Here is one more photo from Debconf11 that has been missed in all the excitement – t-shirts from all Debconfs so far: from Debconf3 up to Debconf11. I was a bit late in stitching it together, so it appeared in the middle of the photo stream and people missed it.

P.S. I also took a bit of time to add some labels to the photos so the people that were not there would know what is happening in the image.

P.P.S. Talking to few key people (housing, venue, catering, networking) to prepare Latvia bid for Debconf13 is in full swing now.

What do we learn from this for next year? I am told that Debconf12 team has already had some meetings specifically to identify and learn from some shortcomings and strengths of this years conference. However, I think everyone of us might have an idea or two to add to the mix as well. For example, I think that BoF rooms are great and we should expand and solidify on that concept: take a page from unconference playbook – have a board on-site where people can book slots for their BoF in one of the two rooms for tomorrow. Not far in advance and without moderation requirement of penta scheduling. In the evening the stickers can be taken down and tomorrows BoFs can be added to the schedule at that point, so the people can see online what is going on.
Also I think that we need some kind of coverage of the BoF room(s) from the video team. Even if that is in a form of a single self-service omnidirectional microphone where people could just walk into the room, press a single button and the audio would start streaming and recording.
In addition we could have a screen with the IRC channel of the room projected onto a screen on a side of the stage, to simplify getting questions off the channel. Recording that channel (as a text log) could also be useful.
It feels like post-conference assembly of the talk lists, presentations, links to the relevant recordings, photos, chat logs, ideas, comments, … for every talk is very problematic in penta, should we perhaps just use wiki for that?
Any other ideas?

And to finish off some more personal travel-inspired rambling. After visiting Paris, Zagreb, Banja Luka and (very shortly) Vienna on this trip it was very interesting to see similarities and draw some parallels, especially with the added context of Berlin and Riga. The similarities in city planning, street shops, brands and the way people go about their lives in these capitals are quite remarkable. I would even say that a trend can be seen where capitols of countries/regions that had troubles in the past (Bosnia more recently; Riga, Zagreb and East Berlin a bit more into the past) are now moving from their different pasts and converging towards the vision of the European capitol city living we see in cities like Paris. If you look at individual pieces you can even recognise milestones along this route and see when specific cities reach them (possibly in a different order than others). With that in mind you can even try to predict what might come next, like looking at Banja Luka and thinking that they might reach the point of upgrading their buses in the next 2-3 years, or comparing Riga and Zagreb we can see that Riga needs to soon choose a street and close it to car traffic to have more cafés, beer gardens and shops concentrated in that area. Or looking at Paris we might find a compelling idea, like clustering a lot of businesses of the same type (such as kitchen design) in the same street, so the customers know where they can go to have all the best choices available within a block.

All in all this years Debconf for me was one with the most diverse experiences and the one that felt closest to home. I hope to see you all good people again next year!

P.S. I do hope that Debconf12 dates are nailed down in the next 2 months, so we can start talking to air plane companies for group discounts immediately.

I am pleased to say it is the one of the largest Debconf group photos yet with 263 people and 86 Mpix resolution. It took 10 separate images to stitch it together (from 44 images taken) and 15 fixes of stitching bugs deemed RC, 4 bugs were noted post-release, deemed minor. Most noticeable is on very skinny leg in the front row .

Short links: http://is.gd/dc11group http://is.gd/dc11names

In light of all this, I really dug deep into all possible options and found an option that is far more fun and relaxing for me and almost the same price. So I will be travelling to Paris on the morning of July 16th, then staying overnight there (never been in Paris before!), then take a late morning flight to Zagreb where I’ll be around noon (plenty of time to get to Banja Luka) and then on the final day of the conference I can got to Zagreb at any time, stay there overnight (never been to Zagreb too!) and around noon next day fly back home via Budapest (just a 2 hour break there). This way I will get to see two more cities, save me a lot of stress and also not bother the organizers too much.

P.S. I must say thank you Accenture for paying for my plane tickets.

We can draw two conclusions from this:

1. Debian Planet is far more popular than Debconf info or Debian-related hashtags on Twitter/Identi.ca. It could be estimated that the Debian Planet is 50-100 times more popular.
2. Readers of Debian Planet read the posted articles with a delay. It looks like most will have read an article after 6-7 days, but there might also be a tail, I will kee an eye on that over the next weeks

I thought it might be interesting to people

Note: Only 14 blank spots left in the group photo faces page! Let’s get the hunt on and finish it!

