text:
Let yourself be embraced by the purple rubber toy octopus! We're happy to announce the release of Debian 9.0, codenamed Stretch.
Want to install it? Choose your favourite installation media among Blu-ray Discs, DVDs, CDs and USB sticks. Then read the installation manual.
Already a happy Debian user and you only want to upgrade? You can easily upgrade from your current Debian 8 Jessie installation, please read the release notes.
Do you want to celebrate the release? Share the banner from this blog in your blog or your website!
The Debian Release Team in coordination with several other teams are preparing the last bits needed for releasing Debian 9 Stretch. Please, be patient! Lots of steps are involved and some of them take some time, such as building the images, propagating the release through the mirror network, and rebuilding the Debian website so that "stable" points to Debian 9.
Follow the live coverage of the release on https://micronews.debian.org or the @debian profile in your favorite social network! We'll spread the word about what's new in this version of Debian 9, how the release process is progressing during the weekend and facts about Debian and the wide community of volunteer contributors that make it possible.
It's been a while since I last tried out a different desktop environment on my laptop and I've been using i3 for some time now so it's only fair to give other things a go ;)
To test these out, I ran another X display - keeping my original one running so I could switch back and forth to take notes - and started each environment with DISPLAY=:1 <the command to start the desktop>.
I'll start with just one today and perhaps review some others another time.Deepin
In summary: bits of Gnome Shell, Chrome OS, and Mac OSX but not quite as polished as any of them.
The Deepin Desktop Environment (DDE - from the Deepin distribution) installed easily enough under Arch with a quick pacman -S deepin deepin-extra. It also started up easily with an unambiguous startdde.
Immediately on startup, DDE plays a slightly annoying chime presumably just to remind you of how far we've come since Windows 95. The initial view of the desktop looks similar to OSX or Chrome OS with file icons on the desktop and a launcher bar centred across the bottom of the screen.
The first thing I tried was clicking on a button labelled "Multitasking view" only to be presented with a prompt telling me "Kindly reminder: This application can not run without window effect" and an OK button. So far, so enigmatic. So then I tried a trusty right-click on the desktop which brought up the expected context menu. In the menu was a "Display settings" option so I plumped for that, thinking that perhaps that was where I could enable the mystic "window effect". Clicking the "Display settings" button opened a dark-themed panel from the right-hand side, similar to the information panel you get in OSX. I searched through that panel for a good couple of minutes but could find no allusion to any "window effect".
Unperturbed, I decided to press on and see what other features Deepin had to offer...
Moving the mouse around the desktop a bit, I discovered that Deepin has borrowed some ideas from Gnome shell as well as OSX and Chrome OS. Moving the mouse pointer into the top-left corner of the screen brings up an application list similar to Gnome's launcher. The bottom-right corner reveals the settings panel. The top-right does nothing and the bottom-left, wonder of wonders, brings up my old favourite, the "kindly reminder".
I poked around in the settings a bit more but didn't really see anything of interest so I fired up what looks to be the last part of Deepin left for me to explore: the file manager. It does the job and it's not very interesting although I did discover that Deepin also has it's own terminal emulator (unsurprisingly called deepin-terminal) which has a snazzy Matrix theme to it but is otherwise uninteresting.
That's it, I'm bored. Next!
I tried Budgie and LXQT for a few minutes each at this point but they weren't immediately interesting enough to make me want to write about them just now :)
If you have a bunch of machines running OpenBSD for firewalling purposes, which is pretty standard, you might start to use source-control to maintain the rulesets. You might go further, and use some kind of integration testing to deploy changes from your revision control system into production.
Of course before you deploy any pf.conf file you need to test that the file contents are valid/correct. If your integration system doesn't run on OpenBSD though you have a couple of choices:
I looked at this last year and got pretty far, but then got distracted. So the other day I picked it up again. It turns out that if you're patient it's not hard to use bison to generate some C code, then glue it together such that you can validate your firewall rules on a Linux system.deagol ~/pf.ctl $ ./pfctl ./pf.conf ./pf.conf:298: macro 'undefined_variable' not defined ./pf.conf:298: syntax error
Unfortunately I had to remove quite a lot of code to get the tool to compile, which means that while some failures like that above are caught others are missed. The example above reads:vlans="{vlan1,vlan2}" .. pass out on $vlans proto udp from $undefined_variable
Unfortunately the following line does not raise an error:pass out on vlan12 inet proto tcp from <unknown> to $http_server port {80,443}
That comes about because looking up the value of the table named unknown just silently fails. In slowly removing more and more code to make it compile I lost the ability to keep track of table definitions - both their names and their values - Thus the fetching of a table by name has become a NOP, and a bogus name will result in no error.
Now it is possible, with more care, that you could use a hashtable library, or similar, to simulate these things. But I kinda stalled, again.
(Similar things happen with fetching a proto by name, I just hardcoded inet, gre, icmp, icmp6, etc. Things that I'd actually use.)
Might be a fun project for somebody with some time anyway! Download the OpenBSD source, e.g. from a github mirror - yeah, yeah, but still. CVS? No thanks! - Then poke around beneath sbin/pfctl/. The main file you'll want to grab is parse.y, although you'll need to setup a bunch of headers too, and write yourself a Makefile. Here's a hint:deagol ~/pf.ctl $ tree . ├── inc │ ├── net │ │ └── pfvar.h │ ├── queue.h │ └── sys │ ├── _null.h │ ├── refcnt.h │ └── tree.h ├── Makefile ├── parse.y ├── pf.conf ├── pfctl.h ├── pfctl_parser.h └── y.tab.c 3 directories, 11 files
Back in January 2011, I posted a brief note about a site hosted at the domain "ismycomputeroff.com". I have just had occasion to look again at that site and found that the domain is now definitely off. It is parked at sedo and is up for sale at the ludicrous price of 599 euros.
Tell you what, you can have my "theinternetisoff.net" domain for the bargain price of half that – after all, it only cost me about a tenner.
Tonight I read this weeks LWN quotes-page a little later than usual because I was busy at work for most of the day. Anyway as always LWNs content was awesome, and this particular list lead to an interesting discussion about a new Linux-Security-Module (LSM).
That read weirdly, what I was trying to say was that every Thursday morning I like to read LWN at work. Tonight is the first chance I had to get round to it.
One of the later replies in the thread was particularly interesting as it said:Suggestion: Create an security module that looks for the attribute security.WHITELISTED on things being executed/mmapped and denys it if the attribute isn't present. Create a program (whitelistd) that reads /etc/whitelist.conf and scans the system to ensure that only things on the list have the attribute.
So I figured that was a simple idea, and it didn't seem too hard even for myself as a non-kernel non-developer. There are several linux security modules included in the kernel-releases, beneath the top-level security/ directory, so I assumed I could copy & paste code around them to get something working.
During the course of all this work, which took about 90 minutes from start to Finnish (that pun never gets old), this online documentation was enormously useful:
If you're not familiar with the attr tool it's pretty simple. You can assign values to arbitrary labels on files. The only annoying thing is you have to use extra-flags to commands like rsync, tar, cp, etc, to preserve the damn things.
Set three attributes on the file named moi:$ touch moi $ attr -s forename -V "Steve" moi $ attr -s surname -V "Kemp" moi $ attr -s name -V "Steve Kemp" moi
Now list the attributes present:$ attr -l moi Attribute "name" has a 10 byte value for moi Attribute "forename" has a 5 byte value for moi Attribute "surname" has a 4 byte value for moi
And retrieve one?$ attr -q -g name moi Steve Kemp LSM Skeleton
My initial starting point was to create "steve_lsm.c", with the following contents:#include <linux/lsm_hooks.h> /* * Log things for the moment. */ static int steve_bprm_check_security(struct linux_binprm *bprm) { printk(KERN_INFO "STEVE LSM check of %s\n", bprm->filename); return 0; } /* * Only check exec(). */ static struct security_hook_list steve_hooks[] = { LSM_HOOK_INIT(bprm_check_security, steve_bprm_check_security), }; /* * Somebody set us up the bomb. */ static void __init steve_init(void) { security_add_hooks(steve_hooks, ARRAY_SIZE(steve_hooks), "steve"); printk(KERN_INFO "STEVE LSM initialized\n"); }
With that in place I had to modify the various KBuild files beneath security/ to make sure this could be selected as an LSM, and add in a Makefile to the new directory security/steve/.
With the boiler-plate done though, and the host machine rebooted into my new kernel it was simple to test things out.
Obviously the first step, post-boot, is to make sure that the module is active, which can be done in two ways, looking at the output of dmesg, and explicitly listing the modules available:~# dmesg | grep STEVE | head -n2 STEVE LSM initialized STEVE LSM check of /init $ echo $(cat /sys/kernel/security/lsm) capability,steve Making the LSM functional
The next step was to make the module do more than mere logging. In short this is what we want:
NOTE we don't care what the content of the extended attribute is, we just care whether it exists or not.
Reading the extended attribute is pretty simple, using the __vfs_getxattr function. All in all our module becomes this:#include <linux/xattr.h> #include <linux/binfmts.h> #include <linux/lsm_hooks.h> #include <linux/sysctl.h> #include <linux/ptrace.h> #include <linux/prctl.h> #include <linux/ratelimit.h> #include <linux/workqueue.h> #include <linux/string_helpers.h> #include <linux/task_work.h> #include <linux/sched.h> #include <linux/spinlock.h> #include <linux/lsm_hooks.h> /* * Perform a check of a program execution/map. * * Return 0 if it should be allowed, -EPERM on block. */ static int steve_bprm_check_security(struct linux_binprm *bprm) { // The current task & the UID it is running as. const struct task_struct *task = current; kuid_t uid = task->cred->uid; // The target we're checking struct dentry *dentry = bprm->file->f_path.dentry; struct inode *inode = d_backing_inode(dentry); // The size of the label-value (if any). int size = 0; // Root can access everything. if ( uid.val == 0 ) return 0; size = __vfs_getxattr(dentry, inode, "user.whitelisted", NULL, 0); if ( size >= 0 ) { printk(KERN_INFO "STEVE LSM check of %s resulted in %d bytes from 'user.whitelisted' - permitting access for UID %d\n", bprm->filename, size, uid.val ); return 0; } printk(KERN_INFO "STEVE LSM check of %s denying access for UID %d [ERRO:%d] \n", bprm->filename, uid.val, size ); return -EPERM; } /* * The hooks we wish to be installed. */ static struct security_hook_list steve_hooks[] = { LSM_HOOK_INIT(bprm_check_security, steve_bprm_check_security), }; /* * Initialize our module. */ void __init steve_add_hooks(void) { /* register ourselves with the security framework */ security_add_hooks(steve_hooks, ARRAY_SIZE(steve_hooks), "steve"); printk(KERN_INFO "STEVE LSM initialized\n"); }
Once again we reboot with this new kernel, and we test that the LSM is active. After the basic testing, as before, we can now test real functionality. By default no binaries will have the attribute we look for present - so we'd expect ALL commands to fail, unless executed by root. Let us test that:~# su - nobody -s /bin/sh No directory, logging in with HOME=/ Cannot execute /bin/sh: Operation not permitted
That looks like it worked. Let us allow users to run /bin/sh:~# attr -s whitelisted -V 1 /bin/sh
Unfortunately that fails, because symlinks are weird, but repeating the test with /bin/dash works as expected:~# su - nobody -s /bin/dash No directory, logging in with HOME=/ Cannot execute /bin/dash: Operation not permitted ~# attr -s whitelisted -V 1 /bin/dash ~# attr -s whitelisted -V 1 /usr/bin/id ~# su - nobody -s /bin/dash No directory, logging in with HOME=/ $ id uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup) $ uptime -su: 2: uptime: Operation not permitted
And our logging shows the useful results as we'd expect:STEVE LSM check of /usr/bin/id resulted in 1 bytes from 'user.WHITELISTED' - permitting access for UID 65534 STEVE LSM check of /usr/bin/uptime denying access for UID 65534 [ERRO:-95] Surprises
If you were paying careful attention you'll see that we changed what we did part-way through this guide.
Not sure what is going on there, but it was very confusing. It appears to be the case that when you set an attribute a secret user. prefix is added to the name.
