Thomas Koch

No more self-hosting

nospam@example.com (Thomas Koch) — Thu, 12 Apr 2012 15:25:25 +0200

A few years ago I started to run my own server. This was an interesting challenge back then but today I only consider it a waste of time and money. Therefore I'm searching for (a) service provider(s) to substitute my self hosted applications:

mail server with IMAP, Spamfilter, webmail
private/public Git hosting
(sharable) file hosting
blog
photo gallery
wikis
mailing lists
online address book, calendar
feed reader

However I'm a bit insane about privacy, security and reliability. I simply want to be able to TRUST. This rules out IMHO: Google, Github, Yahoo. On the other hand I'd probably be prepared to pay an insane monthly fee for a provider that just keeps me happy.

I'd love to here your recommendations! I'm especially interested in providers that are organized as cooperatives and care about environmental issues.

Do I need to mention free software? An extra plus would be a healthy distaste for PHP.

some cooperative-style provider initiatives that I still need to evaluate:

Perils of not switching to Git

nospam@example.com (Thomas Koch) — Mon, 02 Jan 2012 06:24:01 +0100

Somebody probably already recommended you to switch to Git, because it's the best VCS. I'd like to go a step further now and talk about the risk you're taking if you won't switch soon.
By still using SVN (if you're using CVS you're doomed anyway), you communicate the following:

We're ignorant about the fact that the rest of the (free) world switched to Git.
We don't invest time to train our developers in new technologies.
We don't care to provide the best development infrastructure.
We're not used to collaborate with external contributors.
We're not aware how much Subversion sucks and that Subversion does not support any decent development process. Yes, our development process most certainly sucks too.

Be aware that good developers today will not consider working with or for you if you're still using SVN. - And that's the risk.
Until recently I thought that Mercurial would be an acceptable alternative to Git. Until I used mercurial for some time. It is not.

Update: The comments are not too approving, to say the least. Lets see what time will tell. In the meanwhile I'll attach links to this blogpost:

using Git for some special workflows not so easy possible using Mercurial

Stop coding for money

nospam@example.com (Thomas Koch) — Mon, 26 Dec 2011 14:58:22 +0100

Do you believe that there will come a major inflation in the next months or years? If not, you can stop reading this article. Otherwise lets think what would be the right thing to do now.

If you're a programmer, you've most probably been able to save a bit of money over the years and should worry now how to rescue this savings over the inflation. My suggestion is: don't.
Instead stop coding for money and start to life of your savings. There are three things that are worth to invest in and will surely keep their value: health, education and community. All three things require investment of time. Go to the gym, work off your backlog of things you wanted to learn, meet with friends and family more often. Well, you could spent some money and let the dentist give you a good overhaul.
When the inflation comes, you'd better be in good health because you probably don't have the money for a doctor. When the inflation is over your education will quickly get you a good job again. And a good crisis is the moment that shows you which of your friends you can really count on. You can use a bit of free time to contribute to free software which will come in handy at a portfolio when searching a new job.
On the other hand, it's now even more futile than ever to say that you don't have time for clean code and good software engineering practices. If you're in a company that pressures you to compromise on quality, then it's now the time to quit. Remember that your boss can only give you money, which will loose it's value anyways in short terms.
Am I totally mislead or is this good advise? What do you think?

On distributing binaries

nospam@example.com (Thomas Koch) — Thu, 08 Dec 2011 09:43:36 +0100

Many software developers don't care about security. A typical Java developer downloads the Eclipse binary from eclipse.org, a website that doesn't even support https. He then continues to install binary eclipse plugins from several different web sites. Once development starts, maven continues to pull in hundreds of plugins and dependencies without checking their origin.
How do you still want to trust this machine with your private passwords or gpg key? I don't. Therefor I do java development at least in a chroot'ed environment. To make this point a bit less theoretic I've collected examples of compromised downloads or servers in recent months.