Please add your name and names of people you recognise here. Update: 14 people left!

The rest of my DebConf10 photos are in my DebConf10 Flickr set. There will still be a few photos from today uploaded to that set tomorrow morning, but it is almost complete. Hint: it also contains a video of DPL pitch and video of MakerBot working.

Update: All photos are up and labelled now. Enjoy!

But about the first half of the Debcamp week there are things that are as usual and there are things that are not.

Let’s start with the usual bits: more people arriving every day, evening parties are getting more and more fun and wild (or so people say) and the Internet and power at the hacklabs magically becomes more and more reliable day by day, the cabling mess grows organically trying to spread out evenly and not overload any individual socket, extension cords with non-local plugs appear and spread the load some more, people stress out, volunteer, crash out and repeat. All in all nothing can stop the freight train of few hundred Debian developers determined to have fun. With out own DFSG-free definition of fun. (But this year we appear to be running very close to the edge on volunteers – if we run out of those, there will be a train-wreck, so please volunteer!)

Now off to the unusual stuff.

The City is … well … it is cool and very, very impressive. It is not terribly different to me at least – I am used to such structure of the city: grid based layout of the downtown city (with some parks) and then branching out to separate, but different across-the-river districts and then sprawling out to slightly chaotic suburbs. Riga is very much like New York in the design. The difference is that New York is 10-20 times larger: the areas are 10 times larger, the buildings are 3-4 times higher on average, the streets are 2-3 times wider and yet have more traffic and there are far, far more shops, shows and restaurants. Also there is the subway. It is a great thing in that it hides the size of the city – take a bus downtown once, to find out what I mean – it takes ages to drive the distance that takes 20 minutes on the subway. I like this city, I am getting a feeling, that I could live here without much problem for me. So far I’ve only had this feeling in Riga and Berlin.

On the other hand this is USA. I’ve so far only encountered one bad thing about it, but it is a pretty big one – food. Basically all food that I’ve tried so far in the USA has been crap. It was tasty – salt, sugars and fat took care on my brain thinking it’s food, but underneath that it was pretty crap: there was no texture, no content, no soul. The John Jay cafeteria where we are eating lunch and dinner is better than the most other options, because it is an all-you-can-eat buffet where you can choose your poison and it was also the place where I had the best piece of food in USA so far – a slice of pepperoni pizza, that had a bit of taste behind the fat. Also, surprisingly, the fast food options (McDonalds, Burger King, …) are better than the equivalents in Europe, far better. In fact the fast food is cheap and in some cases tastes better than ‘regular’ food, so there is no wonder why people might prefer it in some situations. So it is easy to see how people just accept shoving bland fast food or bland all-you-can-eat food into their mouths and not think much about it and thus become fat and put undue stress on their health. I expect the average weight of Debian developers to increase by 5 kg by the end of the conference. If you want to prove me wrong, running with bubulle would help you a lot with that.

Events downtown. New York is a huge city with a lot of events going on every day, so everyone should be able to find something of interest for them. For me it was the free tickets for tapeings of The Daily Show and The Colbert Report. I got into both of those and for me The Colbert Report was by far the better experience. For one you can not get into Daily Show without a ticket (some tickets show up on the web site on the morning of the shoot around 11am), while 18 people from the stand-by list at Colbert Report got in. At The Daily Show you stand in a live line with ticket holders in one line and stand-by line separate. If you have tickets and arrive around 3pm you should be fine – any later than that and you risk to be standing outside even with a ticket. You find that out around 4.30pm when they hand out physical tickets – you have one, you get in. If not you might rush over to Colbert Report where a more humane system is used – a staffer takes down your name and email on a numbered list and then you can walk around until 5.30pm then they let the ticket holders in and after that call the names of stand-by people that get in. The Colbert Report studio is brighter, more colourful and closer to the action, also it is very rare that cameras block the view from the audience (which is common on The Daily Show). It might have also been my luck when I got on the most boring The Daily Show episode I can remember, ever. The best joke was a woman asking John is she could get a ticket for her friend in August. The warm-up act and crowd control at The Colbert Report was also way better: Colbert staff was hyper, security was ever-present, warm-up was funnier and very engaging (he grilled me for several minutes and I replied making the audience laugh very hard explaining that Latvia was like India of Eastern Europe in regards to IT exports) and Colbert himself was very gracious talking to us out-of-character before the show for a good 10 minutes.

