[07:55] <popey> Morning all
[08:05] <MartijnVdS> \o popey
[08:19] <popey> anyone fancy confirming bug 919082 ?
[08:20] <sagaci> popey: affirmative
[08:21] <popey> and if it does please tick the 'This affects you' thing
[08:21] <sagaci> done
[08:22] <popey> thanks!
[08:22] <sagaci> I checked in ubuntu 12.04 latest updates
[08:51] <czajkowski> aloha
[08:51] <czajkowski> why would you need more than 4 layouts?
[09:16] <dwatkins> Someone might need to write in 5 different languages.
[09:18] <jpds> dwatkins: Yes, I have experience with that.
[09:19] <jpds> popey: Ohhh, yes.
[09:20] <Seeker`> o/
[09:22] <AlanBell> looks like it is a hard limit in X
[09:22] <jpds> AlanBell: Lovely.
[09:23] <AlanBell> http://freedesktop.org/wiki/Software/LibXklavier in the documentation section there are two pdf files that explain it
[09:24] <AlanBell> I don't understand them, but that is where the four is coming from
[09:25] <dwatkins> So it's all SGI's fault? ;)
[09:26] <AlanBell> it is probably a wait for wayland kind of bug
[09:26] <AlanBell> should be fixed in 14.04
[09:29] <jpds> Oh well.
[09:33] <bigcalm> Good morning peeps :)
[09:35] <daubers> Morning
[09:35] <daubers> Anyone else on BT Business broadband having issues this morning?#
[09:38] <oimon> oh deary me. http://www.bbc.co.uk/newsbeat/16642189
[09:39] <AlanBell> gosh
[09:39] <bigcalm> :(
[09:39] <DJones> daubers: The only person I know on BT is online without any problems
[09:40] <daubers> DJones: It's an issue with BT Business broadband, specifically with people who have static IP's :(
[09:40] <DJones> Right, this was a residential line
[09:40] <daubers> BT have an answerphone message saying there's an issue..
[09:41] <DJones> http://btbusiness.custhelp.com/app/service_status_consumer/ss_cat/2468,2470/ Website just suggests sheffield have problems
[09:45] <daubers> We have that issue and we're not in sheffield :(
[09:46] <daubers> http://btbusiness.custhelp.com/app/service_status/a_id/19500#ans_19500
[09:46] <daubers> suggests a bigger problem
[09:48] <popey> what i really want is for the keyboard layout on my mac to be correct, which it isnt ☹
[09:48] <tugrik> :)
[09:48] <tugrik> a few stickers combined with a new keyboard mapping will solve that popey ?
[09:49] <smittix> howdy campers.
[09:49] <popey> no
[09:49] <popey> xkb config fixes
[09:49] <bigcalm> Yikes, it's Friday!
[09:50] <smittix> bug 786325
[09:51] <nothingspecial> hi smittix, I missed you last night sorry (I have kids). Yes iTunes is in a Windows 7 VM
[09:51] <smittix> I am on BTBB everything looks fine here in Nottingham.
[09:52] <smittix> nothingspecial: Thanks for that.
[09:52] <daubers> smittix: Got a static IP?
[09:52] <smittix> daubers: Yes several
[09:52] <daubers> Hmmm.... ours won't authenticate :(
[09:52] <daubers> However, I'm a lot further south than you
[09:54] <smittix> :/
[10:00] <JamesTait> Merry Friday, everyone! :)
[10:00] <gord> best holiday of the week
[10:01] <gord> we really should make every Friday a national holiday
[10:02] <daubers> Like wear clogs to work day?
[10:03] <gord> thats not a real thing right? because that would be horrible
[10:03]  * popey also wishes he knew why his ssh session hangs for some time, catching up when he presses a key
[10:04] <oimon> virgin media?
[10:04] <popey> yes
[10:04] <oimon> :P
[10:04] <oimon> check your ping stats
[10:04] <popey> my what?
[10:04] <oimon> check for dropped packets
[10:04] <oimon> or CRC errors
[10:04] <popey>           RX packets:6419628 errors:0 dropped:0 overruns:0 frame:0
[10:04] <popey>           TX packets:7655543 errors:0 dropped:0 overruns:0 carrier:0
[10:05] <matti> ;]
[10:05] <gord> tubes clogged =\
[10:05] <oimon> worth running a continuous ping to double check :-\
[10:07] <MartijnVdS> popey: http://www.bufferbloat.net/ or a flaky router
[10:07] <popey> http://paste.ubuntu.com/810534/
[10:07] <MartijnVdS> Hop 2 seems to be lossy
[10:07] <MartijnVdS> Hop 1 seems to have scary high ping
[10:08] <popey> hop 1 is my router I guess
[10:08] <oimon> looks like a traffic jam on the information superhighway
[10:08] <danfish_> morning
[10:09] <daubers> Morning danfish_
[10:09] <bigcalm> Morning
[10:09] <danfish_> I expect VM's big speedupgrade is going to cause chaos over the next 6 months :/
[10:09] <popey> heh
[10:09] <danfish_> daubers: o/
[10:09] <bigcalm> Damn phpexcel and column widths not matching excel column widths
[10:10] <bigcalm> danfish_: oh yes, I look forward to it
[10:10] <bigcalm> popey: remind me to move tig to bytemark
[10:11] <danfish_> went to 4yo son's assembly this morning to see him play the part of a duck. He cried
[10:11] <danfish_> time to do some work :(
[10:11] <daubers> Oh dear
[10:12] <czajkowski> danfish_: why a duck ?
[10:12] <czajkowski> hmm my keyboard seems to have gone a bit crazy during the update " is now longer where it should be as is @ a bit confused
[10:12] <bigcalm> Sounds like a US layout
[10:13] <czajkowski> aye
[10:13] <smittix> What's this Arch Linux I hear so much about.
[10:13] <smittix> heh
[10:13] <bigcalm> -.-
[10:14] <smittix> New version of LightDM is looking good.
[10:14] <bigcalm> smittix: I think czajkowski would be dragged over to RH if anything :P
[10:26] <popey> anyone on precise with a touchpad which supports multitouch?
[10:26] <gord> we talking real multi-touch or the two finger drag kind?
[10:27] <popey> real multitouch
[10:27] <popey> 3 fingers should trigger dash
[10:27] <popey> (it seems)
[10:27] <gord> ah nope here
[10:27] <gord> should really buy a magic whatever it is to test that stuff
[10:27] <popey> the dash keeps popping up randomly, i can trigger it by holding my hand just above the touchpad
[10:27] <popey> its insanely annoying
[10:27] <bigcalm> Carphone Warehouse still shows the Xoom in stock but won't let you buy it
[10:27] <bigcalm> *le sigh*
[10:28] <gord> popey, you anywhere near millbank today?
[10:28] <oimon> you prefer a xoom to the tranformer prime?
[10:28] <popey> no
[10:28] <bigcalm> oimon: price difference
[10:28] <gord> ah shame, last day jason is there, he does our multi-touch stuff in unity
[10:28] <popey> damnit, i was there yesterday
[10:28] <oimon> bigcalm: how much is the xoom?
[10:29] <popey> tempted to buy a thinkpad and donate my mac to an ubuntu person if they promise to fix it
[10:29] <bigcalm> 249.99 from Carphone Warehouse
[10:29] <gord> thinkpad <3 get the x220 ;)
[10:29] <gord> everyone else has one, should work well
[10:30] <popey> yeah, but thats missing the point ☹
[10:30] <popey> if everyone on the planet has an x220, no other laptops will ever work
[10:31] <gord> tis true, in my defence, i got my x220 before everyone else did. everyone else is a poser
[10:32] <jpds> popey: No other laptops are worth it.
[10:34]  * czajkowski hugs her z830
[10:34] <popey> gord: is yours a tablet then?
[10:35] <gord> popey, nope, tablet version wasn't out when i got mine
[10:37] <czajkowski> hmm no davmor2 :/
[10:38] <bigcalm> czajkowski: need somebody to poke/hug?
[10:39] <czajkowski> I've not poked him or stabbed him or threatened to kill him once this year
[10:39] <czajkowski> and January is almost up! :)
[10:40] <bigcalm> Hence the hug option
[10:40] <bigcalm> Heh
[10:40]  * czajkowski hugs bigcalm
[10:40] <bigcalm> Awww
[10:40]  * bigcalm hugs czajkowski carefully
[10:40] <bigcalm> Always better than a poke
[10:41] <czajkowski> indeed
[10:41] <gord> davmor2 normally shows up around 11
[10:41] <gord> he's crazy
[10:41] <bigcalm> Attending a wedding this afternoon. Such a shame that it's pouring with rain :(
[10:41] <brobostigon> good morning everyone.
[10:42] <occupy64k> good morning
[10:42] <brobostigon> morning occupy64k
[10:42] <bigcalm> Hullo
[10:42] <occupy64k> Today I will be mostly hacking on the command line
[10:42] <czajkowski> bigcalm: not used to friday weddings, mate has chosen a friday at the end of august, as she wants a BBQ on the saturday for close mates to stay around. and catch up.
[10:43]  * Neoti_Laptop just found codeigniter ..... playing........
[10:44] <bigcalm> czajkowski: the husband to be has stomach cancer and the chemo hasn't worked. So they are getting married while he is still in fairly good health. Which meant organising a wedding in 10 days :( Feel really honoured to be invited to the wedding. We are their cat sitters :)
[10:44] <czajkowski> bigcalm: aww poor family
[10:44] <bigcalm> Neoti_Laptop: try cakephp instead :)
[10:45] <czajkowski> gonna be a lovely day but I suspect pretty emotional
[10:45] <Neoti_Laptop> i luv cake.
[10:45] <Neoti_Laptop> lol
[10:45] <Neoti_Laptop> will google it now
[10:45] <bigcalm> cakephp.org
[10:45] <bigcalm> CI makes you work far too hard for a MVC framework
[10:46] <czajkowski> mmm cake  usually about now Myrtti and christel pop up at the mention of cake
[10:46] <christel> cake.
[10:46] <christel> ;)
[10:46] <bigcalm> Haha
[10:46] <Myrtti> cheesecake
[10:46] <czajkowski> morning :)
[10:46] <Myrtti> you can even make it lowcarb high protein
[10:46] <Myrtti> probably
[10:46] <czajkowski> and christel does have the flour!
[10:46] <Myrtti> haven't looked for recipies
[10:47] <christel> i do indeed have flour :P
[10:47] <bigcalm> Beef Caje!
[10:47] <bigcalm> Cake!
[10:47] <bigcalm> I baked them a cake for xmas. Went down quite well apparently
[10:48] <popey> http://superuser.com/questions/262244/how-to-make-libreoffice-calc-to-not-to-hide-unfit-content-of-a-cell-when-the-fol
[10:48] <popey> any idea how to do what he is asking?
[10:48] <popey> I hate libreoffice
[10:49] <Myrtti> well atleast he's using Calc
[10:49] <Myrtti> he is excused for using it
[10:49] <popey> oooo, delete contents does it
[10:49] <Myrtti> there's no excuses for using Libreoffice for documents instead of latex
[10:49] <popey> there is
[10:49] <popey> i am exchanging documents with other people
[10:49] <Myrtti> so am I
[10:49] <oimon> what if the excuse is "i don't know latex well enough"
[10:50] <occupy64k> I've never used latex
[10:50] <bigcalm> Neither have I
[10:50]  * popey ignores the troll
[10:50] <oimon> or "latex produces documents that are too beautiful"
[10:51]  * popey leaves an answer like a good boy
[10:51]  * Myrtti gives popey a cookie
[10:53] <gord> wish i had cookies
[10:55]  * czajkowski gives gord some Millie cookies
[10:55] <czajkowski> yummy stuff!
[10:56] <bigcalm> I feel really good for not buying any cookies yesterday. London, Birmingham New Street and Telford Centre (shopping centre) all teased me with their Millie Cookies stands
[10:57] <oimon> popey: did you have anything in the cell on the right of the text?
