English - 22

Yesterday, there was that message on pro-linx that several projects using bitkeeper for managing their sourcecode now have problems because bitkeeper will no longer be available for free. The most important project using bitkeeper was the linux-kernel. Luckily, the kernel developers developed an alternative called git and seem to be happy with it.
The bitkeeper-issue was one issue showing how using proprietary software on free systems can lead into problems. But at all, it was not that big issue. The source was still free and the projects could switch to other software like git, svn or monotone.

Now, another issue has been brought up recently: Current OpenOffice.org 2.0 beta versions need the proprietary Sun Java Runtime Environment to work. This is imho a much more grave issue. Imagine Sun does the same as BitMoover and says from one day to the other that they won't provide java for free any more. Or, even worse, if sun decides not to support future linux-versions. At the moment, this might not be that big issue, because most parts of OOo are still written in C. But imageine larger parts of it are java-based, this could mean OOo would be suddenly unavailable on Linux (or other free/alternative Systems).
Luchily, the FSF is working on getting OOo to work with the free GCJ (GNU Java Compiler).
(Beside that, although it's always claimed, sun java is limited to a very small number of architectures and thus not very portable)

Another very dangerous threat to free software are binary drivers. Some days ago, NVidia released a new, proprietary linux-driver.
They removed support for some older graphics chips.
What does that mean? If you own such a card, your opportunities are very limited:

• You can continue using the old drivers as long as they work with current kernels and xorg-versions. If they fail with a kernel-update, you can stick to that kernel. If security-hole appear in that kernel, you have a problem.
• You can switch to the free drivers in xorg and use your card, originally probably an expensive, state-of-the-art 3d-gaming-card, without any 3d-functions.
• You can buy another graphics-card.

That's the consequence of binary drivers. If a vendor stops supporting your device, there's just nothing you can do.
The bad thing with graphics-cards is that currently there is no real alternative. ATI is releasing binary drivers, which are very unstable and lacking a lot of features (Jon Lech Johansen wrote about that recently). As I read in the changelog of xorg, they are working on supporting newer ATI-chips (probably by reverse engineering). For the future, maybe the OpenGraphics-Project will be an alternative.

Beside that, there's another problem with binary drivers. Did you ever tell people "Open Source is good, because many people can look at the code and find bugs, security holes and backdoors"? Well, if you load binary drivers in your kernel space, you can just forget this argument.

Another good text I found about that issue is Freedom 0, here is the german version Freiheit 0.

I often read in forums and hear from people "don't be so ideologic, not everything can be free", "RMS and the FSF are stupid, they are too ideologic", "I'm happy that nvidia releases drivers at all" etc. I hope I brought some arguments why in my opinion, free software is important and why I try to avoid the use of non-free software whereever possible.

I just arrived at the GPN4, an event organized by Entropia, the local group of the chaos computer club in Karlsruhe.
The lectures sound very interesting and most are about subjects like Open Source/Free Software, DRM and alternatives, Open Content and Society etc.

If you live nearby Karlsruhe you might consider to join the event for the short term.

While cleaning up my room, I found the ELSA Microlink ISDN USB you can see on the picture here.
I hate this device! It stopped me from using Linux for about half a year. I even set up a homepage about that issue. As far as I know, it's still impossible to use it in Linux. I don't care as I don't use ISDN any more.
I want to get rid of it. If there's anyone out there who seriously wants to write a linux-driver for it (by reverse engineering or contacting ELSA for specs or whatever), write me a note and I'll send you the device for free. Please add some information why you think you are able to do it (e.g. did you write linux/isdn-drivers before?).

As I always like to be on the bleeding edge, I recently rebuilt my complete Gentoo system with the new gcc 4.0.0.

The good news is that it's getting better every day, but you still need a lot of fixes, so if you decide to try it, please be prepared that you'll have to play around, apply patches etc.

• To bootstrap your system with gcc 4, you need to add sys-devel/gcc and sys-libs/glibc to your package.unmask and package.keywords, because they are hard-masked in package.mask and have KEYWORDS="-*". I always have ACCEPT_KEYWORDS="~x86" set in make.conf to get the latest testing-packages, this is probably advisable if you want to try out such bleeding edge stuff.
• xorg-x11 fails, but a patch is in the masked xorg-x11-6.8.2-r2 ebuild, so add that to package.unmask, too.
• A number of packages failed to compile that are now fixed in portage, so you don't have to care about (xfsprogs, mod_php-5, probably some more I forgot).
• libsdl needs to be compiled with -O0, see this bug for details.
• Konqueror compiles, but segfaults, a fix/patch is here.
• Mozilla / Firefox don't compile, see here, but I didn't try/need, as Konqueror is my browser of choice.
• A bigger problem was the kernel, as 2.6.11.8 fails to compile and 2.6.12-rc3/rc4 brought a kernel panic while booting. I'm now running 2.6.12-rc3-mm3, it boots and mostly works, but acpi4asus seems to be broken (don't know if this is due to gcc4 or mm-kernel).
• Packages that still fail for me: gstreamer-ffmpeg, fte, tcpdump, dosemu, wine, openoffice-ximian. All upstream devs are informed, so I think patches will appear soon.