Could be worth some research by somebody with more time on their hands than I have.
Anyway I don't expect this is a terribly useful module, but it was my first, and I think it should be pretty stable. Feedback on my code certainly welcome!
Here is my monthly update covering what I have been doing in the free software world (previous month):
Whilst anyone can inspect the source code of free software for malicious flaws, most software is distributed pre-compiled to end users.
The motivation behind the Reproducible Builds effort is to permit verification that no flaws have been introduced — either maliciously or accidentally — during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised.
(I have generously been awarded a grant from the Core Infrastructure Initiative to fund my work in this area.)
This month I:
I also made the following changes to our tooling:diffoscope
diffoscope is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues.
strip-nondeterminism is our tool to remove specific non-deterministic results from a completed build.
My activities as the current Debian Project Leader are covered in my "Bits from the DPL" email to the debian-devel-announce list.
However, I:
This month I have been paid to work 18 hours on Debian Long Term Support (LTS). In that time I did the following:
I also made the following non-maintainer uploads (NMUs):
I additionally filed 2 bugs for packages that access the internet during build against flower and r-bioc-gviz.
I also filed 6 FTBFS bugs against cronutils, isoquery, libgnupg-interface-perl, maven-plugin-tools, node-dateformat, password-store & simple-tpm-pk11.FTP Team
As a Debian FTP assistant I ACCEPTed 105 packages: boinc-app-eah-brp, debug-me, e-mem, etcd, fdroidcl, firejail, gcc-6-cross-ports, gcc-7-cross-ports, gcc-defaults, gl2ps, gnome-software, gnupg2, golang-github-dlclark-regexp2, golang-github-dop251-goja, golang-github-nebulouslabs-fastrand, golang-github-pkg-profile, haskell-call-stack, haskell-foundation, haskell-nanospec, haskell-parallel-tree-search, haskell-posix-pty, haskell-protobuf, htmlmin, iannix, libarchive-cpio-perl, libexternalsortinginjava-java, libgetdata, libpll, libtgvoip, mariadb-10.3, maven-resolver, mysql-transitional, network-manager, node-async-each, node-aws-sign2, node-bcrypt-pbkdf, node-browserify-rsa, node-builtin-status-codes, node-caseless, node-chokidar, node-concat-with-sourcemaps, node-console-control-strings, node-create-ecdh, node-create-hash, node-create-hmac, node-cryptiles, node-dot, node-ecc-jsbn, node-elliptic, node-evp-bytestokey, node-extsprintf, node-getpass, node-gulp-coffee, node-har-schema, node-har-validator, node-hawk, node-jsprim, node-memory-fs, node-pbkdf2, node-performance-now, node-set-immediate-shim, node-sinon-chai, node-source-list-map, node-stream-array, node-string-decoder, node-stringstream, node-verror, node-vinyl-sourcemaps-apply, node-vm-browserify, node-webpack-sources, node-wide-align, odil, onionshare, opensvc, otb, perl, petsc4py, pglogical, postgresql-10, psortb, purl, pymodbus, pymssql, python-decouple, python-django-rules, python-glob2, python-ncclient, python-parse-type, python-prctl, python-sparse, quoin-clojure, quorum, r-bioc-genomeinfodbdata, radlib, reprounzip, rustc, sbt-test-interface, slepc4py, slick-greeter, sparse, te923con, trabucco, traildb, typescript-types & writegood-mode.
I additionally filed 6 RC bugs against packages that had incomplete debian/copyright files against: libgetdata, odil, opensvc, python-ncclient, radlib and reprounzip.
I continued to be impressed with local vendors, found on 3dhubs. I've had several more things printed out, including an "internet button", and some card-holders for Settlers of Catan.
The most recent print I had made was a collection of display cases, for holding an OLED display, as well as an ESP8266 device.
Unfortunately at the same time as I was falling in love with the service I discovered a glaring XSS attack against the site itself.
Anybody who viewed my profile page could have arbitrary javascript executed, which in some cases would actually disclose their private details - such as:
Discovering this took minutes, writing it up took an hour, and a month later it is still unfixed.
I've deleted my account.
At around 22.30 last Monday, Manchester was subjected to an horrific attack at a pop concert. As the world now knows, a suicide bomber deliberately targeted young people and their friends and families as they were leaving a concert by the young pop singer Ariana Grande. In that attack, 22 people, including children as young as 8 years old lost their lives. Many, many more received life changing injuries.
This is the first confirmed suicide bombing attack in the UK since 7 July 2005. On that day, 12 years ago, I was working in London. I can vividly recall the aftermath of that attack. Shock, horror, disbelief, later turning to anger. But I also vividly recall the reactions of Londoners and visitors to London I met, talked to or simply listened to over the days that followed. Only a few days after the 7th I was travelling by bus to a meeting when quite unbidden a middle aged American couple, obviously tourists, told me and everyone else on the bus that they shared our pain and that they were praying for us. I am not a religious man, indeed, I have no faith whatsoever, but I was deeply moved by that couple's sincerity. Later, towards the end of July, my wife and I were travelling by Tube towards St Pancras on our way to Paris for our wedding anniversary. The driver of that Tube welcomed us (and everyone else) aboard the "up yours al-Qaeda express". This show of defiance in the face of horror actually raised a number of smiles from those around us. London survived, Londoners endured.
The citizens of Manchester are now all facing profound shock and grief. That shock and grief will also be felt by anyone who has any shred of humanity within them. London was bad – 52 people lost their lives in that series of co-ordinated attacks. But somehow, Manchester feels worse, much worse. The London bombers targeted morning Tube and bus travellers – mainly commuters, some of whom were late for work because of earlier rail disruption that day. They were a soft target. But the Manchester bombing was callously and deliberately aimed at the ultimate soft target – kids; youngsters and their families emerging from what should have been a wonderful night out. Kids simply enjoying themselves at a concert many would have been planning for and looking forward to for months. Ariane Grande's fanbase is primarily young women and girls. The attacker would have known that and yet he deliberately chose to detonate his bomb at that time and that place. He, and any accomplices he may have had, deserve nothing but our contempt. Manchester will survive, and Mancunians will endure. They have faced this before in the IRA truck bombing in June 1996. That attack didn't break them. This one won't either.
Meanwhile, everyone must grieve for the loss of so many young lives in such a pointless, pitiless attack. My thoughts, and those of my family, are with Manchester.
I run about 17 servers. Of those about six are very personal and the rest are a small cluster which are used for a single website. (Partly because the code is old and in some ways a bit badly designed, partly because "clustering!", "high availability!", "learning!", "fun!" - seriously I had a lot of fun putting together a fault-tolerant deployment with haproxy, ucarp, etc, etc. If I were paying for it the site would be both retired and static!)
I've started the process of upgrading to stretch by picking a bunch of hosts that do things I could live without for a few days - in case there were big problems, or I needed to restore from backups.
So far I've upgraded:
All upgrades were painless, with only one real surprise - the attic-backup software was removed from Debian.
Although I do intend to retry using Larss' excellent obnum in the near future pragmatically I wanted to stick with what I'm familiar with. Borg backup is a fork of attic I've been aware of for a long time, but I never quite had a reason to try it out. Setting it up pretty much just meant editing my backup-script:s/attic/borg/g
Once I did that, and created some new destinations all was good:email@example.com ~ $ borg init /backups/git.steve.org.uk.borg/ email@example.com ~ $ borg init /backups/master.steve.org.uk.borg/ email@example.com ~ $ ..
Upgrading other hosts, for example my website(s), and my email-box, will be more complex and fiddly. On that basis they will definitely wait for the formal stretch release.
But having a couple of hosts running the frozen distribution is good for testing, and to let me see what is new.
The past few weeks have been randomly busy, nothing huge has happened, but several minor diversions.Coding
I made a new release of my console-based mail-client, with integrated Lua scripting, this is available for download over at https://lumail.org/
I've also given a talk (!!) on using a literate/markdown configuration for GNU Emacs. In brief I created two files:
This contains both my configuration of GNU Emacs as well as documentation for the same. Neat.
This parse the previous file, specifically looking for "code blocks" which are then extracted and evaluated.
This system is easy to maintain, and I'm quite happy with it :)Fuzzing
Somebody nice took the time to report a couple of bugs against my simple bytecode-intepretting virtual-machine project - all found via fuzzing.
I've done some fun fuzzing of my own in the past, so this was nice to see. I've now resolved those bugs, and updated the README.md file to include instructions on fuzzing it. (Which I started doing myself, after receiving the first of the reports )
Finally I have more personal news too: I had a pair of CT-scans carried out recently, and apparently here in sunny Finland (that's me being ironic, it was snowing in the first week of May) when you undergo a CT-scan you can pay to obtain your data on CD-ROM.
I'm 100% definitely going to get a copy of my brain-scan data. I'll be able to view a 3d-rendered model of my own brain on my desktop. (Once upon a time I worked for a company that produced software, sold to doctors/surgeons, for creating 3d-rendered volumes from individual slices. I confirmed with the radiologist that handled my tests that they do indeed use the standard DICOM format. Small world.)
The following contributors got their Debian Developer accounts in the last two months:
The following contributors were added as Debian Maintainers in the last two months:
With the passage into law of the iniquitous Investigatory Powers (IP) Bill in the UK at the end of November last year, it is way past time for all those who care about civil liberties in this country to exercise their right to privacy.
The new IP Act permits HMG and its various agencies to surveil the entire online population. The Act actually formalises (or in reality, legalises) activity which has long gone on in this country (as in others) in that it gives LEAs and others a blanket right of surveillance.
The Act (PDF) itself states that it is:
"An Act to make provision about the interception of communications, equipment interference and the acquisition and retention of communications data, bulk personal datasets and other information; to make provision about the treatment of material held as a result of such interception, equipment interference or acquisition or retention; to establish the Investigatory Powers Commissioner and other Judicial Commissioners and make provision about them and other oversight arrangements; to make further provision about investigatory powers and national security; to amend sections 3 and 5 of the Intelligence Services Act 1994; and for connected purposes."
(Don't you just love the "connected purposes" bit?)
The Open Rights Group says the Act:
"is one of the most extreme surveillance laws ever passed in a democracy. Its impact will be felt beyond the UK as other countries, including authoritarian regimes with poor human rights records, will use this law to justify their own intrusive surveillance regimes."
Liberty, which believes the Act breeches the public's rights under the Human Rights Act, is challenging the Act through the Courts. That organisation says:
"Liberty will seek to challenge the lawfulness of the following powers, which it believes breach the public's rights:
– Bulk hacking – the Act lets police and agencies access, control and alter electronic devices like computers, phones and tablets on an industrial scale, regardless of whether their owners are suspected of involvement in crime – leaving them vulnerable to further attack by hackers.
– Bulk interception – the Act allows the state to read texts, online messages and emails and listen in on calls en masse, without requiring suspicion of criminal activity.
– Bulk acquisition of everybody's communications data and internet history – the Act forces communications companies and service providers to hand over records of everybody's emails, phone calls and texts and entire web browsing history to state agencies to store, data-mine and profile at its will.
This provides a goldmine of valuable personal information for criminal hackers and foreign spies.
– "Bulk personal datasets" – the Act lets agencies acquire and link vast databases held by the public or private sector. These contain details on religion, ethnic origin, sexuality, political leanings and health problems, potentially on the entire population – and are ripe for abuse and discrimination."