[10:57] <oimon> the spill over only happens then the cell to the right of it is empty
[11:03] <oimon> lovely videos if you have 10 mins to spare: http://www.youtube.com/watch?feature=player_embedded&v=ahXIMUkSXX0 http://www.youtube.com/watch?feature=player_embedded&v=lOIP_Z_-0Hs
[11:04] <davmor2> Morning all
[11:04] <davmor2> czajkowski: proddity proddity proddity prod, Happy Friday
[11:06]  * czajkowski hugs davmor2
[11:06] <czajkowski> see we're back to normal davmor2 is back
[11:08] <davmor2> czajkowski: No I was still nice I added Happy Friday to the end :)
[11:10] <czajkowski> indeed
[11:19] <DJones> This seems a promising read for Linux engineers http://www.channelregister.co.uk/2012/01/20/linux_foundation_survey_big_data/
[11:26] <smittix> daubers: Having problems here now.
[11:29] <dwatkins> I'm on BT at home, it seems to work ok in Edinburgh.
[11:42] <bigcalm> I want to hit PHPExcel with something
[11:42] <bigcalm> A clue bat would be good
[11:44] <dwatkins> sounds like a fun plugin, bigcalm ...
[11:49] <gord> heh "phpexcel" - there is not a single letter in there that i want a part of
[11:50] <oimon> lol
[11:55] <bigcalm> dwatkins: it's a useful library, if you have to deal with excel poop for clients
[11:56] <dwatkins> bigcalm: ah I see, I feel your pain
[11:56] <bigcalm> But right now I'm having silly problems with the PHP itself
[11:56]  * dwatkins heads home to let BT in to hopefully fix his internet connection that drops out 5 times a day
[11:56] <dwatkins> c ya
[11:57] <bigcalm> Toodles
[12:31] <bigcalm> PHP! HELP! http://paste.ubuntu.com/810643/
[12:31] <bigcalm> :)
[12:33]  * MartijnVdS gives bigcalm a can of eye bleach
[12:35] <matti> Huh.
[12:35] <davmor2> bigcalm: try on a PHP channel :P
[12:35] <bigcalm> davmor2: there are PHP devs in here :P
[12:35] <matti> PHP is so '70.
[12:36] <christel> bigcalm: i just hump mgdm's leg whenever i need php
[12:36] <bigcalm> Tricky as it's a language of the '90s
[12:36] <davmor2> bigcalm: yeap but they won't mock you as much as an entire channel of them would :D
[12:36] <bigcalm> christel: would you mind humping his leg for me? ;)
[12:36] <christel> not at all
[12:36] <bigcalm> davmor2: I'm used to it :P
[12:36]  * christel gets the lu...oh
[12:36]  * christel tickles mgdm
[12:38] <Myrtti> looks like I need to add ubuntu-uk.tex on my IRCQuotes book
[12:43] <bigcalm> Not to worry. The example code was duff. I've found how to do it propperly
[12:45] <matti> bigcalm: Strip everything and only keep lines 2 to 12.
[12:45] <davmor2> bigcalm: man you got to love google :D
[12:45] <matti> bigcalm: Oh, you found it.
[12:46] <bigcalm> Replaced:
[12:46] <bigcalm> $objReader = new PHPExcel_Reader_Excel2007();
[12:46] <bigcalm> $objPHPExcel = $objReader->load($fileName);
[12:46] <bigcalm> With:
[12:46] <popey> Perl?
[12:46] <bigcalm> $objPHPExcel = PHPExcel_IOFactory::load($fileName);
[12:46] <bigcalm> Haha
[12:46] <popey> ;)
[12:47] <AlanBell> popey: http://mterry.name/log/2012/01/20/cant-log-into-precise-heres-help/
[12:53] <popey> AlanBell: thanks, have set dupe
[12:55] <mgdm> o___O
[12:57] <mgdm> https://wiki.mozilla.org/Eudora_OSE
[12:58] <bigcalm> Eudora?!
[12:59] <bigcalm> I actually _bought_ that
[12:59] <gord> woo more japanese candy through my letter box, best service ever
[12:59] <daubers> wooo
[12:59] <daubers> internets is back
[13:02] <mgdm> That was an excellent sandwich
[13:02] <mgdm> the only issue is, that it's not finished
[13:02] <mgdm> s/not/now/
[13:03] <christel> aww
[13:04] <bigcalm> Is it possible to crop a spreadsheet to a specified range?
[13:21] <bigcalm> Sod it, sub way
[13:22] <smittix> Subway solves everything
[13:22] <smittix> especially hunger
[13:22] <ikonia> http://www.ebay.co.uk/itm/Aluminium-Linux-Ubuntu-Case-Badge-Sticker-/280803272311?pt=UK_Computing_Software_Software_SR&hash=item41612de677
[13:22] <ikonia> just incase any of you UK guys wanted to do a bit of pride on your laptops
[13:28] <AlanBell> would if it was the new branding
[13:28] <popey> we should get some made
[13:33] <smittix> I need some stickers for my lappy
[13:33] <davmor2> popey: let me know when you do :)
[13:59] <danfish_> I've got an ubuntu template at home for use with a spray can - spray the circle of friends on you laptop lid. Anyone want to borrow?
[14:00] <daubers_> Does anyone know if there's a FUSE irc channel?
[14:00] <Myrtti> I should take a photo of my laptop lid
[14:00] <daubers_> or can anyone tell me how I can catch what functions something wants me to impliment in python-fuse (instead of just getting a -34 error)
[14:01] <Myrtti> I wish someone would fix flickrfs
[14:02] <gord> why not you? ;) scratching itches is what most fixes come from
[14:03] <Myrtti> gord: because it's been so long from my coding days I can't do even a helloworld in any of the languages I've ever used apart from LaTeX without sneaking a look from some cheatsheet
[14:03] <Myrtti> not at this moment anyway
[14:06] <Myrtti> oh and bash of course
[14:06] <Myrtti> that and latex
[14:06] <gord> sounds like a good time to learn ;)
[14:07] <Myrtti> I know
[14:07] <Myrtti> :-|
[14:13] <kazade> afternoon all
[14:15] <daubers_> Hello kazade
[14:16] <kazade> hey daubers_, how's the book going?
[14:17] <daubers_> kazade: A bit slowly, but getting there :) Did all the exercises to the end of chapter 2
[14:17] <kazade> cool, I need to dig out the latest code for you
[14:17] <daubers_> spent ages understanding the windowing stuff that used X
[14:17] <kazade> my VPS died and it was hosted there
[14:17] <daubers_> :(
[14:18] <kazade> yeah, annoyingly I couldn't cover Linux in detail in the text :(
[14:18] <kazade> as the original was Windows focused
[14:18] <daubers_> Yeah, I kinda understand what's going one now (more or less) just need to carry on working through to get to the bits where I'm a bit wonky
[14:18] <popey> hey kazade
[14:19] <popey> long time no see
[14:19] <kazade> daubers_: ok, I'll try and port some of the apps to SDL 1.3 which will make life easier for you :)
[14:19] <kazade> hey popey
[14:19] <kazade> yeah, I keep forgetting about IRC :p
[14:19] <kazade> how's things?
[14:19] <popey> heh
[14:19] <popey> not bad ☺
[14:19] <kazade> how's the new job going?
[14:19] <kazade> well, newish
[14:19] <popey> sweet!
[14:20] <kazade> cool :)
[14:22]  * Laney bimbles
[14:32] <gord> apt-get update is such a tease.... 20s left... 10s left... 2. 1.. nope! anther 90s left!
[14:37] <oimon> brought to you by the author of the windows file copy dialogue box.
[14:40] <Myrtti> new thriller, this January - will he keep the file transfer speed up to 200K/s? What happens if the speed goes below 50K? Presenting Gord Allott in his breakthrough role - premiere on Friday 20th!
[14:42] <gord> spelt my second name right :D no one does that
[14:42] <Myrtti> that's because I know you're not Alot
[14:42] <Myrtti> even though I like you alot
[14:43] <gord> picturing an elmo alot now
[14:44] <davmor2> gord: that's just wrong
[15:11] <awilkins> Elmo likes code! Elmo wants Coffee!
[15:21] <awilkins> Elmo has web developer friend! ......    "COOKIE!!!!"
[15:37] <zleap> has anyone here used kidsruby
[15:41] <daubers> Can someone explain to me what the magic trick that's being explained here is and how I can impliment it? http://sourceforge.net/apps/mediawiki/fuse/index.php?title=FUSE_Python_Reference#File_Class_Methods
[15:41] <daubers> </very confused>
[15:54] <kazade> daubers: You're a Python guy yeah?
[15:54] <daubers> kazade: I ive in a couple of languages, but python mostly :)
[15:55] <kazade> what's your editor of choice?
[15:55] <kazade> :)
[15:55]  * AlanBell contemplates an interesting fuse driver
[15:55] <daubers> kazade: pydev :)
[15:56] <daubers> kazade: But largley because I have machines that can handle eclipse well
[15:56] <kazade> Yeah mine too... well until Eclipse's memory usage drove me crazy
[15:56] <kazade> I'm hacking plugins for GEdit to make it more Pydev-like (but without the bloat)
[15:56] <davmor2> kazade: geany, gedit, nano, vim, and emacs are the most totted ones with idle for beginners
[15:56] <kazade> https://github.com/lukebpotato/geditpycompletion
[15:57] <davmor2> kazade: try geany it's basically gedit geared to devs
[15:57] <kazade> also: https://github.com/potatolondon/GPyflakes
[15:57] <kazade> davmor2: Yeah I've used Geany
[15:57] <Myrtti> geany ♥
[15:57] <kazade> they're all good :)
[15:58] <Myrtti> geany is loverly for latex as well
[15:58] <kazade> I like how easy it is to write GEdit plugins though (granted, I haven't checked what geany's plugin API is like :) )
[15:59] <gord> geany is nice :) i use vim myself, but if you want a moused based editor, its really good at just being nice and not getting in the way
[16:00] <kazade> Well, if anyone needs a Python code completion plugin for GEdit, there's one there ^^ :)
[16:00]  * zleap is upgrading to 11.10
[16:00] <kazade> I must check out geany again..
[16:00] <kazade> I'm not entirely sure why I stopped using geany actually..
[16:01] <oimon> non gtk3 compatible?
[16:02] <kazade> what, geany?
[16:02] <oimon> yeah
[16:02] <oimon> it's more of a question than a statement :P
[16:02] <AlanBell> does geany have no menu, or not work with the global menu?
[16:02] <kazade> I think I must've just stopped using it when I realized that GEdit could be more than just a Notepad equiv :)
[16:06] <kazade> hmm it's a shame Geany's plugin API is in C and not Python - I thought there would have been an easy port there :p
[16:11] <AlanBell> daubers: what will your fuse thing do?
[16:13] <oimon> a spooky floating error message: http://i.imgur.com/YdsAV.jpg
[16:20] <daubers> AlanBell: hide some files between UIDs
[16:20] <daubers> and redirect some writes to those files
[16:20] <daubers> making programs taht aren't designed for shared storage work with shared storage :)
[16:21] <oimon> has anyone tried linuxdeepin?
[16:21] <oimon> http://www.linuxdeepin.com/
[16:24] <daubers> Can't get this magic trick to work :( Don't really understand what it's doing
[16:28] <AlanBell> daubers: I am failing at the first hurdle, "fusermount mountpoint script.py" doesn't work
[16:28] <AlanBell> fusermount: extra arguments after the mountpoint
[16:29] <popey> anyone tried mumble on windows?
[16:29] <popey> I keep getting an odd error that everyone else gets, but nobody knows how to fix
[16:30] <popey> ""A referral was returned from the server.""
[16:31] <Daviey> popey: i suspect version mismatch.
[16:31] <Daviey> popey: grab a different binary
[16:31] <Daviey> OR.. just use G+
[16:31] <daubers> AlanBell: heh, fun. I've got the script mounting itself
[16:31] <oimon> Due to an expiring certificate no Mumble 1.2.2 or newer released before today (15.01.2012) will work on the Windows Platform after 15 January 2012 11:36:47 GMT. If such an outdated Mumble is launched after that date the error message “A referral was returned by the server” will be displayed by Windows and Mumble will not start.
