This post is a chance to signal that having moved ipdb development to GitHub brings contributors and eases collaboration.

Who are we ? We are a community of individuals, business companies, public and non-profit organizations.

We collaborate and share the full development process of our system: functional and requirements analysis, coding and development, quality assurance, plus best practices for each of those.

This includes Open Source but goes further.

Seven years ago, Community Shared Development is what made me choose Plone community's CMS instead of single-dominant-vendor Open Source Nuxeo CPS. Since then, it is also what I sell to my customers.

Why Community Shared Development instead of Open Development as proposed by Dylan Jay and others ?

The word Development is a real differentiator. But, if we keep the word Open, do we really differentiate from Open Source ? I think it does not trigger enough questions.

Also, Open Development misses the community aspect. While reading Matt's post, my first reaction was that that the term Community was missing. I read in the comments that at least Jens and Wouter also think it is an important term.

Further, we need to include a term that will be harder to hijack by single-dominant-vendor Open Source systems.

Like Wouter, while reading, I came to Open Business Community Development. But this has two drawbacks. First and main, it is too long.

Second, it uses the term Business. This might feel like excluding the contributions from individuals, public or non-profit organizations. Also, it is a term that might feel suspect to some members of our community.

I then came to Community Development... which felt nice at first thought. However, while trying to explain Community Development in the text above, I found out that the word Sharing came naturally. It is a good replacement for Open. Choosing a way of calling ourselves that does not include any terms found in Open Source will trigger questions and reactions.

I am looking forward to reading your questions and reactions !

VZCZCXRO4489
OO RUEHDBU RUEHFL RUEHKW RUEHLA RUEHROV
DE RUEHTL #0366/01 1551427
ZNY SSSSS ZZH
O 041427Z JUN 07
FM AMEMBASSY TALLINN
TO RUEHC/SECSTATE WASHDC IMMEDIATE 9880
INFO RUEHZL/EUROPEAN POLITICAL COLLECTIVE IMMEDIATE
RUEHMO/AMEMBASSY MOSCOW IMMEDIATE 2513
RUEHBS/USEU BRUSSELS IMMEDIATE
RUEKJCS/SECDEF WASHDC IMMEDIATE
RUENAAA/SECNAV WASHINGTON DC IMMEDIATE
RUEHNO/USMISSION USNATO IMMEDIATE 1194
RUEHVEN/USMISSION USOSCE IMMEDIATE 0480
RHEFDIA/DIA WASHDC IMMEDIATE
RHMFISS/DEPT OF HOMELAND SECURITY WASHINGTON DC IMMEDIATE
RUEKJCS/JOINT STAFF WASHDC IMMEDIATE
RHEHNSC/NSC WASHDC IMMEDIATE
RHEHAAA/WHITE HOUSE WASHDC IMMEDIATE

S E C R E T SECTION 01 OF 04 TALLINN 000366 

SIPDIS 

SIPDIS 

DEPT FOR EUR/NB 

E.O. 12958: DECL: 06/04/2017 
TAGS: PREL PGOV ECON ETRD NATO RS EN
SUBJECT: ESTONIA'S CYBER ATTACKS: WORLD'S FIRST VIRTUAL 
ATTACK AGAINST NATION STATE 

REF: A) TALLINN 276 B) TALLINN 280 C) TALLINN 347 D) 
LEE-GOLDSTEIN EMAIL 05/11/07 

Classified By: Ambassador S. Dave Phillips for reasons 1.4 (b) & (d) 

¶1. (S) Summary. Since April 27, Estonia has been the 
victim of the world's first coordinated cyber attacks 
against a nation state and its political and economic 
infrastructure. The sensational nature of the story, 
combined with the highly technical details of the subject 
matter, has led to a good deal of misinformation in the 
public domain. Although GOE and international analysis 
is ongoing, these attacks have highlighted the 
vulnerability of both government and private sector 
internet infrastructure to attacks of this nature. For 
over a month, government, banking, media, and other 
Estonian websites, servers, and routers came under a 
barrage of cyber attacks. Defense against the attacks 
was extremely expensive for both GOE and the private 
sector. GOE and private cyber defense experts cite the 
nature and sophistication of the attacks as proof of 
Russian government complicity in the attacks. End 
Summary. 