ProtonMail, a mail provider designed and built by "scientists, engineers, and developers drawn together by a shared vision of protecting civil liberties online." announced on Thursday 19 January that they will be providing access to their email service via a Tor onion site, accessible only over the Tor anonymising network. The ProtonMail blog entry announcing the new service says:
"As ProtonMail has evolved, the world has also been changing around us. Civil liberties have been increasingly restricted in all corners of the globe. Even Western democracies such as the US have not been immune to this trend, which is most starkly illustrated by the forced enlistment of US tech companies into the US surveillance apparatus. In fact, we have reached the point where it simply not possible to run a privacy and security focused service in the US or in the UK.
At the same time, the stakes are also higher than ever before. As ProtonMail has grown, we have become increasingly aware of our role as a tool for freedom of speech, and in particular for investigative journalism. Last fall, we were invited to the 2nd Asian Investigative Journalism Conference and were able to get a firsthand look at the importance of tools like ProtonMail in the field.
Recently, more and more countries have begun to take active measures to surveil or restrict access to privacy services, cutting off access to these vital tools. We realize that censorship of ProtonMail in certain countries is not a matter of if, but a matter of when. That's why we have created a Tor hidden service (also known as an onion site) for ProtonMail to provide an alternative access to ProtonMail that is more secure, private, and resistant to censorship."
So, somewhat depressingly, the UK is now widely seen as a repressive state, willing to subject its citizens to a frighteningly totalitarian level of surveillance. Personally I am not prepared to put up with this without resistance.
Snowden hype notwithstanding, HMG does not have the resources to directly monitor all electronic communications traffic within the UK or to/from the UK, so it effectively outsources that task to "communications providers" (telcos for telephony and ISPs for internet traffic). Indeed, the IP act is intended, in part, to force UK ISPs to retain internet connection records (ICRs) when required to do so by the Home Secretary. In reality, this means that all the major ISPs, who already have relationships with HMG of various kinds, will be expected to log all their customer's internet connectivity and to retain such logs for so long as is deemed necessary under the Act. The Act then gives various parts of HMG the right to request those logs for investigatory purposes.
Given that most of us now routinely use the internet for a vast range of activity, not limited just to browsing websites, but actually transacting in the real world, this is akin to requiring that every single library records the book requests of its users, every single media outlet (newsagents, bookshops, record shops etc.) records every purchase in a form traceable back to the purchaser, every single professional service provider (solicitors, lawyers, doctors, dentists, architects, plumbers, builders etc.) record all activity by name and address of visitor. All this on top of the already existing capability of of HMG to track and record every single person, social media site or organisation we contact by email or other form of messaging.
Can you imagine how you would feel if on every occasion you left your home a Police Officer (or in fact officials from any one of 48 separate agencies, including such oddities as the Food Standards Agency, the NHS Business Services Authority or the Gambling Commission) had the right, without a warrant or justifiable cause, to stop you and search you so that (s)he could read every piece of documentation you were carrying? How do you feel about submitting to a fishing trip through your handbag, briefcase, wallet or pockets?
I have no problem whatsoever with targeted surveillance, but forgive me if I find the blanket unwarranted surveillance of the whole populace, on the off-chance it might be useful, completely unacceptable. What happened to the right to privacy and the presumption of innocence in the eyes of the law? The data collected by ISPs and telcos under the IP act gives a treasure trove of information on UK citizens that the former East German Stasi could only have dreamed about.
Now regardless of whether or not you trust HMG to use this information wisely, and only for the reasons laid out under the Act, and only in the strict circumstances laid out in the Act, and only with the effective scrutiny of "independent" oversight, how confident are you that any future administration would be similarly wise and circumspect? What is to stop a future, let us suppose, less enlightened or liberal administration, misusing that data? What happens if in future some act which is currently perfectly legal and permissible, if of somewhat dubious taste, morality and good sense (such as, say, reading the Daily Mail online) were to become illegal? What constraint would there be to prevent a retrospective search for past consumers of such dubious material in order to flag them as "persons of interest"?
And even if you are comfortable with all of that, how comfortable are you with the idea that organised crime could have access to all your personal details? Given the aggregation of data inherent in the requirement for bulk data collection by ISPs, those datasets become massive and juicy targets for data theft (by criminals as as well as foreign nations states). And if you think that could not happen because ISPs and Telcos take really, really, really good care of their customer's data, then think about TalkTalk or Plusnet or Three or Yahoo.
And they are just a few of the recent ones that we /know/ about.
So long as I use a UK landline or mobile provider for telephony, there is little I can do about the aggregation of metadata about my contacts (and if you think metadata aggregation doesn't matter, take a look at this EFF note. I can, of course, and do, keep a couple of (cash) pre-paid SIM only mobile 'phones handy – after all, you never know when you may need one (such as perhaps, in future when they become "difficult" to purchase). And the very fact that I say that probably flags me as suspicious in some people's minds. (As an aside, ask yourself what comes to mind when you think about someone using a cash paid, anonymous, second hand mobile 'phone. See? I must be guilty of something. Notice how pernicious suspicion becomes? Tricky isn't it?) Nor can I do much about protecting my email (unless I use GPG, but that is problematic and in any case does not hide the all important metadata in the to/from/date/subject headers). Given that, I have long treated email just as if it were correspondence by postcard, though somewhat less private. For some long time I used to routinely GPG sign all my email. I have stopped doing that because the signatures meant, of course, that I had no deniability. Nowadays I only sign (and/or encrypt) when I want my correspondents to be sure I am who I say I am (or they want that reassurance).
But that does not mean I think I should just roll over and give up. There is plenty I can do to protect both myself and my immediate family from unnecessary, intrusive, unwarranted and unwanted snooping. For over a year now I have been using my own XMPP server in place of text messaging. I have had my own email server for well over a decade, and so long as I am conversing there with others on one of my domains served by that system, then that email is pretty private too (protected in transit by TLS using my own X509 certificates). My web browsing has also long been protected by Tor. But all that still leaves trails I don't like leaving. I might, for example, not want my ISP to even know that I am using Tor, and in the case of my browsing activity it becomes problematic to protect others in my household or to cover all the multiple devices we now have which are network connected (I've actually lost count and would have to sit down and list them carefully to be sure I had everything covered).
What to do? The obvious solution is to wrap all my network activity in a VPN tunnel through my ISP's routers before I hit the wider internet. That way my ISP can't log anything beyond the fact that I am using a VPN. But which VPN to use? And should I go for a commercial service or roll my own? Bear in mind that not all VPNs are created equal, nor are they all necessarily really private or secure. The "P" in VPN refers to the ability to interconnect two separate (probably RFC 1918) private networks across a public untrusted network. It does not actually imply anything about the end user's privacy. And depending upon the provider chosen and the protocols used, end user privacy may be largely illusory. In the worst case scenario, depending upon the jurisdiction in which you live and your personal threat model, a badly chosen VPN provider may actually reduce privacy by drawing attention to the fact that you value that privacy. (As an aside, using Tor can also have much the same effect. Indeed, there is plenty of anecdotal evidence to suggest that Tor usage lights you up like a christmas tree in the eyes of the main GPAs.)
Back in 2015, a team of researchers from the Sapienza University of Rome and Queen Mary University of London published a paper (PDF) entitled "A Glance through the VPN Looking Glass: IPv6 Leakage and DNS Hijacking in Commercial VPN clients". That paper described the researcher's findings from a survey of 14 of the better known commercial VPN providers. The teams chose the providers in much the same way you or I might do so – they searched on-line for "best VPN" or "anonymous VPN" and chose the providers which came highest or most frequently in the search results. The paper is worth reading. It describes how a poor choice of provider could lead to significant traffic leakage, typically through IPV6 or DNS. The table below is taken from their paper.
The paper describes some countermeasures which may mitigate some of the problems. In my case I disable IPV6 at the router and apply firewall rules at both the desktop and VPS end of the tunnel to deny IPV6. My local DNS resolver files point to the OpenVPN endpoint (where I run a DNS resolver stub) for resolution and both that server and my local DNS resolvers (dnsmasq) point only to opennic DNS servers. It may help.
There are reports that usage of commercial VPN providers has gone up since the passage of the IP act. Many commercial VPN providers will be using the passage of the act as a potential booster for their services. And there are plenty of VPN providers about – just do what the Sapienza and Queen Mary researchers did and search for "VPN Provider" or "VPN services" to get lots of different lists, or take a look at lists provided by such sites as PrivacyTools or BestVPN. One useful point about the better commercial providers is that they usually have substantial infrastructure in place offering VPN exit points in various geographic locations. This can be particularly useful if you want to appear to be based in a particular country. Our own dear old BBC for example will block access to some services if you are not UK based (or if you are UK based and try to access services designed for overseas users). This can be problematic for UK citizens travelling overseas who wish to view UK services. A VPN with a UK exit gets around that problem. VPN users can also use local exits when they wish to access similarly (stupidly) protected services in foreign locales (the idiots in the media companies who are insistent on DRM in all its manifest forms are becoming more than just tiresome).
Some of the commercial services look better than others to me, but they all have one simple flaw as far as I am concerned. I don't control the service. And no matter what the provider may say about "complete anonymity" (difficult if you want to pay by credit card) or "no logs", the reality is that either there will be logs or the provider may be forced to divulge information by law. And don't forget the problem of traffic leakage through IPV6 or DNS noted above. One further problem for me in using a commercial VPN provider rather than my own endpoint(s) is that I cannot then predict my apparent source IP address. This matters to me because my firewall rules limit ssh access to my various servers by source IP address. If I don't know the IP address I am going to pop out on, then I'm going to have to relax that rule. I choose not to. I have simply amended my iptables rules to permit access from all my VPN endpoints.
The goldenfrog site has an interesting take on VPN anonymity. (Note that Goldenfrog market their own VPN service called "VyprVPN" so they are not entirely disinterested observers, but the post is still worth reading nevertheless). If you are simply concerned with protecting your privacy whilst browsing the net, and you are not concerned about anonymity then there may be a case for you to consider using a commercial provider – just don't pick a UK company because they will be subject to lawful intercept requests under the IP act. Personally I'd shy away from US based companies too, (a view that is shared by PrivacyTools.io so it's not just me). I would also only pick a provider which supports OpenVPN (or possibly SoftEther) in preference to less secure protocols such as PPTP, or L2TP. (For a comparison of the options, see this BestVPN blog post.
