Francois Aichelbaum

The Interest on Later: Why Postponed Decisions Never Stay Where You Left Them

2026-10-06T00:00:00+02:00

Every decision a company postpones is a loan it takes out against itself, and nobody sends the statement. The principal is what the fix would have cost on the day it was first raised. The interest is everything that attaches to the unfixed thing while it waits. Organisations price the principal correctly and ignore the rate entirely, which is why a two-month repair turns into a one-year programme and nobody can say exactly when that happened.

Postponement is a liability that accrues, not a pause

A postponed decision does not sit still. That is the part boards get wrong, and they get it wrong consistently, because the language of postponement is the language of stillness. We are holding off. We are parking this. We will revisit in the spring. Every one of those phrases describes an object at rest.

The object is not at rest. The system around it keeps moving, and every movement makes the eventual correction bigger. New work gets built on top of the thing that should have been replaced. New integrations attach to the interface that should have been retired. New people join who learn the workaround as if it were the design. None of that is visible on the day of the decision, and all of it is billed on the day of the reckoning.

What makes this so hard to see from the top of an organisation is that the postponed item behaves exactly like a solved item for a long time. It does not produce incidents. It does not generate escalations. It does not appear in a monthly report, because monthly reports track activity and there is no activity. A decision that nobody is working on produces no evidence that anybody is not working on it.

So the executive committee moves on. And it is right to move on, in the narrow sense that on that particular Tuesday there really was something more urgent. The error is not in the individual arbitration. It is in the assumption that the arbitration can be repeated indefinitely at the same price.

The debt metaphor was always about the interest, not about the mess

Ward Cunningham introduced the debt metaphor in a 1992 experience report about a financial software product, and the point he was making has been quietly inverted ever since. He was not describing bad code. He was describing the gap between a shipped understanding of a problem and the correct one, and arguing that shipping early against an imperfect understanding is a legitimate financing decision, as long as you go back and refactor once you understand better.

The metaphor works because of the second half. Debt is a reasonable instrument. It becomes destructive when you service it without ever repaying principal, or when you take it out without knowing the rate. Cunningham’s warning was about the organisation that borrows continuously and never returns, until every hour of new work goes into carrying the interest and nothing is left for the product.

Martin Fowler later split the concept along two axes, reckless against prudent and deliberate against inadvertent, and that grid remains the most useful thing a non-technical leader can hold in their head. The interesting quadrant for a CEO is prudent and deliberate. That is the quadrant where the organisation knowingly takes on a short-term cost because the market timing justifies it, writes it down, and comes back. It is the only quadrant where postponement is a strategy rather than a habit.

The quadrant most companies actually live in is prudent and inadvertent. Every individual decision was defensible. Nobody wrote anything down. There is no register of what was deferred, no date attached to any of it, and no owner. The organisation is carrying real debt with no loan documentation, which means it cannot tell you the balance and cannot tell you the rate.

Physical infrastructure publishes the bill that organisations never see

Public asset managers have spent decades learning this arithmetic in the open, and their numbers are worth borrowing because they are audited and they are large.

The United States National Park Service assesses the condition of its assets every year and publishes what it would cost to catch up. At the end of fiscal year 2025, that deferred maintenance and repair figure stood at an estimated twenty-four billion dollars across roads, buildings, utility systems and other structures. That number is not a budget request. It is an accounting of work that was correctly identified, correctly costed, and not done, year after year, by an organisation with competent engineers and a clear inventory.

The American Society of Civil Engineers does the same exercise at national scale in its Infrastructure Report Card, and its 2025 edition puts the investment gap at three point six trillion dollars over ten years, across roads, bridges, drinking water, energy, levees and the rest. Eight categories improved in that edition. The gap is still measured in trillions.

Two things in those numbers matter for a company that has never owned a bridge.

The first is that the deferral was never a decision to accept a permanent loss. It was always a decision to accept a delay. The permanent loss arrived later, as a consequence, and it was always larger than the delay appeared to justify at the moment it was accepted.

The second is that these organisations can state the figure at all. They have an inventory, a condition assessment and an annual recalculation. Most companies have none of the three for their own technical estate. They cannot produce the equivalent number because nothing in their management system is designed to produce it. The absence of the number is not evidence that the liability is small.

The rate is set by what attaches, not by the calendar

Here is the part that boards consistently mis-model. They assume the cost of a deferred fix grows with time, in a straight line, roughly in step with inflation and salary drift. Eighteen months of delay, eighteen months of extra cost, annoying but proportionate.

That is not how it grows. It grows with attachment.

A decision left unmade becomes more expensive in proportion to the number of things that come to depend on the unmade state. If nothing attaches, the cost barely moves. A reporting tool that nobody else integrates with can sit unfixed for three years and cost roughly the same to replace at the end as at the start. That is a healthy deferral, and executives should make more of them without guilt.

If the item is central, the curve is entirely different. A billing platform that should have been replaced two years ago has since acquired four new consumers. Each of those consumers was built against the current behaviour, including the behaviour that was wrong. Replacing the platform now means replacing the platform and reworking four things that did not exist when the decision was first declined. The organisation did not defer one project. It manufactured four more.

This is compounding in the literal sense. The base grows, and the next period’s growth is calculated on the new base. And it is why the honest answer to a CEO who asks what a delay will cost is a question in return: what is going to plug into this in the next twelve months?

That question is answerable. It requires knowing the roadmap, the acquisition pipeline and the integration backlog, which are all things the executive committee already has. It does not require any technical knowledge at all. It requires somebody to put those three lists next to the list of deferred decisions, which almost nobody does, because the second list does not exist in writing.

Organisations underprice postponement because nothing ever invoices them

Every other commitment a company makes announces itself. A lease has a schedule. A loan has a statement. A supplier has an invoice with a due date and a collection process behind it. A hire has a start date and a payroll line. These commitments are visible because a counterparty exists whose job is to make them visible.

Deferred decisions have no counterparty. Nobody is on the other side of the transaction with an incentive to remind you. The system does not send a letter. It simply keeps working, less well each quarter, in a way that stays below the threshold of executive attention until it crosses it all at once.

This creates a structural bias that has nothing to do with the intelligence of the people involved. In any prioritisation exercise, items with a date outrank items without one. That is correct behaviour for a queue. The deferred technical decision has no date, no claimant and no escalation path, so it loses every week, forever, until it stops being a queue item and becomes a wall.

And when it finally arrives, it does not arrive as a request for arbitration. It arrives as a constraint. The commercial project that the board approved in January cannot ship, because it runs through the thing nobody wanted to touch in the year before last. At that point the decision has already been made, by default, by the organisation’s own past behaviour. The executive committee is not choosing. It is paying.

There is a second-order effect that is worse. The correction, when it finally happens, is undertaken in the worst possible conditions. It is now urgent, which means it is now expensive. It is now blocking revenue, which means it will be scoped by panic rather than by design. And the people who understood the original context have frequently left, which means part of the budget goes to rediscovering what was already known three years ago.

A company that had been postponing for three years

I was called in by a mid-sized services group. Not a technology company. A business with physical operations, field teams, a real estate footprint and a chief executive who had grown the company competently for eleven years without ever needing to have an opinion about a database.

The presenting problem was a delivery one. A commercial programme that mattered to the year was six months late, and each monthly review produced a new explanation that the executive committee could not evaluate. They did not want an audit. They wanted a translation.

I asked for something that had nothing to do with the programme. I asked for the minutes of every management meeting going back four years, and permission to read them all.

It took two days. What came out of it was a list of eleven separate occasions on which the same underlying decision had been raised, discussed seriously, and deferred. Not ignored. Discussed. There were paragraphs about it. There were arguments, some of them good ones.

Each deferral had a defensible reason attached. A difficult trading year. A senior departure that needed backfilling before anything structural could be attempted. An acquisition that had to be absorbed first. A year in which the chief executive had explicitly decided that stability mattered more than improvement, which, given the context of that year, was the right call.

The thing that stopped me was not the number eleven. It was that the eleven entries were textually almost identical. Same framing, same estimated effort, same named individuals, four years apart. The item had been photocopied forward across sixteen quarters without anybody ever recalculating it.

Because the rest of the business had not stood still. In those four years the group had added two subsidiaries, replaced its invoicing tool, and roughly doubled its field headcount. Every one of those three changes had been connected to the component that nobody wanted to touch. Each connection had been built quickly, against the current behaviour, by people who were told the underlying thing would be dealt with later and who had no reason to doubt it.

So the original estimate, one quarter of work, was now fiction. Not because a quarter had been optimistic in the first place. It had been about right in the first place. It was fiction because the object being estimated had changed shape underneath the estimate. The same work, done in the current environment, was closer to a full year, and it now required coordinating three business units that had not been involved when the question was first asked.

I put that in front of the chief executive as two numbers and one sentence. One quarter, four years ago. One year, now. The difference was not inflation, and it was not anybody’s incompetence. It was the cost of four years of things attaching to a decision that was never made.

His reaction is the reason I keep telling this story. He was not upset about the year. He was upset that he had never seen the number. He had approved every one of those eleven deferrals, and at no point had anyone told him that the price of the thing he was deferring was moving while he deferred it. He had believed, reasonably, that he was choosing between doing it now and doing it later at the same price. He had actually been choosing between doing it now and doing something four times larger later, and no one in the room, including the people who knew the system best, had ever expressed it that way.

The second-order damage was worse than the direct cost. The six-month delay on the commercial programme was caused by the compounded item. So was a hiring problem, because the two people who understood the component had become impossible to replace and equally impossible to promote out of it. So was a quality issue in field reporting that the operations director had been treating as a training problem for eighteen months.

Three problems, three owners, three separate action plans, one cause. None of the three owners could have seen the cause from where they sat, because each of them only saw their own symptom.

We did not fix the component in that engagement. That was not the mandate and it would not have been the right sequence. What we produced was a register: every deferred technical decision in the group, what it would cost to correct today, what it would cost in twelve months given what was scheduled to attach to it, and what it was currently blocking. Fourteen items. Nine of them were genuinely fine to keep deferring, and saying so out loud mattered as much as flagging the other five. Two of the five were repriced upward by a factor of three between the original estimate and the current one.

That register is now reviewed twice a year. It is a page and a half. The chief executive’s own description of what changed was that he had stopped making these decisions blind. He is still deferring things. He is deferring them knowing the rate.

Pricing a later takes four questions

None of these require technical knowledge. All of them require somebody with no stake in the answer to ask them.

The first question is when this was first raised. Not when it became a problem. When it first appeared in a meeting. If the answer is more than a year ago, the original estimate is no longer valid and should be treated as unknown rather than as a baseline.

The second question is what has been connected to it since. Every integration, every new team, every process built around the current behaviour. That list is the interest that has already accrued.

The third question is what is scheduled to connect to it in the next twelve months. Acquisitions, product launches, new markets, replatforming of adjacent systems. That list is the rate going forward, and it is the only forward-looking number in the exercise.

The fourth question is what this is currently blocking that nobody has attributed to it. This is the one that changes the conversation in the room, because it usually turns two or three separate problems, each with its own owner and its own plan, into one problem with one cause.

Answer those four and you have converted an invisible liability into a priced one. You may well decide to keep deferring. That is a legitimate outcome and often the correct one. The difference is that you will be deferring a known amount at a known rate, which is the definition of a financing decision rather than an omission.

Later is a position, and it has a price

The organisations that get destroyed by deferred decisions are almost never the ones that made bad calls. They are the ones that made a long series of individually reasonable calls without ever writing down what those calls were accumulating.

Nobody in those companies decided to run a leveraged position on their own technical estate. They decided, eleven times, that this quarter was not the quarter. The leverage was the by-product.

A chief executive can read a balance sheet, a covenant, a maturity schedule. The one liability that never appears in any of those documents is the set of decisions the company has chosen not to make. It is real, it compounds, and it will present itself in full, on a date it chooses rather than one you choose.

The work is not to stop postponing. It is to know the rate before you sign.

Sources

All Green and Losing: What Your Dashboard Was Never Asked to Measure

2026-09-29T00:00:00+02:00

A dashboard does not report on reality. It reports on the handful of things somebody decided were worth watching, measured in a way somebody decided was acceptable, against thresholds somebody decided were safe. Every one of those decisions was reasonable when it was made. None of them is revisited. That is how a company runs six green quarters and loses its two largest accounts in the seventh.

A dashboard reports on choices, not on the business

Green means that the things you chose to watch are inside the range you chose to accept. It does not mean that the business is healthy. The gap between those two statements is where most expensive surprises live, and the gap is invisible by construction: a dashboard cannot display the absence of a metric.

This matters most for executives who cannot audit the underlying system themselves. A chief executive with a commercial or financial background has no independent way to test whether an availability figure, a ticket count or a delivery percentage still stands for the thing it was created to stand for. They read the number. The number is correct. The conclusion they draw from it may be wrong by a wide margin, and nothing on the screen will tell them.

The people who built the dashboard are not hiding anything. They built a set of indicators that could be read in fifteen minutes by a board that does not speak the language of the system. Legibility was the design goal. Discomfort was not.

The most famous health target in the world started as a product name

The 10,000 step goal was never a clinical finding. It comes from the name of a Japanese pedometer launched in 1965 around the Tokyo Olympics, the Manpo-kei, literally the 10,000 step meter. The number was chosen because it sounded right and the character for 10,000 looks like a walking figure. Research since then, including work led by I-Min Lee at Harvard, found that mortality benefits in older women level off well below that, around 7,500 steps a day.

Sixty years later, hundreds of millions of wrists carry a device that turns green at a figure invented by a marketing department.

The interesting part is not the trivia. It is what the figure did to behaviour. People walk in circles in their kitchen at eleven at night to close a ring. They do not do this because they are stupid. They do it because a target was set and they are meeting it. The target was a proxy for something broad and hard to measure: move, get outside, do not spend the day in a chair. Once the proxy became the objective, the underlying thing stopped being the subject of the evening question. The question became whether the ring was closed.

Nobody in that chain lied. A product name became a target, a target became a proof, and the proof replaced the thing it was standing in for.

Goodhart’s law describes an incentive, not a character flaw

Charles Goodhart, writing about UK monetary policy in 1975, observed that a statistical regularity tends to collapse once pressure is placed on it for control purposes. Marilyn Strathern gave the formulation that travelled, in a 1997 paper on audit in British universities: when a measure becomes a target, it ceases to be a good measure. Donald Campbell had described the same dynamic for social indicators in 1979, with a sharper edge: the more an indicator is used for decision making, the more it will be corrupted, and the more it will distort the process it was meant to monitor.

Three disciplines, three decades, one mechanism. That is usually a sign that the mechanism is structural rather than cultural.

The word corruption is misleading to a modern ear. It suggests fraud. In practice almost nothing that degrades an indicator is fraud. It is optimisation, performed by competent people who were asked for a number and delivered it.

A support team measured on ticket resolution time will split large tickets into smaller ones. That is a defensible operational decision, taken for good reasons, and it moves the number without moving a single customer’s experience. A delivery team measured on velocity will stop estimating the genuinely hard work, because hard work poisons a velocity chart. A sales organisation measured on products per customer will open products customers did not ask for, which is how a very large American bank ended up with several million unauthorised accounts and a cross-selling metric that looked excellent right up to the moment it did not.

At each step, someone did what the organisation asked. The organisation asked for the number.

Surrogation is the moment the proxy replaces the objective in people’s heads

Management researchers have a name for the specific failure that follows. Willie Choi, Gary Hecht and Bill Tayler called it surrogation: the tendency of people to mentally substitute the measure for the strategy it represents. Harris and Tayler laid it out for executives in Harvard Business Review in 2019, and their diagnosis is uncomfortable because it is not about bad actors. It is about cognition. Strategy is abstract, hard to hold in mind, and impossible to check on a Tuesday afternoon. The metric is concrete, visible, and settled by lunchtime.

So the metric wins. Not in the reporting pack, in the heads of the people doing the work. They are not tracking a proxy for customer trust any more. They are tracking the number, and they believe the number is the thing.

Incentive compensation accelerates this, which is why the effect shows up most violently where bonuses are attached. It does not require compensation. A weekly review in which one figure is always the first slide is enough. Attention is a currency, and the organisation spends it on whatever is displayed.

Six green quarters and two lost anchor accounts

What follows is a composite. The shape is common enough that the details do not need to belong to any single company, and none of them do.

A B2B services business, roughly three hundred people, sells a platform into mid-market customers with long contracts and slow renewal cycles. The chief executive came from the commercial side. The board pack carries four technology indicators: platform availability, support ticket volume and closure rate, engineering velocity, and a customer satisfaction score. Every one of those indicators was chosen sensibly, three years earlier, by a technical director who has since left.

For six quarters, all four are green.

Availability sits above 99.9 percent. The figure is accurate. It is also computed on a definition of downtime that excludes planned maintenance windows, and the windows have been getting longer. Two years earlier maintenance meant a quiet hour on a Sunday. It now means a four hour window most Wednesday evenings, because a core integration has become fragile enough that changes are batched and staged carefully. Customers in the Americas experience this as the product being unreliable on Wednesday afternoons. The availability metric experiences it as nothing at all, because planned maintenance was excluded from the definition on the day the definition was written, when maintenance was genuinely rare.

Ticket closure rate is excellent and improving. The improvement started shortly after closure rate became a quarterly objective for the support organisation. Tickets are now scoped more tightly, which is good practice, and multi part problems are logged as separate tickets, which is also good practice. A customer whose integration breaks now generates four tickets, each closed inside the target, instead of one that stayed open for nine days. The board sees a rising closure rate. The customer sees the same nine days.

Velocity is up eighteen percent year on year. Part of that is real. Part of it is that the team has quietly routed around the oldest and most dangerous part of the codebase, the batch job that reconciles customer entitlements every night. Nobody has decided to avoid it. It is simply that work touching it is unpredictable, unpredictable work wrecks a sprint commitment, and sprint commitments are visible. The reconciliation job now runs on a version of a runtime that has been out of support for over a year, and exactly one engineer understands it. That fact appears on no indicator, because there is no indicator for it.

The customer satisfaction score holds at a strong number. The survey is sent thirty days after a support interaction is closed, to accounts with no open critical incident. The exclusion was added for a reasonable purpose: not to ask angry customers to rate you in the middle of an outage. Its practical effect is that the most damaged relationships are systematically outside the sample.

None of this is fraud. Every single choice above was made by a competent person for a defensible reason, most of them years before the consequence appeared. There is no one to blame, which is precisely what makes it survive.

There is one more layer, and it is the one that makes the situation durable. Each of these four indicators is owned by a different person, and each owner is reporting accurately on their own scope. The head of infrastructure reports availability as defined. The support manager reports closure rate as defined. The engineering lead reports velocity as measured by the tool. The customer success lead reports the satisfaction score the survey returns. No individual has visibility across all four, and no individual is wrong.

The technical director who would have held the whole picture left two years earlier and was replaced by a delivery manager with a narrower remit. That single organisational change, made for sensible cost reasons, removed the only role in the company whose job was to look across the indicators rather than at one of them.

What the chief executive experiences is six quarters of a technology function performing well. Investment decisions follow: the technology budget is held flat for two years, because the indicators show a system in good shape and the growth argument is being made in sales. Two commercial hires are made instead of the platform engineering role the departing technical director had asked for.

In the seventh quarter, the two largest accounts, together around a quarter of recurring revenue, decline to renew. Both cite reliability and responsiveness. One of them has been running a parallel evaluation for five months. The chief executive learns the reasons in the exit conversation, not in the board pack, and the reasons are things that were happening continuously for two years, in plain sight, on the other side of four green indicators.

The cost is not the outage that never happened. The cost is two years of capital allocated on the strength of a picture that measured activity and called it health, and a renewal conversation that was lost before anyone knew it had started.

The recovery is worse than the loss. Fixing the reconciliation job, rebuilding the availability definition, and re-establishing trust with a mid-market reference base takes longer and costs more than the platform engineering hire would have. The company survives. The two years do not come back.

Vanity metrics survive because they are easy to defend, not because they are useful

There is an economy to this, and it is worth stating plainly because it explains why the problem regenerates after every clean-up.

Every indicator in a board pack has to survive a specific test: it must be explicable in under a minute to an audience that does not share the vocabulary of the system being described. That test favours a particular kind of number. Counts over conditions. Averages over distributions. Percentages of things completed over assessments of whether the completed thing works. Anything that requires a caveat loses to anything that does not.

The people who assemble the pack know this. They are not cynical about it. They are doing the reasonable thing, which is choosing figures that will not derail a meeting with a definitional argument. The result is a systematic bias toward metrics that are legible rather than metrics that are informative, and the bias operates every quarter, in every organisation, without anyone intending it.

There is a second force pushing the same way. An indicator that can make you look bad is an indicator you have an interest in not proposing. Nobody in the chain that produces the reporting has a professional incentive to introduce a number that says the system is more fragile than it looks. The absence is not a conspiracy. It is the sum of many individually sensible omissions, made by people who each assumed someone else was covering it.

Put those two forces together and you get a dashboard that drifts steadily toward reassurance. Not through any single decision. Through the accumulated gravity of a hundred small, defensible ones.

This is also why asking the same chain to review its own indicators does not work. The review will be honest and it will change nothing important, because the people conducting it share the constraints that produced the problem. Every metric will be confirmed as accurate, because every metric is accurate. Accuracy was never the issue.

Four questions that separate a health indicator from a decorative one

The audit that matters is not arithmetic. Take each indicator in the pack and answer four things about it.

Who built it, and to persuade whom. Indicators built to reassure a board behave differently from indicators built to run an operation, and after a few years nobody remembers which kind they were dealing with.

What it was originally standing in for. Availability stands in for customers being able to work. Ticket closure stands in for problems being resolved. Write down the underlying thing, then ask whether the indicator would still move if the underlying thing changed.

What it excludes today. Every metric has a definition, every definition has exclusions, and exclusions written years ago under different conditions are where the drift accumulates. Planned maintenance. Accounts with open incidents. Work that was not estimated.

Who gains if it goes up. Not to catch anyone. To know which figures are under pressure, because those are the ones that will degrade first.

Four questions, applied across a dozen indicators, takes a couple of days. It has to be done by somebody outside the chain that produces the numbers, and that is the entire difficulty, because the organisation has no natural role for that person.

A better dashboard is not the fix

The instinct after discovering a decorative metric is to replace it with a better one. That instinct is right in principle and it fails in practice, because the replacement enters the same system that degraded the original.

A new indicator arrives clean. It describes something real, it is not yet attached to an objective, and for two or three quarters it tells the truth. Then it gets a target, because an indicator that nobody is accountable for tends to disappear from the pack. Once it has a target it acquires the same gravity as everything else, and the same slow drift begins.

What survives is not a metric. It is a habit: someone from outside the chain that produces the numbers looks at the definitions on a fixed cadence and asks what changed. Not the values, the definitions. What was excluded that was not excluded last year. Which threshold was adjusted, and by whom, and what was happening that month. Which number started improving unusually fast, and what became an objective shortly before.

That review is unglamorous and it takes two days a year. It is also the only mechanism that catches drift, because drift does not announce itself in the values. It hides in the definitions, and definitions are the one part of a reporting pack that nobody reads twice.

Organisations that do this well tend to keep a short written record of why each indicator exists and what it was meant to stand for. Not a governance artefact. A paragraph per metric, written when it was introduced, readable by the person who inherits it three years later and has no idea what the original question was.

The bill for a green dashboard always arrives late and in full

The particular cruelty of this failure mode is its timing. Nothing goes wrong while it is happening. There is no incident to investigate, no threshold breached, no moment where a reasonable executive should have known. The degradation is continuous and the reporting is stable, so the only signal available is the absence of surprise, which is not a signal anyone can act on.

By the time it surfaces, it surfaces as revenue.

A dashboard is not a view of your business. It is a model of your business, built by people with constraints, in a context that has since changed, and it decays the way any unmaintained model decays. The decay is silent and the colour stays the same.

Green is not an answer. It is a claim, made by an instrument, about a question somebody else chose.

Sources

Marilyn Strathern, “‘Improving ratings’: audit in the British University system”, European Review, 1997. PDF, publisher record
Donald T. Campbell, “Assessing the impact of planned social change”, Evaluation and Program Planning, vol. 2 no. 1, 1979. Record
Goodhart’s law, overview and origin
Michael Harris and Bill Tayler, “Don’t Let Metrics Undermine Your Business”, Harvard Business Review, September-October 2019. Article
Surrogation: the substitution of a measure for the objective it represents
Harvard Health Publishing, “10,000 steps a day, or fewer?”, on the origin of the figure and the I-Min Lee study. Article

Everyone Sells You What You Asked For

2026-09-22T00:00:00+02:00

The need a company states and the need it has are rarely the same thing, and almost every supplier around the table is paid to serve the first one. Not out of malice. Because the stated need is specified, budgeted and billable, while the real one is a conversation nobody invoices. The result is an organisation that buys a correct answer to the wrong question, pays for it in full, and concludes from the failure that it should buy more.

A stated need is a translation, and translations lose things

A chief executive does not observe a technical problem. He observes a consequence. Month-end takes too long. Two salespeople left and the third is complaining. A customer escalated for the second time this quarter. Something in the machine is producing an outcome he can feel.

Between that observation and the moment it becomes a request, there is a translation step. It takes about four seconds and it is invisible. The consequence gets matched against a pattern, the pattern gets matched against a remedy, and the remedy gets spoken out loud. We need a new ERP. We need to migrate off this platform. We need a CTO.

The translation is not stupid. It is experience doing its job. A leader who stopped to diagnose every irritation would never decide anything, and most of the time the shortcut lands close enough to be useful. The trouble is what happens to the shortcut once it has been said in a room.

The moment a need is stated, it stops being a hypothesis and becomes the subject. Meetings are scheduled about it. Budget lines are opened under its name. Suppliers are asked to quote against it. Within two weeks, nobody is discussing the consequence any more. Everybody is discussing the remedy, its options, its timeline and its vendor shortlist.

The original observation is now an unexamined premise carried inside a procurement process.

Software people gave this a name long before management did. The XY problem: someone asks for help with X, the solution they have already chosen, instead of describing Y, the thing they actually need to achieve. The person helping spends an afternoon making X work, and X was never going to solve Y. The pattern is old, well documented, and it scales perfectly from a support forum to a seven-figure programme.

Expertise markets are built on a gap the buyer cannot close

There is a category of goods where the buyer cannot judge what he needs before the purchase, and often cannot judge what he received after it. Economists call them credence goods. The canonical examples are doctors, mechanics and computer specialists, which is a list worth reading twice if you buy technology advice for a living.

Uwe Dulleck and Rudolf Kerschbamer laid out the mechanics in the Journal of Economic Literature in 2006. When the expert also diagnoses, three things can go wrong that the customer cannot detect: he can be treated for something he did not have, he can be charged for work that was not performed, and he can be under-treated on the thing he did have. All three survive a perfectly polite transaction. All three are compatible with an expert who is technically excellent.

Notice what the model assumes. It does not assume fraud. It assumes that the person who tells you what you need is the same person who gets paid for providing it. That single overlap is enough to produce the outcome, with or without bad intent, in a market full of competent professionals.

Corporate technology buying is that structure with better slides. The vendor scopes the requirement. The integrator validates the architecture. The recruiter defines the profile. Each of them is the most qualified voice in the room on their own subject, and each of them is describing a need whose fulfilment they will invoice.

The formal name for the rest of it is the principal-agent problem: the agent acts on the principal’s behalf, the two sets of interests do not fully overlap, and the principal lacks the information to monitor the gap. Nothing exotic. It is the default condition of every advisory relationship, and it is managed by structure, not by character.

Procurement rigour starts one step too late

Most organisations that buy badly are not sloppy. They are rigorous, one step downstream of where it matters.

Look at how a decision of this kind is actually handled in a serious company. A requirement document is written and reviewed. Three suppliers are consulted rather than one. Responses are scored against weighted criteria. Legal reviews the contract. A steering committee is set up with named sponsors and a reporting cadence. Every single one of those controls is a good control, and together they produce an audit trail that would survive any inspection.

Not one of them examines whether the requirement is the right requirement.

The controls start at the requirement and work forward. They test whether the chosen supplier can deliver what was asked, whether the price is competitive, whether the risk is covered, whether the programme is on track. They are all comparative. They assume the object of comparison is correct, because by the time the process begins, the object has already been fixed by a sentence somebody said in a meeting weeks earlier.

This is why the failure is so hard to see from inside. The organisation experiences itself as disciplined the entire way through, and it is right. The discipline simply begins on the wrong side of the only decision that could not be reversed later.

There is a practical consequence worth stating plainly. The cheapest possible intervention on a programme of this type is an hour spent before the requirement is written, and the most expensive is the same hour spent after go-live. The value of the question decays to almost nothing the moment budget is committed, because from then on the question threatens sunk cost and personal credibility rather than a hypothetical.

Nobody’s process schedules that hour, and nobody’s invoice contains it.

Nobody at the table is positioned to disagree with you

Take an actual decision and list the participants.

The software publisher wants the licences. The integrator wants the deployment. The recruitment firm wants the placement. The services company wants the days. Internal IT has a professional opinion and also a career, and the two are not always separable. The executive committee has already approved a direction and does not enjoy reopening it. The consultant who framed the programme has his name on the framing.

Now cross out everybody who loses nothing by telling the chief executive his stated need is wrong.

The list is usually empty. Not because these people are dishonest, but because none of them occupies a position from which the sentence can be said without cost. Asking a supplier to challenge the brief is asking him to argue himself out of a signed order, in front of a client who may well read the objection as a lack of competence.

So the chief executive gets consensus. Ten qualified professionals agreed with the plan. He reads that as confirmation. What he is hearing is ten commercial processes that all begin with his yes.

A case: the close that stayed at three weeks

A manufacturing group, around six hundred people, three production sites, two of them acquired within the previous decade. The finance director had a concrete and unarguable problem: the monthly close took three weeks. Figures for month N landed on the executive committee’s desk near the end of month N+1, by which point they were commentary rather than management information. Decisions were being taken on a picture of the past.

The stated need was formed quickly and it sounded right. The ERP is old, it dates from before the acquisitions, it does not consolidate the sites properly. We need to replace it.

Everybody agreed. The incumbent publisher agreed, and had a modern suite. Two integrators agreed, and both quoted. The auditor agreed in passing, because a modern ERP is never a bad idea. The IT manager agreed, partly because he had wanted to replace that system for four years. The executive committee agreed because three weeks is obviously too long and here was a plan to fix it.

The programme ran fourteen months. By any delivery standard it was a success. Scope held. The overrun was under ten per cent. Data migration was clean, training was done properly, the integrator’s team was good and the finance team did not revolt. The go-live weekend was uneventful, which in that business is the highest available compliment.

The first close on the new system took three weeks and two days.

The second took three weeks. The third took three weeks. A year later, it was still three weeks.

The three weeks had never been in the software. They were in the inputs. The two acquired sites booked their supplier invoices on their own local rhythm, one weekly, one when the plant manager got around to it, because that had been the practice before the acquisition and no one had ever changed it. Stock counts at the third site were entered by a single person who also ran the warehouse, and she entered them when the warehouse allowed her to, which was after the twelfth of the month. Intercompany transfers were reconciled by hand in a spreadsheet by one controller, and the spreadsheet had grown a set of rules that existed nowhere else.

The close did not start when the month ended. It started when the last of those three things arrived, and that date was structurally around the fifteenth. Everything after it was fast. Everything before it was outside the system entirely.

A new ERP could not move that date. No ERP can. The constraint was an operating agreement between four sites that had never been written down, let alone renegotiated.

What it cost is worth itemising, because only one line of it appears in any accounting system.

The programme itself, licences plus integration plus internal time, was the visible number and the smallest problem. Fourteen months of the finance team’s attention was the second line: during that period the group did not touch its pricing structure, did not rebuild its cost accounting, and postponed a site consolidation study that had been scheduled. The third line was political. The finance director had spent his personal credit inside the executive committee to get the programme approved, and after delivery the figures still arrived at the end of month N+1. He was now the person whose big project had not worked. Two years later he was no longer with the group.

The fourth line is the one that makes the pattern self-sustaining. Since the close was still three weeks after a successful ERP implementation, the conclusion drawn internally was that the problem must be deeper. A consolidation tool was evaluated. A business intelligence layer was proposed on top of the new system. A finance transformation programme was sketched. Each of these was a reasonable proposal, sold by capable people, aimed at the same wrong target, and each one now had a better argument than the last because it came from suppliers who knew the house.

The entire sequence could have been stopped by one person, in one afternoon, before anything was signed, by asking what was actually happening between the last day of the month and the day the first consolidated figure appeared. That afternoon was not on anybody’s invoice, so it did not happen.

A wrong diagnosis does not cancel, it compounds

The dangerous property of the wrong diagnosis is not the first bill. It is that a clean delivery of the wrong thing produces evidence for buying more of it.

When a project fails visibly, an organisation stops and asks why. When a project succeeds visibly and the underlying problem persists, the organisation does not question the diagnosis, because the diagnosis was never on trial. It questions the dose. Phase two. An additional module. A bigger team. More of the same remedy, argued now by people with real knowledge of the environment, which makes them more persuasive than they were the first time.

The company is now on a trajectory that moves steadily away from its actual subject, at constant speed, with everybody’s agreement, and with a paper trail that looks like good governance the whole way.

Theodore Levitt made the point about companies defining themselves by their product instead of the need they serve. The buying side has the same disease. A business that defines its problem as the absence of a tool will keep buying tools. Christensen and his co-authors put the same idea on the customer’s side of the table: people hire a product to do a job, and the job is not the product. If you never articulate the job, you will be sold the product, correctly, at full price, forever.

Telling the truth here has a price and it is paid by the wrong person

The mechanism only breaks if somebody says the stated need is wrong. That sentence is expensive to say.

The person saying it gives up the mission in front of him. He accepts being read as difficult, or as unable to deliver. He offers, for free, the most valuable thing he has in the exchange, which is the diagnosis. And he does it at the exact moment he has the least credibility to do it, because he has not worked with the company yet.

There is no altruism in any of this. It is a position. Either you are structured so that you can afford to say no, or you are not, and if you are not, your opinion on the client’s real need is worth precisely nothing, whatever your competence. That is the uncomfortable part. Independence is the scarce input here. Competence is available everywhere, at market rate.

Which is why the test a chief executive should apply is not about expertise. It is simpler than that.

Ask what happens to the adviser if the answer is no

Before signing anything, there is one question worth an hour of anybody’s time. Not put to the supplier. Put to yourself, about each person advising you.

If the honest answer to my problem is that I should do nothing, or something small, or something entirely different from what I have described, what does this person lose by telling me?

Where the answer is nothing, listen carefully. Where the answer is the mandate itself, discount accordingly. That is arithmetic about positions rather than cynicism about people, and it is the only part of this whole structure the buyer actually controls.

The garage that puts your car on the lift before answering is not more virtuous than the one that changes your brakes on request. It is arranged differently. You cannot inspect virtue. You can inspect arrangements.

Sources

The XY Problem: description of the pattern where help is requested on an attempted solution rather than on the underlying problem.
Uwe Dulleck and Rudolf Kerschbamer, On Doctors, Mechanics, and Computer Specialists: The Economics of Credence Goods, Journal of Economic Literature, vol. 44 no. 1, 2006.
Principal-agent problem: conflict of interest and information asymmetry between a principal and the agent acting on his behalf.
Theodore Levitt, Marketing Myopia, Harvard Business Review (classic article, 2004 reissue).
Clayton M. Christensen, Taddy Hall, Karen Dillon and David S. Duncan, Know Your Customers’ “Jobs to Be Done”, Harvard Business Review, September 2016.

Flags of Convenience: The Process That Was Never Meant to Protect You

2026-09-15T00:00:00+02:00

A shipowner does not register his vessel in Panama because he intends to sail there. He registers it there because the flag decides who has to answer when something goes wrong, and he has selected a flag that will not. Most rules, processes and organisational structures work the same way: they are designed to move responsibility away from the point where the decision is taken, and the consequence flows downhill until it reaches someone with no rule left to hide behind. That person did not decide anything. That person pays.

A ship’s flag tells you who will answer when something breaks

Under international maritime law, the flag state carries the legal duty to inspect a vessel, certify its safety, and enforce labour standards on board. That is the entire point of registration. A ship is a piece of territory that moves, and the flag decides whose law travels with it.

So the owner picks the territory. He can live in Piraeus, run the technical management from Cyprus, register the hull in Monrovia, and crew it from Manila. Nothing about that is illegal. Each link is compliant with its own frame. The International Transport Workers’ Federation, which has been documenting this arrangement for decades, describes a flag of convenience vessel simply as one flying the flag of a country other than the country of ownership, and points at the reason: cheap registration fees, low or no taxes, and the freedom to recruit the cheapest labour available.

What the owner buys is not a port. It is a gap. The state whose flag flies at the stern has neither the inspectorate nor the incentive to look closely at a fleet it will never see. The owner has bought distance between his decision and its consequences.

The industry knows this precisely enough to have built instruments around it. The Paris Memorandum of Understanding on Port State Control exists because flag states cannot be trusted to police their own registers, so the ports do it instead. Its annual performance lists rank flags on three years of inspection and detention data and sort them into a White, Grey and Black list. In the 2025 lists, forty flags sit on the White list, nineteen on the Grey, ten on the Black. The Black list is the list of flags whose ships are detained most often relative to how often they are inspected.

Read that structure again, because it is the interesting part. An entire international apparatus had to be invented to compensate for the fact that the party formally responsible has arranged not to be. Nobody in that apparatus is naive about it. The compensating mechanism is treated as normal infrastructure.

And when a ship is finally abandoned in a foreign port, which the ITF documents regularly, the crew on board discovers what the arrangement was actually for. There is an owner in one country, a manager in another, a registry in a third, and a crew agency in a fourth. Every one of them followed its own frame. The unpaid wages, the food running out, the months without repatriation: those are entirely real, and they belong to nobody.

Moral hazard is a design outcome, not a moral failing

The economics of this were formalised more than sixty years ago, and the formalisation is more useful than the outrage. In 1963, Kenneth Arrow examined how insurance changes the behaviour of the insured, drawing on a term already circulating in insurance practice: the effect of coverage on incentive. Once a party is shielded from the cost of an outcome, that party’s care in avoiding the outcome drops. Not because the party is dishonest. Because the price signal has been cut.

The word “hazard” carries a moral tone that misleads people. It sounds like an accusation of bad faith. It is not. It is a statement about geometry. If you separate the person who takes a decision from the person who absorbs its consequence, the decision degrades. Reliably. Regardless of character.

The principal-agent literature that grew out of that period describes the same geometry from the other side: whenever one party acts on behalf of another whose interests differ, and the acting party knows things the other does not, the acting party’s rational move is to optimise for what will be observed rather than for what actually matters. A process that is auditable will beat a process that is effective, every time, if only the audit is checked.

Put those two together and you have the mechanism this whole essay is about. A rule can be written to achieve its stated purpose. A rule can also be written to produce evidence that its stated purpose was pursued. The second is cheaper, faster to demonstrate, and defensible in front of a regulator, an insurer or a court. Organisations are not stupid. They pick the second more often than they admit, and they rarely pick it consciously enough to feel dishonest about it.

Organised irresponsibility describes what mature structures produce on purpose

Ulrich Beck gave this its sharpest name. Writing on the risk society, most famously in Risikogesellschaft (1986, published in English as Risk Society in 1992) and then in Gegengifte: die organisierte Unverantwortlichkeit (1988), he argued that modern institutions have become extremely good at generating hazards while simultaneously generating the procedural conditions under which nobody can be held accountable for them. Organised irresponsibility: the phrase does the work.

The word that matters there is “organised”. Not “accidental”. Not “emergent”. The dilution of responsibility is an output of the system working as designed, and the system is often improved in that direction over time. Every incident produces a new procedure. Every new procedure adds a documented step, a sign-off, a delegated control. The chain lengthens. The audit trail thickens. And the number of people who could actually be held to answer for an outcome goes down, not up.

This is why “we have a process for that” is such a durable sentence in corporate life. It is not a description of capability. It is a claim about liability, and it is usually true.

Here is the part that should bother a chief executive. The same maturity curve that makes a large organisation reliable also makes it a very efficient exporter of risk. Its counterparties are almost always smaller, less lawyered, and less able to say no. So the risk moves outward, to suppliers, subcontractors, partners, franchisees, and eventually to individual employees on the last rung. Each transfer is documented. Each transfer is agreed. None of it looks like coercion, because at every step somebody signed.

A case: the secure process that secured nothing

I want to reconstruct one case in detail, anonymised, because the abstraction only becomes useful when you can see the machinery turning.

A mid-sized company works with one of the very largest names on the French market. Being in that supply chain is commercially significant. It changes what other buyers think, it stabilises the order book, and it justifies hiring. The relationship is asymmetric in every dimension that matters: revenue concentration, legal capacity, and who can walk away.

The work requires the smaller company to hand over genuinely sensitive material. Commercial terms. Unit pricing and the reasoning behind it. Technical architecture. An honest inventory of what the company can and cannot do, which is the single most exploitable document any business produces about itself.

The large group has a secure document process. This is not a fiction and not a shortcut. It is written down, it is referenced in the contract, it has an internal owner, it appears in the group’s compliance reporting, and it has been signed off by people whose job title contains the word security. It has an official-looking external platform in front of it, operated by a third party with a public-sector flavour, which does a great deal of work on the perception side.

The process, executed as designed, does the following. The supplier uploads the document to the platform. The platform applies a watermark. The watermarked PDF is then attached to an email and sent onward to whoever inside the group needs it.

That is the whole control.

A watermark encrypts nothing. It restricts nothing. It expires nothing. It cannot be revoked once the file is out. It does exactly one thing, and it does it well: it writes the supplier’s identity onto every page. And the email carrying the file lands in an unknown number of mailboxes, on devices nobody has enumerated, subject to retention rules the supplier has never been shown, forwarded onward by people acting in good faith with no idea what the file is worth.

Anyone with a security background sees this instantly. Which raises the real question: how does a process like this survive inside an organisation that employs competent security people?

It survives because it is not a security control. It is a liability instrument, and as a liability instrument it is excellent.

Follow the incentives. Procurement needs a documented process in order to close the contract. Compliance needs a control it can name in a report. Legal needs the process referenced in the agreement so that the group’s obligation is defined and bounded. The internal auditor needs something checkable, and “was the platform used” is checkable in a way that “was the file actually protected” is not. The security team may well have flagged it, but the security team does not own procurement’s contract template, and the finding sits in a backlog behind things with owners.

None of these people is acting in bad faith. Each is optimising for what is observed in their function. The result of all that local rationality is a process whose real function is to establish that a procedure existed and was followed.

Now run the failure.

Eighteen months in, the file surfaces where it should not be. Maybe a laptop, maybe a departing employee, maybe an unrelated breach at a fourth party, maybe a forward to a consultant who also works for a competitor. The vector barely matters. What matters is what each side is holding when the music stops.

The group is holding a documented process, an audit trail showing it was followed, a contract clause defining its obligation narrowly, and a watermark that names the source of the leaked document. Its exposure is procedural and it is covered. Internally, this will be handled as an incident, closed with an action item, and possibly used to justify one more step in the process.

The smaller company is holding something else. Its pricing logic is now readable by anyone who wants to undercut it, and pricing logic is far more damaging than a price, because it tells a competitor where the floor is and why. Its honest inventory of weaknesses is now available to be quoted back at it in the next competitive situation. Its commercial terms with this group become the reference point every other large buyer will demand to match. And in the next negotiation with the group itself, its margin is no longer private information.

None of that appears as a line item. There is no invoice for it. The chief executive of the smaller company will feel it as a slow deterioration in win rates and negotiating position over the following two years, and will attribute it to market conditions, because that is the only explanation available without the document in hand.

The recourse is close to nil. Not because the law is unfair, but because the process was followed. The obligation was defined and met. The supplier accepted the process at contract signature, at a moment when refusing it would have meant not signing at all, and when nobody in the room framed it as accepting a transfer of risk. It was framed as security. It said security on the label. It had a platform.

That is what a flag of convenience looks like when it is made of paper. The group registered the handling of your most sensitive material under a regime that cannot hold it responsible, and it did so while telling you, accurately, that the regime existed and was documented.

The cost always lands on whoever is furthest from the decision

In every version of this pattern, the party that pays is the one with the least power to have shaped the rule. No coincidence there. Risk moves along the path of least resistance, and resistance is a function of power, so the selection mechanism does the work on its own.

The crew on the abandoned ship did not pick the registry. The supplier did not draft the document process. The apprentice put in charge of a critical technical subject, because the contractor who used to hold it was judged too expensive, did not decide to concentrate a company’s survival into the hands of its least experienced person. In each case the decision was taken several levels above, by someone whose exposure to the outcome had already been engineered away.

And the person who ends up carrying it is almost always grateful at first. That detail is worth sitting with. The apprentice is pleased to be trusted with something real. The supplier is pleased to be in the supply chain. Consent is present at every step, which is exactly why the arrangement is stable and why it does not read as abuse from the inside.

For a chief executive, the uncomfortable half of this is that the same logic runs in both directions. You inherit transferred risk from regulators, from large customers, from vendors whose terms you accepted because you needed the deal. You also transfer it: onto an underpowered hire on a subject nobody in your company understands, onto a supplier whose liability cap is smaller than the damage they could cause you, onto an internal process that documents an approval instead of producing a judgement. You will pay for the second kind later, and you will pay for it as an operational surprise rather than as a decision you remember making.

Read a rule by asking who wrote it

There is one question that cuts through all of it, and it is not a technical question. Who wrote this rule, and what would happen to them if it failed?

If the answer is “nothing”, you are not looking at a protection. You are looking at a transfer, and you are standing at the receiving end of it. That holds for a supplier’s security process, for a large customer’s subcontracting clauses, for an insurance exclusion, for an internal approval workflow, and for the training certificate nobody in the building could act on.

The repair is unglamorous and it is not more process. It is naming. Take the decisions in your organisation that would genuinely hurt if they went wrong, and put a person’s name against each one, not a committee, not a vendor, not a procedure. Then take the rules imposed on you from outside and mark, for each, who is exposed if it fails. What remains unnamed after that exercise is the list of risks you are carrying without knowing it.

Doing this does not make an organisation safer on its own. It makes the exposure visible, which is the only condition under which a leader is actually deciding rather than discovering. The alternative is to keep sailing under a flag somebody else chose, and to find out what it was worth on the day it matters.

Sources

International Transport Workers’ Federation, Flags of Convenience: https://www.itfglobal.org/en/sector/seafarers/flags-of-convenience
Paris Memorandum of Understanding on Port State Control, Flag and RO Performance Lists (White, Grey and Black List): https://parismou.org/Statistics%26Current-Lists/white-grey-and-black-list
International Maritime Organization, Our Work: Safety: https://www.imo.org/en/OurWork/Safety/Pages/Default.aspx
Kenneth J. Arrow, “Uncertainty and the Welfare Economics of Medical Care”, The American Economic Review, vol. LIII, no. 5, December 1963, pp. 941 to 973: https://assets.aeaweb.org/asset-server/files/9442.pdf
Ulrich Beck, bibliographical record including Risikogesellschaft (1986) and Gegengifte: die organisierte Unverantwortlichkeit (1988): https://en.wikipedia.org/wiki/Ulrich_Beck

The Taxonomy Nobody Draws: Four Things Hiding Under Simple and Complex

2026-09-08T00:00:00+02:00

Simple and complex are not two categories. They are two words covering four distinct operations: simplification, reduction, manufactured complexity, and natural complexity. Two of the four are counterfeits sold as virtues, and two are real conditions that most organisations refuse to name. The cost of the confusion is not intellectual. It is paid in capabilities that vanish quietly and in invoices that buy volume instead of judgment.

Two words carry four different operations

The vocabulary is the failure point. When an executive says “simplify this”, four different things can come back, and the language offers no way to tell them apart before the money is spent.

Simplification removes what is in the way and keeps what mattered. Reduction removes until the thing stops doing its job, and borrows the word simplification to describe the damage. Manufactured complexity adds weight that no requirement asked for, because weight reads as rigour and rigour justifies a price. Natural complexity is the part that was already hard before anyone touched it, and stays hard after every tool has been bought.

Four operations. Two words. Every organisation I have looked at owns a rich vocabulary for cost and almost none for this.

Reduction destroys substance and calls itself simplification

Reduction is always presented from the side of what remains. That is its signature and it is reliable.

A vendor demonstrates a workflow that used to take fifteen steps and now takes three. The three steps are real. What left the building is not discussed, because the person demonstrating does not know your business well enough to know what left. The export your accountant relied on, the record of who changed what, the ability to correct an entry after a close: none of those appear in a demonstration, because a demonstration shows capability, never absence.

The interesting part is that reduction is rarely dishonest. Nobody in the room lies. The failure is structural: no one at the table holds the mandate to name what disappears. Sales does not, because it sells what exists. The operational team does not, because it was not invited. The executive does not, because from that seat the missing capability has no visible shape.

John Gall, writing in 1975 in General Systemantics and again in the 1977 edition, made the observation that systems tend to fail in ways their designers did not anticipate, and that a system’s behaviour cannot be deduced from its specification. Reduction is that failure with a marketing layer on top. The specification says fewer steps. The behaviour says a capability is gone and someone will discover it on a bad day.

Manufactured complexity is a pricing strategy, not an engineering outcome

Manufactured complexity grows when you ask for a price and never when you ask for a result. That asymmetry is the whole tell.

A framing exercise runs six weeks before the first decision that changes anything. Three governance bodies exist where one would do. Forty slides carry six slides of content. None of this is incompetence, and reading it as incompetence is the mistake that keeps executives from acting on it. The volume is the product. The heaviness is what makes the invoice defensible, both to the buyer and to the buyer’s board.

The internal version is quieter and more durable. A team over-designs: three layers of abstraction for a requirement that has one shape, an architecture split into fourteen services for a product with three hundred users. Reading this as laziness is also wrong. It is insurance. Work that nobody else can understand cannot be handed to anybody else, which means the person holding it cannot be moved, questioned cheaply, or replaced. Manufactured complexity is a career strategy long before it is an architecture.

