Can’t send mail because of iptables -A FORWARD -p tcp –tcp-flags SYN,RST SYN -j TCPMSS –clamp-mss- to-pmtu

Posted on 18 October 2012 by stuff writer

So, you have a Netgear DGN1000 N150 router or possibly any other Netgear router, and you have it set up with:

  • DSL – VPI=8, VCI=35, LLC, PPPOE
  • Wireless
  • Ethernet

One day, as you are sending mail, you notice that mail larger than 300kb or so cannot be sent … on the wireless only.  This is odd, so you capture the traffic on the server side and on the client side, and discover that the packets you are sending on the client side do not reach the server side.  That’s really odd.  So you dig.

After downloading the source code for your router (thanks Netgear!) it turns out that Netgear has the following widely recommended code to set up iptables:

# strings DGN1000B_VB1.00.45_GR_src/target/sbin/rc | grep -r pmtu
-A TCP_MSS -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

This rule is correctly linked into the FORWARD chain and will process both SYN and SYN/ACK packets.

So, what’s up? Why can I not send my mail?

This is what the server sees during the TCP session setup – SYN, SYN-ACK, ACK:

$ tcpdump -r  server-smtpfail.pcap -v port 25 -c 3 -n
reading from file server-smtpfail.pcap, link-type EN10MB (Ethernet)
14:23:24.621396 IP (tos 0x0, ttl 54, id 30211, offset 0, flags [DF], proto TCP (6), length 60)
    105.236.7.23.55337 > 80.68.92.4.25: Flags [S], cksum 0x62c2 (correct), seq 994029838, win 14600, options [mss 1452,sackOK,TS val 55887629 ecr 0,nop,wscale 7], length 0
14:23:24.621502 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    80.68.92.4.25 > 105.236.7.23.55337: Flags [S.], cksum 0x1d7a (incorrect -> 0x26f2), seq 2508676892, ack 994029839, win 14480, options [mss 1460,sackOK,TS val 18433651 ecr 55887629,nop,wscale 6], length 0
14:23:24.844055 IP (tos 0x0, ttl 54, id 30212, offset 0, flags [DF], proto TCP (6), length 52)
    105.236.7.23.55337 > 80.68.92.4.25: Flags [.], cksum 0x8da2 (correct), ack 1, win 115, options [nop,nop,TS val 55887685 ecr 18433651], length 0

This is what the client sees:

$ tcpdump -r  client-smtpfail.pcap -v port 25 -c 3 -n
reading from file client-smtpfail.pcap, link-type EN10MB (Ethernet)
14:23:23.814713 IP (tos 0x0, ttl 64, id 30211, offset 0, flags [DF], proto TCP (6), length 60)
    192.168.64.4.55337 > 80.68.92.4.25: Flags [S], cksum 0xad23 (incorrect -> 0xd310), seq 994029838, win 14600, options [mss 1460,sackOK,TS val 55887629 ecr 0,nop,wscale 7], length 0
14:23:24.038449 IP (tos 0x0, ttl 48, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    80.68.92.4.25 > 192.168.64.4.55337: Flags [S.], cksum 0x9748 (correct), seq 2508676892, ack 994029839, win 14480, options [mss 1460,sackOK,TS val 18433651 ecr 55887629,nop,wscale 6], length 0
14:23:24.038491 IP (tos 0x0, ttl 64, id 30212, offset 0, flags [DF], proto TCP (6), length 52)
    192.168.64.4.55337 > 80.68.92.4.25: Flags [.], cksum 0xad1b (incorrect -> 0xfdf8), ack 1, win 115, options [nop,nop,TS val 55887685 ecr 18433651], length 0

More succinctly:

$ tcpdump -r  client-smtpfail.pcap -v port 25 -c 3 -n | egrep -o 'mss.[0-9]+'
reading from file client-smtpfail.pcap, link-type EN10MB (Ethernet)
mss 1460
mss 1460
$ tcpdump -r  server-smtpfail.pcap -v port 25 -c 3 -n | egrep -o 'mss.[0-9]+'
reading from file server-smtpfail.pcap, link-type EN10MB (Ethernet)
mss 1452
mss 1460

So here’s how it went down:

  • Client says MTU is 1460 in SYN packet (1500 bytes ethernet packet, less 40 bytes IP header)
  • ADSL router subtracts 8 and transmits it to the server as 1452
  • Server says it can transmit TCP segments of 1460 bytes
  • ADSL router forwards the server’s MSS size without alteration
  • Client sees that server will accept MSS of 1460

During the data transmission (sending SMTP mail in this case):

  • After about 200kB of data on a nice fast line the segment size climbs up to 1460
  • The client transmits this packet to the server – it’s 1500 bytes across the wire, which is the limit.
  • The server never gets the packet – after it adds 8 bytes of PPPOE headers to it, it is too big, so it gets dropped.