If you wish to use a commercial VPN provider, then I would strongly recommend that you pay for it – and check the contractual arrangements carefully to ensure that they match your requirements. I suggest this for the same reasons I recommend that you pay for an email service. You get a contract. In my view, using a free VPN service might be worse than using no VPN. Think carefully about the business model for free provision of services on the 'net. Google is a good example of the sort of free service provider which I find problematic. Using a commercial, paid for, VPN service has the distinct advantage that the provider has a vested interest in keeping his clients' details, and activity, private. After all, his business depends upon that. Trust is fragile and easily lost. If your business is predicated on trustworthiness then I would argue that you will (or should) work hard to maintain that trust. PrivacyTools has a good set of recommendations for VPN providers.
But what if, like me, you are still unsure about using a commercial VPN? Should you use your own setup (as I do)? Here are some things to think about.
Using a commercial VPN
For Against Probably easier than setting up OpenVPN on a self-managed VPS for most people. The service provider will usually offer configuration files aimed at all the most popular operating systems. In many cases you will get a "point and click" application interface which will allow you to select the country you wish to pop out in. "Easier" does not mean "safer". For example, the VPN provider may provide multiple users with the same private key wrapped up in its configuration files. Or the provider may not actually use OpenVPN. The provider may not offer support for YOUR chosen OS, or YOUR router. Beware in particular of "binary blob" installation of VPN software or configuration files (this applies particularly to Windows users). Unless you are technically competent (which you may not be if you are relying on this sort of installation) then you have no idea what is in that binary installation. You get a contract (if you pay!) That contract may not be as strong as you might wish, or it might specifically exclude some things you might wish to see covered. Check the AUP before you select your provider. You get what you pay for. Management and maintenance of the service (e.g. software patching) is handled by the provider. You rely on the provider to maintain a secure, up to date, fully patched service. Again, you get what you pay for. The provider (should) take your security and privacy seriously. Their business depends on it. The provider may hold logs, or be forced to log activity if local LE require that. They may also make simple mistakes which leak evidence of your activity (is their DNS secure?)
The VPN service is a large, attractive, juicy target for hostile activity by organised crime and/or Global Passive Adversaries such as GCHQ and NSA. Consider your threat model and act accordingly.Your network activity is "lost" in the noise of activity of others. But your legal and legitimate activity could provide "cover" for criminal activity of others. If this results in LEA seizure (or otherwise surveillance) of the VPN endpoint then your activity is swept up in the investigation. Are you prepared for the possible consequences of that? You should get "unlimited" bandwidth (if you pay for it). But you may have to trade that off for reduced access speed, particularly if you are in contention for network usage with a large number of other users You (may) be able to set up the account completely anonymously using bitcoin. Using a VPN provider cannot guarantee you are anonymous. All it can do is enhance your privacy. Do not rely on a VPN to hide illegal activity. (And don't rely on Tor for that either!) You may be able to select from a wide range of exit locations depending upon need. "Most VPN providers are terrible"
Using your own VPN
For Against You get full control over the protocol you use, the DNS servers you use, the ciphers you choose and the location(s) you pop up in. You have to know what you are doing and you have to be comfortable in configuring the VPN software. Moreover, you need to be sure that you can actually secure the server on which you install the VPN server software as well as the client end. There is no point in having a "secure" tunnel if the end server leaks like a sieve or is subject to surveillance by the server provider – you have just shifted surveillance from the UK ISP to someone else. It can be cheaper than using a commercial service. It may not be. If you want to be able to pop out in different countries you will have to pay for multiple VPSs in multiple datacentres. You will also be responsible for maintaining those servers. You can be confident that your network activity is actually private because you can enforce your own no logging policy. No you can't be sure. The VPS provider may log all activity. Check the privacy policy carefully. And be aware that the provider of a 3 euro a month VPS is very likely to dump you in the lap of any LEA who comes knocking on the door should you be stupid enough to use the VPN for illegal activity (or even any activity which breaches their AUP).
Also bear in mind the fact that you have no plausible deniability through hiding in a lot of other's traffic if you are the only user of the VPN – which you paid for with your credit card.
I've used OpenVPN quite a lot in the past. I like it, it has a good record for privacy and security, it is relatively easy to set up, and it is well supported on a range of different devices. I have an OpenVPN endpoint on a server on the outer screened subnet which forms part of my home network so that I can connect privately to systems when I am out and about and wish my source IP to appear to be that at my home address. This can be useful when I am stuck in such places as airport lounges, internet cafes, foreign (or even domestic) hotels etc. So when the IP Act was still but a gleam in the eyes of some of our more manic lords and masters, I set up one or two more OpenVPN servers on various VPSs I have dotted about the world. In testing, I've found that using a standard OpenVPN setup (using UDP as the transport) has only a negligible impact on my network usage – certainly much less than using Tor.
Apart from the privacy offered by OpenVPN, particularly when properly configured to use forward secrecy as provided by TLS (see gr3t for some tips on improving security in your configuration), we can also make the tunnel difficult to block. We don't (yet) see many blanket attempts to block VPN usage in the UK, but in some other parts of the world, notably China or reportedly the UAE for example, such activity can be common. By default OpenVPN uses UDP as the transport protocol and the server listens on port 1194. This well known port and/or protocol combination could easily be blocked at the network level. Indeed, some hotels, internet cafes and airport lounges routinely (and annoyingly) block all traffic to ports other than 80 and 443. If, however, we reconfigure OpenVPN to use TCP as the transport and listen on port 443, then its traffic becomes indistinguishable from HTTPS which makes blocking it much more difficult. There is a downside to this though. The overhead of running TCP over TCP can degrade your network experience. That said however, in my view a slightly slower connection is infinitely preferable to no connection or an unprotected connection.
In my testing, even using Tor over the OpenVPN tunnel (so that my Tor entry point appears to the Tor network to be the OpenVPN endpoint) didn't degrade my network usage too much. This sort of Tor usage is made easier by the fact that I run my Tor client (either Tails, or Whonix) from within a virtual server instance running on one of my desktops. Thus if the desktop is connected to an OpenVPN tunnel then the Tor client is forced to use that tunnel to connect to Tor and thence the outside world.
However, this set up has a few disadvantages, not least the fact that I might forget to fire up the OpenVPN tunnel on my desktop before starting to use Tor. But the biggest problem I face in running a tunnel from my desktop is that it only protects activity /from/ that desktop. Any network connections from any of my mobile devices, my laptops, my various servers, or other network connected devices (as I said, I have lost count) or most importantly, my family's devices, are perforce unprotected unless I can set up OpenVPN clients on them. In some cases this may be possible (my wife's laptop for example) but it certainly isn't ideal and in many cases (think my kid's 'phones for example) it is going to be completely impractical. So the obvious solution is to move the VPN tunnel entry point to my domestic router. That way, /all/ traffic to the net will be forced over the tunnel.
When thinking about this, Initially I considered using a raspberry pi as the router but my own experience of the pi's networking capability left me wondering whether it would cope with my intended use case. The problem with the pi is that it only has one ethernet port and its broadcom chip only supports USB 2.0 connection. Internally the pi converts ethernet to USB. Since the chip is connected to four USB external ports and I would need to add a USB to ethernet conversion externally as well as USB wifi dongle in order to get the kind of connectivity I want (which includes streaming video) I fear that I might overwhelm the pi – certainly I'm pretty sure the device might become a bottleneck. However, I have /not/ tested this (yet) so I have no empirical evidence either way.
My network is already segmented in that I have a domestic ADSL router connected to my ISP and a separate, internal ethernet/WiFi only router connecting to that external router. It looks (something) like this:
Since all the devices I care most about are inbound of the internal router (and wired rather than wifi where I really care) I can treat the network between the two devices as a sacrificial screened subnet. I consider that subnet to be almost as hostile as the outside world. I could therefore add the pi to the external screened net and thus create another separate internal network which is wifi only. That wouldn't help with my wired devices (which tend to be the ones I really worry about) but it would give me a good test network which I could use as "guest only" access to the outside world. I have commented in the past about the etiquette of allowing guests access to my network. I currently force such access over my external router so that the guests don't get to see my internal systems. However, that means that in future they won't get the protection offered by my VPN. That doesn't strike me as fair so I might yet set up a pi as described (or in fact add another router, they are cheap enough).
Having discounted the pi as a possibility, then another obvious solution would be re-purpose an old linux box (I have plenty) but that would consume way more power than I need to waste and looks to be overkill so the obvious solution is to stick with the purpose built router option. Now both OpenWrt or its fork LEDE and the more controversial DD-WRT offer the possibility of custom built routers with OpenVPN client capability built in. The OpenWrt wiki has a good description of how to set up OpenVPN. The DD-WRT wiki entry somewhat is less good, but then OpenWrt/LEDE would probably be a better choice in my view anyway. I've used OpenWrt in the past (on an Asus WL-500g) but found it a bit flaky. Possibly that is a reflection of the router I used (fairly old, bought cheap off ebay) and I should probably try again with a more modern device. But right now it is possible to buy new, capable SOHO routers with OpenVPN capability off the shelf. A quick search for "openvpn routers" will give you devices by Asus, Linksys, Netgear, Cisco or some really interesting little devices by GL Innovations. The Gli devices actually come with OpenWRT baked in and both the GL-MT300N and the slightly better specced GL-AR300M look to be particularly useful. I leave the choice of router to you, but you should be aware that many SOHO routers have lamentably poor security out of the box and even worse security update histories. You also need to bear in mind that VPN capability is resource intensive so you should choose the device with the fastest CPU and most RAM you can afford. I personally chose an Asus device as my VPN router (and yes, it is patched to the latest level….) simply because they are being actively audited at the moment and seem to be taking security a little more seriously than some of their competitors. I may yet experiment with one of the GL devices though.
Note here that I do /not/ use the OpenVPN router as the external router connected directly to my ISP, my new router replaced my old "inside net" router. This means that whilst all the connections I really care about are tunnelled over the OpenVPN route to my endpoint (which may be in one of several European datacentres depending upon how I feel) I can still retain a connection to the outside world which is /not/ tunnelled. There are a couple of reasons for this. Firstly some devices I use actually sometimes need a UK IP presence (think streaming video from catch-up TV or BBC news for example). Secondly, I also wish to retain a separate screened sub-net to house my internal OpenVPN server (to allow me to appear to be using my home network should I so choose when I'm out and about). And of course I may occasionally just like to use an unprotected connection simply to give my ISP some "noise" for his logs….