Location, location, location. The talk rooms and event rooms and hacklabs are spread out across multiple buildings and there is a lot of other activities going on in those buildings besides Debconf, so moving between place might be confusing for the first day or two. Also the rooms are quite dark – that might cause a noise problem for me and the video team as we’ll have to up the sensitivity settings on our gear. The video team is working on fixing that by throwing a bit more light on to the speakers. Elevators are wicked fast, but can also be confusing, because the ground floor is on a different number for different buildings – it can be G, 1 or even 4. Usually on campus there is a star next to the level with the exit.

The dorms. I am in the Carman building and it looks like its interior has not been updated since it was built – large ceramic bricks with very visible gaps (for the interior walls), raise-to-open windows, huge aircon fans that take up the whole bottom of the window, plumbing from the 60ies (at least). The security is weird – on one hand you have to give your room card to the guard when entering the building, but on the other hand the room cleaning crew can simply forget to close your door after they are done. Like this Thursday I returned to the dorm just before lunch only to find the door of my room open. No one was around and nothing was missing, but it’s still worrying.

In any case I am steadily uploading photos from Debconf 10 to my Flickr page and new stuff should show up every day.

At the end of last year, there were rumours that the IT system of Latvia’s Internal Revenue System was ‘hacked’ and millions of documents had been downloaded by multiple organizations. Shortly thereafter more details on the glaring security hole became public (after it was closed).

There is a full electronic interface to give all reports to the IRS electronically (at http://eds.vid.gov.lv) and as part of that system you could also view and export monthly report summaries about your organization into XML and PDF files. After the system checked that you are authorized to access the report, you were redirected to the URL to actually download the report by report ID (as a single param in a GET request). Unfortunately, report IDs were predicable and the script that gave the reports for download did not check if you were authorized to get that report. It did not even check if were logged into the system.

There were suspicions that the authorization was disabled on purpose to allow to leak data on purpose, but apparently it was an error of forgetting to disable debug code in production environment.

The error was discovered only because the firewall administrator noticed an unexplained stable increase of traffic, especially during night hours when typically the traffic fully stopped. Apparently a single hacker (who later identified himself as ‘Neo’ to the press) discovered the flaw and wrote a script to just try all possible report ids and get as much data out as possible. This had been going on for months, before someone noticed.

After the flaw was discovered and a bit of time passed, Neo made his first move – he published the list of top salaries in a governmental company, that clearly showed that the top leadership of this company failed to cut their salary by 40%, like everyone elses during harsh budget cuts of 2009. He stripped the names and ids of the specific employees, but named the company which made it pretty easy to figure out who was who.

The society was outraged that the top managers in a government owned company failed to comply with the strict pay cut that everyone else in government had to endure. But after a few weeks the outrage subsided and no action followed from the government or law enforcement.

Neo continued to release documents detailing salaries of top managers in different Latvian government companies. And each time after short outrage, nothing happened. Neo gave an interview where he said that he was disappointed in the passivity of the Latvian people in face of such blatant injustices.

After a few month Neo went silent, promising to return before parliamentary elections this fall.

However, this week a new development shocked everyone – in the middle of the night two police SWAT teams went into action: one detained Ilmārs Poikāns, a researcher in artificial intelligence at the University of Latvia’s Computer Science department and another raided the home of a Latvian TV journalist Ilze Nagle who interviewed Neo. Poikāns confessed of being Neo the next day and was released (with travel restrictions, pending trial) today.

Politicians reacted immediately – opposition demanded the resignation of the Interior Minister over ‘such blatant disregard of freedom of press’ and another politician (who is also a famous lawyer) Aleksejs Loskutovs volunteered to defend Neo pro-bono (on Twitter, no less). Almost all Latvian online media have the arrest of Neo and the raid on the home of a journalist as main stories of the day.

As a legal titbit, we also know that Neo is being charged with breaking statutes 145 and and 244p2 of the criminal law. Statute 145 is hard to find applicable in this situation as talks about actions done by ‘people authorized (..) to access [private] information’. Statute 244p2 will also be hard to pin down as it mentions ‘influencing system resources of (an IT system)’ and ‘if such action caused severe harm’. It looks like the first part talks about at least a DoS attack (which did not happen in this case) and also there was no measurable harm from these leaks.