[16:31] <popey> i cant use G+ when the people i need to speak to are on mumble
[16:32] <oimon> popey: ^^
[16:32] <oimon> http://blog.mumble.info/important-update-to-mumble-1-2-3a/
[16:32] <popey> i am on 1.2.3a
[16:33]  * popey reinstalls
[16:33] <oimon> the blog also has a fixed mumble exe for the 1.2.3 stable so try that otherwis
[16:35] <popey> gone to 1.2.4 which starts now
[16:35] <popey> thanks
[16:36] <oimon> np
[16:47] <AlanBell> /usr/share/doc/python-fuse/examples/hello.py seems to work
[16:55] <davmor2> czajkowski: prod!
[16:56] <davmor2> popey: why would you want to use mumble on Windows out of curiosity?
[16:57] <gord> i use mumble on windows, to talk to people, because skype is a pain
[16:58] <davmor2> gord: fair enough I just wondered if there was a big mumble following, obviously there is some :)
[16:58] <AlanBell> is this a canonical internal murmer server?
[16:58] <gord> davmor2, for video games mind
[16:58] <gord> people use mumble or some other one
[16:58] <AlanBell> I have a customer interested in using mumble
[16:58] <davmor2> gord: ah okay
[16:59] <gord> mumble can integrate into games and display stuff on top of the games
[16:59] <popey> i use mumble on windows because mumble on linux sucks donkey balls
[16:59] <popey> anyone trying to convince me otherwise can go to /dev/null
[16:59]  * czajkowski hugs davmor2
[17:00]  * davmor2 sends himself to /dev/null
[17:00] <gord> mumble works fine for me :P
[17:00] <gord> after i set it to explicitly use certain devices, i haven't had any problems
[17:01] <davmor2> popey: only issue I get is sometime on initial startup it doesn't do audio, restart and all is fine
[17:03] <davmor2> popey: maybe you abuse it incorrectly ;)
[17:03]  * popey can't hear davmor2 talking from inside /dev/null
[17:04] <AlanBell> daubers: this python fuse stuff doesn't cover up the c very well does it!
[17:04] <davmor2> popey: You'll like it here it's full of software you love to hate
[17:07] <daubers> AlanBell: :)
[17:09] <gordonjcp> AlanBell: ah, fuse
[17:09] <daubers> still can't get the magic to work :(
[17:09] <gordonjcp> AlanBell: I started looking at implementing a filesystem in fuse
[17:10] <gordonjcp> AlanBell: after some dramatic use of dd, strings and a bit of C to extract the binary bits, I just wrote a script to pick the disk images apart
[17:11] <ali1234> struct.unpack
[17:11] <ali1234> use it
[17:33]  * awilkins rolls back to about 1600-ish in the log
[17:33] <awilkins> kazade, gord, I quite like Komodo for the very little Python I do ; it has member indexing and autocomplete and also a vim emulation.
[17:34] <gord> komodo is good for python, but i've not seen it since before it went free
[17:34] <kazade> is Komodo free now?
[17:34]  * kazade adds it to the list
[17:34] <awilkins> kazade, They do a free and a premium
[17:34] <kazade> cool
[17:34] <awilkins> kazade, Komodo Edit for free, Komodo IDE for bucks
[17:34] <kazade> Ahh k..
[17:35] <kazade> Eclipse PyDev has always been cool once it's configured with Pylint, but it's just so resource hungry :(
[17:35] <gord> the main reason that komodo is good for python is that everything else is so bad with python though
[17:35] <awilkins> If I suddenly became a pro Python developer, I'd probably pay for the IDE version and try it out for a month or so
[17:36] <awilkins> But I've not hacked any Python since I got Bazaar working well enough in Windows
[17:36] <davmor2> gord: geany ftw :D
[17:36] <awilkins> (only a few things, like IIS and SSH support in win32 environments)
[17:38] <awilkins> What I've really been craving is a good Debian packaging plugin for Eclipse
[17:38] <awilkins> It can't be that hard... have a "source" object and "package output" objects and fill in the forms for them...
[17:38] <gord> davmor2, vim ftw :P
[17:39] <awilkins> Run lintian over it at the end and present the problems in the Eclipse problems list
[17:39] <davmor2> gord: if you're going down that path nano ftw!
[17:39] <gord> davmor2, don't be ridiculous :P
[17:40] <gord> nano is that horrible editor that makes my documents be peppered with :w all over the place
[17:40] <awilkins> Is it just me or is there little impetus to make Debian packaging easier because it's perceived as a badge of honour to have wrangled your way though the pain?
[17:40] <awilkins> Or is it that if the bar was lowered, undesirables and bad packaging would be the result?
[17:40] <gord> i think its more that once you have got through the pain, the tools work very simply, very easy to understand and use. so the itch does not need scratching
[17:41] <davmor2> gord: well stop trying to write out from it in vim terms then :P
[17:41] <gord> *never*
[17:42] <awilkins> It's things like the answer to the question : "By default, the upstream source package sets a prefix of /usr/local ; what is the standard mechanism for setting this to /usr in the debian packaging method?"
[17:46] <awilkins> Apparently the answer is that dh_auto_configure does it for you
[17:49] <ali1234> debian packaging is awful
[17:49] <ali1234> but at least it isn't rpm
[17:49] <ali1234> and in theory the tools are simple and easy to use
[17:50] <ali1234> but in the majority of cases they don't do what you need and every package that is more complicated that hello world ends up with many nasty hacks in the rules file
[17:50] <ali1234> and then you end up with packages that only build from the source once, then you have to rm -rf the whole thing and start again
[17:51] <ali1234> such as Qt for example, which takes about an hour to build the first time
[17:51] <awilkins> Reading both the Ubuntu debian packaging guide and the Debian maintainers guide has so far failed to enable me to produce a working set of packages for the thing I am packaging. It's easy enough to install it with some hacks like moving the JNI libraries to the right folder manually afterwards... but still, I'd prefer to be able to just add my PPA and apt-get it
[17:52] <ali1234> you just put the copy command into rules... = a nasty hack
[17:52] <ali1234> but it will work
[17:52] <awilkins> Now I thought that was what the various *.install files were for
[17:53] <ali1234> well it depends what you need it to do
[17:53] <awilkins> I just want it to put one library in /usr/lib/jni instead of /usr/lib
[17:53] <ali1234> so you just make sure it's at that location inside the deb
[17:54] <ali1234> by moving it before you create the deb
[18:12] <directhex> both are valid approaches
[18:12] <directhex> i'd say using debian/install is better
[18:21] <awilkins> I agree
[18:21] <awilkins> It keeps hackishness and patching the original sources to a minimum
[19:09] <daubers> Evening
[19:23] <dwatkins> hi daubers
[19:24] <zleap> hello
[19:24] <zleap> upgrade to 11.10 seems to have gone very well
[20:57] <daubers> \o/
[20:57] <daubers> I'd forgotten how amazing Back to the Future was
[20:58] <brobostigon> :)
[20:59] <daubers> Ubuntu-UK: Where we're going, we don't need roads.
[21:02] <daubers> \o/
[21:02] <daubers> Today has been a good day :)
[21:03] <AlanBell> do you have a fuse filesystem?
[21:03] <daubers> Got my Filesystem to work (few bugs left, but it works \o/), had chinese for free AND found Back to the Future Trilogy on DVD for £6
[21:03] <daubers> AlanBell: Yes indeedy :)
[21:03] <AlanBell> I am a bit flummoxed by the need to know the filesize before it is opened
[21:03] <daubers> You're doing this in python still?
[21:03] <AlanBell> yeah
[21:04] <daubers> Which example did you use? NullFS or xmp.py?
[21:04] <AlanBell> hello.py
[21:04] <daubers> ah
[21:04] <AlanBell> and I looked at nullfs (yo dawg, we heard you liked filesystems)
[21:05] <AlanBell> and xmp too, but I was just playing with hello.py
[21:05] <daubers> I started with xmp, and used that as a base. But I don't need to interact with files, which makes it easier (just change the path as it passes through)
[21:06] <AlanBell> it looks like if getattr says the file is 5 bytes long then all it will return is 5 bytes
[21:06] <AlanBell> even if read tries to return "Hello World" all that gets read is "Hello"
[21:07] <AlanBell> what I want to do is a fuse filesystem for openERP
[21:07] <AlanBell> so you would get a directory of invoices, one of purchase orders etc etc
[21:07] <daubers> can you not just calculate the size from the data you have?
[21:07] <AlanBell> they would all look like PDF files, and you can open them, but they don't really exist until you open them and it kicks of the report engine on the server to generate the PDF
[21:08] <AlanBell> nope, because they don't exist until it plugs the fields into an ODT file then spawns libreoffice headless to make a PDF
[21:08] <daubers> can you not treat them as softlinks? or do softlinks pass through the size?
[21:09] <AlanBell> I have read some stuff about treating dynamic files as FIFO objects, but I have no idea how to do that
[21:09] <daubers> If you can figure out how to treat them as softlinks then it should work. A link has size "st_size=100"
[21:10] <daubers> also..... are you creating a file class?
[21:11] <daubers> You might get away with doing it in there?
[21:13] <AlanBell> I have not really got very far, just trying to get all the pieces together so I can assemble them
[21:14] <daubers> Fair enough :) It's quite fun when you get into it
[21:14] <daubers> stackexchange thing on fifo's http://stackoverflow.com/questions/1430446/create-a-temporary-fifo-named-pipe-in-python
[21:16] <AlanBell> hmm, that is how to make one, but not how to pretend to be one in fuse :)
[21:18] <daubers> heh :) Do you not just make one and subclass it's read/write stuff or somesuch?
[21:19] <AlanBell> maybe if getattr returns the right size before read gets called
[21:20] <AlanBell> dunno the sequence of calls quite
[21:22] <daubers> If you make a file class, the file is opened in the init, and then you can control the read/write calls
[21:23] <daubers> Don't think that was in nullfs, but is definatley in xmp
[21:28] <AlanBell> hmm, still fgetattr has to return a size at some stage
[21:32] <Seeker`> Daviey: are you the portable paper friend?
[21:33] <Daviey> Seeker`: indeed
[21:33] <Seeker`> \o/
[21:33] <Seeker`> its the beard that gives you away
[21:35] <Daviey> heh
[21:36] <Seeker`> what  can I do with my 10 points?
[21:37] <Daviey> They are worth 0.001 bitcoins.. so you could sell them
[21:38]  * daubers waits for quickly to install
[21:38] <Seeker`> :O ZOMGWOW
[21:39] <mattt> evening evening
[21:42] <daubers> Other than "They're all terrible" does anyone have any opinions on forum software these days?
[21:42] <daubers> Probably going to end up going down the phpbb route by the look of it
[21:43] <popey> ubuntu uses vbulletin
[21:43] <popey> phpbb has a reputation...
[21:44] <daubers> I know, vbulletin costs £lots
[21:44] <popey> does it?
[21:45] <daubers> It's like $200
[21:45] <daubers> https://www.vbulletin.com/
[21:45] <popey> is that a lot?
[21:45] <daubers> For an organisation that is not for profit and has no money, yes :)
[21:46] <daubers> (this is for the hackspace)
[21:46]  * daubers considers £lots to be > ~£45-50
[21:46] <daubers> skyrim is lots :(
[21:47] <daubers> My options seem to be phpbb, yabb or Simple Machines
[21:49] <daubers> arduino seem to use SMF
[21:54] <directhex> dotnetnuke!
[21:55] <daubers> heh :)
[21:55] <daubers> c# or vb?
