My ISP is Comcast and I couldn’t be happier. “What!?” you say. I know, I know. Realize that most people deal with Comcast as a residential customer and the horror stories I hear are typically related to that class of service. There is another Comcast - the business services group. I am not sure at what point in the corporate hierarchy the two groups separate.Comcast provides an a la carte business service called Comcast Workplace. I have this service at my office. I pay monthly for two things: a connection that averages 10 Mbit inbound and 1.5 Mbit outbound, and a block of static IP addresses. Actually, the service agreement is for about 9 Mbit, but some days we get upwards of 12 Mbit. That’s it, no bundles, no block of useless email addresses, no free web storage, no browser toolbars, nothing. I am paying for exactly what is needed - bandwidth and addresses - no more. This is a business connection, and I run web and email servers here for a few low traffic domains. Inbound and outbound VPN is almost always running. The catch? In terms of paying for exactly what you need and obtaining a phone number directly to network engineers, expect to pay 2-3 times what you pay for residential cable Internet service. “What!?” you say again.A positive example of the service I get was when I needed to change the reverse lookup on the IP addresses. The customer support person at Comcast knew exactly what needed to happen and replied, “Please hold while I transfer you to network engineering.” The process took about 10 minutes on the phone and about 6 hours later the changes were live. After having the service in place since January 2006, the connection has been down once for a total of about 2-3 hours. That outage was due to a deep freeze here in Denver and that impacted equipment at Comcast’s location. They were attentive enough to send someone to my office within 45 minutes of reporting the outage to work the problem back to their site.For now, the office is happy and Comcast stays.

It really has been about 1.5 years since my last post. I have been busy and now have plenty to write about. A few months ago I deployed a dedicated system running m0n0wall at the edge of my network. I needed to find a firewall and router that could do the usual firewally things. I needed support for inbound and outbound NAT, DHCP and DNS for LAN clients, and inbound VPN when I am away. I did not want the firewall to rely on any other system in the network aside from the ISP’s router. Last year a new requirement surfaced in that the office needed shaping and prioritizing of traffic to and from the Internet. There is a VOIP adapter here for AT&T CallVantage. Skype is also used periodically. Real time traffic needs priority over everything else. Traffic related to the web and email servers need to run at the lowest priority. Services like SMTP don’t need the full bandwidth of my connection here in either direction. I often find bursts of incoming SMTP can cause drop-outs on the VOIP calls. The several workstations on the network here need reasonable connectivity - high priority than the servers but less than the VOIP traffic. Finally, if a class of service is not competing with any other, that service should get the bulk of available bandwidth regardless of priority. Here is a high-level diagram of my network. From m0n0wall With the next few postings, I will go into detail of how I successfully deployed m0n0wall on this network to satisfy these requirements.

I recently updated my PGP/GPG keys. I uploaded the public key to the MIT key server and a Google Sites page. MIT Server Google Drive

AOL, Google, and Yahoo have been in the news about their responses to a Justice Department request for search terms used by the worldwide Internet community. AOL and Yahoo have agreed, while Google has refused to hand over the information. A court battle is on the way.I really haven’t given this subject much thought until the other night when I was looking for references to my family name using Google. I searched on my name, family member’s names, addresses and even phone numbers. Then it occurred to me - search terms do contain private data. How many times have I put someone’s name into a search engine to find out about them? By now, hundreds of times. The government has said repeatedly they are not interested in who is performing the search, but I also believe there is enough private data in search terms to restrict that data as well. Considering the amount of time Google and Yahoo have probably been archiving usage data for profiling and optimizing their services, there has to be mountains of search terms that would make an NSA analyst wet themself.How many people have put their social security number into a search engine to see if it has been compromised? How many people have put a credit card number into a search engine for the same reason? How many times have you searched on something related only to you? Perhaps something private about you?The more I thought about it, the more I believe that every bit of data related to Internet search should be maintained as private and should only be obtained through proper court authority.