Also Neo was careful to strip all personally identifying information (such as names, social security numbers and addresses of the employees in question), so it will be hard to pin him on that. Also no actual breaking or other modification of an IT system occurred. And no ‘specialized software’ was used beyond a trivial script such as :

for i in range(0,7000000):
    wget('https://eds.vid.gov.lv/getRep.aspx?id='+str(i))

A lot of commentators on the Internet likened the situation to walking trough an unlocked door and stealing something. I think that analogy is very incorrect – there was no door, and nothing went missing after the action.

I came up with a different analogy – there was this corridor with a lot of doors in IRS, locked steel doors. You were instructed to go to a room with a specified number and given a key to that room to unlock it and see your secret info. However, that corridor opened out to the street on one end, oh and also the walls of the rooms with all the secrets were transparent. So Neo walked into the corridor, looked at some of the secrets, wrote them down (to remember them better) and then went out and discussed the worst examples abuses of power he saw.

In the end IRS had to learn their lesson – if you have to put naked photos of yourself on the Internet (or something equally embarrassing), then make damn sure you password protect that, but if you don’t then don’t cry that someone ‘hacked’ you and ‘stole’ you pictures.

What other people think:
http://freespeechlatvia.blogspot.com/2010/05/neo-released-under-restrictions.html

We’ll see how the story develops soon.

Let’s start with something most people know – I took photos, a lot of photos. The main photo naturally was the Debconf9 group photo (also http://tr.im/dc9group and an annotated version). Please look for people that are missing their IRC nicknames. I have uploaded the best of my photos on Flickr and all good photos in full resolution on the Gallery site. All of these photos are licensed CC-BY 2.0 or 3.0 or GPL v2 or v3 (your choice).

Now about the organisation. The place reasonably easy to get to but not particularly fast or cheap – from airport to the venue it took 1 hour in metro, 3 hours in a bus or train and a half an hour walk (or 5 minutes in a taxi) for the sum of 22 � and 4.5 hours or 27� and 4 hours one way. While we all accept the time waisted in airports, getting from the airport to the venue should be easier and cheaper than this.

While it was crazy hot outside (38-40 C) there was great air conditioning everywhere, so we did not feel the heat most of the time (except if you walked from bus/train to the venue or did the climb during the day trip). Having air conditioning in the room was a godsend – I do not think I would be able to sleep otherwise. Also free water from a drinking fountain where you could also refill your water bottle was a great touch. The rooms were great – two beds, air conditioning, bathroom, shower, desks and closets where one could unpack their things. And we did not have to move to other rooms in the middle, it allowed us to unpack and feel comfortable instead of living out of the suitcase the whole time. I’m not sure if it will be possible for future Debconfs to get rooms with only two beds, but I think that even with 4 people per room would have been fine, provided that there are enough bathrooms/showers, enough space to unpack everyone’s clothes, enough sockets to charge some stuff overnight and enough WiFi coverage in rooms to get some late emails without going to the hacklab.

Which brings me to Internet and hacklabs. I must say that Internet was great this year – it was fast enough not be a major problem, it was almost everywhere (a bit more signal in the sleeping rooms would be better), it was up and running from day one of the Debcamp and it was stable through (I think there was one or two interruptions). It would be nice to see people write a blog entry about how exactly it was done. As far as I know it was very helpful to have several kilometres of CAT5 cable, several large switches and a huge amount of identical WiFi routers all flashed with OpenWRT (and then some more smaller routers also flashed with OpenWRT to plug some holes). I heard there were two Internet connections joined together and a complex firewall/transparent proxy/traffic shaper and also a local Debian mirror that was DNS-redirecting people to it from all the regular Debian mirrors people use at home. The hacklabs were also nice – when the Debcamp started the second hacklab was lacking most tables and chairs, but when those arrived there was plenty of space. Other common issues such as access to a free switch port for people without wireless and access to power sockets were also handled well and fast. It was very nice that organisers always had a few spare power strips or a spare patch cable at hand.