September 2009 Apache.org got hacked - twice in eight months.
December 2010 The proftpd Source Code contains a backdoor
January 2011 Sourceforge, one of the biggest distributor of free software, got hacked.
June 2011 The Wordpress Plugins AddThis, WPtouch and W3 Total Cache contain backdoors
July 2011 The vsftpd server download was replaced with a hacked version
July 2011 VLC suffers from Companies spreading Malware bundled with VLC
August 2011 kernel.org got hacked
September 2011 MySQL.com hacked to serve malware
November 2011 Takedown of the largest botnet ever. DNS resolving of the bots was compromised.
December 2011 Does download.com enrich their downloads with malware?
February 2012 unnoticed for 3 months, the Horde project served compromised downloads
March 2012 Github was easily hackable for a long time and an attacker could have compromised any repository.

And another funny example, why you should not run sudo make install on any downloaded source code: The bumblebee rm -rf /usr disaster. Not so funny: 154 people killed in malware caused airplane crash. or Malware compromises USAF Predator drones
What's the morale? If you're a developer, then please get a gpg key, get it signed by many other developers and sign your release artifacts! And no, just publishing a SHA-1 or (god beware) MD5 hash of the artifact does not provide any security. It may just fool people to believe they'd be secure. (Google Code team, please fix this! Apache people, signing artifacts with gpg keys that don't have any signatures is at best useless!)
This blog post has been triggered by a post relating to the issue of binary incompatibilities between Scala versions. If I understand Josh Suereth correctly, he recommends to not worry about binary incompatibilities but to distribute libraries as source code and recompile them when necessary. AMEN! Please, make this a habbit in Scala land! If you then distribute source code in Git repositories you can make use of gpg signed tags.
And while you're at it, why not help your favorite linux distribution to package Scala stuff?

update: add Horde, Sourceforge

Gemeinsam für globalen Wandel

nospam@example.com (Thomas Koch) — Tue, 11 Oct 2011 09:13:48 +0200

english abstract: call to assembly on October 15th in Constance (Germany).

ATTAC Konstanz und www.echte-demokratie-jetzt.de laden ein zur Versammlung "Gemeinsam für globalen Wandel" am 15. Oktober 2011 um 15:10 Uhr auf die Marktstätte (in Bankennähe)

United for global change
Wir sind die 99%!
Wir zahlen nicht für Eure Krise!
Echte Demokratie jetzt!

Weltweit gehen an diesem Tag Menschen auf die Straße, um darüber ins Gespräch zu kommen, in welcher Gesellschaft sie leben wollen. Mit ihnen gemeinsam empören wir uns darüber, dass heute die Interessen von Banken und Konzernen vielfach über die Interessen der Menschen gestellt werden, und die Kluft zwischen Arm und Reich immer größer wird. Wir sehen uns durch Politik und Wirtschaft nicht mehr repräsentiert und wollen selbst für grundlegende Veränderungen eintreten. Wir engagieren uns für neue Wege aus der Krise, jenseits von Parteien, Gewerkschaften und anderen Gruppeninteressen.

Darüber wollen wir auch in Konstanz auf der Marktstätte miteinander reden. Zur Information, wie sich Menschen in anderen Ländern für ihre Anliegen einsetzen, wird es einen Informationsstand über die Protestbewegungen in Spanien, Griechenland, Israel, Chile und den USA geben.

Weitere Informationen:

Is it really that hard?

nospam@example.com (Thomas Koch) — Sun, 29 May 2011 18:10:42 +0200

It's 2011. Computers are here for a couple of decades now, but they still don't help me with the most simple problems. I've been asked once again about a recommendation for a GroupWare and still don't know what to say. This are the simple requirements:

Manage my Mails, Calendar, Contacts, Files, Knowledge (Wiki) and ToDos (including IssueTracker). Let me synchronize these informations with mobile devices and for offline work. Allow collaboration and sharing.

I started professional programming in 2006 with the eGroupWare project, which provides the above functionality more or less, but I still can't recommend it. Neither could I recommend any other system I know of (Tine 2.0, OpenGroupWare, OpenExchange, Horde, Kolab, ...?) since they violate one or more of my secondary requirements:

a maintainable code base (this rules out PHP IMHO)
free software (there's certainly enough to earn with support/service for such a system!)
no relational database! they're just not made for this kind of data or why do you think system X allows only for N numbers of mails/addresses/phone numbers per contact?
reusable components / libraries
no dependency on antique technology (yes, I mean Kolab depending on Cyrus)
and as the cream: easy installation at least for test setups

This kind of software is on the top position on my Things-To-Do-When-I-Have-Time. But on the other hand I know that many have already started such projects and either they did not deliver sufficient functionality or there code base is a PITA.

