Elsewhere

At the recent Ubuntu Developer Summit, I managed to convince a few people (after assurances that there would be no permanent damage) to plug a USB stick into their machines so we could watch Xorg crash and wedge their console. What was this evil thing, you ask? It was an AVR microprocessor connected to USB, acting as a USB HID Keyboard, with the product name set to “%n”.

Recently a Chrome OS developer discovered that renaming his Bluetooth Keyboard to “%n” would crash Xorg. The flaw was in the logging stack, triggering glibc to abort the process due to format string protections. At first glance, it looks like this isn’t a big deal since one would have to have already done a Bluetooth pairing with the keyboard, but it would be a problem for any input device, not just Bluetooth. I wanted to see this in action for a “normal” (USB) keyboard.

I borrowed a “Maximus” USB AVR from a friend, and then ultimately bought a Minimus. It will let you put anything you want on the USB bus.

I added a rule for it to udev:

SUBSYSTEM=="usb", ACTION=="add", ATTR{idVendor}=="03eb", ATTR{idProduct}=="*", GROUP="plugdev"

installed the AVR tools:

sudo apt-get install dfu-programmer gcc-avr avr-libc

and pulled down the excellent LUFA USB tree:

git clone git://github.com/abcminiuser/lufa-lib.git

After applying a patch to the LUFA USB keyboard demo, I had my handy USB-AVR-as-Keyboard stick ready to crash Xorg:

- .VendorID = 0x03EB, - .ProductID = 0x2042, + .VendorID = 0x045e, + .ProductID = 0x000b, ... - .UnicodeString = L"LUFA Keyboard Demo" + .UnicodeString = L"Keyboard (%n%n%n%n)"

In fact, it was so successfully that after I got the code right and programmed it, Xorg immediately crashed on my development machine. :)

make dfu

After a reboot, I switched it back to programming mode by pressing and holding the “H” button, press/releasing the “R” button, and releasing “H”.

The fix to Xorg is winding its way through upstream, and should land in your distros soon. In the meantime, you can disable your external USB ports, as Marc Deslauriers demonstrated for me:

echo "0" > /sys/bus/usb/devices/usb1/authorized echo "0" > /sys/bus/usb/devices/usb1/authorized_default

Be careful of shared internal/external ports, and having two buses on one port, etc.

© 2012, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 License.

It’s 2011, and the world is going mobile. People don't just use their desktop computer or laptop anymore to visit the sites you build. They're coming at you with smartphones, tablets, TV screens— and who knows what they’ll bring next year? With all this device-switching going on, one of the questions that site builders ask themselves is, how can we keep catering to all these different devices? The good news: There is a way. It’s called responsive webdesign.

In this article, we briefly lay out what responsive webdesign is, and, more importantly, how you can use it in your Drupal projects today.

What is responsive web design?

In his 2010 article on 'A List Apart', Ethan Marcotte coined the term "responsive webdesign," referring to responsive architecture. If architects can design rooms that change according to the number of people inside them, why can't web designers build web pages that adapt to the people who view them?

As you may have guessed from the name, responsive web design is all about, yes, responding to the site user's device specifics. Does the device have a wide or narrow screen? How is the user holding the device? What OS is powering the device? All these questions determine how the user experiences your website. With responsive webdesign, you can accommodate all these possible differences.

Using a combination of CSS3 media queries (which query the device's capabilities to determine the proper stylesheets to load), a flexible grid acting as the site’s foundation, and images that change according to the screen resolution, responsive webdesign allows you to work in a so called "device agnostic" way. It doesn’t matter whether the user has the latest tablet, or an early-adapter smartphone: if your design is responsive, it can adapt to the user. Think of it as a fluid (vs fixed) webdesign on heavy steroids.

