Fedora is a Trademark of Red Hat, Inc, an operating system built by volunteers around the world. This page is provided so that independent volunteers can showcase our contributions to Fedora and Free Software in general. Official Fedora Download page.

We Make Fedora

December 11, 2024

Kiwi TCMS Major outage for Kiwi TCMS
Hello testers, in the spirit of transparency we'd like to inform everyone that on Dec 11th 2024 between 07:20-09:30 UTC Kiwi TCMS suffered a major outage!

The Kiwi TCMS web application was up and running, however the database behind it had stopped accepting requests resulting in 500 Internal Server Error page visible to everyone. A little over 1000 requests (both manual and via API) were affected!

As of this time service has been restored and our team is taking corrective actions. So far it doesn't look like that there was loss of historical data.

If you like what we're doing and how Kiwi TCMS supports various communities please help us!
- Join our newsletter and follow all project news;
- Become a contributor and an awesome open source hacker;
- Become a customer and help us sustain development

December 10, 2024

Peter Czanik Running a syslog-ng server in WSL
Windows Subsystem for Linux (WSL) allows you to run Linux applications on a Windows host. While you can install and run syslog-ng on a default WSL installation, it is not really practical: there is no systemd and WSL is behind NAT. This blog gives you some pointers for working around these problems.

For many years, if you wanted to work with WSL, you had to find information in various forums, blog posts, or mailing list archives. Not anymore: Microsoft made using WSL easier and even prepared proper documentation for it. Throughout this blog, I will refer to various sub-pages of https://learn.microsoft.com/en-us/windows/wsl/

Before you begin

First of all, make sure that WSL 2 is installed on your Windows machine. You also need to install one of the Linux distributions. My choice is openSUSE Leap, but the same instructions should work on any of the supported Linux distributions. Once you installed Linux, do not install syslog-ng yet!

Enabling systemd

Before you install syslog-ng, make sure that systemd is enabled in WSL. It is not enabled by default to make WSL start (a lot) faster. Check https://learn.microsoft.com/en-us/windows/wsl/systemd on how to enable systemd support within WSL.

Install and configure syslog-ng

Once you restarted WSL verify that you are using systemd: start systemctl. Running it without any arguments is good enough: if you do not get a big red warning, then you are OK.

Now it is time to install syslog-ng according to your Linux distribution of choice. In my case it was:
```
zypper -v in syslog-ng
```
Make sure that a network source is available in your configuration and that it is enabled in a log path:
```
tcp(ip("0.0.0.0") port(514));
```
Then, restart syslog-ng:
```
systemctl restart syslog-ng
```
Configuring networking

By default, WSL is behind NAT. Unfortunately, because of company policy, I have Windows 10 on my laptop, which is a lot less flexible. Windows 11 has a lot more possibilities to provide network services from WSL to the outside world.

All possibilities are described at https://learn.microsoft.com/en-us/windows/wsl/networking

In my case, I adopted the following command line to forward log messages into WSL:
```
netsh interface portproxy add v4tov4 listenport=<yourPortToForward> listenaddress=0.0.0.0 connectport=<yourPortToConnectToInWSL> connectaddress=(wsl hostname -I)
```
What is next?

Your mileage may vary, but despite my workarounds, when it comes to Windows, I still find it a lot easier to install syslog-ng on a proper virtual machine. However, my preferences might be just because of the Windows 10 limitations I mentioned. As such, if you use WSL regularly anyway, then running syslog-ng in it might be still a good alternative to deploying a full-fledged virtual machine.

-

If you have questions or comments related to syslog-ng, do not hesitate to contact us. You can reach us by email or even chat with us. For a list of possibilities, check our GitHub page under the “Community” section at https://github.com/syslog-ng/syslog-ng. On Twitter, I am available as @PCzanik, on Mastodon as @Pczanik@fosstodon.org.

Josef Strzibny How does Kamal deploy to multiple hosts

How does Kamal deploy to multiple hosts at once? And how to configure it?

SSHKit

Kamal is built around SSHKit which provides Kamal with the SSH connections to issue remote commands. Through out the Kamal codebase we can notice the following SSHKit DSL which let’s Kamal schedule work on each hosts with their own thread:

on(KAMAL.hosts) do |host|
  # Execute commands on each host
end

Kamal also enhances the SSHKit capabilities further in some ways. The most notable are the changes to SSHKit::Runner::Parallel that lets Kamal wait on all threads and collect the failures:

class SSHKit::Runner::Parallel
  # SSHKit joins the threads in sequence and fails on the first error it encounters, which means that we wait threads
  # before the first failure to complete but not for ones after.
  #
  # We'll patch it to wait for them all to complete, and to record all the threads that errored so we can see when a
  # problem occurs on multiple hosts.
  module CompleteAll
    def execute
      threads = hosts.map do |host|
        Thread.new(host) do |h|
          backend(h, &block).run
        rescue ::StandardError => e
          e2 = SSHKit::Runner::ExecuteError.new e
          raise e2, "Exception while executing #{host.user ? "as #{host.user}@" : "on host "}#{host}: #{e.message}"
        end
      end

      exceptions = []
      threads.each do |t|
        begin
          t.join
        rescue SSHKit::Runner::ExecuteError => e
          exceptions << e
        end
      end
      if exceptions.one?
        raise exceptions.first
      elsif exceptions.many?
        raise exceptions.first, [ "Exceptions on #{exceptions.count} hosts:", exceptions.map(&:message) ].join("\n")
      end
    end
  end

  prepend CompleteAll
end

Web barrier

Kamal splits servers into roles with a primary role. The usual primary role is a web role, e.g. our Puma server serving HTTP requests.

This role is important as it’s the first role to be booted before any other role:

def run
  old_version = old_version_renamed_if_clashing
  wait_at_barrier if queuer?

  begin
    start_new_version
  rescue => e
    close_barrier if gatekeeper?
    stop_new_version
    raise
  end

  release_barrier if gatekeeper?

  if old_version
    stop_old_version(old_version)
  end
end

Only once at least one host of the primary role succeeds, everything else gets a green light for booting as well.

Controlled rollouts

Kamal supports rolling deployments through the boot configuration in config/deploy.

With limit and wait we can decide how many servers to deploy at a time and how long to wait between groups:

boot:
  limit: 2  # Deploy to 2 servers at a time
  wait: 10  # Wait 10 seconds between groups

Alternatively the limit can also be specified as percentage:

boot:
  limit: 25% # Deploy to 25% of servers at a time
  wait: 10

This lets us rollout the new changes in a pace we are comfortable with.

Note that on each hosts containers are booted in a blue-green style of deployment where both old and new containers run next to each other for a brief period of time.

Finally, there is one more related setting for controlling the number of started concurrent connections at a time:

sshkit:
  max_concurrent_starts: 10

December 09, 2024

Charles-Antoine Couret Revue de presse de Fedora Linux 41
Cela fait depuis Fedora 19 que je publie sur la liste de diffusion de Fedora-fr une revue de presse de chaque sortie d'une nouvelle version. Récapituler quels sites en parle et comment. Je le fais toujours deux semaines après la publication (pour que tout le monde ait le temps d'en parler). Maintenant, place à Fedora Linux 41 malgré le retard !

Bien entendu je passe sous silence mon blog et le forum de fedora-fr.

Sites web d'actualité
- Linuxfr ;
- Next ;
- Développez.com ;
- Laptop Spirit.
Soit 4 sites.

Les vidéos
- Linuxtricks.
- Actualia.
Soit 2 vidéos.

Bilan

Le nombre de sites parlant de Fedora Linux 41 est en légère baise de même que les vidéos.

La semaine de sa sortie, nous avons eu globalement une augmentation de visites par rapport à la semaine d'avant de cet ordre là :
- Forums : hausse de 7% (plus de 250 visites en plus)
- Documentation : hausse d'environ 10,5% (soit environ 200 visites en plus)
- Le site Fedora-fr : hausse de 30% (soit 60 visites en plus)
Si vous avez connaissance d'un autre lien, n'hésitez pas à partager !

Rendez-vous pour Fedora Linux 42.
Charles-Antoine Couret Fedora Linux 39 n'est plus maintenu

C'est en ce mardi 26 novembre 2024 que la maintenance de Fedora Linux 39 prend fin.

Qu'est-ce que c'est ?

Un mois après la sortie d'une version de Fedora n, ici Fedora Linux 41, la version n-2 (donc Fedora Linux 39) n'est plus maintenue.

Ce mois sert à donner du temps aux utilisateurs pour faire la mise à niveau. Ce qui fait qu'en moyenne une version est officiellement maintenue pendant 13 mois.

En effet, la fin de vie d'une version signifie qu'elle n'aura plus de mises à jour et plus aucun bogue ne sera corrigé. Pour des questions de sécurité, avec des failles non corrigées, il est vivement conseillé aux utilisateurs de Fedora Linux 39 et antérieurs d'effectuer la mise à niveau vers Fedora Linux 41 ou 40.

Que faire ?

Si vous êtes concernés, il est nécessaire de faire la mise à niveau de vos systèmes. Vous pouvez télécharger des images CD ou USB plus récentes.

Il est également possible de faire la mise à niveau sans réinstaller via DNF ou GNOME Logiciels.

GNOME Logiciels a également dû vous prévenir par une pop-up de la disponibilité de Fedora Linux 41 ou 40. N'hésitez pas à lancer la mise à niveau par ce biais.
Fedora Community Blog F41 Elections Voting is now Open!
Voting in the Fedora Linux 41 elections is now open. Go to the Elections app to cast your vote. This cycle we have just one election to vote in – FESCo. Voting closes at 23:59 UTC on Friday, 20thDecember and don’t forget to claim your “I Voted” badge when you cast your ballot. Links to candidate interviews are below.

Fedora Engineering Steering Committee (FESCo)

There are five seats open for the Fedora Engineering Steering Committee (FESCo).
Mindshare Committee

As one of the nominees for the Mindshare Committee is already an active elected member, Sumantro Mukherjee, the current eligible nominee number matches the open seats, and so the eligible nominated candidate will be automatically elected in. Early congratulations, Luis Bazan!

The post F41 Elections Voting is now Open! appeared first on Fedora Community Blog.
Fedora Community Blog FESCo election: Interview with Zbigniew Jędrzejewski-Szmek
This is a part of the Elections Interviews series. Voting is open to all Fedora contributors. The voting period starts on Monday, 9th December and closes promptly at 23:59:59 UTC on Friday, 20 December. 2024

Interview with Zbigniew Jędrzejewski-Szmek
- Fedora Account: Zbigniew Jędrzejewski-Szmek
- Nick: zbyszek
- Matrix Channels typically found in: fedora-devel, fedora-python, systemd, mkosi
- Fedora User Wiki Page
Why do you want to be a member of FESCo and how do you expect to help steer the direction of Fedora?

I see the role of FESCo as a place where all voices are heard so that a consensus decision can be reached. It is individual community members, SIGs, and other groups who should propose and implement changes. FESCo is the place where questions about motivation, backwards compatibility, user experience, schedules and contingency plans are asked and answered. I think it’s totally fine when the majority of decisions by FESCo is unanimous after that.

Overall, I think Fedora is doing OK. We are consistently delivering very solid releases regularly, with latest packages, and with a number of interesting new features in each release. The release of F39 was delayed, but this can be attributed to internal Red Hat problems. I hope we’re past this and will be back on track for F40.

To maintain the position of Fedora as the most innovative distro, we need to keep adapting and implementing big new initiatives. I would love to see Fedora more widely used, with more packages delivered more reliably. I very much support the FPL’s goal to double the number of contributors. Coincidentally, I think it’ll be easier to engage new contributors, including existing upstream maintainers, when the packaging story is streamlined.

We have a number of initiatives that improve specific areas, but we’re not doing enough to build tools and procedures that provide a uniform and consistent experience. For example, we have rpmautospec, but it’s not universally used. We have automatic bodhi updates for rawhide, but the same functionality is not available for stable releases. We have gating, but it’s still very hard to use, with lots of false positives. Packit is being used by some packages, but it’s something on the side, only awkwardly integrated with the normal Fedora packaging infrastructure. We need to build a more coherent packaging experience so that we can do bold, innovative things in Fedora.

How do you currently contribute to Fedora? How does that contribution benefit the community?

I’m active in systemd upstream, and I’ve been doing systemd package maintenance in Fedora since 2013; if you’ve submitted a systemd bug in Bugzilla or in the upstream bugtracker, chances are I’ve looked at it. I maintain a few dozen packages, and I try to do new package reviews regularly (469 so far). I’ve been in FESCo since F28. I’be been involved in various initiatives, like the transition of various upstream to Python 3, mass rename of Python 2 packages during the transition to Python 3, improvements to packaging tools (rust2rpm, rpmautospec), transition of the packaging documentation from the wiki, ELF package notes, reproducible builds, updating of Packaging Guidelines for new techniques. I try to help with all aspects of packaging, but I’m especially interested in mass cleanups and automatization of various packaging processes.

How do you handle disagreements when working as part of a team?

Team members must trust each other and be transparent about their reasoning and motivations. If that is true, technical differences can be explained away or proven with actual code. For all this to work, the group must share a common goal.

What else should community members know about you or your positions?

Continue my wishlist of 2024 into 2025, as I have done in previous election years:
- Clean up bodhi update gating so that false failures are infrequent and packagers start relying on the status and always consider the results.
- Figure out how rpmautospec should be used during initial packaging and during review. The documented method before and after review must be consistent.
- Convert 90+% of packages to SPDX license tags.
- Set up a continuous rebuilds of rawhide/amd64 to gather statistics on build reproducibility of Fedora packages. Once the common issues have been resolved, plan towards making build reproducibility an official feature.
- SystemdSecurityHardening
- continue the work on Unified Kernel Images and non-dracut initrds. This year we should get a pre-built initrd as an option for normal users.
The post FESCo election: Interview with Zbigniew Jędrzejewski-Szmek appeared first on Fedora Community Blog.
Fedora Community Blog FESCo election: Interview with Tomas Hckra
This is a part of the Elections Interviews series. Voting is open to all Fedora contributors. The voting period starts on Monday, 9th December and closes promptly at 23:59:59 UTC on Friday, 20 December. 2024

Interview with Tomas Hckra
- Fedora Account: Tomas Hckra
- Nick: jednorozec/humaton
- Matrix Channels typically found in: fedora-releng, #fedora-devel, #fedora-devel, #fedora-noc
- Fedora User Wiki Page
Why do you want to be a member of FESCo and how do you expect to help steer the direction of Fedora?

As a product owner of Community linux engineer team, I bring to the table insight on the planning and capacity that the team that is running fedora infrastructure, release engineering and Quality has, and this perspective can bring some new opinions into the steering process. My focus is mostly on user/contributor self-service where possible so we can remove obstacles for new people coming into the Fedora project.

How do you currently contribute to Fedora? How does that contribution benefit the community?

Over the last decade, I went through package maintenance and app development. Currently, I am part of the release engineering team, helping out with releases and related infrastructure work. Right now I am working on dropping the Product Definition Center from our workflows so we can reduce the complexity in our package-related processes and tooling.

How do you handle disagreements when working as part of a team?

Most of the team disagreements I was part of were caused by communication issues and misunderstanding of one or the other side. So I strongly believe that most problems are resolvable by listening, considering the other side, and communicating about the disagreement clearly. The next step is building consensus keeping in mind all the viewpoints that caused the conflict in the first place.

What else should community members know about you or your positions?

I am a full-on open-source nerd, everything in my house is running open-source SW. I am not shy of public speaking you can find some of my talks on YouTube like this one about opensource home automation: https://www.youtube.com/watch?v=HUhHaHnzhYA

Two main ideas that define my approach to technology:
“I want all things open and all sources shown”
“Where is a serial console there is a way”

The post FESCo election: Interview with Tomas Hckra appeared first on Fedora Community Blog.
Fedora Community Blog FESCo Election: Interview with Josh Stone
This is a part of the Elections Interviews series. Voting is open to all Fedora contributors. The voting period starts on Monday, 9th December and closes promptly at 23:59:59 UTC on Friday, 20 December. 2024

Interview with Josh Stone
- Fedora Account: Josh Stone
- Nick: jistone
- Matrix Channels typically found in: #rust:fedoraproject.org
- Fedora User Wiki Page
Why do you want to be a member of FESCo and how do you expect to help steer the direction of Fedora?

I’m proud of Fedora, both as a user and contributor, and continuing to serve on FESCo would be another way for me to contribute to its success. I don’t have a list of things that I would change in Fedora, but even steering along the current course requires time and attention, and there will always be new changes on the horizon. I think that I have relevant experience to continue to help as an elected member of FESCo.

How do you currently contribute to Fedora? How does that contribution benefit the community?

I maintain the Rust toolchain in Fedora, keeping up with its releases every 6 weeks for all Fedora branches, and sometimes point release in-between. We decided long ago that rolling rebases made the most sense for Fedora, since Rust developers are often eager to use new features. This keeps Fedora relevant for Rust developers, and helps Rust SIG packagers to not worry about the toolchain version when updating crates. I also work closely with the LLVM maintainers, both for coordinating Rust needs and in more general issues.

How do you handle disagreements when working as part of a team?

Disagreements are natural, and the goal should be to reach consensus, which may require difficult conversations about pros and cons and compromise positions. But even then, it’s not always possible to reach agreement, and hopefully in that case there is a governance structure to fall back on — whether that’s a decision maker in a team lead or manager, or a democratic process like voting in FESCo decisions. Ultimately, it’s important to operate in good faith and assume the same in others, and agree to commit and move on when a decision has been made.

What else should community members know about you or your positions?

