• What Parents Can Do When Bullying is Downplayed at School | Psychology Today

  Despite the “Bully-Free Zone” posters that line the school cafeteria walls and the Zero-Tolerance policy that was boasted about during last September’s Back-to-School night, your experience is that the school would rather not address the problem at all. The responses you get from your child’s teacher include bland lip service […]

  Good advice for this nasty situation — I’m thankfully not facing it myself, but bookmarking just in case…

  (tags: bullyingkidsschooleducationpsychologychildrenparenting)

• Cyclists: Let’s Talk About Shoaling

  You’re stopped at a red light with a bunch of folks on bikes, when someone who’s just arrived sails past everyone, right to the head of the class. It’s a lot like seeing somebody in the Whole Foods express lane with too many things. In other words, it’s the kind of behavior that triggers toothy-toddler rages in otherwise emotionally competent adults.

  Oh god. This drives me nuts. (via Mark)

  (tags: shoalingcyclingcommutingbikesred-lightscommuterage)

• Commodore 64 Raspberry Pi Case with working power LED

  3D-printed retro-pi cases (via Oisin)

  (tags: via:oisin3d-printingretropicasesraspberry-pihardwarecute)

• The Best Way to Sous Vide Is to Shut Up About It

  lol

  (tags: sous-videgadgetskitchenbroscookingcookeryfunny)

• “1 like = 1 delicious cocktail recipe or booze fact.”

  Great cocktail factoid thread from Manhattans Project/Every Cloud’s Felix Cohen

  (tags: felix-cohencocktailsboozefactoidshistorydrinks)

• Alarm systems alarmingly insecure. Oh the irony | Pen Test Partners

  Some absolutely abysmal security practices used in off-the-shelf self-installed wireless home alarm systems — specifically the Yale HSA6400. Simple replay attacks of the unlock PIN message, for instance

  (tags: securityhomewirelessalarmsyalefail)

• Open-sourcing RacerD: Fast static race detection at scale | Engineering Blog | Facebook Code

  At Facebook we have been working on automated reasoning about concurrency in our work with the Infer static analyzer. RacerD, our new open source race detector, searches for data races — unsynchronized memory accesses, where one is a write — in Java programs, and it does this without running the program it is analyzing. RacerD employs symbolic reasoning to cover many paths through an app, quickly.

  This sounds extremely interesting…

  (tags: racerdrace-conditionsdata-racesthread-safetystatic-code-analysiscodingtestingfacebookopen-sourceinfer)

• Solera – Wikipedia

  Fascinating stuff — from Felix Cohen’s excellent twitter thread.

  Solera is a process for aging liquids such as wine, beer, vinegar, and brandy, by fractional blending in such a way that the finished product is a mixture of ages, with the average age gradually increasing as the process continues over many years. The purpose of this labor-intensive process is the maintenance of a reliable style and quality of the beverage over time. Solera means literally “on the ground” in Spanish, and it refers to the lower level of the set of barrels or other containers used in the process; the liquid (traditionally transferred from barrel to barrel, top to bottom, the oldest mixtures being in the barrel right “on the ground”), although the containers in today’s process are not necessarily stacked physically in the way that this implies, but merely carefully labeled. Products which are often solera aged include Sherry, Madeira, Lillet, Port wine, Marsala, Mavrodafni, Muscat, and Muscadelle wines; Balsamic, Commandaria, some Vins doux naturels, and Sherry vinegars; Brandy de Jerez; beer; rums; and whiskies. Since the origin of this process is undoubtedly out of the Iberian peninsula, most of the traditional terminology was in Spanish, Portuguese, or Catalan.

  (tags: wineagingsolerasherrymuscatvinegarbrandybeerrumwhiskeywhiskybrewingspain)

During the next week I'll join the next Open Source Summit Europe in Prague. This year the event will includes different conferences under the same location (Hilton Prague): LinuxCon, ContainerCon, CloudOpen and the new Open Community Conference.