[21:55] <ali1234> write your own in turbopascal
[21:55] <directhex> daubers: i assume it'd work, dunno if it's any good. and vb is a horrible language for perverts
[21:56] <directhex> oh, did i remember to upload vb.net to sid? i don't think i did
[22:01] <Daviey> daubers: $200 really isn't very much... if they are still bootstrapping, they should use hosted forums or mailing list... when they have the userbase, ask for donations... doesn't take many people giving $10 to reach the target :)
[22:01]  * jutnux pokes daubers
[22:02] <popey> ooo turbopascal
[22:02] <popey> those were the days
[22:05] <Myrtti> I wrote the snake game
[22:05] <daubers> Daviey: We're still trying to cover the cost of the building.... Andy's very kindly given us a VPS for free so I'd like to put it in there
[22:07] <daubers> Daviey: Might give SMF a go for now, and then look at moving to vbulletin at a later date
[22:08] <daubers> I'd rather spend that $200 on a new tube for the laser cutter rather than some forum software
[22:34] <popey> oooh, snow
[22:34] <ubuntubhoy> where ?
[22:34] <popey> on tv
[22:34] <ubuntubhoy> it can stay there
[22:35] <popey> hah
[22:36] <jutnux> Howdy all.
[22:37]  * daubers is supposedly driving to bolton tomorrow...
[22:39] <popey> bolt on
[22:40] <daubers> Might go watch my younger brother do a faclonry display on the way or on the way back
[22:41] <mgdm> nice
[22:51]  * daubers heads to bed
[22:51] <daubers> night all
[22:59] <popey> excellent plan
[23:11] <jutnux> Adios
[23:12] <jutnux> I appear to be 20 minutes late


[21:43] <LLKCKfan> Does anyone know anything about Nook apps? I do not have the Nook itself but I have two of the apps


[05:33] <Tm_T> moin
[07:09] <dholbach> good morning
[15:06] <jose> czajkowski: ping, would you mind a quick PM?
[15:22] <czajkowski> sure
[15:24] <czajkowski> jose: ^


[00:58] <davecheney> niemeyer: got a better fix for signing bug
[00:58] <davecheney> will propose in a few minutes
[01:06] <davecheney> niemeyer: did you fix lbox so it doesn't mess up the milestone of a bug ?
[01:06] <davecheney> if so, thank you :)
[01:08] <niemeyer> davecheney: Yo
[01:08] <niemeyer> davecheney: Morning
[01:08] <niemeyer> davecheney: I didn't yet, sorry
[01:19] <davecheney> niemeyer: weird, i wonder why lbox propose didn't screw up the milestone on https://bugs.launchpad.net/juju-core/+bug/1061941
[01:20] <davecheney> maybe because it's a different project
[01:48] <niemeyer> davecheney: Perhaps the milestone picking logic is actually right
[01:48] <niemeyer> davecheney: What I did was to deactivate 1.3 a while ago
[01:48] <davecheney> \o/ !
[02:34] <niemeyer> davecheney: Bed time here
[02:34] <niemeyer> davecheney: Have a good time
[02:34]  * niemeyer => zzzzzZZZ
[07:28] <wrtp> fwereade__: morning
[07:32] <fwereade__> wrtp, heyhey
[09:17] <wrtp> davecheney: hiya
[09:18] <wrtp> davecheney: if you have a moment, this evening, it would be great if you could try to provoke that test failure - i'd like to get that CL submitted.
[09:23] <davecheney> wrtp: that is the thing
[09:23] <davecheney> the test never fails
[09:23] <wrtp> davecheney: have you tried raising the iteration count?
[09:23] <wrtp> davecheney: (did you see my reply BTW?)
[09:24] <davecheney> i think i may not have
[09:24] <davecheney> basically i reveted state.go
[09:24] <davecheney> and the test still passed
[09:24] <davecheney> so, what is the test testing ?
[09:24] <wrtp> davecheney: i only replied an hour ago
[09:24] <wrtp> davecheney: it's testing a race condition
[09:24] <wrtp> davecheney: read my reply for details
[09:24] <davecheney> ok, i'll go upstairs and read it
[09:25] <wrtp> davecheney: ta
[09:45] <fwereade__> guys, I need to take a somewhat extended lunch; https://codereview.appspot.com/6734046 is pretty trivial if anyone is bored ;p
[09:51] <wrtp> fwereade__: reviewed
[10:20] <Aram> moin.
[10:29] <wrtp> Aram: hiya
[12:22] <wrtp> this fails for me.go test labix.org/v2/mgo
[12:23] <wrtp> could someone else try it, and let me know if the test passes, please.
[12:23] <Aram> one min\
[12:23] <wrtp> Aram: thanks
[12:24] <Aram> wrtp: failed
[12:24] <wrtp> Aram: thanks
[12:25] <Aram> wrtp: I remember now, actually.
[12:25] <Aram> it never passed for me
[12:25] <Aram> I remember that error from when I started using mgo
[12:25] <Aram> it never worked right here
[12:25] <wrtp> Aram: it's strange because it looks like that js is ok
[12:25] <wrtp> Aram: that is, i can't see how rs1a could be undefined.
[12:26] <wrtp> Aram: ah, i see
[12:27] <Aram> yeah
[12:27] <wrtp> Aram: maybe the server ports have changed or something
[12:27] <Aram> what momgodb version do you have?
[12:27] <Aram> this is 2.0.4
[12:27] <wrtp> Aram: the one we're using in ec2, i think
[12:28] <wrtp> Aram: 2.2.0
[12:31] <wrtp> Aram: hmm, i think it might be failing because i don't have a "supervisorctl" command
[12:31] <wrtp> (whatever that's supposed to do)
[12:32] <Aram> yeah, I don't have that either
[12:34] <wrtp> Aram: hmm, that doesn't seem to have fixed it
[12:57] <niemeyer> Moooorning
[13:01] <fwereade__> niemeyer, heyhey
[13:07] <wrtp> niemeyer: yo!
[13:08] <wrtp> niemeyer: any hints as to how i can get mgo tests passing? it seems like it's something to do with supervisord (which wasn't installed), but i've failed to get it working even when it is.
[13:09] <niemeyer> wrtp: You have to run make startdb
[13:09] <wrtp> niemeyer: ah!
[13:09] <niemeyer> wrtp: It sets up the 12 servers, etc
[13:09] <niemeyer> wrtp: It doesn't restart them across runs
[13:10] <wrtp> niemeyer: right - i see now. that was not so obvious :-)
[13:14] <niemeyer> wrtp: Anything you think is broken there?
[13:15] <wrtp> niemeyer: i just wanted to check that i could connect to mongodb with Go's TLS, so i made some changes to allow that and wanted to verify that everything was still working
[13:15] <wrtp> niemeyer: i do get one test failure, even after running startdb, BTW
[13:15] <niemeyer> wrtp: I will work on that on my own time
[13:15] <wrtp> niemeyer: it looks like session.DatabaseNames doesn't always return the names in sorted order
[13:15] <wrtp> niemeyer: ok. you don't want to accept it as a contribution?
[13:16] <niemeyer> wrtp: Is juju distributing TLS certificates properly?  I'll happily take that as a contribution. :-)
[13:16] <wrtp> niemeyer: i need to talk with you about that
[13:17] <wrtp> niemeyer: i didn't want to build an implementation without deciding what to do first
[13:17] <niemeyer> wrtp: Understood.. the point is that I'm happy to use my own time to work on mgo as I've been doing since day one. We don't have to spend our time to do that.
[13:17] <wrtp> niemeyer: that's ok.
[13:17] <wrtp> niemeyer: it was only 10 minutes' work
[13:18] <niemeyer> wrtp: Cool, but it wouldn't be to implement it properly
[13:18] <wrtp> niemeyer: no? it's true i'm probably unaware of the subtleties
[13:19] <wrtp> niemeyer: i thought something like this was probably sufficient: http://paste.ubuntu.com/1286877/
[13:24] <niemeyer> wrtp: Quite possibly
[13:24] <niemeyer> wrtp: That's what Dave suggested too
[13:27] <wrtp> niemeyer: here's my half-baked plan for key distribution BTW: http://paste.ubuntu.com/1286895/
[13:33] <niemeyer> fwereade__: I think there was some misunderstanding on the Cleanup review
[13:33] <niemeyer> fwereade__: But perhaps it's for the best
[13:34] <fwereade__> niemeyer, oh, sorry, perhaps there was
[13:34] <fwereade__> niemeyer, what did I miss?
[13:34] <niemeyer> fwereade__: The suggestion was to run RemoveAll, but not to scan through all documents pending of cleanups at once
[13:35] <fwereade__> niemeyer, yes -- that changed because it appeared to make the code simpler, and I couldn't think of a serious drawback...
[13:36] <fwereade__> niemeyer, given that I was looping until I found a valid cleanup doc *anyway*, I thought it was easier to just keep on looping :)
[13:36] <wrtp> i've got to reboot. back in a mo.
[13:36] <niemeyer> fwereade__: It may only load the system at once a bit more, but it sounds worth trying
[13:36] <fwereade__> niemeyer, yeah, it seemed to follow the spirit of your other suggestions :)
[13:37] <niemeyer> fwereade__: I think the cleanups doc is fine to be deleted out of a transaction too, btw
[13:38] <fwereade__> niemeyer, I thought "better safe than sorry" there, on the basis that it's a new feature whose context is yet to be completely determined
[13:38] <niemeyer> fwereade__: We did its intended action before getting there, and the action is idempotent, so any mixup should be fine
[13:39] <fwereade__> niemeyer, true enough, happy to change
[13:40] <niemeyer> fwereade__: For clarity, the dangers we can incur by not using a transaction, in that specific case, is seeing the change being done again
[13:41] <niemeyer> fwereade__: Because if the transaction failed on the insert side before being finished, someone else will attempt to apply the transaction again, and may end up reinserting the doc
[13:41] <niemeyer> fwereade__: After that transaction is finished, that doc is never seen in a transaction again
[13:42] <niemeyer> fwereade__: So the worst that can happen is Cleanup running the same cleanup twice, which is not a big deal due to its nature
[13:42] <niemeyer> fwereade__: I suspect that will be true in general for cleanups
[13:42] <fwereade__> niemeyer, hope so :)
[13:43] <niemeyer> fwereade__: If you want me, I'll be in my bunker
[13:43] <fwereade__> haha
[13:44] <wrtp> niemeyer: any thoughts on my key distribution sketch above?
[13:45] <niemeyer> wrtp: I started reviewing a branch before you posted, and I haven't yet finished
[13:45] <wrtp> niemeyer: ok, np
[13:46] <wrtp> niemeyer: i wasn't sure you noticed the paste.
[13:47] <niemeyer> fwereade__: LGTM, thanks a lot for the rounds
[13:47] <niemeyer> wrtp: np
[13:47] <niemeyer> wrtp: SO..
[13:47] <rogpeppe> niemeyer: so...
[13:47] <niemeyer> rogpeppe: We don't need --sslOnNormalPorts.. we don't even use normal ports
[13:48] <rogpeppe> niemeyer: ok. that just came from a web page. i'm not fully cognizant of the implications of all the mongod flags :-)
[13:49] <rogpeppe> niemeyer: (i thought perhaps it might allow non-ssl connections without that flag)
[13:50] <niemeyer> rogpeppe: We want --ssl, I think
[13:50] <niemeyer> rogpeppe: I don't have a lot of experience with ssl on mongo myself, to be honest
[13:50] <niemeyer> rogpeppe: 10gen plays a trick I don't find so nice
[13:50] <rogpeppe> niemeyer: i was going from this page: http://docs.mongodb.org/manual/administration/ssl/
[13:51] <niemeyer> rogpeppe: Their own packages don't have ssl built-in.. you have to pay for a subscription
[13:51] <rogpeppe> niemeyer: yeah, that's why you had to do your own build, right?
[13:51] <niemeyer> All things considered, I guess it's a fine way to stay in business, though
[13:51] <niemeyer> rogpeppe: Yeah
[13:52] <rogpeppe> niemeyer: if people can't be bothered to do a build, then it's their problem i guess.
[13:52] <rogpeppe> niemeyer: (you didn't have that easy a time of it AFAIR though!)
[13:52] <niemeyer> Hmm.. "Add the “ssl=True” parameter to a PyMongo".. I'll have to investigate what's the standard way drivers are handling that
[13:53] <niemeyer> "mongodb://localhost/?ssl=true&sslverifycertificate=false"
[13:53] <niemeyer> interesting..