I’m a member of Red Hat’s Platform Tools team, where I also maintain the Rust toolchain for RHEL. In a previous role, I worked on SystemTap for Fedora and RHEL, giving me broad experience across the entire system. In the upstream Rust community, I’m a member of the library, release, and security-response teams, and I previously served as a Project Directoron the board of the Rust Foundation. So while my current contributions to Fedora are narrowly focused, I think I have a lot to offer in the larger view as a FESCo member.

The post FESCo Election: Interview with Josh Stone appeared first on Fedora Community Blog.
Fedora Community Blog FESCo election: Interview with David Cantrell
This is a part of the Elections Interviews series. Voting is open to all Fedora contributors. The voting period starts on Monday, 9th December and closes promptly at 23:59:59 UTC on Friday, 20 December. 2024

Interview with David Cantrell
- Fedora Account: dcantrell
- Nick: dcantrell
- Matrix Channels typically found in: fedora-ambassadors, #fedora-ci, #fedora-devel, #fedora-qa, #rpm, and #rpm-ecosystem & you can also ping me directly
- Fedora User Wiki Page
Why do you want to be a member of FESCo and how do you expect to help steer the direction of Fedora?

Fedora is important to me as both a project and a community. I want to continue to help steer Fedora’s engineering direction and ensuring that the project succeeds and grows. Specifically I want to see it continue to embrace more container-based delivery alongside the traditional RPM model. Making Fedora even easier to work with in a container: to maintain, to update, and to deploy. We also have a lot of hardware opportunities and seeing the Asahi Project move to using Fedora as their base was great. On FESCo we discuss all of these sorts of things and more and I want to continue to hear from the users and developers and help guide the project.

How do you currently contribute to Fedora? How does that contribution benefit the community?

Aside from FESCo, I also serve as the engineering representative on the Fedora Council. I am a Fedora Ambassador and a sponsor for new contributors. I maintain a range of packages and am the upstream developer for a number of projects. My recent large project has been the rpminspect program which is used in a handful of CI environments to validate builds and check policy compliance.

I run both the latest stable release of Fedora and rawhide and report bugs when I encounter them and submit patches when possible.

I try to answer questions for as many people as I can and when I can’t, I try to help find someone who can.

How do you handle disagreements when working as part of a team?

In my experience, disagreements come up because everyone is very passionate about the task or topic at hand. It’s important to remember that most of these should end in compromise. I do my best to make my points clear and understood while at the same time listening to everyone else. Sometimes the conversation itself is enough to clear up disagreements. Maybe I didn’t have the full story or maybe someone else didn’t. As long as we are willing to have these conversations and reach a compromise, things go well.

What else should community members know about you or your positions?

My day job is working at Red Hat, where I have been working on RHEL and Fedora full time for 19 years. Prior to that I worked at a number of companies doing Linux development or admin work and even before that I worked on the Slackware Linux distribution.

Outside of work I enjoy restoring old and obsolete computers, making contacts (or actively pretending to make contacts) via amateur radio, and boating in and around Boston Harbor and New England.

I live in Medford, Massachusetts.

The post FESCo election: Interview with David Cantrell appeared first on Fedora Community Blog.
Adam Young Long Refactoring: Generators
While the main solving function is now cleaned up, I am not very happy with the code that checks the validation on each cell.

I am not going to go through each step here, as the pattern is well established now. Pull out of the function anything that is a distractor. Once you have the heart of the algorithm, clean it up. Then put things back together.

Here is what the is_value_valid function looks like before refactoring:
```
    def is_value_valid(self, board, node):
        return self.value_valid(board, node.row, node.col)

    def value_valid(self, board, row_index, column_index):
        row = possible_values()
        column = possible_values()
        square = possible_values()
        for number in board[row_index]:
            if number == '0':
                continue
            if number in row:
                row.remove(number)
            else:
                return False
        for a_row in range(DIM):
            number = board[a_row][column_index]
            if number == '0':
                continue
            if number in column:
                column.remove(number)
            else:
                return False
        box_indexes = self.table[
            self.find_box_of_index(
                str(row_index) + str(column_index))]
        for index in box_indexes:
            row = int(index[0])
            column = int(index[1])
            number = board[row][column]
            if number == '0':
                continue
            if number in square:
                square.remove(number)
            else:
                return False
        return True
```
What is peering out at us here is three very similar checks to see if a number is duplicated in a row, a column, or a box.

Here is the end state of is_value_valid:
```
def is_value_valid(board, node):
    if not is_set_valid(board, node.row, node.col, column_generator):
        return False
    if not is_set_valid(board, node.row, node.col, row_generator):
        return False
    return is_set_valid(board, node.row, node.col, box_generator)
```
The only thing that differs when checking a row, a column, or a box is the iterator used to figure out what value is next. We use the term set to to collect all three of those into a common abstraction: each one of those grouping contain a set of the digits 1 to 9 with no repeats. Here is the code for is_set_valid:
```
def is_set_valid(board, row_index, column_index, generator):
    box = possible_values()
    for (row, column) in generator(row_index, column_index):
        number = board[row][column]
        if number == '0':
            continue
        if number in box:
            box.remove(number)
        else:
            return False
    return True
```
This is the code that was repeated in the original value_valid method function. Here are the three generators:
```
def column_generator(row, col):
    for i in range(0, DIM):
        yield (i, col)


def row_generator(row, col):
    for i in range(0, DIM):
        yield (row, i)


def box_generator(row, col):
    row_mod = row % BASIS
    start_row = row - row_mod
    col_mod = col % BASIS
    start_col = col - col_mod
    for i in range(0, BASIS):
        for j in range(0, BASIS):
            yield (start_row + i, start_col + j)
```
Note that they have the same parameter list. This is an implementation of the strategy design pattern: vary the algorithm that is passed into the validation function.

I made this transformation in many little steps. Here are the comments in the git log for each of them.
- rename square to box
- extract method is_row_valid
- extract method is_col_valid
- move is_row/col_valid method calls to is_value_valid method
- rename value_valid is is_box_valid
- move method is_box_valid to top level function
- move is_value_valid to top level function
- replace BoxIndex table lookup with generator
- remove class BoxIndex
- remove unnecessary index variable
- replace board_index_table lookup with function index_to_row_col
- remove BoardIndexTable
- common parameter list for is_x_valid functions
- pass generator in to is_set_valid
- use generators for row and column validation
- remove class BoxIndex
- remove validators for row and column that now use common code
I was not able to see this path from the start. Instead, I had to first simplify the value_valid method until it only did one thing. This is an analogue to disassembling a machine before I can work on its innards: I had to make sure I kept track of the parts I was going to want when I got to reassembling it. As the process progresses, I started making a bunch of smaller functions, with the hope of organizing the code in a better way at the end.

The major code reductions happened in the middle of the process. The original code did a couple of table lookups to convert from coordinates to cells. These lookups made use of the BoardIndexTable and the BoxIndex. Since the lookups could be easily replaced with mathematical computations, removing them reduced the amount of code significantly, and made the overall flow of the program easier to understand…at least for me. I ended up adding test_index_to_row_col. This test allowed me to isolate the new behavior I was adding to perform the math.
```
def test_index_to_row_col():
    (row, col) = tree_sudoku.index_to_row_col(0)
    assert (row == 0)
    assert (col == 0)

    (row, col) = tree_sudoku.index_to_row_col(80)
    assert (row == 8)
    assert (col == 8)
```
In other code, it might be a major performance benefit to do a table lookup instead of a more complex computation. Again, the strategy pattern could help here to allow you to swap in which ever approach makes sense in a given situation.

In extracting the functions, I ended up with code that was significantly less object-based than I started with. This function decomposition we driven by the need to pull behavior apart that did not belong together. I think there is still an object model in there waiting to emerge, but the code needs further teasing apart before it can be put back together in a different way.
Josh Bressers Episode 458 – FBI endorses E2E encryption
Josh and Kurt talk about the FBI telling everyone to use end to end encrypted messengers. This is a pretty drastic deviation from messages in the past. The reason for this is it appears the US telephone networks are pwnt beyond repair at this point, which is concerning. The only real solution now is to treat the phone network as untrusted and encrypt all the traffic.
https://traffic.libsyn.com/opensourcesecuritypodcast/Episode_458_FBI_endorses_E2E_encryption.mp3
Show Notes

December 06, 2024

Adam Young Getting a File from gitlab using a TOKEN
I work on a system in our lab that I connect to via SSH. Fetching a file via the web and pushing it to this machine is quite slow, and I want to pull on this machine directly. The trick to make this work is to use a TOKEN from gitlab and oauth2 as the username portion of the URL. For example
```
curl -O   https://oauth2:$CI_JOB_TOKEN@gitlab.com/api/v4/projects/$PROJECT_ID/packages/generic/$PROJECT_NAME/$PROJECT_VERSION/$FILE
```
The CI_JOB_TOKEN must be set to a token that has appropriate permissions on your project. Most of the values I wrote as envvars could be copy-pasted from the gitlab packages link on the web.
Remi Collet PHP version 8.2.27RC1, 8.3.15RC1 and 8.4.2RC1
Release Candidate versions are available in the testing repository for Fedora and Enterprise Linux (RHEL / CentOS / Alma / Rocky and other clones) to allow more people to test them. They are available as Software Collections, for a parallel installation, the perfect solution for such tests, and also as base packages.

RPMs of PHP version 8.4.2RC1 are available
- as base packages in the remi-modular-test for Fedora 39-41 and Enterprise Linux ≥ 8
- as SCL in remi-test repository
RPMs of PHP version 8.3.15RC1 are available
- as base packages in the remi-modular-test for Fedora 39-41 and Enterprise Linux ≥ 8
- as SCL in remi-test repository
RPMs of PHP version 8.2.27RC1 are available
- as base packages in the remi-modular-test for Fedora 39-41 and Enterprise Linux ≥ 8
- as SCL in remi-test repository
The packages are available for x86_64 and aarch64.

PHP version 8.1 is now in security mode only, so no more RC will be released.

Installation: follow the wizard instructions.

Announcements:
Parallel installation of version 8.4 as Software Collection:
```
yum --enablerepo=remi-test install php84
```
Parallel installation of version 8.3 as Software Collection:
```
yum --enablerepo=remi-test install php83
```
Parallel installation of version 8.2 as Software Collection:
```
yum --enablerepo=remi-test install php82
```
Update of system version 8.4:
```
dnf module switch-to php:remi-8.4
dnf --enablerepo=remi-modular-test update php\*
```
Update of system version 8.3:
```
dnf module switch-to php:remi-8.3
dnf --enablerepo=remi-modular-test update php\*
```
Update of system version 8.2:
```
dnf module switch-to php:remi-8.2
dnf --enablerepo=remi-modular-test update php\*
```
Notice:
- version 8.4.2RC1 is in Fedora rawhide for QA
- EL-10 packages are built using RHEL-10.0-beta
- EL-9 packages are built using RHEL-9.5
- EL-8 packages are built using RHEL-8.10
- oci8 extension uses the RPM of the Oracle Instant Client version 23.6 on x86_64 or 19.24 on aarch64
- intl extension uses libicu 74.2
- RC version is usually the same as the final version (no change accepted after RC, exception for security fix).
- versions 8.2.27, 8.3.15 and 8.4.2 are planed for December 19th, in 2 weeks.
Software Collections (php82, php83, php84)

Base packages (php)

December 05, 2024

Peter Czanik The syslog-ng Insider 2024-12: FreeBSD audit; 4.8.1; conferences
Dear syslog-ng users,

This is the 126th issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news.

NEWS

FreeBSD audit source for syslog-ng

Two weeks ago, I was at EuroBSDcon and received a feature request for syslog-ng. The user wanted to collect FreeBSD audit logs together with other logs using syslog-ng. Writing a native driver in C is time consuming. However, creating an integration based on the program() source of syslog-ng is not that difficult. This blog shows you the current state of the FreeBSD audit source, how it works, and its limitations. It is also a request for feedback.

https://www.syslog-ng.com/community/b/blog/posts/freebsd-audit-source-for-syslog-ng

Version 4.8.1 of syslog-ng is now available

Version 4.8.1 was released recently. As you could guess from the version number change, it is primarily a bug fix release, but some minor features also slipped in. From this blog, you can learn what changed in syslog-ng 4.8.1 and where you can get its latest stable version.

https://www.syslog-ng.com/community/b/blog/posts/version-4-8-1-of-syslog-ng-is-now-available

Where should I present syslog-ng and sudo?

Recently I was asked the same question both at my workplace and at EuroBSDCon, the conference where I was presenting: where do you talk next? I had no definite answer. Of course, I am looking forward to the FOSDEM CfP, but I am also looking for new conferences to present syslog-ng and sudo. Do you have any recommendations?

https://www.syslog-ng.com/community/b/blog/posts/where-should-i-present-syslog-ng-and-sudo

WEBINARS
- New webinar: “Performance tuning for syslog-ng deployments”. You can register for it at https://www.syslog-ng.com/event/performance-tuning-for-syslog-ng-deployments/
- You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/
Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/

December 04, 2024

Kiwi TCMS Kiwi TCMS 13.7
We're happy to announce Kiwi TCMS version 13.7!

IMPORTANT:

This release includes security related updates, several improvements, API changes, a few bug fixes and new translations.

Recommended upgrade path:
```
13.6 -> 13.7
```
You can explore everything at https://public.tenant.kiwitcms.org!

---
Upstream container images (x86_64):
```
kiwitcms/kiwi   latest  89261439831b    677MB
```
IMPORTANT: version tagged and multi-arch container images are available only to subscribers!
Changes since Kiwi TCMS 13.6
Security
- Update Django from 5.0.9 to 5.0.10, addressing one security issue with severity â€œhighâ€� and one security issue with severity â€œmoderateâ€� which do not appear to affect Kiwi TCMS.
Improvements
- Update bleach from 6.1.0 to 6.2.0
- Update mysqlclient from 2.2.4 to 2.2.6
- Update pygithub from 2.4.0 to 2.5.0
- Update python-gitlab from 4.13.0 to 5.1.0
- Update uwsgi from 2.0.27 to 2.0.28
- Update node_modules/pdfmake from 0.2.14 to 0.2.15
- Speed-up TestCase filtering on the TestPlan view page
- Speed-up TestExecution filtering on TestRun view page
API
- Method Bug.details() will now return the additional fields id, status and url! References Issue #3748
Bug fixes
- Remove internal IssueTrackerType.rpc_cache attribute. Fixes Issue #3757
- Update filtering logic for Automated=False on TestPlan view page. Fixes Issue #3841
- Refresh test execution counter when filtering on TestRun view page
Refactoring and testing
- Update action psf/black from 24.8.0 to 24.10.0
- Update action codecov/codecov-action from 4 to 5
- Update selenium from 4.25.0 to 4.27.1
- Update sphinx from 8.1.1 to 8.1.3
- Update node_modules/webpack from 5.95.0 to 5.97.0
- Update fedora from 40 to 41 in /tests/bugzilla
- Update redmine from 5 to 6 in /tests/redmine
Translations
- New Ukrainian translation (Oleksandr Nemchenko)
Kiwi TCMS Enterprise v13.7-mt
- Based on Kiwi TCMS v13.7
- Add dependency on dict-hash package
- Update django-ses from 4.2.0 to 4.3.0
- Update dj-database-url from 2.2.0 to 2.3.0
- Update certbot from 2.11.0 to 3.0.1
- Update certbot-dns-* plugins from 2.11.0 to 3.0.1
- Update sentry-sdk from 2.16.0 to 2.19.0
Private container images
```
quay.io/kiwitcms/version            13.7 (aarch64)          33ab4247df54    04 Dec 2024     687MB
quay.io/kiwitcms/version            13.7 (x86_64)           ecf66eb23dda    04 Dec 2024     677MB
quay.io/kiwitcms/enterprise         13.7-mt (x86_64)        62d4a283713b    04 Dec 2024     1.06GB
quay.io/kiwitcms/enterprise         13.7-mt (aarch64)       5e9b96dd3e6f    04 Dec 2024     1.08GB
```
IMPORTANT: version tagged, multi-arch and Enterprise container images are available only to subscribers!
How to upgrade

Backup first! Then follow the Upgrading instructions from our documentation.

Happy testing!

---

If you like what we're doing and how Kiwi TCMS supports various communities please help us grow!
- Give â� on GitHub;
- Give ğŸ‘� on GitLab;
- Join our newsletter and follow all project news;
- Become a contributor and an awesome open source hacker;
- Become a subscriber and help us sustain development

Luca Ciavatta Why You Should Get a VPN and How to Install the Best One on Linux

VPN: Essential Tools for Privacy and Security

In today’s digital age, maintaining online privacy and security has become more critical than ever. One of the most effective tools to achieve this is a VPN (Virtual Private Network). This comprehensive guide (You Should Get a VPN) will explore what VPNs are, why they are indispensable for privacy and security, compare some of the most popular VPN services, and conclude by highlighting why Mullvad VPN stands out as the best option considering price and performance. Additionally, we’ll provide a detailed tutorial on how to install Mullvad VPN on Linux openSUSE, even though it’s not officially supported.

What is a VPN?

A VPN is a service that creates a secure, encrypted connection between your device and a remote server. This process hides your IP address, protects your data from hackers and other threats, and allows you to access content that may be restricted based on your geographical location. It’s clear: you should get a VPN.

Mullvad VPN stands out for its strong commitment to privacy, transparent pricing, and high security standards

Why Use a VPN?

Privacy: By masking your IP address, a VPN makes it difficult for websites, advertisers, and even your ISP to track your online activities.
Security: VPNs encrypt your data, making it nearly impossible for cybercriminals to intercept and steal your sensitive information.
Access to Restricted Content: Many streaming services and websites restrict content based on your geographical location. A VPN lets you bypass these restrictions by routing your connection through a server in a different location.
Protection on Public Wi-Fi: Public Wi-Fi networks are often unsecured, making them a prime target for hackers. Using a VPN on these networks protects your data from being intercepted.