Virtual Shots Heard Round the World 
----------------------------------- 

¶2. (C) Cyber attacks against Estonian websites began on 
April 27. They came in the wake of rioting in Tallinn 
triggered by the Government of Estonia's (GOE) 
preparations for relocating the so called "Bronze 
Soldier", a Soviet-era World War II monument (Refs A and 
B). The attacks initially targeted GOE websites 
including those of the Estonian President, Prime 
Minister, Ministry of Foreign Affairs (MFA), Ministry of 
Justice (MOJ), and Parliament, among others. According 
to XXXXXXXXXXXX the initial attacks were 
technically unsophisticated and "seemed more like a cyber 
riot than a cyber war." However, all our Estonian 
interlocutors clearly recognized these attacks as 
political in nature. Russian-language internet chat 
forums held discussions exhorting people to attack 
Estonian sites and supplied downloadable software tools 
to carry out the attacks. According to XXXXXXXXXXXX, these 
initial attacks were limited to spam (a barrage of 
unsolicited emails) and cyber vandalism (e.g., Prime 
Minister Andrus Ansip's photo was defaced on the Estonian 
Reform Party's website) and appeared to be nothing more 
than a virtual mob reaction to the Bronze Soldier issue. 
Estonian media and press commentators were quick to 
accuse Moscow of being responsible, interpreting these 
attacks as part of Russian retribution for moving the 
Bronze Soldier (Ref C). 

¶3. (S) However, on April 30, a broader range of cyber 
attacks -- from simple spam postings to coordinated DDoS 
(Distributed Denial-of-Service) attacks -- began against 
GOE sites. (Note. A DDoS attack is when a flood of 
bogus queries are made to a specific server or network of 
computers in order to over-saturate the target and 
prevent access by legitimate users. End Note.) For 
example, the Presidential website, which normally has a 2 
million Mbps (megabits per second) capacity, was flooded 
with nearly 200 million Mbps of traffic. While none of 
the technology involved in the attacks was new, tactics 
and tools routinely shifted to prevent Estonian 
authorities from blocking the attacks. One of the most 
pernicious tools in these attacks was "bots." (Note. 
Bots are computers and/or servers under the control of a 
third party. End Note.) These bot attacks came from 
ISPs (internet service providers) around the world (e.g., 
the United States, Canada, Russia, Turkey, Germany, 
Belgium, Egypt, Vietnam, etc.). Attacks routinely came 
from one set of bots, subsided and then resumed again 
using another set of bots with different ISPs. According 
to XXXXXXXXXXXX, the attacks ranged from a single
minute to  many hours in length. The longest attacks lasted


TALLINN 00000366 002 OF 004 


over  ten hours and unleashed a crushing 90 million Mbps of 
traffic on targeted endpoints. According to XXXXXXXXXXXX,
the GOE's  assessment was that a small but unknown number
of  individuals were behind these more sophisticated cyber 
attacks, which quickly dwarfed the traffic volume of the 
initial cyber rioters. 

¶4. (S) On May 3, the cyber attacks expanded beyond GOE 
sites and servers to private sites. Hansabank and SEB, 
Estonia's two largest banks, faced the most significant 
problems. Swedish-owned Hansabank and SEB account for 
almost 75% of all online banking in Estonia. (Note: 
Approximately 90% of all money transfers and bill 
payments in Estonia are done online. End Note.) 
Hansabank was well prepared with powerful servers, 
alternate sites to mirror content (thus making it more 
difficult for DDoS attacks), and the ability to 
reallocate access lines from foreign to domestic 
customers. However, even though Hansabank's site 
remained online, XXXXXXXXXXXX estimated that it came
at a cost -  - at least 10 million Euros ($13.4 million)
 Hansabank  also had to temporarily block access to its site by all 
foreign ISPs so that there was enough broadband capacity 
for its domestic clients. However, Hansabank was able to 
create alternate access mechanisms for its largest 
foreign customers. Correcting much of the press coverage 
in the early days of the attacks, XXXXXXXXXXXX
 said that  while the cyber attacks against Hansabank and SEB were a 
challenge, there was no serious danger of Estonia's 
banking sector being shut down. 

¶5. (S) This second wave of cyber attacks also hit the 
websites of Postimees, Estonia's paper of record, and 
Eesti Paevaleht, a leading Estonian-language daily, which 
over two-thirds of Estonians regularly visit for their 
news. "Imagine if you can the psychological effect," 
XXXXXXXXXXXX asked us, "when an Estonian tries to
pay his bills but can't or get the news online but can't." As 
one of the most wired countries on the planet, GOE 
interlocutors viewed the evolution of the attacks as a 
frightening threat to key economic and societal 
infrastructure. 