[13:53] <niemeyer> Anyway, sorry, derail
[13:54] <niemeyer> rogpeppe: Only because it takes forever.. otherwise it was somewhat okay
[13:54] <niemeyer> rogpeppe: in your sketch, I'm not entirely sure of what lines 12-15 mean
[13:55] <rogpeppe> niemeyer: we've got to make the public key available somewhere outside of the state, right?
[13:55] <rogpeppe> niemeyer: and the server itself must generate the public key, i think
[13:55] <niemeyer> rogpeppe: Well, we can only generate the public key by generating the pair
[13:56] <rogpeppe> niemeyer: exactly
[13:56] <niemeyer> rogpeppe: I'm not sure we want to do that at the server side, though
[13:56] <niemeyer> rogpeppe: It means the client has to trust the server blindly, at least once
[13:56] <rogpeppe> niemeyer: and we don't want to make the private key available in cloudinit
[13:56] <rogpeppe> niemeyer: there's another way around that, i think, which is orthogonal to this
[13:57] <rogpeppe> niemeyer: which is to have a client-specified value that's put into the state.
[13:57] <niemeyer> rogpeppe: That's a bit related to that conversation we had the other day regarding push vs. pull
[13:57] <niemeyer> rogpeppe: Erm.. sorry
[13:57] <niemeyer> rogpeppe: That was confusng
[13:58] <niemeyer> rogpeppe: The conversation regarding bootstrapping via ssh rather than via cloud-init
[13:58] <rogpeppe> niemeyer: i remember the conversation
[13:58] <niemeyer> rogpeppe: Or perhaps via both, but pushing the changes via ssh
[13:58] <rogpeppe> niemeyer: don't we have the same problem there. we must trust the server blindly the first time.
[13:58] <niemeyer> rogpeppe: Let me look at how we bootstrap today for a sec.. just a moment
[14:01] <niemeyer> rogpeppe: Okay
[14:02] <niemeyer> rogpeppe: I guess the problem we have is pretty much the same as the problem we just solved with the password
[14:02] <rogpeppe> niemeyer: if we could write to environments.yaml, our problem would be simpler
[14:03] <niemeyer> rogpeppe: Seems like a red-herring
[14:03] <niemeyer> rogpeppe: How did we solve the problem of initializing the password?
[14:04] <rogpeppe> niemeyer: we changed it
[14:04] <niemeyer> rogpeppe: Yep
[14:04] <rogpeppe> niemeyer: but if the password is specified in environments.yaml, we can't do that.
[14:04] <niemeyer> rogpeppe: Hmm.. I lost you
[14:05] <niemeyer> rogpeppe: The password *is* specified in environments.yaml, and we do that
[14:05] <niemeyer> rogpeppe: environments.yaml seems like a red-herring
[14:05] <rogpeppe> niemeyer: perhaps i'm misunderstanding you. the password in environments.yaml is so we can authenticate ourselves to the server. what we're trying to do here is authenticate the server to the client, no?
[14:06] <niemeyer> rogpeppe: The problem we have is exactly the same.. we have a private key that we want the server to hold without exposing to everybody that can read cloud-init
[14:07] <rogpeppe> niemeyer: ok... so who generates the private key?
[14:07] <niemeyer> rogpeppe: We do
[14:07] <niemeyer> rogpeppe: The client
[14:07] <rogpeppe> niemeyer: how does that help?
[14:08] <rogpeppe> niemeyer: i suppose it means we don't have to wait for the public key to become available
[14:08] <niemeyer> rogpeppe: It's the only way for the client to be able to tell it's talking to the right server
[14:08] <rogpeppe> niemeyer: i don't see how it helps
[14:08] <niemeyer> rogpeppe: Hmm.. expand?
[14:09] <rogpeppe> niemeyer: when we connect for the first time after bootstrap, how do we tell if we're talking to the right server?
[14:09] <niemeyer> rogpeppe: When you connect to your bank in your browser, how can your browser tell it is talking to the right endpoint?
[14:10] <niemeyer> rogpeppe: (or at least hope so ;)
[14:10] <rogpeppe> niemeyer: because your browser has stored a public key of the bank.
[14:10] <niemeyer> rogpeppe: Almost, but close enough
[14:11] <rogpeppe> niemeyer: so where do we store the public key that we generate at bootstrap time?
[14:11] <rogpeppe> niemeyer: ah, i suppose we can use our local key to sign a certificate for the server
[14:11] <rogpeppe> niemeyer: and then use our local key as the root CA
[14:12] <rogpeppe> niemeyer: i'm not sure that works though
[14:13] <rogpeppe> niemeyer: hmm, maybe.
[14:13] <niemeyer> rogpeppe: Why?
[14:15] <rogpeppe> niemeyer: i guess we'd need another field in environments.yaml
[14:15] <rogpeppe> niemeyer: to hold the original signer's certificate
[14:15] <rogpeppe> niemeyer: we could overload authorized-keys, i suppose
[14:16] <niemeyer> rogpeppe: Uh.. why the obsession about environments.yaml?
[14:16] <niemeyer> rogpeppe: and how's authorized-keys related to the problem?
[14:16] <niemeyer> rogpeppe: This is the ssh key, and it works well
[14:16] <niemeyer> rogpeppe: No need to fiddle there
[14:17] <rogpeppe> [15:09:02] <rogpeppe> niemeyer: when we connect for the first time after bootstrap, how do we tell if we're talking to the right server?
 rogpeppe: environments.yaml seems like a red-herring
[14:17] <niemeyer> :)
[14:17] <rogpeppe> :-)
[14:17] <rogpeppe> niemeyer: i'm not sure how to answer my question above
[14:17] <niemeyer> rogpeppe: You've already answered it?
[14:18] <rogpeppe> niemeyer: my answer only works if we know what key signed the server's cert
[14:18] <niemeyer> rogpeppe: Of half of it, anyway
[14:18] <rogpeppe> niemeyer: and that's something that needs to be specified in environments.yaml AFAICS
[14:18] <niemeyer> rogpeppe: Exactly, that's what we're handing off the key to the server
[14:18] <niemeyer> s/what/why
[14:18] <niemeyer> rogpeppe: lOL
[14:19] <niemeyer> rogpeppe: We can do whatever we want.. yes, it may be in environments.yaml, it may be in ~/.juju/envname.cert, or whatever
[14:19] <rogpeppe> niemeyer: ok, so we've handed off the key to the server. now we connect again, and the server presents a certificate. how do we tell if that certificate is valid?
[14:21] <rogpeppe> niemeyer: ok, sorry. i was using environments.yaml as a place-holder for "somewhere with client configuration information". of course it could be stored elsewhere too.
[14:21] <niemeyer> rogpeppe: You've already answered it:
 niemeyer: ah, i suppose we can use our local key to sign a certificate for the server
 niemeyer: and then use our local key as the root CA
[14:22] <rogpeppe> niemeyer: the reason for the possible authorized-keys possible-red-herring is that we already have a local key, which we use to connect with SSH. we could use that very same key to sign the initial certificate.
[14:22] <rogpeppe> niemeyer: rather than requiring everyone to generate another key just for juju
[14:23] <niemeyer> rogpeppe: Nope.. different worlds
[14:23] <rogpeppe> niemeyer: ok
[14:24] <rogpeppe> niemeyer: so... in this proposed world, we have our own key distribution problem at the client side.
[14:24] <rogpeppe> niemeyer: everyone that needs to bootstrap an environment must have a private key signed by the root key
[14:25] <niemeyer> rogpeppe: This seems to put a simple problem in somewhat of a dark perspective
[14:26] <niemeyer> rogpeppe: I'd put it more lightly as
[14:26] <niemeyer> rogpeppe: When we bootstrap, we sign the key we hand off to the server
[14:28] <rogpeppe> niemeyer: i suppose i'm slightly concerned at the change in juju usage implied here. before, you could just bootstrap anywhere, and connect to the environment from any other place as long as you had an authorized ssh key.
[14:29] <niemeyer> rogpeppe: That feels like an entirely different context than the one we're talking about
[14:29] <rogpeppe> niemeyer: now you can only bootstrap if you've got a private key that is derived from the root key.
[14:29] <rogpeppe> niemeyer: (the root key being the one mentioned in the other environments.yaml files, so that they can connect)
[14:30] <niemeyer> rogpeppe: Sorry, I think either you see something I don't, or you're creating a picture that I'm not perceiving
[14:30] <niemeyer> rogpeppe: Generate key, sign, send to server, profit..
[14:30] <niemeyer> rogpeppe: Where's the pain coming from?
[14:31] <rogpeppe> niemeyer: connecting again
[14:31] <niemeyer> rogpeppe: yes?
[14:32] <rogpeppe> niemeyer: if i'm connecting from a different host, i've got to verify that the bootstrapped environment's key was signed by the original key
[14:32] <rogpeppe> niemeyer: so i need to know about the original key
[14:32] <niemeyer> rogpeppe: Yes you do need to know about the server certificate if you want to validate the server is who we think it is
[14:32] <niemeyer> rogpeppe: That's called authentication
[14:33] <niemeyer> rogpeppe: Something we conveniently ignore right now
[14:33] <rogpeppe> niemeyer: we're actually verifying the client that did the bootstrap in this case.
[14:33] <rogpeppe> i think
[14:33] <niemeyer> rogpeppe: ?
[14:34] <rogpeppe> niemeyer: that's where the chain of trust starts
[14:34] <rogpeppe> niemeyer: which seems good, actually.
[14:38] <rogpeppe> niemeyer: hmm, i guess we'll have to issue the initial certficate with a very limited lifespan.
[14:38] <rogpeppe> niemeyer: no that doesn't work
[14:39] <rogpeppe> niemeyer: i'm not sure how we'll do the interaction to sign the new key when first connecting to the state.
[14:40] <niemeyer> rogpeppe: We can create a temporary cert to sign the trashed private key
[14:41] <rogpeppe> niemeyer: the server does that?
[14:41] <niemeyer> rogpeppe: We cannot create the certificate in the server because then we cannot talk to the server and know we're talking to the right server
[14:41] <rogpeppe> niemeyer: perhaps we need to run a little server that the client connects to, reads the new public key from the server, and sends back a signed cert
[14:42] <rogpeppe> niemeyer: indeed
[14:42] <rogpeppe> niemeyer: but we can (and should) generate a new private key on the server, and get that signed
[14:43] <niemeyer> rogpeppe: We can generate the private key on the client and sign it on the client where we have the certificate
[14:44] <rogpeppe> niemeyer: how do we send it to the server?
[14:45] <rogpeppe> niemeyer: we could put it in the state, i guess, but that seems wrong to me
[14:47] <niemeyer> rogpeppe: Why?
[14:48] <rogpeppe> niemeyer: for the same reason we don't put admin-password in the state
[14:49] <niemeyer> rogpeppe: One of the reasons we don't put it in the state is because nobody needs it
[14:51] <rogpeppe> niemeyer: i thought it was a security issue too - we don't want anyone with access to the state to be able to impersonate the state server.
[14:51] <rogpeppe> s/thought it was/think it might be/
[14:52] <rogpeppe> niemeyer: of course, they can only do that if they subvert DNS too
[14:53] <niemeyer> rogpeppe: Give me access to the state without a private key, and I'll dig the key out of the state server in a short while
[14:53] <rogpeppe> niemeyer: that's true of all our passwords too, of course. (with the exception of admin-password itself)
[14:54] <niemeyer> rogpeppe: No, you cannot figure the password actually, but that's a derail
[14:55] <niemeyer> rogpeppe: The points are:
[14:56] <niemeyer> 1) We're consciously not handling authorization anywhere yet
[14:56] <niemeyer> 2) Anyone with access to the state *today* can do whatever they want
[14:56] <niemeyer> 3) That includes getting access to the state server
[14:56] <niemeyer> 4) We're walking towards having a true API that manages authorization
[14:57] <niemeyer> 5) With authorization, we can prevent people from having access to things they shouldn't
[14:57] <niemeyer> 6) Even in the future, anyone that gets access to a state server *database* will have the private key for the server anyway, no matter if the key sits within the state or not
[14:58] <niemeyer> That's it, I think
[14:59] <rogpeppe> niemeyer: i suppose it just *feels* more secure to have the server generate its own private key. but you're probably right that it's unnecessary.