Comparing Popular VPNs

Let’s take a look at some of the most popular VPN services on the market and compare their features:

VPN	Price Monthly (USD)	Price Monthly (EUR)	Servers	Privacy	Security	Streaming
NordVPN	$12.99	€12,99	6700	High	High	Excellent
ExpressVPN	$12.99	€12,90	3000	High	High	Excellent
Surfshark	$15.45	€15,45	3200	High	High	Good
Mullvad VPN	$5.00	€5	700	High	High	Good
ProtonVPN	$9.99	€9,99	1500	High	High	Good

Why Mullvad VPN?

When it comes to evaluating VPN services, Mullvad VPN stands out as the best option for several reasons:

Privacy Commitment: Mullvad VPN has a strong commitment to privacy. They do not require an email address or personal information to sign up, and they follow a strict no-logs policy.
Transparent Pricing: Mullvad offers a flat rate of €5 per month ($5.00), without any long-term commitment or promotional pricing.
Open Source Software: Mullvad’s software is open source, meaning anyone can review the code to ensure there are no security vulnerabilities or backdoors.
High Security Standards: Mullvad uses industry-leading encryption standards to protect your data.
Ease of Use: The Mullvad app is user-friendly and easy to set up, even for those who are not tech-savvy.

Installing Mullvad VPN on Linux

The Mullvad VPN app is available via repository servers only for Ubuntu, Debian and Fedora.

You can get full instructions on this page: https://mullvad.net/en/download/vpn/linux

If you use another unsupported distribution based on Ubuntu or Debian that uses systemd then you can try to install it using the manual .deb installation instructions.

Although Mullvad VPN does not officially support openSUSE, you can still install it using the Fedora .rpm package.

Here’s a step-by-step guide:

Download the .rpm package: Go to the Mullvad VPN download page and download the Fedora .rpm package.
Open the terminal: Access your terminal in openSUSE.
Install the necessary library:

sudo zypper in libnotify
Run the installation command: Use the following command to install the package:

sudo rpm -i --nosignature /path/to/mullvad-vpn.rpm

Replace /path/to/mullvad-vpn.rpm with the actual path to the downloaded file.
Launch Mullvad VPN: After installation, you can launch the Mullvad VPN app from your application menu.

In-Depth VPN Comparison

To further understand the strengths and weaknesses of different VPN services, let’s delve deeper into each one:

NordVPN

Privacy and Security: NordVPN is renowned for its robust privacy features, including a strict no-logs policy and advanced security protocols like OpenVPN and IKEv2/IPSec. They also offer a Double VPN feature, which routes your traffic through two different servers for extra security.

Performance: NordVPN boasts over 6,700 servers in 59 countries, providing excellent speed and reliability. Their SmartPlay technology ensures a smooth streaming experience by bypassing geo-restrictions.

User Experience: The NordVPN app is intuitive and easy to use, available on all major platforms. They also offer 24/7 customer support.

Link: https://nordvpn.com/

ExpressVPN

Privacy and Security: ExpressVPN is another top contender with a strict no-logs policy and high-level encryption standards. They use TrustedServer technology, which ensures that their servers run on RAM only, meaning all data is wiped with every reboot.

Performance: With over 3,000 servers in 94 countries, ExpressVPN offers impressive speeds and reliability. Their servers are optimized for streaming, torrenting, and secure browsing.

User Experience: ExpressVPN is known for its user-friendly interface and excellent customer support. They offer a 30-day money-back guarantee, giving users peace of mind when trying out the service.

Link: https://www.expressvpn.com/

Surfshark

Privacy and Security: Surfshark provides a no-logs policy and strong encryption standards. They offer additional features like CleanWeb, which blocks ads, trackers, and malware, and MultiHop, which routes your traffic through multiple countries for extra security.

Performance: Surfshark has over 3,200 servers in 65 countries, providing reliable speeds and performance. Their NoBorders mode ensures that the VPN works in restrictive regions.

User Experience: Surfshark’s app is easy to navigate and available on multiple platforms. They offer 24/7 customer support and a 30-day money-back guarantee.

Link: https://surfshark.com/

ProtonVPN

Privacy and Security: ProtonVPN is developed by the same team behind ProtonMail, known for its commitment to privacy. They follow a strict no-logs policy and use secure core architecture to route traffic through privacy-friendly countries.

Performance: ProtonVPN offers over 1,500 servers in 63 countries. Their speeds are generally good, and they provide unlimited bandwidth on all plans.

User Experience: The ProtonVPN app is user-friendly and available on all major platforms. They offer a free plan with limited features, which is a great way to test the service before committing.

Link: https://protonvpn.com/

Conclusion

When it comes to choosing a VPN, Mullvad VPN stands out for its strong commitment to privacy, transparent pricing, and high security standards. Although it may not have as many servers as some competitors, its focus on user privacy and open-source software make it an excellent choice for those seeking a reliable and trustworthy VPN service.

By following the steps outlined in this guide, you can easily install Mullvad VPN on openSUSE, ensuring your online privacy and security without any hassle. Happy surfing!

The post Why You Should Get a VPN and How to Install the Best One on Linux appeared first on CIALU.NET.

Cockpit Project Cockpit 330
Cockpit is the modern Linux admin interface. We release regularly.

Here are the release notes from Cockpit 330:

Web server: Increased sandboxing, setuid removal, bootc support

Cockpitâ€™s web server already had low privilege levels, but previously used a setuid helper program cockpit-session for user logins. That helper had restricted permissions and was only executable by Cockpit (through group ownership). Its sole purpose was to run at the system level and immediately drop permissions to log in to a specific user account. However, the binary was still setuid, and setuid should be avoided for security reasons.

This release removes the setuid flag from the helper. cockpit-session now starts via systemd socket activation, with the Cockpit web server connecting to it using a protected UNIX socket in the /run directory. This approach enables tighter sandbox security by preventing the login session from being a direct descendant of the web server process. It also fixes Cockpit on bootc images.

All Cockpit components now run as dynamic users created at startup using the DynamicUser= systemd feature. Existing systems may still have a cockpit-ws user (and very old systems might even have associated TLS certificates). However, this cockpit-ws user is no longer required and can be safely deleted.

Development: New install mode using systemd-sysext

To simplify development, a new build tool can install Cockpit as a systemd-sysext (system extension). This enables testing all parts of Cockpit (web server, login page, systemd units, and bridge) directly on the host system, safely and quickly, without modifying the disk or having to use a virtual machine. Installation is temporary in /run/extensions/ and cleared on reboot.

Read the documentation for detailed instructions.

Try it out

Cockpit 330 is available now:

December 03, 2024

Kushal Das Basedpyright and neovim

screenshot from the website

Basedpyright is a fork of pyright with various type checking improvements, improved vscode support and pylance features built into the language server. It has a list of benefits over Pyright.

In case you want to use that inside of neovim using Mason, you will have to remember to have the configuration inside of a settings key. The following is from my setup.

basedpyright = {
  settings = {
    basedpyright = {
      analysis = {
        diagnosticMode = 'openFilesOnly',
        typeCheckingMode = 'basic',
        capabilities = capabilities,
        useLibraryCodeForTypes = true,
        diagnosticSeverityOverrides = {
          autoSearchPaths = true,
          enableTypeIgnoreComments = false,
          reportGeneralTypeIssues = 'none',
          reportArgumentType = 'none',
          reportUnknownMemberType = 'none',
          reportAssignmentType = 'none',
        },
      },
    },
  },
},

Struggled for a few hours to fix this couple of days ago.

December 02, 2024

Felipe Borges Announcement: GNOME will have an Outreachy intern working on librsvg

We are excited to announce that the GNOME Foundation is sponsoring an Outreachy internship for the December-March round!

The intern will work with mentor Federico Mena Quintero on the project, “Implement the SVG2 text layout algorithm in librsvg.”

The intern’s blog will soon be added to Planet GNOME, where you can follow their project updates and learn more about them. Stay tuned!
Kushal Das Bahnhof Bar

A few weeks ago Bahnhof organized an evening to celebrate technology/innovation/freedom, and opened Bahnhof Bar only for the evening. Back in 2005 their office was raided and servers were taken, and the latest TV series, The Pirate Bay on SVT Play already showed that as part of the series.

The evening went too fast, met a lot of new people and a few old friends too. I love Bahnhof's service as Internet provider, but also love how they fight for privacy and freedom.

You can read their blog post about the event too.
Josh Bressers Episode 457 – The D-Link D-bacle
Josh and Kurt talk about a serious D-Link security vulnerability in a bunch of end of life products. The crux of the discussion focuses on D-Link, but the reality is almost all consumer gear you plug into the internet is terrible. And there’s little hope it will get better anytime soon.
https://traffic.libsyn.com/opensourcesecuritypodcast/Episode_457_The_D-Link_D-bacle.mp3
Show Notes

December 01, 2024

Zach Oglesby Harmony

As I was prepare for a work trip last week, I found myself cleaning out my travel bag and stumbled upon a pleasant surprise—notes from my travel notebook. One note, in particular, caught my attention: a reflection from my trip to Japan earlier this year.

During that visit, I had the privilege of exploring Sojiji Temple, one of Japan’s two main Zen Buddhist temples. While there, I witnessed a fascinating ceremony involving a woman doing calligraphy on a large sign. Intrigued but not fully understanding the significance of the event, I stood quietly, observing and listening.

After the ceremony, the event’s MC approached me, likely noticing I was the only foreigner in attendance. She kindly asked if I understood what was happening and then took the time to explain everything in English. To my surprise, she handed me a printed English translation of her script.

One part of it particularly stood out:

Harmony is to be valued, and an avoidance of wanton opposition to be honored. All men are influenced by partisanship, and there are few who are intelligent. Hence there are some who disobey their lords and fathers, or who maintain feuds with the neighboring villages. But when those above are harmonious and those below are friendly, and there is concord in the discussion of business, right views of things spontaneously gain acceptance. Then what is there which cannot be accomplished?

This passage, part of the first article of Prince Shotoku’s 17-Article Constitution, underscores the importance of harmony. The ceremony I witnessed was a commemoration of Prince Shotoku and his dedication to this principle—a value deeply influenced by Buddhism and enshrined in his vision for society.

What struck me then—and resonates even more now—is how deeply the idea of harmony is woven into Japanese culture. Having lived in Japan for three years, I experienced firsthand the kindness, politeness, and respect that permeate daily life. Even when people disagree or dislike one another, they prioritize civility and cooperation. Society functions smoothly because people take their roles seriously, no matter how big or small, understanding that everyone’s efforts are interconnected.

Of course, this cultural emphasis on harmony isn’t without challenges. The pressure to maintain outward politeness can sometimes suppress negative emotions, leading to mental health issues. Still, the overall atmosphere of mutual respect creates a unique and admirable social fabric—one that stands in stark contrast to many places I’ve been.

It’s hard not to reflect on how much the United States could benefit from embracing a similar sense of harmony. We often lose sight of the fact that we function best as a collective, working together with mutual respect. Disagreements—whether political, religious, or otherwise—don’t need to devolve into constant conflict.

To be clear, I’m not advocating for silence in the face of hate or injustice. Those must always be confronted. But as a society, we should strive to make respect and civility our default. Harmony doesn’t mean suppressing our individuality or ignoring our differences. Instead, it’s about finding ways to coexist, recognizing our shared humanity, and working together toward a greater good.

If there’s one lesson I took away from that day at Sojiji Temple, it’s that harmony is not just a lofty ideal—it’s a practical path to a better, more connected world.
Daniel Pocock Gerry ‘The Monk’ Hutch: criminals vs geeks, multinationals vs Ireland

Looking at the statistics for Dublin Central, there are 7,000 more preference transfers to be distributed and Gerry 'the Monk' Hutch has a lead of 800 votes over the candidate in fifth place. If the Monk gets another 300 votes from the transfers, Sherlock, in fifth place, would need another 1,100 votes to overtake and displace the Monk.

A lot of people don't fill in the whole ballot paper so it is not clear if Sherlock can get enough transfers to catch up.

Why did over 3,000 people give their first vote to a criminal but only 27 people gave their first vote to a software engineer who attempts to answer today's most critical questions about social control media's impact on children and the rise of AI? With so many tech workers in Ireland, why didn't they rally around one of their own?

The question about tech worker votes is easier to answer with facts that can be checked. Quite simply, many of the tech workers are not Irish citizens. They are a combination of European citizens and people from Brazil, India and further afield. The European citizens, for example, from Poland or Spain, are entitled to vote in the European elections but they are not entitled to vote in the national elections. Many people from countries like Brazil or India come to Ireland on a student visa to complete a masters degree, they are living in estates like Citywest on the edge of the city and they end up working as contractors for some of the large multinationals. Some of them are employed directly while many are employed as contractors. This makes it much harder to estimate their role in the economy. For various reasons, including the time they lose commuting, the silos created by their employment, their social circles and the neighborhoods where they live, we don't see these people participating in the open source eco-system or other voluntary pursuits.

On the question of people voting for Gerry 'the Monk' Hutch, this was already hinted at in my previous blog. The Monk received an enormous amount of free publicity due to his criminal record. If I speak to friends from France or other countries, they all seem to know that there is a criminal in the Irish election. International awareness of the Monk's history seems to be far higher than awareness that more significant figures, like the leader of Australia's opposition party, is a former detective and the British Prime Minister is a former Director of the Crown Prosecution Service.

For any Irish police (Gardai) who find this infatuation with a gangster unpalatable, Australia has offered them asylum.

Every few hours, the election officials stand up on a stage and give people an update on the progress of vote counting. As the names of the candidates are read out, their supporters cheer. Each time the name "Hutch, Gerard" is announced, there is silence. Despite spending all Saturday afternoon at the count center, I could not identify one person affiliated with the Monk.

While nobody cheers for him, everybody has something to say about it. His strong performance sends a message. The voters' message is not exactly clear but it is disparaging for everybody else in the room. One interpretation of the message is that Irish voters couldn't tell the difference between a politican and a criminal. Perhaps some people are so unhappy that they think a criminal could do better than the status quo. Or maybe the 3,000 people who voted Monk are all about to leave for Australia or the US anyway and this was their idea of a prank.

Whichever interpretation you choose, I had the perception that many people in Ireland's political elite did feel both insulted and undervalued both from the pro-Monk media bias and the voters' verdict. For some of the other candidates, the thought of finishing on only 27 votes like me would have been more bearable than the fact that they polled lower than the 3,000 votes achieved by the Monk.

From the Monk to the poisoned chalice

About a week ago, I wrote my own observations on the likely impact when US multinationals shift their corporation tax back to the US. On Tuesday, an official from the incoming Trump administration confirmed Ireland is a specific target and on Wednesday, two days before voting, the Irish government admitted that even if only three of the top multinationals stop paying Irish tax, the state will lose ten billion euros in revenue.

Candidates spent three weeks on the campaign trail promising to spend money but in reality, they will have to cut expenditures almost immediately. The promises from the campaign, for example, the cross-party support for the Western rail link are still fresh in the minds of voters.

Given the potential tax revenue shortfalls were announced in the week of the vote, I feel this created a war-time voting mentality. When voters face great uncertainty from things far away, like Ukraine, Gaza, Lebanon and Donald Trump, the voters tend to prefer the status quo and the larger parties.

We can see this in practice in various ways: except for the Monk, the campaigns of other high profile independent candidates generally fizzled out at the ballot box. The same logic explains the decimation of the Greens party. The Greens were a member of the previous coalition, having a minister in the ruling government gave them a lot of publicity but now they have lost almost all their seats. The communist party may win more seats than the Greens. When the country-at-war or world-at-war mentality is at the forefront of voters' minds, they may simply see the eco-policies of the Greens as a luxury that can be put on hold for another five years until the next election.

Yet in this particular case, the crisis Ireland faces is a crisis of having all our eggs in one basket with the corporate tax revenues of multinationals from a single country, the USA. The two large center right parties that Ireland votes for have created that situation and they have been complacent in spending the money year in and year out without working to diversify income streams for the state. Gravitating to the large well-known center right parties feels like a contradiction because it is a reward to the parties who created the problem.

Ironically, the same multinationals in the tech sector who have provided this tax revenue pre-Trump are also responsible for the problems of social control media and fake news that have negatively impacted the very same election campaign.

Looking towards the future: tax will be optional, for some

Wouldn't it be nice if tax was optional?

In fact, such situations do arise and they are not necessarily good for the state.

When paying tax is optional, the very large tax payers can exert even more influence. For example, if a multinational has a choice of paying their taxes in one of three countries and all three countries provide a similar tax rate, the multinational may seek to influence each of those countries to 'win' the taxes. As an example, the countries competing for that revenue may be encouraged to become even more dependent on the multinationals by putting all the state IT infrastructure into cloud services provided by the same companies.

A different type of multinational, Philip Morris, has their international headquarters in Vaud, Switzerland. For some years, they chose to optionally pay the church taxes. At some point they simply changed their mind and stopped paying that tax. It was odd to hear church leaders complaining about the loss of revenue from a tobacco company.

If it comes to pass that Gerry Hutch is elected, will we see him lobbying for the legalization and taxation of any other substances on Irish territory?

November 30, 2024

Daniel Pocock Understanding Irish general election 2024 results Dublin Bay South

Counting staff have conducted initial tallies of the ballot papers and these confirm my predictions from the blog post yesterday.

Personally, I'm not in contention to win a place in the Dáil. The big positive outcome for my campaign is the increased interest in my blogs about the adverse impact of social control media and some of the other things that are going wrong at the intersection of technology and society. Unlike last time I ran for public office, it does not look like I finished last again.