"This is our way forward. Rather than tailoring disconnected designs to each of an ever-increasing number of web devices, we can treat them as facets of the same experience. We can design for an optimal viewing experience, but embed standards-based technologies into our designs to make them not only more flexible, but more adaptive to the media that renders them." (Ethan Marcotte)

Author Bruno De Bondt & Kristof Orts

Bruno De Bondt has been theming and developing Drupal sites since 2005. He is the technical lead at DeWereldMorgen.be, a popular independent news website in Belgium. He has also worked as a Drupal developer and themer for Krismon, one of the main Drupal shops in Europe. Working with them, he has built several media, non profit and advocacy websites. Bruno currently lives in Vancouver, Canada. You can reach him on Drupal.org or Twitter as brunodbo or on http://brunodbo.be.

Kristof Orts loves the web and specializes in user experience and usability. He's also a team player, for big projects he likes to work with partners that have the same knowledge and passion as he does. Some keywords Kristof uses every day: CSS3, HTML5, JS, flexible layouts, responsive and mobile design. He also loves to speak about these things at conferences.

A number of years back, I read yet another complaint about someone having trouble finding a computer with Linux preinstalled.

So I did something about it: I created LinuxSi.com, where it is possible to register computer stores in Italy (this was an Italian Linux mailing list) that are helpful towards people wishing to buy a Linux machine.

Fast forward past getting married, having kids and buying a house, and LinuxSi.com is not something I have much time to run any more.  I still think it's a useful service, even if the site itself is a bit creaky.

In any event, I've put it up for auction with Flippa.com, and there's one week left on the auction.  Right now, it's going for just $10, which even with the low amounts of adsense income it brings in, you'd make back pretty quickly.

I hope that it goes to someone who cares about promoting Linux in Italy - if nothing else, the domain name is a good one that could be employed for many things.

A continuation of the useful administration modules list started in Part I.

Devel

Used extensively by the developers, devel module can also be very helpful to the site administrators. One of its more popular features is automatic content generation (such as users and nodes) - including media files! Another nice feature is switching between users (for example, to test access permissions). It also integrates well with the admin menu module mentioned in the first part of the article.

To use Devel on Drupal 6, go to admin/generate and choose the type of items to generate (the modules comes with taxonomy, content and users, other modules add more types of content). The module can also delete the existing items (for examples, nodes by type).

Related stories: 

If you liked it this story, you might like the following:

15 modules to improve your Drupal administration and content management experience (D6 & D7) - part IRedirect 403 to User Login (r4032login module).Custom contact form with conditional fields using webform and webform conditionalDrush Site Aliases and Interactive ShellInstall Drupal 7 site with Drush

read more

<iframe frameborder="0" height="315" src="http://www.youtube.com/embed/IFe9wiDfb0E" width="560"></iframe>

A new release 0.2.4 of RProtoBuf is now on CRAN. RProtoBuf provides GNU R bindings for the Google Protobuf data encoding library used and released by Google.

This release once again contains a number of patches kindly contributed by Murray Stokely, as well as an added header file needed to build with the g++ 4.7 version which has become the build standard on CRAN.

The NEWS file entry follows below:

2012-05-15 Dirk Eddelbuettel <edd> * DESCRIPTION: Release 0.2.4 * R/zzz.R (.onLoad): pass lib.loc=libname to readProtoFiles * R/internals.R (readProtoFiles): use lib.loc argument * man/readProtoFiles.Rd: Document new lib.loc argument 2012-05-14 Dirk Eddelbuettel <edd> * R/lookup.R: comment-out unlockBinding() which R CMD check does not like as it turns out that we do not need it here anyway * inst/unitTests/runit.addressbook.R (test.ascii): Small correction by converting to character before comparing * DESCRIPTION: Remove Depends: on int64 which is no longer used, lower Depends: on Rcpp to 0.9.6 which should be sufficient 2012-05-13 Dirk Eddelbuettel <edd> * src/rprotobuf.h: Added '#include <unistd.h>' to make g++-4.7 happy * src/*: Reversed out SVN revisions 426 to 434 related to int64 2012-04-07 Dirk Eddelbuettel <edd> * R/zzz.R: Add 'lib.loc=libname' to packageDescription() call as requested by Brian Ripley 2012-03-20 Dirk Eddelbuettel <edd> * Applied another patch by Murray: - src/mutators.cpp: Deal with case of repeated strings - inst/unitTests/runit.golden.message.R: test for this case 2011-07-17 Dirk Eddelbuettel <edd> * Applied another patch by Murray: - src/wrapper_Descriptor.cpp: Add missing readASCIIFromConnection C++ function that was called in read.R but not defined. - R/read.R: Remove an _ in the readASCII C++ functions to match the naming convention of the other nearby functions. - man/readASCII.Rd: Add examples of ascii export/import of messages. - inst/unitTests/runit.addressbook.R: Add tests of ascii export/import of messages. 2011-07-07 Dirk Eddelbuettel <edd> * src/wrapper_FileDescriptor.cpp (rprotobuf): Applied patch by Murray to correct a cut & paste error in variable name CRANberries also provides a diff to the previous release 0.2.3. More information is at the RProtoBuf page which has a draft package vignette, a 'quick' overview vignette and a unit test summary vignette. Questions, comments etc should go to the rprotobuf mailing list off the RProtoBuf page at R-Forge.