¶6. (S) The attacks reached their apex on May 9, the 
Russian anniversary of the end of World War II. To cope 
with the rising volume of attacks, the GOE increased its 
broadband capacity from two Gbps (Gigabites per second) 
to eight Gbps. Hansabank, SEB, Postimees, and others 
also added servers to increase broadband capacity. A 
EUCOM cyber defense expert described it as a "cyber arms 
race" where the Estonians repeatedly increased their 
broadband capacity to match the increasing volume of 
cyber attacks (Ref D). XXXXXXXXXXXX told us that XXXXXXXXXXXX
increased the  "broadband pipe" for both government and private 
clients  at a frantic pace to keep up with the attacks.
XXXXXXXXXXXX  told us that one GOE ministry increased
its original  server capacity of 30 Mbps to 1 Gbps (1 Gbps
equals 1000  Mbps). XXXXXXXXXXXX said that this defensive
response by  the GOE and the private sector was ultimately
successful,  but it was extremely expensive. 

¶7. (S) The number of attacks steadily declined after May 
9 and 10, allowing GOE and private sites to reduce their 
broadband capacity. However, on May 15, there was an 
unexpected spike in attacks that focused on Hansabank and 
SEB. In two separate and coordinated 15 minute attacks, 
these two sites were hit with over 400 bot attacks 
(roughly half the number of bot attacks recorded on May 
10) from multiple ISPs. The attacks temporarily crashed 
SEB's site for 30 minutes. Since the May 15 spike, the 
number of attacks has declined and is now hovering 
slightly above pre-April 27 numbers. 


No Smoking Gun 

TALLINN 00000366 003 OF 004 
¶8. (S) On May 2, Foreign Minister Urmas Paet released a 
statement that the MFA had proof that some of the attacks 
originated from GOR ISPs. The Estonian and international 
press carried Paet's claim, but  XXXXXXXXXXXX interlocutors 
distanced themselves from the accusation. 
XXXXXXXXXXXX  privately said to us that no "smoking gun"
incriminating  Moscow has turned up and likely won't.
The use of bots,  proxies, and spoofing tactics makes it
extremely  difficult to determine with any certainty the origin 
of  the attacks. Press reports suggested that a million 
computers were involved in the attacks. However, 
XXXXXXXXXXXX admitted that due to Estonia's poor
monitoring  capability, XXXXXXXXXXXX could only speculate on the
number of computers and servers attacking Estonia, and had
even less specific information on the origins of the attacks. 
(Note. XXXXXXXXXXXX said that the one million figure
 used by  the press and the GOE was from a quote to the press
taken out of context in which he tried to explain how he could 
only speculate a number ranging from a 1000 to a million 
computers. End Note.) 

¶9. (S) The GOE believes it has enough circumstantial 
evidence to link Moscow with the attacks. As President 
Ilves told the Ambassador, renting the large number of 
bots used in these attacks is an expensive business. 
Moreover, as XXXXXXXXXXXX repeatedly asked us in 
conversations, "Who benefits from these attacks?" He 
speculated that the probing nature of the attacks on 
specific government and strategic private sector targets 
through the use of anonymous proxies fit the modus 
operandi of the Putin regime testing a new "weapon." 
XXXXXXXXXXXXX told us that the GOE now feels that their original 
assessment of a "cyber riot" may have been incorrect. 
"Looking at the patterns of the attacks, it is clear that 
there was a small, core of individuals who intended to 
launch their attack on May 9," XXXXXXXXXXXX explained, "but 
when the MOD announced its plans to move the Bronze 
Soldier on April 27, they moved up their plans to try to 
link the attacks with the monument's removal." Estonian 
analysis of these later sophisticated attacks and 
organization through Russian-language internet forums has 
led them to believe that the key individuals tried to 
disguise their initial attacks as a cyber riot. "You 
don't expect spontaneous, populist cyber attacks to have 
a pre-determined list of targets and precise dates and 
times for coordinated attacks," said XXXXXXXXXXX. 