Larry Tesler’s law of conservation of complexity, formulated around 1984, says that the irreducible complexity of an application cannot be deleted, only moved between the user, the application developer, and the platform developer. Manufactured complexity is the inverse operation and it deserves its own name: complexity that was not there, created and then relocated onto the buyer, who now pays to carry it.

Natural complexity is irreducible and only yields to atomisation

Natural complexity does not respond to slogans, tools, or reorganisations, and pretending otherwise is more expensive than admitting it.

Thirty years of pricing rules, seven of which come from contracts nobody can reopen. Three enterprise systems that arrived with three acquisitions. A regulatory constraint that moves twice a year. None of that is a defect. It is the shape of the business, written down in software. Frederick Brooks named this in 1986 in No Silver Bullet, separating the difficulties inherent to the problem from the difficulties introduced by our tools, and arguing that the second category had already been largely harvested. Forty years later the accidental layer has been harvested several times over, and the essential layer is exactly where it was.

The only honest treatment is decomposition. Herbert Simon described in 1962, in The Architecture of Complexity, why this works: complex systems that survive tend to be near-decomposable, meaning interactions inside a subsystem are much stronger than interactions between subsystems. That property is what makes a hard system understandable at all. It is also what makes a hard problem tractable: break it into unit problems, each with an owner, a definition of done, and a date, and you get twelve small things you can stop individually instead of one large thing you can only abandon.

This is the test that separates real complexity from the manufactured kind, and it requires no technical skill to run. Ask for the decomposition. Real complexity accepts being cut into pieces, and some of those pieces will be ugly, and two or three will have no clean solution. Manufactured complexity resists, because it needs to stay whole to stay impressive. The refusal is the information.

Simplification is the rarest of the four because it requires knowing what things are for

Simplification costs more upfront than reduction and looks worse in a meeting, which is why it is the least practised of the four operations.

The removal is trivial. Knowing what can be removed is not. Most of what looks useless is used: by one person, once a quarter, for something nobody wrote down. Documentation does not help, because documentation describes intent and the question is about usage. The only reliable method is observation: who opens this, at what point in the month, and what do they do with the output.

An honest simplification produces a sentence its author is willing to sign before acting: here is what you lose, here is who it hurts, here is why we are doing it anyway. Reduction sold as simplification never writes that sentence. It does not need to lie. It only needs to leave the subject closed.

Case: the capability that had no name

What follows is a composite. The details are changed and no single organisation is being described. The mechanism is untouched, because the mechanism is the point, and I have watched it run more than once.

A distribution business, around a hundred and eighty people, four sites, roughly forty years old. Eleven tools in the operational stack, several of them older than half the staff. A consolidation programme is launched with a slogan that nobody could reasonably argue with: one system, one version of the truth. The business case is sound. The eleven tools genuinely cost more than they should, the reconciliation work between them genuinely consumed people, and the executive committee genuinely wanted the simplification. Every intention in this story is good. That is what makes it useful.

The old order-management system had grown a path over roughly fourteen years, added one patch at a time, that handled a specific situation: partial delivery with substitution and repricing. When a reference was short, the system would propose an equivalent from a different range, reprice the line according to a matrix of customer-specific rules, split the order, and keep the commitment date on the part that could ship. It was ugly. It had been built by three different people, none of whom were still there. It touched perhaps six per cent of order lines.

Those six per cent carried a disproportionate share of the margin, for a reason that never appeared in any document: they were how the business kept its largest customers supplied during shortages, which was how it kept those customers at all. Sales knew this in the way people know weather. Nobody had written it down, and more importantly, nobody had a name for it. No catalogue listed it as a feature. No process map carried it as a line. It was a behaviour of a system, understood by usage.

The requirements workshops for the new platform ran for nine weeks and were well conducted. Every documented process was mapped. Every named feature was assessed, scored, and either retained or dropped with a rationale. The substitution path was never assessed, because it was never named. It appeared in the workshop notes once, as “handles some special cases”, and moved to a backlog category that nobody revisited. The new platform handled partial delivery, which sounded close enough to anyone reading the summary. It did not handle substitution with repricing, and the vendor was never asked whether it could, because nobody in the room knew there was a question.

Go-live was declared a success, and by the criterion in the programme charter it was one: eleven tools became one, on schedule, within budget, with training completed. The criterion measured the transition, not the business.

The six per cent became manual within three weeks. First a spreadsheet maintained by one person in customer service, who reconstructed the substitution matrix from memory and from old order confirmations. Then a shared mailbox, because one person could not hold it. Then two people, then a third during quarter ends. Response time on shortage substitution went from same-day, handled by software, to two to four days, handled by humans with incomplete rules. Errors appeared: wrong equivalents proposed, prices applied from the wrong matrix, credit notes issued to fix them.

Fourteen months after go-live, someone finally counted. The manual handling of a capability the new system did not have was consuming more salary than the licence and maintenance cost of the tool it had replaced. That number was uncomfortable but it was not the real loss. The real loss was that the business had stopped being the supplier who solved shortages faster than its competitors, which had been its actual differentiator for two decades, and nobody had decided to stop being that. It had simply not survived a requirements workshop.

The post-mortem, when it happened, blamed the vendor selection, then the workshops, then change management. All three are wrong. The vendor sold what it had. The workshops did exactly what workshops do, which is assess named things. Change management managed the change that was described to it.

The failure was lexical. A capability with no name cannot be defended, because defending it requires someone to say the words out loud in a room where decisions are made, and there were no words. The programme did not make a bad trade-off between simplicity and capability. It never knew a trade-off was on the table, which is the difference between simplification and reduction, and the difference is entirely in whether anyone said what was being given up.

What a competent intervention looks like here is unglamorous. Before a consolidation programme opens its first workshop, someone spends three weeks not in documentation but in usage: which screens are opened, by whom, at what point in the month, and what happens to the output. Anything with no detectable usage across a full business cycle is a candidate for removal. Anything used rarely and by few people is exactly where the value hides, and gets named before it gets assessed. That work is slow, it produces no slide anyone enjoys presenting, and it is the difference between a programme that simplifies and a programme that reduces.

Organisations confuse the four because their vocabulary has only two words

The confusion comes from missing names, not from missing intelligence, and names are cheap to fix.

An executive team can distinguish gross margin from contribution margin without a finance degree, because someone once insisted the two words be used correctly and the distinction was enforced in meetings. No equivalent discipline exists for simplicity. Two counterfeits and two real conditions share two words, and the words are used interchangeably by vendors, by consultants, by internal teams, and by the executives buying from all three.

The consequence is predictable. Reduction gets approved because it is described as simplification and simplification is agreed to be good. Manufactured complexity gets approved because it is described as rigour and rigour is agreed to be responsible. Natural complexity gets refused, because admitting a problem is genuinely hard reads as an excuse, and the person who says it is asked to come back with a simpler plan. Real simplification gets refused too, because it costs three weeks of observation before anyone sees a result.

The two counterfeits are bought. The two real things are declined. That is what a missing vocabulary does.

The cost of the confusion is paid twice

Every organisation that cannot name the four operations pays once for the counterfeit and once again for the repair.

The first payment is visible on the invoice: a tool that dropped a capability, a framing exercise that produced volume, an architecture that needs two full-time people to stay upright. The second payment is invisible on any ledger: the manual workaround that grows a headcount at a time, the differentiator that was never decided away, the internal knowledge that walks out with the person who was holding the spreadsheet.

The second payment is always larger, and it is never attributed to the decision that caused it, because eighteen months have passed and the decision was declared a success at the time.

Naming the four is an executive skill, not a technical one

None of this requires an executive to understand a system. It requires an executive to hold four labels and insist that people use them.

Ask what you can no longer do after the change, and require the answer in writing. Ask for the decomposition, and watch whether it is refused. Ask for the short version, and watch whether the subject survives being short. Ask who uses the thing you are about to remove, and accept that the honest answer takes three weeks to obtain.

Four questions, four labels. The technical work belongs to someone else. The naming belongs to the person who signs, and it cannot be delegated to the party being paid.

Sources

Frederick P. Brooks Jr., No Silver Bullet: Essence and Accident in Software Engineering, 1986. https://worrydream.com/refs/Brooks_1986_-_No_Silver_Bullet.pdf
Larry Tesler, Law of Conservation of Complexity, c. 1984. https://www.nomodes.com/Larry_Tesler_Consulting/Complexity_Law.html
Herbert A. Simon, The Architecture of Complexity, 1962. https://faculty.sites.iastate.edu/tesfatsi/archive/tesfatsi/ArchitectureOfComplexity.HSimon1962.pdf
John Gall, Systemantics: How Systems Work and Especially How They Fail, 1977 (first edition 1975 as General Systemantics). https://archive.org/details/systemanticshows00gall
Laws of UX, Tesler’s Law. https://lawsofux.com/teslers-law/

The Chain Nobody Cut

2026-09-01T00:00:00+02:00

Blame is a mechanism, not a moral position. Asking who is responsible before you know what happened destroys the only material an organisation has to understand its own failure, because the people holding that material immediately start protecting themselves instead of describing what they saw. A serious failure never has a single cause: it has a chain of decisions, each defensible on its own, that nobody cut. The chain is the only object a leader can actually act on, and it becomes unreadable the moment a name is on the table.

Aviation separated investigation from judgment on purpose, and wrote it down

Air accident investigation is built on a rule that reads as generosity and is in fact a piece of engineering. The international framework governing these investigations sets a single objective for a safety investigation: prevention. It states that apportioning blame or liability is not the purpose of that activity. The French safety board says the same thing in its own words, describing its investigations as aimed solely at improving aviation safety, distinct from and without prejudice to any proceedings intended to establish faults or liabilities.

Two processes, two purposes, two sets of files. A court looks for someone responsible, which is a legitimate social need. An investigation looks for a cause, which is an operational need. They coexist, and they are kept apart.

The separation is not there to protect crews from consequences. It is there because the two objectives are technically incompatible in the same room at the same time. An investigator needs a pilot, a mechanic, a controller and a dispatcher to describe what they thought was happening, including the part where their reasoning was wrong. Nobody describes their own faulty reasoning to someone who can end their career with it. So the investigation is given a protected space, and the judicial process is given its own evidence to gather.

Companies do not have this luxury. In a company, the investigator and the judge are the same person, in the same office, often within the same hour. That is not a flaw to be fixed. It is the constraint to be managed, and almost nobody manages it explicitly.

An accident is a trajectory, not a decision

James Reason gave this shape a name in the British Medical Journal in 2000. His paper contrasts what he calls the person approach, which focuses on the unsafe acts of people at the sharp end and whose natural countermeasures are naming, blaming and shaming, with the system approach, which starts from the premise that humans are fallible and errors are to be expected even in the best organisations.

The image most people remember from his work is the layered one. An organisation is a series of defences. Each defence has holes. The holes are not fixed: they open and close with workload, staffing, deadlines, software versions, who happens to be on shift. An accident happens when the holes in every layer line up long enough for a trajectory to pass through all of them.

What matters in that model is not the picture. It is the consequence for anyone trying to learn from a failure.

If a failure requires alignment across several layers, then every single layer, taken alone, was working within its own definition of correct. That is why interviews after a serious incident produce the same sentence over and over: I did what I was asked to do. The sentence is not a defence. It is usually accurate. And it is exactly the sentence a blame-oriented process cannot process, so it gets treated as evasion.

Blame is expensive because it changes what people are willing to say

The cost of a blame reflex is never booked anywhere. It appears as an absence, and absences do not show up on dashboards.

Once responsibility has been assigned publicly one time, an organisation learns. What follows is not disengagement, which would at least be visible. It is defensive hygiene. People copy more colleagues on email. They ask for written confirmation of things that used to be settled standing up in a corridor. They timestamp. They write for the future reader who might be a lawyer rather than for the colleague who needs to act.

Each of those behaviours is individually rational. Together they add latency to every decision and remove the informal channel through which weak signals used to travel. The organisation becomes slower and blinder at the same time, and it experiences this as a process problem rather than as a consequence of how it handled one incident eighteen months earlier.

There is a second-order cost that is harder to talk about and easier to observe. The people who leave first, in an organisation that has learned to assign blame, are not the weakest ones. They are the ones with the clearest read on where the next incident is going to come from, because they are the ones for whom staying quiet is the most expensive thing psychologically. What remains is a team that is technically competent and structurally silent, and a leadership team that has no idea it is now flying on instruments that report only good news.

Sidney Dekker has spent a career on this trade-off. The argument in Just Culture: Balancing Safety and Accountability is not that nobody should ever be held to account. It is that accountability and learning pull in different directions, that the pull is real, and that most organisations resolve it implicitly, by reflex, without ever noticing they made a choice. In The Field Guide to Understanding Human Error, the same point is turned toward practice: human error is not an explanation, it is the thing that still needs explaining.

A data migration that lost fourteen months of history, reconstructed as a chain

Here is a failure I have seen in enough variations to treat it as a type rather than an anecdote. The details below are reconstructed and anonymised. No organisation is identifiable, and the point is the structure, not the story.

A company consolidates two customer databases after an internal reorganisation. The two systems came from two business units that used to operate separately. The consolidation is not a technical vanity project: a regulatory reporting obligation requires a single view of the customer base by a specific date, and that date is not negotiable.

Decision one. The executive committee approves the consolidation and fixes the go-live to land before the reporting date, with a small buffer. That is the correct call. The date is externally imposed. A leadership team that lets an internal migration slip past a regulatory deadline has failed at its actual job.

Decision two. During schema work, an engineer finds that roughly two per cent of records from the older system carry a legacy identifier format that the new schema cannot represent. These are the oldest customers, the ones with the longest history. He does exactly what he should: he documents it, quantifies it, and proposes a mapping table with an estimate of three weeks.

Decision three. The programme manager holds the deadline. Three weeks eats the buffer. She asks a reasonable question: can those records be migrated in a second pass, after go-live? The answer is yes, technically nothing prevents it. She decides on a second pass and records the decision. Given her mandate and the information she has, this is not a compromise. It is good programme management. The regulatory report does not depend on the two per cent.

Decision four. The second pass is entered in the project tracker as a follow-up task with an owner. Two months later, that owner moves to another role in a reorganisation that has nothing to do with this project. The task was in the tracker, not in anyone’s objectives, not in a service catalogue, not in a risk register. The project closes on time. Its tracker is archived, which is standard practice for a closed project and which any auditor would approve of.

Decision five. Post-go-live validation compares record counts between the old and the new system. The counts match. They match because the two per cent were written to a quarantine table during migration, and the reconciliation query counts every row present in the target environment. Nobody wrote that query in bad faith. It was written before the quarantine table existed as a concept, and counting everything that arrived is the intuitive definition of a successful migration.

Fourteen months later, a commercial dispute with one of those long-standing customers requires the transaction history that predates the reorganisation. It is not there. The quarantine table was dropped during a storage clean-up, executed under a documented retention rule, by someone who had no reason to grant it an exemption because nothing anywhere described it as holding production data.

Five decision points. Not one of them was wrong when it was taken. Five people could have cut the chain, and each of them was doing the thing their role rewards.

Now watch what the blame reflex produces here. It produces the engineer. He is the only person in the sequence who saw the problem, named it, and then let it go. That reading is satisfying, and it is the single most expensive conclusion available, because it teaches every engineer in the company that flagging a two per cent anomaly attaches your name to whatever happens next. The next anomaly will not be flagged. It will be worked around quietly, and the workaround will be undocumented, because documenting a workaround is documenting that you knew.

The chain reading produces something different. It produces five cut points, each with an answer that outlives the people involved. A deferred migration item does not survive in a project tracker, so deferred work with a data consequence needs a home that is not a tracker. A validation query that counts rows in the target environment answers the wrong question, so reconciliation has to compare against a business definition of the record, not against a row count. A retention rule applied to a table nobody classified will delete production data eventually, so classification is a precondition of retention, not a nice-to-have. A follow-up task with an owner and no objective is a task with no owner. And a project cannot close while it still holds an open data commitment, which is a governance rule, not an engineering one.

None of that is discoverable from a name. All of it is discoverable from a sequence.

High reliability organisations treat failure as data, not as misconduct

Karl Weick and Kathleen Sutcliffe studied organisations that operate in conditions where failure is catastrophic and yet failure is rare. In Managing the Unexpected: Sustained Performance in a Complex World, the pattern they describe is not heroic vigilance. It is a set of habits, and two of them are directly relevant to any company.

The first is preoccupation with failure, meaning that small anomalies are treated as information about the system rather than as noise to be filtered. The second is reluctance to simplify, meaning that convenient single-factor explanations are actively distrusted, because a simple explanation of a complex event is almost always a truncated one.

A single named culprit is the most convenient simplification available. It is also the one that ends inquiry fastest, which is precisely why it feels like resolution.

The software reliability world arrived at the same place from a different direction and gave it a name. The postmortem chapter in Google’s Site Reliability Engineering describes a blameless postmortem as one that identifies contributing causes without indicting any individual or team, and it states the working assumption plainly: everyone involved had good intentions and did the right thing with the information they had. The operational logic in that chapter is worth quoting in substance rather than in form, because it is the whole argument compressed: you cannot fix people, but you can fix the systems and processes that support people in making the right choices.

A blameless post-mortem is a discipline, not a mood

The most common failure mode of this idea is to treat it as a tone of voice. A meeting where everyone is polite and nobody says anything useful is not a blameless post-mortem. It is a blame-avoidant meeting, which is the same information loss with better manners.

The discipline has a few hard edges.

It starts with an assumption stated out loud before anything else: every person in this sequence acted correctly given what they knew at that moment. That assumption is not up for debate during the session. It is the axiom that makes the rest possible. What remains to be examined is far more interesting anyway: why did the available information lead to that decision.

It produces a dated sequence, not a narrative. Times, decisions, who knew what, what was written down and where. The output is a chain, with the cut points marked.

It separates the question of consequence in time. A leader who needs to sanction someone retains that right. Doing it during the reconstruction destroys the reconstruction. Doing it after means the decision is made by someone who now understands what happened, which tends to change the decision.

It also has a guest list, and the guest list is where most attempts die. A reconstruction attended by the person who signs the budget of everyone in the room is not a reconstruction. It does not matter how sincere that person is about wanting the truth: the people in the room are doing arithmetic about their own exposure, and they are right to. Either the sponsor stays out and receives the written sequence afterwards, or the sponsor comes in and accepts that what they will hear is the version that survives being heard by them. Both are workable. Pretending the choice does not exist is not.

And it is governed. A post-mortem practice that depends on the goodwill of whoever runs the meeting lasts exactly as long as that person. It needs a trigger threshold, a named owner of the practice rather than of the incident, a standard output format, and a rule about who reads it. Without those four things it will be applied to the incident that is politically safe and skipped on the one that matters.

What changes when a leader stops asking who

The habit is in the phrasing, and the phrasing is contagious. A leader who opens with who validated this has already told the room which process is running. A leader who opens with walk me through the sequence has told them something else, and the room adjusts within minutes. That is not a soft-skills observation. It is the highest-leverage change available, and it costs nothing.

What comes back is different in kind. Not a defence, a chain. And a chain has an uncomfortable property: it always passes through governance. The deferred item with no home, the validation that answered the wrong question, the ownership that evaporated in a reorganisation, the closed project with an open commitment. None of those belong to the engineer. They belong to whoever designed the system in which those things are normal.

Which is the real reason the question who is so attractive. It ends outside the leader. The chain does not.

A failure that produces a name teaches an organisation to hide. A failure that produces a sequence teaches it something it can use. Both are choices, and one of them is made every time by default, in the first twenty minutes, by whoever speaks first.

Sources

James Reason, Human error: models and management, BMJ, 2000, 320:768-770. https://www.bmj.com/content/320/7237/768
SKYbrary, Introduction to Accident Investigation (citing the sole objective of a safety investigation under ICAO Annex 13). https://skybrary.aero/articles/introduction-accident-investigation
Sidney Dekker, Just Culture: Balancing Safety and Accountability, 2nd edition, CRC Press, 2016. https://www.taylorfrancis.com/books/mono/10.4324/9781315251271/culture-sidney-dekker
Sidney Dekker, The Field Guide to Understanding Human Error, CRC Press, 2017. https://www.taylorfrancis.com/books/mono/10.1201/9781315239675/field-guide-understanding-human-error-sidney-dekker
Karl E. Weick and Kathleen M. Sutcliffe, Managing the Unexpected: Sustained Performance in a Complex World, 3rd edition, Wiley, 2015. https://pure.johnshopkins.edu/en/publications/managing-the-unexpected-sustained-performance-in-a-complex-world-/
John Lunney and Sue Lueder, Postmortem Culture: Learning from Failure, chapter 15 of Site Reliability Engineering, O’Reilly. https://sre.google/sre-book/postmortem-culture/
BEA (Bureau d’Enquêtes et d’Analyses), Our mission. https://bea.aero/en/the-bea/our-mission/

You Cannot Verify Your Own Interpreter

2026-08-25T00:00:00+02:00

A chief executive never receives information about his own technology. He receives a translation of it, produced by the people whose work that same information is used to judge. This is not a communication problem that better dashboards will solve. It is a governance problem, and the structural answer to it is a translator who works for him and for nobody else.

Every technology decision a chief executive makes is made on a translation

No chief executive reads the state of his own systems. He reads a rendering of that state: a slide, a status colour, a sentence in a steering committee, a paragraph in a board pack. Between the machine and the decision there is always at least one human act of translation, and often three or four stacked on top of each other.

This is not a failure. It is the only way a company of two hundred people can function. Nobody expects a chief executive to read logs, and a chief executive who reads logs is usually a chief executive who has stopped doing his job. The translation layer exists because it has to exist.

The problem starts one step later. The translation is produced by people who are inside the thing being translated. The engineering lead who tells you the platform is fine is also the person whose team would be blamed if it were not fine. The vendor who tells you the migration is necessary is also the vendor who invoices the migration. The head of product who reports amber instead of red is also the person who committed to the date in front of your board six months ago. None of these people is dishonest. All of them are translating with something at stake.

An interpreter with something at stake is still an interpreter. He simply is not a neutral one, and there is no version of the arrangement in which he becomes neutral because you asked him nicely.

The interpreter is the only person in the room you cannot audit

Sit in a negotiation conducted in a language you do not speak. You say a sentence. The interpreter turns and speaks. You watch the other party’s face, which tells you nothing, because a face does not translate. The other party answers. The interpreter turns back and gives you a version.

Everyone else in that room can be checked. You can check the contract afterwards. You can check the numbers with your own finance team. You can check the other party’s reputation with three phone calls. The interpreter is the single node in the entire circuit whose output you have no independent way of testing, and he is also the node through which every single piece of information travels.

That is a remarkable structural position for one person to hold, and it exists in your company right now. Not because anyone engineered it, but because information about technology travels along exactly one path: from the people who built the thing, to the people who manage those people, to you. Each hop is a translation. No hop has a second channel.

The interpreting profession understands this danger better than most corporate functions do. Professional interpreter bodies build their standards around impartiality and professional secrecy precisely because the interpreter’s position is unverifiable from the inside. AIIC, the international association of conference interpreters, maintains a code of professional ethics and a set of professional standards whose entire purpose is to compensate for the fact that the client cannot check the work in real time. The profession solved the trust problem with an external framework, because it could not be solved with goodwill.

Your technology reporting has no such framework. It has goodwill.

Smoothing is not lying, which is why nobody stops it

Ask any working interpreter what actually happens in the booth and you will hear a version of the same thing: some things get rounded. An aggressive sentence is delivered a little softer, because breaking the atmosphere is not in anyone’s interest. A vague conditional in one language has no clean equivalent in the other, so it becomes a yes or a no. A technical detail the interpreter did not follow is dropped, on the reasonable assumption that it was probably not the important part.

Every single one of those choices is helpful. That is the difficulty. Nobody involved has done anything wrong, and nobody involved could reasonably be asked to behave differently. The interpreter who refuses to smooth anything produces a conversation nobody can follow.

The same three moves happen in every technology report that reaches an executive committee. Severity gets softened, because a red status in month four has political consequences that a red status in month nine does not. Ambiguity gets resolved into a decision, because a chief executive who is told “it depends” three times stops asking. Detail that the reporter did not fully grasp gets dropped, because reporting something you do not understand is professionally risky, and dropping it costs nothing this month.

Individually, each of these is a rounding error. Stacked over two quarters, they produce a picture of the company’s technical reality that is not false in any single line and is wrong as a whole. And the person who discovers this last is always the person who does not speak the language.

Claude Shannon established in 1948 that a noisy channel can be made reliable only by adding redundancy: with a single pass and no second reading, the receiver has no way to separate the message from the error. Corporate reporting removed the redundancy on purpose, in the name of executive time. One channel, one summary, nothing to compare it against.

Four things a chief executive structurally cannot verify

Not “does not have time to verify”. Cannot. These four are unverifiable from the chief executive’s chair, by construction, regardless of how good he is.

Whether the risk he has been given is the risk that exists. A risk register is a translation of engineering anxiety into executive language. The conversion rate is set by the translator. When the same team reports a risk as moderate for four consecutive quarters and then the thing fails, nobody lied at any point: the word moderate simply meant something different inside the team than it meant on the slide.

Whether the option he was offered was the best option or the most comfortable one. Every technical recommendation that reaches a chief executive has already been filtered. Options that would have required admitting an earlier mistake, or that would have moved work away from the team proposing them, tend not to survive the filter. The chief executive sees three options and believes he is choosing. He is choosing among the survivors.

Whether the cost he is quoted includes the cost of the way it will actually be done. Estimates arrive as numbers, which look verifiable. They are not: they are a translation of a set of assumptions, and the assumptions do not travel with the number. The chief executive can audit the arithmetic and has no way to audit the assumptions, which is where the entire variance lives.

Whether what he decided is what got built. This is the one that hurts. A decision leaves the room as a sentence and arrives in the code as an interpretation of that sentence, made by people who were not in the room. Melvin Conway described the mechanism in Datamation in 1968: the structure of a system mirrors the structure of the organisation that produced it. The corollary is less quoted and more useful. If your organisation’s communication path to engineering has one lossy hop in it, your systems will encode that loss, permanently, in a form nobody can point at later.

These four are not the same problem four times. They are one problem: the chief executive holds the accountability for decisions whose inputs he is structurally prevented from testing. Kenneth Arrow described the general economics of this in 1963, in a paper about medical care of all things, and the mechanism transfers cleanly: when one party cannot evaluate the quality of what the other party is providing, the relationship stops being a transaction and becomes an act of faith. George Akerlof made the consequence explicit in 1970. Markets in which the buyer cannot verify quality do not merely become inefficient. They degrade, because the participants who benefit from opacity outlast the ones who do not.

A case: the migration that wrote its own business case

A company of roughly a hundred and forty people, profitable, growing at a rate that makes the board comfortable and the engineering team nervous. The platform is eight years old. It works. It is also, according to everyone who touches it, at the end of something.

In February the engineering leadership brings a proposal to the executive committee: migrate the core platform to a new architecture, eighteen months, a budget that is large but not absurd relative to revenue. The business case is well built. It contains a cost of inaction, a competitive argument, a hiring argument, and a risk section. Every number in it is defensible. The chief executive, who is not technical, reads it twice, asks four good questions, receives four good answers, and approves.

Here is what the business case is, structurally. It is a document written by the people who will execute the work, justifying the work, using information that only they hold, evaluated by someone who cannot check any of it. Every actor is honest. The document is still, in the strict sense, an interpreter speaking on behalf of both parties at once.

Look at what the translation does to each of the four arguments.

The cost of inaction is expressed as a probability of a serious incident rising over time. That probability is not measured, because it cannot be measured. It is an engineering intuition converted into a percentage, and the conversion happened in a room where the people converting it already believed the migration was necessary. The intuition may well be right. The number is not evidence, it is the intuition wearing the clothes of evidence.

The competitive argument says the current architecture prevents the company from shipping two features that customers are asking for. This is the part a chief executive feels most equipped to evaluate, and it is the part where the translation is most complete. In the engineering conversation, the actual sentence was closer to: those features are possible in the current architecture, but building them there is unpleasant, and the people capable of doing it do not want to. That is a legitimate constraint. It is a staffing and morale constraint, not an architectural one. Somewhere between the corridor and the slide, it changed category.

The hiring argument says the current stack makes recruitment harder. True, and unfalsifiable in the direction that matters. It is also the argument with the strongest personal alignment: the engineers proposing the migration would each become more employable on completion. Nobody says this, because it would be graceless, and because it is not the reason they believe the migration is right. It remains a fact about the incentive structure of the translation.

The risk section lists execution risks and rates them moderate. Not one of them is rated high. In a project of eighteen months touching the revenue-generating core of the business, that distribution is telling you something about the reporting culture rather than about the project.

Now the part that makes it a governance story rather than a story about a bad decision.

Month nine. Delivery is behind, in the way these things are behind: no single dramatic failure, a series of reasonable slips. The status reported to the executive committee has been amber for five months. Amber, in this company, means the team believes it can recover. It has meant that for five months, because the team has believed it for five months, and because the first person to say red will be the person who said it.

The chief executive asks the only question available to him: are we going to make it. He receives an honest answer from people who are exhausted and sincere: yes, if the next two sprints go well. The next two sprints do not go well. He asks again. Same answer, same sincerity.

At month fourteen the old platform is still running production and the new one is running eleven per cent of traffic. Both must now be maintained. The engineering team is split across two systems, which halves its throughput on everything else, which slows the migration further. This is the moment where the project stops being a project and becomes the company’s operating condition.

Nobody defrauded anybody. The chief executive made a defensible decision on the information he had, and re-made it a dozen times on the information he kept receiving. That is the point. There was no version of this in which better questions from him produced better answers, because every answer he got was a translation produced by the only people who could produce it, all of whom were inside the outcome.

What would have changed it is not a smarter chief executive. It is a second interpreter in the room at the February meeting: someone fluent in both languages, with no stake in the migration happening or not happening, whose entire function was to read the same business case and say which of the four arguments were architectural, which were about people, and which were about comfort. That conversation takes two weeks and costs a rounding error against eighteen months.

The company did not have that person. It had an excellent, honest, motivated engineering team, and a chief executive who trusted them, which is not a governance structure. It is a hope.

An independent translator is a control, not a comfort

In serious negotiation, each side brings its own interpreter. This is standard practice and it is not read as an insult. It is read as evidence that the parties are taking the conversation seriously.

The reason it works is not that two interpreters translate better than one. It is that each interpreter now knows he is being heard by someone competent. The mere presence of a second channel changes the behaviour of the first one, before anybody has corrected anything. This is the oldest control mechanism there is, and every mature governance function in a company already uses it. Jensen and Meckling gave it a name in 1976: monitoring cost, one of the three components of what it costs to have anyone act on your behalf. Monitoring is not what you pay because you suspect someone. It is what the arrangement costs, and refusing to pay it does not remove the cost, it defers it. An external auditor does not do the accounting better than the finance team. He makes the finance team’s account checkable. Nobody argues that hiring an auditor implies the chief financial officer is a liar.

Technology is the last executive domain where a company of two hundred people routinely operates with one unverifiable channel and calls it trust. The reasons are historical and mostly bad: technology was a cost centre for thirty years, it arrived in the executive committee late, and the vocabulary is hard enough that the people who hold it were able to keep it.

The independent translator’s job is narrow and worth being precise about. He does not decide. He does not manage. He does not replace the engineering leadership, and if he starts competing with it he has become a second interested party rather than a control. What he does is make the existing translation checkable: name what was rounded, restore what was dropped, say which recommendation is architectural and which is organisational, and tell the chief executive what he was not told, including the parts that are inconvenient for everyone including the translator.

The test of independence is simple and it is not about competence. Does this person’s income, career or reputation depend on the outcome of the decision he is translating? If yes, he is a party. If no, he is an interpreter. There is no third category, and no amount of integrity converts the first into the second.

You do not need to speak the language

The instinct, once you see the mechanism, is to try to learn the language. That instinct is wrong and expensive. A chief executive who spends a year becoming semi-technical arrives at a worse place than where he started: he now has enough vocabulary to be argued with, and not enough to win, which converts every technical conversation into a negotiation he is guaranteed to lose slowly.

The useful move is smaller. Stop asking whether you understand the technology. Start asking who translates it, and on whose behalf.

That question has answers. Who wrote the document I am deciding on. What would have had to be true for a different recommendation to reach me. Which of these arguments would still hold if the person making it had nothing to gain. Who in this building is paid to tell me the thing nobody wants to say, and if the answer is nobody, that is not a personality gap in my team, it is a hole in the structure.

A chief executive does not need to speak the language of his own systems. He needs an interpreter he can trust, which means one whose interests do not sit on either side of the table. Until that person exists, every technology decision he signs is a decision made on a translation he cannot read, and the accountability for it is his alone.

What you cannot verify governs you. That is true whether or not you have noticed it.

Sources

Kenneth J. Arrow, Uncertainty and the Welfare Economics of Medical Care, The American Economic Review, 1963. https://www.jstor.org/stable/1812044
George A. Akerlof, The Market for “Lemons”: Quality Uncertainty and the Market Mechanism, The Quarterly Journal of Economics, 1970. https://www.jstor.org/stable/1879431
Michael C. Jensen and William H. Meckling, Theory of the Firm: Managerial Behavior, Agency Costs and Ownership Structure, Journal of Financial Economics, 1976. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=94043
Melvin E. Conway, How Do Committees Invent?, Datamation, 1968. https://www.melconway.com/Home/Committees_Paper.html
Claude E. Shannon, A Mathematical Theory of Communication, The Bell System Technical Journal, 1948. https://people.math.harvard.edu/~ctm/home/text/others/shannon/entropy/entropy.pdf
AIIC, Basic Texts: Code of Professional Ethics and Professional Standards. https://aiic.org/site/about-us/basic_texts

Your Hiring Process Is a Filter Against Your Own Blind Spot

2026-08-18T00:00:00+02:00

Companies do not accidentally lose the people who would have spotted the failure in their information system. They filter them out on purpose, using recruitment and performance processes they are proud of. The traits that make someone hard to sit in a meeting with, refusing to close a subject, following a decision down to its fourth consequence, hearing what nobody said out loud, are the same traits that detect low probability, high cost failure modes years before a dashboard does. An executive who wants fewer surprises in his systems has to look at who his organisation finds exhausting, and why that person stopped speaking.

Organisations do not select for insight, they select for low friction

Every hiring process optimises for something. Very few optimise for what they claim.

Ask a management team what it recruits for and you will hear competence, ownership, culture. Watch the same team decide, and the actual criterion surfaces fast: how easy will this person be to work with, week after week, in a room where twelve subjects have to be closed before lunch.

That criterion is not stupid. An organisation that cannot close subjects does not ship. Friction has a real cost, paid daily, visible to everyone. The cost of the opposite failure, closing a subject that was not resolved, is paid once, later, by someone else, often by a successor.

Lauren Rivera documented the mechanism in elite professional service firms. Evaluators consistently favoured candidates who felt culturally familiar, and constructed their definition of merit around that familiarity. They were not lying about wanting the best. They genuinely could not separate “best” from “reads like us”.

The output is an organisation with a narrow band of cognitive style. Everyone in the room processes information roughly the same way, at roughly the same speed, with roughly the same tolerance for open questions. Meetings get shorter. Alignment gets easier. Risk detection gets worse, because risk detection is a minority function. It requires someone who is willing to be the only person still talking about a subject the room has already agreed to leave.

Cass Sunstein and Reid Hastie described what happens to groups when that person is absent or silent. Errors get amplified instead of corrected. Early speakers set the direction. Information held by a single member never reaches the table. A group of intelligent people reliably produces a decision worse than its best member would have produced alone.

None of this is a diversity argument in the moral sense. It is a detection argument. A system that filters for low friction is a system that has removed its own alarm.

The traits an organisation corrects are the traits that read a system

Look at what actually goes into performance reviews.

Goes off on tangents. Struggles to prioritise. Gets stuck on details. Overthinks. Too direct. Reads too much into things. Does not switch off.

Now look at what an information system failure actually requires, in order to be seen before it costs money.

Going off on tangents means walking the consequence tree of a decision past the point where the vendor’s demo stops. Getting stuck on details means refusing to accept “it restarted, it is fine” as an explanation of why a service stopped. Reading too much into things means noticing that the project manager has stopped escalating, which has never meant everything is fine. Not switching off means covering ground on a Sunday that nobody covered in three years of steering committees.

The overlap is not partial. It is close to total. Every trait a company spends money correcting is a trait that, pointed at a system, produces early detection.

This is where most writing on the subject goes wrong. It turns into a celebration, a claim that unusual minds are better, a request for recognition. That framing is useless to an executive, and it is not the point. The point is narrower and colder: a company that trains this behaviour out of its people has traded a permanent detection capability for a modest gain in meeting comfort, without ever putting the trade on a slide.

Robert Austin and Gary Pisano made a version of the same argument in Harvard Business Review, and it is worth reading for the operational detail. Their case is that standard hiring processes screen out capabilities the firm actually needs, then the firm pays consultants for those capabilities later. The screening is not malicious. It is procedural, and it is invisible from the inside.

The filter operates in four moments, and none of them looks like a filter

Executives who accept the argument in principle usually reject it in practice, because they cannot see where the filtering happens. Nobody in their company has ever written “reject candidates who ask too many questions” in a hiring guideline. The filter is real anyway. It operates in four moments, and each one is defensible on its own.

The first is the screening call. A recruiter with fifteen candidates and forty minutes each is measuring one thing above all others: is this conversation smooth. A candidate who answers a question with a better question, or who needs to understand the business before answering a technical one, is producing friction at the exact moment friction is most expensive to the recruiter. That candidate does not fail. He is simply not moved forward, which is a different thing and leaves no trace.

The second is the probation period. New arrivals who ask about things outside their remit in their first three months are read as either promising or presumptuous, and the reading depends almost entirely on how confident their manager is. An insecure manager experiences the same behaviour as a challenge to authority. Nothing in the process distinguishes the two interpretations, and the outcome is recorded as a fit issue.

The third is the annual review, which is where most of the damage happens, precisely because it is the moment everybody trusts. The vocabulary is developmental. Learn to prioritise. Work on your executive presence. Pick your battles. Every one of those sentences is well intentioned, most are individually reasonable, and their aggregate effect over three years is a person who has learned to stop mentioning things.

The fourth is promotion. Organisations promote people who make the level above comfortable. It is not a conspiracy, it is a preference expressed under time pressure by humans who will have to work with the result. The consequence is that the further you go up the structure, the fewer people you will meet whose instinct is to reopen a closed subject, which is another way of saying that your detection capability decreases with seniority exactly where your decision stakes increase.

Four moments, four defensible decisions, one outcome. Your organisation has removed its ability to see what you cannot see, and it did so using processes you would defend in front of a board.

The only way to notice from the top floor is by absence. Nothing gets flagged. Nothing appears on a risk register. You simply stop receiving a category of information, and you cannot miss what never arrives.

The Post Office spent two decades proving that the system was never questioned by anyone the organisation could hear

The clearest case I know of an organisation destroying its own detection capability is the Horizon scandal in the United Kingdom.

Horizon is the accounting and point of sale system supplied by Fujitsu and deployed across Post Office branches from 1999. Sub-postmasters, the people who actually run those branches, began reporting shortfalls they could not explain. Money that the system said was missing, that they had not taken, that appeared and reappeared across branches with no common cause.

The Post Office response, sustained over roughly two decades, was that the system was reliable and the sub-postmasters were not. More than 900 people were prosecuted for theft, fraud or false accounting on the strength of Horizon data. People went to prison. People lost homes. Some died before their convictions were overturned.

Read the structure of that failure rather than its scale, because the structure is what repeats.

The organisation had a large population of front line users reporting a consistent, reproducible anomaly. That is, in engineering terms, an excellent signal. Hundreds of independent observers, same symptom, different geographies, no coordination between them. Any system owner receiving that pattern should treat it as the highest quality bug report available.

The organisation reclassified it. The signal became a personnel problem: dishonest or incompetent postmasters. Once that classification was made, every further report confirmed it. More reports meant more dishonest postmasters, never a more probable defect. The reclassification was self sealing.

Inside the organisation, the people who could have broken the seal were exactly the people whose input was structurally hard to hear. Raising it required going off topic, questioning a system the board had already declared sound, and doing so repeatedly, against colleagues who had a professional interest in the subject staying closed. It required, in short, every behaviour a well run corporate performance process discourages.

The English High Court found in 2019 that Horizon contained bugs, errors and defects, and that remote access to branch accounts had been possible, contrary to what had been asserted for years. A statutory public inquiry chaired by Sir Wyn Williams has since spent years reconstructing how an organisation reached that state and stayed there.

What matters for an executive reading this is not the legal outcome. It is the timeline. The information required to prevent the entire disaster existed inside the organisation from the early years. It was not missing. It was present, repeated, and structurally unhearable, because hearing it meant reopening a subject that senior people had closed, and because the individuals inclined to keep reopening it had either been managed out, moved on, or learned what happens to people who do that.

Nothing about Horizon required exceptional insight. It required someone with the standing to be exhausting, and a room willing to sit through it.

Every company I look at has a smaller version of this. Not with the same human cost, and rarely with the same duration. Same shape. A recurring anomaly that has been explained away often enough that the explanation has become the official account. A vendor whose reassurances are accepted because reopening the question implies the original decision was wrong. A team whose warnings arrive in a format the executive committee does not process, and stop arriving after a while.

The organisation is not lying to its CEO. It has simply optimised itself into a state where the truth about its systems has no route to the top floor.

Cultural fit is a technical risk, not an HR preference

Executives treat hiring style as a people topic, delegated to HR, reviewed once a year. It belongs on the risk register.

When you standardise the cognitive profile of everyone who touches your critical systems, you have made an architecture decision. You have decided that your detection layer will be composed entirely of people who process the world the same way, which means they will miss the same things, in the same direction, at the same time. Correlated sensors. Any engineer would flag that design.

Katherine Phillips summarised the research on the mechanism in Scientific American: groups that contain genuine difference prepare more carefully, examine facts harder, and reach better conclusions, while reporting that the experience felt worse. Homogeneous groups report smoother meetings and produce weaker decisions. The subjective signal is inverted relative to the actual quality of the output.

That inversion is the whole trap. Your comfort in the room is anti correlated with the quality of the scrutiny in the room. If your steering committee feels easy, that is information, and it is not good news.

Charles Perrow’s work on complex systems, and Diane Vaughan’s reconstruction of the Challenger launch decision, both land on a related point from a different direction. Catastrophic outcomes in tightly coupled systems rarely come from a single dramatic error. They come from an accumulation of small deviations, each individually justified, each accepted because the last one was accepted. Vaughan called it the normalisation of deviance. Stopping that accumulation requires someone whose reaction to “we have always done it that way and it has been fine” is to ask why, again, for the fifth time.

That person is expensive to manage and cheap to ignore. Ignoring them costs nothing today.

What this actually costs, in money you already recognise

Abstractions do not move executives. Invoices do.

The unexplained infrastructure budget increase, where nobody can name the decision that caused it, is a consequence tree that was never walked. Somebody chose a product, the demo covered the first branch, and the cost of the sixth branch arrives eighteen months later as a line item with no owner.

The migration that slipped by two quarters was visible in team behaviour before it was visible in the plan. Somebody heard it. That person either did not have a route to you, or had learned that using it produced friction and no result.

The vendor you cannot leave was a reversibility clause that nobody read closely, because reading it closely meant slowing down a deal the whole room wanted to close.

The outage on a component nobody knew was critical was documented, once, by someone who was told the subject was resolved.

Each of these has the same root. Not incompetence. Not bad luck. A detection function that was removed because it was uncomfortable, and an executive who never saw the removal happen, because it happened in performance reviews and hiring loops, one polite conversation at a time.

What a CEO can change without hiring anybody

The useful part of this argument is that it does not require a recruitment programme.

Start by finding out who in your organisation used to raise things and stopped. Not who complains. Who used to, and no longer does. That transition is recorded in the memory of every team, and it is not in any of your systems. The people who went quiet are your decommissioned sensors.

Then look at your last three significant technical decisions and ask a single question about each: who in the room was allowed to be tiresome, and for how long. If the honest answer is nobody, or five minutes, you did not make a decision. You ratified a proposal.

Then check what happens to a disagreement in your organisation when it survives past the first meeting. In healthy structures it escalates and gets arbitrated. In most structures it dies quietly, and the person who raised it learns something about the cost of raising things.

Amy Edmondson’s work on psychological safety is the academic version of this, and it is worth noting that her finding is not about being nice. It is about whether interpersonal risk taking is survivable, because learning behaviour depends on it. A team that cannot survive its own dissent cannot detect its own failures.

None of this requires a budget line. It requires an executive willing to be told things that make the week longer.

The uncomfortable person is the control you removed

There is a version of this article that ends as an appeal for tolerance. That version is worthless to you.

Here is the useful ending instead.

Your information system will fail in a way you did not anticipate. Not maybe. The only variables are when, how expensive, and whether anyone saw it coming and could not get through.

The probability that someone saw it coming is high. Organisations rarely fail from a total absence of information. They fail from information that had no route.

The traits that produce that information, the tangents, the stubbornness, the register switching, the reading of what was not said, the mind that does not stop at 18h, are traits your processes are actively grinding down right now, in good faith, with the language of professional development. Every one of those conversations is a small, deliberate, well intentioned reduction of your own visibility.

You do not have to like the person. You do not have to promote them. You have to know where they are, and make sure that when they say the subject is not closed, the sentence reaches you before the invoice does.

Sources

Lauren A. Rivera, Hiring as Cultural Matching: The Case of Elite Professional Service Firms, American Sociological Review 77(6), 2012. https://journals.sagepub.com/doi/10.1177/0003122412463213
Robert D. Austin and Gary P. Pisano, Neurodiversity as a Competitive Advantage, Harvard Business Review, May 2017. https://hbr.org/2017/05/neurodiversity-as-a-competitive-advantage
Cass R. Sunstein and Reid Hastie, Making Dumb Groups Smarter, Harvard Business Review, December 2014. https://hbr.org/2014/12/making-dumb-groups-smarter
Katherine W. Phillips, How Diversity Makes Us Smarter, Scientific American, October 2014. https://www.scientificamerican.com/article/how-diversity-makes-us-smarter/
Diane Vaughan, The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA, University of Chicago Press, enlarged edition 2016. https://press.uchicago.edu/ucp/books/book/chicago/C/bo22781921.html
Post Office Horizon IT Inquiry, chaired by Sir Wyn Williams, official inquiry site. https://www.postofficehorizoninquiry.org.uk/

Permission Not to Decide: The Quiet Technology of Diluted Responsibility

2026-08-11T00:00:00+02:00

A process is not only a way to get things done. It is also a social technology, and one of its quiet functions is to spread responsibility so thin that no single person has to decide anything, or answer for the result. The more hands a decision passes through, the less any hand owns it. That is not a flaw most organisations are trying to fix. For many of them, without ever saying so out loud, it is the reason the process exists.

A process is a machine for spreading responsibility thin

Every process distributes a decision across more people than the decision needs. That is what a process is for, on paper: no single point of failure, no lone cowboy, no unchecked call. In practice, the same design has a second effect that nobody prints in the handbook. When a decision belongs to five people, it belongs to no one.

Psychologists gave this a name a long time ago. In 1968, John Darley and Bibb Latané described the diffusion of responsibility: the more witnesses are present, the less any one of them feels obliged to act. Each assumes someone else will, or already has. The effect is strongest precisely when the group is largest, which is the opposite of what common sense predicts.

An organisation is a permanent crowd. A process is the crowd written down. Every approval step, every “consulted party,” every sign-off adds a witness to the decision and subtracts a fraction of ownership from each of them. Albert Bandura made the point sharper: when work is cut into subtasks, people focus on their piece and quietly forget the whole. The division of labour is also a division of conscience.

None of this requires bad people. It requires only a structure in which no individual is the person the outcome lands on. Give me a slow, evasive organisation and I will rarely find laziness. I will find a process that lets everyone be blameless while nothing moves.

There is a small, almost comic piece of evidence for this. Researchers who study how people answer requests have found that the same message gets a longer, more useful reply when it is sent to one named person than when it is sent to a group, even a small one. Address a crowd and each member quietly assumes someone else will take it. Address a person and the excuse disappears. An organisation runs on the first kind of message far more than it likes to admit. Most of its procedure is, in the end, a way of speaking to the group instead of to a person.

“Check with the relevant team” is where decisions go to die

There is a sentence you hear in every organisation, and it always means the same thing. “You will need to check with the relevant team.” On its face, it is diligence: route the question to the people who know. Nine times out of ten, it is deferral wearing the costume of rigour.

The relevant team, once you reach it, tends to point you at another relevant team. That one is relevant too. The decision, meanwhile, is relevant to no one. Everyone in the chain has technically done their job. They forwarded, they escalated, they looped in. Not one of them decided.

David Graeber, in The Utopia of Rules (2015), described bureaucracy as the water we have stopped noticing we swim in. His argument was not that rules are useless. It was that we have come to treat procedure as a form of intelligence, when often it is a way to avoid the discomfort of a judgment call. A rule you can hide behind is more valuable, to the person hiding, than a rule that works.

The tell is simple. Ask who can say yes. In a healthy structure, someone can, and they know it. In a sick one, the honest answer is a shrug and a redirection. The process has become a maze with no room marked “decision.” You can route a person around that maze for months. You can route a whole company around it for years.

It helps to separate two kinds of rule. One kind exists to make a good decision easier: it strips out noise, it guards against the obvious mistake, it lets a busy person act without reinventing the basics every time. The other kind exists to make a decision optional: it adds a step whose real function is to give everyone a reason to wait. On a slide they look identical. You can tell them apart with a single question. Does this rule end in someone deciding, or does it end in someone being consulted? A rule that always ends in consultation is not governance. It is a waiting room with better furniture.

A ceiling always turns into a floor

Give someone a maximum and they will treat it as a target. Tell a supplier “three weeks at the most” and you have not set a limit. You have set an expectation, and it is the wrong one. You meant the latest acceptable date. They heard the date they are allowed to aim for.