In this chapter we will get a calendar up and running on our demo site. We will cover the necessary modules, how to install them, as well as basic site configurations. We'll also show how simple it is to get a calendar on your site using a views template, and then give a tour of some calendar features.

Resources  Modules Needed:

• Calendar module
• Ctools module
• Views module

9m Publication date  May 16, 2012 - 9:00am Rules trigger for changing creation date on a scheduled publication.  No

In this series we focus on building calendars with Drupal. We'll be covering topics such as basic configuration for fields and views, using calendar templates, creating blocks and different ways of displaying the calendar, along with customizing the look and feel.

This video assumes that you understand the basics of content, fields, and Views in Drupal. If you need a refresher on these topics, or want to find out more about using the Date module, here are some other tutorial series to review:

2m Publication date  May 16, 2012 - 9:00am Rules trigger for changing creation date on a scheduled publication.  No

read more

Way before Debian, Launchpad bug tracking system just reached 1 million bugs reported with one "bug" reported against Edubuntu basically mentioning it should invade schools.

What to say about this?

Hard without being harsh towards my friends working in the Ubuntu "world", indeed. Still, I really think that here, too much noise kills signal and the LP BTS is often hardly usable.

I counted up to 217 bugs reported against samba4 (which is, after all, not so widely used yet) just because it apparently has upgrading issues between pre 12.04 versions of Ubuntu and Oneiric. It indeed seems that some automated bug reporting is now active and whenever a user encouters an upgrade issue with a package, a bug is being reported. I guess this is somehow an opt-in system (I hope so..:-)) but the default is very clearly using it.

This feature is apparently what caused the recent bump in number of bugs reported in LP, making them even less useful, particularly to Debian package maintainers. I'm sure there are tools to help dealing with that and I was already answered that work is in progress to change this (and use a dedicated website for such reports or something like this). But, still, that seems to be the scary side of popularity...the very same popularity that is slowly but constantly hiding the work we're doing in Debian to indirectly make Ubuntu popular.

(moving to more general concerns)

I know that things are not all black or all white, but it always saddens me to feel that slowly....but, again, constantly, more and more people tend to forget that Debian is behind Ubuntu, is the ground on which it is built and Ubuntu wouldn't exist without it. When doing work, a human need is to get reward for it...and we are getting less of it...slowly, but constantly.

Don't take me wrong. I have many friends working directly for Ubuntu. Some paid by Canonical for this. Some really involved up to "top level" (yes, including the very very top level even if I killed him once). I don't want to throw offense on them. I don't even know if they can do something about what I'm expressing below. I would just have them (and others) know.

Let's take an example. I recently activated a few languages in D-I (Burmese, Tibetan, Uyghur). I'm happy with that, this is something I'm doing for 8 years now. But all these new translators were indeed only interested in one thing : "have Ubuntu translated in their language". No offense intended, but they didn't really care about *Debian* being translated in their language. I think that some didn't even know what Debian is.

