</a></li>
1150
1151 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/09/">September (7)</a></li>
1152
1153 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/10/">October (9)</a></li>
1154
1155 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/11/">November (13)</a></li>
1156
1157 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/12/">December (12)</a></li>
1158
1159 </ul></li>
1160
1161 <li>2009
1162 <ul>
1163
1164 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
1165
1166 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
1167
1168 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
1169
1170 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
1171
1172 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
1173
1174 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
1175
1176 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
1177
1178 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
1179
1180 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
1181
1182 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
1183
1184 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
1185
1186 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
1187
1188 </ul></li>
1189
1190 <li>2008
1191 <ul>
1192
1193 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
1194
1195 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
1196
1197 </ul></li>
1198
1199 </ul>
1200
1201
1202
1203 <h2>Tags</h2>
1204 <ul>
1205
1206  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (13)</a></li>
1207
1208  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
1209
1210  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
1211
1212  <li><a href="http://people.skolelinux.org/pere/blog/tags/bankid">bankid (4)</a></li>
1213
1214  <li><a href="http://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin (8)</a></li>
1215
1216  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (14)</a></li>
1217
1218  <li><a href="http://people.skolelinux.org/pere/blog/tags/bsa">bsa (2)</a></li>
1219
1220  <li><a href="http://people.skolelinux.org/pere/blog/tags/chrpath">chrpath (2)</a></li>
1221
1222  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (98)</a></li>
1223
1224  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (146)</a></li>
1225
1226  <li><a href="http://people.skolelinux.org/pere/blog/tags/digistan">digistan (10)</a></li>
1227
1228  <li><a href="http://people.skolelinux.org/pere/blog/tags/dld">dld (15)</a></li>
1229
1230  <li><a href="http://people.skolelinux.org/pere/blog/tags/docbook">docbook (10)</a></li>
1231
1232  <li><a href="http://people.skolelinux.org/pere/blog/tags/drivstoffpriser">drivstoffpriser (4)</a></li>
1233
1234  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (246)</a></li>
1235
1236  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (21)</a></li>
1237
1238  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (12)</a></li>
1239
1240  <li><a href="http://people.skolelinux.org/pere/blog/tags/freeculture">freeculture (12)</a></li>
1241
1242  <li><a href="http://people.skolelinux.org/pere/blog/tags/freedombox">freedombox (8)</a></li>
1243
1244  <li><a href="http://people.skolelinux.org/pere/blog/tags/frikanalen">frikanalen (11)</a></li>
1245
1246  <li><a href="http://people.skolelinux.org/pere/blog/tags/intervju">intervju (40)</a></li>
1247
1248  <li><a href="http://people.skolelinux.org/pere/blog/tags/isenkram">isenkram (9)</a></li>
1249
1250  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (18)</a></li>
1251
1252  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (9)</a></li>
1253
1254  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (7)</a></li>
1255
1256  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
1257
1258  <li><a href="http://people.skolelinux.org/pere/blog/tags/mesh network">mesh network (8)</a></li>
1259
1260  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (27)</a></li>
1261
1262  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (245)</a></li>
1263
1264  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (162)</a></li>
1265
1266  <li><a href="http://people.skolelinux.org/pere/blog/tags/offentlig innsyn">offentlig innsyn (11)</a></li>
1267
1268  <li><a href="http://people.skolelinux.org/pere/blog/tags/open311">open311 (2)</a></li>
1269
1270  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (46)</a></li>
1271
1272  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (72)</a></li>
1273
1274  <li><a href="http://people.skolelinux.org/pere/blog/tags/raid">raid (1)</a></li>
1275
1276  <li><a href="http://people.skolelinux.org/pere/blog/tags/reactos">reactos (1)</a></li>
1277
1278  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (11)</a></li>
1279
1280  <li><a href="http://people.skolelinux.org/pere/blog/tags/rfid">rfid (2)</a></li>
1281
1282  <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (9)</a></li>
1283
1284  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
1285
1286  <li><a href="http://people.skolelinux.org/pere/blog/tags/ruter">ruter (4)</a></li>
1287
1288  <li><a href="http://people.skolelinux.org/pere/blog/tags/scraperwiki">scraperwiki (2)</a></li>
1289
1290  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (40)</a></li>
1291
1292  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (4)</a></li>
1293
1294  <li><a href="http://people.skolelinux.org/pere/blog/tags/skepsis">skepsis (4)</a></li>
1295
1296  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (44)</a></li>
1297
1298  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (3)</a></li>
1299
1300  <li><a href="http://people.skolelinux.org/pere/blog/tags/stortinget">stortinget (9)</a></li>
1301
1302  <li><a href="http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance (25)</a></li>
1303
1304  <li><a href="http://people.skolelinux.org/pere/blog/tags/sysadmin">sysadmin (1)</a></li>
1305
1306  <li><a href="http://people.skolelinux.org/pere/blog/tags/valg">valg (8)</a></li>
1307
1308  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (41)</a></li>
1309
1310  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (4)</a></li>
1311
1312  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (31)</a></li>
1313
1314 </ul>
1315
1316
1317     </div>
1318     <p style="text-align: right">
1319  Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v4.6</a>
1320 </p>
1321
1322   </body>
1323 </html>