Yes, I'm ranting once again. But please show me a decent GroupWare and I'll praise you on any occassion!

Or should I make this my project for my bachelor thesis: A Contacts+Mail server/web frontend in Scala using CouchDB, Dovecot? What do you think?

Keysigning @ Berlin Buzzwords

nospam@example.com (Thomas Koch) — Sun, 29 May 2011 13:33:53 +0200

Whenever you download some software from the Apache Software Foundation, there is a small .asc file besides every software release. This tiny file is a cryptographic signature to protect you from accidentally downloading and running malware.

Put your key signing fingerprints in your badge!

However this signature is only as good as the web-of-trust between you and the Release Manager of the Software project.
At BerlinBuzzWords many developers and users will gather at one place. This is a unique occasion to strengthen the web-of-trust. Therefor we want to encourage and remind you to use the occassion for keysigning! For lack of time there won't be an official keysigning party, but you have occassion during lunch, coffee break or the barbecue to do quick one-to-one keysignings.
You should bring print-outs of your key fingerprints and identification documents. If you put the fingerprints in your batch (see picture) everyone can easily see
them and ask you for a quick trust exchange. We may also mark a "keysigning corner" somewhere where people can go and meet others for key signing.

Hints:

under Debian (and Ubuntu) you can get a PDF to print out your fingerprints many times via:
CODE:
sudo aptitude install signing-party ghostscript gpg-key2ps KEYID | ps2pdf - fingerprints.pdf
the signing-party package also contains the tool "caff" to batch process the signing of keys after the event
please only use keys with at least 2024 bits!
please make sure that you've uploaded your key to a public keyserver
I'm happy to answer all remaining questions at the BarCamp on Sunday or during the event

Debconf and other travel plans

nospam@example.com (Thomas Koch) — Wed, 06 Apr 2011 17:01:10 +0200

If you're going to Debconf and would like to take a train, please have a look at the Arrivals page in the debconf wiki! These are my travel plans for the next months:

mai: BarCamp Kirche 2.0, Linuxtag, Fernuni

th, mai 5th to Frankfurt/M for Barcamp Kirche 2.0
mo, mai 9th to Berlin for Linuxtag (talking about Gerrit Code Review)
th, mai 12th to Düsseldorf for university stuff
mo, mai 16th back home to Constance/Kreuzlingen

june: Kirchentag, Ruhrgebiet

we, june 1st, Dresden for Kirchentag
su, june 5th, to Berlin for BerlinBuzzwords (talking about ZooKeeper)
we, june 8th to Düsseldorf for university and meeting on "church - situation, outlook"
mo, june 13th backo home to Constance/Kreuzlingen

juli: Fernuni, Debconf (Bosnia)

juli 13 - 19: Hagen (Ruhrgebiet) for university stuff
fr, juli 22th Zurich 20:40 to Novska or Okucani
su, juli 31th Novska or Nova Gradiska 15:51 to Zürich

outlook: Froscon in Bonn, august 20th, Linuxtag Oberhausen november 12th

I've been young - I needed the money

nospam@example.com (Thomas Koch) — Wed, 23 Feb 2011 14:55:38 +0100

Yesterday I had my last day at $company and today is my first day in freedom. I'll write about my future plans in another blog post. Here I just want to express the joy I had yesterday afternoon when I did:

CODE:

aptitude purge php5

I've started using PHP in 2006 and used it almost exclusively until the end of 2009. I believe I've learned most of what one can learn about PHP in this time. In 2010 I started to work in Java and only started to understand how limited PHP is.
I know that java is far from perfect. So I don't stop there and already started to learn Scala and looking forward to learn other languages too. But Java is for sure a better answer then PHP, regardless what the question was.
There are many reasons, why you should not, never, for no project ever use PHP. I'll only tell you my personal top reasons:

PHP is neither strictly nor statically typed. I fail to see any advantage in dynamic typing. But there are many advantages in compile time checks, automatic refactoring, call hierarchies and many other goodies that every IDE gives you for java.
The first time I introspected a running JVM with jconsole and could peek into the inner workings of my application, I knew that PHP is a childish language. The JVM is great, its tool support is great. PHP does not give me nearly as elaborate development tools as the java world.
PHP5 copied its object orientation syntax from Java (at least it looks like this). PHPUnit is a great tool (thank you SB!), but it's still only a very good copy of JUnit. Why not just use the original?
PHP is typically choosen because initial development is very cheap. PHP programmers are much cheaper then java developers and you can move faster with PHP. The resulting projects however become a mess of unmaintainable code sooner or later. Nobody wants to work on the code anymore and shops with such PHP code burn one developer after the other to keep the crap running.