I'm excited to contribute at this event in two different ways on behalf of the Apache Software Foundation:

1. As a speaker inside the Open Community Conference
2. As a sponsor during MesosCon taking care of the ASF booth duty with Sharan Foga

During my session I'll share the path followed by the Apache ManifoldCF community for achieving the final graduation as a Top Level Project. I'll try to explain what the Apache Way steps are and how we have approached all the challenges during the journey. 

The title of the session is The Journey of Apache ManifoldCF: learning from ASF's successes and I'll keep it on Wednesday 25th at 11:15am. If you want to take a look all the schedule please visit the program page.

I would like to thank Apache Community for mentioning me in the article about the Community Development and hope this helps.

Let me know if you come at this event and come to say hello at the booth :)

this release fixes a serious bug in the difference engine when documents only differ in namespace prefix.

The full list of changes for XMLUnit.NET:

• elements that only differed in namespace prefix resulted in a false `ELEMENT_TAG_NAME` difference when compared. Issue #22

• IBM broke its cloud by letting three domain names expire – The Register

  “multiple domain names were mistakenly allowed to expire and were in hold status.”

  (tags: outagesfailibmthe-registeropsdnsdomainscloud)

I seem to be posting a lot less frequently recently. I was traveling, work has been crazy busy, you know how it goes. Oh, well.

I was looking at some stuff while I was traveling, and reviewing what I thought, and decided it still holds, so I decided to post it here.

It ain't perfect, but then nothing is, and besides which you get what you paid for, so here are my 100% free of charge simple rules for online security:

• Always do your banking and other important web accesses from your own personal computer, not from public computers like those in hotel business centers, coffee shops, etc.
• Always use Chrome or Firefox to access "important" web sites like the bank, credit cards, Amazon, etc.
• Always use https:// URLs for those web sites
• Always let Windows Update automatically update your computer as it wants to, also always let Chrome and Firefox update themselves when they want to.
• Stick with GMail, it's about as secure as email can get right now. Train yourself to be suspicious of weird mails from unknown senders, or with weird links in them, just in case you get a "phishing" mail that pretends to be from your bank or credit card company, etc.
• If you get a mail from a company you care about (bank, retirement account, credit card, health care company, etc.), instead of clicking on the link in the mail, ALWAYS open up a new browser window and type in the https:// URL of the bank or whatever yourself. It's clicking the link in the email that gets you in trouble.
• At least once a week or so, sign on and look at your credit card charges, your bank account, your retirement account, etc., just to see that everything on there looks as it should be. If not, call your bank and credit card company, dispute the charge, and ask them to send you a new credit card, ATM card, whatever it was.
• Don't accept phone calls from people who aren't in your contacts, or whose call you didn't expect. If you accept a phone call that you think might be legitimate (e.g., from your bank or credit card company), but you need to discuss your account, hang up and call them back, using the main service number from their web site, not the number that called you. Never answer "security questions" over the phone unless you initiated the call yourself. Con artists that call you on the phone can be really persuasive, this is actually the biggest threat nowadays I think.

Book three of the Expanse series is Abaddon's Gate.

Abaddon's Gate starts out as a continuation of books one and two.

Which is great, and I would have been just fine with that.

But then, about halfway through (page 266, to be exact), Abaddon's Gate takes a sudden and startling 90 degree turn, revealing that much of what you thought you knew from the first two books is completely wrong, and exposing a whole new set of ideas to contemplate.

And so, then, off we go, in a completely new direction!

One of the things I'm really enjoying about the series is the "long now" perspective that it takes. You might think that a couple thousand years of written history is a pretty decent accomplishment for a sentient species, but pah! that's really nothing, in the big picture of things.

If you liked the first two books, you'll enjoy Abaddon's Gate. If you didn't like any of this, well, you probably figured that out about 50 pages into Leviathan Wakes and that's fine, too.

This post is loosely based on a lightning talk last week in Brussels.  We had a few minutes to fill and I felt compelled to spill my guts, despite having nothing prepared.

For those that have never heard about LDAPCon, it’s a biennial event, first held in ’07, with rotating venues, always in interesting places.  The talks are a 50/50 split between technology providers and usages.

You can check out this year’s talks, along with sides — here.