Yesterday I commented on one of the minor candidates from the communist-trotskyist PBP. Many people were amused that I frustrated the campaign of a communist. Nonetheless, that was not my intention. My only intention was to demonstrate the hypocrisy of communists using social control media platforms that enrich billionaires in a foreign country. Nonetheless, it is interesting to see that the communist increased her share of the votes from three percent to four percent. At the same time, the Green party vote fell as they were running with a different candidate. In general, the left votes were divided and fighting against each other and none of them appear to be able win a seat. That is a loss for the left as one seat was previously held by the Greens.

Kate O'Connell previously served as a local representative for the party Fine Gael and this time she ran as an independent. The media showed a big interest in her campaign. Her previous status and her media profile haven't helped her attain the number of first preference votes required to be in contention for one of the four seats.

Nonetheless, Kate achieved about 4.5% of the vote and this demonstrates how much harder it was for other independents who have little or no public profile at all.

Many people have commented on my €17,000 electricity bill. This is the type of scandal that is so unusual that it would normally appear in a news report even if there was not an election in progress. The media have known about the bill for a week but chosen not to report on it. This adds to the perception of many people that the media has been very selective in reporting on the existing political parties and not providing any space for new candidates and the issues we raise.

One of the issues people raised with me during the campaign was the status of the Sandymount Baths. Despite Dublin's incredible shoreline, the Baths have been derelict for over 100 years. Coincidentally, many people comment that the same two parties have taken turns to govern Ireland over the same period of 100 years.

The only independent candidate who did get significant media attention for free is the high profile bank robber Gerry Hutch. He is in fourth position after the first tally and this means there is a real possibility that he will win a seat. He could miss out on the seat if the preference transfers from other candidates all work against him to help one of the candidates in fifth or sixth positions to rise up into the fourth position and displace him. If that happens, he may miss out on the seat by a very slim margin. It may come down to just one hundred votes. People who acquired Gerry 'The Monk' Hutch domain names may share some of the responsibility if he misses out on a seat by such a small margin.

The election created a huge interest in my blog posts about inconvenient truths in the days before voting. It is interesting to see that the heightened interest in my blog has continued in the time since the polls closed.
Fedora fans افزایش سرعت دانلود بسته ها در فدورا لینوکس

فدورا از مدیر بسته ی DNF جهت دانلود بسته های نرم افزاری استفاده می کند. مانند هر برنامه ی دیگری می توان DNF را نیز پیکربندی کرد. در این مطلب قصد داریم تا سرعت دانلود بسته های نرم افزاری توسط DNF را افزایش دهیم. فایل پیکربندی DNF در این مسیر قرار دارد: /etc/dnf/dnf.conf ۱. فعال […]
The post افزایش سرعت دانلود بسته ها در فدورا لینوکس first appeared on طرفداران فدورا.
Josef Strzibny Test Driving Rails, 1st edition is released!

I am releasing my third book today. This time about Rails-native testing!

Idea

I am a big fan of Rails defaults and especially those for testing. Minitest and fixtures rock! But all I ever see are posts and books on RSpec. Nothing really wrong with RSpec (well, except 2 things), but I am surprised people don’t embrace the simplicity and performance of Rails default testing stack (less dependencies too!).

Originally the idea for the book was more about somebody else writing it. Time passed and nobody did. There is only one related Minitest book I know of and it’s from 2016. That’s Rails 5 with references to Rails 4. We need more Minitest and fixtures. And I want to apply to my next job and write it, so I decided to do a small part in promoting it.

Writing

The writing started with my summer move to Bangkok. You can say I write more abroad than at home and it’s true. I like to pair writing with good life experiences and have a good time. Writing is already difficult, so you need to make it easier. I would hate myself for hiding in the dark closet and write by force.

I finally tried Gordon Ramsay food in Bangkok (I am big fan of his shows), met Dmytro Krasun from ScreenshotOne, seen Muay Thai fights (with 3 knockouts in one evening, no less), and did some relaxing in Pattaya and Ko Larn with jet skiing and go carting.

The original plan was to finish the book during this time, but of course I didn’t. The good news was that it gave me more time to make it better and get a feedback by Steven R. Baker and other readers, so the book is much better for it!

Foreword

Steven R. Baker wrote a foreword to Test Driving Rails. Steven is a testing legend, author of minitest/mock and RSpec. The whole thing happened by accident on X when Steven got interested in my book. To my surprise Steven defaults to Minitest as well. If you want to know something about RSpec beginnings, you should go read his post History of RSpec. Thanks Steven!

Cover

I bought my first car this year, so there is a similar car on the cover (no money for GTI, tho). I was thinking of including one of the DHH’s cars, but wasn’t sure! Maybe in the next edition. Test Driving Rails [applications] meaning is a reference to test driving cars.

Get it

Get Test Driving Rails today with 20% off at launch with code launch.

November 29, 2024

Daniel Pocock Watching Irish general election 2024 results

As an independent candidate I'm not expecting to get too many votes. Ireland is a country where traditions are very strong and people gravitate to the parties and candidates they grew up with. On top of that, my campaign was subject to distortion and obfuscation in Google search results. I will be happy if I get more than 5 votes but even that is not certain. In the last election, some independent candidates only got 23 votes each.

There is still time for people to go and vote now before the polling stations close.

The candidates with fewer votes are eliminated in earlier rounds of counting. Counting begins at 9am on Saturday, 30 November and the first eliminations will become clear some time around lunchtime.

The most interesting results to look for

One of the hot topics in the news was the candidacy of Gerry 'the Monk' Hutch. Being famous can sometimes be a good thing in elections. The jockey Nina Carberry won a seat in the European Parliament on her first attempt due to her high profile sporting career.

Voters may have sympathy for the Monk after I registered all his most likely domain names, along with those of other candidates. On the other hand, if the Monk misses out on a seat in the DÃ¡il by only a small number of votes, for example, if he is 10 votes below the candidate who takes the final seat, people may attribute the loss to the fact that he could not get those domain names for himself.

Fortunately I know some good hideouts in Australia.

In the movie Mad Max, organized crime gangs ride around on motorcycles and the police unit responsible for catching them is the Main Force Patrol (MFP). The MFP car park in the movie is actually the University of Melbourne's South Lawn Car Park. The adjacent buildings are Electrical Engineering and Law.

Mad Max at University of Melbourne

Win or lose, I'm glad that my campaign prompted some discussions about the role of the Internet and social control media in society.

Please Vote [1] Daniel POCOCK

Vote [1] Daniel POCOCK
Daniel Pocock Brigid Purcell (PBP): generation Z, unteachable children, how will they govern in ten years?

After securing the domain names of some of my rivals in Dublin Bay South, I tried to contact each of them and reassure them that they would not have a big problem getting them at the end of the voting and using them in future.

Elections are a stressful time for everybody and I wanted to demonstrate good sportsmanship and not see rivals losing sleep over this particular issue.

Personally, I used each of the domains to make some political points about social control media and hypocrisy but the domains have no long term value for me. I cancel the auto-renewal on them and 12 months after the registration date, each domain will expire and then whoever acts fastest can register them.

Out of all the rival candidates I contacted, they were all quite happy to find out that they could get a domain name without being blackmailed by anonymous cybersquatters, except for one person who didn't demonstrate any patience whatsoever.

Brigid Purcell, from the socialist-communist PBP went to all her social media accounts to complain about "middle aged men". I'm ignoring everything else in the discussion except that phrase. When a candidate makes a generalization like that it will be noticed by all the other middle-aged men who are deciding how to vote.

Young women from the same background as Brigid get excited and side with her. But those women were going to vote for Brigid anyway. I'm sure she would do a good job of talking about the problems they experience in life but that is only half the job of being an elected representative. What about all the other 70,000 people who live in Dublin Bay South? What Brigid has demonstrated illustrates how generation-Z have been raised in social media silos. Social media silos have not prepared these people for some of the situations they will face in real life. Employers complain about very talented people from generation Z who come to a job interview and do everything correctly up to the point where, out of habit, they take out their mobile phone and start trying to look something up or ask their friends.

I met another woman the same age as Brigid recently. She had graduated as a teacher, worked as a teacher for one year and then quit. She summarized her decision with one word: "unteachable". She mentioned that the children of today are being raised by social media rather than parents.

Older generations of school teachers are saying the same thing. They are quitting, whether it is in Ireland or in Australia. Here is a quote from the Australian case study:

During her time as a relief teacher in 2022, she noticed more boys talking about Andrew Tate in class.

Shaming by either gender is a big factor. Brigid has chosen to give me a put-down in front of her fans without even finding out what I might have to say. Andrew Tate's generalizations about women and Brigid's generalization about middle-aged men feel like opposite sides of the same coin. The problem is not the age or gender, the problem is the manner in which people rush to their social media account to shame somebody they never met.

During my time in student politics, I met many socialist-communists like Brigid so I know that it is unlikely she has any money and I would be wasting my time if I tried to blackmail her. When I contacted her like all the other candidates, I was simply going to give her the domains for free when we meet at the count center on Saturday.

If I sent the domain transfer passwords to a stranger by email there is a big risk they could end up in the hands of her boyfriend or a volunteer. Many women believe they own their domain names right up to the day they break up with their boyfriend. Then they find out that the domain names are managed through a foreign company in the US and there is nothing that they can do. In these situations, where the woman has spent time building a business on the domain name, the now ex-boyfriend really can do some blackmail before handing it over.

Having heard of many cases like this, I always want to do proper due-diligence, for example, to speak to the new owner of a domain in person or by telephone and make sure they understand the value of the domain transfer key at the moment I hand it over. Brigid rushed to judge me based on my age and gender and so she did not gain anything from my prior experience on the topic.

The other group of middle-aged men we need to worry about are the public servants, heads of government departments and agencies who have to come in to Leinster House from time to time and sit in a room with politicians posing tricky questions. Some of the public service bosses are middle-aged women but in general they are middle-aged men. When more people from Generation Z are elected into public office, I really hope they don't make the same mistake as Brigid. If they refuse to talk to people from older generations or if they humiliate public servants in front of their social media fans we can expect a lot of the public servants will quit, just like the school teachers who are quitting today. The Government will have to offer even higher salary packages for replacements to take leadership roles in the public service.

Fact checking

Take a look at the statistics from previous elections. If previous statistics are anything to go by, neither Brigid or I have a very high chance of being elected. In the 2021 by-election, Brigid had less than a thousand votes, about three percent.

Therefore, fighting with each other is rather pointless and a waste of time. Brigid would increase her chance of election if she focused on the issues that differentiate her party from Hazel Chu, the female candidate for the Greens.

She could gain votes by asking other minor candidates to support her as a second preference.

However, other candidates will be afraid to discuss preference-swapping with somebody if they feel that every attempt at negotiation will be leaked on social media.
Kushal Das Amnesty seminar on activism

2 Weeks ago I was down with fever, but as I became better after a few days I managed to attend Amnesty International's Stockholm chapter's event on activism. I had to travel to a different part of Stockholm, which was fun.

The day started with welcome talk and then a new "Palestine Activist Group" presented their work (in both English and Swedish). Then the main opening talk (in Swedish) from a very senior Swedish journalist about history and important dates related to Palestine. I managed to understand 50-60% of the words. Still a lot of learn.

During the break I had longer chats about privacy, data and our lives. It was good to find folks who knows/uses Python/Fedora/Debian/Ubuntu and other Open Source tools in their daily lives, sometimes even without knowing.

After the morning break, I attended a workshop about being an activist. It was filled with discussions, and of course a lot of new words in Swedish for me. But, the delivery of the workshop was good, people talked about what they think about being an individual activist and things to consider etc.

Next day I had a workshop for a selected group, about boycotting large services and how to providing least amount data to preserve our privacy. The group consisted people from various parts of Swedish society, people working in other government agencies and large multinational companies.

We talked about metadata and phones provide both metadata and real data to the various services via apps. Explaining people to imagine that every time they get out of home, there are many humans walking with them to every destination, keeping notes of every place visit, and every chats they are having with another person or about groups, and then later selling that information to other businesses. It is one thing to talk about these, but it is complete opposite to show. So, I showed them live how much our phones/computers talk. I had my old Pixel4a configured with GrapheneOS, and one of the participant connected their regular Pixel phone to the same VPN. And people seemed to be offended by seeing the amount of data flowing, even when the phone is not use. The below is a screenshot I took today morning from the same demo setup.

We also talked about various chatting platforms, I already built another system to teach kids about how various social chatting platforms work. It was a perfect tool for this demo. We discussed about various other technologies in our daily lives and how they affect privacy.

November 28, 2024

Daniel Pocock Why you should follow my RSS or Atom feed, Irish elections, everybody wins

When it comes to politics, the journey is important too, even if the outcome is unpredictable and sometimes utterly dismal.

The campaign has served its purpose already though. We have fresh evidence about censorship. People have been taking screenshots of the Google search results. You can't look at these search results and not feel that they have been hand-crafted by somebody who resents the prospect of people voting for me.

The word "ELIMINATED" has appeared in capital letters high in the search results, but that actually refers to the process of eliminating candidates one-by-one during counting in the last elections. No candidates have been eliminated in this election.

One of the main highlights of this campaign was the distribution of a leaflet to every home in the region. Forty thousand households received the leaflet. Several people have spoken to me about electricity bills but not one has a bill as big as mine, â‚¬17,000.

Regardless of whether I win or lose, in the next few days I'm going to publish fresh details about the secret expulsions in GNOME Foundation and more about the social engineering attacks in Debian, especially the cases where some kind of privilege escalation has been successful.

To make sure you don't miss key stories like this, if you want to bypass the social media filtering and advertising, please use an RSS or Atom feed reader to follow blogs like this.

Vote [1] Daniel POCOCK

If you care about democracy, don't let yourself be fooled by Google and the lawyerstalking.

Please Vote [1] Daniel POCOCK

Vote [1] Daniel POCOCK
not Gerry 'The Monk' Hutch 8GB Swiss Archive offered to Irish voters by Dáil candidate

Swiss women Pascale Koster and Albane de Ziegler at law firm Walder Wyss signed a document demanding that an open source software volunteer publish self-deprecating insults on his blog. Moreover, the rude women made this demand after the volunteer's father died. Mr Pocock doesn't take orders from cyberbullies like that. Instead of publishing the insults they wrote for him, he is publishing an 8GB archive from Switzerland for Irish voters to consider as they go to the polls tomorrow. The link is below.

By way of background, the volunteer Daniel Pocock is a highly respected Debian Developer. In 2017, on the anniversary of the Easter rising, the Free Software Fellowship elected Mr Pocock as their representative. Yet a subgroup of German and Swiss fellows became incredibly frustrated with Mr Pocock's success and attack him ever since then.

Mr Pocock made a number of blog posts exposing corruption and modern slavery when multinationals penetrate volunteer communities.

Two judicial processes have found that Mr Pocock and his family were victims of harassment. The Zurich black cat trial in 2018 gave Mr Pocock's family CHF 10,000 (equivalent to EUR 10,000) and the WeMakeFedora dispute in 2022 found Mr Pocock was a victim of harassment.

The multinationals failed to listen to these verdicts and keep throwing more and more money at corrupt lawyers and judges to attack volunteers.

Mr Pocock simply started writing blogs about the corrupt lawyers and judges, the Swiss JuristGate affair.

The racist lawyers Pascale Koster and Albane de Ziegler signed this document insisting that Mr Pocock publish self-deprecating insults after his father died. Instead, he is publishing the 8GB archive.

If people have concerns about what is in this 8GB archive, ask the racist Swiss women why they are lawyerstalking a volunteer after the death of his father.

Access the 8GB archive using IPFS

IPFS was used to share information about the referendum in Catalonia and it is being used again today to support Irish democracy.

Please download the IPFS Desktop software.

For background information about the IPFS peer-to-peer network please see the InterPlanetary File System (IPFS) page on Wikipedia.

After installing the IPFS desktop, simply cut and paste or click the Content ID (CID) to access the 8GB archive from Switzerland.

Click to Download 8GB Swiss_Archive.7z (encrypted) with IPFS Desktop

Content ID: [ QmastD22PqBw6m2Q3VHiyKP5DCnijPURjudeWg8guBvJKi ] (to copy and paste into IPFS Desktop)

Inside the IPFS desktop software, right click the folder and select the option to Pin important file-sharing content like this so that it is forced to keep a local copy on your hard disk even when you are offline.

Release of the encryption key on 5 December 2024

If you want this to happen, please Vote [1] Daniel POCOCK

If the Irish people choose to elect Mr Pocock to the DÃ¡il, Mr Pocock will release the encryption key for the 8GB Swiss Archive on International Volunteer Day, 5 December 2024.

The opening of the archive, like the opening of a Christmas present, will be celebrated with ceremonies around Ireland and around the world. If you would like to organize an event in a local pub, community center or campus environment, please promote your event using whichever online platforms you prefer and use the words Debian Swiss Archive in the title of your event. People can use these keywords to search for events nearby.

Googlists undermining Mr Pocock's campaign

Google search results are wrongly suggesting that Mr Pocock was eliminated. In fact, no candidates have been eliminated. This is more proof that multinationals are interfering in our democracy.

If you care about democracy, don't let yourself be fooled by Google and the lawyerstalking. Please Vote [1] Daniel POCOCK

Respect for volunteers

Mr Pocock has been doing voluntary work with amateur radio and free, open source software since he was 14 years old. Sinister people on social media who try to steal the reputation of a volunteer are stealing that person's life. Their gossip campaigns, theft of reputations are far worse than the sinister men who steal money from banks. Here is the certificate from Mr Pocock's amateur radio license, he started doing voluntary work when he was 14.

Vote [1] Daniel POCOCK

Please remember to discuss the Pocock campaign with your friends and promote it widely.

Mr Pocock's nomination page gives a lot of detail about his policies, unique skills and experience so you are voting for a lot more than what is hidden in this 8GB Swiss Archive.