In the same field, I am more and more "fighting" to keep the level of translation completeness in Debian (see my regular spa^W reports). In some way, I still succeed, but the price to pay is more and more and more personal investment and work. That's still working for the strong set of languages we support. That works much less for most others. When someone "disappears" (or just switches to some other priorities), it's more and more difficult to find someone else popping up.

And, for the "strong set", something else is happening : work duplication. There are "strong" French, German, Italian, whatever, l10n teams in Debian.....and there are similar teams for Ubuntu. And, mostly, those do not really work together.

And sometimes, this is kinda discouraging. So, seeing the explosion happening on what is, whatever we think or write, the "other side", is not somethnig that can make one entirely happy. And this is why I won't celebrate Launchpad's millionth bug report.

Particularly when I see that millionth bug report not even ack'ing that this Edubuntu marvel is based on the grounds set by some pionneers many years ago in a few schools in Norway (hello, Petter and others).

Yeah, sometimes sad. To balance this, let's release wheezy and have millions of people benefit from it without even knowing.

This week I talk with Steven Jones of the Aegir Project.

Here are some of the questions I asked him

• I’ve only heard of Aegir, but never actually used it. What exactly is it?
• How did you get started with Aegir?
• What kinds of things can Aegir do other than site install?
• How does Aegir integrate with Git?
• What sort of people is Aegir appropriate for?
• How does Aegir compare to other tools like Pantheon or Acquia’s dev cloud?
• What about tools like Puppet or Capistrano?
• How can people get help?
• What’s the future of Aegir?

Questions from Twitter

• @TimeRaider: What are the plans for 7.x release and new Drush support?
• @tgroff: What should distributions do to ensure Aegir compatibility?

Submitted on Wed, 05/16/2012 - 00:00

Hey, thanks, Peter for the hint!

Never heard of that option until you blogged about it. So, now I'm also ready to "tar taf", "tar xaf", "tar caf"..:-). Harder for me than you because I was used to "tar tfz" or "tar tfj"..:-)

And I suspect that "tar taf" is prone to typos...we'll see.

Minor Drupal versions are usually for bug fixes, security updates, and the occasional new feature that doesn't break backwards compatibility. Compatibility changes are reserved for major Drupal releases. There are exceptions such as Drupal 6.2. It was such a big deal there is an update documentation page just for this release. When Drupal 7.14 made an API breaking change without providing documentation or notification to module developers I was quite surprised. The lack of detail made it difficult to track down the changes when I had a broken codebase. Here are the details so others can, hopefully, have an easier time if they run into this problem.

Continue Reading »

I’ve been noticing a number of odd things happening surrounding my blog lately, and I thought it’s about time to figure out what’s going on and how to stop it.

The first problem is that people are illegally copying my posts, probably using RSS scraping, and putting them up on their own ad-infested sites. It is trivial to find them using Google for any somewhat unique word or phrase in one of my posts. Lately one of them, linux-support.com, actually sends me pingbacks announcing the fact that they’ve scraped me! Most of these sites seem to be nothing but content farms for selling ad impressions, and almost none of them have any identifiable names for the owners.

(There is an exception: I have specifically set up sites like Planet Debian and Goodreads to copy my blog posts.)

I’m obviously an advocate of open content, but I do not feel it right that others should be profiting by putting photos and stories about Free Software, or photos of my family, on their ad farms. While I release a great deal of content under GPL or Creative Commons licenses, I have never done so with my blog – an intentional decision.

What should I do about this? Is it worth fighting a battle over, or is it about as useless as trying to block every spam follower on my twitter account?

So that’s the first weird thing. The second weird thing just started within the last few weeks. I have been getting a surprising amount (a few a week) of email addressed to me. It does not bear the appearance of being 100% automated spam, though it is possible that it is. It’s taken a few forms:

• Someone wanting to buy an ad on my blog
• Someone wanting to send me a story hyping their product (and intending me to pretend that I wrote the story)
• Someone wanting me to write a story about their website and link to it

The profit motive in all of these is high, and in at least the second and third, so is the sleaze factor.