This seems to be a topic of increasing discussion both inside IBM and within the Eclipse Process Framework community. Questions such as “Which offering will get feature XYZ first?” “Are they functionally equivalent?” “Should the customer buy Rational Method Composer or will EPF Composer do the same thing?” are asked weekly. To refresh everyone, Rational Method Composer is a commercial tool by IBM Rational Software for the authoring of method content and for publishing configurations of method content as processes. EPF Composer is a subset of RMC code and was donated by IBM to the Eclipse Foundation as open source. The idea over time is that EPF Composer will be a core component of RMC, while RMC will add value through proprietary features and support that might not be possible in a purely open source offering.I would like to see the relationship between EPF Composer and Rational Method Composer develop in the same way the relationship of Red Hat Enterprise Linux and Fedora Core Linux has evolved. Red Hat Enterprise Linux and Fedora Core Linux are the result of Red Hat’s experience in developing, maintaining, and selling Linux distributions over more than a decade. Red Hat Enterprise Linux is a commercial distribution of Linux that is sold by Red Hat. You cannot download RHEL executable code for free. Each major release of Red Hat Enterprise Linux is stable, evolves conservatively, and this all works very well if you are an IT administrator who does not want to deal with constant architectural churn of your server operating system. Fedora Core Linux, on the other hand, is entirely open source and is available in source or binary form for download by anyone. Fedora Core Linux pushes the technology barrier to the bleeding edge. One could consider Fedora Core Linux unstable in terms of constant change, yet revolutionary in terms of the capabilities it incorporates with this regular cycle of change. An example would be the inclusion of Xen virtualization technology recently added to Fedora Core 5. Xen is developed out of University of Cambridge. Imagine having virtual machine technology, like what mainframes have had for decades, as a standard feature of your PC operating system. How would having the ability to partition the operating system into multiple, independent virtual systems change the landscape of data center design? It will. Once it is there, administrators will begin to count on it. Xen is not quite stable, yet adding it to Fedora Core 5 will push Xen toward stability by making it accessible in a highly popular Linux distribution. As cutting edge features are added to Fedora Core Linux and stabilized, they are eventually consumed by Red Hat Enterprise Linux and supported over the long term [years] by the RHEL teams. We will see Xen show up in a future release of Red Hat Enterprise Linux when it has stabilized enough for commercial adoption. Additionally, proprietary features such as hardware device drivers and other closed-source capabilities can be found in RHEL, but will never make it to Fedora Core Linux.Let’s project this idea onto Rational Method Composer and EPF Composer. Imagine EPF Composer is where new experimental ideas are realized into the tool for authoring and publishing software processes. Risks would be taken here, changes happen quickly, and the essence of the tool represents the cutting edge of ideas in the IT process authoring space from experts in business and academia. As new concepts are stabilized in EPF Composer and deemed fit for commercial inclusion, they are consumed by Rational Method Composer and supported by the world’s largest Information Technology company and the service professionals behind it. This would not mean that Rational Method Composer would be behind the times in terms of features. It means those features taken from EPF Composer and added into Rational Method Composer would be supported over the long term [years] and allow for a predictable maintenance path for CIOs, on-site technical support and formal training professionals. Additionally, Rational Method Composer might get capabilities that are not applicable to an entirely open source tool. A partnership with another vendor might allow Rational Method Composer to import and export data with another commercial closed source tool. Such an agreement would not be possible in open source.I think it is important to define the nature of the relationship between these two offerings and how they will benefit from each other’s existence. This is one possible approach for how that relationship might evolve.

After losing two dogs to completely different illnesses within one year, we recently adopted a new family member named Tater from New Hope Cattle Dogs of Colorado. He is about five months old now, and he appears to be mixed Cattle Dog and Pointer. We joke that he has a internal conflict of wanting to flush small animals out of bushes and then herd them back together. Tater

The following message was received today on the epf-dev mailing list for the Eclipse Process Framework. This is an exciting announcement from Donald Firesmith because it is another example of the process engineering community, both commercial and academic, bringing the content it has been developing for years to EPF to take advantage of the standardization of metamodel and tooling to author and publish the material.On behalf of the OPEN Process Framework Repository Organization (www.opfro.org) and the OPEN Consortium (http://www.open.org.au/), I would like to officially announce that we will be donating our complete OPFRO repository of over 1,100 reusable, open-source method components to the eclipse epf project as an additional third repository. Currently, our repository is based on the OPEN Metamodel, but we will shortly begin translating it to fit the epf SPEM metamodel andassociated xml xsd. We will also be working over the next few weeks to determine what level of effort support we can donate to epf.Donald FiresmithChair, OPFRO

I am a committer on the Eclipse Process Framework (EPF) open source project. The code and content that makes up EPF was donated from the Rational Method Composer product and the Rational Unified Process. The open source version of RUP is called BUP, which stands for Basic Unified Process. Today you can download EPF Composer from the web site and begin authoring your own method content and publishing process configurations, or you can use the BUP method content and customize it for your own development project. There is also a published version of BUP available for download as well. EPF Composer and the published BUP web site are available from the EPF download page.

This past year I joined the Rational Method Composer (RMC) team at IBM. Rational Method Composer is a tool to author method content and configure that method content into processes. RMC can be used for authoring software development processes, IT operations processes, or any complex business process that requires documentation and consistency. Processes can be published and distributed via HTML sites. What I like about RMC is that is brings the concept of knowledge reuse to process engineering. Method content can consist of the roles, tasks, and work products which are essentially smaller generic pieces of a process. Those pieces can then be assembled into a process configuration and published. Using the same library of method content, a process author could build a configuration for a new software project and also a configuration for product maintainance.

I was first introduced to DSHIELD last month. Particularly, my interest was in the textual feeds of recommended hosts to block at the firewall. The lists come in the form of a text file formatted with individual hosts and entire networks. The feeds are refreshed on a regular basis from community input. I wrote a small shell script to pull these recommended lists and create an iptables chain that is called from my existing server firewalling rules. The input, output and forwarding chains all call the DSHIELD chain. After about a month of use it seems to have paid off, because the DSHIELD chain in my firewall rules blocks many packets from these blacklisted hosts - and so far no one has complained. This script is run nightly to refresh the DSHIELD chain. If for any reason it cannot contact the DSHIELD site, it will keep the existing rules in place. Here is the BASH shell script I use on Fedora and CentOS servers.