Vote [1] Daniel POCOCK

Vote [1] Daniel POCOCK

November 27, 2024

Peter Czanik Syslog-ng Prometheus exporter added to RPM syslog-ng container image
Last week I introduced you to my latest project: a syslog-ng container based on Alma Linux. This week I added a syslog-ng Prometheus exporter to the container, so you can also monitor syslog-ng, if you enable it.

Before you begin

The syslog-ng Prometheus exporter is a few lines of Python script, so it does not increase the size of the container in a noticeable way. All its dependencies are already included in the container. If you downloaded the container image earlier, you should download it again.

Enabling the Prometheus exporter

As not everyone is using Prometheus, the syslog-ng Prometheus exporter is not started automatically together with syslog-ng, so you have to enable and start it yourself. Note that you must also add “-p 9577:9577” to the command line to make the syslog-ng Prometheus exporter reachable over the network. In the commands below, I named the container “sng” to make it easier to work with. The first command starts the container, while the other two enable and start the syslog-ng Prometheus exporter.
```
docker run -d --name=sng -v /data/log/:/var/log:Z -p 514:514 -p 9577:9577 czanik/syslog-ng:alma9_481
docker exec -ti sng systemctl enable sngexporter
docker exec -ti sng systemctl start sngexporter
```
From now on, the syslog-ng Prometheus exporter will start automatically within the container.

What is next?

Read the syslog-ng Prometheus exporter README on how to configure it: https://github.com/czanik/sngexporter/ In an ideal case, you do not have to change anything, just use it as is from Prometheus.

-

If you have questions or comments related to syslog-ng, do not hesitate to contact us. You can reach us by email or even chat with us. For a list of possibilities, check our GitHub page under the “Community” section at https://github.com/syslog-ng/syslog-ng. On Twitter, I am available as @PCzanik, on Mastodon as @Pczanik@fosstodon.org.
Felipe Borges GNOME Settings 47 Retrospective

While cutting the 47.2 release earlier today, I couldnâ€™t help but reflect on everything weâ€™ve accomplished this cycle. But instead of just listing code changes, I want to use this opportunity to give credit where itâ€™s due, because to me, software is about people!

Much of what we have achieved this cycle is thanks to the dedication of passionate volunteer contributors such as Matthijs Velsink, Automeris Naranja, Hari Rana, Alice Mikhaylenko, Andy Holmes, Adrian Vovk, Corey Berla, Joan Torres, Joshua, Adrien Plazas, Jamie Murphy, and many others. I’m also deeply gratefulÂ to the translation teams for making GNOME accessible in so many different languages.

The GNOME Design team has been invaluable throughout this cycle. A big thank you to Allan Day, Jakub Steiner, Sam Hewitt, and Jamie Gravendeel, for their essential contributions.

Special thanks to Matthijs Velsink for taking on the challenging role of co-maintaining Settings with me. I couldnâ€™t manage it without Matthijsâ€™ outstanding contributions to fixes, features, and reviews. Weâ€™re lucky to have him as part of the project.

Release 47 holds extra significance for me. Wearing my downstream hat, I can share (itâ€™s no secret) that the upcoming RHEL 10 Workstation will primarily feature GNOME 47 components. Building a solid upstream foundation for this version has been one of my top priorities, and Iâ€™m happy with the results.

Thanks to the evolution of libadwaita, weâ€™ve been able to port many of our custom widgets to modern libadwaita ones. This transition enhances consistency across the desktop, improves accessibility, and ensures better responsiveness on screens of various sizes. A big shoutout to the incredible folks working on libadwaita for making this possible!

With Libadwaita we added Accent Color settings, allowing customizing our default blue accent color throughout the GNOME app ecosystem. Personally, Iâ€™ve been rocking the purple accent color on my desktop.

We also revisited the interface for adding local and enterprise user accounts, improving it with libadwaita widgets, a new password and username feedback widget, and addressing some technical debt along the way. Speaking of interface modernization, weâ€™ve also revamped several UIs in the Printing settings.

Over time, some of our UIs have evolved at different paces, often leaving us with interfaces in transitional states and UX inconsistencies. A common example was nested dialogs, where a button within a dialog could open yet another dialog. To address this, many top-level dialogs have been converted into subpages using libadwaita’s AdwNavigationView, resulting in a smoother browsing experience.

We continually refine the settings texts and descriptions to align more closely with the GNOME Human Interface Guidelines. Many settings have also been reworded to improve clarity and discoverability too.

Thereâ€™s so much more that happened this cycle, including a lot of performance improvements, bug fixes, and various tweaks. You can find more changes listed on the ‘Version History’ dialog in GNOME Software.

Weâ€™re always looking for contributors, and there are many ways you can help improve GNOME Settings. Visit apps.gnome.org/Settings to learn how to get started.

November 26, 2024

Swiss JuristGate GCHQ puzzles & FINMA Swiss secrets solved by the Irish

Each year the British spies at GCHQ share a puzzle in a Christmas card.

In 2016, an Irishman called David McBryan found the solution to the British puzzle.

In Septmeber 2023, FINMA, the Swiss financial regulator, published a dossier about the JuristGate affair. They redacted the names of the enterprises. They redacted the dates in the dossier.

When Gaelle Jeanmonod published the document, she wrote "PTP" in the filename:

The CLB used the acronym "PTP" in their filename too.

Daniel Pocock, Irish-Swiss-Australian found the link between the dossier and the JuristGate scandal. He published the first detailed blog about the scandal.
Swiss JuristGate Conférence latine des Batonniers warned lawyers in Cantonal bar associations FR, BE, GE, JU, NE, TI, VD and VS

We found a document in the Wayback Machine.

According to the file, Julie Krattinger (ODA VD) created the document 28 april 2021.

She wrote the acronym "PTP" in the filename. Parreaux, Thiébaud & Partners = PTP

Nicolas Gillard, President of the Conférence latine des Batonniers signed the document.

The bar association of Canton Geneva published the document on their web site and then it disappeared. Why?

We found the proof thanks to the Wayback Machine.

After several years of free publicity in the French side of Switzerland (Romandy), the name of Parreaux, Thiébaud & Partners was well known in the region of Romandy.

Communication to members of bar associations

To all members of cantonal bar associations in FR, BE, GE, JU, NE, TI, VD et VS

Parreaux, Thiébaud & Partners

Dear sisters, Dear brothers,

Various members of the bar associations have contacted us because of the company Parreaux, Thiébaud & Partners and informed us that said company has approached them.

The Geneva Bar Association has already taken legal action against this company.

Parreaux, Thiébaud & Partners presents itself as a law firm, claiming to be a “law firm”. It is not a law firm. This company also claims to be “the best legal protection in Switzerland”. It is not legal protection insurance and this company is not on the list of insurance companies authorised by FINMA.

We would like to draw your attention to the fact that a partnership with a company giving the appearance that the lawyer is practising as such within it may pose problems with regard to the duty of structural independence within the meaning of Art. 8 para. 1 let. d LLCA (ATF 145 II 229 c. 6). Furthermore, partnering with a company that advertises beyond objective facts, in order to indirectly benefit from this advertising, could also pose problems with regard to professional rules (art. 12 let. d LLCA).

For these reasons, we therefore recommend that you do not respond to requests from Parreaux, Thiébaud & Partners.

With lawyerly hugs and kisses,

For the Conférence latine des Bâtonniers

November 25, 2024

Michael McGrath Cybertorture in Ireland and the European Union

In February 2020, The Guardian reported on work undertaken by Prof Nils Melzer, United Nations Special Rapporteur on Torture and Other Cruel, Inhuman or Degrading Treatment or Punishment concerning the subject of Cybertorture.

People were quick to prove the phenomena is real by creating fake web sites to mock the term cybertorture.

Mr Pocock, on the other hand, began meticulously researching the evidence in distributed online communities, such as the open source developer community creating the Debian GNU/Linux software. Mr Pocock has created a detailed index of the incidents in the high-stress Debianist environment.

Based on this research, Mr Pocock is creating a series of blog posts to explore the cybertorture phenomena in general terms.

Mr Pocock elaborates on the experience his family suffered:

Carla began cutting herself and suffered from an eating disorder at the age of 14 years.

A significant percentage of women with these challenges have been victims of harassment or abuse during adolescence.

In 2018, rogue participants in the Debian ecosystem began spreading rumors of harassment and abuse around our family. Neither of us consented to those public references to harassment and abuse.

They have clearly taken something that would be very painful for any family and twisted it inside out to cause extreme distress.

Some of these Debianist cyberbullies engage in these attacks for sadistic pleasure. Other members of the group do this for political reasons.

The evidence is clear, they wanted to block my candidacy in the election of the Debian Project Leader so they had to make up a story that sounded really horrible. The online lynch mobs followed the gossip blindly. There is no collective conscience in groups like this. It is like gang rape with words.

Given the nature of such problems that traverse multiple family members, it is impossible for the victims of these gossip campaigns to defend ourselves publicly without also compromising the privacy of family members. Effectively, by creating malicious gossip about harassment and paying dishonest and racist women to sook, they are blackmailing me to reveal that Carla suffers from this since adolescence.

The evidence shows that Google has knowingly funded groups that behave like this and Google employees are active in the vendettas.

In the UK, which has left the European Union, the parliament at Westminster described these people as digital gangsters. The Irish Times poses the question: "Are Digital Gangsters damaging Ireland Inc's reputation?". Clearly, they damage the reputations of anybody who refuses to roll over for them.
Michael McGrath JuristGate: illegal cross-border legal insurance from Switzerland

Between 2018 and 2023, Swiss jurists in Geneva promoted a legal expenses insurance scheme to residents of both Switzerland and France.

Switzerland is not an EU member and does not have passporting rights for the sale of legal expenses insurance into EU countries like France.

Daniel Pocock, an Irish-Swiss-Australian citizen, wrote a very detailed blog post about the affair in October 2023.

Mr Pocock subsequently commenced the JuristGate.com web site where he is analyzing each detail of the scheme with evidence.

Customers who purchased the insurance have been victims of miscarriages of justice. The Swiss regulator FINMA has hidden details from the customers. Customers may be at risk of suicide and other adverse consequences.

Rogue Swiss tribunals, plagued by nepotism and politics, as proven by Mr Pocock's evidence, have tarnished the reputations of workers and freelancers and then dumped them into EU countries. Is that what the Freedom of Movement program intended?
Bodhi 8.3.0
Released on 2024-11-25.
This is a feature release that re-adds the distinction between min_karma and critpath.min_karma settings.

Features
- Bodhi now allows setting the min_karma threshold for critical path and non-critical path updates separately (#5802).
- bcd has a new clean subcommand to completely refresh the bcd environment (#5804).
- WebUI: the update page now reports both the autopush settings and the minimum threshold for the manual push (#5805).
- The Release properties min_karma, critpath_min_karma, mandatory_days_in_testing and critpath_mandatory_days_in_testing are now expossed in JSON replies from bodhi-server and can be viewed in bodhi-client through the release requirements command (#5807).
Bug fixes
- Bodhi documentation on RTD was missing some content generated by external scripts (#5789).
- When editing an update from APIs it is no more required to specify the old bug ids list in sent data if no change is required (#5800).
Development improvements
- A deprecation warning is now emitted when a value for karma_critpath is set in a comment (#5796).
Contributors

The following developers contributed to this release of Bodhi:
- Adam Williamson
- Mattia Verga
Ankur Sinha "FranciscoD" Accessing UCL VPN using OpenConnect on Linux systems
I needed to use the UCL VPN again, on my Fedora/Linux machine. Linux isn't really supported by the university infrastructure, but there are instructions that others have come up with and they had worked for me the last time I'd needed VPN access. Unfortunately, that was a few years ago, and things have changed a little since then. Notably, UCL has introduced two factor authentication (2FA).

I had to look around a little but I did manage to get it to work again using NetworkManager. I thought I'd write it up quickly so everyone that needs it, including future me, have a quick reference to look at.

This is on Fedora 41 with the following OpenConnect packages:
```
$ rpm -qa \*openconnect\*
openconnect-9.12-6.fc41.x86_64
NetworkManager-openconnect-1.2.10-6.fc41.x86_64
NetworkManager-openconnect-gnome-1.2.10-6.fc41.x86_64
```
In NetworkManager one needs to create a new VPN connection with the following settings:

Here are the settings in a list too:
- VPN Protocol: Cisco AnyConnect or OpenConnect
- Gateway: vpn.ucl.ac.uk
- User Agent: AnyConnect
- CA Certificate: <None>
- Proxy: <leave blank>
- Allow security scanner trojan (CSD): Yes (checked)
- Trojan (CSD) wrapper script: /usr/libexec/openconnect/csd-post.sh
- Reported OS: Windows 10 (I didn't try another)
- Machine certificate: <None>
- Machine private key: <will be greyed out>
- User certification: <None>
- User private key: <will be greyed out>
- Use FSID for key passphrase: No (unchecked)
- Prevent user from manually accepting invalid credentials: No (unchecked)
- Token mode: TOTP - manually entered
This is similar to what had worked before. What changed:
- It didn't work without setting the User Agent to "AnyConnect"
- I set the token mode to "TOTP - manually entered"
This opens up a web login page where one can enter their credentials.
Josh Bressers Episode 456 – What if XZ happened to a company? The openness of open source
Josh and Kurt embark on a thought experiment to discuss how a commercial entity would handle something like the xz incident. It was very specific and difficult to understand. It’s easy to claim just because source code being available doesn’t matter. But the reality is when source code is needed, it can make a huge difference for everyone working together, just like we saw with xz.
https://traffic.libsyn.com/opensourcesecuritypodcast/Episode_456_What_if_XZ_happened_to_a_company_The_openness_of_open_source.mp3
Show Notes
- Lindt admits chocolate may not be ‘expertly crafted’ in class-action lawsuit battle
- Mitchell & Webb – Needlessly ambiguous terms
Josef Strzibny Using non-root users in Kamal
Kamal gives us an option to connect with a non-root user, but how can we create it?

Creating a non-root user

If you use cloud VM providers like Hetzner or Digital Ocean, your virtual private server with likely come with root only. And Kamal unfortunately cannot create additional users automatically.

To change root to our own user, we can take advantage of the SSH key of the root user and use it to set up a new user. We can do that with a provisioning tool, script, or issuing the following commands after logging in to the server:
```
$ ssh root@public-ip
```
As a first step, we create the user itself with a home directory where we’ll install the SSH keys:
```
useradd --create-home username
usermod -s /bin/bash username
```
We also select a default shell (here bash) which will make the future connections more comfortable.

Then we can create the ~/.ssh/authorized_keys file and move the already existing root key (installed by our cloud provider). If we do that using the just created user (using su) we’ll get the right ownership:
```
su - username -c 'mkdir -p ~/.ssh'
su - username -c 'touch ~/.ssh/authorized_keys'
cat /root/.ssh/authorized_keys >> /home/username/.ssh/authorized_keys
chmod 700 /home/username/.ssh
chmod 600 /home/username/.ssh/authorized_keys
```
At the end we are finishing it up by setting the expected access rights (only read and write for this user).

Finally, we need to ensure that we can still make all the administrative tasks on the servers. So we make the user to be able get root privileges with sudo and make him part of docker group:
```
echo 'username ALL=(ALL:ALL) NOPASSWD: ALL' | tee /etc/sudoers.d/username
chmod 0440 /etc/sudoers.d/username
visudo -c -f /etc/sudoers.d/username
usermod -aG docker username
```
Note that this configuration really make the user as powerful as root. You could also directly limit the actions in the /etc/sudoers.d/username file for finer control.

The steps mentioned can be used in Ubuntu 22 and 24, and likely many other systems.

Kamal config

Changing the SSH user in Kamal simple. Providing the user under the ssh setting will make Kamal always connect with this user from now on:
```
# config/deploy.yml

ssh:
  user: username
```
Implications

While changing the user is simple, it still comes from some implications. Since Kamal doesn’t know anything about issuing commands with sudo, Kamal won’t be able to cleanly remove directories that don’t have write access for this specific users.

This can happen when creating a PostgreSQL directory which ends up using its own user as the owner:
```
sudo ls /home/username/app-postgres -all
drwx------ 19        999 username 4096 Oct 11 14:06 data
```
Now it isn’t a real problem per-se, but kamal remove will now fail trying to delete the directory.

To fix issues like this we need to create these kind of directories with write and execute bits for the user beforehand. Adding them for the group here would make this work.

Disabling root

Once the configuration works as expected, we might want to disable the root login altogether.

To do that we need to change the PermitRootLogin SSH daemon configuration and restart the service:
```
sed -i 's@PasswordAuthentication yes@PasswordAuthentication no@g' /etc/ssh/sshd_config;
sed -i 's@PermitRootLogin yes@PermitRootLogin no@g' /etc/ssh/sshd_config;
systemctl restart ssh
```
I am also disabling password authentication while I am at it. We should use only SSH keys.

November 23, 2024

Adam Young Adding stable to a blobless clone

We regularly sync various git repos from upstream to our company speicfic Linux repository. However, sometimes when working on a development machine, I need a branch from stable that we have not synced yet. If I did a blobless clone from our repository, doing a fetch from stable is going to pull over lots of blobs that I do not need.