It’s not a ‘big’ conference — attendance hovers between 70 and 80.  It doesn’t last very long — about two days.  There’s very little glitz or glory.  You won’t find the big vendors with their entourages of executives and marketing reps, wearing fancy suits, sporting fast talk and empty promises.  Nor are there giveaways, flashy parties or big name entertainers.  For the most part the media and analysts ignore it; participants don’t get much exposure to the outside world.  Everyone just sits in a single, large conference room for the duration and listens to every talk (gasp).

So what is it about this modest little gathering that I love so much?

Not my first rodeo.  The end of my career is much closer than its beginning, and I’ve been to dozens of conferences over the decades.  Large, small and everything in between.  For example, I’ve attended JavaOne twelve times and been to half a dozen IBM mega conferences.

Let’s start with relevance.  Contrary to what you may think LDAP is not going away.  It’s not sexy or exciting.  Depending on your role in technology you may not even have heard of it (although I can guarantee that your information is housed within its walls).  But it’s useful.  If you’re interested in security you better understand LDAP.  If you choose not to use it you better have good reasons.  Ignore at your peril.

I’ve been working with LDAP technology (as a user) for almost twenty years.  When I first started, back in the late ’90’s there was a fair amount of hype behind it.  Over the years that hype has faded of course.  As it faded, I found myself alone in the tech centers.  In other words, I was the only one who understood how it worked, and why it was needed.  As the years passed, I found my knowledge growing stale.  Without others to bounce ideas off of there’s little chance for learning. You might say I was thirsting for knowledge.

My first LDAPCon was back in ’11 in Heidelberg.  It was as if I had found an oasis after stumbling about in the desert alone for years.  It was like AH at last others who understand and from whom I can learn.

Many conferences are rather impersonal.  This is understandable of course, because the communities aren’t well established or are so large that it would be impossible to know everyone, or even a significant minority.

The leaders of these large technology communities are more like rock stars than ordinary people.  Often (not always) with oversized egos fed by the adoration of their ‘fans’.  This is great if you are seeking an autograph or inspiration, but not so much if you’re wanting help or validation of ideas.

Not the case at LDAPCon.  You’ll still find the leaders and architects, but not the egos.  Rather, they understand the importance of helping others find their way and encourage interaction and collaboration.

Sprinkle in with these leaders earnest newcomers.  Much like when I arrived in Heidelberg the pattern repeats.  These newcomers bring energy and passion that fuels the ecosystem and helps to stave off obsolescence.  There is a continuous stream of ideas coming in ensuring the products and protocols remain relevant.

The newcomers are welcomed with open arms and not ignored or marginalized.  This creates a warm atmosphere of collaboration.  New ideas are cherished and not shunned.  Newcomers are elevated and not marginalized.

Not a marketing conference.  You won’t find booths (like at a carnival) where passersby are cajoled and enticed by shiny lights and glitzy demos.  Where on the last day they warily pack up their rides and go to the next stop on the circuit.

Not a competitive atmosphere, rather collaborative.  Here is where server vendors like Forgerock, Redhat, Microsoft, Symas, and others meet to work together on common goals, improving conditions for the community.  They don’t all show up to every one, but are certainly welcome when they do.

Here, on the last day, there is some sadness.  We go and have some beer together, share war stories (one last time) and make plans for the future.

The next LDAPCon will probably again be held in Europe.  Perhaps Berlin or Brno.

I can hardly wait.

Keynotes

• People thrive for acceptance. This can be exploited when building communities: Acceptance is often displayed by some form of status. People are more likely to do what makes them proceed in their career, gain the next level in a leadership board, gain some form of real or artificial title.
• Humans are a reciprocal species. Ever heart of the phrase "a favour given - a favour taken"? People who once received a favour from you are more likely to help in the long run.
• People form habits through repetition - but it takes time to get into a habit: You need to make sure people repeat the behaviour you want them to show for at least two months until it becomes a habit that they themselves continue to drive without your help. If you are trying to roll out peer review based, pull request based working as a new model - it will take roughly two months for people to adapt this as a habit.
• Humans have a fairly good bullshit radar. Try to remain authentic, instead of automated thank yous, extend authentic (I would add qualified) thank you messages.