So what’s the bug?  The ADSL router has the code to set the MSS to the path MTU.  Here’s the thing:

  • Path MTU for outgoing SYN is 1492 – this is the MTU of the PPP interface (correct)
  • Path MTU for incoming SYN-ACK is 1500 – this is the MTU of the wireless interface (FAIL!)

The fix?

  • Workaround: on each client using the wireless connection, set the MTU to be a little lower
  • Crummy fix: on the Netgear DSL router, the MTU of the wireless card can be set to 1492.  I have no idea what this is going to do.
  • Better fix: don’t rely on the path MTU, but set the MTU explicitly by changing the rol from 
    -m tcpmss --clamp-mss-to-pmtu

    to

    -m tcpmss --mss 1492:65535 -j TCPMSS --set-mss 1492
  • Best fix: update the kernel to the version that checks the source and the destination MTU

I told netgear about it — case 19630614 on my.netgear.com :

Thu Oct 18 08:44:58 ~ $ xsel|grep expert
Thank you for choosing NETGEAR. My name is Ashish and I will be your support expert. I appreciate the opportunity to assist you.
Thank you for choosing NETGEAR. My name is Ashish and I will be your support expert. I appreciate the opportunity to assist you.
Thank you for choosing NETGEAR. My name is Sajeev and I will be your support expert. I appreciate the opportunity to assist you.
Thank you for choosing NETGEAR. My name is Amrit and I will be your support expert. I appreciate the opportunity to assist you.

The fourth reply says they’re bumping it up the chain. That’s nice.

Update Fri 7 Dec 2012: and they asked for the pcap files! Yay! Just as well I kept them. These are the pcap files:

Update Fri 25 Jan 2013: another response, but cluelessness has returned: they say “cannot replicate” and want access to “the computer” via teamviewer. I said, “You can’t be serious! Teamviewer? It takes you 30 days for Netgear to decide to do anything! There is NO WAY that I’ll be able to keep teamviewer open for that long – there are children in the house! Besides all this, the Netgear router that you are trying to diagnose is providing the network access, and any attempt to replicate the problem will cause teamviewer to fail. Additionally, the desktop system that could possibly run Teamviewer is running Linux, and if you couldn’t do anything with the stuff I’ve sent you already, I don’t have any reason to believe you’ll do any better with a Linux desktop. Even if I gave you a root login on my system, you would not be able to simultaneously bring up the wireless and the ethernet AND perform a meaningful test. This is not a desktop support matter, but a subtle networking problem. Perhaps you can tell me what specific difficulty was encountered while reproducing the fault, e.g. you couldn’t find a device of the appropriate model, you couldn’t establish a 802.11g wireless link, you couldn’t run a sniffer, you couldn’t generate traffic, etc, or after all of that your test worked perfectly, and your sniffer confirmed that 1500 byte packets were sent and handled correctly?” Much as that’s a great response to a stupid idea, because I couldn’t do the crazy thing they asked, my expectations are rather low. I think my Netgear junk will never be fixed. “Connect forever” they said, “with easy and reliable products for your wireless home network” they said – just that the “reliable” is only for certain types of traffic.

Update Tuesday 2 April 2013:they have closed my ticket. No more correspondence is being entered into.  I have given them a piece of my mind, which, it turns out, is rather angry about it all:

Bloody hell.  In 6 months only one person had enough sense to ask for a .pcap file, and when I supplied it, nobody could respond to that.  Hire some competent staff, or stop selling networking products.  Instead you send it back over and over with no real update.  It’s a simple problem, but you’ve moved on and you DO NOT SUPPORT OLD PRODUCTS (ie. something not under active development).  It doesn’t help to be polite if you are not willing to apply your mind for more than 3 minutes in the course of 6 months.  I have invested more time in this problem than you ever did.  Clearly I care too much about your products, and I will try to fix that by never buying them again.  You join my blacklist, consisting of Lexmark and Apple, and now also Netgear.