I’ve gotten two emails lately of this form:

Hi John,

I am curious if you are the administrator for this site: changelog.complete.org/archives/174-house-outlaws-fast-forwarding-senate-pres-next

I am a researcher / writer involved with a new project whose mission it is to provide accurate and useful information for those interested in the practice of law, whether as a lawyer or paralegal. I recently produced an article detailing the complex relationship between law and technology and the legal implications on personal privacy and free speech. I would love to share this resource with those who might find it useful and am curious of you are the correct person to contact about such a request?

Thank you!

All my best,

The details vary – the URLs appear to be random (the one cited above was little more than a link to an article), the topics the website claims to discuss range from law to schizophrenia (that one actually came with a link to the site, which again seemed to be a content farm). I am slightly tempted to reply to one of these and ask where the heck people are getting my name. It seems as if somebody has put me into a mailing list they sell containing sleazebag bloggers.

Frankly, I am puzzled at this attention. I guess I haven’t checked, but I can’t imagine that my blog has anything even remotely resembling a high PageRank or anything else. It’s not high-traffic, not Slashdot, etc. Either people are desperate, naive, failing to be selective, or maybe working some scam on me that I don’t know yet.

In any case, I’m interested if others have seen this, or any advice you might have.

A drush site alias file allows you to streamline advanced drush commands and make running them against both local and remote sites a breeze. With a properly configured alias file and an SSH key you can run frequently used commands that have complex options, with a concise easily remembered "alias" on any site. This will help you be far more productive and you will find yourself using drush itself far more often.

The Migrate module is the leading tool for migrating data from an external application into Drupal. Migrate has been used to bring many world class sites onto Drupal, including The Economist, Martha Stewart and thousands more. The main theme of the upcoming Migrate 2.4 release is improved file handling on Drupal 7.

It's not too obvious how to test email receive handlers in Appengine.  The important observation is that the handlers take HTTP POSTs with multipart/form-data encoded data.  In python you can build an email to be handled with the following code:
from email.message import Message

def test_email(self):
body = Message()
body.add_header('to', 'test-unknown@other-app.com')
body.add_header('from', 'test@app.com')
body.add_header('Content-Type', 'multipart/alternative', boundary=self.boundary)
text = Message()
text['content-type'] = 'text/plain'
text.set_payload('I am I! Don Quixote!  The man of La Mancha!')
body.attach(text)

post(payload=body.as_string())

Commerce AutoSKU is a really useful tool for those Drupal Commerce users that don't need or don't care about generating their own SKU identifiers. This module uses the Drupal core capabilities to manage tokens and generate SKU for the products based in other product properties such as title, product id or any other token available in the product context. Additionally, the contributed Token module helps a lot with the selection of the pattern.

The automatic SKU generation can be configured at the product type level and the SKU field can be hide to the administrator users, it also supports case transformation and other settings.

Tags: Drupal 7Commerce Module TuesdayPlanet Drupal var switchTo5x=true;stLight.options({publisher:'dr-2277fa04-9203-1dc3-ced9-ffc8e5c4d194'});

Video Embed Field is a module that provides a simple interface for placing videos on your Drupal site. It works by simply providing a field of type 'Video Embed' which allows a user to paste in the link to a video from Youtube or Vimeo. The module then provides formatters to show the video and specify settings for it (for example: autoplay, width and height of player, skin color) or as a thumbnail. My hope with the module is to make videos really simple to add to any Drupal site, without a lot of configuration or headache. This blog post is a walkthrough of how to create handlers for other video services that you wish to support.

A common need I run into with a ton of Drupal sites and Views is searching/filtering content based on multiple fields. For example, a lot of people would like to search for content using either the Title or the Body for a particular content type.

There are two primary solutions offered for this situation, but they both have downsides or are overly complex, in my opinion:

• Use the Computed Field module to create yet another field stored in the database, combining the two (or more) fields you want to search, then expose a filter for that field instead of both of the individual fields. (I don't like this because it duplicates content/storage, and involves an extra module to do so).
• Use the Views Filters Populate to invisibly populate a second field that you've added to a views OR group (using Views OR in Views 2.x, or the built-in AND/OR functionality in Views 3.x). (This module is slightly limited in that you can only work with strings, and again, it involves an extra module).