So, having chosen the router, we now need to configure it to use OpenVPN in client mode. My router can also be configured as a server, so that it would allow incoming tunnelled connections from the outside to my network, but I don't want that, and nor probably do you. In my case such inbound connections would in any event fail because my external router is so configured as to only allow inbound connections to a webserver and my (separate) OpenVPN server on the screened subnet. It does not permit any other inbound connections, nor does my internal router accept connections from either the outside world or the screened subnet. My internal screened OpenVPN server is configured to route traffic back out to the outside world because it is intended only for such usage.
My new internal router expects its OpenVPN configuration file to follow a specific format. I found this to be poorly documented (but that is not unusual). Here's how mine looks (well, not exactly for obvious reasons, in particular the (empty) keys are not real, but the format is correct).
# config file for router to VPN endpoint 1
dev tun
proto udp
remote 184.108.40.206 1194
resolv-retry infinite
user nobody
# Asus router can't cope with group change so:
# group nogroup
—–BEGIN OpenVPN Static key V1—–
—–END OpenVPN Static key V1—–
key-direction 1
auth SHA512
remote-cert-tls server
cipher AES-256-CBC
# end configuration
If you are using a commercial VPN service rather than your own OpenVPN endpoint, then your provider should give you configuration files much like those above. As I mentioned earlier, beware of "binary blob" non-text configurations.
If your router is anything like mine, you will need to upload the configuration file using the administrative web interface and then activate it. My router allows several different configurations to be stored so that I can vary my VPN endpoints depending on where I wish to pop up on the net. Of course this means that I have to pay for several different VPSs to run OpenVPN on, but at about 3 euros a month for a suitable server, that is not a problem. I choose providers who:
Whilst this may appear at first sight to be problematic, there are in fact a large number of such providers dotted around Europe. Be aware, however, that many small providers are simply resellers of services provided by other, larger, companies. This can mean that whilst you appear to be using ISP "X" in, say, Bulgaria, you are actually using servers owned and managed by a major German company or at least are on networks so owned. Be careful and do your homework before signing up to a service. I have found the lowendtalk site very useful for getting leads and for researching providers. The lowendbox website is also a good starting point for finding cheap deals when you want to test your setup.
Now go take back your privacy.
Some of the sites I found useful when considering my options are listed below.
Check your IP address and the DNS servers you are using at check2ip.com
Also check whether you are leaking DNS requests outside the tunnel at ipleak.net.
You can also check for DNS leakage at dnsleaktest.
PrivacyTools.io is a very useful resource – and not just for VPN comparisons
cryptostorm.is/ and Mullvad.net look to be two of the better paid for commercial services.
TheBestVPN site offers a VPN Comparison and some reviews of 20 providers.
A very thorough comparison of 180 different commercial VPN providers is given by "that one privacy guy". The rest of his (or her) site is also well worth exploring.
Brian Krebs discusses VPN options.
This is a final reminder: if you intend to apply for a DebConf17 bursary and have not yet done so, please proceed as soon as possible.
Bursary applications for DebConf17 will be accepted until May 10th at 23:59 UTC. Applications submitted after this deadline will not be considered.
You can apply for a bursary when you register for the conference.
Remember that giving a talk is considered towards your bursary; if you have a submission to make, submit it even if it is only sketched-out. You will be able to detail it later.
Please make sure to double-check your accommodation choices (dates and venue). Details about accommodation arrangements can be found on the wiki.
Note: For DebCamp we only have on-site accommodation available. The option chosen in the registration system will only be for the DebConf period (August 5 to 12).
See you in Montréal!
Recently Rob and I visited Soile and Lars. We had a lovely time wandering around Helsinki with them, and I also spent a good chunk of time with Lars working on some design and planning for the Yarn test specification and tooling. You see, I wrote a Rust implementation of Yarn called rsyarn "for fun" and in doing so I noted a bunch of missing bits in the understanding Lars and I shared about how Yarn should work. Lars and I filled, and re-filled, a whiteboard with discussion about what the 'Yarn specification' should be, about various language extensions and changes, and also about what functionality a normative implementation of Yarn should have.
This article is meant to be a write-up of all of that discussion, but before I start on that, I should probably summarise what Yarn is.
Yarn is a mechanism for specifying tests in a form which is more like documentation than code. Yarn follows the concept of BDD story based design/testing and has a very Cucumberish scenario language in which to write tests. Yarn takes, as input, Markdown documents which contain code blocks with Yarn tests in them; and it then runs those tests and reports on the scenario failures/successes.
As an example of a poorly written but still fairly effective Yarn suite, you could look at Gitano's tests or perhaps at Obnam's tests (rendered as HTML). Yarn is not trying to replace unit testing, nor other forms of testing, but rather seeks to be one of a suite of test tools used to help validate software and to verify integrations. Lars writes Yarns which test his server setups for example.
As an example, lets look at what a simple test might be for the behaviour of the /bin/true tool:SCENARIO true should exit with code zero WHEN /bin/true is run with no arguments THEN the exit code is 0 AND stdout is empty AND stderr is empty
Anyone ought to be able to understand exactly what that test is doing, even though there's no obvious code to run. Yarn statements are meant to be easily grokked by both developers and managers. This should be so that managers can understand the tests which verify that requirements are being met, without needing to grok python, shell, C, or whatever else is needed to implement the test where the Yarns meet the metal.
Obviously, there needs to be a way to join the dots, and Yarn calls those things IMPLEMENTS, for example:IMPLEMENTS WHEN (\S+) is run with no arguments set +e "${MATCH_1}" > "${DATADIR}/stdout" 2> "${DATADIR}/stderr" echo $? > "${DATADIR}/exitcode"
As you can see from the example, Yarn IMPLEMENTS can use regular expressions to capture parts of their invocation, allowing the test implementer to handle many different scenario statements with one implementation block. For the rest of the implementation, whatever you assume about things will probably be okay for now.
Given all of the above, we (Lars and I) decided that it would make a lot of sense if there was a set of Yarn scenarios which could validate a Yarn implementation. Such a document could also form the basis of a Yarn specification and also a manual for writing reasonable Yarn scenarios. As such, we wrote up a three-column approach to what we'd need in that test suite.
Firstly we considered what the core features of the Yarn language are:
We considered unusual (or corner) cases and which of them needed defining in the short to medium term:
All of this comes down to how to interpret input to a Yarn implementation. In addition there were a number of things we felt any "normative" Yarn implementation would have to handle or provide in order to be considered useful. It's worth noting that we don't specify anything about an implementation being a command line tool though...
There's bound to be more, but right now with the above, we believe we have two roughly conformant Yarn implementations. Lars' Python based implementation which lives in cmdtest (and which I shall refer to as pyyarn for now) and my Rust based one (rsyarn).
One thing which rsyarn supports, but pyyarn does not, is running multiple scenarios in parallel. However when I wrote that support into rsyarn I noticed that there were plenty of issues with running stuff in parallel. (A problem I'm sure any of you who know about threads will appreciate).
One particular issue was that scenarios often need to share resources which are not easily sandboxed into the ${DATADIR} provided by Yarn. For example databases or access to limited online services. Lars and I had a good chat about that, and decided that a reasonable language extension could be:USING database foo
with its counterpartRESOURCE database (\S+) LABEL database-$1 GIVEN a database called $1 FINALLY database $1 is torn down
The USING statement should be reasonably clear in its pairing to a RESOURCE statement. The LABEL statement I'll get to in a moment (though it's only relevant in a RESOURCE block, and the rest of the statements are essentially substituted into the calling scenario at the point of the USING.
This is nowhere near ready to consider adding to the specification though. Both Lars and I are uncomfortable with the $1 syntax though we can't think of anything nicer right now; and the USING/RESOURCE/LABEL vocabulary isn't set in stone either.
The idea of the LABEL is that we'd also require that a normative Yarn implementation be capable of specifying resource limits by name. E.g. if a RESOURCE used a LABEL foo then the caller of a Yarn scenario suite could specify that there were 5 foos available. The Yarn implementation would then schedule a maximum of 5 scenarios which are using that label to happen simultaneously. At bare minimum it'd gate new users, but at best it would intelligently schedule them.
In addition, since this introduces the concept of parallelism into Yarn proper, we also wanted to add a maximum parallelism setting to the Yarn implementation requirements; and to specify that any resource label which was not explicitly set had a usage limit of 1.
Once we'd discussed the parallelism, we decided that once we had a nice syntax for expanding these sets of statements anyway, we may as well have a syntax for specifying scenario language expansions which could be used to provide something akin to macros for Yarn scenarios. What we came up with as a starter-for-ten was:CALLING write foo
paired withEXPANDING write (\S+) GIVEN bar WHEN $1 is written to THEN success was had by all
Again, the CALLING/EXPANDING keywords are not fixed yet, nor is the $1 type syntax, though whatever is used here should match the other places where we might want it.
Finally we discussed multi-line inputs in Yarn. We currently have a syntax akin to:GIVEN foo ... bar ... baz
which is directly equivalent to:GIVEN foo bar baz
and this is achieved by collapsing the multiple lines and using the whitespace normalisation functionality of Yarn to replace all whitespace sequences with single space characters. However this means that, for example, injecting chunks of YAML into a Yarn scenario is a pain, as would be including any amount of another whitespace-sensitive input language.
After a lot of to-ing and fro-ing, we decided that the right thing to do would be to redefine the ... Yarn statement to be whitespace preserving and to then pass that whitespace through to be matched by the IMPLEMENTS or whatever. In order for that to work, the regexp matching would have to be defined to treat the input as a single line, allowing . to match \n etc.
Of course, this would mean that the old functionality wouldn't be possible, so we considered allowing a \ at the end of a line to provide the current kind of behaviour, rewriting the above example as:GIVEN foo \ bar \ baz
It's not as nice, but since we couldn't find any real uses of ... in any of our Yarn suites where having the whitespace preserved would be an issue, we decided it was worth the pain.
None of the above is, as of yet, set in stone. This blog posting is about me recording the information so that it can be referred to; and also to hopefully spark a little bit of discussion about Yarn. We'd welcome emails to our usual addresses, being poked on Twitter, or on IRC in the common spots we can be found. If you're honestly unsure of how to get hold of us, just comment on this blog post and I'll find your message eventually.
Hopefully soon we can start writing that Yarn suite which can be used to validate the behaviour of pyyarn and rsyarn and from there we can implement our new proposals for extending Yarn to be even more useful.
WYLUG has not any specific plans for an activity,but if you meet any of us, be sure to give us a wave.
Due to some last minute hassle it seems that we will not be having a meeting this month and will be making up for it by having two next month.
This month we are meeting on the Last Wednesday of the Month instead of the last Thursaday. Same time, same place, look for a group of us round a laptop(s) in the Lord Darcy at ~7:30pm
Its that time of the month again when jolly good chaps and chapesses visit the Lord Darcy to discuss and exhibit GNU/Linux. We hope to solve eachothers problems about that sort of thing, sometimes just by saying "Its supposed to do that", but not quite always. Look for a group of people talking animatedly round a laptop. Thats Thurs 23 FEB at 7~7:30ish
If you want your 15 minutes of fame, just post your report of January's meeting on the wylug-discuss mailing list. If you have not already joined now is a fine time to do so. Just follow the link from our home page.