Cyril Northcote Parkinson put the mechanism in print in 1955, in a satirical essay that turned out to be one of the most durable observations in management: work expands so as to fill the time available for its completion. Offer three weeks, the work takes three weeks. Offer six, it takes six. The size of the container decides the size of the contents.

Eliyahu Goldratt described the human engine behind it in Critical Chain (1997), under the name student syndrome. People start a task at the last responsible moment, then compress all the real effort into the final stretch before the deadline. Any safety margin you built into the estimate is spent before the work even begins. So the maximum is not just reached. It is reached with no slack left, which means the first surprise pushes it past the line.

This is why padding estimates makes projects later, not safer. Every buffer you add is read as permission, consumed early, and gone when you need it. The ceiling you set to protect yourself becomes the floor everyone builds on. Then the floor gives way.

The steering committee that decided nothing

I once watched a company try to fix slow decisions by building a machine for making them. It is the clearest case I know of a process quietly doing the opposite of its stated job, so it is worth telling slowly.

The company was scaling. It had grown from a room of people who all knew each other into several floors of people who did not. Decisions that used to happen in a corridor now took weeks, and leadership felt it. The diagnosis, reasonable on its face, was that the organisation lacked structure. So they built some. A weekly steering committee for anything that crossed team lines. A responsibility matrix, the familiar grid of Responsible, Accountable, Consulted, Informed, filled in for every significant initiative.

On paper it was textbook. In the room it was a beautifully lit dead end. The committee met every week. Minutes were taken. Actions were “assigned.” And almost nothing was decided, because the design had made deciding optional. Everyone at the table was Consulted, which meant everyone had a right to an opinion and no obligation to a conclusion. The “Accountable” letter sat in a cell on a spreadsheet, attached to a role rather than to a human being who could feel it in their stomach on a Sunday night.

Here is the part my brain would not let go of. The more thorough the structure looked, the less anyone owned. Each week, a hard question would arrive. It would be discussed, genuinely and intelligently, by people who were not stupid and not lazy. And then it would be parked: pending more input, pending another team, pending the next session. The grid gave everyone a place to stand where the decision was always someone else’s line item.

The clearest moment came in one of those weekly sessions. Someone finally asked the plain question: who actually owns this, as a person, not as a box on a grid. The room went quiet in a very particular way. Not hostile. Genuinely puzzled. Three people could each explain which part of it touched their team. Not one could say the words this is mine. The letter that marked the accountable party pointed at a role that, in practice, no single human occupied. Everyone had assumed the structure contained an owner somewhere, the way you assume a building has a night watchman you have never met. It did not. The owner was a cell in a spreadsheet, and a cell does not lie awake on a Sunday night.

I keep seeing the same shape in places that have nothing to do with each other. A person waits all day for a delivery that never comes, calls three numbers, and is told by each that it is not their part. A board spends an hour on a decision and adjourns without making it. A committee reviews a plan for the fourth time. Different rooms, identical physics. When responsibility is spread across enough surfaces, it stops resting on any of them. I do not experience this as a metaphor. I experience it as the same event happening in different costumes, and I cannot switch off the recognition.

What broke the loop was not a better matrix. It was one sentence, said out loud by the CEO in the room: “This one is mine. I will decide it by Thursday, and you can hold me to that.” Nothing else about the process changed that week. The committee still met. The grid still existed. But a single decision now had a single human attached to it, with a date and a witness, and it moved. The lesson was not that structure is bad. It was that structure had been used, without anyone intending it, as a way to make sure no one ever had to say “mine.”

The people a delay does not touch will always set the pace

A delay only accelerates for the person it lands on. This is the mechanism that explains most stuck projects better than any story about skill or motivation, and it is the one leaders are slowest to name, because naming it sounds like an accusation.

It is not. Consider the honest position of someone who is blocking your project without malice. The delay does not reach them. It reaches the next team, the end client, the leader who has to report upward. Their own week is full of things that do reach them. So they are not dragging their feet on purpose. They are simply, rationally, somewhere else. You are urgent to you. You are background noise to them.

Maximilien Ringelmann measured a version of this in 1913, pulling on ropes. He found that as you add people to a group, the effort each person contributes goes down, not up. Part of it is coordination, but part of it is motivation: in a crowd, individual effort becomes invisible, so it quietly shrinks. Add a second condition, that the consequences of slowness fall on someone else entirely, and the effort does not just shrink. It evaporates, cheerfully and with a clear conscience.

You cannot fix this with more meetings, because meetings do not change who the delay touches. You fix it by changing the incidence: by making sure the person setting the pace is also a person the outcome reaches.

Changing the incidence is unglamorous and specific. It can mean that the person who owns the deadline is the one who has to stand in front of the client if it slips, rather than a colleague two doors down. It can mean that the team causing the wait is made to feel the wait, instead of exporting it cleanly to the team next door. You are not making anyone work harder through willpower. You are moving the consequence back to where the choice is made. Effort follows consequence. It almost always has.

Naming a single owner is the only fix that works

The cure for diluted responsibility is not more process. It is a name. Not a role, not a committee, not a box on a chart. A specific person who can decide, who knows the outcome is theirs, and who can be seen carrying it.

Ringelmann’s own experiments point straight at the remedy. Effort recovers when contribution becomes identifiable, when the group is small enough that each member is visibly indispensable, and when the goal is explicit rather than vague. Every one of those is a way of undoing anonymity. A named owner is anonymity’s opposite. The moment a decision has one person’s name on it, the diffusion collapses, because there is no longer a crowd to hide inside.

This is unglamorous work. It is not a transformation programme. Most of the time it is the reverse: removing the layer of procedure that let everyone be a little bit responsible, and replacing it with one line that says who answers for the result. Organisations resist it, not because they disagree, but because a named owner is exposed, and exposure is exactly what the process was quietly protecting people from.

The opposite of process is not chaos. It is a name

People defend process as the only thing standing between them and chaos. It is a false choice, and it is worth refusing. The opposite of a process that decides nothing is not a free-for-all. It is a person who can decide, and who answers for it.

Think of the one who commissions a building. The mason answers for the wall. The electrician answers for the wiring. Each is faultless on their own stretch, and the building is late anyway, because no trade answers for the building. Only the client does. They are the single party for whom the whole thing exists as one object rather than a set of parts.

Every organisation needs that person for every outcome that matters. Not a committee that owns the building. A name. The test is not whether your process is thorough. Thorough is easy. The test is whether, for anything that matters, you can point at one human being who answers for the whole, and who has more than their voice to make it happen. If you cannot, you do not have a governance problem. You have a very well documented way of never deciding anything.

I am not against process. I have built plenty of it, and I will build more. What I am against is the quiet substitution: the day a process stops helping people decide and starts standing in for the decision itself. That substitution never announces itself. It arrives dressed as diligence, as maturity, as the thing a serious company is supposed to do as it grows. Which is exactly why someone has to keep asking the rude question out loud, about every outcome that matters. Who answers for this. Not which team. Who.

Sources

John M. Darley, Bibb Latané, Bystander Intervention in Emergencies: Diffusion of Responsibility, 1968: https://en.wikipedia.org/wiki/Diffusion_of_responsibility
C. Northcote Parkinson, Parkinson’s Law, 1955: https://en.wikipedia.org/wiki/Parkinson%27s_law
David Graeber, The Utopia of Rules: On Technology, Stupidity, and the Secret Joys of Bureaucracy, 2015: https://en.wikipedia.org/wiki/The_Utopia_of_Rules
Maximilien Ringelmann, Recherches sur les moteurs animés (Ringelmann effect), 1913: https://en.wikipedia.org/wiki/Ringelmann_effect
Eliyahu M. Goldratt, Critical Chain (student syndrome), 1997: https://en.wikipedia.org/wiki/Student_syndrome

Sovereignty Is Not a Slogan, It's a Four-Question Test

2026-08-04T00:00:00+02:00

Sovereignty in technology is one of the most used and least defined words in a boardroom. It fills speeches, tenders, and vendor decks. It rarely reaches a contract. The honest version is narrow and testable. Sovereignty is a set of four written answers about any supplier your business cannot live without. When the answers are missing, sovereignty does not exist. What exists is a comfortable relationship that lasts exactly as long as it suits the other side.

Sovereignty is a test, not a posture

Most conversations about sovereignty stay at altitude. National clouds, strategic autonomy, data borders. Useful debates, and far too abstract for a leader who has to decide something on Tuesday.

Bring it down to the ground. Sovereignty, at the level where a company actually lives or dies, means one thing. Can you keep operating, and keep control of what matters, when a supplier changes its mind. That is it. Everything else is commentary.

A posture is a statement you make about yourself. A test is a question reality asks you. The difference shows up the day a supplier raises its price, changes its terms, gets acquired, or simply has a bad week. A posture collapses that day. A test you passed in advance holds.

So the useful question is never whether you feel sovereign. It is whether you would pass the test if someone ran it on you tomorrow.

Four questions decide who is in control

I use the same four questions on every critical supplier. They are deliberately concrete, because sovereignty dies in abstraction and survives in specifics.

Who decides when an update ships to your systems. You, on your schedule, or the vendor, unilaterally, on a random morning, with no warning.

Who holds the encryption key to your data. You, or the vendor, which means the vendor can technically read everything you store.

Can you cut the service yourself, cleanly, without depending on the vendor’s goodwill or notice period. A switch you cannot reach is not a switch you own.

What happens to your access the day the vendor is acquired. By a competitor, by a fund, by an actor under another jurisdiction with other rules.

Four questions. If the answers are not written into the relationship, you are not sovereign over that supplier. You are trusting. Trust is a fine fuel for a partnership. It is not a guarantee, and it should never be mistaken for one.

A rule written into the architecture does not get argued in meetings

Answering the four questions is step one. Making the answers stick is the harder part, and this is where most sovereignty efforts quietly fail. They live in a policy. Policies decay.

Leo Casagrande framed a useful idea under the name framework by design. A rule that matters belongs in the infrastructure, not in a charter. It gets encoded to the point where doing the wrong thing is no longer an option. The constraint lives in the wall, not in the wiki.

Apply that to connectivity and sovereignty together. You can write we value high availability and reversibility in a policy. No one reads it on the day it matters. Or you build it in. Two carriers instead of one. Multi-factor authentication imposed on everyone by the system itself. A recovery plan that has actually been tested, not filed. Data you have already proven you can extract, in a usable format, within a day.

Casagrande has a line I keep. The framework has won when you no longer need to enforce it. A sovereign architecture is exactly that. You pay the cost once, at design time, and after that the constraint works for you while you sleep. A policy asks for discipline every single day. A wall asks for nothing.

The missing mandate is the right to say no

There is a second discipline, and it is human, not technical. In conversations with other practitioners, the same pattern keeps surfacing. Organizations hand out plenty of mandates to execute. Almost none to contradict.

Think about your own company. Who has the written authority to block a signature that creates lock-in with no priced exit. Not to advise against it. Not to add a cautious note to the file. To stop it. In most organizations that authority sits nowhere. An architect can warn. A security lead can flag. The decision then travels upward, toward people with neither the time nor the detail to see the trap close.

This matters because reversibility looks like a technical question and behaves like a political one. The ability to leave a vendor, to recover your data, to switch off a service, is negotiated before you sign, or it is not negotiated at all. After signing, you no longer negotiate. You ask. And asking is a much weaker position than deciding.

Giving someone a real mandate to contradict, in the cold, before the ink dries, is the cheapest insurance a company can buy against the dependencies it signs without seeing.

What sovereignty looks like on an ordinary Tuesday

Sovereignty is not dramatic. It does not look like independence or a fortress. On a normal Tuesday, in a sovereign company, a vendor pushes an update and it lands when the company allowed it to. The data sits somewhere the company can point to and retrieve. A contract comes up for renewal and leaving is a real option, which is precisely why the price stays honest. Someone in the building has the mandate to look at all of this and the right to say no.

None of that requires heroics. It requires four written answers, a few constraints built into the architecture instead of a charter, and one named person allowed to contradict. Sovereignty stops being a slogan the moment those three things exist, and stays a slogan every day they do not.

The Paradox of Always-On Business

2026-07-28T00:00:00+02:00

A modern company runs on one silent assumption. The connection will be there. It almost always is. That word, almost, is where the risk lives, and no one has ever put a number on it. The day the line cuts, signing a document, releasing a payment, reaching a colleague, opening a file, all of it stops at the same moment. The outage is only the symptom. The real exposure is that no one on the org chart holds a written mandate to define what must remain possible when the line is gone.

Two cities, one symptom

In Libreville, the line dropped without warning. A video call froze mid-sentence. A file refused to upload. You relaunch, you switch to the phone, you make do. The work slows to the speed of the weakest link, and the weakest link is invisible.

Back in France, the same symptom in a different costume. A throttled connection, throughput collapsing at the wrong hours, a working day that stalls out of nowhere. Two settings with nothing in common. One shared result.

The outage passes fast. What it exposes stays. Everything I had to handle that day hung on a single thing. The line. Not the laptop, not the team, not the plan. The line. When it went, competence and goodwill counted for nothing. The company was present and unable to act.

That is the paradox. We have never been more capable and never more fragile at the same point. The capability is real. The fragility sits under it, unmeasured, until one bad hour makes it visible.

The four dependencies no one audits while things work

When a business is running well, leaders watch revenue, margin, pipeline. They rarely watch the four things that decide whether the company survives a bad day. These four wake up only during the outage, and by then it is too late to map them.

The line itself comes first. One carrier, no redundancy, no 4G or 5G failover ready to take over. The day it drops, you discover there was no fallback. You discover it at the same moment your customers do.

Authentication comes second. A single identity provider, one centralized multi-factor system, an administrator password living inside a third party you do not control. If that provider closes, errs, or gets breached, your teams no longer get in anywhere. Neither do you.

Data comes third. Three questions decide whether you own it or merely rent the illusion of owning it. Where does it actually live. Who can hand it back to you. How long would that take. If the answer is not clear in one sentence, the data is not under your control. You are holding it elsewhere, on trust.

The critical partner comes fourth. The cloud provider, the host, the box sitting at the edge of your network. Usually one actor, on whom the continuity of everything else depends. None of these four is expensive to map. Each is very expensive the day you did not.

The decision no one ever made

Ask a leadership team when they decided to give up the ability to work offline. You will get puzzled looks. No one decided it. There was never a meeting, never a vote, never a line in the minutes.

The messaging moved to the cloud. A sound call. Then the ERP. Sound too. Then the CRM, the accounting, the electronic signature, the document storage. Each brick a good decision, taken at the right time, for the right reasons. Ten reasonable choices, laid end to end, produce a company that cannot run for one hour without the internet.

The dependency was never chosen. It accumulated. That is what makes it so hard to see. There is no single culprit, no obvious mistake to point at. Every step made sense on its own. The exposure lives in the sum, and no one is responsible for the sum.

This matters because you cannot fix by accident what you built by accident. The accumulation has to be made visible on purpose, listed, named, and put in front of someone with the authority to act on it.

Resilience is a name before it is a value

In most companies, resilience is a value. It appears in the charter, in the all-hands deck, in the risk section of the board pack. It belongs to everyone, which means it belongs to no one.

Look at how the responsibilities actually split. The CIO owns the technology. The CFO owns financial risk. The COO owns execution. Each holds a column and holds it seriously. Global resilience does not sit inside any one of those columns. It lives between them. And what lives between functions has no owner by default.

As long as no name is written against the word, resilience stays an intention. A good one, shared and sincere. An intention does not restart a system at three in the morning. A mandate does. A mandate names a person. It gives that person the right to block, to arbitrate, to spend, to say no to a decision that weakens the whole while helping one part.

The difference between a company that absorbs an outage and one that is flattened by it is decided long before the outage itself. It is decided on the day a leader writes a name against the word resilience. Everything else is hope, and hope holds only as long as the line holds.

What a leader does before the line cuts

None of this calls for a six-month program or a frightening budget. It calls for three moves, in order.

Start with an inventory. List the dependencies one by one. Where the data lives, who holds the keys, which contracts have no exit, which single supplier could stop everything. Most of this can be written down in a few working sessions. The list is almost always longer than expected, and the surprise itself is useful.

Then set a priority. You do not fix everything at once. You start where the pain would be worst and where the fix is fastest. Those two are not always in the same place, which is exactly where an outside eye earns its keep.

Then assign the mandate. One person, named, with the authority to carry the subject across functions and the right to contradict a decision that creates a trap. Not to slow the company down. To make sure the company keeps a door it can walk through.

The line will cut one day. That is arithmetic, not pessimism. The only real choice is whether someone was made responsible, in advance and in writing, for what remains possible when it does. A company that made that choice barely notices the bad hour. A company that did not spends it discovering, live, everything it never priced.

The Right to Cut: What Gabon Taught Me About Sovereignty

2026-07-21T00:00:00+02:00

Real sovereignty is not the capacity you are granted. It is the capacity you are willing to use, and its sharpest test is the right to cut: to leave a vendor, to delete your data, to sever a dependency you no longer accept. Gabon reminded me of this over a single week. France, which taught the world a great deal about sovereignty, seems to have mislaid the practice of it.

Ownership has three parts, and only the third one frightens anyone

Roman law split ownership into three rights. Usus, the right to use a thing. Fructus, the right to enjoy what it produces. Abusus, the right to dispose of it, to change it, to destroy it. You did not truly own something until you held the third right. A tenant has usus. A shareholder has fructus. Only the owner has abusus.

Carry that distinction into a modern company and it cuts deep.

You use your software every day. That is usus. You build your operations on top of it and you profit from it. That is fructus. Now the third question. Can you dispose of it? Can you export everything, delete the account, sever the vendor, and walk away without asking anyone’s permission? That is abusus, and most organisations simply do not have it.

They feel like owners because they use the system and profit from it. Two rights out of three. The right that actually defines ownership, they signed away without noticing, usually inside a data-format clause or an access policy nobody read to the end.

Picture the test in practice. You decide, on a Monday, to leave your main platform. How long until your data is fully in your hands, in a form your next system can read, with the old vendor no longer able to hold anything back. If the honest answer is measured in quarters, or if it depends on the vendor’s goodwill, you were never the owner. You were a long-term guest with a confident vocabulary.

I keep meeting leaders who are surprised by this. They run the company. They pay the invoices. And they discover, the day they want to leave, that leaving was never theirs to decide.

There is a reason this stays invisible. Usus and fructus are felt every day. You touch them. Abusus is felt once, on the day you try to leave, and by then it is too late to acquire it. The one right that matters most is also the one nobody misses until the exit is blocked. Ownership hides its most important part behind the least used door.

A sovereignty you are handed is inert until someone exercises it

Here the history of the place I visited stops being background and becomes the argument.

In November 1959, Léon M’ba, who would become Gabon’s first president, argued openly for departmentalization. He wanted the territory to stay a French department rather than become an independent state. Jacques Foccart, de Gaulle’s man for African affairs, told him the idea was unthinkable. Gabon became independent on 17 August 1960, whether its leading politician had chosen that path or not.

That detail has stayed with me. A sovereignty handed down from above is not the same object as a sovereignty taken up from below. One is a status printed on a document. The other is a capacity that somebody wakes up and exercises. You can be declared independent and still spend every morning waiting for someone else to decide the things that matter.

Companies inherit sovereignty the same inert way. A contract says the data is yours. An audit says you are compliant. A slide says you are in control. None of it moves until a named person chooses to use the third right, and proves it.

Proof is the whole point. An unexercised right decays into a decoration. A muscle you never use still shows on the anatomy chart and still cannot lift anything. Sovereignty is that kind of muscle. It exists on the org chart, in the contract, in the compliance file. Whether it can lift anything is a separate question, and the only honest way to answer it is to try.

The right to cut costs you before it pays you

Abusus has a price, and the price comes first.

To keep the right to leave, you pay upfront. You insist on open export formats when a proprietary one would be smoother today. You keep the root access even when handing it over would be more convenient. You build a little internal competence you could have rented. Every one of these choices is more expensive now and cheaper later.

The dependency trap is the mirror image. It is cheaper now and far more expensive later. You take the smooth onboarding, the managed everything, the format that only the vendor reads. Nothing hurts on day one. The bill arrives the day you try to exercise a right you quietly gave up.

Most organisations optimise for the comfortable start. They buy usus and fructus at a discount and let abusus lapse. Then they call the result bad luck. It was not luck. It was a purchase order.

I have watched this play out from both chairs, as the buyer who got it wrong years ago and as the advisor who now sees it coming. The pattern never changes. The discount at the start is visible and the bill at the end is deferred, so the brain that signs treats the first as real and the second as hypothetical. It is not hypothetical. It is scheduled. You simply have not been told the date.

France taught the doctrine and mislaid the practice

There is an irony I could not ignore on the flight home.

France gave the modern world a great deal of its vocabulary of sovereignty. The theory is deep here, taught, debated, defended. And yet, inside the companies I work with, the practice of the third right is rare. Leaders optimise use. They optimise returns. The capacity to cut a dependency, to walk away from a vendor, to refuse a captivity, sits unexercised, often unassigned to anyone at all.

The country that first refused Gabon its independence now often forgets to pick up its own. Not at the level of the state. At the level of the ordinary company that runs the country’s economy. The doctrine is intact. The muscle has gone soft.

I say this without contempt. Comfort does this to everyone. When the power stays on, the vendors stay solid, and the formats mostly work, the reflex to keep an exit fades. Why pay for a door you never expect to use. The answer arrives with the first acquisition, the first price change, the first strategic pivot you did not choose. By then the door has been walled over, quietly, one convenient decision at a time.

I am not romanticising anywhere. The infrastructure constraints I saw were real, sometimes severe. But a constraint you can name is not the thing that costs you the most. What costs you is a right you never use because you forgot you held it.

What the man in the car already knew

Go back to the first evening, the long drive from the airport, the driver talking about his son who writes code.

What he said, in his own words, was that he wanted his son to build things he could keep. Not rent forever. Keep. Change. Walk away from if needed. He did not know Roman law and he did not need to. He had the instinct that the lawyers spent centuries formalising. Ownership is the right to dispose.

I think that is why the week unsettled me. I did not meet more knowledge there. I met more instinct. People who had never been able to assume that a system would simply keep working, and who therefore never confused using a thing with owning it. That confusion is a luxury. Luxuries make you soft in ways you only notice once they are taken away.

I came home with that instinct ringing louder than any of my notes on bandwidth. Sovereignty is not the title. It is the third right, exercised by someone who is willing to pay for it before it pays them back. Ask yourself the uncomfortable version tonight. On the systems that run your company, do you hold the right to cut? And if you do, when did you last prove it?

Sources

Wikipedia, “Léon M’ba”, 2026. https://en.wikipedia.org/wiki/L%C3%A9on_M%27ba
France 24, “1960: The year of independence”, 2010. https://www.france24.com/en/20100214-1960-year-independence
BlackPast.org, “Léon M’ba (1902-1967)”, 2011. https://www.blackpast.org/global-african-history/people-global-african-history/leon-mba-1902-1967/

Off the Books: The Technical Debt No Monitor Will Ever Show You

2026-07-14T00:00:00+02:00

Every company carries technical debt it can count: the legacy to rewrite, the licences to migrate, the tickets in the backlog. It also carries a debt no monitor will ever show, because people absorb it for free. The manual export. The knowledge that lives in one head. The workaround nobody wrote down. This second debt has no functional owner. It surfaces only when someone leaves, a system breaks, or an audit finally drags it into the light. By then it is no longer a line item. It is a crisis with a calendar that does not wait.

A balance sheet only tells you half of what a company owes

Accountants solved this problem a long time ago. A balance sheet shows what a company owns and what it owes. It does not show everything the company is committed to. A nine year lease. A pension obligation. A guarantee given to a partner. A lawsuit in progress. None of it sits in the liabilities column. All of it is real.

This is what the off-balance-sheet annex is for. The accounting rule does not ask for it out of caution. It asks for it because without it, the balance sheet lies. The international standard that governs this, IAS 37 (Provisions, Contingent Liabilities and Contingent Assets), exists precisely to force what is owed but uncertain back into the open. The French Plan Comptable Général carries the same demand in its annex on off-balance-sheet commitments. Different rulebooks, one principle: what is not recorded is still owed.

The most expensive lesson on this point was Enron, in 2001. The company moved enormous obligations into special purpose entities that never appeared on the main balance sheet. On paper, the group looked healthy. The obligations were real the whole time. When they came back into view, the company did not slow down. It imploded. I cite it as a textbook case, not as a thriller. The mechanism is what matters: what you keep off the books does not disappear. It waits for the conditions that make it visible.

A company’s information system has the same two layers. There is the technical balance sheet: servers, licences, contracts, open tickets. Things you can name and cost. And there is the technical off-balance-sheet: everything that keeps the company running without appearing anywhere. That second layer is the one I want to talk about.

The debt people absorb has no owner, and that is what makes it dangerous

Recorded technical debt has a strange virtue. It is honest by construction. It only contains what teams know how to name and agree to report. A module flagged for a rewrite, an old framework past its support window: those make it into the register because someone can describe them.

The off-balance-sheet layer never makes it in, because describing it would require someone to notice it first. The export reworked by hand every month, because two systems do not talk to each other. The knowledge of an old subsystem that nobody ever wrote down. The process workaround learned on the job, passed on by word of mouth, never documented. The team that has been compensating for a broken tool for three years no longer sees it as debt. They see it as doing their job well.

There is a name for this in the research on work itself. Susan Leigh Star and Anselm Strauss, in 1999, described the invisible work that keeps systems running and never appears in the formal account of who does what. Their point was not technical. It was organisational. Some work only becomes visible when it stops. Until then, it is absorbed, silently, by the people doing it.

That is the heart of it. This debt has no owner. Ward Cunningham coined the technical debt metaphor to talk about code you ship fast and pay for later, and Martin Fowler has spent years refining it. The metaphor holds, but it stops at the code. The version that hurts a non-technical CEO the most is not in the code. It is in the gap between what the organisation depends on and what the organisation actually owns. A skill in one person’s head is not an asset. It is a commitment with no maturity date, payable on the worst possible day.

A clean modernisation project dies on what nobody wrote down

Here is how it plays out. Names and details changed, the shape is one I have seen more than once.

A mid-sized company decides to modernise. The plan is sound. Replace an ageing platform, connect the systems that do not talk, retire the manual steps. The budget is approved. The timeline is tight but reasonable. On paper, it is a clean project. Everyone signs off.

The first audit phase is supposed to be a formality. Map the existing processes, confirm the dependencies, start building. It is not a formality. It is where the off-balance-sheet comes out.

The monthly closing, it turns out, depends on a spreadsheet. Not a system. A spreadsheet, built and maintained by one person, who pulls data from three places, reconciles it by hand, and produces the file the whole finance chain waits for. No one above that person knows the spreadsheet exists in this form. They know the number arrives on time. They never asked how.

The same audit finds five more of these. A reporting flow that only runs because someone manually triggers it. A customer onboarding step that lives in a checklist on one laptop. A nightly job that breaks twice a year, and only one engineer knows the sequence to bring it back. Each one, on its own, looks small. Together, they are the load-bearing structure of the company. And not one of them is in the project plan, because the plan was built from the recorded debt, not the absorbed one.

Now the project has a choice it did not budget for. Modernise on top of dependencies it does not understand, and risk breaking the closing in month two. Or stop, document everything first, and blow the timeline. Both options cost more than the original estimate. The debt that never showed up on a dashboard just became the single most expensive variable in the project. It was always there. It only acquired a price the moment the conditions changed.

This is the off-balance-sheet, exactly as an accountant would recognise it. A commitment that costs nothing while everything holds, and everything the day it moves.

Some people do not just hold the debt, they guard it

There is a sharper version of this, and it is the one most organisations refuse to name.

Sometimes the debt is not absorbed by accident. It is cultivated. A person works out, consciously or not, that knowledge kept private becomes power. So they keep it private. They do not document. They make the process a little more complicated than it needs to be, just enough to stay the only one who can run it. They present dependency as expertise.

The signals are easy to miss because they look like competence. The person delivers. They are precious. People around them say, with admiration, that they are irreplaceable. Irreplaceable is rarely a compliment. It is a diagnosis.

The hardest cases add hostility to opacity. Challenge the work, and it does not turn into a technical debate. It turns into a political one. So people stop challenging. And every month, a little more of the company runs through one head, with the organisation quietly agreeing not to look. Management complicity is part of the mechanism. It is easier to keep the person happy than to confront what their indispensability is costing.

This is where the absorbed debt becomes almost impossible to see from the top. Ordinary invisible work is just unrecorded. Guarded invisible work is actively hidden, by someone with an interest in keeping it hidden. A CEO cannot audit what no one will describe, and the one person who could describe it is the one person who never will.

A CEO cannot audit what they do not know exists

Here is the trap, stated plainly. The non-technical leader is asked to govern a risk they cannot see, through people who, for different reasons, will not show it to them.

It is not a competence problem. You do not need to read code to run a company that depends on code. You need to know which questions to ask, and you need someone who can ask them without triggering the war. The leader sitting in the chair sees the top layer: the dashboards, the recorded debt, the reassuring sentence that the number always arrives on time. The layer underneath does not rise on its own. It comes out at the audit, at the departure, at the crisis. Always late. Always under pressure.

The fix is not heroic. It is patient. You map where the company actually depends on individuals rather than systems. You make the implicit explicit, one process at a time. You turn what lives in two or three heads into something the company owns. You do it without putting anyone on trial, because the goal is not to punish the person who absorbed the debt. The goal is to stop the company from depending on an accident.

That last word matters. An organisation that runs on accident eventually discovers the exact cost of that accident. The only real choice is whether you learn the number on your own terms, with time to act, or on the day someone hands in their notice and the inventory you never made becomes due all at once.

Put the off-balance-sheet back on the books

The discipline an accountant applies to commitments is the discipline a leader should apply to dependencies. Not because it is elegant. Because the alternative is a balance sheet that lies.

Start with one question, asked of the right people, in a way that does not feel like an accusation: if this person were out for a month, what would stop? Then follow the answers, because they are never as narrow as the first response suggests. What stops is the map of your real off-balance-sheet. Write it down. Give each item an owner who is not a single irreplaceable individual. Turn the spreadsheet into a system, the tribal knowledge into documentation, the workaround into a decision someone made on purpose.

None of this shows up on a monitor, which is exactly why it gets skipped. The debt people absorb is the cheapest thing in the company until the day it is the most expensive. A leader who learns the number before that day keeps the choice. A leader who waits inherits a debt they never signed.

Sources

IFRS Foundation, IAS 37 Provisions, Contingent Liabilities and Contingent Assets, 2001 (à jour 2026). https://www.ifrs.org/issued-standards/list-of-standards/ias-37-provisions-contingent-liabilities-and-contingent-assets/
Autorité des Normes Comptables, Règlement ANC n° 2014-03 relatif au Plan Comptable Général, version consolidée au 1er janvier 2026 (section informations relatives aux engagements hors bilan). https://www.anc.gouv.fr/files/anc/files/1_Normes_fran%C3%A7aises/Reglements/Recueils/PCG_janvier2026/PCG–1er-janvier-2026.pdf
Peter Bondarenko, Enron scandal, Encyclopædia Britannica, 2026. https://www.britannica.com/event/Enron-scandal
Susan Leigh Star & Anselm Strauss, Layers of Silence, Arenas of Voice: The Ecology of Visible and Invisible Work, Computer Supported Cooperative Work, 1999. https://link.springer.com/article/10.1023/A:1008651105359
Martin Fowler, Technical Debt, 2019. https://martinfowler.com/bliki/TechnicalDebt.html

The Chef Never Touches the Pan: Why Leaders Confuse Mastery With Judgment

2026-07-07T00:00:00+02:00

A head chef in a serious kitchen holds no station. He learned all of them, then left them. He still runs the service. The belief that a leader must be able to do every job before delegating it is the belief that quietly destroys delegation. You do not need to master a craft to govern it. You need to understand it well enough to know when it sounds right, and that is a different skill that takes a different amount of time.

There is a story most leaders tell themselves, and it is wrong. It says authority comes from competence at the task. That to lead the people who do the work, you must be able to do the work, or to have done it, or at least to be able to follow every move. It feels humble. It feels rigorous. It is the most expensive mistake a non-technical leader makes, and it has a twin in the kitchen that has been solved for over a hundred years.

Doing, mastering, and understanding are three different things

Most people collapse three distinct capacities into one word: competence. Pull them apart and the whole question changes.

The first is knowing how to do a task. You have held the station. Your hands know the motion. This decays fast when you stop practising. A head chef who spent fifteen years away from the fish station would not cook a fillet as cleanly as the cook who does it every night. He knows this and does not pretend otherwise.

The second is mastery. Not just doing the task, but doing it with the precision that holds up at every service, under pressure, three hundred covers deep. Mastery demands daily repetition. It is the rarest of the three and the first to erode. The head chef gave it up the day he stepped back. His fish cook owns it now.

The third is understanding. Knowing what a correctly cooked fish is. Knowing why this one is not. Knowing what to say to the cook so the next one is right. Understanding does not decay the way the others do. Once you have it, it stays. You can lose your hands and keep your judgment.

Leadership runs on the third. Not the first two. The leader who refuses to decide a technical question because he could not perform the task himself has confused mastery with judgment. He thinks he needs the hands. He needs the ear.

Escoffier wrote the answer down in 1903

The professional kitchen solved this problem before the telephone was common. In 1903, Georges Auguste Escoffier published Le Guide Culinaire and codified the brigade de cuisine: a kitchen organised into stations, each run by a chef de partie, the whole coordinated by a chef de cuisine who, in the full system, cooks almost nothing.

The structure is deliberate. The saucier owns the sauces. The poissonnier owns the fish. The garde-manger owns the cold work, the pâtissier the desserts. Escoffier, who had served in the French army, borrowed the discipline of a military brigade and applied it to service. The point was scale: with specialised stations, a kitchen could send hundreds of covers without losing consistency. No single person could do that by cooking everything. Someone had to stop cooking and start listening.

That someone is the chef de cuisine. He learned every station on the way up. He tasted each one for years. He can tell when a reduction has split, when a stock is flat, when a plate is two minutes late. He does none of the cooking. He hears the whole kitchen at once, and he decides. The system does not treat this as a loss of legitimacy. It treats it as the job.

Nobody in a great house asks the chef to take back the pan to prove he deserves to command. The proof is in the service running clean. The day the chef drops back onto a single station and starts cooking, the brigade reads it instantly: something has gone wrong, and the whole kitchen is about to feel it.

The chef who tries to hold every station loses the kitchen

A chef who insists on cooking everything is not more in control. He is less. He has his head down in one pan while the rest of the service drifts.

Picture it. He is reducing a sauce that is going too fast, so his attention is on the pan. Meanwhile table 12 has been waiting eight minutes, the fish cook’s oven just failed, and a new ticket for twelve just landed. None of that reaches him, because he is cooking. He has traded the one thing only he can do, hold the whole picture, for a thing any of his cooks could do as well or better.

This is the trap, and it is not about ability. It is about where attention goes. Attention is the scarcest resource a leader has. Spend it on a task you could delegate and you have nothing left for the judgment nobody else can supply. The kitchen does not slow down because the chef lacks skill. It slows down because everything routes through one person who insisted on staying in the work.

The same physics governs a company. A leader who keeps a hand in every technical decision becomes the bottleneck the whole organisation waits on. The team stops deciding. They have learned that whatever they produce will be redone or overruled, so they bring everything up the line and wait. The leader reads this as proof that he is needed everywhere. It is the opposite. He built it.

Jeff Bezos set Amazon’s architecture without writing a line of it

The clearest example of leading by understanding instead of doing is also one of the most consequential decisions in modern technology. In 2002, Jeff Bezos issued what is now remembered as the API mandate.

The substance, as preserved in Steve Yegge’s well-known 2011 account, was blunt. All teams would expose their data and functionality through service interfaces. Teams would communicate only through those interfaces. No direct linking, no shared databases, no back doors. Every interface had to be designed from the ground up to be exposable to outside developers. And, in Yegge’s telling, a final line: anyone who does not do this will be fired.

Bezos did not write those services. He did not architect the individual systems or implement the interfaces. He had the understanding to see what the company needed to become, a platform rather than a product, and he set the constraint that forced it. The engineers discovered the hard lessons themselves over the following years: service discovery, monitoring that doubles as QA, throttling so that peer teams do not become denial-of-service attackers. Bezos did not need to know those lessons in advance. He needed to understand the stakes well enough to point the organisation at the right hill and refuse to let it cheat.

What came out of that constraint was, eventually, Amazon Web Services. A bookseller’s internal plumbing became a computing platform that now runs a large share of the internet. The decision that made it possible was not a feat of engineering by the man at the top. It was a feat of judgment, set by principle, executed by people who held the mastery he did not.

This is the chef de cuisine at industrial scale. Bezos tasted enough of the craft to know what a good system was. He did not build it. He decided what it had to be, and he listened hard enough to know whether the answer coming back sounded right.

The non-technical leader makes the chef’s mistake in reverse

A non-technical CEO who feels illegitimate deciding a technical question is making the same error as the chef who wants to cook every dish. Same false belief, opposite symptom.

The chef who cooks everything believes mastery of the station is what earns him the right to run the kitchen, so he never leaves the stove. The CEO who recuses himself from technical arbitration believes mastery of the subject is what earns him the right to decide, so he never decides. Both are paralysed by the same idea: that you must be able to do it to be allowed to govern it.

When a leader steps out of a technical decision because he is not technical, he does not hand it to a better decision-maker. He leaves a hole. His head of engineering has an engineering view. His CFO has a cost view. His sales lead has a deadline view. Each sees one station. None sees the whole kitchen. That is the leader’s view, and it is the only one in the room that integrates the others. Vacate it, and the question gets answered by default, usually by whoever speaks with the most confidence that day.

The leader does not need to know how to write the code to decide whether to rewrite the system or keep it. He needs to understand what is actually at stake, what each option costs, what it forecloses, and how it sounds against everything else he is responsible for. That is judgment. It is learnable without ever touching the pan.

Understanding is the capacity that survives

The reason this distinction matters so much is that the three capacities age differently. Two of them are perishable. One is not.

Hands fade. A leader who once wrote code well will not write it well after years away, and chasing that lost fluency is a waste of the hours a leader has. Mastery fades faster still, because it was only ever held up by daily practice the leader no longer does. If your authority rests on either of those, it is decaying from the day you stop doing the work, and you will spend your energy defending a competence that is slipping rather than exercising the judgment that is not.

Understanding behaves differently. Once you genuinely grasp why a system behaves the way it does, what good looks like, where the real risks sit, that knowledge compounds rather than erodes. It transfers across problems. The leader who understands his technology can walk into a decision he has never seen before and ask the three questions that matter, because he understands the shape of the thing even if he could not build it.

This is why the chef de cuisine keeps running the kitchen long after his hands have left the stations. His understanding did not leave. It is what he leads with.

What this means for how you lead

The practical move is to stop trying to earn legitimacy through mastery you will never reach and start building the understanding you can.

You do not need to learn fifteen jobs. You will not have the hours, and even if you did, you would be optimising the wrong thing. What you need is the ear: enough understanding of your own systems to tell when they sound right and when they sound off, without putting your hands inside them. That is installable. It does not require turning a leader into a technician. It requires giving the leader the judgment to arbitrate, so the people who hold the mastery can get on with the work.

The chef who tries to do everything is not the strong one. He is the bottleneck. The strong chef learned every station, left them all, and now hears the whole service in a single glance across the pass. He decides what goes out and what comes back. He does not pick up the pan, and nobody asks him to.

You can run the kitchen without dressing the plate. Most leaders do not believe it. It is costing them the one job that was actually theirs.

Sources

Auguste Escoffier, Le Guide Culinaire (1903). Full original French text on the Internet Archive: https://archive.org/details/bnf-bpt6k65768837 — overview: https://en.wikipedia.org/wiki/Le_guide_culinaire
Le Cordon Bleu, “What is the kitchen brigade system?” https://www.cordonbleu.edu/news/what-is-the-kitchen-brigade-system/en
Auguste Escoffier School of Culinary Arts, “Kitchen Hierarchy Explained: Different Jobs in the Brigade de Cuisine” (2025). https://www.escoffier.edu/blog/culinary-pastry-careers/different-types-of-chef-jobs-in-the-brigade-de-cuisine/
Steve Yegge, “Stevey’s Google Platforms Rant” (2011), preserving Jeff Bezos’s 2002 API mandate. Archived copy: https://courses.cs.washington.edu/courses/cse452/23wi/papers/yegge-platform-rant.html
Walter Isaacson, Steve Jobs (Simon & Schuster, 2011). Reference via Library of Congress, “The Founding of Apple Computer, Inc.”: https://guides.loc.gov/this-month-in-business-history/april/apple-computer-founded

The Decision Nobody Reopens

2026-06-30T00:00:00+02:00

A technical decision is a dated act. It was made on a specific day, by specific people, under specific assumptions. Medicine treats a chronic condition this way: a patient who is stable today is not a patient who is cured, so the follow-up visit is scheduled before anyone leaves the room. Most organisations document the decision and schedule nobody to revisit it. The result is silent erosion, and the bill arrives as an incident rather than a review.

A stable decision and a stable patient are the same illusion

Both feel solved, and neither is.

In type 2 diabetes care, French health authorities lay out something most companies never write down for their own decisions: a follow-up rhythm. Annual screening for complications. Regular reconsideration of the treatment strategy. A named pilot who coordinates the whole pathway. The point is not that the patient is fragile. The point is that the equilibrium reached today was reached under conditions that will change, and someone has to be responsible for noticing when they do.

A treated patient who feels fine can deteriorate over a year without a single alarming event between the two visits. No symptom. No crisis. Just the slow drift of values that nobody measured. The follow-up protocol exists precisely because the absence of symptoms is not evidence of health. It is, at most, evidence that nobody looked.

A technical arbitrage behaves the same way. The vendor you chose because your team mastered it. The architecture you picked because it fit the need. The contract you renewed without rereading it. Each was correct on the day it was decided. None of them comes with a follow-up visit.

The paper survives, the ground does not

What erodes is never the record. It is the terrain the record stood on.

Six months after a decision, the register still holds. The decision memo still holds. The selection criteria still hold. What has moved is everything the decision quietly depended on: the engineer who understood the tool has left, the vendor has been acquired, the workload has tripled, the assumption that traffic would stay flat turned out to be wrong. The decision did not fail. Its foundations were replaced underneath it, one piece at a time, and nobody re-checked whether it still stood.

This is the gap between a decision and its half-life. We are good at making decisions and recording them. We are terrible at admitting they have an expiry date we cannot see in advance. So we treat the record as if it were the reality, and we manage the document instead of the thing the document described.

The medical word for this is a silent recurrence. The clinical markers slip below the surface while the patient reports feeling well. It is detectable, but only if a test was ordered. In companies, the equivalent test is a scheduled reopening of the decision, and it is almost never ordered.

A short story about a tool that was right until it wasn’t

Consider a mid-sized company that standardised, years ago, on a single internal tool to run a critical part of its operations.

At the time, the choice was sound. The team that requested it knew it inside out. It was cheaper than the alternatives. It integrated with what already existed. The decision was documented, approved, and filed. Everyone moved on, which is exactly what you are supposed to do with a settled question.

Then the half-life began. The two engineers who had championed the tool moved to other roles, then out of the company. The vendor shifted its roadmap toward a different market and let the features this company relied on stagnate. The volume of work the tool handled grew well past what anyone had imagined when it was chosen. None of this triggered an alert, because no alert had been defined. The tool kept running. Dashboards stayed green. The decision stayed filed.

The reopening, when it finally came, was not a review. It was a failure. A routine change broke something nobody now understood, because the people who understood it were gone and the documentation had aged into fiction. What should have been a calm reassessment eighteen months earlier became a scramble: emergency contracts, external help brought in at a premium, weeks of senior attention spent on a problem that had been visible, in principle, the whole time.

The root cause was not the original choice. The original choice was good. The root cause was that no one had been mandated to ask, at a fixed date and regardless of whether anything seemed wrong, the simple question: does this decision still hold?

The role that keeps decisions fresh is missing from the org chart

Look at who, in your organisation, owns the freshness of past technical decisions. The honest answer is usually nobody.

The CEO validates dozens of technical arbitrages a year and has neither the time nor the remit to reopen them all. The technology lead is absorbed by the run and the next project. The vendor is paid to deliver, not to audit its own continued relevance. The teams rotate. The committee that made the call dissolved the moment the call was made. Each of these actors is doing exactly what they are supposed to do. None of them is doing the one thing that was never assigned: the scheduled, routine reopening.

A hospital does not leave follow-up to chance. The protocol names who looks at what, at which interval, and who reopens the file if the results drift. It is written down because memory and goodwill are not a system. In most companies, the equivalent role does not exist on any job description. The closest thing is an audit, but an audit is an event, not a rhythm, and it usually arrives because something already went wrong.

The person who reopens the file should not be the person who runs it

Distance, not expertise, is what makes a reopening honest.

The team that operates a system every day is the worst placed to judge whether it still belongs. Not through any failing, but because they live inside it. They have absorbed its quirks as normal. They have built the workarounds themselves and stopped seeing them as workarounds. They have a stake in the decision continuing to look right, because they implemented it, defended it, and built their routines around it. Asking them to reopen the file is asking them to argue against their own recent past, which is a lot to ask of anyone.

This is why hospitals separate roles. The specialist who reads the follow-up results is not always the one who prescribed the original treatment, and the protocol is designed so that the review does not depend on the goodwill or the memory of a single overloaded actor. The structure carries the rigour, not the individual. Inside a company, the same separation matters. The reviewer needs enough distance to say “this no longer holds” without it landing as self-criticism, and enough remove from the daily run to not be dragged back into firefighting the moment something urgent appears.

Sometimes that distance is internal: a person or function deliberately kept out of operations and given the explicit mandate to reopen. Sometimes it is external: someone who never made the original call, has nothing to defend, and reads the system the way a doctor reads a file they did not write, by looking at the results rather than asking whether everyone feels fine.

A routine mandate is harder to assign than a crisis mandate

This is the uncomfortable part, and it explains why the role keeps disappearing.

For a crisis, everyone knows who to call. For an audit, there is a budget line and a trigger. For routine review, there is nothing. Routine makes no noise. It does not escalate, it does not page anyone, it does not show up in this quarter’s numbers. So when the urgent crowds out the important, the first task to be quietly dropped is the one that watches the things not yet on fire. It is dropped without a decision, without a meeting, without anyone noticing. It simply stops being done.

The doctor does not cancel the follow-up visit because the patient feels well. It is when the patient feels well that the visit matters most, because that is the only window in which a silent drift can be caught before it becomes an event. Inside organisations, this logic is inverted. We reopen decisions only once they have already cost us, which is the most expensive moment to do it and the least useful.

The half-life of a decision is shorter than the record suggests

Most leaders overestimate how long a technical decision stays valid, because the record does not age and they read the record instead of the reality.

A signed decision looks permanent. The PDF does not yellow. The line in the register does not move. So the mind files it as done, and done feels like forever. But the decision was never the PDF. It was a bet placed on a particular configuration of people, tools, costs, and assumptions, and that configuration starts decaying the day after the signature. The half-life is not measured in years. In a company that is growing, hiring, losing people, and changing direction, the conditions under which a decision made sense can be unrecognisable in twelve to eighteen months.

There is a useful discipline here borrowed straight from chronic care. Doctors do not ask whether the diabetes is gone. They ask what the markers say now, against the markers from the last visit, and whether the gap is acceptable. The question is never “is this still true forever”. The question is “is this still true today, and by how much has it moved”. A decision deserves the same framing. Not “was this a good call” but “does this call still hold under conditions that have certainly changed”.

The danger of the permanent-looking record is that it suppresses the question entirely. Nobody asks whether the vendor still fits, because the vendor question is closed, it says so right there in the register. Closure is comfortable. It is also the exact mechanism by which good decisions rot in plain sight.

Decisions have biomarkers, and almost nobody reads them

Every decaying decision sends early signals long before it fails, and the signals are usually sitting in data you already have.

In medicine, a biomarker is a measurable proxy for a state you cannot see directly. Blood sugar for metabolic control. A handful of numbers that tell you the equilibrium is slipping before the patient feels anything. Technical decisions throw off the same kind of proxies, and they are rarely watched as such. The number of people who can still operate a given system, trending toward one, then zero. The age of the last meaningful update from a vendor. The growing distance between the volume a tool was chosen for and the volume it now carries. The frequency of small workarounds the team has quietly built to keep something alive.

None of these is an incident. Each is a biomarker. Read together, at a fixed interval, they tell you which of your settled decisions are drifting toward a silent recurrence. The problem is not that the signals are hidden. The problem is that nobody has the job of taking the reading, so the signals accumulate unobserved until one of them crosses a threshold loudly enough to become a crisis.

A follow-up protocol is, at bottom, a decision about which biomarkers to watch and how often to take the reading. It does not require new dashboards or new tooling. It requires that someone be named to look, on a schedule, at numbers that are already there.

What a follow-up protocol for decisions actually looks like

The fix is not heroic. It is boring, and that is its strength.

Take the register of significant technical decisions you most likely already have, and add one column to it: a review date. Then name a person, not a committee, who owns that date. The reviewer’s job is not to defend the original decision, because they did not make it. Their job is to reopen the file at the appointed time and ask what has changed underneath it. Who has left. What the vendor has become. Whether the assumptions still hold. Whether the people who can operate the thing still work here. The output is short: still valid, watch closely, or reopen for real.

The value is not in the paperwork. It is in the existence of a person whose explicit mandate is to look at what is not currently broken. That mandate has to be protected from the gravity of the urgent, which means it cannot be the same person who runs the operation, and it works best when the reviewer has the distance not to be defending their own past call. This is, incidentally, where an outside eye earns its place: someone who did not make the original decision, has nothing to protect, and can read the silent drift the people living inside the system can no longer see.

A technical decision that is never reopened is not a stable decision. It is a decision whose expiry date everyone has forgotten. The register tells you it was made. It cannot tell you whether it still holds. Only a reopening can do that, and only if someone was given the job before the incident, not after.