I once advocated PHP as a serious plattform and even gave three talks about PHP. I feel ashamed of this now and apologize. Please forgive me. It's not worth arguing about this post. Its just to make me feel less guilty about my foolishness in the past.

Google Summer of Code 2011

nospam@example.com (Thomas Koch) — Fri, 28 Jan 2011 21:50:18 +0100

This summer I'll be a full time student (again) to finish my computer science bachelor. So I thought it would be a nice occasion to apply for the Google Summer of Code. Would anybody like to recommend me a project? Something around Debian, Java, decentralized social software, quality assurance or developer tools?

Thank you!

Free Software in companies

nospam@example.com (Thomas Koch) — Fri, 06 Aug 2010 10:46:25 +0200

At work we currently have a discussion: I'd like to develop some components as Free Software. My bosses like the idea, but the client goes nuts only thinking about it.
So as part of the discussion I thought to collect those companies who actively advertise their Free Software. I know about the big ones, but it would be even more interesting to get a list of succesful small companies that share at least part of their inhouse projects. On the other hand it would not be too interesting to list full Free Software companies like Red Hat.
It would also be fine to share this list in some wiki (FSFE?) when it grows larger. For some companies I also list very popular projects from my point of view.

big companies

Adobe
Facebook: Cassandra, Thrift, Scribe, HipHop for PHP, ...
Yahoo: YUI, Design Pattern Library, YSlow, Hadoop, ZooKeeper
Twitter
Google: Chromium Browser, Google Summer of Code, Android, Google Web Toolkit (GWT), Protocol Buffers - data interchange format, Java Collections Library, unladen-swallow - faster implementation of Python, ...
IBM: Developerworks (Tutorials), Eclipse, International Components for Unicode (ICU)

middle sized companies

Digg

small companies

101tec (now Datameer): Katta (distributed lucene on Hadoop), zkClient

Update: Need to add Danga (Gearman), Liip.ch with Okapi, Flux CMS, Jackalope, rackspace, Samsung

Wohngemeinschaft in Konstanz / Kreuzlingen am Bodensee

nospam@example.com (Thomas Koch) — Thu, 05 Aug 2010 08:32:22 +0200

Vor einigen Wochen habe ich meine Freunde Zellmi und Natalie in ihrer neuen Heimat, der Kommune Waltershausen (KoWa) besucht. Es hat mir sehr gut gefallen und ich wäre am liebsten gleich eingezogen. Aber meine Frau und ich sind gerade erst an den Bodensee gezogen und auch beide beruflich gebunden. Also warum nicht so etwas ähnliches am Bodensee beginnen? Es muss ja nicht gleich eine Kommune sein; eine Wohngemeinschaft wäre ein Anfang. Die Miete ist der größte Haufen Geld, den wir jeden Monat erwirtschaften müssen. Und dann arbeiten wir so lange, dass wir den Wohnraum meist nur zum schlafen nutzen. Was für eine Verschwendung. Und dann halten wir diese Wohnung im Winter auch noch warm, obwohl keiner zu hause ist.
Wenn wir mal die Zeit haben, uns selber Essen zuzubereiten, dann tun wir das für zwei Personen. Was für eine Verschwendung von Zeit und Energie! In der (KoWa) wird immer für die ganze Gemeinschaft von über 10 Personen gekocht. Jeder kommt etwa alle 2 Wochen einmal dran.
Die Mitglieder der Kommune berichten, dass sie durch die gemeinsame Nutzung von Aufenthalts- und Sanitärräumen, Sammeleinkauf und gemeinschaftliches Essen deutlich kostengünstiger lebten. Dann sollte diese Wohnform doch gerade in einer so teuren Wohnregion wie am Bodensee die richtige Wahl sein!
Gerade lese ich, dass in Konstanz und Kreuzlingen ein riesiges Überangebot an Büroflächen existiert: Teil 1, Teil 2. Es ist also vielleicht gar nicht so utopisch mit mehreren Leuten eine geeignete Immobilie günstig zu erwerben.
Wer hat also Interesse? Einfach einen Kommentar schreiben oder Mail an thomas (at) koch punkt ro.
Vielleicht können wir ja mit Ute Hauth kooperieren. Sie und andere möchten einen Co-working space in Konstanz aufbauen. Kann man in einer geeigneten Immobilie sowohl Arbeitsbereiche als auch Wohnbereiche haben?