text:
ActionScript Graphic Cookbook
Backx, Peter and Gélineau, Dominic
2012, Packt Publishing
This is a cookbook, a book of recipes; it is not a reference or teaching book; you will not have a comprehensive library at the end. This book give specific solutions to specific needs. A teaching book might show a finished chart with call-outs explaining how to create or configure the pieces, but a recipe is not an analysis: it starts with the least foundation it can and works towards a finished graphic. This book will show you how to create graphic representations of data; it will not tell you when to use a particular technique.
It is also not a users' manual for the Data Visualization chart library from Adobe, although the recipes in the middle of the book use that library. For simple line charts (e.g. sparklines), the recipe describes how to draw the lines oneself using the ActionScript graphic primitives. For advanced rotatable 3-D charts (which Data Visualization does not support) and 3-D landscapes, it uses advanced geometry and low-level polygon fills. While these are not Flex components (the code is pure ActionScript with mostly Sprite-based classes, many recipes are connected to data, sometimes dynamically.
Each recipe presents as a set of sections: the title, Getting ready, How to do it…, How it works…, There's more…, and See also. Besides the inconsistent use of ellipsis, the title section (which describes the need) is often perfunctory and sometimes omits a picture of the finished graph or chart (i.e. the tempting photo of the finished dish). While some How it works… sections show additional (but too few) images, a graphics book should err on their side of too many images, and certainly should always have one as part of the recipe's description.
Within sections, some of the recipes do built on the previous one a bit: graphic enhancements, adding different data sources, or using a more complex representations. The sections cover
- Drawing with the core ActionScript objects
- Representing sets of data in graphs
- Bar charts (using Adobe's Data Visualization library)
- Advanced charts without the Data Visualization library
- Charting Data on Maps
- Animation and Zooming in on Data
- Showing Network Data Relationships Graphically
- Rotatable 3-D Charts and Data Landscapes
The book is available in Kindle and paperback editions as well as PDF, mobi, and epub direct from the publisher. The PDF seems to be images of the pages, not text (no copy-and-paste, no external links, and no links from the table of contents). It is also available on-line from the publisher's site once purchased. The HTML presentation, often being very wide, actually makes the chapters easier to read than the book format: the code does not need to wrap; the images are visible on the same "page" as the rest of the recipe, and the links work.
Some recipes need to import data from files or web services and include code and discussion to do so; these pedestrian routines (and some entire recipes!) distract from the topic of graphic functionality; perhaps they could have been relegated to an appendix. Some recipes, perhaps acknowledging that supporting code is large and tedious, direct the user to download files from the Packt Publishing website and "… follow along". The index is 12 pages long; very respectable for a 280 page book.
For its niche, it is likely the definitive reference. It does not address the relative merits of using a well-known charting library vs. using trigonometric functions and low-level drawing functions; clearly these include abstraction and performance. Cookbooks don't offer a questionnaire; they just tell you how to make a great souffle Joe Bob says: check it out.