Yes, I have a personal blacklist of vendors.  It’s still short:

  • Lexmark: for suing people who made cartridges that work in their printers, and abandoning their older GDI printers without software support.
  • Apple: for adding boot-loader encryption in the ipod Nano (without changing the model number) so that it cannot be customised (I still have it somewhere)
  • Netgear: for abandonware: making a basic networking mistake and then providing only lip service support instead of technical support.

Bonus candidates for my personal vendor blacklist:

  • Hewlett-Packard: for years of price gouging on inkjet cartridges, and failure to connect the IPMI BMC on their motherboards to the network port (but then offering an expensive add on that does just that).  HP remains in candidate blacklist status because I have not yet paid any of my own money for their products …
  • Microsoft: for their subversive and destructive approach to document standards, and for funding “Planned Parenthood”.
Posted in Stuff | Tagged , , , , , , , , , , , | Comments Off on Can’t send mail because of iptables -A FORWARD -p tcp –tcp-flags SYN,RST SYN -j TCPMSS –clamp-mss- to-pmtu

Creation of a custom virtual machine

Posted on 16 September 2012 by stuff writer

In the beginning, the engineer created the virtual machine. Now the virtual machine was unconfigured, its files sparse, and the engineer pondered how he would set it up.

Then the engineer said, “Let’s give this thing a CPU and some memory.” Click click, and it was so. The engineer saw that the hypervisor had the CPU ready to run tasks, and that it was good enough. There was a coffee break, and a smoke. That was the first thing done.

Then the engineer said, “Let’s have some storage for this thing. And we’ll put all the operating system on one partition all in one place, and the data on the other.” Click click, and it was so. The engineer allocated space on local storage, and allocated space on the storage array. The progress bar moved to 100%. There was a coffee break, and a smoke. That was the second thing done.

Then the engineer said, “Let us create filesystems on the virtual disks.” The engineer partitioned the disks to hold related data together, and mounted them as part of one filesystem. He called the operating system root and the data he called home. It seemed fine. And there was a coffee break, and a smoke. That was the third thing done.

Then the engineer said, “Let the operating system filesystem be filled with the operating system files, each with their permissions and attributes, all according to their file types and directories.” And he installed the operating system files, and it was okay. There was a coffee break, and a smoke. That was the fourth thing done.

Then the engineer said, “Let’s hook this thing up to the network.” So he created two network connections: a fast network connection to stream public information from and to the system, and a slow network connection for local network communications. And he hooked them up to show their status on the virtual desktop. He also set up a cool screensaver. And it seemed to be working. There was a coffee break, and a smoke. That was the fifth thing done.

Then the engineer said, “Let’s install all sorts of applications on this thing.” And he installed operating system applications, and user applications – applications that log, analyse, and report, and a few kinds of scheduled jobs, each according to the system requirements. And it was not too shabby.

Then the engineer said, “I’m going to install a couple of scripts to do all my work for me. So he wrote down all his business rules in a script, and set it up, together with a helper application.

Then the engineer had a look at the entire virtual machine that he had set up, and said, “It’s pretty good, if I say so myself.” And so that was the sixth thing done, and the whole virtual machine was ready to be commissioned.

So the machine was completed, and all its vast storage array. Then the engineer put his feet up, and ate the pizza he had ordered earlier, and rested from all the configuration he had done. And he called the virtual machine “pizza”.

Here’s the funny thing: this is not actually fiction.  This really is how you set up a new custom virtual machine on KVM or vmware.  You really do click things into existence, and there really is nothing on the disk before you allocate space to it it – the disk really doesn’t exist until you start to use it.  Okay, you might not take so many breaks when you do it, and you might not smoke if you are a non smoker.  Also, if it’s a particularly big job, it may take a few days to get the job finished.  And you have to be pretty good at what you are doing to say it’s very good at every stop.

Posted in Stuff | Tagged , , , , , , , , , , | 1 Comment

Pottering around in the precise rosegarden

Posted on 31 August 2012 by stuff writer

After being inspired by the music of supertux, some of which is available with the original Rosegarden files, I downloaded it and got it running. It was quite a job. It turns out that it’s quite simple if you have done it before.