This year there was a siesta break in the proceedings. While it was in line with local traditions (take a several hour break during the hottest hours), it did not do much for the secondary stated reason – to get out and see the surrounding, because half of the attraction of getting out (shops and bars) were all closed during the same siesta time. IMHO we should have used the great aircon of the venue and continued the talks from mid day to 18:00 (when the siesta ends) and then make a break until dinner so that we could go out and enjoy shops and bars and historic places during a cooler time of day. If there is a break in proceedings, then it should be at the time when people are most likely to enjoy the surroundings. I doun’t know the schedules in NY, but if the museums close at 18:00, then there should be a break during the day to allow people to get to those museums.

Food was there and it was there every day, but it was not particularly great. Aside from typical problems with vegetarians and vegans (even salads had pieces of meat in them), I did not find the food to be compelling most of the time. I do not like fish and there was a lot of fish. Mostly it was good fish and sometimes it was so well done that even I enjoyed eating it, but other times it was full of fish bones and/or tasteless. Too often the dinner consisted of a salad, a deep-fried piece of meat and spoonful of dry fries. It would not kill them to put more fries on the plate and have some kind of sauce for them. One thing that was great in food were the fruit deserts – apples, oranges, peaches and nectarines were fresh and juicy and then there were melons! I typically hate melons because the ones I can get in shops in Latvia are dry and bitter, but the melons here were bursting with sweet juice – heavenly stuff. In the future it would be nice if the food selection and amounts per portion could be checked and agreed upon with the caterer in advance. Also the timing should be adjusted – it is too early to end breakfast at 10:00, especially with dinner starting at 21:30 – there is way too little time to socialize with other people after dinner and then to get a decent sleep. Talks can start at 10:00, but breakfast should go up to 11! I did like the water bottles and wine jugs on the tables and the beer being served as part of the food – that was a nice touch that many people enjoyed.

The daytrip was a nice distraction in the middle of the conference – a trip to a swimming pool made from a river bed blocked by a damn with an optional hike up a mountain to a spectacular cascade of natural water pools and slides that a river has carved in the solid rock or the mountain valley. Most people did the hike – it was steep and hot and rocky, but the payout (the water fun) was there at the end, and it was great! Wonderful warm water and unexpectedly deep pools that both locals and us jumped into from rocks of differing heights. I am more of a climber than a jumper so instead of jumping off a cliff, I spidermanned up the cliff up from the water. I did not have any safety, but if I did fall I would have fallen into the water, so felt almost safe After the hike, the jumps and a hike back downhill we went into the buses and joined up with the people relaxing in the pool or in the bar right next to it. And after an hour or two later the day trip was over. While this was fun I would have preferred if after the hike we would have gone to some castle or other tourist attraction for more of a ‘trip’ experience than sitting by a pool chatting.

Formal dinner was another traditional thing that we did this year. We walked over to a restaurant overlooking the city, sat down at many different tables occupying most of the place and then the waiters brought us plates with bits of food. Each plate was basically a set of 4 snacks for 4 people – a plate of cheese, a plate of ham cuts, a plate of steamed vegetables and a plate of grilled meat. After that was coffee and desert. In my opinion the grilled meat was overcooked, the vegetables were passable, 1 of 5 cheeses was great (the local soft speciality) while other were ok and the ham cuts were ok. Desert was average. In all I was neither impressed by the food nor filled by it. There was also entertainment – a singer with two dancers. They ware way too loud, so loud in fact that police came and shut the performance down, I did get a few interesting photos but otherwise I did not like them. They came to our venue the next night to continue the performance, luckily it was in an isolated patio and did not disturb people sleeping.

Wine and cheese party on the other hand was simply great this year – there was a huge selection of wine and cheese as we were in the right part of the world for that. There were 7 tables full of cheese, wine and bread and also some extra stuff such as a barrel of peanuts and some great tea from Taiwan. People were walking around for hours eating cheese, cleaning the taste off with bread and wine, chatting and doing it all over again at another table. I left the patio at around 2am and there were still several dozen people around chatting, eating, drinking wine and tea. I’m not sure how to get an event of similar size in NY as it is not allowed for travellers to bring cheese into US, only commercial import with an appropriate licence is allowed.

I also have my praise for the video team, but I’ll hold on to that and the feedback about the talks until I see the recordings of talks that I missed, so I can also recommend the must see recordings.

All in all it was a great event – meeting all the great Debian people again, coding some stuff, having fun and talking about the future of Debian in a more relaxed atmosphere than an IRC chat room. Debconf 9 was great, see you all next year at Debconf 10 in New York!