[15:00] <niemeyer> rogpeppe: Well, I won't argue about that. If you know why it's more secure I'd be interested though.
[15:02] <rogpeppe> niemeyer: it means we're not leveraging future security on current security so much. once a state server has obtained an identity, it can keep it, knowing that no-one else has its private key. that said, i can't think of any attacks in particular that this enables.
[15:03] <niemeyer> rogpeppe: Yeah, I don't see where the "more secure" bits went in
[15:04] <niemeyer> rogpeppe: And I see a bunch of issues to solve, such as how to distribute keys to replica sets, and how to ensure the key isn't lost
[15:08] <wrtp> hmm, don't know why i was kicked of then
[15:08] <wrtp> niemeyer: last thing i saw: [16:04:15] <niemeyer> rogpeppe: And I see a bunch of issues to solve, such as how to distribute keys to replica sets, and how to ensure the key isn't lost
[15:08] <wrtp> off
[15:08] <niemeyer> wrtp: Yeah, that was it
[15:08] <wrtp> niemeyer: what was the last thing you saw me say?
[15:09] <niemeyer> wrtp: Nothing after that
[15:09] <wrtp> 16:06:29] <rogpeppe> niemeyer: here's a thought: is it actually possible to change the server's key after it has started running?
[15:09] <wrtp> [16:06:52] <rogpeppe> niemeyer: or will we need to shut down mongod and restart it pointing to the new private key
[15:09] <wrtp> ?
[15:11] <niemeyer> wrtp: Short term, I suppose we have to restart it
[15:12] <wrtp> niemeyer: and there's another issue too - how do we ensure that the original certificate (in cloud-init) isn't valid forever, while ensuring we can connect an arbitrary time after bootstrap
[15:12] <wrtp> ?
[15:12] <niemeyer> Oct 18 11:40:53 <niemeyer>      rogpeppe: We can create a temporary cert to sign the trashed private key
[15:12] <wrtp> niemeyer: i'm not sure quite what you mean by that
[15:12] <niemeyer> wrtp: Temporary cert?
[15:12] <niemeyer> wrtp: What part?
[15:13] <wrtp> niemeyer: yeah
[15:13] <niemeyer> wrtp: Sorry, can you explain what you don';t understand?
[15:13] <wrtp> niemeyer: do you mean a certificate with a short expiry time?
[15:13] <niemeyer> wrtp: No.. I mean creating a certificate that is itself temporary
[15:14] <wrtp> niemeyer: i'm not sure what that means
[15:14] <wrtp> niemeyer: stored temporarily?
[15:14] <niemeyer> wrtp: I don't know how to explain that more simply
[15:14] <niemeyer> wrtp: Yes
[15:15] <wrtp> niemeyer: but the cert is in the cloud-init data; how can it be stored only temporarily?
[15:15] <niemeyer> wrtp: No, the cert is local
[15:15] <niemeyer> wrtp: priv and pub keys are in cloud-init
[15:16] <wrtp> niemeyer: don't we need to pass a cert in the cloud-init too?
[15:16] <wrtp> niemeyer: because we need to sign it with the client's private key
[15:17] <niemeyer> wrtp: Hm?
[15:17] <wrtp> niemeyer: isn't that the basis of our security here?
[15:17] <wrtp> niemeyer: how else do we know that the certificate is valid when we're connecting to the state?
[15:18] <niemeyer> wrtp: Because we have the certificate with which the private key was signed
[15:18] <niemeyer> Erm
[15:18] <niemeyer> The public key
[15:18] <wrtp> niemeyer: the server has that certificate?
[15:18] <niemeyer> wrtp: Not necessarily, although we should probably send the public part of it as a sensible thing to do
[15:19] <niemeyer> wrtp: That's not what the security is based on, though
[15:19] <wrtp> niemeyer: oh, i *think* i start tosee.
[15:19] <wrtp> to see
[15:19] <niemeyer> wrtp: A private key is used to sign stuff, and to encrypt stuff for people to have the public key
[15:20] <wrtp> niemeyer: i know that.
[15:21] <niemeyer> wrtp: A public key is signed by a private part of the certificate so that people holding the public part of the certificate can attest that whoever handed off the public key was signed by the private part of the certificate
[15:21] <wrtp> niemeyer: i do know how pk auth works, i think
[15:22] <niemeyer> wrtp: My apologies, but that's exactly what I've been explaining
[15:22] <wrtp> niemeyer: i'm just not entirely sure what configuration you envisage here
[15:22] <wrtp> niemeyer: i think i might see. i was thinking that the private key would be generated at bootstrap time.
[15:23] <niemeyer> wrtp: and it will
[15:26] <niemeyer> Oct 18 11:30:45 <niemeyer>      rogpeppe: Generate key, sign, send to server, profit..
[15:26] <wrtp> niemeyer: (sorry, i'm feeling particularly dense today)
[15:27] <wrtp> niemeyer: i thought that the server side of the TLS connection needed the signed certificate
[15:30] <niemeyer> wrtp: The server side needs a public key signed by the local certificate and a private key
[15:31] <wrtp> niemeyer: hmm, that's what i thought
[15:31] <wrtp> niemeyer: so that {public key signed by the local certificate} must go into the cloud-init data, right?
[15:31] <niemeyer> wrtp: The server side needs a public key signed by the local certificate and a private key
[15:31] <niemeyer> wrtp: Both need to go
[15:32] <wrtp> niemeyer: yeah, sure, the private key too
[15:32] <wrtp> how does that tally with this: [16:15:22] <niemeyer> wrtp: No, the cert is local
[15:33] <niemeyer> wrtp: "signed by the local certificate"?
[15:33] <wrtp> niemeyer: isn't a public key signed by the local certificate a certificate itself?
[15:34] <wrtp> niemeyer: i'm probably getting my terminology wrong, sorry.
[15:34] <niemeyer> wrtp: It can be if its respective private key is used to sign something else.. but I don't think that matters/
[15:34] <niemeyer> ?
[15:34] <wrtp> niemeyer: (i was thinking that certificates can't sign things, only private keys can)
[15:34] <niemeyer> niemeyer> wrtp: A public key is signed by a private part of the certificate so that people holding the public part of the certificate can attest that whoever handed off the public key was signed by the private part of the certificate
[15:35] <wrtp> niemeyer: private-part-of-certficate == private-key, no?
[15:35] <wrtp> gah!
[15:36] <niemeyer> wrtp: I suggest reading a bit about PKI..
[15:37] <wrtp> niemeyer: i have read a certain amount, but obviously not the right bits...
[15:38] <niemeyer> wrtp: http://www.openssl.org/docs/HOWTO/certificates.txt
[15:39] <wrtp> niemeyer: that seems to agree with what i thought
[15:40] <wrtp> niemeyer: i.e. the private key is not part of the cert
[15:40] <niemeyer> wrtp: I'm sure.. we're debating this for ages just because we all understand things and are in deep agreement :)
[15:42] <wrtp> niemeyer: i'm sorry. but part of my confusion here is about terminology. when you say "public key signed by the local certificate", i find it confusing, because a certificate can't sign things.
[15:43] <wrtp> niemeyer: so i'm *trying* to get around to asking how we can limit the lifetime of the certificate we send to the server in the cloud-init data.
[15:44] <wrtp> niemeyer: i'm sorry we seem to be having difficulty here.
[15:45] <niemeyer> wrtp: Do you understand what a root certificate is?
[15:45] <wrtp> niemeyer: i believe so
[15:46] <niemeyer> wrtp: Okay.. what does it do?
[15:47] <wrtp> niemeyer: it verifies that some root private key has some attributes
[15:47] <niemeyer> wrtp: Hmm.. no..
[15:47] <niemeyer> wrtp: It signs things
[15:47] <niemeyer> wrtp: and there is both a private part of it, and a public part of it
[15:48] <wrtp> niemeyer: the public part of it *is* the certificate, i believe
[15:48] <wrtp> niemeyer: the private key is just a private key, that can be used to sign any number of certs
[15:48] <niemeyer> wrtp: Nope.. it's a pair
[15:49] <wrtp> niemeyer: if i want to sign a certificate request, i can use this command:
[15:49] <wrtp> openssl x509 -req -days 10000 -signkey $keyfile -out $certfile -in $reqfile
[15:49] <wrtp> niemeyer: that produces a certficate signed by the specified key file.
[15:50] <wrtp> niemeyer: there's no inherent pairing
[15:50] <niemeyer> wrtp: There all those fancy names, but in the end it's good old asymmetric crypto
[15:50] <wrtp> niemeyer: indeed
[15:50] <wrtp> niemeyer: the different thing about a root cert, i suppose, is that it's self-signed.
[15:53] <niemeyer> wrtp: So, you use the private part of the key pair that some call certificate, some call whatever they want, to sign things
[15:53] <wrtp> niemeyer: yup
[15:54] <niemeyer> wrtp: The root CA is the public part of it
[15:54] <wrtp> niemeyer: yup
[15:54] <niemeyer> wrtp: The thing we see and can check
[15:54] <wrtp> niemeyer: yup. but we also need to check the intermediate certificate too, right?
[15:54] <niemeyer> wrtp: The private part of the root CA is what signs the public keys we use in the server that you can also call certificate if you want
[15:55] <niemeyer> wrtp: If there is an intermediate certificate, yes
[15:55] <niemeyer> wrtp: Then the private key of the root CA signed the public key of the intermediate certificate, and the private key of the intermediate certificate signs the server public key or public certificate if you please
[15:55] <wrtp> niemeyer: in this case, there must be an intermediate certificate AFAICS because we don't send the root certificate to the cloud
[15:57] <wrtp> niemeyer: ok, in that sense we probably won't have an intermediate certificate. it's that last bit i'm talking about.
[15:57] <niemeyer> wrtp: The two last sentences contradict each other
[15:58] <wrtp> niemeyer: i realised that i meant a different thing to you by "intermediate certificate"
[15:58] <wrtp> niemeyer: hence "in that sense"
[15:58] <niemeyer> wrtp: Intermediate certificate in general is unambiguous
[15:59] <wrtp> niemeyer: in this case AFAICS, we've got two certificates in the first instance: the root cert and the cert that we give to the bootstrap instance.
[15:59] <niemeyer> http://en.wikipedia.org/wiki/Intermediate_certificate_authorities
[15:59] <niemeyer> wrtp: Yes
[16:00] <wrtp> niemeyer: so the latter cert goes in the cloud-init data, right?
[16:01] <niemeyer> wrtp: Yes, we have to send the private key and the public key for the server in cloud-init
[16:02] <wrtp> niemeyer: it's more than just the public key - it's the *certificate* (which includes expiry time, possible server name etc) too, right?
[16:02] <niemeyer> wrtp: We can call it shit if you want..
[16:02] <niemeyer> wrtp: Sorry.. I'm getting slightly tired by now
[16:02] <wrtp> niemeyer: i'm sorry, that's a big difference
[16:03] <wrtp> niemeyer: because a certificate is valid for a while
[16:03] <wrtp> niemeyer: so even if we change the private key, that certificate will still be valid
[16:03] <wrtp> niemeyer: so we *could* make the expiry time short
[16:03] <wrtp> niemeyer: but that would mean that if we didn't connect soon after bootstrap, then it'll expire and we'll lose access to our newly bootstrapped state
[16:04] <niemeyer> wrtp: I suggest we use a temporary certificate to sign the key instead, but you already knew that 1.5h ago
[16:04] <wrtp> niemeyer: who signs the temporary cert?
[16:04] <niemeyer> wrtp: Nobody.. the temporary CA cert is the thing that sings the server cert
[16:05] <wrtp> niemeyer: ah... so you're suggesting making a temporary root certificate when bootstrapping?