Instead, I want to fetch just a specific tag. I can do this by adding the tag to the fetch command, and it will pull over only those blobs

For example, 6.12.1 is the most recent stable as of the time of this writing. I cloned our repo using

time git clone   --filter=blob:none  --no-checkout    git@gitlab.com:$COMPANY/linux/linux.git
linux.git
Cloning into 'linux'...
remote: Enumerating objects: 7897467, done.
remote: Counting objects: 100% (7897467/7897467), done.
remote: Compressing objects: 100% (1588677/1588677), done.
remote: Total 7897467 (delta 6255066), reused 7896568 (delta 6254179), pack-reused 0 (from 0)
Receiving objects: 100% (7897467/7897467), 1.34 GiB | 21.69 MiB/s, done.
Resolving deltas: 100% (6255066/6255066), done.

real	1m54.141s
user	2m35.017s
sys	1m32.279s

git tag --list  | grep v6.12

v6.12
v6.12-rc1
v6.12-rc2
v6.12-rc3
v6.12-rc4
v6.12-rc5
v6.12-rc6
v6.12-rc7

And found that we did not have the 6.12.1 tag yet. So…

git remote add stable https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
time git fetch stable v6.12.1

This is what gets pulled over. It takes a little time, but that is to be expected:

Receiving objects: 100% (54243/54243), 415.91 MiB | 7.64 MiB/s, done.
Resolving deltas: 100% (8884/8884), done.
Resolving deltas: 100% (1724442/1724442), completed with 68857 local objects.

If I go to another machine with a clean git repo and count the files:

find . -print | wc -l
90556

1724442 Blobs feels high. The Linux Kernel, as it is a big chunk of code. I suspect we are getting more than just the files required for the v6.12.1 tag

If I fetched without the –tags option would have gotten the reference that the tag points to, but not the tag.


$ time git fetch stable v6.12.1
remote: Enumerating objects: 19, done.
remote: Counting objects: 100% (9/9), done.
remote: Compressing objects: 100% (2/2), done.
remote: Total 19 (delta 7), reused 7 (delta 7), pack-reused 10
remote: Enumerating objects: 1, done.
remote: Counting objects: 100% (1/1), done.
remote: Total 1 (delta 0), reused 0 (delta 0), pack-reused 0 (from 0)
Receiving objects: 100% (1/1), 17.94 KiB | 17.94 MiB/s, done.
remote: Enumerating objects: 1, done.
remote: Counting objects: 100% (1/1), done.
remote: Total 1 (delta 0), reused 0 (delta 0), pack-reused 0 (from 0)
Receiving objects: 100% (1/1), 20.47 KiB | 20.47 MiB/s, done.
Unpacking objects: 100% (19/19), 27.23 KiB | 8.00 KiB/s, done.
From https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux
 * tag                         v6.12.1    -> FETCH_HEAD

real	2m34.559s
user	2m27.936s
sys	0m1.391s

19 Objects came over…not quite sure what they were.

One thing that did not come over was the tag itself. However, I can check out the associated reference using:

git checkout FETCH_HEAD

This is where you pay the priced for the blobless checkout: It fetches all the blobs it needs for this branch:

time git checkout FETCH_HEAD
remote: Enumerating objects: 86108, done.
remote: Counting objects: 100% (86108/86108), done.
remote: Compressing objects: 100% (81761/81761), done.
remote: Total 86108 (delta 4618), reused 28829 (delta 3950), pack-reused 0 (from 0)
Receiving objects: 100% (86108/86108), 251.39 MiB | 9.82 MiB/s, done.
Resolving deltas: 100% (4618/4618), done.
Updating files: 100% (86680/86680), done.
Note: switching to 'FETCH_HEAD'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:

  git switch -c <new-branch-name>

Or undo this operation with:

  git switch -

Turn off this advice by setting config variable advice.detached Head to false

HEAD is now at d390303b28da Linux 6.12.1

real	1m3.333s
user	0m23.439s
sys	0m4.452s

I can now save this as a branch. Yeah, I don’t use switch…too many years doing it this way”

git checkout -b defconfig

This is faster approach than checking out the full main repository plus fetching and syncing the stable trees. The over all time was ~5 1/2 minutes. There is obviously a heavier cognative load when adding the additional switches, and there will be time consequences if I need to do additional git operations.

November 22, 2024

not Gerry 'The Monk' Hutch Who snatched GerryHutch.com, GerryHutch.ie & TheMonk.ie?

When Gerry Hutch released his video this week, he wasn't able to publish it on a web site bearing his own domain name. These names were all proactively registered by Daniel Pocock, a candidate for Dublin Bay South who has worked as a consultant for a number of banks. Pocock wants to promote the work of HUTCH Hussein, who is a leading figure in Australian politics.

The domain names / web sites concerned are GerryHutch.com, GerryHutch.ie, GerardHutch.com, GerardHutch.ie and TheMonk.ie. TheMonk.com was already taken by a business in another country.

Oddly enough, Mr Pocock has also collected the domain name AlanShatter.com, the high-profile independent Alan Shatter who formerly served as Minister for Defence and Minister for Justice. Will we see a class action law suit in the UDRP where Ireland's most notorious criminal teams up with a former justice minister to get their respective names back?

Daniel Pocock is a Debian Developer. What is a Debian Developer?

The Monk started his career doing jumpovers, robbing banks and stores by jumping over the counter. Mr Pocock has run steeplechases in athletics.

Mr Hutch arrived at the office of the returning officer on a scooter. Daniel Pocock arrived the next day on a BMW Motorrad F800 GT and parked in the same place:

The frugal lifestyle helped Mr Hutch gain the nickname Monk.

Nobody is more concerned with the safety and security of Dublin's citizens than Mr Pocock.

In this section of an interview with Ali Bracken from the Independent, the Monk talks about cleaning up Dublin and they finish with a comment about Donald Trump:

Daniel Pocock is sincere about cleaning up Dublin. He was in the middle of the Dublin riots of November 2023 and he posted a detailed report with photos. Today, he goes one step further publishing videos. This was recorded in Parliament Street. We can see the riot police advancing south towards the Dublin Castle, reclaiming sections of the city fifty meters at a time and putting out spot fires as they proceed.

Here is another video:

Similarities between murder of David Byrne and the GNOME Foundation attack on Sonny Piers

The wikipedia page about David Byrne tells us the following:

At the weigh-in there was an organised armed attack; the match was cancelled after the shooting. There were at least four attackers with masks, army-style helmets and flak jackets, two of whom were disguised as members of the Garda Emergency Response Unit and armed with AK-47 assault rifles. An associate of the Kinahan cartel, David Byrne (34) was shot dead; security sources said that the gang had intended to kill others.

Earlier this year, some masked employees of the GNOME Foundation created an anonymous account in the GNOME Foundation Discourse forum and used it to anonymously post a character assassin hit on Sonny Piers, an elected volunteer. The kill:

The GNOME Foundation Board voted to remove Sonny Piers as a member of the Board of Directors for cause, at a Special Meeting on May 17th, 2024, following the procedure outlined in the GNOME Bylaws, and remove him from all committees. Effective May 25th, 2024, his seat is now vacant, and in accordance with the Bylaws will be filled for the remainder of its term by an appointment made by the Board.

A Code of Conduct complaint was also made against Sonny Piers. The Foundation is engaged in a mediation process with him, which is still ongoing and so we are unable to share more information at this time.

The assassins disguised as members of the Garda Emergency Response Unit remind us of people in free / open source software organizations who give themselves big titles, pretending to be police so they can denounce their political rivals.

We can see that Gerry 'The Monk' Hutch had a very public trial by jury. Sonny Piers was subject to a secret trial, with secret evidence for secret crimes. In Debian, we've seen people can be punished like this simply for using a word like "wayward".

The Universal Declaration of Human Rights, point 1 tells us that everybody is equal. Why do some people get such extraordinary punishments for using the wrong word but Ireland's most notorious criminal can run for the DÃ¡il?

Social control media companies have been described as digital gangsters. The Irish Times poses the question:

Are 'digital gangsters' damaging Ireland Inc's reputation?

Daniel Pocock believes in equality. If elected, he will show equal concern about traditional Irish gangstering and digital gangstering.

Here is that video of Daniel Pocock at the United Nations Forum on Business and Human Rights, it is recorded in 2018 and he correctly anticipated the risk of somebody like Elon Musk taking over Twitter:

Garda have suggested people ask the Monk where he got the funds to pay for his campaign. Pocock admits getting his first file server from a Cardinal.

Garda have been watching the Monk since he was ten years old. Pocock used to row every morning with one of the most distinguished members of Victoria Police sitting in the seat behind him and watching his every move:

Vote [1] Daniel POCOCK

Voters have a choice. If you would like to vote for a professional who can think about the things that mainstream candidates overlook Vote [1] DANIEL POCOCK and remember to follow Daniel Pocock's blog at DanielPOCOCK.com

Vote [1] Daniel POCOCK
Gerry 'The Monk' Hutch The Hutch: there can be only one

Luke "Ming" Flanagan is one of Ireland's most successful independent candidates ever. Ming regularly shares advice with those who want to follow in his footsteps. He recently told The Irish Times:

‘The one thing you’ve got to do is be remembered in politics’

When news reports appeared about Gerry Hutch, a.k.a. The Monk entering politics, Daniel Pocock, candidate for Dublin Bay South remembered his old friend Hutch Hussein, formerly President of the Victorian state branch of the Australian Labor Party.

Is there room for two Hutches in the world of politics?

Putting it in the context of Ming's advice, Hutch's wikipedia entry captures the things Hutch Hussein is remembered for:

Hatice "Hutch" Hussein is an Australian feminist, activist, and social worker. She served as the elected State President of the Victorian branch of the Australian Labor Party (ALP) between 2016 and 2019. Upon taking this role, she became the first President in the party's 125-year history to be from an ethnic minority background, from a Muslim background, and from the LGBT community.

Another wikipedia page reminds us that the Hutch-Kinahan feud is an "ongoing" feud and that:

Special Crime Task Force was created within the national Drugs and Organised Crime Bureau (DOCB) to combat crime gangs, especially the Kinahan and Hutch gangs. Manned by at least 10 gardaí and three sergeants, the task force was scheduled to close in 2021; however, despite at least 18 people being killed in the feud, their success in preventing 50 other murder attempts means it will continue operating.

What are friends for? Daniel Pocock has registered all permutations of Hutch domains like GerryHutch.com and GerryHutch.ie to uphold the good name of Hutch Hussein.

For those who want to know more about The Monk, Mr Pocock has registered TheMonk.ie for good measure. Don't forget to read it before you vote on 29 November 2024.

Here are some videos of Hutch Hussein and Daniel Pocock:

Hutch Hussein speaks to Australian Fabian Society, June 2018

Daniel Pocock at the UN Forum on Business and Human Rights, November 2018

Mr Pocock makes the point that social control media gives activists like Hutch Hussein a false sense of empowerment. People have come to see the truth in this during 2024 as Elon Musk's Twitter / X appeared to help one US election candidate more than the other. The Guardian newspaper recently decided to stop using the Twitter / X platform.

Mr Pocock's point is equally valid for all enterprises, whether they be political parties, non-profits, small businesses or whatever.

Let's not forget Operation Trojan Shield, whereby the secure messaging app ANOM was really controlled by the FBI and Australian Federal Police (AFP). Social control media is really not much better than this and unlike an app operated by the police, social control media can sell information about their users to just about anybody.

Read more about TheMonk.ie and then remember to ...

Vote [1] Daniel POCOCK

Voters have a choice. If you would like to vote for a professional who can think about the things that mainstream candidates overlook Vote [1] DANIEL POCOCK and remember to follow Daniel Pocock's blog at DanielPOCOCK.com

Vote [1] Daniel POCOCK
Alan Shatter Dual citizens, Alan Shatter, Michael Danby & Israel

Alan Shatter resigned from the party Fine Gael some years ago and is making a return as an independent candidate for Dublin Rathdown.

Like candidates in neighboring Dublin Bay South, Mr Shatter wasn't fast enough to recover his old domain names. The domain name AlanShatter.ie has been taken by cybersquatters and they are trying to sell it to the highest bidder.

Somehow the cybersquatters lost interest in Mr Shatter's original domain name AlanShatter.com and it has been secured by Daniel Pocock, independent candidate for Dublin Bay South. The original Alan Shatter web site can be viewed here.

Mr Shatter is the only political leader who has simultaneously served as Ireland's Minister of Defence and Minister of Justice. Ironically, Mr Pocock used to be in the committee of the Elwood branch of the Australian Labor Party. The local member of federal parliament was Michael Danby.

Ireland's political system is very permissive of dual citizens while Australia's system requires dual citizens to renounce any additional citizenships if they are elected to public office. Everybody who identifies as Jewish is entitled to citizenship of Israel. It is interesting to note that while Michael Danby was in the Australian parliament for twenty one years, he was never accepted as a minister, as a member of the cabinet.

Danby had been editor of the Australia-Israel Review and after leaving parliament, he took another job with a Jewish cultural organization in Israel. This emphasizes the challenges that dual-citizens face when they are stretched between multiple communities.

Danby's father was a German Jew who fled to Australia after the Kristallnacht. Coincidentally, Daniel Pocock's birthday, 9 November, is the anniversary of the Kristallnacht and Pocock is sympathetic to all victims of totalitarianism, wherever they are.

Alan Shatter is a lawyer and so he has a much deeper understanding than most of us when it comes to some of the more significant legal questions about Israel and Palestine. It would be interesting to hear his feedback on these topics during the campaign:

On 22 May 2024, the Irish state formally recognized the State of Palestine. This is a dramatic change from the time when Mr Shatter was chariperson of the Irish Parliaments Foreign Affairs Committee.

On 24 May 2024, the International Court of Justice made an order against Israel with reference to genocide.

On 26 May 2024, the first pro-Israel rally took place in Dublin and Shatter was pictured speaking in front of the Israeli flag:

On 21 November 2024, the International Criminal Court issued a warrant for the arrest of leadership figures on both sides of the dispute, both the Israeli president and the Hamas leadership.

Decisions like these stand a head and shoulders above many of the other day-to-day stories of tragedy that appear in the news.

More significantly, Irish troops are currently stationed in Lebanon as peacekeepers and Israel ordered them to leave. Where does Mr Shatter stand in a situation like that? It is not an easy situation for any Irish-Israeli citizen.

During the MEP election campaign period in April and May 2024, Mr Pocock was fortunate to meet some of the Irish servicemen and their families having their leaving drinks before deployment to Lebanon. For the safety of the men and the families, the photo has been redacted. These were the drinks:

Ask the right questions

Vote [1] Daniel POCOCK

Daniel Pocock is ready to ask the difficult questions.

Pocock is not a dual-citizen any more. He acquired a third citizenship.

Activists on all sides of the dispute, whether they are supporters of Palestine or supporters of Israel, would be wise to contemplate Mr Pocock's concern about social control media giving them a false sense of empowerment:

Daniel Pocock is ready to ask the difficult questions.

Vote [1] Daniel POCOCK
Kate O'Connell Gloves are off in Dublin Bay South

Kate O'Connell was a member of Fine Gael for many years. In 2016 she was the Fine Gael candidate and she won a seat. In the 2020 election Fine Gael fielded two candidates and O'Connell just missed out on winning one of the four seats. Kate subsequently graduated from Fine Gael and now she is running as an independent in 2024.

The domain name KateOConnell.com has been taken by cybersquatters and they are offering it for sale at a price of $4,999. The domain name KateOConnell.ie was available and obtained by rival candidate Daniel Pocock for â‚¬15.

Every candidate who receives a vote of more than one quarter of the quota is entitled to have their campaign expenses reimbursed, up to a certain limit. Therefore, if Kate has the cash to pay the expense and if she is confident of getting enough votes then she could give the $4,999 ransom to the blackmailer selling kateoconnell.com and reclaim the expense from public funds. The blackmailer wins and the taxpayer loses.

While Daniel Pocock was busy submitting his nomination Kate, who runs a small business, demonstrated her entrepreneurial side by making off with Pocock's motorbike:

When Gerry Hutch, a.k.a. The Monk submitted his nomination, news reports showed him parking his scooter in the same place the day before and putting a lock on it. Why do you need to lock your vehicle when you are a crime boss and everybody is supposed to be afraid of you? Surely people know that scooter belongs to the leader of the Hutch Gang and nobody touches it. Nonetheless, Mr Hutch locks the scooter, even when it is parked outside the office of the sheriff.

Kate O'Connell's wikipedia page goes into more detail about her interactions with her former party, Fine Gael and also the Catholic Church:

In October 2016 O'Connell responded to comments by the Archbishop of Dublin Diarmuid Martin that TDs should remember their faith when legislating for abortion in Ireland by stating "I don't see why the archbishop's views are in any way relevant. I don't see why Archbishop Martin should be getting involved in women's health issues. It is the same as asking my four-year-old. They [the Church] are entitled to their opinion, but I don't put any weight in them. I don't see what involvement the Catholic Church should have in women's health issues".

In the world of open source / free software, we would say that this is a woman who doesn't obey the Code of Conduct and the cool kids would go off and have a big sook about "harassment" every time she opens her mouth.

Mr Pocock was a mentor in programs like Outreach Program for Women (Outreachy) and he admitted hoping to find talented female candidates who would also be willing to speak their mind. In 2017 he awarded such an internship to Renata D'Avila from Brazil. While most of the interns were in their first job, Renata had formerly worked as a school teacher and then re-trained as a software developer. Being about 30 years old, she was no longer as naive as the 20 year-olds Debian was hoping to recruit in the program. Renata came to the mini-DebConf in Brazil and spoke to the Debian men the same way she would speak to naughty schoolchildren:

After having met some of the candidates, Mr Pocock has made the following observations about Kate O'Connell:

I don't know everything that Kate stands for and I suspect I may not even agree with her on everything. However, she was the only other candidate who immediately asked for my number [2] vote when she realized I was running against her.

Donald Trump told us clearly that American companies in Ireland will be asked to pay their taxes in America at a lower tax rate. Many Irish politicians will be taken by surprise when the revenue they took for granted just disappears. Read the hard facts about this lost revenue on my blog.

We need a new generation of TDs who can think on our feet. Kate, a small business owner, demonstrated with her immediate request for my number [2] vote the same lightning reflexes that helped me seize her domain, along with the domains of our rivals.