Sources

Haute Autorité de Santé, Parcours de soins du patient adulte vivant avec un diabète de type 2 (guide), 2025. https://www.has-sante.fr/jcms/p_3634754/fr/parcours-de-soins-du-patient-adulte-vivant-avec-un-diabete-de-type-2
Haute Autorité de Santé, Diabète de type 2 : six épisodes de soins sous surveillance, 2025. https://www.has-sante.fr/jcms/pprd_2974646/fr/diabete-de-type-2-six-episodes-de-soins-sous-surveillance
Institut national du cancer, Cancers du sein : le suivi après les traitements. https://www.e-cancer.fr/Patients-et-proches/Les-cancers/Cancer-du-sein/Le-suivi
Inserm, Activité physique : Prévention et traitement des maladies chroniques (expertise collective), 2019. https://www.ipubli.inserm.fr/handle/10608/9690
World Health Organization, Noncommunicable Diseases (NCD) Management. https://www.who.int/europe/teams/ncd-management

Restoring Without Erasing

2026-06-23T00:00:00+02:00

Inheriting a legacy information system is the same ethical situation as inheriting a damaged painting: you must choose between an impossible return to the original state, a deliberate decision to stabilize without touching, or a visible, documented, reversible intervention. Art restorers formalized this choice sixty years ago. Most executives make it by accident, without knowing they are making it. The mature move is not to rebuild. It is to pick one of the three postures consciously, and to own it.

A Damaged Painting and a Legacy System Pose the Same Question

The question a restorer faces in front of a darkened canvas is not technical, it is moral: what am I allowed to change in something that was entrusted to me?

I did not expect to find the clearest framework for legacy IT decisions in an art conservation studio. But watch what happens when a seventeenth-century painting arrives on the easel. The varnish has gone amber. Paint lifts at the edges. There is a loss, a lacuna, in the lower corner. The owner wants it back “like new.”

The restorer hears that sentence the way I hear a board member say “let’s just rebuild the whole thing.” With professional patience, and a firm intention to do no such thing.

Because the restorer knows there are exactly three honest answers. Return the work to its original state: seductive, and destructive, since that state no longer exists anywhere except in imagination. Stabilize the work without intervening: control the environment, stop the decay, touch nothing. Or intervene while leaving the intervention visible: fill the lacuna with a technique a trained eye can identify, document every gesture, use materials a future restorer can remove.

Three postures. No fourth. Every legacy system decision I have reviewed in the last decade falls into one of these, or fails because it pretended a fourth existed.

The Original State Is a Myth That Destroys What It Touches

The first posture, returning to the original, is the one that ruins both paintings and companies, because the original state is a reconstruction, not a destination.

In conservation, this is settled doctrine. Strip a painting back to what you believe was its first appearance and you must scrape away layers that became part of the work: the artist’s own later revisions, historic retouches, the surface chemistry of centuries. You do not recover the original. You manufacture a clean forgery of your own assumptions.

The corporate equivalent is the full rebuild fantasy. The system is old, therefore the system must be remade, this time properly, the way it should have been built from the start. I have sat in meetings where this was presented as obvious hygiene. It rests on the same illusion as the over-cleaned canvas: that somewhere beneath the accumulated layers there is a pure design waiting to be liberated.

There is not. The accumulated layers are the system. Twenty years of pricing exceptions, regulatory adaptations, client-specific workflows, integrations born from acquisitions: this is not dirt on top of the system, this is the institution’s memory written in executable form. A rebuild does not liberate the design. It discards the memory and keeps the assumptions of whoever wrote the migration spec, who typically arrived eight months ago.

Notice also who proposes the return to origin. In conservation history, the great over-cleanings were rarely demanded by the people who lived with the works. They were sold by intervening parties with something to gain from the gesture: prestige, a signature campaign, a budget. The pattern transposes intact. The rebuild is almost never requested by the operations teams who run the system daily and know where its bodies are buried. It arrives from outside, packaged with a deck, priced with optimism, and timed to a sponsor’s tenure rather than to the system’s actual condition.

Some of that memory deserves to go. Plenty of it is genuine grime. The point is not that everything old is sacred. The point is that “back to original” is never the real choice on the table. The real choice is always between the two remaining postures.

Preventive Conservation Acts on the Environment, Not the Work

The second posture has a name in museums, preventive conservation, and it is the most underrated decision available to a non-technical CEO.

Museums learned long ago that the cheapest way to save a collection is to never let it need saving. Humidity control, stable temperature, filtered light, vibration management. The work itself is not touched. Its environment is engineered so that decay slows to a crawl. The Venice Charter of 1964, the founding international text of modern conservation, made permanent maintenance the first duty owed to a monument, before any restoration gesture.

Translate that to an information system and you get a program nobody brags about at conferences: tested backups, patched dependencies, revoked accesses, monitored performance, documented interfaces, contracts that do not silently expire. None of it changes the system. All of it changes how fast the system degrades.

Here is what I keep observing in mid-sized companies: the environment work is skipped precisely because it is invisible. A CEO under pressure wants to announce something. “We are rebuilding our platform” is an announcement. “We now test our backups weekly” is not. So capital flows to interventions while the environment drifts, and the drift quietly creates the emergency that will later justify a panicked rebuild.

Choosing preventive conservation is not refusing to decide. It is a dated, signed, active decision: this system stays as it is, and we spend our money making sure it stops getting worse while we figure out what it actually contains. For a company in M&A uncertainty, in leadership transition, or simply without the cash for a safe intervention, it is frequently the only adult choice available. It deserves to be presented to boards as a strategy, not as an absence of one.

Brandi and the Venice Charter Wrote the Rules Executives Are Missing

The third posture, intervening without erasing, was codified with a precision that puts most IT governance documents to shame, and the two founding texts are worth naming.

Cesare Brandi, first director of Rome’s Istituto Centrale per il Restauro, published Teoria del restauro in 1963. His theory holds restoration in tension between two demands that he refused to collapse into one: the aesthetic instance, the work as a thing of beauty that must remain readable as a whole, and the historical instance, the work as a document of everything that happened to it. A restoration that sacrifices either is a failure. From this tension he derived practical consequences: interventions must aim at the potential unity of the work without faking completeness, must remain recognizable on close inspection, and must stay reversible so that future knowledge can undo present error. The Italian school built on his thinking even institutionalized a technique, tratteggio, where losses are filled with fine parallel strokes: invisible at viewing distance, unmistakable up close. The repair participates in the whole and never lies about being a repair.

One year later, the Venice Charter brought the same discipline to architecture and made it international law of the profession. Its restoration articles read like a checklist I wish every CTO transition plan had to satisfy. Restoration stops where conjecture begins. Replacements must integrate harmoniously yet remain distinguishable from the original, so the restoration does not falsify the evidence. The valid contributions of all periods must be respected, because unity of style is not the aim. And every campaign of work must produce precise documentation, archived and published.

Now reread those principles as a system owner. Do not rewrite what you do not understand: stop where conjecture begins. Make every change traceable and visibly distinct from the inherited behavior: distinguishable, documented. Do not flatten the layers added by previous eras of the company in the name of stylistic purity: respect the contributions of all periods. Keep a record a successor can audit: publish the report.

Sixty years ago, a profession that handles irreplaceable objects concluded that the ethical intervention is visible, humble, documented and reversible. The software industry, which handles objects that are merely expensive, still mostly ships the opposite.

The Pentimento Always Resurfaces

Painters themselves left us the proof that buried decisions do not stay buried: conservators call it the pentimento.

The word comes from the Italian for repentance. A pentimento is a change the artist made during the painting: a repositioned arm, a hat brim moved, a figure painted over. The revision is hidden under the final layer, and for decades it stays hidden. Then the covering paint grows transparent with age, or an X-ray sweeps the panel, and the first gesture comes back, a ghost under the composition. The National Gallery’s glossary notes that these ghosts are precious: they reveal how the work was actually made, and help establish what is original.

Every information system of respectable age is full of pentimenti. The ERP rollout that stopped at sixty percent. The module built for a flagship client who left. The half-finished migration whose two halves still run side by side, reconciled nightly by a script one person understands. Each abandoned decision was painted over, not removed. And like their pictorial cousins, they resurface at the worst archaeological moments: under load, during an audit, in the data room of a due diligence.

You can read this as a horror story. Restorers read it the other way: pentimenti are evidence, and evidence is an asset if you find it before it finds you. A serious assessment of a legacy system is exactly this kind of imaging work, X-raying the layers before deciding which posture to adopt. The companies that get into trouble are not the ones with pentimenti, which is to say all of them. They are the ones that commission a rebuild without ever putting the canvas under the lamp.

A Luxury House Taught Me What Harmonizing Without Erasing Looks Like

The longest lesson I received in applied conservation did not happen in a museum, it happened inside one of the great French luxury groups, on a harmonization program whose name I will keep to myself: the mechanics matter here, not the logo.

The setting, simplified: a group whose subsidiaries had each grown their own systems, their own data habits, their own operational gestures. Years of autonomy had produced exactly what you would expect, richness and divergence in the same proportions. The group needed common ground: shared standards, interoperable data, processes that could be read across entities.

The obvious playbook exists, and every large integrator will sell it to you by the kilo: define the single target model, declare every local variation a deviation, migrate everyone onto the standard, celebrate the decommissioning count. It is the restoration equivalent of stripping every canvas in the collection back to the same bright white ground. Clean, uniform, and a massacre.

What made this program a formative experience is that it made the other choice, deliberately. The work started not with a target architecture but with something closer to a conservator’s condition report: understanding, entity by entity, what each local system actually encoded. Some divergences turned out to be accidents of history, tooling chosen because a vendor happened to call that year. Those could be harmonized without loss, the grime of the piece. Other divergences encoded the way a specific métier actually worked, constraints of a craft, of a market, of a client relationship that the local system had absorbed over years. Erase those and you would not be cleaning the subsidiary, you would be amputating it.

So the program drew the line the way Brandi drew it: harmonize what carries no identity, preserve what does, and make the interventions reversible wherever the knowledge was incomplete. Standards were introduced as layers the entities adopted, not as solvents poured over their existing operations. Where a subsidiary’s specificity was real, the standard bent around it, and the bend was documented as a conscious decision rather than hidden as a guilty exception. The intervention stayed visible: anyone reading the program’s records could tell what had been changed, what had been kept, and why.

Two things struck me from the executive side of that program. First, the discipline was harder to sell internally than a clean-slate plan would have been, because its success looked undramatic: nothing collapsed, nothing flashy got inaugurated, the singularities were still there, now legible and connected instead of opaque and isolated. Preventive conservation never photographs well. Second, the discipline aged remarkably. Decisions that bent the standard around a real specificity did not come back as regrets. The few places where uniformity had been forced for elegance were precisely where friction kept resurfacing, pentimenti of the program itself, reminders that what you paint over does not disappear.

I left with a conviction that has since survived contact with much smaller companies: the quality of a harmonization is not measured by how uniform the result is. It is measured by whether the people closest to the work still recognize their craft in the system afterwards. Uniformity is cheap to specify and brutal to live with. Legibility is the actual prize.

The CEO’s Job Is to Choose the Posture, Not to Hold the Brush

You inherited a system you did not build, the way a museum inherits a collection it did not paint, and nobody expects the museum director to retouch canvases.

What the institution does expect from its director is the ethical choice: which works get stabilized, which get restored, what the house rules of intervention are, and the budget honesty that goes with each. That is precisely the part of the legacy IT decision that cannot be delegated to vendors, because every vendor at your table earns money on exactly one of the three postures and will argue for it with conviction.

This is also why the choice has to be explicit and written down. An implicit posture is not a posture, it is a drift. The company that never formally chose conservation still practices it, badly: no environment work, no condition report, just neglect wearing the costume of prudence. The company that never formally chose intervention still intervenes, badly: a hundred undocumented patches a year, each invisible, each irreversible, none signed. The three postures exist whether or not you choose one. The only variable under your control is whether the posture was decided, by you, with the costs in front of you, or inherited from a thousand small defaults nobody owns.

What Remains When the Varnish Settles

The restorer’s ethic compresses into questions a non-technical executive can ask without writing a line of code, and they are sturdier than most steering committees.

Before any intervention on the system you inherited: do we know what is varnish and what is paint, which layers are grime and which are memory? Has anyone put the canvas under the lamp, or are we deciding on the basis of the frame? Is the proposed change reversible, and if not, who signed the sentence that says we accept never coming back? Will the intervention stay visible, documented, distinguishable, or will the next leadership team find our choices disguised as original architecture? And the question that the whole market is built to keep you from asking: is the right move, this year, to touch the work at all, or to fix the thermostat and watch it stop degrading?

On vous a dit qu’un SI vieux se refait, as I keep hearing in French boardrooms: an old system gets rebuilt, everyone knows that. The best restorers know something else. They know when not to intervene, and when intervening, how to do it without erasing the very thing they were hired to save. The maturity of a CEO in front of a legacy system is the same maturity, transposed: not mastering the brush, but owning the choice of posture, consciously, in writing, with its costs on the table.

The painting does not need you to be a painter. It needs you to decide, and to leave a trace of having decided.

Sources

ICOMOS, International Charter for the Conservation and Restoration of Monuments and Sites (The Venice Charter), 1964. https://civvih.icomos.org/wp-content/uploads/2022/03/Charter-of-Venice_1964.pdf
Wikipedia, Cesare Brandi, on the life and restoration theory of the author of Teoria del restauro (1963). https://en.wikipedia.org/wiki/Cesare_Brandi
The National Gallery, London, Glossary: Pentimento. https://www.nationalgallery.org.uk/paintings/glossary/pentimento
Chiara L. M. Occelli, The tradition of Brandi, ICCROM. https://www.iccrom.org/sites/default/files/publications/2020-05/the_tradition_of_brandi.pdf

Conducting Without an Instrument

2026-06-16T00:00:00+02:00

A conductor doesn’t play any instrument. Not the cello, not the bassoon, not the oboe. The absence is not a deficiency. It is the condition that allows the function to exist. The non-technical CEO who tries to learn how to code so that they can decide on the code is, by the same mechanism, abandoning the seat from which a decision can be made. Mastery of the practice is not the prerequisite for the arbitration of the practice. Listening is.

The Conductor Plays Nothing

A symphony orchestra is a room full of virtuosos. The first violin has spent twenty years refining a bow stroke. The bassoonist knows the twelve millimeters of their reed by heart. The percussionist can place a cymbal crash inside a measure to within a fortieth of a second. Every chair is occupied by an instrumentalist whose technique took decades to build.

None of them conducts.

The conductor stands in front of all of them, baton in hand, and produces no sound. Bruno Walter, one of the great conductors of the twentieth century, wrote in Of Music and Music-Making (W. W. Norton, 1961) that the baton emits nothing. It points. It decides where the sound goes. The conductor’s function is the arbitration of a collective trajectory, not the execution of a melodic line.

This is not a polite division of labor. It is a structural condition. A conductor who tried to play the cello during the performance would lose the orchestra in the second measure. The gesture of playing and the gesture of conducting are incompatible inside the same second. You cannot hold a bow at three hundred and fifty notes per minute and a baton at the same time. One excludes the other.

For most of the nineteenth century, this was contested. Conductors were expected to be the best instrumentalist of the orchestra, the one who had occupied every chair before being entrusted with the podium. The twentieth century took that idea apart. By the time Walter wrote his book, it had become widely accepted in conservatories that the discipline of conducting was its own discipline, with its own training, its own ear, and its own demands. Mastery of an instrument was no longer the gateway. Some great conductors had been pianists, others had been violinists, others had begun their training as singers. The seat had stopped requiring a particular biography.

What the seat required was something else. Something harder to name. Something that did not show up in the practice rooms.

Audiation: Hearing Without Playing

Edwin Gordon, the American music education theorist (1927-2015), gave that capacity a name. He called it audiation. He developed the concept in Learning Sequences in Music: A Contemporary Music Learning Theory (GIA Publications, first edition 1980, multiple revised editions through the 2000s and 2010s) and refined it across forty years of work in music cognition.

Audiation, in Gordon’s formulation, is the capacity to hear music inwardly when no music is physically being played, and to comprehend music heard. It is not memory. It is not imagination. It is a structural mental operation in which a person can hold the architecture of a piece in their mind, perceive its harmonic and rhythmic logic, anticipate its movement, and notice when an actual performance deviates from what the piece should be.

A musician who can audiate well can read a score and hear the piece without an instrument in their hands. They can sit in a concert and notice that a phrase is taken too slowly even though the same phrase by the same orchestra was taken at the right tempo yesterday. They can detect, in real time, that something is off, before the off-ness becomes obvious to the rest of the room.

This is the capacity that defines a conductor. Not the capacity to play. The capacity to audiate.

Gordon’s work was developed in the context of music pedagogy. His point was that audiation can be cultivated. It is not a gift that some have and others lack. It is a trainable mental discipline. Children who are exposed early to varied musical material, in his framework, develop more refined audiation than children whose musical exposure is poor. Adults can also develop it, although more slowly, by deliberate listening, by score reading, by working with people who already have the capacity.

The implication, taken seriously, reframes a wide swath of professional life. The transferability is not obvious in Gordon’s text, but it does not take much imagination to apply. Any domain where collective output depends on the coordinated work of many specialists, and where someone has to arbitrate the whole, involves audiation. The architect of a building does not lay the bricks. They audiate the building. The film director does not operate the camera, does not write the score, does not sew the costumes. They audiate the film. The hospital chief of staff does not perform the surgery. They audiate the institution.

And the chief executive of a company does not write the code. Or build the warehouse. Or operate the call center. Or close the books. They audiate the company.

What a Guest Conductor Does Before a Difficult Concert

A few years ago, I worked as an interim infrastructure lead inside a French SaaS scale-up. The company sold video APIs to developers. The product was strong, the engineering team was talented, and the platform was growing fast enough that the choices made in the first two years were no longer adequate for the third year. Monitoring was incomplete. Deployments were manual. The architecture had been written for a customer base of a few hundred developers and was now serving thousands. The difficult concert was already on the calendar: the platform had to be industrialized, and it had to be industrialized in months, not years.

I came in as a guest conductor. The metaphor is not decorative. I was not the chief technology officer of the company. I was not going to become the chief technology officer of the company. I had been asked to come in, prepare the orchestra for the concert, conduct the concert, and leave. The contract was scoped that way from the first day.

I worked mostly alone. I built the monitoring stack that allowed the team to see, for the first time, what was actually happening on the platform in real time. I rewrote the deployment pipeline so that pushing to production was no longer a multi-hour manual procedure performed by one of two people who knew how. I refactored the architecture into a shape that the rest of the engineering team could read, modify, and operate without me.

The numbers moved. Availability went from 95% to 99.95%. Deployment to a new point of presence went from several hours of manual work to under fifteen minutes of automated work. The platform stopped being fragile.

When I left, the company recruited four people to take over the role I had been filling. Four. Not one. The work I had been doing alone, in compressed time, was structured to be picked up by a permanent team. The score I had assembled was readable. The passages I had drilled were workable. The orchestra could play the concert without me.

That is the function of a guest conductor. To accord the orchestra. To work the difficult passages. To hand back the keys. To leave.

I am writing this in 2026, several years after the mission ended. The company is still operating. The platform they took over still runs. The four people who replaced me have grown into a larger team. None of this is my work anymore. None of it ever was, in a permanent sense. The concert was theirs to play. My function was to make sure it could be played.

The mechanism is not unique to that one mission. I have done variations of it inside other organizations, with different difficult concerts in front of them. Each time, the discipline is the same. Do not install yourself. Do not become the chief titular conductor. Prepare the orchestra. Conduct the difficult concert. Leave.

The temptation to stay is real. There is always a reason to stay another quarter. There is always something else that could be tightened. The organization, having gotten used to the guest conductor, often offers to make the role permanent. The discipline is to refuse. The guest conductor who installs themselves becomes a different kind of figure entirely. They become a dependency. The orchestra stops learning to play without them. The whole point of the mission collapses.

The CEO Who Tries to Learn the Cello

The mistake non-technical CEOs make is the symmetric one. They look at their technology organization, conclude that they cannot decide on it because they do not understand it, and decide to spend their time learning to play the cello. They take online courses. They follow internal technical reviews with growing intensity. They ask their CTO to explain microservices, then containers, then Kubernetes, then service meshes. They build, over months, a fragile vocabulary.

At the end of that process, they have not become technologists. They have become non-technologists with a slightly larger lexicon. Their decisions on technology investments are not better. They are often worse, because the partial vocabulary creates the illusion of mastery, and the illusion of mastery silences the question that should have been asked first.

Worse, while they were busy trying to play the cello, they were not in the conductor’s seat. The function they should have been performing was empty. The technology organization, deprived of arbitration, drifted. The first violin took over the tempo because nobody was holding it. The orchestra became less ensemble and more aggregate.

The error is not laziness. It is misplaced diligence. The non-technical CEO who tries to learn to code believes they are doing the responsible thing. They are doing the wrong thing, more responsibly than most.

The right thing is to develop audiation of the technology organization. To learn to hear how a healthy technical conversation sounds, what a credible roadmap sounds like, where the voice of the architect should sit in the harmonic field, when the operations chair has gone flat. This is a different discipline. It involves listening to many technologists, over time, in many contexts. It involves reading not the code but the patterns of how technology decisions are made. It involves working, when needed, with people who can play and conduct fluently enough to bring the CEO’s ear up.

Audiation, in Gordon’s framework, is trainable. The CEO can develop it. They cannot develop it by learning to play the cello. They develop it by listening, by being exposed to varied technical material, by working with people who already have it.

The Function Survives the Practice

There is a phenomenon Gordon described, although he did not put it in these terms. The capacity to audiate can survive the loss of the capacity to play. A pianist who can no longer play, because of injury or illness or simply because they stopped practicing thirty years ago, may still be able to read a score and hear the piece. The gesture is gone. The audiation remains. In some cases, the audiation is sharper for being detached from the gesture, because the practitioner is no longer judging the piece by what their fingers can produce. They judge it by what it should be.

For the non-technical CEO, this is the news they did not know they needed. They do not need to acquire the gesture of writing code. They need to develop the audiation of a technology organization. The two are independent capacities. The function does not require the practice. In some cases, the function is even better performed by someone who never had the practice, because they are not tempted to second-guess the first violin by playing along with them.

The first violin should be left at the first chair. The CEO should hold the baton.

That is the whole point.

The Concert Belongs to Whoever Plays It

The conductor does not play the concert. The orchestra plays the concert. When the music is good, the conductor has done their job. When the music is bad, the conductor has not done their job. The conductor’s function is judged by the sound, not by the manuscript.

So is the CEO’s. The technology organization produces the work. The CEO does not produce the technology. When the technology is sound, the CEO has done their job. When it is incoherent, the CEO has not. It is not the engineers who get judged at that level. It is the seat from which the tempo was held, or not held.

A guest conductor, brought in for a difficult concert, sees this from inside. Most CEOs do not have a guest conductor in their lives. The few who do, in my experience, leave the mission with a sharper ear than they came in with. Not because they were taught to play. Because they were shown what it sounds like when the orchestra plays well.

That is what is on offer here. Not a cello lesson. An ear training.

Sources

Bruno Walter, Of Music and Music-Making, W. W. Norton & Company, 1961.
Edwin E. Gordon, Learning Sequences in Music: A Contemporary Music Learning Theory, GIA Publications, 1980 (revised editions through 2012).
Edwin E. Gordon, Audiation, Music Educators Journal, 1985-2000.
Wilhelm Furtwängler, Notebooks 1924-1954, ed. Michael Tanner, Quartet Books, 1989.

The Story You Were Sold About Your System

2026-06-09T00:00:00+02:00

An information system never lies to its CEO. It is narrated to its CEO. Every audit, every dashboard, every internal report is a deposition, not a statement of fact. We apply the unreliable narrator grid to journalism, to courtroom testimony, to memoir, without any trouble at all. We refuse to apply it to the technical report we just commissioned, because we believe the technical report is somehow different. It is not.

Reports do not lie. They are narrated.

When a CEO opens an IT audit, the reading posture is almost always the same. The document is treated as a state of the system, not as the deposition of the person who wrote it. The figures are scanned. The risk matrix is glanced at. The conclusion is internalized. And the entire reading is done in a frame that assumes the author had no stake, no angle, no positioning interest.

That frame is wrong. The author always has a stake. Not because auditors are dishonest. Because auditors are human, embedded in a market, paid by someone, scored by someone, recruited again by someone. Every audit is written knowing who will read it and who will commission the next one.

This is not corruption. It is positioning. The same word, the same finding, the same recommendation can be phrased twenty ways. Each phrasing is a choice. Each choice carries a small directional vector. Twenty small vectors aligned in the same direction become a story. The CEO reads the story and calls it a state of the system.

Wayne Booth gave us the word in 1961. We never applied it to the audit report.

The literary critic Wayne C. Booth defined the unreliable narrator in The Rhetoric of Fiction in 1961. A narrator, Booth wrote, is reliable when he speaks for or acts in accordance with the norms of the work, and unreliable when he does not. The definition was technical, careful, and meant for fiction. It traveled. It traveled to cinema, to non-fiction memoir, to legal testimony analysis, to oral history.

It never traveled to the corporate technical artifact.

Read a critical review of a presidential biography, and you will see the unreliable narrator grid applied paragraph by paragraph. Watch a film studies seminar discuss Bryan Singer and Christopher McQuarrie’s 1995 film The Usual Suspects, and you will see the same grid applied to Verbal Kint’s voiceover from minute one. Open a courtroom transcript, and you will see attorneys train juries to look for the gap between what the witness says and what the witness has reason to say.

Now open an IT audit. Open the quarterly system review. Open the slide deck the integrator presented at the last steering committee. Where is the unreliable narrator grid? Nobody applies it. Not the CEO. Not the CFO. Not the board. The audit is treated as a state, and the state is acted upon.

This asymmetry is not a small thing. It is the central blind spot of executive decision-making on technical matters. A CEO who would never accept a single-source story from a journalist, and who would interrogate any witness in a deal negotiation for hidden interest, accepts the audit report as if it had no narrator at all.

Why technical reports escape the unreliable narrator grid

There are three reasons the grid does not get applied, and all three are worth naming.

The first reason is that technical reports use the visual codes of objectivity. Numbers. Tables. Maturity matrices on a five-point scale. The visual codes mimic the look of measurement, and measurement is culturally coded as neutral. The CEO who would smell positioning in a paragraph of prose loses the reflex when the same positioning is hidden behind a green-yellow-red column.

The second reason is that the CEO is, by self-assessment, not technical. The lack of subject matter expertise creates a reading posture that is structurally deferential. The audit author is the expert. The expert is treated as the source. The narrator-as-source is exactly what Booth told us, in 1961, to never assume in any narrated artifact.

The third reason is more subtle. It is that the alternative is exhausting. To read an audit report as a deposition is to commit to the work of reading between the lines. It is to ask who paid for the work, who commissioned the framing, who chose the questions, who decided which findings would be in the executive summary and which would be in appendix C. Most executive readers do not have the time, the inclination, or the protected attention to do that. They want a state. They are given a story.

The luxury group that did not know which side to grab

I spent some time, a few years ago, inside a global luxury group trying to harmonize a single technical standard across its subsidiaries. The standard was internal. It was supposed to be the same in Paris, in Milan, in Hong Kong, in New York. It was not.

Each subsidiary told me, over several months, a coherent version of how their implementation of the standard worked, why it deviated from the others, and why their deviation was the legitimate one. The CTO of one subsidiary explained that historical sourcing constraints made his version the original. The CTO of another explained that volume scale forced his version to be the reference. A third explained that regulatory pressure in his geography made his deviation a compliance requirement, not a deviation.

Four versions. Four internal coherences. None describing the same thing.

For months, the central architecture team tried to broker consensus. The brokering followed the natural pattern. Workshops. Comparative documents. Side-by-side tables. Joint sessions. The pattern produced something predictable. Each subsidiary, when asked to describe the standard, doubled down on its own version, because each subsidiary had a deposition to defend.

What ended the deadlock was not consensus. It was not a vote. It was not a synthesis.

It was a formal mandate.

A central architecture committee, convened with formal sponsorship from the group’s executive committee, ruled on the standard. Not by aggregating the four versions. By stating, with authority and on the record, what the standard would be from a defined date forward. The committee did not ask the subsidiaries which version they preferred. The committee stated which version would hold.

The result was immediate. The subsidiaries did not love it. Two of them filed structured objections. But the four narratives collapsed at the moment the standard became a mandate. The story each subsidiary had been telling itself, with full internal coherence, lost its narrative authority because a different authority had been formally constituted.

This is the deep mechanism. Narrators hold their narrative as long as nobody else holds anything. A formal mandate, properly sponsored and properly documented, takes the narration away from the narrators. The standard stops being told. It becomes stated.

The CEO who was watching this from a distance learned something he had not learned in twenty years of running the group. The fight was not between four technical positions. The fight was over who held the right to narrate the standard. The committee did not win on technical grounds. It won by becoming the legitimate narrator.

The detail that does not fit

In Bryan Singer’s film, Detective Dean Kujan listens to Verbal Kint’s story for the entire runtime. The story is internally coherent. The witnesses he can check check out. The narrative does not snag. Kujan validates, in his own mind, almost every beat of it.

What breaks the story is not a contradiction in the story. It is a detail in the room.

A coffee cup falls. The detective looks down. He looks at the bulletin board behind his chair, sees the names of cities and people that match too perfectly the names Verbal Kint just produced. The detail that was always in the room, that Kujan had been looking at and not seeing, suddenly becomes the only thing that matters.

The unreliable narrator does not get caught by interrogating the narration. He gets caught by stopping the interrogation and looking at what was always already in the room.

This is the operational lesson for a CEO reading a technical report. The most useful work is not to demand more reports, more audits, more sources, more triangulation. Triangulation gives you three coherent stories. The most useful work is to slow down at the detail that does not fit, the figure that does not align, the silence in the report on a subject that should obviously be there.

The technical artifact almost always contains the detail that does not fit. It is almost never in the executive summary. It is almost always in a footnote, in an appendix, in a sentence that begins with “we did not have access to” or “this dimension was out of scope”. The CEO who learns to read those sentences first learns more in fifteen minutes than the executive summary can give in two hours.

What changes when a CEO becomes Kujan

The transformation I am describing is not technical. It is a reading posture.

A CEO who reads a technical report as a state of the system will, over years, accumulate a series of decisions taken inside narratives constructed by people whose interests were never on the table. The decisions will look defensible. They will be auditable. They will be presentable to a board. They will also, in aggregate, slowly diverge from any state of the system that exists outside the narration.

A CEO who reads a technical report as a deposition stops doing that. Not because the CEO becomes paranoid. Because the CEO becomes a reader of the kind Booth described in 1961. A reader who assumes that every narrator has a position, and who treats the narration as a piece of evidence about the narrator as much as about the subject.

This posture does not require technical expertise. It requires a frame. The same frame the CEO already uses on memoirs, on press releases, on courtroom testimony, on competitive intelligence about other companies. The same frame nobody currently applies to the artifacts produced inside the CEO’s own organization.

Applying the frame inside the organization is what changes the decision quality. Not more audits. Not more dashboards. Not more cross-checking. A different kind of reading.

The moment a CEO becomes Kujan, the room changes. The narrators sense it. The reports start to be written differently because the writers know they are being read as narrators, not as instruments. The dashboards become more honest, because the green-yellow-red is no longer accepted as a measurement and is instead questioned as a framing choice.

This is the work. Not commissioning more. Reading what already exists with the grid that exists, and that we already use on every other narrated artifact we encounter.

Sources

Wayne C. Booth, The Rhetoric of Fiction, 1961 (2nd ed. 1983). University of Chicago Press. https://press.uchicago.edu/ucp/books/book/chicago/R/bo5965941.html
Wayne C. Booth, The Rhetoric of Fiction, 1961, digital archive (full text, see definition of reliable/unreliable narrator pp. 158-159). https://archive.org/details/rhetoricoffictio00boot
Unreliable narrator, encyclopedic article tracing the concept from Booth to its extension in film and television, 2026. https://en.wikipedia.org/wiki/Unreliable_narrator
Confirmation bias, encyclopedic article on the cognitive bias of selectively interpreting evidence consistent with prior expectations, 2026. https://en.wikipedia.org/wiki/Confirmation_bias
Authority bias, encyclopedic article on the tendency to attribute greater accuracy to authority figures, with reference to Milgram 1963, 2026. https://en.wikipedia.org/wiki/Authority_bias
The Usual Suspects, encyclopedic article on the 1995 film directed by Bryan Singer, screenplay by Christopher McQuarrie, 2026. https://en.wikipedia.org/wiki/The_Usual_Suspects

When Organizations Believe

2026-06-02T00:00:00+02:00

Some belief systems are not refuted by evidence. They feed on it. Every objection becomes a confirmation, every dissenter becomes a traitor, every external observation becomes part of the conspiracy. The non-technical CEO who cannot recognize the closed system inside his own organization will discover, too late, that his technology strategy stopped being a hypothesis years ago and turned into a doctrine that nobody can challenge.

Tartaria is a mud flood that never happened

Tartaria is the name of an empire that never existed and that, according to its believers, was deliberately erased from the historical record.

The story goes like this. A vast, technologically advanced civilization once spanned Eurasia, with cities built in a style now visible only in pre-1900 photographs of European and Russian capitals. Then, sometime in the nineteenth century, a global mud flood buried it. Streets were paved over its lower floors. Buildings that were too magnificent to credibly belong to the modern world are attributed to this lost empire. Historians, the believers say, are complicit in the erasure. Architects who built the great train stations and opera houses of the 1800s could not possibly have built them with the tools of their time. So they did not.

The theory works because it is generative. Every old photograph that shows a building with windows partially below street level becomes evidence. Every grand exposition site that was demolished after a single fair becomes a coverup. Every nineteenth-century structure that survived a war becomes a relic that was already there. The believer is not asked to find new evidence. He is asked to reinterpret existing evidence under a new key. The supply is unlimited.

The mechanism that interests me is not the content. It is the impossibility of refutation.

Show a believer the construction documents of an 1893 train station, archived, dated, signed by the architect. He will tell you the documents were fabricated. Show him the bricks, the foundations, the contracts. He will tell you the foundations are older than the documents and were repurposed. Show him a continuous photographic record from the period. He will tell you the photographs are part of the cover. There is no fact that the system cannot absorb. There is no datum that does not strengthen it.

This is not a problem of intelligence. Many of the people who believe in Tartaria are functional, articulate, and curious. The problem is structural. The belief is held in a form that no external evidence can ever penetrate. It is a closed system.

Anatoly Fomenko built a chronology in which most of history was invented

The intellectual scaffolding for Tartaria did not come from TikTok. It came from a Soviet mathematician.

Anatoly Fomenko, a topologist at Moscow State University, began publishing in the late 1970s a theory he called the New Chronology. He claimed that most of recorded history before the seventeenth century was either invented, duplicated, or dated incorrectly. Ancient Greece, the Roman Empire, biblical history, the medieval European chronologies, all collapsed into a much shorter period and were largely the work of later forgers. Jesus Christ, in his framework, lived in the twelfth century. The Mongol invasions were a misnaming of Russian Christianization. And so on.

Fomenko’s work was rejected by every recognized historian, archaeologist, linguist, and astronomer who examined it. The dating he proposed contradicts dendrochronology, ice cores, sediment records, independent astronomical observations, coin metallurgy, and the textual cross-references of dozens of unrelated traditions. None of this mattered to the theory. Fomenko’s framework had been designed, mathematically, in a way that absorbed contradiction by attributing it to the very forgeries it was trying to expose.

In the 1990s, the writer Nikolai Levashov took elements of Fomenko’s chronology and rewove them with Russian nationalist mysticism. The result was the embryonic version of what would later be called Tartaria. Internet forums in the 2000s, especially on Russian-language sites, kept the thread alive. Reddit picked it up around 2015 to 2016, attracted by the photographs of half-buried buildings. TikTok, after 2020, made it a meme. By the time it began appearing in mainstream feeds, the theory had a complete vocabulary, a stable iconography, and a clear list of acceptable historical periods.

What made Tartaria viable as a contemporary internet phenomenon was not its truth value. It was its productivity. The framework can be applied to any old building anywhere in the world. Each application produces engagement. Each new applier feels he has discovered something. The believer is not consuming a story. He is participating in the rewriting of history. It is fundamentally democratic. That, too, is part of its appeal.

A closed system rewrites its own history, not the world’s

Here is the part of Tartaria that should interest a CEO.

A flat-earther refuses to revise his model of the world. A Tartaria believer refuses to revise his model of the past. The difference matters. Flat-earthism takes a stable, observable claim about the geometry of the Earth and tries to override it. Tartaria takes the much softer terrain of historical interpretation and rewrites it in a way that locks itself in.

Most organizations are closer to the second case than to the first.

A company does not usually develop a closed system about its product or its market. The market answers back. Sales numbers move. Customers churn. Competitors win deals. The terrain is too noisy to sustain a fully closed doctrine.

But a company can develop a closed system about its own history. About why the stack was chosen. About why the architecture was designed the way it was. About what the previous CTO meant when he signed the original ADRs. About what the former auditor recommended. About the reasoning behind the SAP migration in 2017. Internal history is much softer than market reality. It can be rewritten without anyone outside noticing. And if the leadership team has been there long enough, the rewriting will be done in the leadership team’s favor.

The pattern looks like this. A choice was made years ago. It was defensible at the time. It became a doctrine over time. Newcomers who question it are told, “you weren’t here, you don’t understand the context.” Outsiders who question it are told, “you don’t know the history of this company.” Departing employees who questioned it are remembered, after the fact, as having had attitude problems. The choice itself is never re-examined on its merits. It has been moved, quietly, from the category of hypothesis to the category of identity.

You can audit this. You walk into the room and ask a simple question. “Under what conditions would we conclude that this choice was wrong?” In a system that is still falsifiable, somebody will answer. In a closed system, the question itself will be received as an attack.

Karl Popper drew the line in 1963 and most boards do not know it

In Conjectures and Refutations, published in 1963, Karl Popper proposed a criterion for distinguishing scientific theories from non-scientific ones. The criterion is not whether the theory is true. The criterion is whether the theory could, in principle, be shown to be false.

A scientific theory is one that takes risks. It says, explicitly, the world should look like this, and if instead it looks like that, then I am wrong. A non-scientific theory, in Popper’s view, is one that has been constructed in such a way that no possible observation could contradict it. Such a theory is not false. Worse than false, it has placed itself outside the conditions of being either true or false. It is unfalsifiable.

This criterion is rarely taught in business schools. It should be. Most strategic discussions in the executive committee of a non-technical CEO are conducted, implicitly, in the unfalsifiable mode. We have a great culture. Our brand is strong. Our infrastructure is modern. Our DSI knows what he is doing. These are not hypotheses. They are not designed to be tested. They are designed to be expressed.

The role of an external advisor, in the Popperian sense, is not to assert a competing truth. The competing truth would be just another doctrine. The role is to reintroduce the conditions of refutation. To take statements that have been held in the unfalsifiable mode and rewrite them in a form that could, in principle, be disconfirmed. “Our infrastructure is modern” becomes “if we ran a load test of this specification on this date, the system would respond within this latency.” The statement is now risky. It can be wrong. It is back inside the domain of inquiry.

Most CEOs do not understand that the value of an audit is not in the answer. The value is in restoring the question. The competent external never sells truth. He sells the conditions under which truth can again be produced internally.

Organizations ostracize the messenger before reading the message

There is a second mechanism that closed systems share with closed organizations. The treatment of dissidents.

In the sociology of organizations, a long tradition has examined how groups protect their doctrine not by refuting the dissenter, but by neutralizing him socially. The mechanism is well documented. It does not require malice. It requires only that the cost of engaging with the dissenter’s content exceed the cost of disqualifying his standing. When that threshold is crossed, the group reflexively redirects energy from the message to the messenger.

You can observe it in the executive committee. A new hire raises a concern about the data architecture. The committee does not engage with the concern. The committee asks who he is, where he comes from, why he is raising it now, who he has spoken to. The concern itself becomes secondary. By the time the conversation ends, the participant remembers the new hire’s tone, not the substance of what he said. The concern has not been refuted. It has been displaced.

This is exactly what happens to former believers when they leave a closed belief system. Ex-flat-earthers are described as having been bought, as having lost their nerve, as having succumbed to social pressure. Ex-Tartaria adherents are said to have failed to keep digging. The community does not engage with the substance of their departure. It rewrites them as renegades whose exit confirms the doctrine.

A CEO who wants to know whether his executive committee has become a closed system should look at how it treats its former dissenters. Not its current ones, who can still be persuaded to come around. Its former ones, who have left, been pushed out, or now work for competitors. If the leadership team describes them in moral terms rather than analytic terms, the system has closed.

The CEO’s quiet duty is to keep the doctrine falsifiable

A CEO does not have to dismantle his stack. He does not have to fire his DSI. He does not have to redo the SAP migration.

He has to keep his organization in the falsifiable mode.

This means tolerating, sometimes provoking, the periodic confrontation of the internal doctrine with external observation. It means having a clear answer to the question, “under what conditions would I conclude that our current technical strategy is wrong?” If the answer is “I would not, because the strategy is right,” the system is closed. If the answer is “the strategy would be wrong if we observed X, Y, or Z,” the system is still open. The difference is not trivial. It is the entire game.

A non-technical CEO is at higher risk than a technical one for one specific reason. His authority on technical choices comes from his trust in the people who hold them. Once those people have constructed a doctrine, he has no native instrument for cracking it. The doctrine sits inside the very team he has authorized to defend it. The system closes not because he wants it to, but because he has nothing left to push against it with.

The external mandate exists precisely to provide that instrument. Not a competing truth. A discipline. The discipline is to bring the doctrine back into the domain of inquiry.

Three tests for a stack that may have stopped being a hypothesis

You can run these tests yourself before bringing anyone in.

Pick the three statements your leadership team makes most often about the technical stack. Write them down. Now ask, for each statement, under what observable conditions you would conclude that the statement is wrong. If you cannot answer for at least two of the three, the stack has stopped being a hypothesis.

Pick the last three people who left your tech organization in the past eighteen months. Ask three of their colleagues to describe why they left. If the descriptions converge on character (he was difficult, she could not adapt, he was not aligned), and not on substance (he disagreed about X, she pushed against Y, he could not get traction on Z), the system has started to disqualify its messengers before reading their messages.

Pick the last technical decision your committee made unanimously without external input. Ask yourself what would have had to be true, six months earlier, for the committee to have made the opposite decision. If nothing would have changed the outcome, the decision was professed, not chosen.

Three signals do not prove a closed system. They suggest one. The work of keeping the doctrine falsifiable, year after year, is the quiet, unglamorous discipline of a CEO who does not want to wake up one day inside a Tartaria of his own making.

What Privateers Knew About Tech Contracts

2026-05-26T08:00:00+02:00

On October 7th, 1800, in the Bay of Bengal, two ships met in conditions that should have produced a quick result.

The first was the Kent, an East Indiaman owned by the British East India Company. Forty guns. Four hundred and thirty-seven men. Twelve hundred tons of cargo and crew, returning slowly under sail along a known trade route.

The second was the Confiance, a French privateer corvette under the command of a twenty-seven-year-old captain from Saint-Malo named Robert Surcouf. Eighteen guns. One hundred and fifty men.

By every reasonable calculation, the Kent should have won this encounter. It had nearly three times the men, more than twice the guns, and the structural advantage of a heavier hull built for global commerce.

It did not win. Surcouf boarded the Kent, took it, and brought the prize back to the French Île de France, today’s Mauritius, in November of that year. The British Admiralty subsequently put a price on his head.

The reason this attack was a celebrated military exploit and not a piracy charge punishable by hanging is the same reason most modern tech contracts go quietly wrong. It comes down to a piece of paper, dated and signed, with five specific elements on it.

The piece of paper was called a letter of marque. The five elements are what your prestataire’s contract is probably missing.

What a Letter of Marque Actually Was

Letters of marque were not, despite the romantic image, blank licenses to attack enemy ships. They were precise, bounded, and accountable instruments of state warfare conducted through private operators.

A letter of marque had five constitutive elements, and a letter that lacked any of them was either invalid or an instrument of piracy under another name.

The first element was a defined geographical scope. The Bay of Bengal, yes. The territorial waters of a neutral nation, no. A privateer who took prizes outside the geographical scope of his letter could be, and frequently was, prosecuted by his own crown for piracy. The geographical bound was not decorative. It was the substantive limit of legitimate action.

The second was a defined time horizon. Six months, a year, two years. Not indefinite. The mandate was an operation, not a position. When the letter expired, the privateer either returned to port for a new commission or stopped operating entirely. Continuing to take prizes after expiration was, again, piracy.

The third was a defined target. Which flags were lawful prey. Which were not. Neutrals, allies, and certain protected categories of merchant traffic were excluded. The list was explicit, not implicit. A privateer who attacked an unauthorized target was operating outside the letter, regardless of how rich the prize was.

The fourth was the share. The royal treasury took a percentage of every prize, fixed in advance, paid before the privateer touched his cut. This was not a tax on success. It was the price of the mandate itself. Without paying the share, the privateer was not a privateer. He was an unsanctioned operator, which is to say, a pirate.

The fifth was accountability at the return. When the privateer came back to port, he produced his logs, his prize manifests, his casualty records, and any evidence of his conduct on the voyage. The prize court reviewed everything. A privateer whose paperwork did not match his prizes, or who could not account for his conduct, lost his commission, his prizes, or his head, depending on the severity.

Five elements. Geographical scope. Time horizon. Defined target. Pre-agreed share. Mandatory accountability at the return.

This is what made the Kent a legitimate prize and not a crime.

The 1681 Ordinance

The five-element structure was not an oral tradition or a customary practice. It was codified in French law in August 1681, under the direction of Jean-Baptiste Colbert, in what became known as the Grande Ordonnance de la Marine, or simply the Ordinance of 1681.

The Ordinance was the first comprehensive maritime code in modern Europe. It covered shipping contracts, charter parties, sailor wages, marine insurance, and the law of prizes. The privateering provisions sat inside the prizes section, alongside the procedural rules for adjudicating captured property.

Colbert drew explicitly on Dutch maritime statutes from Amsterdam and Antwerp. He was not inventing a regime. He was systematizing a practice that already existed in fragmentary form, and giving it the legal weight that allowed French privateers to operate, and French prize courts to adjudicate, with predictable rules.

The Ordinance survived in modified form until the Declaration of Paris of 1856, which abolished privateering across most of Europe. For 175 years, the privateer-pirate distinction was a stable feature of European maritime law, and the five-element structure was its operational core.

What is interesting, for present purposes, is not the legal history. It is that the same five-element structure recurs, almost intact, every time a society needs to give private operators substantial autonomy without losing the ability to call them to account.

It recurs in modern military rules of engagement. It recurs in police use-of-force authorizations. It recurs in financial fiduciary mandates. It recurs in clinical trial protocols.

It does not, generally, recur in tech consulting contracts.

Why This Matters for Modern Tech Contracts

If you are a CEO who has signed a tech consulting contract recently, take it out and read the first page.

You are looking for five things. You will probably find two of them, partially.

You will find a list of services. Not a defined scope, but an enumeration of what is included. The difference is significant. An enumeration tells you what is in. A defined scope tells you what is in, what is out, and what the procedure is when something is in dispute. Most tech contracts enumerate. Almost none define.

You will find a duration, but it is likely to be either a fixed term with an automatic renewal clause, or an indefinite duration with a termination procedure. Neither of these is a time horizon in the letter-of-marque sense. A letter of marque ended on its expiration date and required a new commission to continue. A renewable contract ends only when one party affirmatively decides to end it, which means it has a default toward continuation. The two structures produce different incentives, and the default-toward-continuation structure produces drift.

You will probably not find a defined target in the operational sense. You will find a description of the work. Whether the work is succeeding, however, is rarely defined in the contract itself. It is left to the parties to assess at periodic reviews, which means it is left to relational dynamics rather than contractual structure.

You will find a price, but the price is rarely a share of outcomes. It is usually a fee for time and effort. This is not a moral problem. It is a structural one. A fee for effort produces an incentive to produce more effort, regardless of whether more effort is what is needed. A share of outcomes, on the other hand, produces an incentive to produce outcomes efficiently. The privateer’s share was the latter, and it was the price of the mandate.

You will find some form of reporting, but you are unlikely to find mandatory accountability at the return, in the sense of a defined moment when the relationship is reviewed against its full record and either renewed, modified, or closed. Most tech contracts have ongoing reporting and quiet attrition. They rarely have a clear moment when everything is laid on the table for review.

In other words, most tech consulting contracts have a contract structure that, if you compare it to the letter of marque, is missing three of the five constitutive elements.

The Three Questions Before You Sign

If you do not have time to redesign your prestataire contracts from scratch, there are three questions you can ask before signing that will tell you whether you are looking at a mandate or a cohabitation.

The first question is about scope. Not “what services are included?”, but “what happens when something is in the gray zone, and how do we know in advance?”. The answer should not be “we discuss it as it comes up”. The answer should be a procedure. If your prestataire cannot describe the procedure for resolving scope ambiguity in fewer than three sentences, the scope is not defined.

The second question is about ending. Not “what is the duration?”, but “how do we know we are done, and what is the test for that?”. The answer should be a state, a deliverable, or a date, with the test specified in advance. The answer should not be “when the engagement no longer adds value”, because that test produces continuous mission creep without a single moment of clear completion.

The third question is about review. Not “how often do we have status meetings?”, but “when do we lay everything on the table and decide whether to continue?”. The answer should be a calendar entry. It should not be “we review continuously”, because continuous review without a forcing function produces continuous reporting without continuous decision.

A contract that survives these three questions cleanly is rare. It is also, almost without exception, a contract that produces good outcomes for both sides.

A contract that does not survive these questions is not necessarily fraudulent or even badly intentioned. Most of the time, it has been written by people who have always written contracts that way, and who have not had the occasion to ask whether the structure they have inherited produces the outcomes they want.

The three questions are uncomfortable to ask. They are also the cheapest piece of due diligence available to a CEO before signing a long-term tech contract.