On Ubuntu 12.04 LTS, “Precise”, you need to:

  • Install Rosegarden
  • Install fluidsynth and fluid-soundfont-gm
  • Install jackd2 (I also installed jackd — no idea which one I’m actually using)

To do this, you install it something like:

sudo apt-get install rosegarden fluidsynth fluid-soundfont-gm jackd2

Then, before you bother to run rosegarden, actually, every single time you intend to use it, you need to start up fluidsynth:

fluidsynth -a pulseaudio /usr/share/sounds/sf2/FluidR3_GM.sf2

You can tell it to play a note to check that it is working:

Thu Aug 30 23:37:37 ~ $ fluidsynth -a pulseaudio /usr/share/sounds/sf2/FluidR3_GM.sf2 
FluidSynth version 1.1.5
Copyright (C) 2000-2011 Peter Hanappe and others.
Distributed under the LGPL license.
SoundFont(R) is a registered trademark of E-mu Systems, Inc.

fluidsynth: warning: Failed to pin the sample data to RAM; swapping is possible.
fluidsynth: Using PulseAudio driver
Type 'help' for help topics.

> noteon 1 72 127
> noteoff 1 72

If things are working as you might hope, then fluidsynth will start up jackd without your help, and you won’t have to run jack_control start. (If your system is anything like mine, then pulseaudio spends most of its time locked up, and likes to be killed occasionally, and after that the sound card’s mixer settings resets to zero, and you have to fiddle with the mute control to get sound again.) If not, then you’ll hear a note when you type noteon 1 60 127 and it will go off when you type reset (or noteoff 1 60).

Once fluidsynth is running, you can start up rosegarden. Don’t bother to try and make it do something: it’s not going to play any sound until you tell it where it’s output MIDI device is (ie, how does it send MIDI to fluidsynth to play?) There is a little toolbar button called “manage MIDI devices” which you have to click, but until you can find it, you can get this function on the menu:
Studio | Manage MIDI devices

If you see “synth plugin” then you’re on the right track, if not, sorry.

If you do get real sounds and you do manage to link to the synthesizer, then load one of the default songs, and work from there. If you can just get it to play and make basic edits, you are on your way to a lot of happy musicalness.

I always wanted my own symphony orchestra. In my enthusiasm, I arranged two songs, exported them to midi and got fluidsynth to make them into tinny sounding MP3’s (they don’t sound quite like a live orchestra, I’m afraid):

The default midi player does not use sampled sounds (“soundfonts”), so the “midi” file might sound pretty poor.

Here’s my script called midi2mp3 that pushes the midi file through the fluidsynth and lame sausage machine and spits out an mp3:

#! /bin/bash
for FILE in "$@" ; do
    case "$FILE" in
        *.mid)
            fluidsynth -F "${FILE/.mid/.wav}" /usr/share/sounds/sf2/FluidR3_GM.sf2  "${FILE}";
            lame "${FILE/.mid/.wav}" && rm "${FILE/.mid/.wav}"
            ;;
        *)
            echo "$FILE: not a midi file"
            ;;
    esac
done
Posted in Songs, Stuff | Tagged , , | Comments Off on Pottering around in the precise rosegarden

The virtual article is the genuine article

Posted on 29 August 2012 by stuff writer

So, you have this computer on your desk at work. You look at stuff on the monitor, you type on the keyboard, you move the mouse, you do stuff. It’s happy, your spreadsheets spread, and your words are processed. One day the computer gets upgraded: all of your data and stuff is migrated to a terminal server. Since you don’t bother to look under the desk much, you don’t notice that your data and everything you hold dear is no longer under your desk, but is now on the far end of a network connection. Your keyboard, monitor and mouse behave very much as they always did, and you are none the wiser. Later, the terminal server is moved out of its place under the staircase to a data centre in the middle of town (that’s why it’s called a data centre). You don’t notice that the response time has dropped from 2 milliseconds to 7 milliseconds. A few months down the line, the data center suggests that the terminal server be virtualised. Everything that was on the terminal server’s disks gets copied bit by bit to some large storage array, and scattered in multiple shards across a set of 17 different devices running diverse operating systems. The CPU power of your terminal server is, for the first week of deployment, running on blade 17 in rack 2, but because Suzy really used a lot of CPU power, the entire terminal server was moved to blade 34 in rack 5. That particular computer doesn’t have hardware that looks like your original computer or your terminal server, but it simulates it instead. Nobody tells you about this, because it’s really not relevant. Later, during a storage upgrade, your data is moved away from the center of town to two different locations, connected by fibre optic links. For reasons of security, the data is encrypted too, and no longer resembles the data you think you have, except by the application of the esoteric mathematics of cryptography. This means that there is no objective reality anywhere that is your computer … and yet you continue to use it every day.