[16:05] <wrtp> niemeyer: and storing that somewhere on the client's machine
[16:05] <niemeyer> wrtp: http://en.wikipedia.org/wiki/Public_key_certificate
[16:07] <niemeyer> wrtp: Yes
[16:07] <wrtp> niemeyer: okaaay
[16:08] <wrtp> niemeyer: that's what i was trying to get at by saying (ages ago) that it would be nice if we could write to environments.yaml.
[16:08] <niemeyer> wrtp: ROTFL
[16:09] <niemeyer> wrtp: Sorry.. this is getting somewhat sad :)
[16:09] <niemeyer> wrtp: I'll step out for lunch
[16:10] <wrtp> niemeyer: enjoy. sorry for my obtuseness.
[16:42] <TheMue> so, CL simplified and re-proposed. time to step out for dinner.
[16:46] <wrtp> niemeyer: this how i understand the current state of affairs (slightly simplified): http://paste.ubuntu.com/1287249/
[16:46] <wrtp> niemeyer: s/current state of affairs/currently proposed scheme/
[16:50] <wrtp> niemeyer: the simplification is that i'm not sure it's particularly useful to generate a certificate on the client side; all we need to verify is the public key of the server, so it can generate its own certificate.
[16:51] <wrtp> s/certificate/temporary certificate/
[16:56] <wrtp> niemeyer: for the record that page above (http://en.wikipedia.org/wiki/Public_key_certificate) contains nothing that implies that a certificate has a private part, or can be used to sign things. i believe my confusion was understandable.
[17:21] <niemeyer> wrtp: It contains the fact that a certificate has *the public key* signed by *the CA*, but I really don't want to discuss this anymore
[17:22] <niemeyer> wrtp: If you think it doesn't have a private counterpart, I won't force you into understanding it
[17:22] <wrtp> niemeyer: me neither. i'm hoping that my paste above will move things forward.
[17:23] <wrtp> niemeyer: (of course it has a private counterpart, the signer, but that's not part of the certificate)
[17:23] <niemeyer> wrtp: "contains nothing that implies that a certificate has a private part"
[17:23] <wrtp> niemeyer: it's not a part of the certificate. anyway, moving on.
[17:24] <niemeyer> wrtp: Changing the point until it becomes reasonable makes for a very painful conversation
[17:24] <wrtp> niemeyer: a certificate contains no private data!
 wrtp: "contains nothing that implies that a certificate has a private part"
[17:24] <niemeyer> wrtp: That's what you said
[17:24] <niemeyer> wrtp: That's what I responded to
[17:24] <wrtp> niemeyer: counterpart != part
[17:25] <niemeyer> wrtp: For my own sanity I'll stop talking for the moment
[17:25] <wrtp> niemeyer: ok
[17:26] <wrtp> niemeyer: i'm sorry this is difficult. i don't mean to be awkward, but when we're talking about this stuff, it helps to have some agreed terminology.
[17:26] <wrtp> niemeyer: we should have moved to G+ hours ago
[17:29] <wrtp> niemeyer: i'd very much like some reaction to my proposal above, as i plan to start implementing it tomorrow morning, if it looks ok.
[17:29] <niemeyer> wrtp: Will check
[17:33] <niemeyer> wrtp:
[17:33] <niemeyer> on initial server:
[17:33] <niemeyer> 	get tempKey from cloud-init data
[17:33] <niemeyer> 	tempCert = generate a self-signed certificate using tempKey
[17:34] <wrtp> niemeyer: is that bad?
[17:35] <niemeyer> wrtp: Just send the key/cert signed by the temporary local CA for the server to use
[17:35] <wrtp> niemeyer: what's the point of generating two keys when one will do?
[17:37] <wrtp> niemeyer: (i'm perfectly willing to accept that there may be a good reason, but i couldn't think of one)
[17:38] <niemeyer> wrtp: What are you going to put on the root CA field?
[17:38] <wrtp> niemeyer: the certificate itself.
[17:38] <wrtp> niemeyer: sorry, the temporary key itself
[17:39] <wrtp> niemeyer: it's self-signed
[17:39] <niemeyer> wrtp: Bingo.. it's a certificate, not a private key
[17:39] <wrtp> niemeyer: the server can generate its own certificate
[17:39] <wrtp> niemeyer: i don't *think* the server needs to share a CA with the client, but i may be wrong.
[17:40] <niemeyer> wrtp: Why are you generating the same certificate twice?
[17:40] <wrtp> niemeyer: we only generate it once
[17:40] <wrtp> niemeyer: on the server.
[17:40] <wrtp> niemeyer: the client just generates the private/public key pair
[17:40] <niemeyer> wrtp: and what do you put on the local root CA field?
[17:41] <wrtp> niemeyer: we don't need one
[17:41] <niemeyer> wrtp: Argh
[17:41] <niemeyer> wrtp: It's been three hours, and we're still stumbling upon basics of PKI
[17:41] <wrtp> niemeyer: we can do TLS authentication with no CAs
[17:41] <niemeyer> wrtp: Gosh
[17:42] <wrtp> niemeyer: i have Go code that does that, in fact.
[17:42] <niemeyer> wrtp: Okay, please teach me about how that works
[17:43] <wrtp> niemeyer: we use the usual diffie-hellman key exchange, which verifies the public key at the other end
[17:43] <wrtp> niemeyer: then we check that public key matches the one we expect
[17:44] <niemeyer> wrtp:
[17:44] <niemeyer>     // RootCAs defines the set of root certificate authorities
[17:44] <niemeyer>     // that clients use when verifying server certificates.
[17:44] <niemeyer>     // If RootCAs is nil, TLS uses the host's root CA set.
[17:44] <niemeyer>     RootCAs *x509.CertPool
[17:44] <niemeyer> wrtp: That's in the tls.Config type
[17:44] <wrtp> niemeyer: yes
[17:44] <wrtp> niemeyer: it's optional.
[17:44] <niemeyer> wrtp: What do you suggest we do with this?
[17:44] <wrtp> niemeyer: it'll work with an empty cert pool
[17:44] <niemeyer> wrtp: Yes, and what happens if you don't use it?
[17:44] <niemeyer> wrtp: What happens in that case?
[17:45] <niemeyer> wrtp: (hint: it's in the comment)
[17:45] <wrtp> niemeyer: you don't verify that the certificate is signed
[17:45] <wrtp> niemeyer: however...
[17:45] <niemeyer> wrtp: Wrong
[17:45] <wrtp> niemeyer: you can easily check the exact certificate
[17:45] <niemeyer> wrtp: It uses the host CA pool
[17:45] <niemeyer> wrtp: Which contains root CAs, which the key is not signed against
[17:46] <wrtp> niemeyer: you can use the ConnectonState method to find out the public key at the other end
[17:46] <niemeyer> wrtp: There are many things we could do, but that's not what we'll do. What we'll do is use plain and well known SSL, as intended.
[17:47] <wrtp> niemeyer: ok. it seems a bit unnecessary (checking the public key directly is just as strong), but fair enough.
[17:47] <niemeyer> wrtp: Sorry, I'll stop discussing that now. Let's talk next week.
[17:47] <wrtp> niemeyer: ok
[17:47] <wrtp> niemeyer: assuming we generate a certificate too, does the rest look ok?
[17:49] <niemeyer> wrtp: I really mean it, sorry about that. We've been discussing this for about 3h without progress. Next week we talk live with a whiteboard and sort it out.
[17:49] <wrtp> niemeyer: ok
[17:50] <wrtp> :-(
[17:50] <niemeyer> wrtp: I suggest picking stuff you'd enjoy working on tomorrow as a brain break
[17:52] <wrtp> niemeyer: i was thinking *this* might be quite fun :-)
[18:05] <wrtp> niemeyer: for the record: http://paste.ubuntu.com/1287384/
[18:05] <wrtp> i'm done for the evening
[18:05] <wrtp> night all
[18:05] <niemeyer> wrtp: Have a good evening
[18:05] <wrtp> niemeyer: and you. v sorry about the wasted time this afternoon.
[18:05] <niemeyer> wrtp: All good, next week will be a lot easier
[18:05] <wrtp> niemeyer: indeed


[04:57] <magespawn> good morning
[05:25] <pieter2627> morning all
[06:28] <AtJack> Hello everyone
[06:28] <AtJack> When is the next meeting?
[07:23] <inetpro> good mornings
[07:34] <ateKore> morning
[09:35] <Kilos> morning all and sundry
[12:59] <Kilos> hi AtJack
[12:59] <AtJack> Hi
[12:59] <Kilos> you the same jack that has just moved to za
[13:03] <Kilos> the one that enquired about the mailing list?
[13:20] <anton> wazzuuppp peeps
[13:37] <pieter2627> hello AtJack and welcome to the channel. am not sure when is the next meeting, possibly 22nd Dec - we still have to discuss it or something...
[13:37] <pieter2627> bye all o/
[14:01] <Kilos-> hi piet
[14:02] <Kilos-> Aai!
[14:54] <Kilos> sjoe daily updates
[15:27] <inetpro> Kilos: yeah, they going crazy again
[15:27] <Kilos> is it all to keep things secure?
[15:28] <Kilos> from bad guys i mean
[15:29] <inetpro> depends
[15:30] <inetpro> Kilos: what version of Ubuntu are you on?
[15:30] <Kilos> i dont understand, because everything is working fine
[15:30] <Kilos> 14.04 kde
[15:31] <Kilos> and its not getting better i think so then it must be to keep it secure
[15:32] <inetpro> Ubuntu Security Notices: http://www.ubuntu.com/usn/
[15:32] <Kilos> kde 14.04 has been great
[15:33] <gremble> Kilos: There are perhaps some niggles that you haven't come across that they fixed
[15:33] <gremble> Or to add features that you don't necessarily use
[15:33] <Kilos> yay
[15:33] <inetpro> each case has its own merits
[15:33] <gremble> Just because you don't see the changes, doesn't meant that they aren't there :P
[15:33] <Kilos> just heavy on mobile data users
[15:33] <gremble> If you are curious to see what changed, you should look at the changelogs for each update
[15:34] <Kilos> nana no energy
[15:34]  * inetpro often looks at changelogs just out of curiosity to see what changed
[15:34] <gremble> On an LTS distro you probably don't have to update that much.
[15:50] <Kilos> [17:46] [Notice] -mist- [Global-ish notice] Hmm, appears a hub went boom. Services are unavailable whilst we figure out where it went.
[15:50] <Kilos> hehe
[16:07] <Kilos> wb gremble what did you break
[16:07] <Kilos> i dropped down to 4 nicks here
[18:08] <kulelu88> Hey guys
[18:09] <inetpro> good mornings kulelu88
[18:10] <kulelu88> howzit mates?
[18:23] <Kilos> inetpro ping
[18:24] <inetpro> Kilos: pong
[18:24] <Kilos> im trying to help ian via cell
[18:24] <inetpro> just do it!
[18:24] <Kilos> to upgrade a lucid server
[18:24] <inetpro> :-)
[18:24] <Kilos> to 14.04
[18:24] <Kilos> dont be funny man
[18:25] <inetpro> lucid is easy to understand
[18:25] <Kilos> is there a command to upgrade please
[18:25] <inetpro> Maaz: define lucid
[18:25] <Maaz> inetpro: Lucid \Lu"cid\, a. [L. lucidus, fr. lux, lucis, light. See {Light}, n.] 1. Shining; bright; resplendent; as, the lucid orbs of heaven. [1913 Webster]  Lucid, like a glowworm.               --Sir I. Newton. [1913 Webster]  A court compact of lucid marbles.     --Tennyson. [1913 Webster]  2. Clear; transparent. " Lucid streams." --Milton. [1913 Webster]  3.
[18:25] <Maaz> Presenting a clear view; easily understood; clear. [1913 Webster]  A lucid and interestin…
[18:26] <inetpro> oops, you mean Ubuntu Lucid
[18:26] <Kilos> in update manager it does give he option yo upgrade
[18:26] <Kilos> ya man
[18:26] <Kilos> 10.04
[18:26] <inetpro> Lucid Lynx 10.04
[18:26] <inetpro> hmm...