¶10. (S) GOE interlocutors expressed their frustration 
that their requests for information from the GOR or 
action on Russian-based ISP attacks were not answered or 
acted upon. XXXXXXXXXXX complained that cooperation
with  Russia's CERT was almost nonexistent. Even at the height 
of the Bronze Soldier controversy, GOE interlocutors who 
regularly work with their Russian counterparts (e.g., law 
enforcement, customs and tax, border guards, etc.) tell 
us that working level cooperation was positive. In 
comparison, the lack of responsiveness by the GOR and 
Russian CERT personnel only diminished Russia's claims of 
innocence in the eyes of the Estonians. 

¶11. (S) On May 29, Konstantin Koloskokov, Commissar of 
the pro-Kremlin youth group Nashi in Transnistria, 
claimed responsibility for some of the early cyber 
attacks. While not discounting the possibility of his 
involvement, XXXXXXXXXXXX noted that some of the
attacks were  extremely sophisticated; beyond the technical
abilities  of an amateur. To illustrate the point, XXXXXXXXXXXX
 and  XXXXXXXXXXXX described an attack that used a mysterious
data  packet to crash a GOE and Elion router so quickly that 
the Estonians are still uncertain how it was done. 
XXXXXXXXXXXX described in detail a number of
additional  attacks using different tools and techniques
and targets  to argue that an organized group with deep
financial backing was the likeliest culprit. "Koloskokov is
window  dressing," said XXXXXXXXXXXX, "a convenient
set-up by the  real perpetrators." 

TALLINN 00000366 004 OF 004

Why do I publish ?

Since rewritten and released in March 2010, it has been actively used, tuned and documented.

The 0.4.1 release focuses on usability right after installation. It brings two new features :

• an interactive wizard eases configuration : vimpdb asks for configuration values if the default values do not fit.
  

• when starting debugging, if no VIM server is running, vimpdb launches it.
  

UPDATE:

There is a 0.4.2 release.

This release removes the last main annoyance that avoided me to use vimpdb all the time : the lack of evaluation of arbitrary Python expression.

It actually adds two new commands :

UPDATE:

There is a 0.4.3 release with bug fixes after REDDIT readers tried previous releases.

Enjoy !

One of my contributions to the community is taking care of the commit access requests for the Collective. I process those requests since a few years and I wondered how many people where joining the Collective.

Begin of 2010, I started to actually count how many accesses I grant. Since January 2010, I counted around 80 accesses granted over around 40 weeks.

This accounts for 2 contributors a week or 100 a year.

Great to be part of a healthy community !

The buildout recipe zc.recipe.egg comes with a python option that points to a section that specifies a Python executable.

For example, with the buildout below, Python 2.4.6 is downloaded, built from source, then used to build the PIL egg found on download.zope.org.

[buildout]
parts =
    python
    PILwoTK

[python]
recipe = zc.recipe.cmmi
url = http://www.python.org/ftp/python/2.4.6/Python-2.4.6.tgz

[python2.4]
executable = ${buildout:directory}/parts/python/bin/python

[PILwoTK]
python = python2.4
recipe = zc.recipe.egg
find-links = http://download.zope.org/distribution/

Because the recipe plone.recipe.zope2instance relies on zc.recipe.egg, it also supports the python option.

However, the recipe plone.recipe.zope2install did not support that nice option. I added the option and made a new 3.3 release.

The buildout hereunder builds a custom Python from source and uses it for Zope installation and creation of instance :

[buildout]
parts =
    python
    zope2
    instance

versions = versions

[versions]
zope2-url = http://www.zope.org/Products/Zope/2.10.11/Zope-2.10.11-final.tgz

plone.recipe.zope2install=3.3
plone.recipe.zope2instance=3.9

[python]
recipe = zc.recipe.cmmi
url = http://www.python.org/ftp/python/2.4.6/Python-2.4.6.tgz

[python2.4]
executable = ${buildout:directory}/parts/python/bin/python

[zope2]
recipe = plone.recipe.zope2install
url = ${versions:zope2-url}
python = python2.4

[instance]
python = python2.4
recipe = plone.recipe.zope2instance
zope2-location = ${zope2:location}
user = admin:admin
http-address = 8080
debug-mode = off
verbose-security = off

eggs =
zcml =
products =

Enjoy !

Since rewritten and released in March 2010, it has been actively used, tuned and documented.

The new 0.4 release brings two features :

• easier configuration through ~/.vimpdbrc instead of environment variables
• Python 2.7 support

Enjoy !

I am a deeply convinced VIM user.