At this point, you send a rather ill-advised e-mail to someone with a litigious frame of mind. The police arrive at your place of work with a warrant to seize your computer and search it for evidence of your terrible crime. You step back from your keyboard, monitor and mouse, and look in horror as they take it all away – but they soon return. The forensics expert says there’s a problem. Please would you be so kind as to explain exactly what this computer thing is that they should seize?

The point of this story (a cautionary tale of desktop virtualisation) is that the computer looks just the same to the user even when its form changes radically. We believe in it as a computer, because that’s what it behaves like. We don’t care how long the bits of string are that make it do its thing – whether they are nanometres or kilometers. We don’t care about the complex mathematics that brought it to us. There is no straightfoward way of telling whether you are dealing with a computer, or with a simulation of a computer. As long as it performs the function of a stand-alone computer, to us, it is a stand-alone computer.

Now, about this universe thing that we see and observe, and count as a true fact. What is it made of? Apparently, it is made out of a few fundamental particles, such as electrons, neutrons and protons, and these interact via electromagnetic waves, when they are not too busy being waves themselves. These interactions are governed by mathematical rules. These rules are such that the absorption spectrum of a hydrogen molecule on earth can be seen in the light coming from the sun, and also in the light coming from distant stars. Now how is it that atoms know how to interact with light according to mathematical laws? Why would something as tiny as an atom spend its time doing mathematics?

James Clerk Maxwell, the physicist said this,

“A molecule of hydrogen, for example, whether in Sirius or in Arcturus, executes its vibrations in precisely the same time. Each molecule, therefore, throughout the universe, bears impressed on it the stamp of a metric system as distinctly as does the metre of the Archives at Paris, or the double royal cubit of the Temple of Karnac … the exact quality of each molecule to all others of the same kind gives it, as Sir John Herschel has well said, the essential character of a manufactured article, and precludes the idea of its being eternal and self-existent.”

Maxwell agreed with Herschel that molecules look manufactured, and did not manufacture themselves. There is, however, another possible explanation for the similarity of atoms that comes from computer science: a simulation.

If we were to manufacture an article such as a hydrogen molecule today, and have it interact with other hydrogen molecule according to mathematical laws, how would we do it? In Maxwell’s time you could manufacture something of wood with a few magnets stuck on and get an approximation of some of the qualities. In our time, you manufacture such articles in a simulation. The articles are identical because the same rules are applied to each article by the simulation. The rules are not inherent to the article itself, but are externally impressed on it by the simulation.

A virtual computer believes itself to operate on real hardware that functions according to predictable principles. It doesn’t matter how these principles are implemented – whether by hardware under your desk, or by something vastly more complex than you would expect.

We live in a universe that operates according to mathematical rules. For the purpose of observation and general use, it does not matter how the rules are implemented – whether they are fundamental to the stuff of the universe, or by something vastly more complex than you can conceive.

If we are living in a high quality simulation (as some interpretations of quantum mechanics propose), then the question should be whose simulation we are living in.

Paul, explaining the concept of the creator to the pagan Athenians, saw fit to quote this line from their own (pagan) poets:

Yet he is actually not far from each one of us, for
‘In him we live and move and have our being’; as even some of your own poets have said,
‘For we are indeed his offspring.’

It’s probably worthwhile to note that every simulation that has been done by man has used equipment that is vastly more complex than the thing being simulated. The stuff in the simulation does exist – it’s just virtual.

Update: The reason we don’t notice that the machine under our desk no longer exists is because we experience only the results of its mathematics – just like everything else we experience which is the result of mathematics.  Any process that calculates the same results from the inputs we provide is essentially equal.  We don’t care much whether the calculations in question are done by local electronics, or by remote electronics (or by by enslaved gnomes with pencils, if they can work fast enough).