Pirates of Modernity

The privateer-pirate distinction is not, even in its historical form, a moral distinction. It is a structural one.

A privateer with a valid letter of marque, attacking a permitted target in the permitted area within the permitted time, was a legal combatant. The same person, doing the same act, the day after the letter expired, was a pirate, subject to summary execution.

The act was identical. The structure had changed.

In modern tech consulting, the same person, doing the same work, can be operating either as a mandataire under a defined commission or as something closer to an embedded resource without a clear sponsor. The work might look identical from the outside. The structural posture is entirely different.

The privateer-pirate distinction in modern terms does not have a hanging at the end. It has, instead, a slow erosion of accountability, a quiet inflation of scope, and a gradual conversion of what was meant to be a mission into what becomes, in practice, a permanent annex to the organization.

This is not a catastrophic outcome. It is an expensive one. It is also a quiet one, which is why it goes unnoticed until someone, usually a new finance director or a new CEO, starts asking why a particular prestataire has been on the books for six years and what, exactly, the original mandate was.

The answer is often that the original mandate has long since been completed, and what remains is a residual relationship that nobody has the political energy to terminate cleanly.

The Art of the Return

There is one final element of the letter of marque that does not appear on the document itself but that runs through the entire institution.

A privateer was supposed to return.

The voyage had a beginning, a duration, and a return to port. The return was not optional. It was the moment when accountability was rendered, the prizes adjudicated, the share distributed, and the next commission, if there was to be one, negotiated on the basis of what had just been done.

A privateer who did not return became, by default, a pirate. Not because anyone declared him so, but because the structural conditions of his legitimacy required the return to close the loop.

Most modern tech mandates have no equivalent return.

The work continues, the invoices continue, the meetings continue, but the moment of accountability, the moment when everything is laid on the table and the question is asked whether the original mandate has been fulfilled, never comes.

The simplest fix is to put it on the calendar before the work begins. Six months, twelve months, eighteen months. A specific date. A defined review. An explicit decision to continue, modify, or close.

This is not a complication of the relationship. It is the frame that makes the relationship a mandate at all.

If you are signing a tech consulting contract this quarter, find the return date.

If it is not in the contract, write it in.

Saturation Is Not the Problem

2026-05-19T10:00:00+02:00

A CEO once handed me an eighty-page IT audit and asked what I thought of it. I read it on the train home. Every page was technically correct. The taxonomy of incidents was rigorous. The vendor benchmark covered the right comparators. The recommendations matched the standards.

I told him the report was excellent and useless. He had paid for it. He filed it. He kept calling for committees on the same subject.

That conversation is the reason I want to talk about Frank Herbert and four films.

Four Dune adaptations, one lesson

Dune, Frank Herbert’s 1965 novel, has been adapted four times depending on how you count. Each attempt tells you more about reports than about science fiction.

Alejandro Jodorowsky tried first, between 1974 and 1976. Fourteen months of pre-production. Moebius drew thousands of storyboards. H.R. Giger designed the Harkonnen world. Pink Floyd were attached to score one section, Magma another. Salvador Dalí had agreed to play the Emperor for a fee that became part of the pre-production legend. Orson Welles was set for Baron Harkonnen. Mick Jagger was Feyd. The screenplay grew into a book several kilos thick that circulated through studio archives across Hollywood for years.

The film was never shot. Studios refused to commit. Two million dollars vanished into a project that ended on a dining table in Paris. Frank Pavich’s 2013 documentary Jodorowsky’s Dune is the public record of this failure. And yet. Star Wars borrowed from those storyboards. Alien borrowed Giger directly. Blade Runner used the visual grammar. The Fifth Element pulled from Moebius’s costume drawings. Prometheus revisited the biomechanical lineage.

The work survived. The decision was never made.

David Lynch shot Dune in 1984 because someone had to. Universal had bought the rights, signed distribution, locked release dates. The Jodorowsky failure had taught them caution about Dune projects, which is precisely why they wanted theirs done quickly. Lynch was hired. Lynch delivered. Lynch disowned the result and refuses to discuss it to this day.

The SyFy mini-series Dune in 2000, directed by John Harrison, is what completists love. It is faithful. It is exhaustive. It includes the Bene Gesserit politics, the gom jabbar test, the Litany Against Fear in the right scene, an Arrakis you can almost map. Children of Dune, the second mini-series in 2003, has lines that genuinely land, including a moment where Leto II recognises his father in the desert wind. The score by Brian Tyler does work the visuals never quite reach. But the whole thing is flat. Everything is there. Nothing strikes.

Then Denis Villeneuve gives us five hours of cinema across Dune (2021) and Dune: Part Two (2024) to cover the first novel in full. Five hours. One book. Not a minute committed to the sequels. He understood that the good adaptation is the one that knows when to stop.

You may have already noticed that I have not described any of these as a film. They are reports. About reports.

Frank Herbert, the saturated source

The book itself was written by a man who spent six years documenting before he wrote a first chapter. Botany of arid biomes. Hydrology. Comparative theology of monotheistic systems. Geopolitics of oil economies. The biology of camels and other water-conserving mammals. Six years of stacking material.

The result is a six-hundred-page novel saturated with invented terminology, unpronounceable proper names, fictional institutions, footnotes inside the narrative, appendices that rival the main text in length. Total saturation. The Bene Gesserit, the Mentat training, the Kwisatz Haderach prophecy, the Atreides line, the Harkonnen baroque, the Fremen sietches, the spice that grants prescience and shortens lives, Shai-Hulud rolling beneath the dunes.

And yet. The book opens on the gom jabbar test, where Paul Atreides keeps his hand inside a box of induced pain under the watch of a Bene Gesserit, and the dread passes before any explanation lands. A few chapters later it is the dust in the mouth, the dry heat of Arrakis, the silent menace of an institution we have not yet seen act. The fear is felt before it is named. Something passes that no Wikipedia summary will ever transmit.

Saturation is not the problem. Intention is.

Most IT reports I have read in twenty years of working in technology fail this test in ways that have nothing to do with their length.

The corporate version

Every report I have read sits somewhere on this spectrum.

Some are Jodorowsky reports. Brilliant, expensive, never decided on, leaking influence into other places where the original author has no name. The work is real. The decision never happens. Years later you spot the strategy in a competitor’s roadmap.

Some are Lynch reports. Filmed because the cameras were rolling and the studio needed something to release. Disowned by their own authors after delivery. The agenda preceded the question. The deliverable could not say what it had been built to say.

Some are SyFy reports. Faithful to the brief, technically complete, evoking nothing, leaving the executive holding two hundred pages and no decision. Everything is there. Every section is correct. The reader closes the document with no next action and a vague sense that something has been done.

The one I describe to clients most often is the Villeneuve report. The one that knows where to stop. The one that takes five chapters where the matter needs five chapters and refuses the temptation of the sixth.

Three lived examples

Three reports from the field. None of them named. None of them recognisable.

The first is an audit commissioned not to understand a problem but to remove a consultant. The previous consultant had done the work, said what needed to be said, and politely declined to endorse a personal initiative of the chief executive. He had to go. The audit was the instrument. It was produced. It was signed. The consultant was ejected. The investment decision underneath, which was what was actually broken, kept costing money and going nowhere. The report was a Lynch. It existed because the cameras were rolling. The director knew it.

The second is a several-month engagement where the brief looked organisational and the actual mandate was political. Build the dossier that designates the IT team as the source of every problem. The IT team would become the fuse. Someone needed to be the fuse. The report was produced. The fuse blew. Several engineers left. The product governance, the unstaffed finance steering, the over-promising commercial pipeline, all stayed in place. The CEO had seen sharply. He had only allowed himself to see in one direction.

There is a particular trap in seeing too clearly. Herbert calls it prescience and treats it as a curse rather than a gift across the entire Dune saga. Seeing all paths is not seeing. Seeing one path very sharply is worse. It looks like clarity. It is selection. The Litany Against Fear in the book is recited by characters about to lose themselves to exactly this kind of false vision. Most CEO dashboards are exercises in the same false vision dressed in green and red.

The third is a luxury group. Several months of analysis and conceptualisation. A real report, dense, abundant, with intention behind every section. A few weeks after delivery, an internal IT director had rewritten the executive summary in their own name, edited the cover, and circulated the version upward. The internal version was thinner, less coherent, but it carried the right signature. It checked the box. The original kept gathering dust. The plagiarised version made decisions that the original would have refused to permit.

Lynch eating Jodorowsky. The richer work existed. It was replaced by a degraded version that served the photo opportunity.

The contrarian recommendation

The standard advice given to executives sounds clean. Ask for more visibility. Map everything. Commission a full audit. Put every option on the table before deciding.

That advice is what paralyses you.

The more complete the report, the less the CEO decides. The more committees come back, the less they cut. Seeing every possible path means losing the ability to choose one. The Bene Gesserit knew this about prescience. It is not a tool. It is a hall of mirrors that absorbs the operator. The Kwisatz Haderach in Dune is not the answer to a problem of vision. He is the consequence of trying to engineer total vision in the first place, and Herbert spends four sequels showing what that costs.

What you actually need is a report with intention. A report that closes questions instead of opening them. Dense where decision needs density. Short where decision needs no further air. Saturated, in the spirit of Herbert, only where saturation evokes something the reader has to feel before they can decide.

Privateer does not write the report you can plagiarise. It writes the report that stops where the next action begins. It refuses the eighty pages whose only function is to look like enough to justify the line item. It refuses the audit that exists because someone has to take the fall.

The good report names the next thing to do and then stops talking.

What to ask of your next report

Frank Herbert spent six years documenting and then wrote a novel that closes. The novel ends. There are sequels for those who want them, but the first book finishes its sentence. That is the discipline of intention.

Most reports never finish their sentence. They trail off into recommendations for further analysis. They list considerations to be examined. They suggest committees to revisit them.

That is the spice that paralyses. That is what extends the meeting, narrows the executive, and ends the quarter with the same question still open.

If your next IT or strategy report does not name three or four decisions you can make this quarter, it is not finished. The brilliance of the analysis is not the issue. Eighty rigorous pages can be empty. Twenty ruthless pages can decide the year.

Ask for intention. Ask the author what they want you to do after reading. If they cannot answer in two sentences, the report is not for you. It is for the file.

The desert in the book is felt before it is described because Herbert wanted you to feel it. The five hours of Villeneuve’s two-part adaptation are what they are because Villeneuve refused to film what could not be filmed yet. The Jodorowsky storyboards still influence cinema half a century later because someone refused to dilute them into something studios could approve.

The reports that work for executives are not the longest. They are the ones whose author wanted the executive to do something specific.

Saturation is not the problem.

Intention is.

The Accusation Already Written

2026-05-12T10:00:00+02:00

There is a principle in criminal procedure that most people take for granted without understanding what it actually protects.

The accused has the right to know the accusation. Not at the verdict. Not during deliberation. Before the hearing begins. They have the right to examine the evidence, to call their own witnesses, to confront the opposing testimony, to respond to each element of the case against them.

If you strip this principle away, you do not get a faster trial. You get a ceremony that looks like a trial and produces a conviction every time.

I think about this when I walk into an organization and discover a decision that has already been taken about a technical situation where only one version of events has been heard.

The one-sided hearing

The most common configuration I encounter when I enter a technical mission in crisis is this: the executive team has built an interpretation of what is going wrong, they have a candidate explanation, they have a candidate responsible party, and they are now looking for the independent expert who will confirm it.

They do not describe it this way. They describe it as wanting a diagnosis. But the scope of the diagnosis has already been narrowed. The questions that would open alternative explanations are not on the agenda. The people who would provide the opposing testimony are not in the meeting.

I have sat through executive briefings where the CEO described the situation, the COO confirmed the COO version, the CFO added a financial angle that supported the same reading, and the entire room agreed on what needed to happen next, while the technical team responsible for the execution of the contested decision was not in the building, had not been consulted, and would only learn about the verdict when the implementation order arrived.

This is not a conspiracy. It is the default configuration of organizational decision-making in the absence of procedural discipline. The people with the most access to executive attention get to tell the story. The people with the least access to executive attention have the story told about them.

The problem is not that the story being told is wrong. Sometimes it is exactly right. The problem is that there is no procedure for finding out whether it is right before a decision based on it is executed.

Charge of proof, inverted

In a proper trial, the burden of proof sits on the accusation. The prosecution must demonstrate guilt beyond reasonable doubt. The defense is not required to prove innocence; the absence of proof against them is sufficient.

Inside organizations, this principle is almost universally inverted.

A technical team produces a system that is performing below expectations. A decision is contemplated to replace the vendor, terminate the partnership, restructure the team, or change the technical approach. The burden of proof, in practice, sits on the technical team to prove that the current situation is acceptable, that the expectations were unrealistic, that the external pressures were unmanageable.

They are not asked to defend a specific accusation. They are asked to justify their continued existence against a diffuse sense that things should be going better.

This is a structurally losing position. You cannot prove the counterfactual. You cannot demonstrate what would have happened if a different decision had been made two years ago. You cannot adequately contest an accusation that has never been formally articulated.

The accused technical team does what anyone in that position does. They produce defensive documentation. They explain context that nobody asked to hear. They preemptively justify choices that may or may not have been the actual source of the problem. And they lose, because they are fighting against a verdict that was reached before they understood they were on trial.

The auditor I encountered by accident

Some years ago, I was leading a technical team inside an organization going through a governance crisis. A minority shareholder had commissioned an independent audit to understand what was actually happening in the business.

The audit was conducted professionally. The auditor interviewed the executive committee, mapped the formal decision-making structure, reviewed the financial data, and built a picture of the organization from the vantage point of its governance documents and its leadership team.

My team was not mentioned in those interviews. We were in a different building, working on a different floor, isolated from the political center for reasons that had more to do with internal positioning than with technical necessity. The auditor had no reason to know we existed, and nobody in the governance reviews had any incentive to surface our existence.

One afternoon, the auditor came to the building for a coffee break. Someone happened to mention my team. He came to find me. We spoke for fifteen minutes.

At the end of that fifteen-minute conversation, he called his assistant from my office, and canceled every meeting he had scheduled for the rest of the afternoon.

The audit’s conclusions changed. Not because my testimony was privileged or definitive. Because it was a version of events that no one at the governance level had any interest in surfacing, and the auditor recognized immediately that the picture he had been building was structurally incomplete.

The most useful information about what is actually happening inside an organization is almost never where the formal inquiry is looking for it. It is in the rooms nobody thought to check, with the people nobody thought to call.

When the process is perfect and the outcome is unjust

There is a specific kind of failure mode in organizational decision-making that looks like success from every procedural angle.

The process was followed. The committee was consulted. The documents were produced. The decision was ratified by the appropriate governing body. Nothing was skipped. Nothing was expedited. Nothing was irregular.

And someone walks out of the outcome with a completely legitimate sense that they have been treated unjustly.

I have seen this repeatedly in technical organizations. A procurement process that selected the lowest bidder over the incumbent partner who knew the system, because the procurement rules rewarded price over capability transfer. A reorganization that respected every applicable labor protection while eliminating the person who carried two critical systems in their head, because the formal criteria did not value tacit knowledge. An investment committee that approved a project because it ticked every box, while ignoring the weak signals from the operational team that the assumptions were wrong.

In each case, the rigidity of the process produced the illusion of neutrality. The decision was “not personal” because the process had been followed. The outcome was “not anyone’s fault” because every step was documented.

The procedural integrity of the decision was used, implicitly, to avoid the substantive judgment that someone in authority needed to make and did not want to make.

This is how organizations avoid accountability for decisions that require it. The process absorbs the responsibility. Nobody has to say: I chose this, and here is why, and if it is wrong it is wrong on me.

The designated fuse

In electrical engineering, a fuse is a deliberately weak point in a circuit. It is designed to fail first so that the more expensive, harder-to-replace components behind it survive.

When a fuse blows, the electrician’s first question is not “why did this fuse fail?” The question is “what upstream condition forced this component to sacrifice itself?”

Organizations use people as fuses.

A project goes badly. The explanation converges on a single individual or a single team, usually the one that arrived most recently, or that had the least political cover, or that was in the room last when the failure became visible. That person absorbs the organizational verdict. A reorganization follows. The problem is declared solved.

Six months later, a similar failure occurs. A different fuse blows. The cycle repeats.

The reason it repeats is that the fuse is not the cause of the failure. The cause of the failure is further upstream, in the governance configuration, in the decision-making protocols, in the political alignment that forced the fuse into a role it was never equipped to succeed in. The fuse fails because something else, structurally, could not hold.

When the fuse is replaced, the underlying condition remains. The next fuse fails the same way.

Recognizing this pattern is difficult from inside the organization, because everyone upstream of the fuse has a direct interest in the fuse being the explanation. The explanation that blames the fuse protects the circuit behind it. The explanation that audits the circuit threatens the positions of everyone who designed it.

This is not a moral failure. It is a structural one. It requires, almost by definition, someone from outside the circuit to see what is actually happening.

What the right to confrontation actually does

The right to confront one’s accuser, one of the oldest principles in adversarial legal systems, is not primarily about fairness to the accused. It is about the quality of the evidence that reaches the decision-maker.

Testimony that cannot be cross-examined is structurally less reliable than testimony that can. Not because the witness is lying. Because the full picture of what the witness knows, and does not know, and how the information came to them, is only visible when the testimony is contested.

In corporate decision-making, the equivalent principle is almost never applied. The technical team’s version of events is heard, if at all, in a separate meeting from the executive team’s version. The consultant’s report is received. The vendor’s pushback is dismissed as self-interested. Each source of testimony is evaluated in isolation, by people with their own prior commitments, without the discipline of contradictory examination.

The decision that emerges from this process is not better than the best testimony. It is an average of the available testimony, weighted by the political influence of each source.

In a courtroom, this would be recognized immediately as a miscarriage of procedure. In a boardroom, it is the normal operating mode.

Who convenes the absent

When I enter a technical situation in crisis, the first thing I look for is not who is being accused. It is who has not been heard.

The auditor who found my team by accident is the template for how this work actually gets done. You cannot trust the formal inquiry to surface the most important testimony, because the formal inquiry is structured by the same political dynamics that produced the crisis in the first place. The people with the best view of the actual mechanics of the failure are almost always the people the formal inquiry has the least incentive to interview.

You have to go find them. Not as an afterthought, not as a completeness check, but as the primary activity of the diagnosis. The verdict that reaches the executive committee should reflect every material version of events, examined under contradiction, with the procedural discipline that is mandatory in courts and optional in corporations.

This is not a neutral activity. It changes the outcome. In many of the situations where I have done this work, the conclusion that the executive team initially favored was not the conclusion that held up under full examination. A vendor was not replaced. A team was not dissolved. A reorganization was halted. The actual cause was further upstream than anyone wanted to look.

The cost of not doing this work is not only that innocent parties take the fall. It is that the organization learns nothing. The circuit continues to blow fuses. Each verdict confirms the previous bias. The institutional memory of what actually goes wrong degrades over time, because every autopsy is conducted by the same people with the same interests.

The value of the adversarial principle is not that it is fair. It is that it produces decisions grounded in the strongest available evidence. That value does not disappear when you move from the courtroom to the boardroom. The requirement for it does not diminish because the defendant is a technical team instead of a citizen.

It just becomes optional. And in its absence, the verdict is written before the hearing begins.

The pattern of stories told about teams rather than with them is the inversion of Looking Inside the Walls. The external vantage point required to surface unheard testimony is the argument of The Pit Wall and the Cockpit.

The Leica Eye

2026-05-05T10:00:00+02:00

Arnaud said it during an internal meeting last week. We were reviewing a deliverable, talking about quality tolerances, the gap between what looks right and what is right. He wasn’t making a point. He was thinking out loud.

“The imperfection that creates perfection.”

I wrote it down. Not because it was clever. Because it described something I’d been circling around for months without finding the right frame.

In Wetzlar, Germany, Leica assembles every lens by hand. Not as a marketing claim. As a manufacturing constraint. The tolerances involved in high-end optical engineering mean that two lenses of the exact same model, built on the same line, by the same technicians, will not produce exactly the same image. Photographers know this. They call it the “Leica rendering.” An organic quality to the image. Slightly warm, slightly imperfect, immediately recognizable. Not a flaw. A signature.

No image correction algorithm reproduces it. Because it isn’t a setting. It’s the accumulated result of specific imperfections in that specific lens, ground by that specific hand, on that specific day.

What the algorithm corrects away

Take the same scene. Same light, same frame. Shoot it with an iPhone and with a Leica M.

The iPhone gives you a perfect image. Sharp everywhere. Colors corrected. Sky enhanced. Skin smoothed. Fourteen algorithms decided for you what you wanted to see. The result is technically excellent. It is also functionally identical to the image anyone else would have taken with the same phone, in the same conditions.

The Leica gives you your image. With the grain of that moment. The sharpness of that particular lens, not another. The depth of field you chose, not the one a computational model calculated as optimal.

One produces consensus. The other produces point of view.

I keep thinking about this when a CEO shows me an IS audit he received from a previous provider. Clean. Complete. Twenty pages. All the right sections. All the expected recommendations. And this strange feeling that it could be the audit of any company of the same size, in the same sector.

The audit is technically correct. The recommendations are defensible. Nothing is wrong. But nothing is specifically right either. The report describes an archetype, not an organization. The algorithmic correction smoothed away everything that made this company’s situation unique.

The photographer William Eggleston once said something about the democratic forest: everything in the frame has the same value. The gas station and the cathedral get the same attention. That’s what a good diagnostic does. It doesn’t privilege what the framework says should be important. It reads the whole frame with equal attention and lets the actual situation determine what matters.

Most IS audits do the opposite. They arrive with the framework already loaded. The equivalent of an iPhone’s computational photography: before the shutter clicks, the software has already decided what the image should look like.

The photocopy bias

In 1928, Alexander Fleming left a petri dish open by mistake before going on holiday. A mold contaminated the bacterial culture. The bacteria around the mold died. Any rigorous lab technician would have discarded the contaminated dish, sterilized the bench, and started the experiment over.

Fleming looked at it.

What followed was penicillin. Millions of lives saved. Born from an error that any automated protocol would have corrected before it became visible.

The discovery wasn’t the accident. The discovery was the gaze. Someone who saw in the anomaly something other than a problem to fix.

I think about Fleming when I watch what’s happening with generative AI and the knowledge cycle. Models trained on content. That produce content. Ingested by other models. That produce more content. Each iteration smooths the outliers. Eliminates the accidents. The distribution tightens around an artificial center of gravity that nobody chose.

This is the photocopy bias. Copy a text. Copy the copy. Copy that copy. After twenty iterations, the fine details are gone. What remains is legible, but it’s no longer the original text. The signal-to-noise ratio didn’t improve. The signal converged toward noise.

In IS diagnostics, I see it emerging. Audits starting to look alike. Not because organizations look alike. Because the tools look alike. Same analysis frameworks. Same pattern libraries. Same standard recommendations. “Refactor your technical debt.” “Migrate to the cloud.” “Implement data governance.”

Fine. But the technical debt in this particular organization exists because a CTO who left three years ago made a political decision disguised as a technical one, and nobody has dared to revisit it since. The real question isn’t in the code. It’s in the org chart. In a meeting that never happened.

No model trained on ten thousand cases sees that. It’s too local. Too contextual. Too human. The algorithm corrected it away.

What this looks like in an IS audit

I was called into a mid-sized industrial company last year. A hundred and twenty people. Three different providers had audited their IS in two years. Each one recommended refactoring the in-house ERP. Each report was thorough, well-structured, defensible. Each one arrived at the same conclusion through the same analytical path.

The CEO was hesitant to start a fourth project. Not because he doubted the diagnosis. Because something felt off and he couldn’t name what.

We spent two days on site. Not in the code. In the corridors. With the teams. The ERP worked. Badly documented, fragile in places, but it ran. The real issue was an architecture decision taken in 2021 by a CTO who had left the company six months after making it. A political choice dressed as a technical one. Everyone knew. Nobody had written it down.

The three previous audits had all seen the symptoms. Fragile ERP, inconsistent architecture, slow deployments. They’d all applied the standard pattern: the system is old, refactor it. None of them had asked why the system looked the way it did. Because the answer wasn’t in the system. It was in the history of the organization, in a decision that lived in the memory of three people who were still there but had never been asked.

We didn’t recommend refactoring. We recommended a conversation. Between the CEO, his operations director, and the dev team. Three hours in a room. With the real question on the table: do we own this inheritance and build on it, or do we start over, but knowing why.

Six months later, the system is running on the same base. Stabilized. Documented. The cost of a migration that didn’t need to happen was saved entirely.

That’s the Leica eye. Not sharper than the algorithm. Differently focused. Tuned to what makes this particular situation unlike any other, even when the surface pattern says otherwise.

The three previous audits weren’t bad. They were generic. They did exactly what they were designed to do: apply a proven framework to an observable situation and produce a defensible recommendation. The problem is that defensible and correct are not the same thing. A recommendation can be perfectly reasonable and entirely wrong for this specific organization, at this specific moment, given this specific history.

The Leica doesn’t take better photos than the iPhone. It takes different ones. Ones where the photographer’s judgment is the primary variable, not the algorithm’s optimization target.

The tool versus the oracle

I should be direct about something before anyone reads this as an anti-AI argument. I use AI tools. Every day. For synthesis, for modeling, for accelerating the parts of the work where speed doesn’t compromise quality. The carpenter who uses a power drill doesn’t apologize for not drilling by hand.

But the carpenter doesn’t ask the drill where to put the hole.

The distinction matters. AI as a tool in the hands of a practitioner is formidable. AI as an oracle replacing the practitioner is something else entirely. It confuses computational power with contextual understanding.

When I build a diagnostic for a client, AI helps me process information. It doesn’t help me sense that the CIO and the CFO haven’t spoken in six months. That the cloud migration was sold by a salesperson before an architect validated it. That the real problem isn’t the legacy system but the fear of touching something that still works.

That comes from accumulated experience. Hundreds of situations read, reread, sometimes gotten wrong. A filter that nobody could train because the data doesn’t exist anywhere. It lives in the meeting room. In the unspoken. In the look on the CEO’s face when someone says the word “overhaul.”

An iPhone gives you a perfect photo. A Leica gives you one that only you could have taken.

The question for the person commissioning the audit isn’t which tool was used. It’s whether the person behind it was looking through a calibrated lens or just pointing and shooting.

There’s a reason Leica still assembles lenses by hand in 2026, while every economic incentive in the world pushes toward automation. Some things cannot be produced by optimizing for the average. The specific, the contextual, the particular: these require a human hand that has done this enough times to know exactly why this time is different.

Your IS doesn’t need a better algorithm. It needs someone who has looked through enough lenses to know which one fits.

The view from outside the cockpit that the driver structurally cannot have is The Pit Wall and the Cockpit. The IS equivalent of a building where nobody has looked inside the walls is Looking Inside the Walls.

The Pit Wall and the Cockpit

2026-04-28T10:00:00+02:00

In Formula 1, there are always two versions of the race happening simultaneously.

The version on the pit wall: tire degradation curves updated every sector, gap to competitors measured to the hundredth of a second, undercut windows calculated by simulation, weather models updated every few minutes.

The version in the cockpit: the rear end stepping out under traction on turn nine, the steering vibrating differently since lap thirty-two, the car feeling planted or loose in ways no sensor fully captures, the competitor’s line through the last corner suggesting he’s managing something.

These are not the same race. They are complementary views of the same race. Neither is complete without the other.

The decisions that win championships are not made from the pit wall alone. They are made in the gap between these two readings — in the quality of the interface between the engineer with the data and the driver with the feel.

I think about this constantly when I audit an information system.

The undercut and the timing of decisions

The undercut is one of the more elegant strategic concepts in modern Formula 1, and it illustrates something important about how good technical decisions work.

A driver is running second, unable to pass on track. The gap to the leader is stable but not closing. On raw pace, they’re equal. The race appears locked.

The pit wall brings the second car in for fresh tires several laps before the normal window. The driver exits with a ten-second deficit but considerably faster tires. He attacks. He posts fastest lap. Fastest lap. Fastest lap again.

When the leader finally pits, he comes out behind.

The position changed in the pit lane, not on track. The decisive move happened before anyone in the grandstands understood that a move was being made.

What makes the undercut work is not speed. It’s the decision being made before the situation becomes obvious. By the time the undercut window is apparent to everyone — to the commentators, to the rival team, to the fans — it’s already too late to execute it cleanly.

The teams that win on strategy are the ones that decided before the window opened. Not because they had better data. Because they acted on what the data was beginning to show before the picture was complete.

Technical organizations fail in exactly the inverse way. They wait for the situation to be unambiguous. They want the full diagnosis before committing to treatment. By the time the technical debt, the architectural limit, or the team capacity problem is obvious to everyone in the room, the window for a clean resolution has usually closed. What remains is a forced pit stop under pressure, with cold tires, in traffic.

What thresholds don’t tell you

There is a recurring argument I have with technical leaders that I now recognize as structurally identical to the threshold-versus-pattern debate in monitoring.

The threshold argument: if a metric exceeds a value, trigger an alert. Simple, auditable, defensible.

The pattern argument: monitor the shape of what’s happening, not just whether a number has crossed a line.

On a mission for a startup that was in the process of fundraising — brought in by a business angel, the company had significant technical problems they weren’t fully seeing — I built a complete monitoring infrastructure. The ability to ingest every available metric, store it, display it, correlate it.

The CEO wanted threshold-based alerts. Clear, readable, binary. Something exceeds X, notify me.

I built something different. Behavioral detection. Patterns. Graphs that showed the form of what was happening, not just whether a number had crossed a boundary.

He never fully understood why.

His engineers did.

The day they had scaling problems, the pattern had been visible in the graphs for six hours before any threshold was breached. The team could point to exactly what was forming, how it was forming, and why. They could act on the mechanism, not just observe the symptom.

A threshold tells you the tire is hot. A pattern tells you how it’s going to fail and approximately when.

In F1, the difference between a proactive pit stop and a tire failure on the main straight at 300 kilometers per hour is often the team’s ability to read the degradation curve rather than wait for a temperature alert.

The decision that isn’t made where it appears to be made

Hamilton. Silverstone. 2013.

The British Grand Prix, late in the race. Mercedes kept Hamilton out three laps longer than the data suggested was safe. The rear-left tire was degrading faster than the models predicted — an issue that would affect multiple cars that afternoon.

The tire failed at speed on the Hangar Straight.

The data showed the tire was holding. The car wasn’t holding. These are different statements, and they diverged with consequences.

I’ve been brought into COMEX presentations where the data was telling a story. Clean, coherent, well-formatted. The numbers supported the decision the room had already decided to make.

The problem: I had the context. The actual data. Evidence that showed what was being constructed in that room — not an honest reading of the situation, but a political narrative dressed as analysis. The goal was to win an internal argument, not to act in the company’s interest.

What struck me was not the maneuver. What struck me was that it worked.

It worked because the executives in the room didn’t know what questions would break the story. They didn’t know what data existed that the presentation had chosen not to show. They couldn’t tell the difference between a dashboard that reflected reality and a dashboard built to reflect a decision already made.

The pit wall was deciding. On filtered telemetry.

(I should be precise about what I mean here: this isn’t necessarily cynical. People often genuinely believe the story they’re constructing. The mechanism is more subtle than deliberate fraud. When you’ve spent eight months building a case for an architectural decision, you start reading data through that lens. The confirmation isn’t fabricated — it’s selected. The effect is the same. The tire isn’t holding.)

In that particular case, I had already put the necessary things in place. The political decision didn’t change the technical outcome. But it shouldn’t have required that kind of preparation. The failure was upstream — in a governance structure that couldn’t distinguish between telemetry and a story about telemetry.

When the safety car comes out

One of the most operationally revealing moments in Formula 1 is the safety car period.

The race neutralizes. Every car closes up. Teams have ninety seconds, perhaps less, to make a decision: pit and take fresh rubber, or stay out and hold position.

The teams that perform consistently well in these moments share one characteristic: they’ve already made the decision, before the safety car came out.

Not the specific decision for this specific race. The framework. The decision tree. The predefined criteria that determine when you pit under safety car and when you don’t, who has the authority to override the simulation, what information is required before committing.

The worst performances I’ve seen under safety car are from teams trying to improvise the decision criteria in real time while also executing the tactical choice. They’re simultaneously deciding how to decide and deciding. The cognitive load collapses the window.

Technical organizations have safety car moments constantly. An unexpected departure. A security incident. A competitor shipping something that changes the market. A regulatory change with a six-week compliance window.

The organizations that respond well are not necessarily the ones with the fastest leaders or the most data. They’re the ones that have defined, in advance, who decides what, with what minimum information, in what timeframe. Not a process document — a decision protocol. The difference is that a process describes steps. A protocol specifies authority, information minimums, and time constraints.

Most technical organizations have processes. Almost none have decision protocols.

The radio problem

Everything I’ve described so far depends on something that Formula 1 teams have invested enormous effort in getting right and still frequently get wrong: the radio communication between the pit wall and the cockpit.

The driver has three seconds per corner to receive information, process it, respond. The engineer has a firehose of incoming data and a driver whose attention is 95% on the car.

The teams that communicate well have developed an extreme discipline about what gets said, when, and how. Critical information first. Short sentences. Acknowledged, not assumed. They’ve mapped the moments when the driver can process complex information versus moments where only immediate tactical instructions work.

They’ve also developed an explicit protocol for the failure mode: what happens when the driver and the pit wall have conflicting reads of the situation. Not who wins the argument — the procedure for surfacing the conflict fast enough that both pieces of information can inform the decision.

In technical organizations, this translation problem is almost universally unaddressed.

The CTO has the system’s technical reality in his head in a form that took years to develop. The CEO has the business context and the strategic constraints. These two people meet for ninety minutes per week in a format designed for status updates, not for surfacing the kind of complex, ambiguous, partially-formed information that would actually be useful for joint decision-making.

The radio doesn’t work. Not because either party is failing. Because nobody designed the communication protocol for the actual content that needs to travel across it.

What I do from the pit wall

I want to be direct about what role I’m describing here, because it’s easy to misread.

The pit wall doesn’t drive the car better than the driver. It doesn’t have better instincts, better physical feedback, better situational awareness in the cockpit. What it has is a different vantage point — one that the driver structurally cannot occupy while driving.

When I work with a technical organization, I’m not bringing superior technical judgment to the engineers who’ve been inside the system for three years. They know things about that system that I will never know.

What I bring is the view from the pit wall. The ability to read the full picture from a position outside the cockpit. The ability to see what the data is beginning to show before the situation becomes unambiguous. The ability to name what the telemetry is actually measuring versus what the story about the telemetry is claiming.

And critically: no stake in the decision. No architecture to defend. No team to protect. No political position to maintain.

The driver who knows the car is wrong but can’t say so clearly because the team has six months invested in the current setup needs someone at the pit wall who will read the lap times without the attachment.

Most technical organizations don’t have that position filled. Not because they lack competent people. Because everyone is in the cockpit.

The pattern detection that lets you see problems forming before thresholds break is in Looking Inside the Walls. The decision paralysis that keeps cars in the wrong tire window is Pekin Express.

Pekin Express

2026-04-21T10:00:00+02:00

Pekin Express. Two people. One euro a day. No GPS. No hotel reservation. No plan beyond “get to the checkpoint before the elimination.”

The show has been running for years. I’ve watched enough seasons to have a clear, uncomfortable opinion about why most teams lose. It’s not the one the show wants you to have.

The teams who fail aren’t the ones without skills. They’re the ones who can’t stop waiting for better conditions before deciding to move.

The truck you didn’t stop

There’s a pattern that appears in almost every season.

A team is standing by the side of a road in the middle of nowhere. A truck drives past. They hesitate. Is it going in the right direction? Do they speak enough of the language? What if there’s a better option in twenty minutes?

The truck is gone. Another team fifty meters away ran to the road the moment they heard the engine, gestured something universally understandable, and is now in the cab while the first team finishes its deliberation.

The difference between these two teams is not intelligence. Not preparation. Not experience.

It’s the tolerance for being wrong.

The team that stopped the truck doesn’t know where it’s going. They might get out in three kilometers because it’s heading the wrong direction. They accept that. They’ve built into their operating model the assumption that some decisions will be wrong, and that speed of correction matters more than accuracy of first attempt.

The team that waited had a different implicit model: make fewer, better decisions. Wait for more information. Optimize the choice. They’re still standing by the road when the other team reaches the checkpoint.

“We need more data” is not an analytical statement

I want to name something that gets dressed up in analytical language constantly in technical organizations.

“We need more data before we can decide on the architecture.”

“We need another quarter of metrics before we can evaluate the team’s performance.”

“We need to complete the RFP process before we can assess whether to change vendors.”

These statements sound rigorous. They position the speaker as careful, methodical, evidence-based. In my experience, approximately half the time they’re accurate. And the other half of the time, they’re a political maneuver dressed as analytical discipline.

Here’s how you tell the difference: ask what specific data point, if provided, would change the decision. If the answer is clear and concrete — “if retention drops below 85%, we change the approach” — it’s analytical. If the answer is vague — “we just need to have a clearer picture” — it’s not.

The clearer picture is never coming. The picture is always incomplete. The decision is being avoided because making it creates accountability for the outcome, and not making it preserves the ability to say “we hadn’t decided yet” if things go wrong.

In Pekin Express, that team is still standing by the road when the show ends.

What constraint actually does

I spent years believing that resources solve problems. More budget, more time, more people, more clarity before committing. I was wrong, and I’ve watched enough technical organizations confirm it that I’m no longer polite about this.

Constraint doesn’t just create urgency. It changes the decision-making process itself.

When you have one euro a day, you stop optimizing and start deciding. Not chaotically — strategically. Every interaction has to count. You develop a sharp instinct for what’s worth trying and what isn’t, because the cost of a failed attempt is real and immediate. You become economical with your hypotheses.

The teams with unlimited resources spend three months planning and ship something with seventeen dependencies, four of which nobody has time to maintain. The constraint teams ship in six weeks, own every decision they made, and can explain the reasoning for each one.

I’ve seen this repeatedly in technical organizations. The teams that produced the most coherent work were not the ones with the most resources. They were the ones who had internalized a constraint-first mindset — who built features you could actually ship with the team you had, who made architecture decisions you could actually maintain at the current headcount, who said no to things that were theoretically good but practically impossible given the actual operating conditions.

Unlimited budget doesn’t produce good decisions. Clarity about constraints does.

Recovery speed is the measurement that doesn’t exist

The teams who win Pekin Express are not the ones who make the best first decisions.

They’re the ones who recover fastest when their decisions don’t work out.

They get dropped off in the wrong city. They adapt immediately. They stop a truck, discover it’s going the wrong direction, get out three kilometers later, and try again. They don’t spend twenty minutes processing the mistake. They’re already working the next problem.

This is the capability that actually separates high-functioning technical organizations from struggling ones. And I’ll be direct: most companies hire for first-decision quality and have no idea how to measure recovery speed.

Job interviews ask how you solved the hard problem. They don’t ask how long it took your team to acknowledge that an approach wasn’t working and change course. They don’t ask how you managed the transition from “we’re committed to this architecture” to “this architecture is wrong and we need to move” without losing six months of progress and three engineers who burned out during the pivot.

Recovery speed is the metric. A team that decides carefully but recovers slowly will get lapped by a team that moves quickly, fails occasionally, and corrects without drama. Every time.

The constraint is already there

The executives I find most effective to work with share one characteristic: they want to understand the actual state of their technical system, including the uncomfortable parts, specifically because a decision is coming and they want to make it with accurate information. Not to delay the decision. To make it faster and better.

The other kind — the one who commissions a study to validate a direction already decided — wants something else. They want coverage, not diagnosis. They’re not standing by the road waiting for a truck. They’re waiting for someone to confirm that waiting was the right strategy.

I’m not useful for that second scenario.

What I find useful to say, clearly: your technical debt is already accumulating. Your architecture already has limits your team is navigating around every sprint. Your system is already gaining complexity at a rate your current headcount cannot absorb indefinitely.

That’s not a future risk. That’s the road you’re currently standing on. The truck has been passing for months.

The question is not whether to move. The question is whether you’re going to build a decision-making model that lets you move with 60% of the information, recover fast when you’re wrong, and make the next decision without relitigating the last one.

Or whether you’re going to wait for better conditions.

They’re not coming.

The authority structure that makes the first decision stick — or not — is in Three Seconds. The full diagnostic picture before you move is Looking Inside the Walls.

The Kitchen

2026-04-14T10:00:00+02:00

A good kitchen is invisible.

The food arrives hot. The timing is right. The table doesn’t wait between courses. From the dining room, the experience is seamless, apparently effortless.

What the customer doesn’t see: ten minutes ago, the main course station was three dishes behind. Someone called it. Another station covered. A dish got plated in the wrong order and was reset in thirty seconds. The expediter absorbed two problems that never left the kitchen.

The customer got his food on time. He has no idea anything happened. That’s the point — in a well-run kitchen, the customer never knows what it cost to serve him.

What happens when the kitchen falls apart

From the dining room you can tell. The entrees come out unevenly — some hot, some clearly plated ten minutes ago and kept waiting. The server starts apologizing with a look that says she’s been apologizing since service started. The bread basket gets refilled twice in five minutes and then not at all for half an hour.

Nobody in the dining room saw the kitchen. But everyone felt that something broke.

I think about this constantly when I audit an information system.

The executive team is the dining room. They see what reaches the table. Deliveries, reports, incidents, release notes. They have opinions about team velocity, product quality, technical decisions. All of those opinions are formed from what arrives in front of them.

They almost never see the kitchen.

And this is not a metaphor. It’s a structural description of how most technical organizations operate. The people who make technical decisions at the organizational level do so from a position of almost complete information asymmetry. They know what they’re served. They don’t know what it cost to produce it, what was absorbed invisibly, what problem was routed around without being fixed, what the person who made it work has been doing for the last three sprints that isn’t on any roadmap.

The kitchen that runs on heroism

The worst technical kitchens I’ve encountered aren’t the ones with bad engineers. They’re the ones with excellent engineers running a system that only works because of them personally.

One person who knows where everything is. One person who gets called at 3am when the production system breaks. One person whose departure would create an immediate crisis that nobody in management has modeled or prepared for, because as long as he’s there, the crisis doesn’t materialize and nobody needs to confront what his presence is actually hiding.

The system works. Food comes out. Executives are satisfied with the delivery rate. The kitchen is invisible because one person is making it invisible, every single day, at a personal cost that isn’t on any dashboard.

Then he leaves. Or burns out. Or gets an offer from a company that pays him what he’s actually worth. And the entire kitchen is exposed at once.

This is where I find myself being brutally direct with CEOs: your senior engineer’s availability is not a performance indicator. It’s a risk indicator. The fact that he solves every crisis is evidence that the crises are structural and recurring — not that the system is healthy.

A fire department that puts out fires efficiently is not proof that your building is safe. It’s proof that you have good firefighters. The building is still on fire.

The brigade structure and why nobody implements it

Escoffier’s brigade de cuisine wasn’t invented because restaurants got complicated. It was invented because the model where one head chef does everything by memory while helpers execute blindly doesn’t survive scale.

Every role defined. Every station autonomous. Every hand-off explicit. The expediter at the pass ensures that timing aligns across stations before anything leaves the kitchen. When it works, a problem at the patissier station doesn’t cascade to the entremettier, because dessert is downstream and isolated from what’s happening at other stations.

The IS equivalent is obvious and almost universally absent.

Clear ownership of each technical domain. Explicit interfaces between systems. Defined decision authority. An architecture where a problem in the billing module doesn’t corrupt the delivery pipeline because the coupling was designed out at the start, not discovered during an incident at 2am.

What I find instead, in almost every engagement: a kitchen where every station is connected to every other station. A change in one place requires three people to coordinate on two other things before anything can deploy. The expediter — usually the CTO or the senior engineer — spends his day managing dependencies rather than ensuring quality.

You can hire better engineers into that structure. You can run sprints, ceremonies, retrospectives. You will improve the output rate at the margins. You will not solve the architecture.

The kitchen is badly designed. You’re optimizing the chefs.

The question the CEO doesn’t ask

I ask executives one question at the start of every engagement: describe a time in the last six months when a technical project took significantly longer than you expected.

Every answer has the same shape. We thought it would take three weeks. It took four months. We kept discovering dependencies we didn’t know existed. Every time we fixed one thing, three other things needed attention.

The CEO tasted a late dish. What he experienced as a delivery problem was a kitchen architecture problem. And he’d been solving it by apologizing to the dining room.

You can’t fix what you can’t see. You can’t restructure a kitchen you’ve never walked through. Status meetings and sprint reviews are the equivalent of reading the menu — they tell you what’s supposed to arrive, not what’s actually happening between the stations.

The plates tell you the symptom. The kitchen shows you the cause. And until you’ve been in the kitchen — not for a tour, but to understand how it actually runs, where the dependencies live, what the known structural weaknesses are, who is the single point of failure — you’re making decisions about performance based on incomplete information.

Most executives haven’t been in the kitchen. Because the kitchen is the engineers’ domain. The food is the CEO’s concern.

This separation is expensive. More expensive than the four-month project that took eighteen months. Because the same structural cause will produce the same structural effect, in the next project, and the one after that, until someone walks through the kitchen and decides to redesign it.

The IS equivalent of a kitchen running on heroism is described in Looking Inside the Walls. The decision paralysis that keeps bad kitchens running is Pekin Express.

Looking Inside the Walls

2026-04-07T10:00:00+02:00

I know people who signed property contracts without reading the diagnostic report. Not naive people. Smart people with good judgment and functioning careers, who spent months finding the right property, found it, and then treated the due diligence as a bureaucratic formality that stood between them and the decision they’d already made.

The crack was in the report. Page 11. Forty thousand euros they hadn’t planned for.

They’d been shown the property. They liked it. The rest was detail.

Nobody reads page 11

I am searching for a space for a project. Every visit starts the same way. Before we discuss price, before we discuss layout: who ran the diagnostics, when, and can I read the full report?

I’ve walked away from properties that looked perfect on the surface. Right neighborhood, right price, right light. But the asbestos survey was from 2009. The electrical assessment was marked incomplete. The structural report had a note that the inspector himself described as “requiring further investigation.”

That note is the whole story. When the inspector says further investigation, he means: I found something I couldn’t resolve. That’s not a minor remark buried in an appendix. That’s the professional who examined the building telling you there’s something he couldn’t see clearly and that warrants a specialist.

In property, the diagnostic is legally mandatory. The system forces the look because the regulators understood, correctly, that almost nobody does it voluntarily. Without the legal requirement, the market would run entirely on presentation.

In tech, there’s no legal requirement. You can hire a new CTO, launch a full rebuild, raise a funding round, sign an enterprise contract — without anyone having examined the actual state of your information system. Nothing stops you. Nothing forces the look.

And so most companies don’t look. They buy on presentation.

The real reason nobody looks

I want to be direct about something that rarely gets said: most leadership teams avoid the IS audit not because they don’t know it exists, but because they sense what it will find.

They’ve been managing around problems they can’t name for months. Deliveries that take longer than they should. Decisions that require five people to coordinate something that should require one. Specific initiatives that always get blocked at the same point. They know something is wrong. They don’t know exactly what.

Commissioning an audit makes the invisible visible. And once it’s visible, you’re obligated to address it. Or you’re explicitly choosing not to, which is a different kind of accountability.

The survey creates obligation. Not commissioning it preserves optionality — the comfortable fiction that maybe it’s not that bad, maybe it resolves itself, maybe next quarter the context will be better.

I’ve seen this explicitly. A CEO who told me, directly and without embarrassment: “I know we have technical debt. I’d rather not know exactly how much until after the fundraise closes.” He wasn’t ignorant. He was managing his information exposure deliberately. The fundraise closed. He called me three months later. The technical debt had not respected his timeline.

What the survey actually reveals

The reaction I see most often when I deliver a technical survey isn’t panic. It’s relief.

The executive has been living with a weight he couldn’t name or locate. Specific decisions kept taking longer than expected. Certain questions couldn’t be answered without involving four people and taking two weeks. There was a pattern, a recurring friction, that he’d learned to route around because he didn’t know what was causing it.

The survey names it. Gives it edges and a scope. Turns “there’s something wrong with the way we make technical decisions” into “your authentication layer is tightly coupled to your billing module, which means any change to pricing logic requires a full regression test across two systems that have no separation of concerns.”

Before the name, it’s anxiety. After the name, it’s a project. Projects are manageable. Anxiety is not.

The survey didn’t create the problem. The problem existed long before we looked. The survey changed it from the vague category to the specific one, and specific problems have solutions.

The decision to proceed anyway

Here’s where I need to be honest about what happens after the survey, because it’s not always what you’d hope.

I’ve had clients who read the report, understood it completely, and decided to proceed with the acquisition or the launch anyway. Knowing the roof needed replacing. Having read page 11 this time.

That’s not necessarily wrong. You can buy the house with the roof if the price reflects it and you’ve allocated the budget. You can launch on architecture with known debt if you’ve modeled the risk and have a remediation plan with real dates on it.

What’s not acceptable is the CEO reading the executive summary, asking two questions, and announcing that they’re proceeding with the product launch because the fundraise timeline doesn’t allow a four-month architecture pause — and then being surprised eight months later when the architecture breaks at the worst possible moment.

Technical debt doesn’t respect launch timelines. It surfaces at maximum load: the product launch, the enterprise contract, the press mention that brings ten times normal traffic. The system held through the testing environment. It holds through the pilot. It fails the day you need it most, because the day you need it most is the first time it’s under production conditions at production scale.

At that point it doesn’t cost four months. It costs eight months, a botched launch, a client who left, and three engineers who are quietly updating their CVs.

What you’re deciding when you don’t look

Not reading the report is a decision. It’s a decision to proceed with a known information gap, dressed as an oversight.

I’m taking time on a current project to look properly before we commit. Some people in the room think we’re moving too slowly. They’re counting the weeks we’re not producing deliverables.

I’m counting the problems we won’t have in eight months. That math always comes out the same way.

The question isn’t whether to commission a technical survey of your IS. The question is whether you’re prepared to act on what it finds, including the findings that are inconvenient for the decisions you’ve already leaned toward.