Update: Ein schönes Vorbild, das Rainbow Mansion

Update2: Links zum Thema: Forum Gemeinschaftliches Wohnen e.V., i3 gemeinschaftlich leben & wohnen, Wohnprojekte Portal. Auf meine Anfrage in einem Couchsurfing.org Forum hat nach wenigen Stunden bereits eine Interessentin geantwortet, die auch aktiv auf ein Projekt hinarbeitet.

searching a colleague to hack on big data, crawling and search

nospam@example.com (Thomas Koch) — Tue, 22 Jun 2010 11:32:01 +0200

At YMC AG I'm working on a project to crawl and index a large amount of online content. The crawled data is feed into an index and queried for different specialized topics.

Now this project is already running since some months, the prospect is great and we're looking forward to enlarge our team and become even better. That's where you come into play. There are many areas, where you could take over some work: We're using Hadoop, HBase and Zookeeper. Maybe we could make use of some parts of Bixo or Nutch. The Lucene Index needs to be scaled, either with Katta, elasticsearch or some homegrown solution on top of HBase. We'll also need to scale the number of servers, so you could help with some background in system administration and configuration management.

What's cool about the job?

First, you'll work with me.
You will work with interesting technology: Big Data, Crawling, Search
YMC is a nice place, where I can combine intern projects with contributions to debian
Lake constance is one of the nicest touristic places in Europe
Allthough it's a touristic region, you don't have to miss Free Software events: It's one hour to Zurich, two and a half to Stuttgart and we run a local web-dev group with around 20 members. Night trains from Zurich take you to Cologne, Berlin or Vienna.

If all this sounds good for you, then have a look at www.ymc.ch/unternehmen/jobs!

NoSQL summer at lake constance

nospam@example.com (Thomas Koch) — Thu, 17 Jun 2010 09:31:00 +0200

Have you already started to try out these new storage/database things commonly referred to as NoSQL? (For you google-bot, I'm talking about CouchDB, Cassandra, HBase, Hadoop, Hypertable, MongoDB, Tokyo Cabinet, etc). Well, it's one thing to install and use them but another to understand all the computer science background about them.
Therefor many developers around the world thought to make this summer a NoSQL summer. Local meetings are held in many cities: London, Los Angeles, New York, Paris, lake constance ...
If you like to meet for a beer and learn and discuss about some of the hottest stuff in computing, then come around! Please select the dates when you can join and the papers you'd like to discuss. You can subscribe to email announcements or ical and rss feeds at the lake constance nosql summer page.

udev ate my laptop today?

nospam@example.com (Thomas Koch) — Sat, 12 Jun 2010 11:10:57 +0200

I finally got punished today for using unstable without knowing enough about my system. Since I can't access my emails I'm hoping for help from planet-debian. Please excuse...

So the last words of my machine:

Loading, please wait...
  One or more specified logical volume(s) not found.
Unable to find LVM volume mylvm/root_crypt
  One or more specified logical volume(s) not found.
Unable to find LVM volume mylvm/swap_crypt
File descriptor 3 (/conf/conf.d/cryptroot) leaked on lvm invocation. Parent PID 
352: /bin/sh
udevd-work[77]: kernel-provided name 'dm-0' and NAME= 'mapper/mylvm-swap' 
disagree, please use SYMLINK+= or change the kernel to provide the proper name

_

Please, if you can help me, write a comment to this blogpost!
(Thank you, Hanno for borrowing me your laptop!)

update: It wasn't udev (this time). Sorry. The problem was, that I updated libdevmapper without also updating dmsetup. I could boot into an older kernel and solve this. A Bug against the LVM Debian package is already filled.