Posted in Stuff | Tagged , , , , , , , | Comments Off on The virtual article is the genuine article

Douglasdale watered down milk

Posted on 18 August 2012 by stuff writer

Just for the record: we’re not buying Douglasdale milk from Douglasdale dairies for the next few months, since we bought a batch of “full cream milk” that was visibly watered down, such that you couldn’t use it to make coffee (reference on the packet says “BX AUG”). It was as if 30% to 40% of what we bought as milk was added water.

Want to know more? Visit their web site at http://www.douglasdale.co.za/ (http://douglasdale.co.za/ is a parking page). Use it, don’t use it.

Posted in Stuff | Tagged , , , | Comments Off on Douglasdale watered down milk

Loading progress display with mod_fcgid using mod_deflate

Posted on 17 August 2012 by stuff writer

When you run your processes with mod_fcgid under apache, one of the problems is that you cannot usefully run flush() to send buffered output through to the client. The reason for this is that the fastcgi interface doesn’t have the nangle algorithm, so it naïvely sends data once a 64kbyte block has been buffered. What this means is that code like this just doesn’t work:

<pre><?php passthru('
echo hello; sleep 5;
echo there; sleep 5;
echo all at once;')

Instead of sending output in three batches 5 seconds apart, it sends it all at once at the end.

However, there’s a work-around. If you’re using mod_deflate then whatever you send from your process to mod_fcgid is compressed before it is transmitted to the client. So you can do this:

<pre><?php passthru('
echo hello; dd if=/dev/zero count=128; sleep 5;
echo there; dd if=/dev/zero count=128; sleep 5;
echo all at once;')

That causes the data to be sent in three discrete steps. Even though there is a 64kbyte block of nulls transmitted from your PHP process to apache, apache compresses that down to under 1kbyte so it is never transmitted across the wire. The only way to tell that it’s there is to look carefully at your memory usage in the browser.

Posted in Stuff | Tagged , , , , , , | Comments Off on Loading progress display with mod_fcgid using mod_deflate

Hell is bad

Posted on 19 July 2012 by stuff writer

I saw this on the screen today:

Thu Jul 19 11:52:59 ~ $ traceroute hell
hell: Name or service not known
Cannot handle "host" cmdline arg `hell' on position 1 (argc 1)

The computer says it doesn’t know what it is, but it knows it’s bad. It’s an echo of this:

And throw that worthless servant outside, into the darkness, where there will be weeping and gnashing of teeth.

Hell: you don’t want to go there, even though it may be an excellent place for you. Not even the computer can handle it.

Posted in Stuff | Tagged , , , | Comments Off on Hell is bad

Protection of Information Bill, sure

Posted on 1 April 2012 by stuff writer

The “Protection of Information Bill 6 of 2010” (or whatever it is called) is currently being steamrollered through our legislative system. This act says that state information must be protected, and lays out all sorts of sanctions for those who expose the state’s secrets (or the party’s dirty laundry, or whatever). Now, this brings up an interesting point: why is protecting your information my problem?

In the good old days, protected information was placed in a dossier with a stamp like “CLASSIFIED”, and only those who had signed the official secrets act would be allowed to look at it. There were measures to prevent this information from blowing out of the window and into the hands of the masses. If someone had the temerity to agree to protect state secrets, and then later expose classified content to the masses, they could hang for treason (or face some other unpleasant punishment). The point is that in times gone by, the state could find people to trust to keep secrets, and place guards with guns to shoot people it didn’t trust.

But now, in South Africa 2012: the state has given up all pretence of having officials that have integrity. An official may agree to keep secrets safe, but the state knows that their officials have no intention of keeping their promises.

Since the state’s officers cannot protect their information, the state would like someone new to protect their information: YOU. If you happen to find the state’s classified information blowing in the wind, or being spoken freely in public, or being chatted about on the internet, or published on billboards, or between the lines in the news, then you must (on pain of nasty punishments) keep it entirely to yourself (please). The state has given up the notion that it will protect its own information. It has proclaimed its loss of confidence in the public service. You are the last line of defence against a curious public finding out that yet another incompetent murderous adulterous fraudster has been promoted to a top post, over the objections of his properly qualified peers.