So finally, no really important packages are missing, my system works quite stable so far.

Feel free to try out yourself. If packages fail to build, try searching the gentoo-bugzilla and the upstream-webpage for fixes.
If you have patches/fixes for the packages above, feel free to add a link to the comments. If you wrote patches yourself, make sure to send them to the upstream-devs and to the gentoo bugzilla.

As I have been busy with other live-issues, I didn't blog for quite a long time. Now I'll try to change that and will be back in the blogosphere.
I've deleted some spam-comments that appeared and you can expect some blog-entries in the next days.

Today I looked if Samsung provides a BIOS-update for my laptop (P30 XVM 1500). There was a new version (09NK), but it was only a windows-executable-file. You can get it here.
Older versions (e.g. the 06nk) were available as boot-cd-images (nero-files, but that doesn't matter, you can easily convert them to isos), but not the new version.

Ok, next thing I tried was extracting the files from the exe. Not that easy though. Usually, you can just unzip exe-installers, but this didn't contain a zip-archive.
With a dos-tool called gettyp (runs in dosemu) I could find out the position of the exe-overlay and could extract it with dd. It started with LPCKLPCK. Nice, looks like a signature.
But file didn't recognize it, googling for LPCKLPCK just brought NOTHING. After some more investigation, I found that the format was quite easy to read, it had always a filename with .gz and a fixed number of zero-bytes later a gzip-header. As I only needed one file, I dd'ed it so it started with the .gz-header of that file (09NK.WPH.gz). gunzip said that it ignoes the trailing garbage after the data.
Nice, so I had my 09nk.wph-file I needed (the BIOS-image).

Ok, the rest was simple, creating a freedos-bootdisk with dosemu, copying the 09nk.wph and phlash16.exe (from the old bios-update 06nk) on it, creating a boot-cd with k3b.

For all of you that don't want to repeat this adventure, I've provided an ISO-image. Just boot it, run phlash16 09nk.wph and you're done.
WARRANTY: This worked for me, but I am not responsible if it destroys your BIOS, if your laptop starts burning or if anything else happens.

After the News about the SHA1 hash-function definitely being broken (see this article from Bruce Schneier for details), I was looking around how to use the alternatives SHA256/SHA512.
While for example GnuPG supports SHA256 out of the box, it's a problem in a lot of situations.

Command line
While the GNU Coreutils have md5sum/sha1sum for the broken, insecure algorithms, they contain no similar tools for SHA256. The hashsum package provides some tools equivalent to the usual md5sum/sha1sum tools.
Another Option is shash, which provides a wide variety of hashing-algorithms, but it's not syntax-compatible to the GNU tools.

Programming library
The above mentioned shash is based on the mhash-library, which supports a wide variety of hashing algorithms.

PHP
While PHP has md5/sha1-functions built-in, there are no such functions for sha256. But it's possible to use the mhash-library if PHP was configured with --with-mhash.
For Gentoo-Users: USE="mhash"
Then you can use mhash(MHASH_SHA256,$s) to get binary hashes. To get hexadecimal encoded hashes (like the md5/sha1-functions do), use bin2hex(mhash(MHASH_SHA256,$s)).

I've just fixed all old blog-entries to be proper UTF-8, so the page should now validate again. I've also changed the doctype to XHTML 1.1 to be on top of the latest W3C-standards.

As I told some weeks ago, I bought an iRiver IFP-795 OGG/MP3-Player.
Today I found that there is a new firmware for USB Mass Storage (called UMS-firmware) support and it works quite well, no longer chinese and unstable (as the alpha-version was I tested some time ago).
So i no longer need any driver for it and can use it as an USB-Stick.

As a great supporter of free software, I always try to reduce the amount of non-free stuff on my harddisk. This time, I replaced the non-free unrar (unpacker for the rar-format) with a gpl-version of unrar. I already added an ebuild to portage, called unrar-gpl.
The only non-free things left are some Browsers (Opera, Netscape 4.x) I have installed to test my webpages and some old games I like to play in emulators (e.g. Monkey Island).