[18:26] <Kilos> can one upgrade 10.04 to 14.4
[18:27] <inetpro> from 10.04 to 14.04 is quite a jump... I wouldn't do it
[18:27] <Kilos> is clean install better
[18:27] <inetpro> why would he want to upgrade this way?
[18:27] <Kilos> and rsync home
[18:28] <Kilos> support ended
[18:28] <inetpro> in other words how big is the risk of loosing something?
[18:28] <Kilos> he has tonight to get it going
[18:28] <inetpro> s/of/if/
[18:28] <Kilos> we rsyncing home
[18:29] <inetpro> haha... you and your rsyncing of home...
[18:30] <inetpro> you sure everything important is just in /home ?
[18:30] <Kilos> i dunno
[18:30] <Kilos> thats why im asking you
[18:30] <inetpro> if you don't know, don't even try to start the upgrade
[18:30] <kulelu88> upgrading from 10 to 14 is dangerous
[18:30] <kulelu88> always backup first
[18:30] <kulelu88> then upgrade from disk
[18:31] <Kilos> what about t0 12.04 then 14.04
[18:31] <kulelu88> are they all 64-bit/32-bit?
[18:32] <inetpro> easier to and quicker to re-install from scratch if you know where everything goes
[18:32] <Kilos> how do you see 32 or 64 bit
[18:33] <Kilos> ai!
[18:33] <inetpro> uname -p
[18:34] <Kilos> ty
[18:34] <inetpro> or rather 'uname -i'
[18:35] <inetpro> Kilos: but as mentioned above, 12/02 20:30:53 <kulelu88> always backup first
[18:36] <Kilos> gives nothing
[18:36] <kulelu88> you just need to backup your user-content and have a text file/screenshot showing what software you have installed
[18:37] <Kilos> unknown
[18:37] <Kilos> is all user content in /home
[18:39] <inetpro> Kilos: arch
[18:39] <Kilos> kulelu88 can i do all that with commands
[18:39] <kulelu88> go up to the root and then go back down
[18:39] <Kilos> im on the fone to him
[18:39] <kulelu88> tell him to come here so we can help
[18:44] <Kilos> lemme try get him here
[18:48] <Kilos> something wrong there
[18:49] <Kilos> 1g home has already rsynced 4 gig and still going
[18:49] <superfly> ohi
[18:50] <magespawn> hey superfly
[18:51] <magespawn> superfly did you see the comments about the ubuntu-za.org website on the mailing list?
[18:51] <superfly> magespawn: uh, I don't know. probably not.  I can do bits and bobs if needed
[19:04] <tumbleweed> kulelu88: right now we're looking for someone to help attendees get visas. http://lists.debconf.org/lurker/message/20151126.153514.24934830.en.html
[19:04] <superfly> kulelu88: a good place to start is probably here: https://wiki.debconf.org/wiki/DebConf16
[19:06] <kulelu88> okay that is doable, but we all know that home affairs and their ilk can be assholes at the best of times
[19:11] <tumbleweed> kulelu88: if you're interested, contact ginggs http://lists.debconf.org/lurker/message/20151126.172801.09197c07.en.html
[19:11] <magespawn> here you go superfly http://pasteboard.co/2zUXc7br.png
[19:13] <kulelu88> tumbleweed: were you at PyCon?
[19:15] <tumbleweed> kulelu88: yep
[19:15] <kulelu88> Long hair and glasses? tumbleweed
[19:15] <tumbleweed> that's me
[19:15] <kulelu88> aah small world :d
[19:16] <tumbleweed> heh yeah, ZA tech world is
[19:23] <kulelu88> what do you do at your day job? tumbleweed
[19:28] <tumbleweed> I run the ops team at Yola
[19:33] <kulelu88> aah that's cool
[20:02] <magespawn> bed time for me, good night all
[20:02] <magespawn> \/exit
[20:22] <Kilos> how do i get a list of installed packages please kulelu88
[20:22] <Kilos> ohi sup
[20:22] <Kilos> ai
[20:23] <Kilos> superfly
[20:23] <kulelu88> uhmmm
[20:23] <Kilos> one hnd holding fone dont work
[20:23] <superfly> Maaz: google for ubuntu get a list of installed packages
[20:23] <Maaz> superfly: "apt - How to list all installed packages? - Ask Ubuntu" http://askubuntu.com/questions/17823/how-to-list-all-installed-packages :: "dpkg - Get list of installed packages? - Ask Ubuntu" http://askubuntu.com/questions/327370/get-list-of-installed-packages :: "apt - How to list installed package and its details on ubuntu? - Ask ..."
[20:23] <Maaz> http://askubuntu.com/questions/389715/how-to-list-installed-package-and-its-details-on-ubuntu :: "ListInstalledPa…
[20:23] <kulelu88> he can open ubuntu software centre and find it there
[20:23] <kulelu88> or that ^^^
[20:23] <Kilos> ty superfly
[20:43] <kulelu88> hey superfly . you ever worked with postfix before?
[20:43] <superfly> a bit
[20:47] <Kilos> ty for the help guys
[20:47] <Kilos> night all sleep tight
[21:22] <Kilos> ian must battle on his own im tired
[21:28] <inetpro> hmm
[21:29] <inetpro> good night


[00:00] <blackboxsw> just uploaded latest cloud-init into Ubuntu focal 20.04 [ubuntu/focal-proposed] cloud-init 20.1-5-g67c8e53c-0ubuntu1 (Accepted)
[14:24] <xiaofwan> Hello guys. I'm building RPM package in Fedora 31 with mock. Some "python36-xxx" like dependencies blocked build. Is there special reason to use python36-xxx instead of python3-xxx? Thanks!
[16:31] <rharper> xiaofwan: no;  specific reason; the spec file needs some updates;
[16:31] <rharper> we have someone actively working on updating our spec to build with newer centos/fedora;
[16:33] <rharper> xiaofwan: the general plan would be for py2 support to remain only on stable-19.4;  for py3, I suspect that centos7 would remain py2 as well, for master, py3, we can get it working with newer python;
[16:52] <xiaofwan> rharper: make sense! Appreciate!
[16:54] <rharper> xiaofwan: another thing to note, historically, the unittest/make check hasn't been run in the rpmbuild due to hard-to-find depdenencies in the rpm repositories;  I do have hope that rawhide or other newer Fedora repos have new enough versions to enable that;  if you end up with something working, please consider submitting a PR  https://github.com/canonical/cloud-init/pulls
[16:59] <xiaofwan> rharper: Nice! I'm working on fixing 'make rpm/srpm' on my centos and fedora mock env. Of course, I'll send PR after that. :)
[17:00] <rharper> \o/
[18:00] <amansi26> Hi I am seeing a scenario where when I install cloudinit 19.1, then add 9 additional volume of 2 GB each (Toal 10 volume [9 additional + 1 boot volume]), cloud init local service is failing with http://paste.openstack.org/show/790124/
[18:00] <amansi26> With 8 volume everything goes well
[18:01] <amansi26> Can anyone suggest something?
[18:01] <rharper> amansi26: it looks unrelated to storage add;  you're datasource is no longer present;  what datasource is normally present ?
[18:02] <amansi26> ConfigDrive
[18:03] <rharper> is the config drive still attached after adding those volumes (is this hotplug, or offline add, and then start back up) ?
[18:03] <amansi26> Didn't get you
[18:05] <amansi26> Then I tried to manually make the services up. It was failing . So changed /lib/systemd/system/cloud-init-local.service with http://paste.openstack.org/show/790125/. Then rebooted . All the services are running
[18:05] <rharper> how do you attach your additional volumes;  do you shut down the instance; run some commands to attach the volumes; start the instance back up; or do you run commands while instance is running, then reboot ?
[18:06] <amansi26> I add the instance in running state itself
[18:06] <rharper> it's failing because it could not find your config drive
[18:06] <rharper> is it possible that while adding the new volumes this removed the config drive ?
[18:07] <amansi26> no
[18:07] <rharper> well, are you sure ?
[18:07] <rharper> you only showed the log indicating that cloudinit did not find a datasource
[18:07] <amansi26> If that will be the case it should fail for adding 8 volumes also
[18:08] <rharper> if you use config drive, it uses either 'CONFIG-2' or 'config-2'  to find this on block devices
[18:09] <amansi26> how can I check that?
[18:10] <rharper> cloud-init runs blkid -c /dev/null -o export
[18:15] <amansi26> rharper: aah.. you got it write. datasource is getting removed and setting it to none
[18:16] <rharper> is that expected (the removal) ?
[18:16] <rharper> is this Openstack or IBM CLoud ?
[18:16] <rharper> I know that IBM Cloud has some first boot/second boot transitions w.r.t config drive, IIRC
[18:16] <amansi26> no The removal is not expected
[18:17] <amansi26> IBM Cloud
[18:17] <rharper> well, it may be expected
[18:17] <amansi26> So you are suggsting 8 is the limit?
[18:17] <rharper> https://github.com/canonical/cloud-init/blob/master/cloudinit/sources/DataSourceIBMCloud.py
[18:17] <rharper> no
[18:18] <rharper> just that the config drive "goes" away some times due to how IBM CLoud is provision
[18:18] <rharper> if you read the datasource docs there; it's "complicated"
[18:19] <amansi26> Was IBM Cloud DataSource is recently introduced?
[18:19] <rharper> no, it's been here for a few years
[18:20] <rharper> initial release was  March 2018
[18:21] <amansi26> Quite new then
[18:21] <rharper> relatively speaking, yes
[18:21] <rharper> vs. say OpenStack
[18:21] <amansi26> I will try using IBM Cloud DataSource replacing configDrive
[18:22] <rharper> I'm confused
[18:22] <rharper> either you're on IBM cloud and we detect that we are on it;  or you're on an OpenStack cloud that's not IBM CLoud
[18:23] <amansi26> As a Datasource I am using ConfigDrive
[18:25] <rharper> cloud-init should detect whether you're on IBM CLoud (with a config drive) vs.  just a ConfidDrive on Openstack
[18:26] <rharper> so if you're seeing ConfigDrive instead of IBMCloud; then either there's a bug in the detection, or there's been a change to IBM CLoud such that we no longer detect it properly
[18:46] <Goneri> @blackboxsw, ok, I was wrong yesterday regarding the initrd. That's something I acutally did on purpose to be able to run the 4 cloud-init calls in the correct order.
[18:47] <Goneri> @blackboxsw, and I can hardly do something different. I think the situation will evolve if someone starts a port of cloud-init for NetBSD.
[18:47] <Goneri> @blackboxsw, but I don't think this is a serious problem.
[19:04] <rharper> ahosmanMSFT: Ill take a look, thanks
[21:23] <ahosmanMSFT> rharper: thanks, I updated the PR
[21:30] <rharper> ahosmanMSFT: cool!
[23:24] <johnsonshi> Is there a way to build a deb package without running the unit tests? I am testing Azure telemetry, so I need to have an intentionally-buggy cloud-init to test our telemetry systems. I intentionally added a raise exception statement which will obviously cause provisioning failure. But I cannot build a deb package as it runs the unit tests and obviously fails.
[23:24] <johnsonshi> Whenever `make deb` is run, it runs ./packages/bddeb. Looking at the file, I have no idea how it works and been spending the past few hours trying to find where the unit tests are actually invoked during debian package build.
[23:27] <johnsonshi> So in order to build a buggy cloud-init deb package, I would need to disable unit testing during deb build. Thanks! :)
[23:27] <sarnold> I don't think I've seen any standardized way to pass in build flags to disable tests
[23:28] <sarnold> (I can't recall seeing non-standardized ways either, but that feels likely that someone has escape hatches..)
[23:35] <sarnold> johnsonshi: is the package in question using debhelper? https://manpages.debian.org/jessie/debhelper/dh_auto_test.1.en.html  "If the DEB_BUILD_OPTIONS environment variable contains nocheck, no tests will be performed. "