Limux - the loss of a lighthouse

• Do we suck at desktop? Are there too many depending apps?
• Did we focus too much on the cost aspect?
• Is the community supportive enough to people trying to monetise open source?
• Do we harm migrations by volunteering - as in single people supporting a project without a budget, burning out in the process instead of setting up sustainable projects with a real budget? Instead of teaching the pros and cons of going for free software so people are in a good position to argue for a sustainable project budget?
• Within administrations: Did we focus too much on the operating system instead of freeing the apps people are using on a day to day basis?
• Did we focus too much on one star project instead of collecting and publicising many different free software based approaches?

Dude, Where's My Microservice

• One very simple solution is to go for a proxy based architecture. There will be a single point of change, there aren't any in-app dependencies to make this model work. You can implement fine-grained load balancing in your proxy. However this comes at the cost of having a single point of failure, one additional hop in the middle, and usually requires using a common protocol that the proxy understands.
• Another approach would be to go for a DNS based architecture: Have one registry that holds information on where services are located, but talking to these happens directly instead of through a proxy. The advantages here: No additional hop once the name is resolved, no single point of failure - services can work with stale data, it's protocol independent. However it does come with in-app dependencies. Load balancing has to happen local to the app. You will want to cache name resolution results, but every cache needs some cache invalidation strategy.

Trolling != Enforcement

Kernel live patching

• Cronic

  ‘A cure for Cron’s chronic email problem’

  (tags: cronlinuxunixopssysadminmail)

• What To Do When Your Daughter Is the Mean Girl | Psychology Today

  Bookmarking — just in case. hopefully it won’t be necessary… good site for parenting advice along these lines.

  I knew this day would come. I was, of course, hoping it never would-hoping that my daughter would never be mean to someone else’s daughter-but as they say, I wrote the book on girl bullying in elementary school, so I knew that there was a pretty good chance that despite all of my best efforts, one of these days, my girl was gonna act like the mean one. This morning, she told me about it.

  (tags: psychologykidsparentingbullieschildrengirls)

• MaxMind DB File Format Specification

  An interesting data structure format — ‘the MaxMind DB file format is a database format that maps IPv4 and IPv6 addresses to data records using an efficient binary search tree.’

  (tags: maxminddatabasesstorageipv4ipv6addressesbstbinary-search-treestreesdata-structures)

Kubernetes in real life

• "Can you help us setup a K8s cluster?" - asked by a customer with one monolithic application deployed twice a year. Clearly that is not a good fit for K8s. You will need a certain level of automation, continuous integration and continuous delivery for K8s to make any sense at all.
• There were customers trying to get into K8s in order to be able to hire talent interested in that technology. That pretty much gets the problem the wrong way around. K8s also won't help with organisational problems where dev and ops teams aren't talking with each other.
• The first question to ask when deploying K8s is whether to go for on-prem, hosted externally or a mix of both. One factor pulling heavily towards hosted solution is the level of time and training investment people are willing to make with K8s. Ian told the audience that he was able to migrate a complete startup to K8s within a short period of time by relying on a hosted solution resulting in a setup that requires just one ops person to maintain. In that particular instance the tech that remained on-prem were Elasticsearch and Kafka as services.
• Another client (government related, huge security requirements) decided to go for on-prem. They had strict requirements to not connect their internal network to the public internet resulting in people carrying downloaded software on USB sticks from one machine to the other. The obvious recommendation to ease things at least a little bit is to relax security requirements at least a little bit here.
• In a third use case the customer tried to establish a prod cluster, staging cluster, test cluster, one dev cluster per developer - pretty much turning into a maintainance nightmare. The solution was to go for a one cluster architecture, using shared resources, but namespaces to create virtual clusters, role based access control for security, network policies to restrict which services can talk to each other, service level TLS to get communications secure. Looking at CI this can be taken one level furter even - spinning up clusters on the fly when they are needed for testing.
• In another customer case Java apps were dying randomly - apparently because what was deployed was using the default settings. Lesson learnt: Learn how it works first, go to production after that.