Yesterday, my laptop did strange things. I couldn't access my homedir any more. After a reboot: shock! Couldn't mount it.
Well, Lars' comment was about backup strategies and his mails are all IMAP and backuped on different systems. But that didn't help me much in that moment.
I had some backups, but months old and not very sorted. Not a backup strategy at all.
Ok, so the tries to rescue my data began. dd'ed the partition-image to another pc, xfs_repair did some things, but after that, I still couldn't mount it. Panic!
Well, after some more tries, I found that there's a tool xfs_copy, which was able to restore most of my data. A lot of stuff is still lost, tons of files in lost+found-dir. But after all, I'm happy that most data is rescued and I'll buy an externa USB-HD tomorrow and invent some backup-strategies.

A few days ago I decided to buy an MP3/OGG-player. Yes, you read right, it had to support ogg! I don't want a player that just plays proprietary/patented crap.
After some googling, a visit in the local saturn (btw, are there any other stores out there where you can buy stuff like this?), it seemed that the only possible solution was an iRiver.
Looking around, it seemed that the iFP-795 was right for me. 512 MB, not too expensive, so I ordered it (in a well-known online-store I won't link/support here, because they have an ugly patent, but I saw no alternative to that).
Today it arrived! I happily opened it, ignored the CDs with windows-software and attached it to my laptop. There is a nice command-line-tool called ifp-line for linux that'll do everything you need. For the gentoo-guys out there, just emerge ifp-line. There are also other things, like a fs-driver, graphical frontends etc., but I saw no need for that.
Well, didn't work, ifp just hanged and even didn't exit after a killall -9. It seemed that the version was buggy, so I bumped the gentoo-ebuild to 0.2.4.5. Voila, everything was okay (ebuild is already commited to portage).
Now, I wanted to try out the ogg-support, as that was the reason I bought it. Uploaded Scamps nice Poison-Remix, and shock! "NOT SUPPORTED!" It just didn't play it. PANIC! Did I accidently buy a device without ogg?
Okay, first thing was a firmware-update. No problem at all, ifp-line can do that.
After the firmware-update it still, didn't play the file. Well, then I tried out another ogg-file, and hey, it played it. Seems that scamp created somehow a buggy ogg-file. After an oggdec and oggenc I also could play the Poison-Remix.

Things to come:
- As the iRiver-people told me, there is also a so-called UMS-firmware, which will make the device an USB mass storage, which would avoid the need for a special-tool and the device could also be used for data-transfer. But they didn't give me a download-link (and I couldn't find it on their hp), so I'll have to wait for that.
- I WANT FLAC! Sadly, it seems that not enough people urge iRiver to implement that. Maybe I should try to decode and hack the firmware. There should be enough space when removing the 100%-useless WMA-support ;)

Update! 26.11.2004
Today I got a mail from iriver with a link to their firmware. You can get it here. After an ifp firmupdate [filename], the iriver needs some minutes to reformat itself. After that, you can access it as an usb mass storage (unlike other devices, it's /dev/sda, not /dev/sda1 on my pc).
I'm not really happy with it, as it switched some menus to chinese (which I sadly don't understand) and it's quite buggy, files disappear, directories become unreadable. As the original firmware worked okay, I think I'll switch back and wait till the ums-firmware is available in english and non-beta.

Yesterday I created a new PGP/GPG-Key for secure communication.
The default gnupg keys are 1024 bit DSA (Data Security Algorithm, based on the discrete logarithm problem). According to studies by famous cryptographs like Dan J. Bernstein or Adi Shamir, keys with 1024 bit for public key encryption based on factorisation or the discrete logarithm problem might be unsecure. Large institutions or companies with several millions available might be able to create special hardware to break such keys.
See http://www.cryptolabs.org/rsa/ for details.

You can get my new key, Key-ID --------, here. It is signed with the old one.

Key no longer used, use BBB51E42.

Today, I was at a talk held by Richard Stallman, the founder of the GNU project and ideological father of the free software movement, at the Lightwerk GmbH in Stuttgart.
The talk was about software patents. I was a bit disappointed, because it was only about the usual, obvious arguments about software patents, which probably all visitors of the talk already knew. I think RMS can tell much more important things about free software and the social and political impact of it.
Nevertheless, it was worth being there. A friend of mine took a picture of me and RMS, which you can see beside.
Oh, before I forget, support the protest of the FFII against software patents.

As there is not much information available about this subject, I started writing a tutorial about how to create 4k intros in linux. The sections about executable packing and using gcc are finished, assembler-section will follow.
Get it here