Kate demonstrated an outspoken response to the role of men in women's lives. The role of social control media is far worse than anything the church has ever done. Therefore, the fact that she has made social control media a key part of her campaign, without even creating a normal website, demonstrates that she is selling her soul and the souls of her supporters to the clerics of Silicon Valley. These platforms are designed to give strong female leaders like Kate a false sense of empowerment. Artificial intelligence and algorithms will always be one step ahead of her.

Mr Pocock has been consistent in sharing this message with independent leaders around the world. Here is the video from the UN Forum on Business and Human Rights. Ever since then, Mr Pocock's family was subject to stalking and gossip campaigns from the social control media cliques:

Good news, Pocock knew just where to find his motorbike again, right outside Kate's pharmacy:

Look at all the bikes. Bike sheds are a major issue in Dublin right now.

Kate has used her business premises to display election advertising. Mr Pocock wants to ban the election posters but such a ban wouldn't apply to private premises like this. Kate appears a little bit smarter than the FG and FF candidates who put their posters on the ESB poles.

Voters have a choice. If you would like to vote for a professional who can think about the things that mainstream candidates overlook Vote [1] DANIEL POCOCK and remember to follow Daniel Pocock's blog at DanielPOCOCK.com

Vote [1] Daniel POCOCK

November 21, 2024

Chris Andrews From Twitter trolling to SLAPP suits and RTE Objectivity

Chris Andrews of Sinn Féin is one of the currently sitting TDs for the constituency of Dublin Bay South.

While Chris still holds the seat for another week and may win it again, his web site domain name ChrisAndrews.ie lapsed at some point. The alternative domain name, ChrisAndrews.com appears to be in the hands of anonymous cybersquatters. He had the opportunity to renew the domain ChrisAndrews.ie but rival candidate Daniel Pocock was faster. Pocock has made a clean sweep of domains relating to competitors from the major parties.

Sinn Féin is by far the most well known name in Irish politics outside of Ireland and this web site will treat them with the respect they deserve.

Andrews is no stranger to the world of online publications. He was previously a member of Fianna Fáil and left that party during a controversy about secret Twitter accounts used to criticize his colleagues. In open source / Free Software terminology people would say that Andrews was breaking the Code of Conduct. Nonetheless, there is a big difference between free software organizations and political parties. In free software organizations, we have a commitment to transparency while political parties normally put winning elections ahead of transparency. Without winning elections, there is no point for the party to exist, you could just go down the pub and joke about politics with your friends.

The Sunday Independent ran a story Sting op exposes Andrews over FF Twitter rants.

We can see Andrews' former web site here.

The name Sinn Féin literally translates to "Ourselves", it is an unambiguous reference to sovereignty so it is disappointing to see that the party functions through social control media where they are giving up their autonomy to algorithms and artificial intelligence.

When our political parties give up their autonomy to social control media, our nation also loses its autonomy.

Chris is 60 years old and lived in Dublin his whole life. Some of his ancestors and cousins have also held public office. He is very well connected here, so why does he need social control media at all?

Daniel Pocock is the only candidate running without social control media accounts.

This week there has been controversy and mixed reactions to Sinn Féin's policy announcement to have external experts review the objectivity of national broadcaster RTE. Some people feel it is tantamount to political interference while others feel it is necessary to ensure that political agendas don't exist in the organization. Yet social control media is actually a far bigger risk than any blunders at RTE. RTE to Facebook is like a mosquito on a crocodile.

Sinn Féin is a democratic socialist party. It is important for such parties to ask if there is no other service to the community that could be more valuable than the financial and environmental cost of erecting election posters.

Daniel Pocock supports the abolition of election posters in future elections.

The two main questions people ask Mr Pocock when he is canvassing are "are you related to the rugby player, Senator David Pocock?" and ...

you asked: "when are the posters coming down?"

Vast sums of public money are wasted on these posters.

If they spend so much public money and volunteer time on erecting these posters, why didn't they even bother to put a website address on them?

If the functioning of the Sinn Féin organization is so tightly intertwined with social control media, how can they set an example for children to turn off their phones? Leadership often comes down to very simple questions like that.

Voters have a choice. If you would like to vote for a professional who can think about the things that mainstream candidates overlook, if you care about how artificial intelligence will impact everything from your income to our Irish identity, Vote [1] DANIEL POCOCK and remember to follow Daniel Pocock's blog at DanielPOCOCK.com

Vote [1] Daniel POCOCK
Brigid Purcell Socialism with a touch of communism

Brigid Purcell is a woman and she is one of the youngest candidates but that doesn't exclude her from the same scrutiny as her competitors. Feedback can only help a candidate improve both now and in future elections.

Purcell has a few videos and here are the key points. People Before Profit present themselves as socialists but some of their ideas are veering on communism, like this comment about a state-owned construction company:

Brigid contested the by-election in 2021 and therefore she could have been more well prepared and registered her domain name long ago. She failed to take the key domain names BrigidPurcell.com and BrigidPurcell.ie and now Daniel Pocock, a rival candidate, has got them.

Like other candidates, Brigid hopes to claim public funds to pay for the posters she is putting up all over Dublin Bay South. The posters promote social control media accounts, therefore, People Before Profit add to the net worth of Silicon Valley billionaires. That is a huge contradiction.

Here Brigid talks about being a minimum wage worker and I'm sure these comments resonate with every minimum wage worker throughout Ireland:

Check out Daniel Pocock's recordings of such behavior in voluntary organizations affiliated to Google and other difficult environments.

Nonetheless, by using social control media for her campaign Brigid is giving power to billionaires in Silicon Valley. Brigid is giving power to a lot of privileged white men who work in the social control media ecosystem. Every minute Brigid spends on social control media is unpaid work adding to the share price of Meta and X. Every friend she connects with through these platforms increases the value of those networks and their share prices based on the theory proposed by Metcalfe's law.

Therefore, by building up social control media, People Before Profit are augmenting the capital accounts of billionaires. Those same billionaires have the power to manipulate their message in very subtle ways or in a very big way at any time. Artificial Intelligence is only going to make it more difficult.

Daniel Pocock is the only candidate building a campaign without social control media. Vote [1] Daniel POCOCK.

Brigid goes on to ask more young people to register to vote in the region where they live and not where their parents live:

Mr Pocock encourages young people to go a step further beyond enrolling to vote: it is vital for young people to get involved in election campaigns, to attending hustings, to organize events for the candidates on campus, to invite the more unusual candidates, to attend party branch meetings as guests and ask the candidates difficult questions. Don't rely on the reports that appear on the television, news web sites and social control media as all of those things are very carefully scripted by public relations experts.

Here we can see Mr Pocock at the UN Forum on Business and Human Rights in 2018. He speaks about social control media giving people like Brigid Purcell a false sense of empowerment:

Pocock is willing to go to the Dáil and ask the difficult questions about artificial intelligence, the economy and jobs. To solve housing problems in Dublin, we need to find win-win situations where landlords and tenants both have some positive outcomes.

The two main questions people ask Mr Pocock when he is canvassing are "are you related to the rugby player, Senator David Pocock?" and ...

you asked: "when are the posters coming down?"

Vast sums of public money are wasted on these posters which encourage people to visit social control media pages controlled by foreign billionaires.

Voters have a choice. If you would like to vote for original ideas to manage the rules of engagement between artificial intelligence, our businesses and our jobs then please Vote [1] DANIEL POCOCK and remember to follow Daniel Pocock's blog at DanielPOCOCK.com

Vote [1] Daniel POCOCK
Nick Delehanty Dog age my web site

Nick Delehanty is a corporate lawyer who worked inside the state system, left to set up a dog day care business, Barkleys Doggie Daycare and wants to change the system that he formerly worked in.

It looks like a dog ate Nick's web site and the domain name has been taken over by rival candidate Daniel Pocock. Coincidentally, Pocock worked at the other Barclays in Canary Wharf.

The domain name NickDelehanty.com is run by somebody else and has no relation to the Nick Delehanty competing in the Irish general election. Therefore, it was crucial for Nick to secure NickDelehanty.ie and he failed to do so.

Many candidates, like Nick, want to change the system. Many candidates simultaneously promise to get social control media under control and protect the children. But you can't always change the system from within, whether it is the state or the menace of social control media, candidates who want to change these things need to break out of them first.

Candidates who try to run their entire campaign within social control media and without a web site are only advancing the cause of the billionaires who run those platforms.

The Guardian learnt that the hard way. After the election of Donald Trump, The Guardian newspaper declared they will no longer post on Elon Musk's X / Twitter platform. But it was too little, too late.

Daniel Pocock is the only candidate who is competing without any social control media accounts. If you want something a bit different, you have to vote for it.

Vote [1] Daniel POCOCK

Visit the blog of Daniel Pocock for more details about policy and how you can help.

Nick has spent a lot of time and money putting up posters. Like most candidates, he will try to reclaim the cost of posters from public funds.

The two main questions people ask Mr Pocock when he is canvassing are "are you related to the rugby player, Senator David Pocock?" and ...

you asked: "when are the posters coming down?"

Daniel Pocock wants to ban the posters.

Vote [1] Daniel POCOCK

The tech industry, globally, is having a huge impact on our salaries, our savings, our small businesses and our national economy. Pocock is one of the few people from the industry who can see the big picture and wants to work on your side as your TD for Dublin Bay South.

Visit the blog of Daniel Pocock for more details about policy and how you can help.

Vote [1] Daniel POCOCK for Dublin Bay South
Alan Shatter Inheritance Tax Reform Campaign in Ireland
On 17 September 2024, the Irish Times reported Alan Shatter hasn’t “given thought” to election bid as he seeks revolt over inheritance tax.

There are many things that can be said for and against each type of tax.

Four days later, on 21 September 2024, The Journal used a loaded question in a headline, asking FactCheck: Is it true that only about 3% of people pay tax on inheritance in Ireland?

The Journal’s article does not mention the word inflation even once.

Some of the big concerns about inheritance tax:
- the threshold doesn’t automatically increase with inflation
- the privacy of a testator’s will means that beneficiaries do not always have a lot of certainty about their inheritance, therefore, they can not fully plan their affairs around it
- in most cases, the time of death will not be known very clearly in advance and this also makes it difficult for beneficiaries to plan their affairs around the tax. Example: parent dies unexpectedly aged 50 and their daughter, who has just had a baby, has committed all their cash to extending their home so they have no disposable cash to pay the inheritance tax bill.
- parents who die in unforeseen circumstances at a young age may not have had the opportunity to transfer assets pre-emptively to children who are still very young
- while some taxes, like USC, are earmarked for specific services and we can measure how well the government provides those services, it is harder to state whether the government is efficient in their use of funds from inheritance tax
Jim O'Callaghan Fine Gael & Fianna Fáil in power again

At each election, the ESB sends a kind warning to all the candidates and political parties reminding them that risky behavior, like erecting signs on the power poles, is not safe for volunteers.

With so many poles in the streets, how can we recognize the poles to avoid?

There are three clues: a yellow warning triangle, a Fine Gael poster and a Fianna Fáil poster. If you see those three things together, it is definitely the wrong pole.

While Fine Gael & Fianna Fáil were barking up the wrong ESB pole, Daniel Pocock registered their Internet domain names.

The domain names for Emma Blain (.com), Fine Gael, Emma Blain (.ie), Fine Gael and Jim O'Callaghan (.ie), Fianna Fáil are now operated by an independent candidate.

Daniel Pocock supports the abolition of election posters in future elections.

The two main questions people ask Mr Pocock when he is canvassing are "are you related to the rugby player, Senator David Pocock?" and ...

you asked: "when are the posters coming down?"

Vast sums of public money are wasted on these posters which encourage people to visit social control media pages controlled by foreign billionaires.

If they spend so much public money and volunteer time on erecting these posters, why didn't they even bother to put a website address on them?

Checking the whois records, we can see that Mr Pocock only acquired the domains after the close of nominations. That is well after these parties had chosen their candidates. Mr Pocock did not prevent them registering the domains themselves. Mrs Blain, who is already a council member, didn't attempt to register the domain and Mr O'Callaghan previously owned the domain jimocallaghan.ie and failed to renew it.

If they can't renew an Internet domain, how can they protect your kids from Google? Do you really want both of these parties in power together again? (excuse the pun) Or do you want independent candidates in the Dáil who can look over their shoulders and help them do better?

Voters have a choice. If you would like to vote for a professional who can think about the things that mainstream candidates overlook Vote [1] DANIEL POCOCK and remember to follow Daniel Pocock's blog at DanielPOCOCK.com

Vote [1] Daniel POCOCK
Emma Blain Barking up the wrong ESB pole

At each election, the ESB sends a kind warning to all the candidates and political parties reminding them that risky behavior, like erecting signs on the power poles, is not safe for volunteers.

With so many poles in the streets, how can we recognize the poles to avoid?

There are three clues: a yellow warning triangle, a Fine Gael poster and a Fianna Fáil poster. If you see those three things together, it is definitely the wrong pole.

While Fine Gael & Fianna Fáil were barking up the wrong ESB pole, Daniel Pocock registered their Internet domain names.

The domain names for Emma Blain (.com), Fine Gael, Emma Blain (.ie), Fine Gael and Jim O'Callaghan (.ie), Fianna Fáil are now operated by an independent candidate.

Daniel Pocock supports the abolition of election posters in future elections.

The two main questions people ask Mr Pocock when he is canvassing are "are you related to the rugby player, Senator David Pocock?" and ...

you asked: "when are the posters coming down?"

Vast sums of public money are wasted on these posters which encourage people to visit social control media pages controlled by foreign billionaires.

If they spend so much public money and volunteer time on erecting these posters, why didn't they even bother to put a web site address on them?

Checking the whois records, we can see that Mr Pocock only acquired the domains after the close of nominations. That is well after these parties had chosen their candidates. Mr Pocock did not prevent them registering the domains themselves. Mrs Blain, who is already a council member, didn't attempt to register the domain and Mr O'Callaghan previously owned the domain jimocallaghan.ie and failed to renew it.

If they can't renew an Internet domain, how can they protect your kids from Google? Do you really want both of these parties in power together again? (excuse the pun) Or do you want independent candidates in the Dáil who can look over their shoulders and help them do better?

Voters have a choice. If you would like to vote for a professional who can think about the things that mainstream candidates overlook Vote [1] DANIEL POCOCK and remember to follow Daniel Pocock's blog at DanielPOCOCK.com

Vote [1] Daniel POCOCK
Remi Collet PHP version 8.4 is released!
RC4 was GOLD, so version 8.4.1 GA was just released, at the planned date.

A great thanks to Eric Mann, Calvin Buckley and Saki Takamachi, our Release Managers, to all developers who have contributed to this new, long-awaited version of PHP, and to all testers of the RC versions who have allowed us to deliver a good-quality version.

RPMs are available in the php:remi-8.4 module for Fedora and Enterprise Linux â‰¥ 8 and as Software Collection in the remi-safe repository.

Read the PHP 8.4.1 Release Announcement and its Addendum for new features and detailed description.

For memory, this is the result of 6 months of work for me to provide these packages, starting in July for Software Collections of alpha versions, in September for module streams of RC versions, and also a lot of work on extensions to provide a mostly full PHP 8.4 stack.

Installation: read the Repository configuration and choose installation mode, or follow the Configuration Wizard instructions.

Replacement of default PHP by version 8.4 installation (simplest):

Fedora modular or Enterprise Linux:
```
dnf module reset php
dnf module install php:remi-8.4
```
Parallel installation of version 8.4 as Software Collection (recommended for tests):
```
yum install php84
```
To be noticed :
- EL-10 RPMs are built using RHEL-10.0-beta
- EL-9 RPMs are built using RHEL-9.5
- EL-8 RPMs are built using RHEL-8.10
- This version will also be the default version in Fedora 42
- Many extensions are already available, see the PECL extension RPM status page.
Information, read:
Base packages (php)

Software Collections (php84)
Remi Collet PHP version 8.1.31, 8.2.26 and 8.3.14
RPMs of PHP version 8.3.14 are available in the remi-modular repository for Fedora ≥ 39 and Enterprise Linux ≥ 8 (RHEL, Alma, CentOS, Rocky...).

RPMs of PHP version 8.2.26 are available in the remi-modular repository for Fedora ≥ 39 and Enterprise Linux ≥ 8 (RHEL, Alma, CentOS, Rocky...).

RPMs of PHP version 8.1.31 are available in the remi-modular repository for Fedora ≥ 39 and Enterprise Linux ≥ 8 (RHEL, Alma, CentOS, Rocky...).

The packages are available for x86_64 and aarch64.

PHP version 8.0 has reached its end of life and is no longer maintained by the PHP project.

These versions are also available as Software Collections in the remi-safe repository.

These Versions fix 6 security bugs (CVE-2024-11233, CVE-2024-11234, CVE-2024-11236, CVE-2024-8929, CVE-2024-8932), so update is strongly recommended.

Version announcements:
Installation: use the Configuration Wizard and choose your version and installation mode.