If the answer is no — if you know in advance that the survey won’t change what you’re going to do — then you’re not missing a diagnostic. You’re missing the organizational honesty to admit you’ve already decided.

That’s a different problem. And it doesn’t have a technical solution.

Why executives avoid the diagnostic is covered in Prescribing Without Examining. Why the same kitchen breaks every time is in The Kitchen.

Prescribing Without Examining

2026-03-30T10:00:00+02:00

You would never accept a doctor who walks into the examination room, hears you say “my head hurts,” and writes a prescription without touching you.

In medicine, that’s a fault. It can cost a doctor their license.

In tech consulting, it’s the business model.

The brief already has the conclusion

I receive these kinds of briefs regularly. Not occasionally. Regularly.

“Our team is slow. We need a process audit.” Translation: confirm that the problem is the team lead and recommend replacing them. We’ve already told him his contract isn’t being renewed. We need documentation for HR.

“Our cloud costs are out of control. We need an optimization plan.” Translation: confirm that the migration was poorly handled and recommend a new vendor. We’ve already started conversations with AWS. We need an outside voice to close the internal debate.

“Our CTO isn’t performing. We need an outside view.” Translation: we’ve decided to let him go. We need a professional who’ll write it up in a way that holds legally and looks objective.

I’ve turned down these missions. Not out of principle — principle is a luxury. Because the work is structurally corrupt. You spend the entire engagement justifying a conclusion that existed before you started. Anything you find that doesn’t support the original diagnosis gets quietly deprioritized. And at the end, the client gets what they paid for, which was never the truth about their system. It was ammunition.

The consultant who takes that work isn’t doing consulting. They’re doing litigation support without the courtroom.

The consulting industry has a structural incentive to keep you sick

Here’s what I rarely hear said directly: the dominant economic model in tech consulting rewards the prescription, not the diagnosis.

If I run a team of fifty consultants and I need them billable, I need ongoing engagements. An engagement that finds the problem, solves it in four months, and ends is bad for revenue. An engagement that validates a migration, manages the migration, then optimizes the result of the migration is eighteen months of billings.

I’m not describing bad actors. I’m describing rational actors in a system that rewards perpetuation over resolution.

The client is often not aware of this. They’ve hired a firm. The firm has good people. The people are well-intentioned. But the incentive structure means that the questions the firm asks are shaped by what they can subsequently sell, not by what the client actually needs to understand.

This is why “referred pain” is so prevalent and so expensive.

Referred pain

In medicine, referred pain means the injury is in one place and the pain manifests somewhere else entirely. You treat the shoulder. The problem is in the heart.

Tech systems have referred pain as their default mode.

A cloud bill that keeps growing is almost never a cloud problem. It’s usually an architecture decision made under time pressure three years ago, without visibility on what the business would become. The engineer made a reasonable choice given what they knew. The business grew in a direction nobody fully anticipated. The architecture didn’t adapt. The bill reflects the structural gap, not cloud mismanagement.

You hire a cloud optimization consultant. You shave 22% off the invoice in quarter one. You’re satisfied. In quarter three, the bill is back at 90% of where it started, because you changed the symptom, not the cause. The consultant will offer you a phase two engagement.

A CTO who “isn’t performing” is almost never performing badly on purpose. More often, he’s navigating an organization that gave him the title without the authority, expects him to deliver technical transformation while fighting every budget conversation alone, and has a product roadmap that changes direction every quarter. He can’t perform because the structural conditions for performance don’t exist.

Replace him. You get a new person in the same structural trap. I’ve watched this happen. The new CTO quit eight months in. The outgoing CTO found a role at a company with actual governance. The board called it a hiring failure.

It was a diagnostic failure.

The questions I ask that aren’t in the brief

I start every engagement by asking things the brief didn’t ask for.

“Before we look at team velocity — walk me through the last three times a technical decision was overridden after it was made.” That’s not a process question. That’s a governance question. It tells me whether the CTO leads or manages upward anxiety. The answer usually comes with a pause.

“Show me the last significant vendor choice that went against what the technical team recommended.” If it exists, the story it tells about authority and accountability in that organization is almost always the real brief.

I’ve had clients tell me these questions are off-topic. “We hired you for the cloud costs.”

I keep asking anyway. Because the referring pain is never in the cloud bill, and a doctor who only examines where it hurts is going to miss the thing that matters.

What happens when the diagnosis is inconvenient

Finding the problem is not the hard part. Problems are visible once you stop looking where you were told to look.

The hard part is delivering a finding that contradicts the decision the client has already committed to emotionally. That’s when the room gets quiet in an uncomfortable way.

I’ve delivered reports that said the CTO was not the problem. That the architecture was sound given the constraints. That the cloud costs reflected real business growth, not waste. Three times in four, the client takes the report, says it’s very interesting, and proceeds with the replacement or migration they had already decided on.

That’s their right. It’s their company.

But here’s what I want to be clear about: the problem doesn’t go away because you changed the person or the vendor. The structural conditions that produced the symptoms remain intact. In twelve months, you’ll have new symptoms. And someone will recommend a new prescription.

The question isn’t whether your technical situation is a problem. It’s whether you actually want to know what’s causing it. Those two questions have different answers more often than anyone in this industry admits.

The authority problem behind “who makes the call” is explored in Three Seconds. The structural consequence — an IS nobody has properly examined — is in Looking Inside the Walls.

Three Seconds

2026-03-23T10:00:00+01:00

I sponsor the SCO. I hold a corporate box. I go to almost every home game.

For years I thought I understood football. I had opinions about the referee. Loud ones, sometimes. Like every executive who has opinions about their IS without having looked at it.

Then I spent an evening with Pierre Chevreux — 13 years as a Ligue 1 assistant referee, now running a café in Angers. He dismantled something I’d been doing professionally for twenty-five years without knowing it.

300 decisions. Per match. With incomplete information.

300 decisions per match. One every 18 seconds. Some clusters of ten decisions in under a minute. No pause, no rewind, no committee, no “let’s schedule a follow-up.”

Pierre described a Bordeaux-PSG where the keeper picks up a backpass because Ibrahimovic is charging. Obvious foul. Pierre sees it clearly from his position on the line, signals it. The central referee doesn’t follow. And in a trio, you trust each other. You don’t override each other publicly. Pierre swallows it. The decision holds. The match moves on.

What struck me wasn’t the injustice. It was the architecture.

Each official has a zone, a role, an angle of vision. The system only works if everyone accepts its constraints. The moment one person starts overriding another’s zone, the whole structure collapses. What looks like a wrong call from the stands is often the correct application of a governance model the crowd doesn’t know exists.

The executives in that room had been spectators

Everyone in that room — including me — had spent years building confident opinions about referee quality. From sixty meters away. At a sprint. Under floodlights. With thirty thousand people shouting in our ears.

We had never seriously considered what the role actually requires.

This is the exact cognitive posture most executives bring to their information system. They’ve watched it from the stands. They have opinions. The system is slow. The team doesn’t deliver. The CTO doesn’t communicate. The architecture is outdated.

All of that might be true. But it’s spectator analysis. Built from what reaches the dining room, not from what happens in the kitchen. Built from the output, not from understanding the constraints that produced it.

I’ve sat across from CEOs who were completely convinced their architecture problem was a people problem. Three months into the engagement, it turned out their “slow team” was navigating an undocumented maze of dependencies that took me two weeks to fully map. The team wasn’t slow. They were doing the equivalent of refereeing with one eye, one arm, and a rulebook written in a language nobody remembered having learned.

The CEO had watched the match. He hadn’t looked at the referee’s operating conditions.

Not deciding is also a decision

The part that stopped me cold: Pierre said, not saying anything is also a decision.

A referee’s silence has consequences exactly like his whistle. Except we never replay the abstentions after the match. We only analyze the interventions. The non-calls, the moments where play was allowed to continue — nobody reviews those.

I think about this in every COMEX I’ve observed where a technical decision was avoided for months. The call to replace a brittle architecture. The call to exit a vendor relationship that costs more than it produces. The call to tell the board that the product roadmap assumes a technical capacity the team doesn’t have.

Silence is not neutrality. Silence is a decision with deferred consequences. And the deferred consequences in tech are almost always more expensive than the call would have been, because technical debt compounds exactly like financial debt — with interest.

The organizations I’ve seen handle this well have one thing in common: someone with the actual authority to make a call and have it hold. Not just the title. Not the meeting organizer. The person whose whistle the rest of the organization respects without relitigating it.

Most companies don’t know who the referee is

Here’s the question I now ask at the start of every engagement, and it’s rarely answered cleanly:

In your organization, who has the actual authority to make a technical call and have it hold?

Not who has the title. Not who calls the meetings. Who, when they blow the whistle, has the rest of the organization move forward without negotiating the call?

The most common answer: the CEO thinks it’s the CTO. The CTO thinks he needs buy-in from the CFO. The CFO thinks it’s a product question. Nobody whistles. The play continues. The foul compounds. And eighteen months later, you’re looking at a bill that represents the accumulated cost of decisions that were never made when they should have been.

Pierre Chevreux made 300 calls per match. He had authority within his zone. He trusted the system. He delivered clean results under conditions most executive teams would find unworkable.

Your organization makes fewer decisions than a Ligue 1 referee. It takes longer. And the authority structure is less clear.

That’s not a football problem.

On a related note: the same executives who can’t name their referee are often the same ones who pre-write the verdict before commissioning the audit. Prescribing Without Examining goes into that.

Social benefits and risks from AI

2023-01-23T08:01:01+01:00

There’s a lot of talk about the benefits and risks of artificial intelligence (AI). Some people believe that AI will make our lives better, while others fear that it could do harm. We’re not going to settle that debate here–but we will look at what some experts say about how AI might affect society in general.

Will it help or will it hurt?

It’s unclear whether AI will help or hurt society, but there are both risks and benefits associated with the technology.

AI is a tool, like any other technology: it has the potential to be used for good or bad. It depends on how it is applied. There are many examples of AI being used for good: for example, Facebook’s Messenger bot that helps identify suicidal posts; or Microsoft’s Tay chatbot that was trained on twitter data and quickly became racist after interacting with real people online (in response to this failure, Microsoft decided not to release its new teen girl chatbot Zo).

It’s not all about the technology though—it’s also about how people use it.

When a company becomes a monopoly, it can charge higher prices than would be possible with competition. This makes consumers worse off because they have to pay more for products or services that would cost less if there were multiple companies in the market. In addition, monopolies reduce the incentive for firms to innovate new products because there is no reason to improve on their existing product if they don’t have any competitors that can offer something different. This is why we need AI more than ever before. The world is changing faster than ever before, and it’s only going to get faster. We can either embrace those changes or fight them - but if we want the best possible future for ourselves and our children, then we have no choice but to embrace them. The same technology can be used for both good and bad. For example, the internet has been used to create jobs that didn’t exist before (like being an Uber driver) but also allowed terrorists to recruit and plan attacks…

AI is no different. It will be used for both good and bad purposes, but the good uses far outweigh the bad ones. That’s why it’s so important that we continue to develop AI technology so that it can help humanity solve some of its biggest problems

The social benefit of AI is that it will make life better for everyone.

AI will help us find jobs, learn new skills, and make better decisions. It will help us solve problems in new ways and enjoy life more than ever before. And it will also connect people together in ways that were never possible before - bringing families closer together and making the world a better place for all of us to live in.

AI is already making a huge difference in the lives of many people. AI can help us find jobs, learn new skills and make better decisions. AI will help us solve problems in new ways and enjoy life more than ever before.

AI will connect people together in ways that were never possible before. AI will bring families closer together and make the world a better place for all of us to live in. AI is already making a huge difference in the lives of many people.

AI can help us find jobs, learn new skills and make better decisions. AI will help us solve problems in new ways and enjoy life more than ever before. AI will connect people together in ways that were never possible before - bringing families closer together and making the world a better place for all of us to live in. AI is already making a huge difference in the lives of many people.

The social risk of AI is that the technology companies will turn into monopolies.

Monopolies are companies that dominate an industry and have no or few competitors. Examples of monopolies include Starbucks, Walmart, and Google. When a firm becomes a monopoly, it can charge higher prices than would be possible with competition. This makes consumers worse off because they have to pay more for products or services that would cost less if there were multiple companies in the market. In addition, monopolies reduce the incentive for firms to innovate new products because there is no reason to improve on their existing product if they don’t have any competitors that can offer something different.

As AI technology continues to progress, the risk that technology companies will become monopolies increases. With the power of AI, companies will be able to create products and services that are so advanced that no other company can compete. This could lead to a situation where a single company controls the entire market, leaving consumers with no other choice.

This could result in a decrease in consumer welfare and an increase in social inequality.

Some examples

Chatgpt and Copy.ai

They are both two examples of how AI can be used for good.

Chatgpt is an example of how AI can be used to help people with autism. Chatgpt is a chatbot that helps people learn social skills, including what it means to be autistic and ways they can interact with others. It’s designed as a resource for children who have been diagnosed with autism and their parents, but anyone can use it too!

Copy.ai is another example of how AI can be used for good: It’s an intelligent personal assistant that learns from your behavior and helps you make decisions based on what you’ve done before. For example, if you want to make sure you never forget about a dentist appointment again (and who doesn’t?), Copy will remind you every day at noon—unless it notices that Dr. Snickerdoodle has become your dentist after all, in which case he’ll let himself into your office space at 6 pm every evening until he sees the light go off in his office next door when everyone leaves after 7 pm.”

As a society, we need to be careful about how we approach AI. I believe there is an ethical dimension to AI that needs more attention. This means thinking about the implications of AI and how it could impact our lives before it becomes mainstream. It’s important for us to have conversations now—about who will control this technology and how it will be used in society—rather than reacting once it’s already out there.

Another area I’m interested in is how AI can help us with our emotions. For example, we could use a system like this to help people who are suffering from depression or anxiety.

Midjourney can draw it for you

Midjourney is a platform designed to connect people with similar values and interests.

Midjourney is a social network designed to help you connect with like-minded people. Whether you’re looking to make friends, find a partner or a business connection, Midjourney makes it easy for you to find them. Midjourney isn’t just another place where people can share their ideas—it’s also a place where people can come together and support each other in their shared values.

It’s a revolutionary social network that has been designed to make it easier than ever to meet like-minded people. Whether you’re looking to make friends, find a romantic partner, or establish a business connection, Midjourney makes it simple to find the right person.

It is the place where you can connect with other people who are interested in self-development, personal growth and spiritual awareness. We know that there are many ways to achieve these goals, so we don’t want to limit what you share.

Midjourney top list

Midjourney is revolutionizing the way people connect with each other. It’s a social network designed to help you find like-minded people and build meaningful relationships. Whether you’re looking for a friend, a partner, or a business connection, Midjourney makes it easy to find them.

Conclusion

As you can see, there are a lot of benefits and risks associated with AI. The technology is still in its early stages, so it’s difficult to predict exactly how it will affect our lives. We do know that AI will have a big impact on our society and economy as it continues to develop over time.

Only the bias is biased

2023-01-06T08:01:01+01:00

Cognitive bias is a phenomenon that occurs when our brain processes information in a way that is systematically different from the way a rational, unbiased mind would. These biases can affect our decision-making, our perceptions and our memory, and they can have a significant impact on our lives.

Types of bias

There are many different types of cognitive biases, and they can be grouped into several categories. Some common types of cognitive biases include:

Confirmation bias: This is the tendency to seek out and give more weight to information that confirms our preexisting beliefs and assumptions. This bias can lead us to ignore or downplay evidence that contradicts our beliefs, and it can make it difficult for us to change our minds even when presented with new or conflicting information.
Anchoring bias: This is the tendency to give too much weight to the first piece of information we receive, even if it is not necessarily relevant or accurate. For example, if we are asked to estimate the number of jelly beans in a jar and are first told that there are 50, we may anchor our subsequent estimates to that initial number, even if it is not a reasonable estimate.
Framing effect: This is the way in which the way a problem or situation is presented can influence our decision-making. For example, if we are asked whether we would rather have a 60% chance of winning $100 or a 40% chance of winning $150, we may choose the first option because it is framed in terms of probability, even though the second option is clearly a better deal.
Representativeness bias: This is the tendency to judge the likelihood of an event based on how closely it resembles our mental concept of that event, rather than on statistical analysis. For example, if we are asked to estimate the likelihood that a person is a doctor based on the fact that they are wearing a white coat and carrying a stethoscope, we may judge that the probability is high, even though there are many other professions that also involve wearing a white coat and using a stethoscope.

Perceval and Karadoc - Kaamelott

These are just a few examples of the many cognitive biases that can influence our thinking and decision-making. Other common biases include the availability heuristic (the tendency to judge the likelihood of an event based on how easily we can recall similar events), the sunk cost fallacy (the tendency to continue investing in a project or course of action because of the resources we have already invested), and the halo effect (the tendency to judge a person or thing more favorably based on one positive characteristic).

Impact of bias

Cognitive biases can have a significant impact on our lives and decision-making, and they can lead us to make judgments that are not based on accurate or objective information. For example, confirmation bias can make it difficult for us to accept new or conflicting information, even when it is supported by evidence, and the sunk cost fallacy can lead us to continue investing in a project even when it is not likely to be successful.

It is important to be aware of these biases and to try to correct for them as much as possible in order to make more informed and rational decisions. There are several strategies that can help us to mitigate the effects of cognitive bias, including seeking out diverse sources of information, questioning our assumptions and beliefs, and using tools like decision trees and cost-benefit analysis to help us make more objective decisions.

Double Impact

By understanding the ways in which our brains can distort or simplify information, we can work to overcome cognitive bias and make more informed and rational decisions. This is important not only for our personal lives, but also for the many complex problems and challenges we face as a society.

Cognitive biases can have a significant impact on how we evaluate and make decisions about risks. The availability heuristic, for example, can lead us to overestimate the likelihood of rare or highly publicized events, such as plane crashes or terrorist attacks. This can lead us to make decisions that are not based on a realistic assessment of the risks we face, and it can also affect public policy and resource allocation.

Cognitive biases can also have an impact on how we perceive and remember events and experiences. For example, the misinformation effect is the tendency for new information to overwrite or distort our memories of events. This can have serious consequences in legal settings, where eyewitness testimony is often an important piece of evidence.

What next?

There is a growing body of research on cognitive biases and how to mitigate their effects, and there are several strategies that can help us to make more informed and rational decisions. These include:

Seeking out diverse sources of information: By exposing ourselves to a wide range of perspectives and viewpoints, we can help to mitigate the effects of confirmation bias and other biases that can distort our perceptions.
Questioning our assumptions and beliefs: By actively questioning our own assumptions and beliefs, we can help to identify and correct for biases that might otherwise distort our thinking.
Using tools like decision trees and cost-benefit analysis: These tools can help us to make more objective and unbiased decisions by forcing us to consider multiple factors and to weigh the pros and cons of different options.

Overall, it is important to be aware of the ways in which our brains can distort or simplify information, and to take steps to correct for these biases in order to make more informed and rational decisions. By understanding and addressing cognitive biases, we can improve our decision-making and increase our chances of success in both our personal and professional lives.

Conclusion

Inspired by one of my extra-professional presentations during a monthly event at Enyx, I decided to try the ChatGPT experiment on the theme of cognitive bias. The question? “Rédige un article de 20000 caractères sur le biais cognitif en anglais” in French, as-is. What do you think of the result?

JSON, MongoDB and rsyslog are on a boat

2020-12-23T11:01:01+01:00

When dealing with log management, obvious solutions emerge earlier, often before you even discussed the purpose of the log management. We can discuss about ELK, Graylog, Splunk, … Those are great tools but they may not fit will all your needs. Lately, I had to work for one of my customer on enforcing log management for billing purposed. Rsyslog was already set to collect and centralize all the logs (and manage their backups). MongoDB seemed as a perfect tips for storing JSON extract of the logs to generate the proper stats.

Invoice Management - DronaHQ

JSON is standard

From json.org:

JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language Standard ECMA-262 3rd Edition - December 1999. JSON is a text format that is completely language independent but uses conventions that are familiar to programmers of the C-family of languages, including C, C++, C#, Java, JavaScript, Perl, Python, and many others. These properties make JSON an ideal data-interchange language.

On top of that format, we can used a more structured syntax, adapted to log management: CEE Log Syntax. This defined format is well used by various tools you might use, in the present case: nginx, rsyslog, and mongodb. Up to a certain level…

Nginx knows about @cee

Sort of. Nginx has a native syslog export for both error_log and access_log. Out of the box, it will simply push all logs from the default log formats to syslog. This won’t be very convenient for proper management afterwards. But nginx is easy to use, and you can define your own custom format. You’ll find plenty of blogposts, tutorials, and others as Any IT here? Help me! describing the proper @cee JSON log format you need:

log_format mainJSON escape=json '@cee: {'
        '"vhost":"$server_name",'
        '"remote_addr":"$remote_addr",'
        '"time_iso8601":"$time_iso8601",'
        '"request_uri":"$request_uri",'
        '"request_length":"$request_length",'
        '"request_method":"$request_method",'
        '"request_time":"$request_time",'
        '"server_port":"$server_port",'
        '"server_protocol":"$server_protocol",'
        '"ssl_protocol":"$ssl_protocol",'
        '"status":"$status",'
        '"bytes_sent":"$bytes_sent",'
        '"http_referer":"$http_referer",'
        '"http_user_agent":"$http_user_agent",'
        '"upstream_response_time":"$upstream_response_time",'
        '"upstream_addr":"$upstream_addr",'
        '"upstream_connect_time":"$upstream_connect_time",'
        '"upstream_cache_status":"$upstream_cache_status",'
        '"tcpinfo_rtt":"$tcpinfo_rtt",'
        '"tcpinfo_rttvar":"$tcpinfo_rttvar"'
        '}';

They all give you the very same structure. Not sure who started it, but that’s not the point: they’re all wrong about it!

I am this close - Terminator 2

They are close, indeed, but some details have to be fixed first. Why are they wrong? Because JSON, and especially the @cee version of it, has datatypes. Numbers (integers and floats) should not be encapsulated between quotes: quotes are for string only.

log_format mainJSON escape=json '@cee: {'
        '"vhost":"$server_name",'
        '"remote_addr":"$remote_addr",'
        '"time_iso8601":"$time_iso8601",'
        '"request_uri":"$request_uri",'
        '"request_length":$request_length,'
        '"request_method":"$request_method",'
        '"request_time":$request_time,'
        '"server_port":$server_port,'
        '"server_protocol":"$server_protocol",'
        '"ssl_protocol":"$ssl_protocol",'
        '"status":$status,'
        '"bytes_sent":$bytes_sent,'
        '"http_referer":"$http_referer",'
        '"http_user_agent":"$http_user_agent",'
        '"upstream_response_time":$upstream_response_time,'
        '"upstream_addr":"$upstream_addr",'
        '"upstream_connect_time":$upstream_connect_time,'
        '"upstream_cache_status":"$upstream_cache_status",'
        '"tcpinfo_rtt":$tcpinfo_rtt,'
        '"tcpinfo_rttvar":$tcpinfo_rttvar'
        '}';

Now we are good to go. Then, as all documentations state it, we can use this log format to push logs to syslog:

access_log      syslog:server=10.10.10.2:514,facility=local7,tag=nginx,severity=info mainJSON;

For sure, you can adapt the faciliy, the tag and the severity of it, along with the log format name.

Rsyslog is great. Its documentation is not.

That’s a fact, technical documentation, made by technical individuals, for technical persons, are not the best. Rsyslog might be one of the best example about this statement. Rainer Gerhards did a great work with his tool, one of the best syslog manager in my humble opinion. Thought, the documentation is a hell to read. Add to this fact, that it not as accurate as it should be.

In the use case I was working on, the infrastructure is benefiting from rsyslog v8-sable. And as stated, we want to use the mongodb exporter, aka ommongodb. Seems easy and straight forward? Almost. But remember this IT mantra:

If all goes well, we forget something.

For reasons out of my mind while writing down this post, I can tell you that it just do not work. Several aspects are to be considering before dealing with those logs.

You need to ensure about the encoding: BSON (the JSON variant mongodb uses internally) only supports valid UTF-8 character. For that, you need to properly fix the encoding before sending them. There is a module for that.
The structured @cee sent using the default configuration to mongodb will just push data “as-is”: first issue and main issue you’ll hit is about the date which will be pushed as a regular string.

But why? - Ryan Reynolds

Why? Simply because rsyslog only understand numbers and strings as datatypes on one end, and mongodb doesn’t auto detect date and timestamps on the other end. Is it an issue at the end? If you want to benefit from mongodb filtering features on dates, yes it is. For that purpose, you need to use the ISODate() functions that mongodb only knows about.

After a tremendous number of attempts, trying to deal with the documentation to find the proper format, I decided to read the ommongodb module source code. Pretty easy as it’s a well written C code:

		/* Convert text to ISODATE when needed */
		if (strncmp(name, "date", 5) == 0 || strncmp(name, "time", 5) == 0 ) {

You’ve just read it well: the code does not expect the fieldname to start with a date or time, but it expect the fieldname to be date or time.

Two solutions there:

either update the log format, in nginx configuration, from time_iso8601: to date:
update your rsyslog configuration

I’m not found of the string exporter used in the default documentation of rsyslog for mongodb: we’re using JSON as an input, we expect JSON at the output, why should we use strings in between?

For that reason, I moved to a JSON manipulation, thanks to the JSON parse module, and list type for the template:

module(load="mmutf8fix")
module(load="mmjsonparse")
module(load="ommongodb")

template(name="json-syslog" type="list" option.jsonf="on") {
        property(outname="vhost" name="$!vhost" format="jsonf" datatype="string" onEmpty="null")
        property(outname="remote_addr" name="$!remote_addr" format="jsonf" datatype="string" onEmpty="null")
        property(outname="time_iso8601" name="$!time_iso8601" format="jsonf")
        property(outname="date" name="$!time_iso8601")
        property(outname="request_uri" name="$!request_uri" format="jsonf" datatype="string" onEmpty="null")
        property(outname="request_length" name="$!request_length" format="jsonf" datatype="number")
        property(outname="request_method" name="$!request_method" format="jsonf" datatype="string" onEmpty="null")
        property(outname="request_time" name="$!request_time" format="jsonf" datatype="number")
        property(outname="server_port" name="$!server_port" format="jsonf" datatype="number")
        property(outname="server_protocol" name="$!server_protocol" format="jsonf" datatype="string" onEmpty="null")
        property(outname="ssl_protocol" name="$!ssl_protocol" format="jsonf" datatype="string" onEmpty="null")
        property(outname="status" name="$!status" format="jsonf" datatype="number")
        property(outname="bytes_sent" name="$!bytes_sent" format="jsonf" datatype="number")
        property(outname="http_referer" name="$!http_referer" format="jsonf" datatype="string" onEmpty="null")
        property(outname="http_user_agent" name="$!http_user_agent" format="jsonf" datatype="string" onEmpty="null")
        property(outname="upstream_response_time" name="$!upstream_response_time" format="jsonf" datatype="string" onEmpty="null")
        property(outname="upstream_addr" name="$!upstream_addr" format="jsonf" datatype="string" onEmpty="null")
        property(outname="upstream_connect_time" name="$!upstream_connect_time" format="jsonf" datatype="string" onEmpty="null")
        property(outname="upstream_cache_status" name="$!upstream_cache_status" format="jsonf" datatype="string" onEmpty="null")
        property(outname="tcpinfo_rtt" name="$!tcpinfo_rtt" format="jsonf" datatype="number")
        property(outname="tcpinfo_rttvar" name="$!tcpinfo_rttvar" format="jsonf" datatype="number")
}

Now we can talk. - Kyle Maclachlan - Twin Peaks

That’s not all folks!

Following that changes, nginx logs are pushed to mongodb, allowing easy statistics aggregation for billing purpose. As we just want to push these lines to mongodb, best is to proceed with something like:

if ($syslogfacility-text == 'local7' and $syslogseverity-text == 'info') then {
        action(type="mmutf8fix")
        action(type="mmjsonparse")
        action(type="ommongodb" uristr="mongodb://--REDACTED--:--REDACTED--@--REDATED--:27017/?authSource=logs&authMechanism=SCRAM-SHA-1" db="logs" collection="nginx" template="json-syslog")
        & stop
}

The uristr is a bit different from the the documentation because, once again, the document is not really explicit enough about it. For most real-life scenarios, even if you use a mongodb cluster, you want to rely on dedicated database and dedicated user, with the proper set of permissions. To benefit from it, you need to add some details within the uristr as the user:password but also some query parameters:

authSource: the db to rely on for authentication, as you user has only permissons on it
authMechanism: you’re pushing a password via the dsn

At the end

We went through. We’ve set up nginx to push JSON @cee-compliant logs to syslog, then we prepare the logs to be properly pushed to mongodb, and we publish them.

Now our folks can run their micro-batching to generate live billing and usage statistics for the customers.

How would you have tackled this kind of need? Did you suffer from technical documentations not adequate or not uptodate?

Too big to fall, not to fail!

2020-11-09T11:03:06+01:00

The late US election inspired me, mixed with several of my customers suffering from their providers’ failure, and led me to write this post to remind about the reality, and not someone’s reality. When dealing with a provider, or selecting a one, you may thing about the consequences and his failure on your business: often, you’ll prefer a big player, as he might be too big to fall. Even if falling and failing are just a character away, they are far more different.

lem.mings (‘lem-ingz): adorable yet incredible stupid furry creatures. Without your help, they have no chance of survival.

Internet is dead! Nope, just Facebook

No need to go back to the beginning of Zuck’s company history: an ultra-fast search on your favorite search engine will lead you to a major crash beginning of 2020.

We often confuse failing our company’s box with failing our customers. That’s why I prefer the term “falling” in the first case. With this little vocabulary point, we can dig a little more into what we call the “To big to ~~fail~~fall”. This has been a recurring topic since the subprime crisis of 2008. The fact that banks can fall, disappear, what about the major players in each field.

Too-big-to-fail banks not only threaten our financial system – they also distort competition © Frédéric Hache / Finance Watch

The fall of “too big” would theoretically cause the whole system to fall. Although this is not without disastrous consequences, no system disappeared with the fall of the American banks. No system disappeared with the massive fall of the car manufacturers. Massive bankruptcies, unemployment, people on the street yes. But the system did not. So those “too big” can fall.

Well, that’s not really the subject of this post, but you’ve understood: we suppose that a big actor can’t disappear because we’ll do everything we can to hold him, because after all, if he were to disappear, we suppose the consequences would be far too disastrous. So let’s move on.

No one has ever been fired for opting for IBM

Choosing “too big” is reassuring. It is known, it has thousands of employees, it weighs hundreds of millions of dollars, … It cannot ~~fail~~fall. Nope, but it can fail.

The first source of error is and has always been human. This is the primary reason for relying on a principle such as HAZOP (HAZard and OPerability studies). The principle of HAZOP is the decomposition of the system to be analyzed into several subsets, called “nodes” so that the risk analysis can be shared between individuals or multidisciplinary teams. Assume that something will fail, and then you can prevent the risk. In fact, in IT, we often use the expression:

If everything went well, then you’ve forgotten something.

Not for nothing.

In 2017, AWS suffered a huge incident on its massive storage (AWS S3). This incident was the direct consequence of human error, to debug another situation. As a result, all companies relying on AWS’ S3 service in this region have been impacted by the service outage, but worse, some have lost data, with no hope of ever finding it again. How many customers have gone out of business due to a failure at AWS?

Very often, the first reaction of a customer of these “too big”, on this type of incident, is that given the massive failure, and the number of companies impacted, your own users, the end-users, will have other things to deal with.

This is true, but within a certain limit. On the other hand, it also shows that you have not calculated the risks, and assume that this risk would be borne unilaterally by this “too big”.

You said to say Hardy!

Very often, in order to respond to these human errors, we decide that the best way is the constraint, the limitation, the process. Do what you are told and strictly what you are told. This is how your “too big”, under cover of a Quality certification for example, will set up various levels of support, each with its own forms, processes, …

Here, we can echo one of my customers, who ordered from the largest French hosting provider (Hello there, OVH), servers, proudly announced available in 120s, without specifying the quantity. Well yes, marketing doesn’t have the same concern for quality process and transparency as technology: after all, it’s not a service ;)

Anyway, servers ordered, but only partially delivered two weeks later. Impossible to have a status because the delivery process is jammed. But the fun doesn’t stop there. In order not to be caught off guard, this customer decides to start installing the servers already delivered, using the tools of this provider. Except, that these tools are bug’d. A support ticket is opened, without reaction. The customer’s teams continue to work on it all the weekend, hoping to get the whole thing up and running, and at times, receive charming mails from the provider, as:

you have set such a value to 0: except that the provider’s installation tool forbids such a value … which is only the result of a bug
stop loop crashing: except that it crashes in a loop, because installing it crashes in a loop.

Solution proposed by the founder of OVH? Replace the famous servers with its Object Storage service. The same service, which has been in error for a week, with no solution, and where some customers are complaining about a loss of revenue of several thousand euros over the same period.

Better off Ted

And meanwhile, the mail open to the support, with all the details, is not read by the speakers. Why is this? It’s out of process! The emails are processed by the level 1 support, which doesn’t work on weekends, while the technicians on site only intervene on alarms. The link between the two in normal times? Level 2 support which can only be triggered by level 1. The famous level 1 unavailable. The process is therefore, once again, at fault.

Here it is possible to distinguish several failures:

managerial, where the founder ignores the state of his department (voluntarily or not) and gives you inadequate recommendations
supply chain, where a server is missing, with no possible information, and no possible billing for the supplier.
support, where segmentation of teams prevents information from circulating correctly, preventing a technical solution from being implemented

Me, myself, and the Apocalypse

Such failures often go unnoticed by the mass of customers of these providers. However, if you take the time to search, you will always find customers. This becomes all the more true when these customers reach critical size.

So yes, one provider can be better than another (in fact, any truly professional provider is better than a low-cost provider). However, no one is infallible, and no one is too big in the face of fails.

If the service to be delivered to you is critical, then the skill levels of that provider are critical. But it is also your responsibility to have a plan-B outside of your provider. Processes (and certifications) will only serve you in court to ascertain whether the obligations of means and results have been met. Period.

How about you? Do you prefer “too big”?

Let's walk in a minefield

2020-08-27T11:24:06+02:00

If you manage an infrastructure, you probably always know the same problem: how to properly manage the blacklisting of malicious IPs. If you are on hybrid infrastructures, without adequate equipment for firewalling, this question often arises all the more. And if you want to be proactive, by securing the whole platform, as soon as a machine detects abnormal behavior, it becomes critical. Fortunately, an opensource tool, MineMeld, allows you to manage this situation, with a minimum of work.

Star Trek - Mind meld - Paramount Pictures

Avant-Propos

(Image inspired by the iTWire article on MineMeld) Not all of us can have next-gen firewalls. On the other hand, we manage servers and can deploy more and more of them. We will therefore focus on this case.

Quick presentation of MineMeld from the official Wiki:

MineMeld is a community supported tool to manipulate list of indicators and transform/aggregate them for consumption by third party enforcement infrastructure. MineMeld has many use-cases and can easily be extended to fulfill many more. Check this page for a brief list of currently supported nodes/feeds.

With non-hype words, it’s a mean to centralize all your blacklist and scorifications in order to manage your threat prevention: it imports multiple feeds, analyze/dedup them, in order to output clean feed you’d be able to use.

MineMeld diagram

The project is opensource and can be installed on a bunch of old Linux distros: the word “old” is quite important but we can deal with it. For the rest of it, I’ll provide some scripts via GitHub.

Suit up !

So we start with the installation of MineMeld. As said above, they officially support old distributions. Go figure! However, their doc explains a little bit the process for the installation on Ubuntu 18.04 for example. A little less old, I decide to start on it.

I won’t detail their installation which is done via an Ansible playbook. Rather readable, if you want to do something else, it should not be complicated.

The Hurt Locker - Kingsgate Films

Post installation, the service seems to start, but generates many errors in the logs, mainly concerning a ‘ujson’ python library. Nothing in the MineMeld documentation. However, my best friend, Google, quickly finds the answer: you have to replace the library provided by the package, by the library available in Ubuntu repositories.

sudo apt install python-ujson
sudo mv /opt/minemeld/engine/current/lib/python2.7/site-packages/ujson.so /opt/minemeld/engine/current/lib/python2.7/site-packages/ujson.so.bak
sudo ln -s /usr/lib/python2.7/dist-packages/ujson.x86_64-linux-gnu.so /opt/minemeld/engine/current/lib/python2.7/site-packages/ujson.so

After a restart of the MineMeld service, everything is running smoothly and you can finally authenticate. If you are looking for the default credentials: admin / minemeld .

Getting to know MineMeld can take a little time. I’ll give you the first few configuration items from our use case, then let you get familiar with it. Of course, I am always available if you need my assistance.

I want to blacklist

Now that the service is in place, it’s time to configure it, before you can take advantage of it on your different servers, but also to keep it up to date with your own IPs to blacklist.

Queen - I want to break free

All scripts I provide here are available on my GitHub account.

Prepare MineMeld

When you are logged in to MineMeld, you will see different menus:

Dashboard: the home page with a reminder of your statistics
Nodes: to configure your different nodes (miners, feeds, aggregators, …)
Config: to load your various (proto)types of nodes you would like to use
Logs
Admin: to configure your users
System: to see how things are going from a system point of view

Dashboard MineMeld

So the first step is to go to the Admin, and to manage your users for a minimum:

change the admin password
add a user whose login and password you will use for the scripts detailed later in this article

Then, let’s go to the Config, to manage the prototypes we want to have. In my case, I usually use at least the following ones:

blacklist_of
spamhaus DROP & EDROP
dshield
wlWhilteListIPv4 (the ‘wl’ prefix is important)
an inboundaggregator to which I assign all the miners
an inboundfeedhc (for High Confidence) of feedHCGreen type

To which I add my own ‘localDB’ blacklist. You can simply view/add new nodes by clicking on the list button at the bottom of the table:

Config list

The default configuration of the various nodes should be suitable for the use we detail here. However, you have to add the IPs that you don’t want to see blacklisted. To do this, simply edit the wlWhiteListIPv4 Node.

Be careful, the name of this node is a fake friend: it does not generate a whitelist, but just makes sure that the IPs listed there do not appear in the aggregate that you will generate at the end.

Finally, the last point to consult is the URL of the output stream. It is a matter of looking at the URL announced in the configuration of the inboundfeedhc Node. For practical reasons, it will be necessary to add the query ‘?tr=1’ to have a CIDR writing of the IPs. For ex:

http:///feeds/inboundfeedhc?tr=1

Benefit from MineMeld on Linux servers

Now that the service is setup, let’s benefit from it. Easy way, is to rely on kernel’s ipset. So don’t forget to install ipset.

I found a bash script that can use blacklist feed and source them to ipset (and maintain the local list based on the feed age). As the script was doing part of MineMeld job, in a very long time, I had to amend it a bit. You’ll find my version here.

Don’t forget to edit it with two information:

BL_URL: with the URL from your inboundfeedhc
MAIL_ADMIN: with your email address

You can also provision a (real) whitelist by adding IPs to /var/lib/blacklists/whitelist.txt . If you have specific IPs you want to blacklist only on that hosts, you can edit the blacklist.txt file at the same location.

On my end, I prefer to run this script at least once an hour, while keeping the possibility to run it on-demand.

On all my servers, I use fail2ban to parse my various logs and generate ban actions. Let’s update it with a new action: simply import the file fail2ban-minemeld.conf to /etc/fail2ban/action.d/minemeld.conf and then update your /etc/fail2ban/jail.localwith a new value for banaction: ‘minemeld’. Also, import the new ban/unban scripts and you’re done after a restart of fail2ban.

The later scripts are to be updated with the proper fqdn and credentials to access your MineMeld API.

That’s all folks

Now, you’re set with MineMeld as a centralized blacklist management for your non-next-gen firewallis. This can also be used as a feed for the NG-FW plugin from pfSense, for instance. Yet, it can still be improved, based on your needs, as via created a real output feed for your whitelists, or with different management of the blacklists.

Do you consider this useful ? How would you tackle such use case ? Feel free to ping me and share your thoughts.

Are you a Person of Interest ?

2020-05-26T11:35:46+02:00

Of course, as an individual, you’re an interesting person. But are you a Person of Interest? By that I mean, are you a person that it is individually interesting to hack, or are you just a person who is immersed in the mass of data that the hacker has targeted? With the confinement and the video binge, the opportunity is too strong to make discover some TV series to neophytes, and to debate with them on all the questions they open. After having made discover series like Person of Interest (for mass surveillance and hacking), but also Mr. Robot (for hacking), we have a lot to do, and especially to question ourselves. So, are you a Person of Interest?

Mass surveillance in China

In the last episode of…

A short summary of these series that launched the debate, and thus this article, may be useful (thanks to Wikipedia).

Person of Interest centers on a mysterious reclusive billionaire computer programmer named Harold Finch, who develops a computer program for the federal government known as “The Machine” that is capable of collating all sources of information to predict terrorist acts and identify people planning them. The Machine also identifies perpetrators and victims of other premeditated deadly crimes, but, because the government considers these “irrelevant”, he programs the Machine to delete this information each night. Anticipating abuse of his creation, Finch created a backdoor into the Machine. Tormented by the “irrelevant” deaths that might have been prevented, he eventually decides to use his backdoor to act covertly. To escape detection, he directs the Machine to provide only a tiny fragment of data: the social security number of a “person of interest”. The person may be a victim, a perpetrator, or an innocent bystander caught up in lethal events. The first episode shows how Finch recruited John Reese, a former Green Beret and CIA agent now presumed dead, to investigate the number provided by the Machine and act accordingly. As time passes, others join the team. From the beginning, the program raises an array of moral issues, from questions of privacy and “the greater good” to the idea of justifiable homicide to problems caused by working with limited information.

Mr. Robot follows Elliot Alderson, a young man living in New York City, who works at the cyber security company Allsafe as a cybersecurity engineer. Constantly struggling with social anxiety, dissociative identity disorder and clinical depression, Elliot’s thought process seems heavily influenced by paranoia and delusion. He connects to people by hacking them, which often leads him to act as a cyber-vigilante. He is recruited by a mysterious insurrectionary anarchist known as Mr. Robot and joins his team of hacktivists known as fsociety (namely “F*ck Society”). One of their missions is to cancel all consumer debt by destroying the data of one of the largest corporations in the world, E Corp (which Elliot perceives as Evil Corp), which also happens to be Allsafe’s biggest client.

Let’s not forget The Bureau, and in particular its latest season, which puts a little more emphasis on hacking.

Ok, that I’ve turned paranoid…

Personally, I’ve grown very fond of these shows. Not so much for the technical aspect (far too romanticized on Person if Interest, and a few too many mistakes on Mr. Robot), but for the questions they always raise. A good way to awaken the paranoid or conspiratorial in you.

The first question to be generally stated is:

But is there such a thing as mass surveillance?

There, you just have to call back quickly, for example:

China, and its mass surveillance system, as well as its capitalist drift with a point system…
the various revelations of Edward Snowden
mass surveillance in Russia

You’re being watched

We are talking about everything that is state-owned, but we should not forget private interests:

the massive use of cookies to track users through their internet browsing
social authentications
coverage of major groups: Google (with Android, Nest, GCP, …), Amazon (with AWS, Amazon Prime Video, Amazon Prime Photo, Amazon Prime Music, Alexa, …), Apple (with iPhone, iMac, iCloud, Siri, …), Facebook (with WhatsApp, Oculus VR, Giphy, Atlas - an advertising agency -, …)

And scandals related to the (mis)use of your personal data by all these organisations regularly make the headlines.

You shall not pass

The second question is in general:

But how easy is it to hack me, whether it’s my phone, my computer, or even my online banking account?

You shall not pass!

I like to answer this question in such a way as to make sure you are totally paranoid: excessively easy. Well, I admit, that kind of answer often makes me lose a part of the audience that is already between throwing the phone and the computer into the fire. But, for those who remain open, we can dig up the why.

If you have finished building your Faraday cage at the foot of the Green Bank Telescope, we can continue with my explanation.

The first answer to be given concerns the means. For those that do (see the second answer), companies spend astronomical budgets to guarantee the security of information systems. However, the result is not “is the door locked properly”, but “how long will the lock hold”. As with your armoured door. The real goal is not to prevent access, but to slow down the attacker enough so that you are warned and can take action. And very often these companies fail: just read the various daily announcements about massive data theft. So if, with their means, these companies fail, how can you be perfectly impervious?

The second answer concerns responsibility. So we know that your means are limited: you don’t necessarily have the knowledge or the support to do it. All too often, security measures are so restrictive for normal use that users end up competing with each other in ingenuity to circumvent them, and thus make them useless. Under these conditions, it is therefore incumbent on those who provide you with these services to guarantee their security, but also their confidentiality. This is the purpose of, for example, the GDPR in Europe, or the CCPA in California. In the same way, they must provide you with simple (and motivating) ways to make use of any security that you may be entrusted with.

It’s time now

But are they all effective? What can you do? The answer varies greatly from one solution to the next, but when I hear some people take pride in having “secured” their iPhone with FaceID, I can only recall an old episode of Columbo, where the assassin’s accomplice was driving around in a car, carrying a picture of the assassin to fool the cameras. Of course, not everyone is Columbo, but what about that young boy who manages to unlock his mother’s phone with his own face?

Columbo’s mask

The first rule is to review your PIN codes and passwords:

finish your son’s date of birth
no more 4-digit code
no more using your children’s names as passwords
no more using the same code or password everywhere

So yes, it can quickly become very complicated to have an ultra-complex password (a number, a special character, a lowercase, an uppercase, a hieroglyph, an emoticon, and especially in the right order in relation to what you ask the site or application.

But it doesn’t matter: you still have your post-its and your notebook… … … Did you hear me yelling there?

If you have an excellent memory and like mental gymnastics, you still can:

remember a page from your favorite religious book, and use it as a password with all the punctuation that goes with it *
or define a “dynamic” password: a fixed password base, that you specifically and logically complete/modify for each site.
put all the important dates in your life in a row

Except that you will always have sites or applications for which this will not fit, and you will have to find an exception… and how to memorize it.

Some users are more perverse: they lie about anything at every use and as soon as the system asks them for a password again, they follow the lost password procedure. It’s almost effective, but it’s tiring.

Others will rely on password portfolio solutions (Dashlane, 1Password, …). Why not! But we come back to the above mentioned aspects on responsibilities and their obligations. On your side, this can clearly simplify your life: there is only one password to memorize, and you can make it as complex as you want! But there is one important point to remember: they can sometimes send you a temporary code to your main e-mail address to make sure that it is you who is trying to access the wallet, so remember the password as well. That’s only two, but still.

But a password, it’s crackable. So it may take time, but since there is no such thing as zero risk, … It has to be reduced. That’s what the different techniques of [MFA] (https://en.wikipedia.org/wiki/Multi-factor_authentication) are all about:

The use of multiple authentication factors to prove one’s identity is based on the premise that an unauthorized actor is unlikely to be able to supply the factors required for access. If, in an authentication attempt, at least one of the components is missing or supplied incorrectly, the user’s identity is not established with sufficient certainty and access to the asset (e.g., a building, or data) being protected by multi-factor authentication then remains blocked. The authentication factors of a multi-factor authentication scheme may include:

Something you have - some physical object in the possession of the user, such as a USB stick with a secret token, a bank card, a key, etc.

Something you know - certain knowledge only known to the user, such as a password, PIN, TAN, etc.

Something you are - some physical characteristic of the user (biometrics), such as a fingerprint, eye iris, voice, typing speed, pattern in key press intervals, etc.

Somewhere you are - some connection to a specific computing network or utilizing a GPS signal to identify the location.

The applications listed above can help you with this, for example.

Okay, great, so you can “secure” access to your tools within certain limits. But what about your devices (computers, phone, …)? They are just as vunerable. Coming back to our friends Harold and Elliot, you too often leave open access to your phones: Wifi, Bluetooth, NFC, … So start by disabling them whenever possible. In the case of Bluetooth, some software versions allow to have it active (so that it connects elsewhere) but without “publishing” it. Same for the Wifi in your home.

Then, a good antivirus is always useful. A paying one is better. It’s stupid to say but, the advanced functions above are very useful but paying. You could always multiply the free applications that each brings a part of these functions … But this can become counterproductive in terms of security, but also in terms of performance. We then come back to the constraints that you would try to bypass.

Yes, but me I’m under Mac OS, and there’s no virus or anything like that!

Objection!

Just last week, I was able to demonstrate just by installing an antivirus on a friend’s Mac that it was a nice marketing illusion that had served its time.

Yes, but when I’m on the net, I surf via a VPN

Well, beyond the question of trust in this VPN service, a VPN is still a tunnel. Have you ever seen a road tunnel preventing a pedestrian from entering it in the opposite direction of the cars? It’s bullshit without a no, but it’s possible. So your VPN, apart from getting you to the other side of the mountain, has little use in that. And when I see the TV commercials of some people promising you privacy on the internet, I can’t help but giggle…

Am I safe?

It depends. We can finally get back to the original subject: are you a Person of Interest?

You have now done a lot for your security: you have cut useless accesses, you don’t use Social Logins anymore, you have made your passwords more complex, you abuse MFAs, … It’s not bad. So you still have the sites and applications you use. Remember, you got out of your Faraday cage to come back on the internet to read the rest of this article. You are therefore connected to third parties.

I remember last year, a friend of mine was worried because he had received an email “sent by himself” (remind me to tell you about Sender Forgery and Spoofing), threatening him to “divulge he knows exactly what was found on his hard drive” unless he paid a Bitcoin ransom. So for one, this famous friend is a bit paranoid and only uses LiveUSB. And two, he doesn’t store anything because he’s unable to find anything (which can be funny in private life). Anyway, the question was: why was he targeted?

Well, he wasn’t actually targeted. His email was simply found in a database that was hacked, and the vile offenders decided to send emails to all known addresses found in it. After all, they would find at least one person “who knows very well what was lying around on his hard drive” and who would pay his ransom without flinching.

However, there is no stolen confidential data here, nor any real ransom. This is just an attempt at a mass con.