How will you know that you have published protected state information? That’s easy: it’s not that it will be in a clearly marked “classified” dossier, or printed on a particular type of paper; it’s not that it will be delivered to you in the dead of night by a shadowy spy who obtained it by craft: no, you will know that you have published protected state information when your front and back doors simultaneously disintegrate into fine powder, and you are dragged off to prison wondering what it is all about.

And you shall know the truth, and the truth shall make you free.

(Until you publish, that is.)

Posted in Stuff | Tagged , , | Comments Off on Protection of Information Bill, sure

Compiling deb with debian/rules in parallel

Posted on 15 March 2012 by stuff writer

Make supports parallel compiling, with the Linux kernel compile recommending you make use of your expensive CPU cores something like this:

make -j 4

You can even do that if you don’t have a multiprocessor system, since you have a multitasking operating system.

Today, while recompiling ImageMagick with FFT support, I found you can compile in parallel like this:

apt-get source imagemagick
sudo apt-get build-dep imagemagick
imagemagick-*
debian/rules -j 4 binary

The load goes up to around 5.0 for the duration of the compile, which is exactly what you want, to set fire to your inadequately cooled CPU. Also, it finishes faster. (I’ll bet it works for other .deb’s too…)

Posted in Stuff | Tagged , , , , | Comments Off on Compiling deb with debian/rules in parallel

Whatever you bind on earth …

Posted on 12 March 2012 by stuff writer

If you are not conversant in first century Greek, then in order to read the Bible, you generally need a translation.  I am told that the ESV is an excellent translation.  My loving wife went out and bought one.  It looks like this:

According to the ESV

The epistle of John to the Ephesians

This particular printing (printed in Canada) appears to have suffered a quire selection problem.  There are two copies of Matthew 22:4 to John 12:30.  From the second copy of John 12:30 we continue suddenly at Galatians 5:4.   Reading over the page boundary it says (bizarrely):

Others said, “An angel has spoken to him”.  Jesus answered, “This voice has come for your sake, who would be justified by the law; you have fallen away from grace.

Now this is a simple misprint.  Some machine that was supposed to grab one pile of pages slipped, and grabbed two, and when the book was big enough to fit in the cover it was bound and put in the “finished” pile.  The thickness was correct, so it passed QA, and arrived in .ZA ready to be sold as a marked down reject.

This brings to mind two problems with modern Bible translations:

Firstly, there is a rather unquestioned reliance on Wescott & Hort’s notion of a superior “earliest text”, at the expense of the received text.  The trouble is that the text that is true is the one that is actually used.  The true text is not in good physical condition, since it is worn down by continual use.  The text which was not a good and true copy, which was made by people who had no living interest in its content is the text which can later be recovered in pristine condition.  Thankfully this overt reliance on “early manuscripts” appears to be waning.

Secondly, the problem of copyright.  Printing and distributing a Bible translation is not a task to be lightly attempted.  It requires specialist skills which, for a long time, have been the exclusive preserve of publishers.  As a result, the copyright for Bible translations is held by publishers.  These publishers, for all their finer qualities have, as a primary goal, profit.  Given the choice between serving God and Mammon, they pay lip service to God, and get as much from Mammon as they reasonably can.  To enable this, the average Bible translation includes all sorts of legal claims to ownership by the publisher:

  • Quotes over 1000 verses are prohibited
  • Recordings over 250 verses are prohibited
  • You must make up more than 50% of what you say when you quote the version.
  • You must credit the publisher in various intrusive ways, and advertise their trademark when you quote the content.
  • No commentaries may be made except by permission

Those are from the ESV.   The NIV has similar terms, but less generous.  Interestingly, there is no requirement that quotations be accurate.  Quite amazing.

These terms were placed there for the publisher, and not for the kingdom of God.  They are there to ensure a profit for the publisher – or a surplus for the non-profit publisher.  Surely they are entitled to payment for their work, but this kind of restriction forgets that a translation of a work owes a lot to the original author.  The original author takes a lively interest in his work.  He should not be trifled with.

My printing of this good book includes only one copy of this verse:

Freely you have received, freely give

And it has no copies of this verse:

Unlike so many, we do not peddle the word of God for profit.

Posted in Stuff | Tagged , , , | Comments Off on Whatever you bind on earth …