Replacement of default PHP by version 8.3 installation (simplest):
```
dnf module switch-to php:remi-8.3/common
```
Parallel installation of version 8.3 as Software Collection
```
yum install php83
```
Replacement of default PHP by version 8.2 installation (simplest):
```
dnf module switch-to php:remi-8.2/common
```
Parallel installation of version 8.2 as Software Collection
```
yum install php82
```
And soon in the official updates:
- Fedora Rawhide now has PHP version 8.4.1
- Fedora 41 - PHP 8.3.14
- Fedora 40 - PHP 8.3.14
To be noticed :
- EL-10 RPMs are built using RHEL-10.0-beta
- EL-9 RPMs are built using RHEL-9.4
- EL-8 RPMs are built using RHEL-8.10
- EL-7 repository is closed
- intl extension now uses libicu74 (version 74.2)
- mbstring extension (EL builds) now uses oniguruma5php (version 6.9.9, instead of the outdated system library)
- oci8 extension now uses the RPM of Oracle Instant Client version 23.6 on x86_64, 19.24 on aarch64
- a lot of extensions are also available, see the PHP extensions RPM status (from PECL and other sources) page
Information:
Base packages (php)

Software Collections (php81 / php82 / php83)

Adam Young xmllint for xpath

Beaker one liner using xmllint:

bkr job-results J:61 | xmllint --xpath /job/recipeSet/recipe/roles/role -
<role value="RECIPE_MEMBERS"/>

The dash at the end makes it read from stdin

November 20, 2024

Peter Czanik Experimental syslog-ng container image based on Alma Linux
The official syslog-ng container image is based on Debian Stable. However, we’ve been getting requests for an RPM-based image for many years. So, I made an initial version available based on Alma Linux and now I need your feedback about it!

This image uses the “init” variant of Alma Linux 9 containers as a base image. What does this mean? Well, it uses systemd service management inside, making it possible to run multiple services from a single container. While only syslog-ng is included right now, I also plan to add the syslog-ng Prometheus exporter to the image.

Note that while the example command lines show Docker, I also tested it using Podman.

Why not RHEL UBI?

I want everyone to be able to rebuild the image from scratch (Dockerfile). When using RHEL UBI as a base image, you have to run RHEL to build the container image based on RHEL UBI, as certain repositories cannot be enabled without a Red Hat subscription. While many syslog-ng users use RHEL to run syslog-ng, even more of them use one of the RHEL-compatible operating systems, like Alma Linux, CentOS, or Rocky Linux. Using Alma Linux as a base image ensures that you do not need an RHEL subscription to rebuild the image locally.

Needless to say: if you use RHEL, you can easily modify the Dockerfile to use RHEL UBI as a base image.

Why version 9?

Yes, I know that RHEL 8 and its compatibles are still more popular than version 9. However, version 8 includes ancient software versions both in the base OS and in EPEL. With RHEL 9 as a base, a lot more syslog-ng features can be enabled.

Which syslog-ng features are included?

All features that can be compiled on RHEL 9, except for Java support. It’s missing because that would significantly enlarge an already huge container. If you really need it, just add syslog-ng-java to the package list in the Dockerfile and build the image yourself.

I also plan to add the syslog-ng Prometheus exporter to the image. It is small, just a few lines of Python script.

You can list the enabled modules with the following command:
```
czplaptop:~ # docker run -it --rm --name syslog-ng czanik/syslog-ng:alma9_481 /usr/sbin/syslog-ng -V
syslog-ng 4 (4.8.1.7.g6113797)
Config version: 4.2
Installer-Version: 4.8.1.7.g6113797
Revision:
Compile-Date: Oct  3 2024 00:00:00
Module-Directory: /usr/lib64/syslog-ng
Module-Path: /usr/lib64/syslog-ng
Include-Path: /usr/share/syslog-ng/include
Available-Modules: add-contextual-data,afamqp,affile,afmongodb,afprog,afsmtp,afsocket,afstomp,afuser,appmodel,azure-auth-header,basicfuncs,cef,cloud_auth,confgen,correlation,cryptofuncs,csvparser,disk-buffer,ebpf,examples,geoip2-plugin,graphite,hook-commands,http,json-plugin,kafka,kvformat,linux-kmsg-format,loki,map-value-pairs,metrics-probe,mod-python,otel,pacctformat,pseudofile,rate-limit-filter,redis,regexp-parser,riemann,sdjournal,secure-logging,stardate,syslogformat,system-source,tags-parser,tfgetent,timestamp,xml
Enable-Debug: off
Enable-GProf: off
Enable-Memtrace: off
Enable-IPv6: on
Enable-Spoof-Source: on
Enable-TCP-Wrapper: off
Enable-Linux-Caps: on
Enable-Systemd: on
czplaptop:~ #
```
Configuration

This container includes the exact same configuration as the official syslog-ng container image. You can check it at https://github.com/syslog-ng/syslog-ng/blob/master/docker/syslog-ng.conf The Dockerfile opens four ports to collect log messages:
- 514 UDP and TCP for RFC3164 log messages
- 601 TCP for RFC5424 log messages
- 4317 TCP for OpenTelemetry (not used in the default configuration)
- 6514 TCP TLS for encrypted RFC5414 log messages (does not work out of the box)
All logs are saved into two files: /var/log/messages and /var/log/messages-kv, the latter of which also stores all name-value pairs received.

Of course, not many people run syslog-ng using the default configuration. You can map your own custom syslog-ng.conf to /etc/syslog-ng/syslog-ng.conf to use your own configuration.

Testing your configuration

If you have a test syslog-ng configuration in the /tmp directory, you can test it by mounting it as a volume into the container and run syslog-ng. If you are lucky, there is no output at all:
```
czplaptop:~ # docker run -it --rm -v /tmp/syslog-ng.conf:/etc/syslog-ng/syslog-ng.conf -p 514:514/udp -p 601:601 --name syslog-ng czanik/syslog-ng:alma9_481 /usr/sbin/syslog-ng --no-caps -s
czplaptop:~ #
```
Note the --no-caps option. It silences an error message. Without it, the output of the above command would be:
```
czplaptop:~ # docker run -it --rm -v /tmp/syslog-ng.conf:/etc/syslog-ng/syslog-ng.conf -p 514:514/udp -p 601:601 --name syslog-ng czanik/syslog-ng:alma9_481 /usr/sbin/syslog-ng -s
syslog-ng: Error setting capabilities, capability management disabled; error='Operation not permitted'
```
Adding a startup parameter permanently

As you could see from the previous paragraphs, syslog-ng needs the --no-caps parameter to run in a container. Normally, when you start the syslog-ng container, syslog-ng is started by init. You cannot pass parameters from the command line. This can be solved by adding parameters to the /etc/sysconfig/syslog-ng file. By default, it already has the --no-caps parameter:
```
SYSLOGNG_OPTS="--no-caps"
```
If you want more parameters, like extra log messages from syslog-ng, you can create a file with this content and add the extra parameters to it. Note that not all syslog-ng parameters make sense, when you have proper init in a container. For example, verbose logging does not work: you have to call syslog-ng directly for that, like in the syntax check case. However, you can use a different configuration file, among others.

Once you saved the file, you have to map it into the container:
```
docker run  -v /tmp/syslog-ng:/etc/sysconfig/syslog-ng czanik/syslog-ng
```
SELinux

If you use volume mapping to store your logs outside the container, you will run into trouble on SELinux-enabled systems. Many organizations simply disable SELinux, as it can greatly complicate life. However, you do not have to do so. Tested with Podman on Alma Linux 8, appending “:Z” to the volume name resolves SELinux problems:
```
docker run -d -v /data/log/:/var/log:Z -p 514:514 czanik/syslog-ng
```
A call for testing and feedback

This is just the first version of the Alma Linux-based syslog-ng container. I plan to add Prometheus exporter support soon. And I need your feedback! Does it work for you? Do you miss something? Is there anything that you would do differently about it?

You can reach the Docker image on Docker Hub at https://hub.docker.com/repository/docker/czanik/syslog-ng/general

You can find the Dockerfile at https://github.com/czanik/syslog-ng-ubi

Pull Requests are also welcome! You can share your feedback on GitHub, the syslog-ng mailing list, or also on LinkedIn / Twitter / Mastodon.

-

If you have questions or comments related to syslog-ng, do not hesitate to contact us. You can reach us by email or even chat with us. For a list of possibilities, check our GitHub page under the “Community” section at https://github.com/syslog-ng/syslog-ng. On Twitter, I am available as @PCzanik, on Mastodon as @Pczanik@fosstodon.org.
Cockpit Project Cockpit 329
Cockpit is the modern Linux admin interface. We release regularly.

Here are the release notes from cockpit 329 and cockpit-files 12:

Shell: Improve warning when connecting to remote hosts

While Cockpit 322 deprecated the “host switcher” on newer distribution versions, connecting to hosts within Cockpit is still possible on older distribution versions or when using a specific override in cockpit.conf. Cockpit now displays a clear warning when connecting to a remote host, as all connected hosts can control each other.

This warning can be disabled by including the following in /etc/cockpit/cockpit.conf:
```
[Session]
WarnBeforeConnecting=false
```
Files: File creation support

Create new files directly in Cockpit Files. Enter the file name and content. Ownership is automatically determined from the current directory, but can be changed if needed.

Try it out

Cockpit 329 and cockpit-files 12 are available now:

November 19, 2024

Richard W.M. Jones Benchmarking RISC-V SpaceMIT X60 and others

I recently received 4 Milk-V Jupiter development boards, and one Banana Pi F3 through RISC-V International. All of these boards have the same (or very similar) SpaceMIT X60 SoC which is a fairly capable 8 core RISC-V processor.

model name      : Spacemit(R) X60
isa             : rv64imafdcv_zicbom_zicboz_zicntr_zicond_zicsr_zifencei_zihintpause_zihpm_zfh_zfhmin_zca_zcd_zba_zbb_zbc_zbs_zkt_zve32f_zve32x_zve64d_zve64f_zve64x_zvfh_zvfhmin_zvkt_sscofpmf_sstc_svinval_svnapot_svpbmt

Since we’ll be using all of these boards for Fedora package building I ran some simple benchmarks of how well they perform. The benchmark is to recompile this grub2 package to RPMs:

# dnf builddep grub2-2.12-11.0.riscv64.fc41.src.rpm
$ time rpmbuild --recompile grub2-2.12-11.0.riscv64.fc41.src.rpm

(I did a few builds in a row until the times settled down, so these are all “hot cache” builds on an otherwise unloaded board.)

Milk-V Jupiter	RISC-V SpaceMIT X60 8 cores 16GB RAM	748s
Banana Pi	RISC-V SpaceMIT X60 8 cores 16GB RAM	962s
VisionFive 2	JH7110 4 cores 8GB RAM	923s
Raspberry Pi 4	ARM Cortex A72 4 cores 8 GB RAM	753s
AMD gaming PC	AMD Ryzen 9 7950X 16 cores 64 GB RAM	104s
ESWIN P550 (update 2024/12/10)	RISC-V SiFive P550 4 cores 16 GB RAM	598s

~~We should be getting a SiFive P550 development board soon which is the first widely available out-of-order RISC-V core.~~

(Thanks Andrea Bolognani for benchmarking the VF2)

Adam Williamson AdamW's Debugging Adventures: Inadvertent Extreme Optimization
It's time for that rarest of events: a blog post! And it's another debugging adventure. Settle in, folks!

Recently I got interested in improving the time it takes to do a full compose of Fedora. This is when we start from just the packages and a few other inputs (basically image recipes and package groups), and produce a set of repositories and boot trees and images and all that stuff. For a long time this took somewhere between 5 and 10 hours. Recently we've managed to get it down to 3-4, then I figured out a change which has got it under 3 hours.

After that I re-analyzed the process and figured out that the biggest remaining point to attack is something called the 'pkgset' phase, which happens near the start of the process, not in parallel with anything else, and takes 35 minutes or so. So I started digging into that to see if it can be improved.

I fairly quickly found that it spends about 20 minutes in one relatively small codepath. It's created one giant package set (this is just a concept in memory at the time, it gets turned into an actual repo later) with every package in the compose in it. During this 20 minutes, it creates subsets of that package set per architecture, with only the packages relevant to that architecture in it (so packages for that arch, plus noarch packages, plus source packages, plus 'compatible' arches, like including i686 for x86_64).

I poked about at that code a bit and decided I could maybe make it a bit more efficient. The current version works by creating each arch subset one at a time by looping over the big global set. Because every arch includes noarch and src packages, it winds up looping over the noarch and src lists once per arch, which seemed inefficient. So I went ahead and rewrote it to create them all at once, to try and reduce the repeated looping.

Today I was testing that out, which unfortunately has to be done more or less 'in production', so if you like you can watch me here, where you'll see composes appearing and disappearing every fifteen minutes or so. At first of course my change didn't work at all because I'd made the usual few dumb mistakes with wrong variable names and stuff. After fixing all that up, I timed it, and it turned out about 7 minutes faster. Not earth shattering, but hey.

So I started checking it was accurate (i.e. created the same package sets as the old code). It turned out it wasn't quite (a subtle bug with noarch package exclusions). While fixing that, I ran across some lines in the code that had bugged me since the first time I started looking at it:
```
                if i.file_path in self.file_cache:
                    # TODO: test if it really works
                    continue
```
These were extra suspicious to me because, not much later, they're followed by this:
```
                self.file_cache.file_cache[i.file_path] = i
```
that is, we check if the thing is in self.file_cache and move on if it is, but if it's not, we add it to self.file_cache.file_cache? That didn't look right at all. But up till now I'd left it alone, because hey, it had been this way for years, right? Must be OK. Well, this afternoon, in passing, I thought "eh, let's try changing it".

Then things got weird.

I was having trouble getting the compose process to actually run exactly as it does in production, but once I did, I was getting what seemed like really bizarre results. The original code was taking 22 minutes in my tests. My earlier test of my branch had taken about 14 minutes. Now it was taking three seconds.

I thought, this can't possibly be right! So I spent a few hours running and re-running the tests, adding debug lines, trying to figure out how (surely) I had completely broken it and it was just bypassing the whole block, or something.

Then I thought...what if I go back to the original code, but change the cache thing?

So I went back to unmodified pungi code, commented out those three lines, ran a compose...and it took three seconds. Tried again with the check corrected to self.file_cache.file_cache instead of self.file_cache...three seconds.

I repeated this enough times that it must be true, but it still bugged me. So I just spent a while digging into it, and I think I know why. These file caches are kobo.pkgset.FileCache instances; see the source code here. So, what's the difference between foo in self.file_cache and foo in self.file_cache.file_cache? Well, a FileCache instance's own file_cache is a dict. FileCache instances also implement __iter__, returning iter(self.file_cache). I think this is why foo in self.file_cache works at all - it actually does do the right thing. But the key is, I think, that it does it inefficiently.

Python's preferred way to do foo in bar is to call bar.__contains__(foo). If that doesn't work, it falls back on iterating over bar until it either hits foo or runs out of iterations. If bar doesn't support iteration it just raises an exception.

Python dictionaries have a very efficient implementation of __contains__. So when we do foo in self.file_cache.file_cache, we hit that efficient algorithm. But FileCache does not implement __contains__, so when we do foo in self.file_cache, we fall back to iteration and wind up using that iterator over the dictionary's keys. This works, but is massively less efficient than the dictionary's __contains__ method would be. And because these package sets are absolutely fracking huge, that makes a very significant difference in the end (because we hit the cache check a huge number of times, and every time it has to iterate over a huge number of dict keys).

So...here's the pull request.

Turns out I could have saved the day and a half it took me to get my rewrite correct. And if anyone had ever got around to TODOing the TODO, we could've saved about 20 minutes out of every Fedora compose for the last nine years...

This is an independent, censorship-resistant site run by volunteers. This site and the blogs of individual volunteers are not officially affiliated with or endorsed by the Fedora Project.

We Make Fedora

December 11, 2024

December 10, 2024

Before you begin

Enabling systemd

Install and configure syslog-ng

Configuring networking

What is next?

SSHKit

Web barrier

Controlled rollouts

December 09, 2024

Sites web d'actualité

Les vidéos

Bilan

Qu'est-ce que c'est ?

Que faire ?

Fedora Engineering Steering Committee (FESCo)

Mindshare Committee

Interview with Zbigniew Jędrzejewski-Szmek

Why do you want to be a member of FESCo and how do you expect to help steer the direction of Fedora?

How do you currently contribute to Fedora? How does that contribution benefit the community?

How do you handle disagreements when working as part of a team?

What else should community members know about you or your positions?

Interview with Tomas Hckra

Why do you want to be a member of FESCo and how do you expect to help steer the direction of Fedora?

How do you currently contribute to Fedora? How does that contribution benefit the community?

How do you handle disagreements when working as part of a team?

What else should community members know about you or your positions?

Interview with Josh Stone

Why do you want to be a member of FESCo and how do you expect to help steer the direction of Fedora?

How do you currently contribute to Fedora? How does that contribution benefit the community?

How do you handle disagreements when working as part of a team?

What else should community members know about you or your positions?

Interview with David Cantrell

Why do you want to be a member of FESCo and how do you expect to help steer the direction of Fedora?

How do you currently contribute to Fedora? How does that contribution benefit the community?

How do you handle disagreements when working as part of a team?

What else should community members know about you or your positions?

Show Notes

December 06, 2024

December 05, 2024

NEWS

FreeBSD audit source for syslog-ng

Version 4.8.1 of syslog-ng is now available

Where should I present syslog-ng and sudo?

WEBINARS

December 04, 2024

Changes since Kiwi TCMS 13.6

Security

Improvements

API

Bug fixes

Refactoring and testing

Translations

Kiwi TCMS Enterprise v13.7-mt

Private container images

How to upgrade

VPN: Essential Tools for Privacy and Security

What is a VPN?

Why Use a VPN?

Comparing Popular VPNs

Why Mullvad VPN?

Installing Mullvad VPN on Linux

In-Depth VPN Comparison

NordVPN

ExpressVPN

Surfshark

ProtonVPN

Conclusion

Web server: Increased sandboxing, setuid removal, bootc support

Development: New install mode using systemd-sysext

Try it out

December 03, 2024

December 02, 2024

Show Notes

December 01, 2024

From the Monk to the poisoned chalice

Looking towards the future: tax will be optional, for some

November 30, 2024

Web server: Increased sandboxing, `setuid` removal, `bootc` support

Development: New install mode using `systemd-sysext`