subset: commoncrawl


text:
I enjoyed my stay at Borocay Sands Hotel. The staff are friendly and the atmosphere is relaxing. It is a bit chilled though and not for someone who is looking for the best quality.If you can look past that, it's a great hotel for the amount you pay to stay there. All in all I had a good time. The location is great as it is close to the main part of Boracay, but far enough so that you still have peace and quiet. The best part is that you can just walk straight out of the hotel and into the ocean!!
- Official Description (provided by the hotel):
- The Boracay Sands Hotel is located at Boracay Island, Philippines. Boracay is a tropical island located approximately 315 kilometers or 200 miles South of Manila, the capital of the Philippines, and 2 kilometers off the northwest tip of the island of Panay in the Western Visayas region of the Philippines. ... more less
- Reservation Options:
- TripAdvisor is proud to partner with Hotels.com, Orbitz, Expedia, Agoda, Booking.com, Cancelon, Travelocity, TripOnline SA, Cheap Tickets, Hotwire, HotelQuickly and Travel Book Philippines, Inc. so you can book your Boracay Sands Hotel reservations with confidence. We help millions of travelers each month to find the perfect hotel for both vacation and business trips, always with the best discounts and special offers.


text:
My Life Profile
By: Larissa Oachs & Kylie Wakefield
Life Profile
We are partners with zero kids. Larissa is a Laborer. Kylie is a Physician Assistant. Larissa drives a total of 20 miles to and from work, while Kylie drives a total of 50 miles to and from work.
- Gross annual income: $118,000.00
- Taxes: $1,929
- Net monthly income: $8,774
- Budget min. and max.:
Established Expenses
Health and life insurance: $30.00 a month.
Medical and Dental Expenses: $60.00 a month.
Planning your Future
Savings: $438.70 to the Wells Fargo Bank
Charitable Giving: $87.74
Chance Cards
Lucky Card: We received $75.00, for finding an Indian Head cent and taking it to a dealer.
Unlucky Card: We lost $100.00 because we had to replace a tire.
Investment Portfolios
Day 1 Values: $10,323.70
Day 5 Values: $15,858.60
Home Improvement
Items and prices:
- Entertainment Center- $399.00
-Flat Screen TV- $378.00
- Living room/Dining room paint- 3 gallons =$67.41
Monthly loan amounts: $844.41
We live in a cozy little house in Mankato, MN. It is a 3 bedroom, 3 bath, 2,947 Sq Ft. home. It's found at 228 Parkway Pl, built in 2006, this lovely home will be a great place for us to live!
Our mortgage: $1,316.87
-Electricity: $200.00 a month
-Sewer/Water: $50.00 a month
- Telephone: $70.00 a month
Kylie drives a 2013 Ford Edge.
Larissa drives a 2013 Chevrolet Malibu 1LT
Our monthly payment is $794.16 over 60 months including insurance, registration and tax.
Maintenance: $180.00 per month.
Food, Household, and Personal Hygiene
Our weekly menu
Monday: Breakfast- Bacon, eggs and orange juice. Lunch- Sandwiches, chips and water. Dinner- Hamburgers and pop. Snack- Salsa, chips and water
Tuesday: Breakfast- Cereal and milk. Lunch- Salad and water. Dinner- Steak, potatoes and milk. Snack- Granola Bars and water
Wednesday: Breakfast- Fruit, yogurt and water. Lunch- went out to eat. Dinner- pork chops and mountain dew. Snack- Cookies and milk
Thursday: Breakfast- Toast, sausage and milk. Lunch- went out to eat. Dinner- Alfredo and water. Snack- Fruit cups
Friday: Breakfast- Bagel, cream cheese and water. Lunch- roman noodles and mountain dew. Dinner- Went out to eat. Snack- Crackers and cheese and water
Saturday: Breakfast- Hash browns, bacon and milk. Lunch- Chicken sandwich and mountain dew. Dinner- Pizza and water. Snack- Ice cream
Sunday: Breakfast- Pancakes/ waffles and orange juice. Lunch- Tacos and water. Dinner- Roast beef and milk. Snack- fruit snacks and pepsi
Clothing and Assesories
Purse- $39.99
2 pairs of earrings- $27.60 x 2= $55.20
Dress- $39.95
2 pairs of coats- $60.00 x 2= $120.00
Entertainment and Recreation
St. Clair Football Game- $6.00 x 2= $12.00
Movie- $7.50 x 2= $15.00
Bowling at Wow Zone- $9.00 x 2= $18.00
Milwaukee Museum- $21.00 x 2= $42.00
Cable and Dining Out
Cable T.V is $84 a month.
Dining out is $27.60 a month.


text:
Physical Education Courses
Cornell Outdoor Education (COE) is part of the Physical Education Department and offers both credit and non-credit courses in a variety of outdoor related activities. Courses include hiking, canoeing, kayaking, climbing, skiing, snowshoeing, caving, teambuilding, wilderness first aid, and Fall/Spring break trips.
- All COE classes are open to the public.
- Most classes don't require any previous expereince.
- Courses may be added any time before the class starts, with no late enrollment fee.
- COE maintains its own drop deadlines (listed in the class pages on this site), enrollment and other policies.
- Questions about COE classes should be referred to Kae-Lynn at firstname.lastname@example.com or (607) 255-6183.
To sign up find us on student center during the enrollment period or call our registrar at (607) 255-6183 or email firstname.lastname@example.com. For Spring 2017 COE courses drop deadline is Wednesday January 25th, 2017. Add a course anytime!


text:
It's Friday and I realized that I haven't posted a poll for this week yet. I'm sure I'll forget about these weekly polls eventually, but it would just be bad form to drop the ball on the third week.
Anyway...given all the outcry over Nintendo's choice for the name of their next console, what would you name a gaming console if you could create one? I've given a possible 10 answers to choose from, but if you have a better name, feel free to post it in a reply.
Also, who else thinks "Revolution" is the perfect name for a console? Tip for Nintendo: next time use the stupid name for the console codename and the cool one for the real name.
Results of Last Week's Poll
Last week's poll was about which flavor of ice cream I should buy since I couldn't eat solid foods (my favorite food group). Chocolate Chip Cookie Dough won by a landslide (50 votes, 37%), but I hate eating raw dough, so I decided to get New York Super Baby Chunk instead. Mmmmmmmmm...babies!


text:
I finally got started today ,got the trailer ready an welded ends one pipe. Hopefully tmorrow I'll get fire box mounted an put on trailer .[IMG]
post #1 of 4
6/10/14 at 3:31pm
Thread Starter
Looks like you got a lot done for one day. At this rate you will have this puppy up and smoking in no time.


text:
Transcript Office
Current Students during school session (for official & unofficial transcripts): See Ms. Wanda Lee in VICCI center.
Otherwise, if you are not a current student, please use the district transcript services (link here)
(Or see
Maricela Ramson
SFUSD Transcript Office - Bungalow 1 at
727 Golden Gate Ave (between Franklin & Gough)
(415) 241-3030 (ext. 13001, or press 2, for Transcripts)
Cost is $5.00 per transcript)


text:
What is JotForm?
JotForm is a free online form builder which helps you create online forms without writing a single line of code. No sign-up required.
At JotForm, we want to make sure that you're getting the online form builder help that you need. Our friendly customer support team is available 24/7.
We believe that if one user has a question, there could be more users who may have the same question. This is why many of our support forum threads are public and available to be searched and viewed. If you'd like help immediately, feel free to search for a similar question, or submit your question or concern.
Get referrer problemAsked by PriceIT on July 17, 2014 at 09:25 PM
When using the iFrame code and you try to use the get referrer (URL from which form was submitted) function the URL does not show up in the notification email or on JotForm inbox. All it shows is, "referrer" with no URL next to it.
JotForm Support
Hello PriceIT,
Unfortunately the getReferrer widget will NOT work if the form is embedded using iFrame embed code. It will always display your form URL in the submission. It is strange that it is just displaying "referrer" instead of displaying form URL. I would suggest you to please share the web page URL and we will take a look.
We will wait for your response.
Thank you!
JotForm Support
Hello PriceIT,
I did test the scenario once again and the getReferrer widget seems to be working fine with iFrame.
I created a simple form with getReferrer widget and embedded it in a html page. I did few tests and it does capture the web page URL correctly.
Please take a look at the following URL where I have embedded the form and also the submission report so that you can test the form and see the submission data as well: https://shots.jotform.com/ashwin/screenshots/getReferrer.html
It should work for you too. Please share the web page URl where you have embedded your form and we will take a look.
Thank you!
I fixed the problem. The only thing I can suggest is to include scripts that don't interfere with other scripts on the page.
Thank you for updating us on this matter. I can forward the suggestion to minimize the use of potentially conflicting scripts, although I believe this might be already a concern of our programmers.
They will contact you via this thread when they have an update on this.
Thank for your suggestion and please get back to us if further support is needed.


text:
login with
Thank you Brande..this is because of my husband who likes to run. I need to get bck in shape and he understands how I feel, our target is 20 miles a stretch by 3 months. So excited that we do this as a family with Aaradhya in a jogger/trailer.
About Deval Singh
Birth: January 09
On Moms.com since: Apr 1, 2014


text:
Mon., June 27, 2011, 8:44 a.m.
The China thing…
It turns out that the John Birch Society, through its magazine, "The New American," has been whipping up the swirl of online outrage over Idaho being sold off to the Chinese, Idaho Statesman reporter Rocky Barker reported on Sunday; you can read his full article here, which included this tidbit: Last week, the online frenzy bumped a six-month-old Statesman story about about an effort to court Chinese investment in Idaho to the most-viewed article on the Statesman's website, drawing tens of thousands of viewers. Barker's article includes a Q-and-A "fact check" on the claims, noting that the Chinese have not bought 50 square miles of Idaho, nor would a possible free-trade zone exempt the Chinese from American laws; Idaho has a free trade zone for Canada now in Boundary County.
In the latest "New American" article on June 9, writer Joe Wolverton blasted Idaho Gov. Butch Otter's "Project 60," a plan to increase the state's gross domestic product while Otter is governor, as "an extraordinary display of misdirection all designed to lull the citizens of the sovereign state of Idaho into a stupor while their state is sold to the Chinese." Barker reports that Otter fielded questions from concerned Idahoans about the reports at his recent Capital for a Day event at Castleford.
You must be logged in to post comments. Please log in here or click the comment box below for options.comments powered by Disqus


text:
Sign up for our Free Newslettermore >>
- Get Our Emails
- Free Shoes
Free Samples, Contests, Coupons and other Great Free Stuff for Canadian Women.
Sign up for our Free Newslettermore >>
March 26, 2015 | Videos
This is going to be a hit in my house. Do you love The Minions? Make Minion Cupcakes!
You work too hard for your money to throw it all away on full price when you don't have to!
© adjump 2011 All Rights Reserved No part of this website or any of its contents may be reproduced, copied, modified or adapted without adjump's prior written consent.