But the point is interesting. This reminds me of the episode Shut Up and Dance of Black Mirror. That pretty much sums it up. If we hack you specifically, knowing you for real, there’s an interest. But this is still extremely exceptional, and no, your personal savings do not interest us. Either you’re doing something illegal, and that interests the authorities or the avengers. Either you actually have money (we are talking in billions). Or finally, you have access to interesting information (business, strategy, … always for values in billions).

But, again, this is an exception. The general rule is that you are just drowning in the mass of information hacked from vulnerable sites/tools. There are various ways to see if this is possible: the portfolios mentioned above, but also a well provisioned website: Have I been pwned?.

My soul of great paranoid romantic prefers to stay on the idea that I am a Person of Interest, and that the Machine is watching me. And you, are you a person of interest?

PS: remember: You’re being watched.

My neighbor is noisy

2020-04-17T10:11:46+02:00

Don’t worry, I won’t discuss about my personal neighbors during the Covid-19 confinement. Lately, several of my customers had random and difficult-to-diagnose issues with their Cloud instances. As this is not related to a specific provider (some of them are using AWS while the others are using OVH Public Cloud), the root cause remains the same. Before going into more detail, I’ll give you a quick answer: their neighbors are noisy.

Protesters demonstrate against Donald Trump’s presidency during the campaign trail in 2016 (by AP)

Some quick reminder

Of course, you all know what the Cloud is, don’t you? So no, it’s not just your online storage, it’s not just your photo sharing. According to Wikipedia, as we’re discussing especially about Cloud Computing:

Cloud computing is the on-demand availability of computer system resources, especially data storage and computing power, without direct active management by the user. The term is generally used to describe data centers available to many users over the Internet. Large clouds, predominant today, often have functions distributed over multiple locations from central servers. If the connection to the user is relatively close, it may be designated an edge server.

Technically, those are virtual resources, easily manageable. By virtual resources, I mean a segmentation of the physical machine into different instances, dedicated to different customers. All of this at the scale of entire data centers.

The virtualization provided is based on usual market solutions (VMware, kvm, …) with potentially management overlay, or home-made solutions. So we talk about hypervisor for the host machine, and instance for the virtual machine.

Virtual Architecture

The subject that interests us here is in itself neither new nor unknown to Cloud providers: they are all gradually releasing offers with “guaranteed performance” or “dedicated resources”. But why this?

Let’s go back to our virtual architecture: we see it as a segmentation of the host machine. Let’s replace our server by a cake and the instances by slices. So you can cut your cake into as many slices as you want, as long as there is cake. Therefore, to have more slices, you have to make them smaller. The same is theoretically true for virtualization.

Theoretically is the important word here: indeed, your providers bet that not all their customers were using all the resources allocated to their instances at the same time. They then decided to keep larger sizes for the instances than the host machine can handle. This is called overbooking.

Most of the time they are right. But the moments that make them wrong, are detrimental to you. This overbooking is predictable for you, customers, depending on the tariff of your provider: the cheaper it is, the higher the probability and the coefficient of overbooking. In addition to dedicated resources, some providers promise you an adequate infrastructure where storage would be the absolute key, through fully SSD-based storage. That’s good. But that’s not all.

Tip: I can’t repeat it enough to my various contacts: no the ‘Cloud’ is not cheap and not very quickly you cost an arm and a leg.

My noisy neighbor is named…

Because of this overbooking, whether it’s naturally related to the mass of instances, or specifically due to a single instance (our Noisy Neighbor), the effect is the same: you have at a given time, less resources available than expected.

The first question I hear most often then is:

But how do you detect it?

This is the most difficult part for you because, in the middle of a run, this can manifest itself in various ways, with obvious signals only in some rare cases. The other signals will simply be the direct consequences on your own service.

On Linux, top can provide one of the obvious signal. Have you ever wonder what is the st value at the end of the second line ? To be conciese, st, for “steal time”, is only relevant in virtualized environments (your Cloud setup here). It represents time when the CPU, from the host, was not available to the current instance: it was stolen. If you want more details about this steal time, you can refer to this tech paper from IBM.

A recommendation to all my customers, when we work on their monitoring platforms, is to include behavior change and comparison tests. Do latency levels suddenly increase? Does the system have hangs without being loaded, and without I/O?

Monitoring room in China

On latency, for example, I remember one client where we worked on their content distribution services using nginx and doing some pretty advanced fine-tuning. From there, we launched tests and set up monitoring for each of the instances concerned. Very low latencies and high bandwidths, at all times, whatever the instance and the Cloud provider. Then one morning, this customer called me with a catastrophic call: all his European customers were complaining about abnormally long latencies when opening the hosted videos. The analysis tests went quite far:

check the navigation timing values to determine what could generate these latencies: the TTFB increases abnormally while everything else is stable.
only the platform hosted in France on one provider is impacted: no abnormal latency on other providers or regions
no machine load (nor steal time - see above)
no I/O
low throughput of the concerned instances: 10 Mbps on average against several hundred for those with no worries

While we’re testing in all directions, with no configuration changes other than juggling the nginx debugging options, the service returns to normal. The next day, around the same time, the same client contacts me again in a panic over the same subject. Same analysis, same result, same return to normal.

After (too) long exchanges with the support of this provider, we finally got the information: another instance was behaving abnormally and was consuming a good part of the machine resources, in particular the network part (speed and number of connections). You said peer-to-peer for last summer’s family videos?

My neighbor moves me

On the subject of the “hang system”, it’s a little more vicious and specific. A client in the video industry, does massive transcoding using ffmpeg. Part of the work is done via CPUs (the smaller resolutions) while the higher resolutions (HD / 4K in mind) are done via GPUs. The setup works well except that regularly some live streams are disturbed in an incomprehensible way, exclusively from the CPU instances. After a long analysis, the only common point of all its interruptions, both in terms of chronology of events, behaviour and logs, is the “bridle” of ffmpeg to a single CPU thread actually used.

Delivery guy collecting a package

We therefore focused our analytical work on understanding what could cause this behavioural change on the part of ffmpeg. After different stress-tests of the instances, only one allowed to reproduce the behavior: the I/O stress-tests at the kernel level, causing system hangs.

At that time, my client remembered having vaguely seen some automated storage migration emails passing by the concerned provider, at the same time as the famous interruptions.

So yes, another important reminder:

Tip: Theoretically transparent host or storage moves are rarely transparent in practice.

Let me be!

The next question, they usually ask, is:

But how do you prevent it?

It all depends on your budget!

Large instance consumers allow themselves to test an instance when spawning it to make sure there are no noisy neighbors from the start. Tests are typically stress-tests specific to each instance template used, the results of which are compared to the average values of the instances considered “valid”. Automation of your entire infrastructure is key here.

This pre-use stage of the instance can quickly become expensive: some people have been surprised to see dozens of attempts before having a viable instance. Time being money in the Cloud world, …

A dog hunting

Most people implement corrective solutions. The monitoring (see above) is then interfaced with the automation tools and will restart a new instance to replace the one detected as disturbed.

This is the least expensive but can have two impacts depending on your service/infrastructure:

a small delay before detection and/or relaunch
a service interruption if your instance is not redundant or if your load-balancer is slow to detect its unavailability

Another solution would be to host your services on dedicated infrastructure when it makes sense, and consider Cloud services as overflow solutions.

Do you agree?

I remember an article explaining that it was the fault of your application and not of cloud hosting. We could go back to the eternal war between Dev and Ops, but these articles usually completely overlook the monitoring aspects and therefore the observability of what is going on. Their point of view is therefore valid, but not gospel.

On your side, have you ever been through these setbacks? How did you react?

My life with a geo-replicated GlusterFS setup

2020-03-26T17:15:16+01:00

Recently, I had to build a geo-replicated GlusterFS setup and encountered a bunch of issues due to the not-so-up-to-date documentation and the unlucky thing. So much time spent reviewing things and discussing with the dev team over IRC. Here’s my (recent) life with a geo-replicated GlusterFS setup.

My life with a geo-replicated GlusterFS setup

But why ?

Before we get started, it would be good if I gave you a little context. So, this is an assignment for a software company.

They provide their customers with large amounts of data (about 11 TB). The publisher being French, and for reasons of ease and sysadmin skills - at the time of implementation - has created all its infrastructures in France.

Due to the fact that they have little control over their network (provided by another service provider from which they cannot leave for the moment) and a worldwide audience (with a strong increase on the North American continent), they were forced to deploy edge servers (HTTP services allowing the local distribution of its famous 11 TB).

This then irremediably leads to high latencies and low throughput for these North American users. Not a very pleasant user experience, you’ll tell me about it. If we talk about numbers:

Latency: 2 seconds compared to 0.3 seconds from France.
Throughput: 500 kB/s compared to 15 MB/s from France (and even 150 MB/s locally at storage)

So they decided to call me to see how we could improve things with the following constraints:

rely on the existing provider (which has infrastructure in Europe and North America)
with the smoothest possible future migration to make it a quick-win

After an audit, we come to a decision for the following setup:

local cluster in France, based on a distributed GlusterFS setup
Local cluster in North America, also based on a distributed GlusterFS setup, geo-replicated on the first one in real time.

The interesting thing here will also be to recycle technological bricks that the editor’s team already knows about, and to stay on something quite high level: GlusterFS is an overlay to the underlying filesystem (XFS was our choice here). The GlusterFS documentation (since version 3.5) also promises the correct operation of geo-replication over a distributed setup.

Please, note also that I’ll resume the operations here, not describing the minutes of each action.

The setup

I enjoy working with Ansible to deploy my small clusters, like many DevOps. So I’m starting on it, writing my own playbooks. Be careful, the project presented on the previous link is the result of the work described here, after a little obvious cleaning, and potentially before a sequel …

The idea of this setup is to have the following elements:

Each country has its own cluster GlusterFS (the master being in France)
Each cluster has two servers in distributed mode
Each server has 10 disks of 4 TB available for this storage, built in software Raid type 10, formatted in XFS
Each node mounts the cluster locally with these parameters: 127.0.0.1:/storage-fr /opt/self glusterfs defaults,_netdev,noatime,log-level=ERROR,log-file=/var/log/gluster.log,direct-io-mode=no,fopen-keep-cache,negative-timeout=10,attribute-timeout=30,fetch-attempts=5,use-readdirp=no,backupvolfile-server=fs-fr-02 0 0

GlusterFS Distributed Volume

That’s the setup at the very beginning. Now let’s live it.

And then there’s the drama

Thanks to the Ansible playbook, the entire deployment goes smoothly and without errors. So I import my 11 TB and then I admit… but not for long. It’s perfect, but a SysOps rule scares me:

If everything goes well on the first try, you’ve forgotten something.

Fortunately for me, not everything is so beautiful: geo-replication doesn’t start. A glance at the geo-replication status does indeed bring me back to reality:

gluster volume geo-replication storage-fr fs-ca-01::storage-ca status

MASTER NODE      MASTER VOL    MASTER BRICK        SLAVE USER    SLAVE                       SLAVE NODE       STATUS    CRAWL STATUS                   LAST_SYNCED
------------------------------------------------------------------------------------------------------------------------------------------------------------------
fs-fr-01         storage-fr    /opt/brick           root         fs-ca-01::storage-ca        N/A              Faulty    N/A                            N/A
fs-fr-02         storage-fr    /opt/brick           root         fs-ca-02::storage-ca        N/A              Faulty    N/A                            N/A

In fact, the startup passes the replication to Active and then immediately to Faulty. For a successful setup, I would come back. So obviously, we always start by consulting the logs first:

less `gluster volume geo-replication storage-fr fs-ca-01::storage-ca config log-file`

And here we see a beautiful log entry, extremely explicit:

E [syncdutils(worker
/gfs1-data/brick):338:log_raise_exception] <top>: FAIL:
Traceback (most recent call last):
  File "/usr/lib/x86_64-linux-gnu/glusterfs/python/syncdaemon/gsyncd.py",
line 322, in main
    func(args)
  File "/usr/lib/x86_64-linux-gnu/glusterfs/python/syncdaemon/subcmds.py",
line 82, in subcmd_worker
    local.service_loop(remote)
  File "/usr/lib/x86_64-linux-gnu/glusterfs/python/syncdaemon/resource.py",
line 1277, in service_loop
    g3.crawlwrap(oneshot=True)
  File "/usr/lib/x86_64-linux-gnu/glusterfs/python/syncdaemon/master.py",
line 599, in crawlwrap
    self.crawl()
  File "/usr/lib/x86_64-linux-gnu/glusterfs/python/syncdaemon/master.py",
line 1555, in crawl
    self.changelogs_batch_process(changes)
  File "/usr/lib/x86_64-linux-gnu/glusterfs/python/syncdaemon/master.py",
line 1455, in changelogs_batch_process
    self.process(batch)
  File "/usr/lib/x86_64-linux-gnu/glusterfs/python/syncdaemon/master.py",
line 1290, in process
    self.process_change(change, done, retry)
  File "/usr/lib/x86_64-linux-gnu/glusterfs/python/syncdaemon/master.py",
line 1229, in process_change
    st = lstat(go[0])
  File
"/usr/lib/x86_64-linux-gnu/glusterfs/python/syncdaemon/syncdutils.py", line
564, in lstat
    return errno_wrap(os.lstat, [e], [ENOENT], [ESTALE, EBUSY])
  File
"/usr/lib/x86_64-linux-gnu/glusterfs/python/syncdaemon/syncdutils.py", line
546, in errno_wrap
    return call(*arg)
OSError: [Errno 22] Invalid argument:
'.gfid/1ab24e67-1234-abcd-5f6g-1ab24e67'

First though is about a specific issue at some files. Checking the file matching the gfid, it occurs to seem valid. As an attempt to save the day, I get rid of it and restart the geo-replication. With no success at it fails the same way. Discussing with the Gluster dev team over IRC, they wonder if the amount of initial data might not be the issue. Fair enough, I get read of the data 1 TB per 1 TB, testing the geo-replication at each stage. Still no luck. As I end with a totally wiped folder, with no more data, I wondered if the changelog did not get corrupted or filled up during those test. I decide to wipe the complete cluster and attempt once again the deployment with Ansible, but without importing any data. To wipe the setup on the servers, I used the following commands:

sudo ansible fs-fr-01 -m shell -a "gluster volume geo-replication storage-fr fs-ca-01::storage-ca stop force"
sudo ansible fs-fr-01 -m shell -a "gluster volume geo-replication storage-fr fs-ca-01::storage-ca delete reset-sync-time"
sudo ansible fs_fr -m shell -a "echo y | gluster volume stop storage-fr"
sudo ansible fs_ca -m shell -a "echo y | gluster volume stop storage-ca"
sudo ansible fs -m shell -a "dpkg -l | grep gluster | awk '{ print \$2 }' | xargs sudo apt -y remove"
sudo ansible fs -m shell -a "service glusterd stop"
sudo ansible fs -m shell -a "umount /opt/self"
sudo ansible fs -m shell -a "setfattr -x trusted.glusterfs.volume-id /opt/brick"
sudo ansible fs -m shell -a "setfattr -x trusted.gfid /opt/brick"
sudo ansible fs -m shell -a "rm -fR /opt/brick/.glusterfs"
sudo ansible fs -m shell -a "find /usr -name '*gluster*' -exec rm -fR {} \;"
sudo ansible fs -m shell -a "find /var -name '*gluster*' -exec rm -fR {} \;"
sudo ansible fs -m shell -a "find /etc -name '*gluster*' -exec rm -fR {} \;"

And as you might have expected: it failed over once again!

E [syncdutils(worker
/gfs1-data/brick):338:log_raise_exception] <top>: FAIL:
Traceback (most recent call last):
  File "/usr/lib/x86_64-linux-gnu/glusterfs/python/syncdaemon/gsyncd.py",
line 322, in main
    func(args)
  File "/usr/lib/x86_64-linux-gnu/glusterfs/python/syncdaemon/subcmds.py",
line 82, in subcmd_worker
    local.service_loop(remote)
  File "/usr/lib/x86_64-linux-gnu/glusterfs/python/syncdaemon/resource.py",
line 1277, in service_loop
    g3.crawlwrap(oneshot=True)
  File "/usr/lib/x86_64-linux-gnu/glusterfs/python/syncdaemon/master.py",
line 599, in crawlwrap
    self.crawl()
  File "/usr/lib/x86_64-linux-gnu/glusterfs/python/syncdaemon/master.py",
line 1555, in crawl
    self.changelogs_batch_process(changes)
  File "/usr/lib/x86_64-linux-gnu/glusterfs/python/syncdaemon/master.py",
line 1455, in changelogs_batch_process
    self.process(batch)
  File "/usr/lib/x86_64-linux-gnu/glusterfs/python/syncdaemon/master.py",
line 1290, in process
    self.process_change(change, done, retry)
  File "/usr/lib/x86_64-linux-gnu/glusterfs/python/syncdaemon/master.py",
line 1229, in process_change
    st = lstat(go[0])
  File
"/usr/lib/x86_64-linux-gnu/glusterfs/python/syncdaemon/syncdutils.py", line
564, in lstat
    return errno_wrap(os.lstat, [e], [ENOENT], [ESTALE, EBUSY])
  File
"/usr/lib/x86_64-linux-gnu/glusterfs/python/syncdaemon/syncdutils.py", line
546, in errno_wrap
    return call(*arg)
OSError: [Errno 22] Invalid argument:
'.gfid/00000000-0000-0000-0000-000000000001'

This time, the gfid matches the Gluster root: /opt/self. How may it fails over the empty root? I review the complete setup with the dev guys and we could not find any issues with it: it correspond to the simpliest version of the documentation, without any potential permission issue as I built the setup as a root to begin with. One of them proposed to use a python script that can do it all “by magic”. The tool installation and usage is pretty straight forward … but yet: no luck.

After several days of digging, building and wiping things, using different hardware and VMs, I asked a simple question: is the distribued setup meant to be the source of the geo-replication? Colleagial positive answer as it’s available since version 3.5, as we are at version 7.3 and none of them touch this part of the code, it should work. Right. Should is the key to it all. None of them tested this setup since the branch 4.x of GlusterFS. Or fair enough, I can build a new setup quite quickly: let’s move to a replicated setup as a source to the geo-replication… And voilà! Now it works perfectly fine. There was some regression at least since the branch 5.x and no once noticed.

Not the most perfect solution but I can still achieve the same results my customer expect. Let’s move to a new setup:

Each country has its own cluster GlusterFS (the master being in France)
Each cluster has two servers in replicated mode
Each server has 10 disks of 4 TB available for this storage, built in software Raid type 0, formatted in XFS
Each node mounts the cluster locally with these parameters: `127.0.0.1:/storage-fr /opt/self glusterfs defaults,_netdev,noatime,log-level=ERROR,log-file=/var/log/gluster.log,direct-io-mode=no,fopen-keep-cache,negative-timeout=10,attribute-timeout=30,fetch-attempts=5,use-readdirp=no,backupvolfile-server=fs-fr-02 0 0

GlusterFS Replicated Volume

Ok we have a working setup, we can import the 11 TB. It will take quite some time. I run a simple rsync command in a screen without supervising it, and I’ll repeat the command over and over until the migration to be as up-to-date as possible prior to the M-Day:

rsync -PWavu /mnt/old/ /mnt/new/ --delete-during --ignore-errors

So far so good, the M-Day is here and we decide to proceed with the migration. We update the mount points and benefit from the same options as previously. The customer is happy as the promised performance are reach in term of latency and throughput. Meaning, I’m happy and relieved.

Did you think it was over?

A couple hours later, his biggest customer in the US reach him out as they can’t access any files. Checking the logs, I can see a bunch of HTTP codes 200 and 304, so I wonder if the issue is a pebcak or an intermediate cache issue somewhere else: I request a couple of problematic URL to test.

Checking the provided URL on both FR and CA platforms, I succeed to reproduce the issue. Checking first the edge servers, they show that the files do not exists. As the platform data was up-to-date, it is pretty unclear. Comparing the same folder on both platforms, the CA instance appear … empty. But df reports the same volume usage. I decide to just add a simple -a param to my ls … and there they all are: the files exist, with the proper size, in the proper folder but instead of player.json (for instance), it’s named .player.json.AbvgGY. Weird ? Not so much as this is the format of the temp files from an rsync. But why do GlusterFS do not fix them on the CA platform as the data and naming are valid on the FR side ? Simply because it relies on a simple checksum of the content, ignoring the name of the files (it expects to track the rename() operation on the fly).

What’s your name? Fuck you, that’s my name.

At this stage, my guess is that something happened during the data importation leading to the wrong file being copied. Checking each cluster logs, status and details (including the heal info), it appears that a split-brain occured on the FR platform. Pretty logicial with only two nodes in it. Digging a bit more on the timestamps, logs, states, … At the end, a pretty race condition of multiple things:

a pebcak (from me): I ran the rsync command with no specific param, leading to the creation of temp files ; I should have added --inplace argument to ensure using the proper name at once
network issues at the provider stage: kinda expected but it occured multiple times, and part during the rename() operations
GlusterFS georep being too simple: why the heck don’t they include the name in the validation of the content?

So, as long as it’s simple to heal the FR cluster (both split-brain and invalid data on one node), fixing the names on the CA cluster is not obvious. There is no GlusterFS mechanism to do so, and I can’t afford waiting for a week for the data to sync again if I decide to wipe the data. From here, I come with a new idea that is just an abuse of what GlusterFS is and how to fix a split-brain situation.

I know that I have no more customer connections to the CA cluster as I moved them all to the FR cluster while solving the issue. To summarize the idea:

GlusterFS considers that writing to a local brick (outside of GlusterFS) is an issue as it will lead to a split-brain
A split-brain can be resolve by reading locally the file via GlusterFS (mountpoint over 127.0.0.1) if there is no concurrent access to it
a rename() operation does not change the gfid, it just update the underlying link GlusterFS use
We know the data is valid, just the name is an issue

Thanks to this, I write a quick script and run it over my folders:

#!/bin/bash

find /opt/brick/ -name ".*" -type f | while read f; do
        rename -f -d -v 's/\.([^.]*)\.([^.]*)\..*/$1.$2/' $f
        brick=`dirname $f`
        self=`echo $brick | sed 's/brick/self/g'`
        filename=`basename $f`
        echo $self | xargs ls -la &> /dev/null
        dest=`dirname $brick`
        sudo rsync -a --inplace  $brick root@fs-ca-02:$dest --delete-after > /dev/null
done

exit 0

Not the proper thing but efficient at least. It rename the file and ensure to solve the split-brain, before removing any invalid remaining dot file on the other node of the cluster. Neat.

One more thing…

We should be fine. “Should”. But we are not. New issue occurs on the edge servers as a full heal is running on the FR platform. Some of them expose corrupted files that are being healed, then cache those invalid files. As they are ok on both nodes of the cluster, the issue is clearly on the edge servers. To solve it, we just need to umount/mount the Gluster endpoint. Quick, efficient. We should re-do it once the full heal is achieved.

Besides all those issues with GlusterFS 7.3, I used to run a bunch of setup based on it … until the branch 4.x included. It used to be a bit more stable/reliable. I love the solution as it’s just a new layer, allowing you to build lots of things under it or around it. When it works, it just works. But when you have issues, the logs are not your best friend. I thing this is the main issue for a larger adoption of GlusterFS at this stage: the log entries and the documentation.

Do you use GlusterFS to build your reliable storage or geo-replication services ? Do you struggle with it ? Feel free to ping me to discuss more about it.

Is the Coronovirus your opportunity ?

2020-03-03T17:14:06+01:00

While the world is watching as much news about the spread of Coronavirus as it is taking its temperature, business discussions are revolving around the global economic slowdown, forcing the various Central Banks and other financial organizations to meet to agree on “solutions”. What if the situation is actually your opportunity?

Inspired by some questions from my contacts as a Freelancer

Dependency on Asia…

I don’t think there is any need to linger on the news channels to know/understand how much we are now dependent on Asia (China, Taiwan, Japan, …). Indeed, between processors and micro-controllers foundry, manufacturers of electronic equipment, the various low-cost supplies (who is talking about the FFP2 mask components from China?)… we have such a dependency that our economy is directly affected.

As recently as yesterday, one of my former colleagues, who was retrained in the supply of fibre-optic networks, seemed to be somewhat concerned about the situation and the risk to his business if he could no longer supply himself with network hardware. This point is collegially taken up by various service providers whose equipment comes from Asia. If the virus continues to spread as it does, many other industries will come to a standstill, also in Europe or the Americas.

Many economists are therefore pointing the finger at the notorious globalisation that would have pushed us to produce ever cheaper, and therefore ever further. To this, they oppose as a solution to relocate, closer to the places of consumption: the also famous, near-shoring. However, hadn’t we avoided it precisely for reasons of cost, (un)skills, and also for reasons of calculating risks and other opportunities by saying to ourselves “if things go wrong, we’ll find another cheap solution”. To that, I would reply that they do not learn from their own mistakes.

Dependency on non-education of the lower classes

Today, if we look at our countries, the sectors most at risk because of potential containment are the industrial sectors, with a large workforce at very low cost. The same sector that we were looking to replace with offshoring in Asia, and that we now want to upgrade (conceptually) with near-shoring.

Cutting your costs in half!

However, it is this same workforce, unskilled, often poorly educated, that is at the origin of the various populist movements that we have seen emerge in recent years. This is the same class that we continue to feed with fears and no real solutions, other than to tell them that we are protecting them and that the risk is low, or that we should not panic.

My professional deformation makes me ask myself a question: how is this answer a solution? It is relatively simple: it is not. Indeed, as with our dependency on Asia, we do not look at the original concern that motivated this or that action: we focus exclusively on factors of consequence. For us technically, this is our famous RCA.

Why is this situation with the lower classes a concern and is related to their non-education? The answer can be broken down, mainly, as follows:

Non-education (for reasons of means, gentrification, …) reduces their ability to rise outside the pre-established framework.
non-education will push them towards jobs with little added value and where they themselves have little added value: a robot would do just as well…
this work forbids them any possibility of remote work.
the low remuneration they earn prevents them from having access to better information (we will come back to this later), but also to quality solutions in the field of health care, e.g., the use of the Internet.

The sewing room of A.T. Stewart’s in 1875

What about…

I’ll grant you, it’s not all bad. Many companies already offer their employees remote working as a preventive measure. However, far too few are taking the plunge, for a variety of reasons:

it’s too complicated (we’ll come back to this later).
you lose the human side (really?)
it’s because of insurance (do you think?)
or it could simply be because of a lack of trust

Are you really working from home?

Of course, conditions and means have to be put in place, but as long as the job is suitable, nothing is unfeasible. This becomes all the more ironic when the companies refusing this teleworking are hosting companies or network operators.

For the record, this reminds me of a situation at a major French telecom operator a few years ago. I was normally working from the Paris HQ, to work on datacenter equipment, located in the suburbs. When, for practical as well as human reasons, I preferred to work from the said datacenter, I almost received a reprimand for not coming to the office and performing unofficial remote working. The datacenter belonged to the company and we had complete control over the video surveillance, so it was easy to check whether I was working on site or not.

Here, we went from one extreme, with the factory, to the other, with a specific case of DevOps. But what about all the small convenience stores, for example? Of course, it’s clearly not that obvious. Still, for administrative matters, the means exist. More and more are getting available over internet: lately I registered myself for the next elections within minutes and received my voter card in the next couple of days.

And what about our software? See the Android case with Chinese Huawei? Opensource might be your solution in most of the situation. In France, you can rely on the April association (I’m also a member there) to assist you on those matters.

And so?

Careful, now. Here I only give possible angles for reflection. These are not absolute truths and I would not claim to be a perfect economist. It is only part of my strategic vision to respond to many concerns. These concerns, I will address them afterwards in the form of small questions. To do so, I would try some parallels with subjects that I master better, because they are related to my daily professional life.

How can you not be dependent on Asia?

The real question here would be rather: how to stop being dependent? So, I’m cutting down on any preconceived notion that you have to be self-sufficient:

It’s a heresy of our nature: mankind has always done great things because of its communities…
the self-sufficient seeks to reduce the definition of our essential needs in order to remedy them; this leads irremediably to a problem: each of us cannot have access to the whole range of resources essential to our own sufficiency and ends up depending on a third party… or not…

So yes, the real question is how to avoid (harmful) dependency. The point is precisely in one of the reasons that invalidates self-sufficiency: everyone needs his neighbour because we still don’t have access to the same resources. The solution is therefore to multiply the sources of supply for each type of resource. In our daily work, this is the basis for redundancy:

We had a single server with a single disk…
we have multiplied the disks and power supplies of the PC to guarantee its operation
we have multiplied the servers to ensure the loss of a
we have multiplied the connectivity with the internet to ensure the loss of a link
we have multiplied the points of presence (datacenter) to guarantee the loss of a physical site

In other areas, this redundancy is omnipresent: be it organizational, procedural, procurement related, … So why is it that in our economy and our business strategy, we persist in having only one supplier? This is the primary reason why offshoring and near-shoring alone is not the answer.

So yes, you could tell me that multiplying supply contracts reduces the mass agreement with a single supplier, and therefore costs a little more in the end. But how much is your addiction costing you? Today, because of containment and non-supply, you’re in danger of going out of business. Tomorrow, your dependency will give your supplier the power to change the situation and put the knife to your throat. Of course, you will still be able to leave, but at what price. What guarantee do you have that other ~~vultures~~ won’t try to kill you?

Is near-shoring a good thing ?

When we talk about near-shoring, we are talking mainly about local industrial production, not about small local shops. So yes, clearly, it does not solve everything, but it does bring some benefits:

it provides work locally
it reduces the product transportation chain, and the pollution associated with it
in the case of foodstuffs, this could avoid certain phenomena where “local” products for exporters have reached astronomical prices for local populations (i.e. avocados)

However, since we are talking about industry, we are generally talking about cheap, unskilled/educated labour. Reversing or intensifying near-shoring, therefore means intensifying the use of this labour force and thus favouring its deep rooting in this “cheap and unskilled” situation, generating a nice vicious circle. Are we talking about recent popular movements all over the world, including in France?

I wonder, then, about one of the main promises of the industrial revolution, which we are continuing today, no matter what anyone says: automate what can be automated. I’m not referring to automating to increase production capacity. I am referring to automating to reduce repetitive human actions.

Whether it’s about home automation, robotic chains, Internet of Things, … so many ways and approaches precisely to rely on automation. For all that, it is not the disappearance of the human on these roles, but rather an obligation of evolution: even if we consider that an AI would be able to generate code, it remains essential that a human remains the master of the code, i.e. the definition of the action, the design of the robot, … That there be assistance, yes, but not replacement. If you want one entrepreneur who talks about it…

In the same way, for corrective maintenance, improvements, problem analysis, … All this must require a human factor intervener for the analysis. The answer to the previous problem of the situation of the lower classes is therefore to promote their education and access to information.

Remote working versus daily obligations ?

When working remotely or, even worse, in forced confinement, the population is exposed to isolation and supply complications. Moreover, recent fears in certain regions of France have motivated local populations to obtain mass supplies of non-perishable foodstuffs, thus producing a small shortage effect that could be managed quite differently.

Massive remote-working at the level of a community (i.e. far beyond a company) has the effect of amplifying any sense of isolation, but also the fear that the media can convey.

Here again, access to clear and accurate information helps to compensate for the latter. On the other hand, with regard to isolation, it is necessary to distinguish between different cases.

In the case of isolation from local shops, online shops can set an example. Of course, this may be easier for the big players (supermarket chains, major e-commerce sites such as Amazon, …) but the small business can have so many possibilities:

take advantage of marketplaces: after all, a good part of Amazon’s revenue on its site comes from its intermediary model; other sites also exist, more or less specialized (i.e. Etsy for handicrafts)
use turnkey SaaS solutions: Shopify, Wix, …
rely on local delivery services with food as a good example: UberEats, JustEat, Frichti, …

And here I’m only mentioning a few 2.0 solutions. What about all the old-fashioned solutions that continue to exist as:

mobile libraries
delivery of bread
pizza trucks

And for your supermarket habits, solutions already exist:

online supermarket with drive-in
online supermarket with delivery

Then, what about the doctor and any medical care? Online consultations are already a reality in France, officially supported by social security. Of course, this only allows an initial filtering for benign concerns, but it can make medical practices and emergencies so much lighter, while at the same time compensating for some medical deserts. Likewise with meds e-commerce websites.

Yet another case would be about the upbringing of our dear little blonde heads in all this? The subject is indeed a little more peculiar. Where MOOCs and other online course solutions may be suitable for the vast majority, it’s not so easy for young children.

Mainly because some learning techniques, such as Montessori, show that it is through the effect of community mixed with mimicry and the desire to learn, that our children learn best. The other important point of these teachings is that this group of children must be restricted, contrary to the unwanted trend of “normal” education which wants to have 35 children per class.

The application of these methods, in small groups, thus makes it possible to return to a very local aspect, even in villages with low density. This point is also related to the previous topic on the middle classes. It is one of the possible ways of providing access to better education. Before going on to specializations that can be done, among others, through the MOOCs.

Finally, what about the human side, then? I’d say you have free will to choose the best way to maintain your relationships. I would cite for example a solution to keep in touch with your elderly relatives: Sunday.

Your opportunity ?

How is this an opportunity for you? Quite simply because it is up to everyone to step in and do what they can to make it happen. There is a range of solutions for every question you may have. This can potentially improve your living environment and even the famous work-life balance.

Also, containment in China, for example, certainly has an impact on their economy, and by rebound, on ours, but also and above all on pollution and therefore ecology.

Satellite imagery shows a drop in air pollution over central and eastern China following a government imposed coronavirus quarantine. (NASA Earth Observatory/Joshua Stevens)

Fighting against containment through old and new means; promoting teleworking, while trusting in the professionalism of employees; improving education through new methods; … are all answers for a brighter future.

What more do you think you could do today to turn this situation into an opportunity? Feel free to contact me to discuss it. I surely have some solutions to submit to you for your connected issues.

Agile and Infrastructure

2020-02-24T09:11:25+01:00

Recently, I had a rather interesting discussion with some of my clients over Slack: Agile processes applied to Infrastructure. At the beginning, we did not reach a common ground, but we quickly realized that the problem was not our approaches, but our vocabulary. Agile? Infrastructure? Once we agreed on these terms, the discussion took on a completely different form. Here is a short summary.

Agile ?

Often, when we talk about Agile, we talk about agility. It is assumed that it is about being flexible in our actions and reactions. It is mainly a mix between a mindset, a culture, an approach and above all a paradigm.

Defined in the Agile Manifesto, this approach to project management is the opposite of traditional approaches such as the V Cycle or cascades. The short version is that these traditional methods lead irremediably to a tunnel effect, which can have disastrous effects on both the project and the client relationship. Conversely, the Agile approach proposes to reduce this tunnel effect as much as possible in order to allow better transparency, through an iterative and incremental process.

So the key elements are there: transparency and iteration. From this, many other concepts will derive, related to the different methods but also to the contexts of applications. Many sites and books will describe them much better than a few lines on this blog.

Infrastructure ?

An infrastructure is a set of interconnected elements that provide a framework to support the entire structure. As such, it is not just the network or system, but a collection of these elements and many more, to be considered in context. In the case of a team, we will have to talk about, for example, NetOps, DevOps, SRE, Architects, Infrastructure Engineers, … All working on the same subject, with different angles, and therefore different needs and means: their daily tasks, depending on their position and the context, will range from pure Run, to R&D applied to infrastructure.

And so ?

Okay, so let’s go back to our original discussion. Why talk about Agile and Infrastructure? We had different points of view together (I arrived during the discussion) and the central point was about the ability of “Infrastructure” teams to work in an Agile way.

One of the participants, who manages an operational team, therefore pure Run, did not see how Agile could be applied to the Run. The other, an R&D manager, was suffering from blockages from an Infrastructure Engineer who had joined his team after years of working on Run. The last one was managing a team that did both R&D and Run, and especially managing a rather junior DevOps that he was happy to model as he went along.

Depending on the interlocutor, it was more or less possible to apply the Agile approach to Infrastructure and that if someone couldn’t do it, it was simply their fault. Rather abrupt.

In fact, we must remember that in the professional world, it is our experience that models us. So you have to look at the current tasks to be performed but also at the past tasks of the people who will be working there. A person who has never worked in project mode will potentially find it more difficult to integrate into a project mode than someone who has been in it since the beginning of his or her career. And in Infrastructure, there are a lot of opportunities to work in project mode, but also a lot not to.

Making the infrastructure agile

So the real point is there: apply the Agile approach only when necessary, on the project, with people who have an approach to the subjects compatible with the two key elements.

Indeed, we could try to apply Agile methods to the Run, but this will not concern the core business rather than more related topics (documentation, debug tests, …). In the same way, a person whose experience has taught him how to look directly for the right final solution, even though he will spend a long and unmeasured amount of time on it, will not easily be able to work in incremental iterations, more time-limited.

This is the point that I sometimes have fun stygmatizing with my clients to trigger reflection. I then caricature by talking about the American approach of a startup, ready to do anything and question itself the next day with a complete turnaround; versus the French approach, much more posed, and which will only deliver once perfection is reached.

So it comes down to the fact that we can work in project mode, according to the Agile approach, with teams that are used to working iteratively and incrementally. The basics. In reality, therefore, we can come up against other problems:

a non-compatible mindset
a lack of method or disagreement on method
an inability to sequence work to make it iterative and incremental

On the first two points, an Agile coach is the best way to find an answer. Indeed, the Agile coach will make sure that both the mindset of the team, but also the coaching structure allows this work in Agile. In the same way, he will often overflow on the means made available. He will then continue the work on the method, because in the Agile approach, each implementation comes with its own method and its own framework that will serve as a basis for its integration. The Agile coach will accompany you on the choice of the right approach and the right method, which will help to remove barriers.

On the difficulty of sequencing the work on the part of one of your collaborators, the work will be more on your side as a mentor of your team to accompany him or her. Although this long work requires an enormous capacity for hindsight on the part of the collaborator, who must change his way of doing things, it is your responsibility to place yourself as a benevolent coach and to find the right words to get your collaborator to put himself in the best possible frame of mind. There is always a risk of complete blockage, because it is still human, but it is up to you to persist and remain … agile. Act, Fail/Success, Iterate.

Why is it interesting to work with the Agile approach on Infrastructure?

Deploy faster more often, which requires standardizing your work (this is one of the bases of the DevOps mentality)
Gain in flexibility: whereas in the past, the infrastructure was relatively fixed in the long term, here the actions are only valid for a short period (before being called into question).
Continuous feedback: the basis of the Agile approach, feedback from users/customers/employees comes in all the time, during the course of the project.
Continuous improvement: because of the above points, you have gained the opportunity to improve continuously, with each new iteration.

In the end, you will reduce the risk of having to call into question the entire infrastructure put in place, and by extension, the major and very costly revamps that we are familiar with.

And you, do you think it is possible to work on Infrastructure topics using an Agile approach? Feel free to contact me to discuss it.

Only 3 types of CTO?

2020-01-15T16:17:17+01:00

For a few months now, there have been a lot of articles explaining that there are 3 types of CTO: the hacker, the stabilizer, and the industrializer. Although accurate in substance, these articles are incomplete when we go into practice. But why is that?

Let’s start by going over these three types again.

The Hacker

You have just created your startup and you are looking to deliver your product as soon as possible with your famous MVP that will allow you to make yourself known and really launch your business. To do so, your company relies on a very limited number of people, whose role boundaries are relatively fluid. This allows you to gain flexibility and to do as much as possible with as little as possible. This schema also applies to your technical referent: once architect, one “hands-on”, he will go through phases to tackle technical related matters. Your referent finds himself having to touch everything, but never 100%, since you can’t know everything, or do everything alone. Doesn’t the saying go “to go fast, go alone; to go far, go together”? This profile is therefore all-rounder, passionate more than experienced: it will allow you to go fast, even to take shortcuts, but it will work … for the MVP. The risk for this type of profile is to persist too long in this type of role. Indeed, he will certainly gain experience, but his expertise will be to always want to do everything, alone, and quickly. It will then become difficult for him to delegate or even manage. To the extreme, he will develop an aura of saviour/messiah within your company, and will monopolise speaking time (and reflection time) with your tacit and silent agreement.

The Stabilizer

Your MVP was launched a few months ago now, your business model is being refined, after a few turnarounds, and your situation is motivating the company and the product to grow. So it’s time to hire and to assess the situation. This step is often perceived as painful or risky, because it involves questioning everything that has been done so far. Why painful? Because no one is “wired” in the same way and, because of the personal commitment required to create an MVP, some will take these questions as a challenge to themselves. However, in order to stabilize the product, and to prepare its scalability, i.e. your ability to accelerate your business development and attack new markets, it is essential to know your strong points, on which you will rely, and your weak points, which you will correct. It is therefore necessary to treat everything in the same way and manage to motivate and structure your teams accordingly. On technical subjects, this will naturally be the role of the CTO. Structuring the team, from a human and managerial point of view, implementing adapted processes and methodologies, he will gradually nose up to become the orchestrator of the technique. Where the hacker was managing alone, the stabilizer will have to orchestrate to make sure to find the right balance between new features, patches, and stabilizations, these last two subjects having strong impacts on the morale of the teams, and thus the quality of their rendering. The risk of this type of profile is linked to the ambivalence between the technical aspect, since the team remains relatively small, and the time needed to structure the whole. In case of imbalance, he would then fall into one of the other two profiles, which would not be in adequacy with your company, and thus your need.

The Industrializer

Now that your company has made a place for itself on the market and is well known, your work continues: it is time to become the absolute reference and to project yourself to several versions/iterations of your product in advance, the famous long term vision. This is the moment when your company sets up its ComEx, when the teams are counted in several dozen and you want/need to add a 0 to the number of employees to realize your plan. Your CTO must then let go, officially at least, of the technique to focus on the strategy and how to get there. You are entering an era where the long-term technical orientation will merge with the vision of future technological developments mixed with the evolution of your market. Everything has to be formalized; the roadmap is then done over several years, where it was defined over a few months; the teams become specialized, needing to improve exchanges between teams and individuals, through human management, processes, … any useful tool for these purposes. Your CTO is therefore at work on strategy, competitive analysis, an in-depth work of your company to find the levers necessary for your commercial success. The risk of this profile is to be too disconnected from technology, to lose touch with technological advances and to be drowned in hypes. The direct consequence would be that the technical teams would no longer have faith in him, with all that this can have as an impact on their productivity but also on the pure realization of his strategy.

So?

Since these definitions are relatively fair, clear and, on paper, non-exclusive, where is the lack? These various articles have been written for “pure players”, i.e. editors of solutions that will be exclusively usable on the web, and where the role of CTO is relatively unique, and that it will be the same person who will manage your internal and external issues. This is a simple echo of a growing trend where some companies are no longer able to distinguish the roles and missions of each, with the direct consequence of having several CTOs in the same structure. I have had the opportunity to note this point several times recently with, for example, an agency that recruits a CTO for one of its clients, and who will have to work in pairs with the CTO in place, each sharing specific but related subjects. But then, what are these missions that require different titles?

The list is long but we could mention the management of your IS, especially if your company starts to develop on several different locations, the management of your R&D, especially with the diversification of technologies, the operational with the support of the customer, the product and its roadmap definition, … Of course, the boundaries are not watertight between these topics, especially depending on the size of your company, but for all that, titles exist to clearly mark the distinction: CTO, CIO, VP Engineering, VP Operations, VP Products, … At some point, your CTO will assume all these roles (the Hacker in this case), but the more you move towards a stabilizer, even an ndustrializer profile, the more he will need support. Depending on his profile, he will refer you to one or the other of these roles as a complement. So who has to do what in this story? Let’s focus on the 3 most technical roles: CTO, CIO and VP Engineering. As much as the difference may seem obvious between the last two, their proximity to the first one adds a significant blur. So let’s dig into their missions

VP Engineering

Simply put, he’s your R&D boss. As a former engineer who rose through the ranks, passing through lead developer and architect roles, he has also developed an ability to manage people. As an internal technical referent in your R&D, he is the person your company relies on to transform the defined strategy into a real product.

CIO

Do you have an internal IT or infrastructure to manage? The IOC is your boss on these matters. He is the face that everyone in your company knows when it comes to IT and related topics: security, cloud, automation, … At the crossroads of all the other professions in your company, even the non-technical ones, he will make sure that your IT teams guarantee the quality of service necessary for the proper functioning of your product and your company itself. Because of its positioning, it will often have a strong impact on your processes and methodology.

CTO

This is the technical face of your company. As a technical referent for the whole company, with priority given to business issues, it must stay up to date technically, so that it can respond to your customers and your board, while guiding product development. How is he not your VP Engineering? Because he has to be able to keep his hacker and hacking side to test and therefore stay up to date, where your VP Engineering has to move forward in accordance with your roadmap and little opportunity to play. How is he not your CIO? I will repeat the discussion I had with the CEO of a large transport group: what is your job and therefore on which technique will your CTO intervene?

Are you struggling with Nginx rewrite rules and $ ?

2018-05-18T15:37:57+02:00

rewrite ^/that-s-my-original-uri/(with-my-folder)/(.*)$ /that-s-my-destination$$1/$2 last;

See the $$1 ?

Are you trying to use a $ in the destination of your rewrite rule ? Then you may have try escaping it, and found out you can only do it via some LUA scripting you might not want or a third party plugin that you can’t use for X or Y reason. The constant result of this situation ?

nginx: [emerg] invalid variable name in /etc/nginx/sites-enabled/XXXXXXXX:YYY

Ok so what’s next ? The idea would be to host the $ inside a variable. Sadly, the set argument does not allow this and will reject you with the same error. The solution would be to use geo in your nginx.conf and replace use the key:

geo $dollar {
	default "$";
}

and then

rewrite ^/that-s-my-original-uri/(with-my-folder)/(.*)$ /that-s-my-destination$dollar$1/$2 last;

And, voila !

Chrome, Aw Snap and HTTP2

2016-06-15T09:47:57+02:00

On a global purpose of optimisation of my website, I lately added some features and enhanced the HTTP2 delivery of the website. The performance restults are instantaneous. But, as there is always a but, it generated some random issues … with Google Chrome (and it’s opensource pendant, Chromium).

The consequence of the bug was a almost random “Aw, Snap !” page : every time I clicked on an internal link or upon one load out of two. And only with Chrome and Chromium. First asumption as it only occurs with a specific browser, it was a code issue : either HTML or, more probably, JS. I started debugging the code with no luck about this one. I decided to create two very simple HTML page with just a basic HTML link towards each other. Again, no luck.

Then, I guessed : when I get the “Aw, Snap” page, the DevTools in Chrome report just nothing besides the SSL details. No URI called. No JS console. Nothing else. So, I decided to debug the SSL part. A review thanks to Qualys reported no issue and even granted an A score to the website (via the CDN and via the origin also). As the late changes were about HTTP2, I decided to test the HTTP2. First, I disabled it from the CDN side. But as the page was in cache, no change resulted from this. Then I debugged the HTTP2 using several tools as h2i or h2c. Again, every thing when fine.

So, I decided to go through the web (GIMF). I found pages about the NPN not being supported any more by Google, so I decided to update my nginx, by recompiling it against openssl 1.0.2 instead of the basic openssl 1.0.0 branch as it is from the various defaut packages ; this enabled the ALPN but did not solve my case. Then, I review my whole nginx config, to check about all the HTTP2 settings. Testing one by one. And … I found it :

Link: </images/banner-1024x240.jpg>; rel=preload; as=image

And there we are : removing this HTTP header from the delivery of HTML pages solved it all. Now this header might not seems harmful. This is one of the new Headers from HTTP2 : it enables the Server Push, meaning, once the HTTP2 connection is opened, the server will push this connect, to preload the image at the same time it push the HTML code. Great for performance optimisations. But, it has a but …

Even if HTTP2 is a new standard, it still relies on a bunch of draft for the different features and headers. The one for the preload of content thanks to Server Push, is still in an early stage. Also, in nginx, this requires to be set by the upstream, meaning your application server behing nginx. And this was my error: as I publish HTML only (thanks to Jekyll), I don’t have any upstream to nginx. So when I was working on the HTTP2 optimisations, I set the Server Push header directly in the nginx configuration, thanks to add_header. For sure, the header was present and reported no error on the debug tools and most of the browsers. But this leveraged a race condition in Chrome.

The Tower of Joy [scene] - Game of Thrones - Ennio Morricone cover

2016-05-20T08:47:57+02:00

(Just splendid …)

The lie we live

2016-05-06T12:37:57+02:00

Liquid error - was not properly terminated with regexp

2016-04-28T22:37:57+02:00

A few weeks ago, I decided to move from Wordpress to a more flat blog engine. After some test, I chose to use Jekyll. I may write a blogpost about this and the related motivation but this is not the actual topic.

During the setup, I needed to implement a search engine. As Jekyll is a flat blog engine, I can’t really implement any dynamic solution. My solution was to implement a lunr.js on the website. For it to operate, it requires a big json file with all the text to search.

The json file is generated during the build stage. Due to this, it will parse the other md files to generate the content. This means that the template file of the json will remplace the Liquid variables with some other Markdown but more especially Liquid variables and statements.

This lead to a classic error :

{% highlight console %} was not properly terminated with regexp: /}}/ in search_data.json {% endhighlight %}

I skip the first part of the error as it’s not relevant. I longly googled on this. But, most of the page foscused on a variable containing Liquid statement that would have be published as this. This is not valid in my case as I want to parse the embedded content and use some other Liquid filters as I would do with :

{% endhighlight %} {{ content | replace: ‘{foo}’, ‘bar’ }} {% endhighlight %}

So, it returned the error. Logic as Liquid will parse this statement, replace ‘content’ with it’s value, another Liquid statement, also finishing with }}. I tried several solutions to escape this with no luck.

I ended with a magical and even more obvious solution : ‘markdownify’

{% endhighlight %} {{ content | markdownify | replace: ‘{foo}’, ‘bar’ }} {% endhighlight %}

This solved the case at once !