EMACS users, please do not flame, it just happened that I started with VIM. I could have started with EMACS but I am too lazy to start to learn again.

When Stefan Eletzhofer relased vimpdb almost two years ago, I immediately tried it. However, I did not use it further as using VIM menus to drive Pdb was far from convenient.

Last fall, Stefan released vimpdbhook, another attempt to integrate Pdb into VIM. Again, it was still not that usable and it was restricted to Mac users.

This time, however, I felt I had to scratch the itch. I started to improve vimpdbhook. This lead me to a better understanding of both pdb.py and communication to VIM.

Lastly, Jean-Francois Roche and I used our flights from and to PyCon 2010 to hack on vimpdbhook. We ended reusing good ideas/code from vimpdb and from VimPdb.vim. It worked well and the result is something pretty usable.

We released a new version of vimpdb : 0.3.2

I would like to thank Stefan of kindly accepting that we release the new code under the same package name.

It is still work in progress. We need to ease setup and to improve the UI in VIM.

Hereunder, an excerpt from the README.

Using

Using vimpdb is easy -- just call set_trace as usual:

import vimpdb; vimpdb.set_trace()

Please let us know what works for you and what does not.

If you feel like fixing bugs or adding features, the code is available at http://github.com/gotcha/vimpdb .

Enjoy

I have configured my editor (vim) to run zptlint when saving page templates (this is documented in the package). This way, I am warned of typos or other basic errors before running Zope or tests.

zptlint was lacking provider: expression support. It would bite me from time to time when editing Plone templates.

I took some time to add that support to zptlint. Enjoy.

It allows to setup timeout separately for each server action. You call it in the stylesheet just before the server action. It has a value parameter where you specify the timeout in milliseconds:

div.timeout:click {
    action-client: setActionServerTimeout;
    setActionServerTimeout-value: 10000;
    action-server: bla;
}

You can also use it to change the global default timeout value at body load time:

body:load {
    action-client: setActionServerTimeout;
    setActionServerTimeout-value: 5000;
}

http://pypi.python.org/pypi/kss.core/1.4.8

• Cignex
• Alexander Pilz
• John Habermann
• George Bray
• Christopher Johnson
• Aleksandr Vladimirskiy
• Boussard Youenn
• Headnet
• Jean-Pascal Houde
• Jesse Snyder
• Florian Schulze
• Graham Perrin
• Virginio Fanelli
• Denis Mishunov
• Totsie Marine
• Pompilio Fanelli
• Jennifer Crandall
• Thomas Zeleny
• Tannic, Inc.
• Tobias Ahlers
• Yves Moisan
• Matthew Latterell
• Jon Stahl
• Patrick Shaw
• William Murphy
• Eric Steele
• Scott Paley
• Vincenzo Barone
• Niels Steen Krogh

I want to thank you all for the trust you put in the work that we will be doing in Mountain View.

I am really honored of having been awarded one of the scholarships to fund my participation : this the opportunity to start this blog that I have been postponing since 2 years. I'll try to blog from the PSPS - no promise though, I still need to learn how writing can be fun.

I look forward to meeting the 50 other Plonistas that I will sit with, to brainstorm about the orientation(s) of our tool (and community) future.

The PloneGov project was competing in the "Local governments" category. It was awarded the "Jury Grand Prix".

PloneGov puts together the efforts of local governments and SME's from 5 countries in Europe and South America to develop software for the local governments with the Plone/Zope/Python platform.

It inherits, among others, from the CommunesPlone project. BubbleNet has been supporting CommunesPlone since it was launched in Wallonia - Belgium two years ago. More than 10 cities are today working together in CommunesPlone.

• Zope 3 message ids,
• Archetypes widgets,
• Selenium functional tests.

Zope 3 message ids

I have been working on backporting Zope 3 message ids to Zope 2. This is a step needed to be able to fully automate the extraction of strings that need to be translated.

The discussion about the integration of message ids and ZPT engine was really positive. I wrote the tests that show how message ids are translated even if not marked up with i18n namespace. Those tests pass.

Archetypes widgets

Ben Saller explained how he sees the future of archetypes dynamic widgets. The mian idea is to rely on a RESTish javascript library that would get some XHTML snippets from the server and send data back as XML chunks.

About 10 people showed up and followed Godefroid's presentation before going on with an informal meeting.

It was a chance for people to meet and deepen their knowledge of each other.