Rebuilding trust through blockchains and open source

• Cross border payments: Currently, using SWIFT, these take days to complete, cost a lot of money, are complicated to do. The goal with rolling out block chains for this would be to make reconcillation real-time. Put information on a shared ledger to make it audible as well. At the moment ANZ, WellsFargo, BNP Paribas and BNY Mellon are participating in this POC.
• Healthcare records: The goal is to put pointers to medical data on a shared ledger so that procedures like blood testing are being done just once and can be trusted across institutions.
• Interstate medical licensing: Here the goal is to make treatment re-imbursment easier, probably even allowing for handing out fixed-purpose budgets.
• Ethical seafood movement: Here the goal is to put information on supply chains for seafood on a shared ledger to make tracking easier, audible and cheaper. The same applies for other supply chains, think diamonds, coffee etc.
• Real estate transactions: The goal is to keep track of land title records on a shared ledger for easier tracking, auditing and access. Same could be done for certifications (e.g. of academic titles etc.)
• Last but not least there is a POC to how how to use shared ledgers to track ownership of creative works in a distributed way and take the middleman distributing money to artists out of the loop.

Kernel developers panel discussion

• Yonatan Zunger’s twitter thread on Twitter’s problem with policy issues

  ‘I worked on policy issues at G+ and YT for years. It was *painfully* obvious that Twitter never took them seriously.’ This thread is full of good information on “free speech”, nazis, Trump, Gamergate and Twitter’s harrassment problem. (Via Peter Bourgon)

  (tags: via:peterbourgonharrassmenttwittergamergatethreadsyoutubegoogle-pluspolicyabusebullyingfree-speechengagement)

• Here’s A List Of The Darkest, Strangest Scientific Paper Titles Of All Time | IFLScience

  some great papers here (via Emilie)

  (tags: via:emiliefunnypaperssciencetitles)

Say what you will about cycling, but it affords time for thoughtful contemplation.

Why am I doing this?  There are plenty of reasons not, starting with it being hard compared to other forms of transportation.

That the roadways don’t accommodate — we’re at best an annoyance, leading to spats and scuffles of varying severities.

It’s not convenient to commute this way requiring time consuming preparation.

Not a particularly time effective form of transportation — much faster to get into a car and drive.

Complications on arrival not shared with motorist; attired in such a way that is comically out of place of today’s societal norms.

Summing up the pros/cons, it can be hard to make a convincing argument for daily commuting on a bike.

So why do it?  Before that can be answered we have to delve into this issue a bit deeper.  What are the cons of commuting by car?

1. The average automobile spews about 5 metric tons of carbon dioxide into the atmosphere a year.¹
2. Driving increases stress levels and encourages a sedentary lifestyle.
3. The cost to maintain the nation’s highways, roads, bridges and streets is hard to calculate but is probable > $100 billion US.²
4. The yearly cost to maintain an automobile about $9,000 US.³

Back to how riding affords time to think — more questions to ponder…

1. What happens when everyone on the planet is driving a car?  (How much longer can the atmosphere absorb the greenhouse emissions before lasting consequences)
2. How much longer can the US government afford to spend sizable portions of our tax revenue maintaining roadways?
3. When will petroleum run out and what then?

More riding, more thoughts… at the turn of the century (twentieth), the internal combustion engine (and its supply chain) was perfected, cycling was widespread and automobiles rarely seen on the roads.

We all know what happens next, but what if otherwise?  The bicycle the target form of personal transportation and the automobile for public and commercial usage only.  Cyclist in the majority; living close by their place of worship, study, work, entertainment, etc…  Commuters would be traveling slower and have to talk to one another — maybe better for politics and setting disputes.

What would our environment look like — still polluted with carbons?  What of our hospitals — full of unfit patients?  What of our cities — divided by giant, ugly roadways or connected by scenic paths?

Is there a middle road?  Meanwhile I ride and long for the day everyone follows…

Footnotes

1. Greenhouse Gas Emissions from a Typical Passenger Vehicle
2. What is the federal government’s annual investment in transportation improvements?
3. Annual Cost of Ownership`

... like noticing that, while we weren't quite paying attention, a group of 8 (!!) paper wasps found their way inside the house and are all clustered against the upper window.

Do paper wasps come in through the chimney? Is there anything one can do about that?