Instead of using an extra module, I simply do the following to achieve a multi-field search:

This year, the annual Debian conference will be held in Managua, Nicaragua. And I'll be lucky enough to spend two weeks visiting the country after Debconf, along with Elisabeth.

Yes, I'll arrive in Nicarague on July 2nd, spend nearly the entire Debcamp, then Debconf, then we'll spend 16 days around the western part of Nicaragua, trying to discover the magic of this country.

So, this post is about sharing our plans with my readers. Of course, I do not know the country so we may have made mistakes and bad choices. We'll see.

Immediately after Debconf, Elisabeth will join in Managua. She'll be landing on July 15th. We'll then spend a night in an hotel near the airport and immediately leave the day after for Matagalpa, in North Nicaragua. We rented a car for the entire trip indeed, and will be on our own on wild Nicaragua roads..:-)

We'll spend two nights in Matagalpa. We plan to visit some coffee or cigar plants, probably have a trip to Lake Apanas and Jinotega.

Then, we'll have a short road trip to Esteli where we spend again two nights. We'll be visiting a coffee growing place (beneficio seco de café). A full day visit is planned at Miraflor natural reserve to enjoy te beauties of hundreds orchids and some local natural marvels.

The next move will be to Leon, where we'll spend 4 nights, visiting a cigar factory (tabacaleras de puros?) on the way, as well as San Jacinto, a place with hydrothermal sources and "Hervideros" (geysers).

Four nights in Leon leaves plenty of time for several activities *and* enjoying the colonial city. We'll have a full day at Juan Venado Island reserve with boat trip from Las Penitas (on a fisherman's boat from what the travel agency mentioned), then another full day climbing on the Cerro Negro volcano. Indeed, I was originally considering climbing the Momotombo, but our travel agency warned about the high difficulty. I would have loved that myself but maybe not the two of us...and this is a trip for both of us! So, we played the safe option..:-)

After these 4 nights in Leon, we'll move to Granada for 3 nights, through Leon Viejo (the former site of Leon).

From Granada, one day will there be used for a visit in the Masaya National Park and see the beauties of Masaya volcano (this is indeed something that could be done for Debconf day trip, IMHO, as it doesn't seem that far from Managua). Another day will be spent to Las Isletas on lake Nicaragua and others visiting the colonial city of Granada. Or, of course, whatever things we don't even known about now..:-)

Then we'll move to what I personnally consider the peak of the trip: 3 nights on Ometepe island on lake Nicaragua. Just check Wikipedia to see why Ometepe is, in my opinion, THE place to go in Nicaragua. Here, I'll have my volcano..:-). Indeed, Elizabeth "authorized" me to book a local guide and then climb Concepcion Volcan, if the weather allows for it. 1600m height, that doesn' seem to be a big issue....except when starting from a little bit above sea level and are climbing a volcano that looks like s postcard volcano : nearly a perfect cone shape.

So, let's cross fingers for having good weather that day. I promise myself I'll record the GPS track of that one and, even if I'll probably be walking most of the climbing (except if I have a very trained guide...), I'll add it to my run tracks!

We might also be going to climb Ometepe's other volcano (Maderas) the day after so that Elizabeth also enjoys these beauties. There also seems to be great places around Maderas such as San Ramon Cascade, Finca el Porvenir, etc.

Then, at the end of all this, it will be time to come back to Managua in the final day and fly back to Paris in the early morning of July 31st.

All over, I'll be in Nicaragua from July 2nd until July 31st! Full month away, yay! Hurrah for the crazy number of holidays those lazy French people have..:-)

During this trip, we might find it interesting some local geeks (not too many as Elizabeth is not that deeply interested in beersigning!) and share a few nice things in local places which are only known by locals.

In case you're interested, out (very clever) travel agency is named Nicaragua Adventures and they're definitely worth contacting if you want to travel around .ni, particularly if we prefer booking things in advance as we do. They speak Spanish (of course!), English and French. They're very responsive to e-mail as well.