text:
Deals are amazing!!! Sad part is that I have to spend money for other things in my car
Sent from my SM-G900V using Tapatalk
Merry Christmas to all!
Happy New Year and thank you all for your support! Looking forward to 2017!!
"Flame suit NOT REQUIRED!!!"Call Me Dane l 2/2004 330i ZHP l 18x8 ET45 BBS CK's wrapped with Conti DWS's @ 245-40-18 l KW V1 Coilovers l BMW Performance Rotors l M3 Intake l UUC StrutBarbarian l Racing Dynamics Rear Strut Bar l Jim Conforti Shark Injector l Silver Cube Interior Trim l Bimmian Celly Mount l Weisslicht A/E's l M3 Trunk Mat l l e90 Performance E-Brake & Shift Knob l M3 Tri-Stitched Boots l AL Headlight Retrofit with ZKW Lenses l CobyWheel Wrap w/M3 Stitching l LCM sw 4.5 triple blink and rear fogs l Maintenance B.U.O.S.S
Subbed for tantalizing discounts this year :0
Sent from my iPhone using Tapatalk
I'm going to swap a 6-speed in my auto: check out my parts list HERE
"You cant connect the dots looking forward; you can only connect them looking backwards." - Steve Jobs
Deals going on? Looking for 3.46 Clutch pack diff


text:
Project Managers
Déjà Vu X3 Workgroup
This is the version with all the features and power functions that make Déjà Vu X3 the most effective quality and productivity solution for Translators, Editors and Project Managers. As the networkable version of Déjà Vu X3, it's the ideal choice for translation companies and freelances who work in teams.
Main Features
- DeepMiner
- AutoWrite
- Create multiple file projects
- Create multiple-format projects
- Multilingual projects and multilingual databases
- Guaranteed Matches
- Project Lexicon
- Intelligent Quality
- SmartView
- Quality Assurance
- Compatibility
- Teamwork
- Share translation memories and terminology databases over a local network
- Powerful batch maintenance of project and database quality
- Programmable API
- Scalable
- Cost-efficient low-administration licensing solutions
- Multi-file and multi-format alignment project
Find out about all the features of the DVX3 Workgroup version


text: Wouldn't it be funny if the boys that photographed themselves assaulting Savannah Dietrich got raped right now? Also, that priest, Monsignor Lynn, who is going to serve three to six years for failing to investigate sex abuse claims against priests — wouldn't it be hilarious if he were raped in prison? And Jerry Sandusky? Just… READ MORE »


text:
A CONCEPT car, as any car nut can tell you, is a prototype designed to shake up dusty, entrenched notions of car design. To show that they're trying to ''think outside the box,'' automakers create these futuristic, radical-looking models for display in car magazines and auto shows. In the laptop world, I.B.M. has been promoting its own efforts to shatter preconceived ideas.
''The clamshell is a very functional laptop design, but it has its limitations,'' said Tom Grimes, segment marketing manager for emerging technologies at I.B.M., referring to the way most laptops are hinged. ''We're trying to design systems that work the way people do instead of getting people to adapt to the way computers are designed.'' Here's a case in point: Next week, the company will release its ThinkPad TransNote, which might best be described as a concept laptop.
When closed, the TransNote resembles an imitation leather portfolio about 13 inches tall, 11 inches wide and 1.3 inches thick. While standard clamshell laptops open like a wall calendar, this one opens like a book. On the right page is a pad of ordinary paper and a double-ended pen (ballpoint at one end, plastic stylus at the other). On the left page is what looks like a laptop cloning experiment gone horribly wrong: the screen is on the bottom half, where the keyboard should be, and there's nothing at all on the top half.
As it turns out, all is well. Instead of being hinged at the bottom, as on standard laptops, this screen is attached to a pivoting stem on its back, permitting it to perform several tricks that will amaze and confuse onlookers. For example, when you don't need the keyboard (when you just need to read or refer to a document, for instance), you can leave the screen and stem folded flat, as they originally appear. In that configuration, you can operate the TransNote as a tablet computer, tapping the touch screen with the stylus to, say, check off items on an on-screen list.
When you want to type, the screen lifts up, revealing a keyboard underneath, and tilts to any angle atop its stem. Finally, when you want to give a presentation, you can flip the screen over to face your audience. A control panel lets you orient the screen image the right way. This tricky screen already represents innovation enough to flood a conference room. But TransNote's real breakthrough lurks in that low-tech paper pad.Continue reading the main story
When you run a program called Ink Manager Pro on the laptop, anything you write or draw on the pad, using the ballpoint end of the stylus, shows up on the screen, clearly and promptly. (The pen communicates with the laptop via radio waves.) Each time you begin a new page, Ink Manager Pro creates a new electronic page to match. When you flip to a different paper page, you must tap a button that lets the software know that you're on a new page.
With one exception noted below, the TransNote makes no attempt to transcribe your handwriting. Your scribbles begin and end their lives as graphics.
I.B.M. may have learned a sharp lesson in this regard from its work with the Cross pen company on the Crosspad 1, the TransNote's obvious predecessor. It was a high-tech clipboard that stored, and could transfer to a PC, 50 pages' worth of handwritten notes stored as digital ink. Its I.B.M. Ink Manager software could convert handwriting into typed text, but with abysmal accuracy. The Crosspad 1 soon retired to the great CompUSA in the sky. The second-generation Crosspad makes no attempt to do more than the TransNote does with handwriting recognition.
But the TransNote software makes impressive efforts to make your handwriting useful. For example, you can select part of a digital page to paste into another program, send via e-mail to someone or save to disk as a graphics file. And by circling a handwritten phrase, you can flag it as a To Do item or a Message. Ink Manager Pro displays these handwriting fragments in special lists, complete with Priority flags and Completed checkboxes.
You can also circle, say, a heading at the top of a page (''Meeting Notes 2/22'') and designate it as a Keyword. At your option, the TransNote does indeed attempt to translate such phrases into typed text so you'll be able to search for specific pages among your electronically stored digital pads. Unfortunately, the handwriting recognition fails miserably, even in this limited context. (I wrote ''IDEAS FOR 2002'' in lettering so large and neat you could have read it from the International Space Station, but the TransNote turned it into ''1D EPA S Fork Zoo Z.'') Fortunately, you can easily use the keyboard to edit these feeble-minded transcriptions.
TransNote has a floppy spine, which makes the whole apparatus a bit unwieldy. To use both sides of the portfolio, you must lay it flat on an expanse of uncluttered desk space nearly two feet wide. On the other hand, the spine's floppiness lets you use either half of the book independently. For example, you can fold the computer portion beneath the pad, creating, in effect, a 5.5-pound clipboard that you can cradle in your arm and use standing up. You don't even have to turn on the laptop to do that. The notepad has its own memory, which can store 50 pages' worth of notes even when the laptop portion is off.
Similarly, you can fold the paper-pad portion underneath when you want to use the laptop on a plane without impaling passengers on either side. (But if the passenger in front of you reclines, you'll be the one who's injured -- at nearly 13 inches, front to back, the TransNote is about three inches bigger than even the biggest clamshell laptop.)
As an innovative note-taking device, the TransNote works surprisingly well, despite its peculiarities. Thoughtful touches are everywhere, like a finger well that helps you turn pages and a Getting Started tutorial with instructions printed on a special paper pad that walks you through the machine's features.
As a bonus, a software switch turns the pad into a digitizing tablet. You can move the cursor by moving the pen tip just above the paper surface, then tap the pad with the pen tip to register a mouse click.
But as a laptop, the TransNote's specs aren't too impressive. For $3,000, you might expect more than a 10-gigabyte hard drive and 64 megabytes of memory. With 1-gigahertz Pentium laptops scheduled to hit the market on March 19, the TransNote's 600-megahertz Pentium III chip feels like an anachronism. Even the operating system is out of date: Windows 98, not Windows Me. (A Windows 2000 version is available for $100 extra.) The computer's Lilliputian screen, at 10.4 inches diagonally, shows only 800 by 600 pixels -- a miserly one-fourth the display of the screens on I.B.M.'s own top-of-the-line laptops. And the shrunken keyboard turns touch-typing into a game of fingertip Twister.
Perhaps I.B.M. considers the TransNote's design so different that comparisons with traditional laptops are irrelevant. In fact, it's not hard to imagine customer niches. I.B.M. suggests, for example, that the TransNote is ideal for executives, bankers, lawyers and anyone who hates to type. It even makes a left-handed model. After all, 10 percent of the population is left-handed -- like Lou Gerstner, I.B.M.'s chief executive.
But for general use, the TransNote embodies the worst of both worlds: it has the bulk and weight of a full-size laptop, but the limitations of subnotebooks (minuscule keyboard and screen, external floppy and CD-ROM drives). Most people will probably find that too much of the $3,000 price is for the touch screen and digital-ink technology, with too little left over to build a decent laptop.
Put another way, the TransNote may be too much concept, too little car.Continue reading the main story


text:
Still wonderful, but the 2017 harvest is here. So for all of you who love low prices, here's a great value. Enjoy 2016 Makaibari first flush at a discount! Certified Organic & Fair Trade.
Use 1 tsp. leaf per 8 oz. cup. Pour boiling water over leaves. Steep 3 mins. Milk is not recommended.
Sold Out


text:
Akuma (Copper) by GP Customs (Authentic)
This copper Akuma is manufactured by GP Customs. This elegant tube style mech mod is a go to for many mech users. With its sexy laser carved designs it is bound to impress all your friends. The simplicity of this mod makes it user friendly for even one of the newest mechanical mod users. With the ability to use various sizes of batteries (18350, 18500, 18650) it is bound to meet the needs of the average vaper.
Product Details:
-Red copper modular tubes
*18350 full tube w/ Akuma Logo
*18500 full tube w/ Akuma Logo
*18650 extension tube
-Red copper bottom cap
-Australian brass top cap & lock ring
-Copper coated Silver pins
-Floating positive w/ telescopic pin for adjustment of atomizer and battery
-Easy twist Locking mechanism
-22mm diameter
-Engraved top and bottom cap logos
-Laser engraved AKUMA logo
-Handmade bottom (screw) designed for AUTHENTICITY
-Handcrafted wooden box (serialized) packaging made by a real tribe from mountain province
-Cnc made
-100% made in the PHILIPPINES!!!!