Lenovo T450 Wireless AC 7265 not working on Linux

2016-03-16T10:37:57+01:00

Lately I discovered an issue with my WiFi adapter on my professional laptop (a Lenovo T450) : it was not working. Pretty inconvenient. After some digging, I tested and had to adapt part of things I found on Google. So, to begging with, the symptoms :

no more wireless adapter in my NetworkManager or any other tools, including ifconfig
dmesg reports issues loading the iwlwifi firmware<

The dmesg output looks like :

[ 4.237444] iwlwifi 0000:03:00.0: Direct firmware load for iwlwifi-7265D-12.ucode failed with error -2
[ 4.237466] iwlwifi 0000:03:00.0: Direct firmware load for iwlwifi-7265D-11.ucode failed with error -2
[ 4.237479] iwlwifi 0000:03:00.0: Direct firmware load for iwlwifi-7265D-10.ucode failed with error -2
[ 4.237482] iwlwifi 0000:03:00.0: request for firmware file 'iwlwifi-7265D-10.ucode' failed.
[ 4.237493] iwlwifi 0000:03:00.0: Direct firmware load for iwlwifi-7265D-9.ucode failed with error -2
[ 4.237495] iwlwifi 0000:03:00.0: request for firmware file 'iwlwifi-7265D-9.ucode' failed.
[ 4.237497] iwlwifi 0000:03:00.0: no suitable firmware found!

I tried to download the official firmware from Intel, namely iwlwifi-7265-ucode-25.30.14.0, with no luck. Though, I decided to keep the ucode files from this archive in my /lib/firmware/. Note that, depending on your distro, this previous step might be enough. To check :

update-initramfs -u
reboot

Then, further dig pointed some issues with the iwlwifi package not handling properly this version of the AC 7265. From lspci :

03:00.0 Network controller [0280]: Intel Corporation Wireless 7265 [8086:095b] (rev 59)
 Subsystem: Intel Corporation Dual Band Wireless-AC 7265 [8086:5210]

Here, the main points are the main ID 095b and the Subsystem ID 5210. To solve this, let’s recompile the backport package of iwlwifi with a tiny difference (the sed line is to adapt with your IDs) :

sudo apt-get install build-essential linux-headers-$(uname -r)
wget https://www.dropbox.com/s/gyuvdlhzx5ho277/backports-20150731.tar.gz
tar -zxvf backports-20150731.tar.gz
cd backports-20150731/
sed -i 's/IWL_PCI_DEVICE(0x095B, 0x9200, iwl7265_2ac_cfg)/IWL_PCI_DEVICE(0x095B, 0x5212, iwl7265_2ac_cfg)/' drivers/net/wireless/iwlwifi/pcie/drv.c 
make defconfig-iwlwifi
make
sudo make install
update-initramfs -u
reboot

Now, if you check your dmesg, you’ll see :

[ 3.950804] iwlwifi 0000:03:00.0: Direct firmware load for iwlwifi-7265D-15.ucode failed with error -2
[ 3.952513] audit: type=1400 audit(1458119598.627:5): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/sbin/dhclient" pid=657 comm="apparmor_parser"
[ 3.952521] audit: type=1400 audit(1458119598.627:6): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/lib/NetworkManager/nm-dhcp-client.action" pid=657 comm="apparmor_parser"
[ 3.952525] audit: type=1400 audit(1458119598.627:7): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/lib/connman/scripts/dhclient-script" pid=657 comm="apparmor_parser"
[ 3.953091] audit: type=1400 audit(1458119598.627:8): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/lib/NetworkManager/nm-dhcp-client.action" pid=657 comm="apparmor_parser"
[ 3.953100] audit: type=1400 audit(1458119598.627:9): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/lib/connman/scripts/dhclient-script" pid=657 comm="apparmor_parser"
[ 3.953362] audit: type=1400 audit(1458119598.627:10): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/lib/connman/scripts/dhclient-script" pid=657 comm="apparmor_parser"
[ 3.955605] iwlwifi 0000:03:00.0: loaded firmware version 25.30.14.0 op_mode iwlmvm
[ 3.975336] input: ThinkPad Extra Buttons as /devices/platform/thinkpad_acpi/input/input7
[ 4.001495] iwlwifi 0000:03:00.0: Detected Intel(R) Dual Band Wireless AC 7265, REV=0x210
[ 4.001843] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[ 4.002290] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled

And, voilà, your wireless adapter is back online ! **NB**: you’ll have to redo these steps after every kernel update, except if the iwlwifi module got fixed.

Share a multifunctional printer (with your Synology)

2016-03-10T10:00:50+01:00

So, lately, we decided to truly use several different computers at home. The fun part is that we want to share the same peripherals (as the multi-functional printer (here, as an HP PhotoSmart B109a), with different OS (for now, Linux and Windows). Let’s see how our Synology saved the day.

The Synology NAS embed a Linux system so basically, we should be able to run most of the applications, as far as we can deploy/compile it. But, because the Synology guys wants to ease our life, they did a great thing : they offer the possibility to add a multi-functional printer and manage it. As far as they did great, the system only embed some drivers (and software - i.e. only cups) and for me, even if the printer is fully discovered, only the print services will be shared over network. So I had to complete the setup. First, I need to be able to extend the system with new package. As we have a pretty recent DS1515+, we don’t have any ipkg system out of the box. But now, this is pretty well documented over internet (in english or in french, for instance). Now that we can install third party software easily on the CLI, let’s setup SANE. So, as a root on the Synology :

ipkg install hplip libusb libieee1284 sane-backends xinetd
echo "hpaio" >> /opt/etc/sane.d/dll.conf
echo "hpaio" > /opt/etc/sane.d/dll.d/hplip

Let’s see if the Synology see the scanner :

sane-find-scanner

Which should reply something like :

found USB scanner (vendor=0x03f0 [HP], product=0x7a11 [Photosmart B109a-m]) at libusb:002:003

Since the NAS sees the scan, let’s test it with SANE via :

scanimage -L
found USB scanner (vendor=0x03f0 [HP], product=0x7a11 [Photosmart B109a-m]) at libusb:002:003

It will reply something as :

device `hpaio:/usb/Photosmart_B109a-m?serial=CN999750CB05C7' is a Hewlett-Packard Photosmart_B109a-m all-in-one
found USB scanner (vendor=0x03f0 [HP], product=0x7a11 [Photosmart B109a-m]) at libusb:002:003

Now, let’s ensure that the service is visible from the rest of the network. To do so, we need to edit /opt/etc/xinetd.conf where we check the line “only_from” : it should match the IP range of the local network. Then we edit /opt/etc/sane.d/saned.conf with the same purpose. We can now edit xinetd to start the sane service properly with the right port, editing /opt/etc/xinetd.d/sane-port :

service sane-port
{
    port = 6566
    socket_type = stream
    wait = no
    user = root
    group = root
    server = /opt/sbin/saned
}
found USB scanner (vendor=0x03f0 [HP], product=0x7a11 [Photosmart B109a-m]) at libusb:002:003

Let’s start it (it will be automatically started on the next reboot :

/opt/etc/init.d/S10xinetd
found USB scanner (vendor=0x03f0 [HP], product=0x7a11 [Photosmart B109a-m]) at libusb:002:003

As we’re good on the server side, let’s focus on the client side. We’ll start with the Linux client as it’s the simpliest. I assume you already installed xsane. Now, we just need to tell Xsane where it can find the scan. So, we edit /etc/sane.d/net.conf to replace “# localhost” with the IP of the Synology. The printer is just a few click away when you go through the regular GUI to add a network printer. We’re good to go. On the Windows side (Windows 10 here), it’s a bit more tricky. First, we’ll focus on the printer service. For this, we’ll have to follow the directives from Synology. This will enable a printer. Windows might complain about missing drivers for some mass storage USB device and an unknown device but you can just ignore as those are the scan and the multi card reader. For the scan service, we’ll have to install some other tools. Indeed, Windows use a specific protocol which is not compatible with sane (it can be TWAIN, ISIS or WIA). But , as we exposed the scan via sane, we need … sane … Absolute logical logic. Thanks to our opensource community friends, port exists. Not so much up2date or maintained, but it’s enough ok to be used. The solution here will be SaneWinDS. Just download the installer, follow the instruction of the GUI and here you go. Reboot your Windows (after all, it remains as a Windows), and now you have a Sane application on your Windows that you can use. The UI is pretty archaic but it should do the trick.

Home

2016-03-09T10:35:59+01:00

La Nature Parle: Sophie Marceau est Mère Nature

2016-03-08T10:31:38+01:00

She's Alive... Beautiful... Finite... Hurting... Worth Dying for

2016-03-07T10:29:57+01:00

Super Bowl 2016 - Trailers & TV Spots

2016-03-05T11:42:23+01:00

It’s Saturday morning. Some might just have a hangover. Others running all around. And a few, just do nothing (as me …. nah just kidding). So the Super Bowl was a month ago so let’s enjoy a compilation of all the Trailers and TV Spots to boost this weekend. Cheers up !

My desktop replacement setup

2016-03-04T19:00:45+01:00

Recently, I decided to move from a decent desktop setup to a desktop replacement setup. Here’s the why and the how of this move.</p>

For years, I had a barebone on my desktop with a huge screen :

Xeon CPU with 4 core, but low voltage
8 GB Ram
Nvidia Geforce .....
128 GB SSD
Dell 30"

As I stopped playing on my computer for at least the last 4 years, I noted several disadvantages of such setup :

It consumes a lot of power (the power supply of the barebone and the screen consume a tremendous amount of power)
It takes a lot of space just to surf
If I want to go to another place with my "desktop" to continue my work it was not so easy (ok I could use some remote desktop thing on a tablet but yet, more devices to use ...)
30" display on a desktop, if you're not doing graphics is just so useless ...
Having a powerful computer just to surf over the web, or admin my servers, is just as driving a McLaren during rush hours, in the streets of Paris

So, at the end of last year, I decided to review all my equipment and optimize my usage, my habits, but also my power consumption. From this, my desk was one of the key elements to work on.

Which desktop ?

At about the same time, I received, graciously, a dead Lenovo X220. It didn't boot any more (Fan error at starting time, forbidding any access to the Bios setup), case had severe knocks all over, the battery was out, ... I love challenges and seeing this dead laptop, I saw the answer to my desk revamp : I'll revive it ! Ok I may loose some MIPS and MFLOPS, but frankly, who cares when surfing and ssh-ing ?

Ok, I'll skip the disassemble time where I got it partly back. Partly because it survived to 10 days during my Chinese trip. Then, the fatal Fan error message came back. Luckily, I was in China. I brought the corpse to a local computer mall and go the welded fan totally replaced ... for 5€ (the guys spent almost his day on it ... !).

Back in France, I was able to go through the next steps :

upgrade the memory from the 6 GB (2+4) it had : Lenovo specs announces that we can go up to 8 GB on this little guy but as it's a Sandy Bridge powered laptop, I decided to give a try up to 16 GB (2x8 GB PC10600 CL9 from G.Skill)
upgrade the harddrive from the 300 GB classical drive to an SSD : first, I assumed I would recycle the SSD from my barebone ; but it was to thick so I decided to get a Scandisk SSD Plus 240 GB which is only 7mm, and therefore can fit perfectly
avoid to damage the bunch of connectors on the laptop : as I would use the laptop as desktop replacement but still as a laptop, having to plug all the USB cable, power, display, ... quite often, would damage them ; getting a dock was the solution and I found one (UltraBase 3 station) on E-bay for just a few bucks ...
Replace my huge 30" Dell screen with something that fit more to my usage but will also consume a hell less : I moved to a Samsung SE650PL, as it has a DisplayPort (as the x220), incorporated speakers (even if not very powerful - but don't care, it's not my multimedia center), low blue light, and is not high energy.

Now, I have all my components, next step was to move forward to setup the box. I'm getting old (I swear it, I have two grey hairs now !), and therefore, I'm getting Lazy. In my old days, I would have install a very light Linux and compile everything from scratch, fine tuning every component. Now I just want to use my computer. Based on that, I decided to use Linux Mint as my distro. The following is not totally exhaustive as I'll skip the secure part that you should apply to any system.

Graphics

The default setup is almost perfect. Almost, because I still had to fix some little glitches. First, Configure the display properly. This starts with the login screen. The MDM, which handle the login screen, does not care about your Cinnamon config. It will still try to push the display toward the internal display and duplicate it, as it, on the DisplayPort. As my lid is closed, seeing the login screen just on a quarter if my screen is not fun ... I had to edit my /etc/mdm/Init/Default file to add the following lines by the end (just before the "exit 0") :

mode="$(xrandr -q|grep -A1 "DP2 connected"| tail -1 |awk '{ print $1 }')"
if [ -n "$mode" ]; then
  xrandr --output LVDS1 --off
  xrandr --output DP2 --primary --mode 1920x1080
fi

Then, I would focus on the video card and how it's used. It's an internal HD Graphic card from the Sandy Bridge. This would require the proper drive and proper configuration from the kernel.

sudo add-apt-repository ppa:oibaf/graphics-drivers
sudo apt-get update
sudo apt-get upgrade
sudo apt-get install  libva-intel-vaapi-driver
sudo add-apt-repository ppa:tigerite/mint-xorg-update
sudo apt-get update
sudo apt-get upgrade
sudo apt-get install xorg-update

Next to this, we'll have to edit our boot parameters for the kernel. Edit /etc/default/grub and update GRUB_CMDLINE_LINUX_DEFAULT, for instance :

GRUB_CMDLINE_LINUX_DEFAULT="quiet splash i915.i915_enable_rc6=1 i915.semaphores=1 i915.i915_enable_fbc=1 pcie_aspm=force"

Then, reload the grub configuration :

sudo update-grub

Now, thanks to this, the display will work as intended. Let's enhance the rest. For this, let's remove the Visual Effects. As usual, it's fancy but not very useful and also quite performance killer. This is quite simply as you can do it via the System Settings : "Appearance" > "Visual Effects" > "None". Easy, isn't it ?

System

Lots of small stuff in the system will enhance the usage. First, lets focus on the /etc/sysctl.conf file :

net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.rp_filter=1
net.ipv4.tcp_syncookies=1
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
vm.swappiness=1
vm.vfs_cache_pressure=50
vm.dirty_background_bytes = 536870912
vm.dirty_bytes = 1073741824
vm.dirty_expire_centisecs = 250
vm.dirty_writeback_centisecs = 500

Why all these ? First to secure, second to enhance. Indeed, we're not a router nor we'll inspect everything on the network from this computer : I'll do it from the router if needed. The second part is how we'll use the swap (with 16 GB Ram, as few as possible) and the different network shares we'll connect to (at least in CIFS for now).

We can also improve part of the SSD usage by updating the options in /etc/fstab :

UUID=04f97099-2f75-4599-92fa-9e455ba38925 / ext4 errors=remount-ro,noatime,discard 0 1

Then we'll change the relative scheduler by providing the info in the /etc/rc.local :

echo noop > /sys/block/sda/queue/scheduler

We'll replicate this choice for the global kernel options, in /etc/default/grub, by updating GRUB_CMDLINE_LINUX_DEFAULT :

GRUB_CMDLINE_LINUX_DEFAULT="quiet splash i915.i915_enable_rc6=1 i915.semaphores=1 i915.i915_enable_fbc=1 pcie_aspm=force elevator=noop profile"

You'll need to update grub, next to this. As you noticed, I added also the word "profile". This will slow down the very next reboot but will progressively speed up all your boot time : it will tell the kernel to profile your system to adapt its own boot. Very useful.

You should also mind about updating the BIOS : it might be a very stock version, and several updates went out through the years.

Next, you'll need to ensure about the CPU usage, temperature, ... Anything related to the fact you rely on a laptop. Tools can do this for you :

aptitude install thermald laptop-mode-tools

You may have this kind of errors during setup :

SETTING OF KERNEL PARAMETER FAILED: echo ondemand 
gt; /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor

This is normal as the "ondemand" governor does not exists for your x220 : only "performance" and "powersave". To fix this, just edit /etc/laptop-mode/conf.d/cpufreq.conf and replace all the "ondemand" by "powersave". It should do the trick.

Conclusion

Thanks to all these, you're now ready to use your x220 as your desktop replacement. Feel free to amend this text based on your specific needs, especially regarding the budget and therefore, the components, or any software you'd like to use.

How to update an ATT / Samsung Galaxy S6 Active ?

2016-02-21T17:53:02+01:00

If, as me, you own a Galaxy S6 Active (SM-G890A) from AT&T, and you can’t update to Android 5.1.1, here is your solution.

Over the last year, I busted two mobiles :

I missed my pocked when trying to fit my phone in : the floor didn’t missed it, especally the screen
The other one tried to swim without protection, whereas I put it into an airtight bag, in an airtight box, to prevent any issue … long but funny story

Whatever … Next to these issues, I decided to get a rugged phone to ensure that I won’t bust another one or at least, not that fast. I googled for some time, avoiding the regular Chinese models you can find all over the place. Two models came out this digging : the one from CAT S30 (the S40 was not yet available) and one from Samsung (the S6 Active). I decided not to go with the CAT one, based on several reviews I got from both. Unfortunately, the Samsung Galaxy S6 Active was only release in some countries (as in the US) and only through some carrier contracts (as AT&T in the US). Luckily, I had to do a quick work trip in the US. Thanks to some colleagues, I was able to buy a brand new S6 Active. I won’t got through a full review of the phone, as you can find a ton of them online. I bought the phone on early July 2015. On August, AT&T released a branded update based on Android 5.0.2. The update was available to all the owner, even not in the US nor on AT&T. The update was fine for lots of thing but there were some glitches as some slowness or some random micro-freezes. One solution, due to Android 5.0, was to move to Android 5.1 as it solved most of the issues. But, as there is no way to root the phone yet, and as it’s not a stock version of Android, there was no way to update it as-is. Waiting was my new friend. On the root side, there is even a bounty on the XDA forum, if you want to take care of it. On November, AT&T released an update based on the 5.1.1. But, and here is our common issue, this update is available only if you’re in the US and if you’re using AT&T : it’s an OTA update (Over The Air). I can’t go to the US as I go to my local bakery nor I can’t ask my employer to pay for a new trip in the US just to get my update. I was struggling for months with this. But, some days ago, I found out about some Samsung tools that could be useful : Samsung Smart-Switch. Here, I won’t focus on the mobile version of the tool as it’s not useful for us. But the computer version (available on Windows and Mac OS X) is our Grail. So, install it on your computer. If, as me, you’re on Linux and can’t find someone with a Windows close to you, visualization is your savior. Install Virtualbox, install a VM with Windows and then, Samsung Smart Switch. Note that you better have at least 2 cores and 2 GB Ram enabled on your VM. Another trick regards the USB :

add your current user to vboxusers

usermod -a -G vboxusers francois

logout/login your session
edit the VM settings to ad a permanent USB filter for your phone (it has to be plugged in prior to this)

Now that you can use Smart Switch, plug your phone, go to the upper right corner on “Plus”, then “Emergency recovery and re-initialization”. Wait for a couple of second, the phone will get detected and recognized. If it’s legit (not declared as stolen), the system will detect the version and propose an update from Android 5.0.2 to Android 5.1.1. You can also for the update via the re-initialization process, thanks to your serial number (on your phone, Settings / About the phone / State), but this will wipe out all the data so do not forget to backup your phone first. If you’re using a virtualized Windows, when the phone reboots the first time, Smart Switch will continue to ask you to connect the phone so it can detect it : just right click on the USB settings of the VM, and change the USB filter from Remote “No” to Remote “Any”. At the end, you may have to do it the other way but this is optional. Now, you have a fully functional Galaxy S6 Active from AT&T, working on an up-to-date and official branded Android 5.1.1 without bothering with AT&T.

Petit scarabée : troisième !

2016-01-19T13:40:53+01:00

Une quinzaine de jours est passée depuis mon dernier billet. Pas tant parce qu'il n'y avait rien a raconté, mais plutôt qu'il faut du temps et de l’énergie pour le faire. On continue donc la découverte du Kung-Fu traditionnel, mixé à la découverte de Chengdu.

Comme introduit dans le premier billet, le kung-fu n'est pas juste un art martial mais est un art de vivre. Celui-ci s'accompagne donc de règles. Elles se scindent en deux familles : les règles de moralités et les règles de comportement. Pendant que nous les revoyons continuellement, tout est prétexte à l'entrainement et aux démonstrations.

[gallery show_title="0" ids="9054,9053,9047"]

Les premières règles sont donc définies ainsi :

Restez humble
Faites bénéficier les autres
Restez stable dans votre cœur et vos actes
Faites face aux difficultés avec grandes volonté et fierté
Votre relation avec les autres est plus importante que l'argent
Soyez gentleman
Apprenez à pardonner
Finissez ce que vous avez commencé

Concernant les règles de comportement, elles se résument ainsi :

N'abandonnez jamais
Ne vous vantez pas
Ne vous fermez pas face à la critique
Ne jouez pas les prétentieux
Ne faites pas étalage de votre kung-fu
Ne colportez pas
N'enseignez pas si vous n'avez pas la compétence
N'arnaquez personne
Ne soyez pas fermer à autrui
Ne désobéissez pas aux règles

On se rend vite compte que tout ceci s'applique à la vie de tous les jours. Ainsi, outre les 6h de sport quotidiennes, nous passons beaucoup de temps à parfaire notre connaissance de l'ancienne culture chinoise, mais aussi observer ce qui se passe autour de nous.

[gallery show_title="0" ids="9052,9051,9050"]

Forts de cette instruction, nous partons à la découverte du parc Wang Jiang, parc de bamboo en l'honneur d'une poète célèbre de Chengdu. Le parc se présente donc en deux parties. La plus grande, publique, recouvre deux tiers de la zone. Il s'agit principalement d'une réserve de diverses espèces de bamboo. La seconde, plus petite, est dédiée à la poète avec différents pavillons et une imposante statue en marbre.

[gallery show_title="0" ids="9072,9071,9070,9069,9068,9067,9066,9065,9063,9062,9061,9060,9059,9058,9057,9056"]

Époustouflés par cet écrin de verdure, conservé au beau milieu de la modernité des buildings, nous avons bien profité de l'ambiance terriblement apaisante du lieu. A ce moment, nous sommes choqués par la contradiction perpétuelle de la Chine. Tout est dans l'opposition. L'ancien au modernisme. La richesse à la pauvreté. Le complique au simple. Le respect de la connaissance à l'ignorance totale du passé.

Pour autant, certaines choses perdurent ou reviennent. Les pandas sont donc partout. Les anciennes font du sport de rue : gym toniques pour mesdames à la tombée de la nuit ou encore danse de salon sur les places publiques en journée, ... A noter également que leur style en anglais fait fureur parfois.

[gallery show_title="0" ids="9080,9049,9073,9074,9066,9064"]

Ceci m’amène à mon 6e projet de tatouage. Ce nouveau projet est une portion en fait un fragment d'un plus gros tatouage que j'ai décidé de segmenter afin de le réaliser au cours de mes divers voyages. La précédente pièce avait donc été faite a New York. Le tatoueur a été trouvé et j'ai pu lui transmettre les matériaux de base pour son travail. Par contre, je garde secret le résultat jusqu'au retour de Chine.

[gallery show_title="0" ids="9085,9084,9083,9082,9081"]

Au cours des diverses explorations de Chengdu, nous sommes également tombes sur le quartier des bars. Celui-ci est caractéristique du style de restauration à la chinoise : l'emballage fait le produit. On se retrouve donc avec des bus Victoriens, un bar de dinosaures, ...

[gallery show_title="0" ids="9079,9078,9077,9076,9075"]

Nous finirons la semaine dernière avec le départ de l'un de nos Kung-Fu brothers. Celui-ci repart donc dans sa province natale, au nord-est de la Chine. Soirée hotpot autant épicée qu'arrosée, suivie d'une séance de cinéma privée, dans la salle d'entrainement avec la projection de Crazy Kungfu, en chinois, bien entendu !

[gallery show_title="0" ids="9048"]

Petit scarabée : deuxième !

2016-01-05T14:34:14+01:00

Les jours s'enchainent sans vraiment se ressembler. Nous continuons de consommer notre lot quotidien de sport, culture kungfu-iste, de piments, le tout enrobé de zénitude et de plaisirs.

Peu de jours se sont écoulés depuis mon billet du nouvel an. Pourtant, tellement de choses ont été vécues. Ainsi, la fin de semaine a continué de s'écouler avec du sport avant de nous offrir une fin de samedi reposante. Mais avant toute chose, le vendredi sera marqué par un "afterwork" digne de ce nom, entre occidentaux. Nous finissons donc non loin de l'école, dans un bar, aux allures de Central Perk. Je note au passage qu'il a fallu que je vienne en Chine pour qu'on me serve par défaut une bière du Laos. D'ailleurs, la serveuse s'excusera en ramenant une bouteille ... car elle est froide (les chinois boivent leurs bières tièdes).

[gallery show_title="0" ids="9005,9004,9003,9002"]

Bien courbatures, nous partons samedi après-midi à l'attaque de l'équivalent des boulevards maréchaux de Chengdu, facilement et rapidement accessible en tuk-tuk depuis l'école. Là, nous déambulons dans les magasins pour y découvrir les marques à la mode, les produits, ou même les petites variantes agréables dans les grandes surfaces.

[gallery show_title="0" ids="9006"]

Fatigués, nous avançons vers un petite boutique de massage qui nous a été recommandée. Une heure de massage à 5 euros, ca ne se refuse pas. On n’était loin d'imaginer le supplice que nous allions vivre. Pourtant habitué à l'aiguille du tatoueur, mon endorphine n'a bien voulu se libérer qu'après que la vieille masseuse ait fini son boulot : il faut croire qu'elle arrive sans problème à faire ses pompes sur les bouts des doigts. Bref, massage fini, plus aucune courbature, douleur ou autre ... le pied total !

[gallery show_title="0" ids="9007"]

Revigorés, nos estomacs nous signale que l'heure du diner approche à grands pas. On n'avait repéré une grande place avec plein de restaurants plus bas et décidons d'y aller. A part un bar dédié aux bières étrangères, tous les restos font dans le "hot pot" : une fondue, épicée ou non, dont le contenu change d'un restaurant à l'autre. Sur le conseil de notre Maître, nous allons dans le restaurant le moins rempli. Bizarrement, ce sera le plus propre de la place et celui offrant les tables les plus garnies. Nous sortons le guide, montrons la phrase magique du "Faites nous plaisir" et là, la farandole de mets à cuire débarque à table. Un régal pour les yeux. Un régal pour le nez. Un régal pour les papilles.

[gallery show_title="0" ids="9009,9010,9008"]

Repus, nous rentrons enfin à l'école. Alors que nous pensions pouvoir aller voir les pandas, tot le dimanche, on nous informe que nous partirons en montagne, chez un ami de notre Maître, qui vit parmi les moines. Appareil photo chargé, les vêtements chauds préparés, nous partons donc pour une excursion en voiture. Le trajet se fait long, on sent que le Maître sort peu et surtout, conduit peu. Pour autant, avec la meme dextérité que pour ses formes, il manœuvre la voiture dans les passages étroits à flan de montagne.

Nous arrivons alors, à 1300 m d'altitude, sur le versant est du Qingcheng Mount. Ce nom signifie "la cité verte" du fait de l'abondance de plantes et arbres. Cette montagne est extrêmement connue en Chine et à l'extérieur pour sa luxuriance et la presence de nombreux sites religieux Bouddhistes et Taoïstes : temples, monastères, mausolées, ...

Nous sommes donc sur un plateau à 1300 m d'altitude avec un imposant bâtiment, surmonté par deux temples. Le Maître des lieux vient d'y ouvrir une école de méditation dans le bâtiment qu'il a restauré et reverse une partie des revenus aux moines. Ainsi, ces derniers peuvent vivre mais surtout régler les impôts importants qu'exige l'état chinois.

[gallery show_title="0" ids="9012,9013,9014,9019,9020,9018"]

Nous apprenons que nous allons y rester deux jours/une nuit afin de participer légèrement à la vie du temple mais surtout apprendre différentes bases de la méditation. Nous visitons donc le site et partageons les repas avec les moines.

[gallery show_title="0" ids="9015"]

Coté culture, nous échangeons avec le Maître des lieux pendant plusieurs heures, réparties sur les deux jours, autour d'une très longue cérémonie du thé. L'après-diner sera aussi l'occasion de me demander, à moi, français, expert ès-vin, de goûter un vin chinois. Celui-ci avait tout d'un Beaujolais nouveau (et comme je ne suis pas fan...). Ainsi, nous explorons les origines du site, les bases de la méditation, la présence de cette nouvelle école, et surtout, nous revenons sur le Bagua (le Yin-Yang). Ce dernier s'avère plus complexe que nous ne le pensions. Celui étudié précédemment est dit "naturel". Un autre Bagua important est celui "du peuple". Celui-ci définit ses orientations par rapport a la géographie et l'histoire de la Chine. Plus complexe, il permet cependant de mieux appréhender le naturel.

[gallery show_title="0" ids="9023,9016,9011"]

Nous découvrons alors divers usages du Bagua. Par exemple, l'art de la divination, grace à 3 pieces de monnaie. Nous découvrons également le Kung-fu Bagua, sorte de mélange de Taichi, Kung-fu mais également méditation. Ce sera d'ailleurs l'important cours du lendemain matin.

https://www.youtube.com/watch?v=3NHEOU88TaY

Nous avons encore bien des choses à apprendre et à parfaire. Ce sera la conclusion du jour mais surtout de ce mardi où nous revoyons toutes nos bases encore et encore. "Aie" crient nos muscles.

[gallery show_title="0" ids="9021"]

Petit scarabée: première !

2016-01-01T10:18:23+01:00

Pour beaucoup, ce n'est pas une surprise : je suis en Chine pour quelques semaines. La précision importante ici est qu'il s'agit d'une immersion dans la campagne chinoise avec un entrainement intensif au Wu Shu.

Cela fait donc quelques jours que je suis arrivé. Etonnamment, un énorme brouillard recouvrait la ville de Chengdu, dans le Sichuan. Bon, je dis étonnamment car ce n'est quasiment pas du à la pollution chinoise mais plus au climat local. Le Sichuan est une province entourée de montagne. Une cuvette quoi... Le résultat est qu'il y pleut très peu mais l'humidité ambiante est permanente, ce qui donne ce brouillard si épais et humide. Ce matin, surprise pour le nouvel an, le brouillard se lève enfin et le soleil parvient à illuminer la cour de l'école. Ca ne réchauffe pas encore le corps, mais au moins ca sèche un peu les affaires.

Revenons-en à cette immersion. C'est donc la Kung Fu Family de Maître Li Quan (Shifu pour les intimes) qui accueille les quatres apprentis que nous sommes, issus de différents pays. Shifu est un Maître (re)connu qui accueille régulièrement des gens de tous horizons et des différentes provinces chinoises, pour leur transmettre ses connaissances et son amour pour le Kung Fu traditionnel, le Wu Shu. Dans la hiérarchie des Maîtres, seul un rang lui demande respect, celui des (rares) Grands Maîtres qui viennent parfois entrainer ses apprentis.

Petits scarabées que nous sommes, les premiers pas sont importants :

savoir quelle est notre place dans la hiérarchie pour ne pas marquer de faux pas par manque de respect
avoir une excellente moralité
comprendre pourquoi nous sommes là
apprendre que tout est lié et que tout vit en harmonie, c'est-à-dire en mouvement et relation permanente avec son opposé

Ce qui caractérise le mieux ces règles de base est entre autres, le Yin-Yang que nous connaissons deja.

[gallery show_title="0" ids="8989"]

Ce symbole, surtout une fois complété des éléments, est très important et sa connaissance assure une bonne base pour commencer notre entrainement. Il s'agit donc d'une philosophie qui englobe toute chose : chaque objet, chaque pensée, chaque action, ... Son chiffre clé est le 8 : huit symboles, 8 cercles, un 8 dessinée dedans, ... Le Yin représente la force, le masculin, l'attaque. Le Yang représente la douceur, le féminin, la défense. Ils ne peuvent fonctionner l'un sans l'autre. Il y a d'ailleurs du Yin dans le Yang et inversement. De meme, quand le Yin est au maximum, le Yang qui est au minimum va pourvoir se développer et prendre du terrain, lancant la dynamique. Ce sont des opposés qui se complètent.

Après avoir compris ce point, on avance sur les huit règles de base du Kung Fu, toutes se développant sur les thèmes de respect et de bonne moralité. Oublions les conflits, la compétition. Ici, on se focalise sur l'entraide, sur le complément, sur l'adaptation. On va donc apprendre, tranquillement un mélange d'art de vivre issu de l'ancien temps, très posé, à celui de la Chine moderne, très festif. Tout cela, en soutenant le respect envers les Ainés. On verra tour à tour divers membres anciens de la fraternité de la Kung Fu Family défiler à table pour partager des repas copieux et de la boisson forte.

[gallery show_title="0" ids="8986"]

Et là, cela peut devenir complètement folklorique pour nos petits yeux d'occidentaux. Ces hommes, pourtant éduqués dans la science et la culture Shaolin, sont devenus totalement bling-bling, parfois aussi customisés que leurs voitures tres Jacky. On verra les gens trinquer, surtout, un par un, en gardant le verre à une hauteur précise pour signifier leur position dans la hiérarchie, puis porter le verre aux lèvres pour à peine les tremper dans le liquide : il ne faudrait pas perdre la face. Il faut que l'autre soit saoul bien avant, pour montrer qu'il est un bon ami. Le pire dans ce cirque de courbettes, à mon sens, est l'alcool. Ici, la belle bouteille fait le bon alcool dans les esprtis. Il en résulte que la premiere soirée se fera sur une bouteille magnifique, mais au contenu écoeurant : un alcool fort (52%) avec un arrière gout de bonbon à la cerise proche de celui des cerises des forêts noires. Erk ... !

Reste que certains Maîtres ont voyagés ou ont rencontrés d'autres cultures. Ceux-là nous ferons profiter d'un vin espagnol de très bon goût pour accompagner les plats pimentés du diner.

La nourriture, c'est bien bon, mais ce n'est pas le but premier de ce séjour. Ici, on pratique et on vit le Kung Fu ! On vit à la dure (pas de chauffage, eau chaude limitée, ...) mais pas trop (petit déj vers 9/10h en gros). Par contre, 6h de cours tous les jours. Apres une première petite semaine, les courbatures sont là et on (re)découvre des muscles depuis longtemps oubliés. Pour autant, le plaisir est total car Shifu aime partage son art et sa culture et tout ce que vous ferez pour montrer que vous etes là pour apprendre sera récompensé.

[gallery show_title="0" ids="8987"]

Le sacre de ces premiers jours : être jugé par les autres membres de la Kung Fu Family, tous au rang de Maître, qui acquiescent fièrement un "Fast learner" sur votre démonstration de la première forme apprise en deux jours seulement.

The Ultimate Christmas Movie - Supercut

2015-12-22T07:27:15+01:00

https://youtu.be/mKrlkMnAVJE

Best of Web 8 - HD - Zapatou

2015-12-17T10:54:00+01:00

Parce que TGIF, et qu'ils commencent à être mérités ces vendredis !

2015-10-30T15:48:02+01:00

https://youtu.be/EmnSm_d2ll4

Movie phone super call

2015-09-17T07:58:41+02:00

https://youtu.be/zXnC2DlEOdE

Diagnostic

2015-09-16T18:36:36+02:00

https://youtu.be/AM4c9ckSy9M

Hell's Club

2015-09-08T09:57:09+02:00

https://youtu.be/QajyNRnyPMs

Marrakech

2015-06-19T16:55:02+02:00

[gallery ids="9491,9490,9489,9487,9486,9485,9484,9483,9482,9481,9480,9479,9478,9477,9476,9475,9474,9473,9472,9471,9470,9469,9468,9467,9466,9465,9464,9463,9462,9461,9459,9460,9458,9457,9456,9455,9454,9453,9452,9451,9450,9449,9448,9447,9446,9445,9444,9443,9442,9441,9440,9439,9438,9437,9436,9435,9434,9433,9432,9421,9420,9419,9418,9417,9416,9415,9414,9413,9412,9411,9410,9409,9408,9407,9406,9405,9404,9403,9402,9401,9400,9399,9398,9397,9396,9395,9394,9393,9392,9391,9390,9389,9388,9387,9386,9385,9384,9383,9382,9381,9380,9379,9378,9377,9376,9375,9374,9373,9372,9371,9370,9369,9368,9367,9366,9365,9364,9363,9362,9361,9360,9359,9358,9357,9356,9355,9354,9353,9352,9351,9350,9349,9348,9347,9346,9345,9344,9343,9342,9341,9340,9339,9338,9337,9336,9335,9334,9333,9332,9331,9330,9329,9328,9327,9326,9325,9324,9323,9322,9321,9320,9319,9318,9317,9316,9315,9314,9313,9312,9311,9310,9309,9308,9307,9306,9305,9304,9303,9302,9301,9300,9299,9298,9297,9293,9291,9290,9289,9288,9287,9286,9285,9284,9283,9282,9281,9280,9279,9278,9277,9276,9275,9274,9273,9272,9271,9270,9269,9268,9267,9266,9265,9264,9263,9262,9261,9260,9259,9258,9257,9256,9255,9254,9253,9252,9251,9250,9249,9248,9247,9246,9245,9244,9243,9242,9241,9240,9239,9238,9237,9236,9235,9234,9233,9232,9231,9230,9229,9228,9227,9226,9225,9224,9223,9222,9221,9220,9219,9218,9217,9216,9215,9214,9213,9212,9211,9210,9209,9208,9207,9206,9205,9204,9203,9202,9201,9196,9195,9194,9193,9192,9191,9190,9189,9188,9187,9180,9176,9175,9174,9169,9168,9167,9166,9165,9164,9163,9162,9161,9160,9159,9156,9542,9541,9540,9539,9538,9537,9536,9535,9534,9533,9532,9531,9530,9529,9528,9527,9526,9525,9524,9523,9522,9521,9520,9519,9518,9517,9516,9515,9514,9513,9512,9511,9510,9488,9296,9292"]

An XMAS Movie Mashup

2014-12-24T08:35:34+01:00

https://www.youtube.com/watch?v=fKjoJKW2C34

Final Cut 2014 - Movie Mashup

2014-12-23T12:59:30+01:00

https://www.youtube.com/watch?v=MV9MCLS1Ji8

Best of Web 7 - HD - Zapatou

2014-12-22T08:23:43+01:00

https://www.youtube.com/watch?v=axgDgH6f7Pw

The Dark Game of Hobbit Knight Thrones Musical Mashup

2014-05-26T19:11:00+02:00

http://www.youtube.com/watch?v=wUKjN5hi7UM

Job le plus dur du monde

2014-05-25T10:40:10+02:00

https://www.youtube.com/watch?v=beCYTVk-AYU

Mashup La communauté de l'anneau / Kaamelott

2014-05-16T12:14:44+02:00

http://www.youtube.com/watch?v=krrZoYm7FvA

Mashup Titanic / Les Bronzés

2014-04-18T11:00:19+02:00

https://www.youtube.com/watch?v=hLEEHWFn308

Monitoring des services de streaming live audio/video

2014-03-06T11:00:35+01:00

Dans le cadre d'une de mes vies précédentes, chez Yacast Media (depuis racheté par SmartJog et devenu Arkena) en l'occurrence, se posait la problématique de comment s'assurer de la qualité de service envoyée au client pour tout ce qui était flux live. A chaque problème, sa solution, et ici, elle se prénomme Bobone.

Certains d'entre vous connaissent les CDN : les Content Delivery Networks, des diffuseurs de contenu. La majorité suppose qu'ils ne font que de la mise en cache du contenu. C'est en effet une bonne part de leur métier mais pas l'unique. Parmi les autres, il y a aussi, dans ce qui nous intéresse ici, des fonctions de captation (récupérer un signal hertzien, satellite, câble, ou autre), de transcodage (transformer ce flux capté en flux informatique) et de diffusion (le coeur du métier du CDN donc). Ceci représente le streaming. Pour vous, en tant qu'utilisateur, il s'agit de ce que vous pouvez consulter sur votre boîter TV fourni par votre FAI, ou via votre tablette ou smartphone.

Pour se faire, les infrastructures sont toujours plus importantes, toujours plus complexes. Dans le cas de la mise en cache de contenu, il est relativement aisé de détecter automatiquement une défaillance ou un dysfonctionnement. Pour autant bien trop peu de CDN mettent ces routines en place ... Dans le cas de la diffusion de contenu en direct, le streaming, il n'y avait pas à l'époque d'outil disponible pour faire ce contrôle automatique. Il incombait donc à des humains de tester les flux.

Ceci représente un coût non négligeable pour la société et le temps qu'un humain teste tous les flux sur tous les serveurs, l'ensemble de la plateforme pouvait s'écrouler ou diffuser le contenu avec une qualité déplorable. Parti de ce constat, c'est posé la question de comment le résoudre. M'est alors venue l'idée d'utiliser VLC pour se faire.

VLC est un outil permettant de regarder des vidéos mais aussi des flux audio/vidéo directement sur internet. Il fonctionne sur de nombreux systèmes dont Linux, ce qui m'arrange pour pouvoir faire ma programmation. Au moins dans sa version Linux, il propose de fonctionner entièrement en ligne de commande, publiant un nombre mirobolant d'informations à chaque instant, mais également l'image transformée en ASCII, grâce à la libcaca (ne rier pas trop, faut qu'on continue à bosser).

Il me restait donc à définir du code permettant de recueillir la liste des points de diffusions de chaque plateforme, la liste des serveurs et tester l'ensemble. C'est le but du code alors rédigé en PHP qui fonctionnera en ligne de commande. Ce programme multi-process consultera plus d'une centaine à chaque instant et analysera une centaine de points sur les flux pour en déterminer la qualité de service. Le résultat sont stockés pour l'heure dans une base SQLite embarquée. L'application est donc mobile. A l'époque, cette base était consultée par l'intranet qui permettait de lister les problèmes et relancer les flux sur les différents équipements via un simple clic.

Les opérateurs y gagnaient en charge de travail, la société en €€ et le client en assurance sur la qualité du service fourni. Des évolutions étaient préves mais n'ont pas vu le jour. Je le ressors aujourd'hui car je vais en avoir besoin et donc vais le faire revivre. Je viens donc d'importer la dernière version du code (qui date de début 2010) sur Github.

Tiens une question du fond, la personne qui se pouffe de rire toute seule : pourquoi Bobonne ? Tout simplement, le programme devait "regarder des chaînes de TV et écouter la radio" en continue. La parfaite ménagère de moins de 50 ans (copyright de nos chères chaînes de TV). En argo, Bobonne.

SupInfoCom - A la francaise

2014-02-27T10:46:57+01:00

http://vimeo.com/86295452

2CELLOS - Thunderstruck

2014-02-25T07:31:35+01:00

http://www.youtube.com/watch?v=uT3SBzmDxGk

1984 Movies supercut - golem13

2014-02-17T11:01:15+01:00

http://vimeo.com/86617721

Love Means Never Having to Say You're Sorry

2014-02-14T11:01:24+01:00

http://vimeo.com/groups/montagecreators/videos/86725484

Make love. Not War - Axe ads without Axe

2014-01-27T07:50:06+01:00

http://youtu.be/Gz07w2XaxBc

Dis 33 ! (Pub Peugeot 806 pour les incultes)

2014-01-21T06:48:56+01:00

http://www.youtube.com/watch?v=16AHysRb3B0

Sophie Maurin & Jamie Cullum - Far Away

2014-01-20T08:04:53+01:00

http://www.dailymotion.com/video/x1a0i3o_jamie-cullum-et-sophie-maurin-le-duo-de-charme_music

Les Frenchies vus par le cinéma US - Hervé De Wilde

2014-01-08T20:14:14+01:00

Oslo - Fireworks - Happy new year 2014 - ABBA medley

2014-01-02T15:55:15+01:00

New Year's Eve Countdown - Movie Mashup

2014-01-01T01:04:46+01:00

http://www.youtube.com/watch?v=et73p86--ls

Darlene Love - All Alone on Christmas (A Very Merry Movie Mash-up)

2013-12-25T10:51:58+01:00

http://www.youtube.com/watch?v=wemjvUbBgz0

Best of web #6 - 2014

2013-12-24T12:08:04+01:00

http://www.youtube.com/watch?v=1-8isxa5B_Y

Best of web #5 - mid 2013

2013-12-24T12:06:58+01:00

http://www.youtube.com/watch?v=iDkrSD8fOBo

James Bond est un alcoolique notoire

2013-12-13T16:11:53+01:00

Ca se passe sur un des blogs du Monde :

http://bigbrowser.blog.lemonde.fr/2013/12/13/alcoolique-anonyme-james-bond-aime-encore-plus-la-bouteille-que-les-femmes/

Skip the use - Nameless world

2013-12-13T15:24:23+01:00

2013 - Movie trailer mashup

2013-12-03T15:33:43+01:00

Côte : manger français à Londres

2013-11-14T01:10:13+01:00

En déplacement professionnel chez nos voisins d'outre-Manche, j'ai passé ma journée à manger/boire français : viennoiseries, bières (Stella & Météor), ... et le dîner. Bah oui, pourquoi s'embêter à trouver quelque chose d'anglais chez les Rosbifs ? Mes souvenirs de voyages linguistiques ? De la semelle, de trucs sans goûts, ... Alors quand en cherchant une table pour le dîner, on a vu un restaurant se présenter comme "Brasserie Côte, la brasserie de laquelle les parisiennes devrait prendre des leçons", on s'est dit : challenge accepted ! C'est ici que ca se passe.

Pour l'ambiance Brasserie, je dirais qu'il y a un petit loupé : on est à mi chemin entre un restaurant à l'Américaine (type le Walt pour ceux qui connaissent), le pub et la brasserie. Pas très cliché mais bon, c'est propre.

La carte, assez pauvre en noms à consonance française est assez bien pourvue, tant sur les entrées que sur les plats. Mon dévolu se jette sur le tartare de boeuf en entrée (??), un demi poulet (breton - ils insistent), accompagné d'une Météor.

Que dire de l'entrée. J'étais assez dubitatif de proposer un tartare en entrée (préparé avec les câpres, le cognac, l'oeuf, ...). Je rajoute mes sauces (Worcester & Tabasco), je porte la fourchette en bouche et là, c'est le drame : c'est l'un de meilleur tartare que j'ai jamais mangé ! Je n'en connais qu'un seul autre (à Paris d'ailleurs) qui fut meilleur ! Je crois rêver ... Je me dit qu'il y a erreur, que j'ai du reprendre le train dans l'autre sens ou que je me suis assoupi à une de mes conférences. Je m'agite, j'en gobe le reste du tartare et non, tout est bien réel.

Très bonne introduction pour me préparer au demi poulet, plat "par défaut" que je prend souvent dans les brasseries parisiennes. Le poulet est cuit sur le grill. Goûtu, il reste néanmoins un peu trop rosé à mon goût (je l'aime bien blanc). mais la cuisson est homogène et propre, l'assaisonnement fin. La sauce au champignons qui l'agrémente est fine et n'étouffe pas le palais. Les frites présente en accompagnement son juste bonne. Le plat est donc bon, mais à mon goût mériterait une cuisson plus longue. Mais rien de choquant et également bien habituelle, même dans les bonnes brasseries parisiennes.

Bien mis en bouche, ayant toujours le régal de l'entrée en bouche, je me jette sur ce qu'on m'annonce la spécialité de la maison, pour mon dessert : la crème caramel. Et bien je dois dire qu'ils peuvent s'en vanter. Généreuse, onctueuse, légère, elle fond délicatement en bouche. La parfaite définition de la crème caramel.

Même si je suis chiant sur la cuisson de mon poulet, le dîner fut parfait du début à la fin avec un service plus qu'agréable. Avec deux bières, le repas m'aura coûté 35,10 livres (soit environ 42€) : honnête. Le pire, c'est que c'est une chaîne ...

Quai d'Orsay : satyre de la politique française

2013-11-13T10:57:55+01:00

A croire que c'est la période des adaptations ciné de bandes dessinées françaises, aussi bien dans le Nouveau Monde que sur ce bon Vieux Continent. Cette fois-ci, on adapte une satyre des méandres de la politique française. Le cadre choisi est le ministère des Affaires Etrangères sous le Président Chirac. La méthode choisie pour découvrir ce monde est d'accompagner les premiers pas d'un jeune diplomate dans l'ombre du ministre. Action.

A croire que le cinéma n'a plus d'idée ... adaptations de bouquins, adaptations de BD, bientôt adaptations de prospectus publicitaires, ... Que dire à part qu'on en mange à toutes les sauces. Pour autant, du franco-français, en comédie, c'est alléchant, surtout avec Popaye comme beau gosse (âgé) de service.

[video]http://www.youtube.com/watch?v=jmwE8aSojrs[/video]

Arthur est un jeune bobo de gauche qui rêve d'un poste prestigieux dans le monde politique française. Heureusement, il est recommandé par bon nombre de ses connaissances auprès du ministre des Affaires Etrangères, Alexandre. Premier hic ? le gouvernement est de droite. Passé ce premier frein, il faut faire ses preuves et trouver ses marques. C'est ainsi que la hiérarchie fort simple (ahem...) de l'administration française s'ouvre à lui et lui permet de découvrir un nouveau monde où les coups bas sont des signes d'amour et les félicitations, des coups en traitres.

Place à une succession de grandes phrases et citations qui n'ont ni queue ni tête mais où tout à chacun trouvera un sens unique : des qui pro quo en chaîne, des interprétations comiques, ... Le film ne s'arrête jamais et garde un rythme soutenu mais non étouffant. On suit et on se délecte de l'ambiance bonne enfant du film. On trouve toujours une allusion à une expérience passée ou présente qui nous permet de nous identifier à Arthur.

Cependant, trois points font perdre au film sa perfection :

la compagne d'Arthur est totalement effacée
parler des expulsions de famille et écoliers est trop dans l'actualité pour en rire dans un film et du coup, la petite anecdote portée à l'écran est mal placée
la fin est catapultée : on est dans le rythme, on s'attend à ce que le film se poursuivre et au final, le générique apparaît à l'écran

Pour autant, le film est un régal qu'on savourera à n'importe quelle heure.

Snowpiercer ne fend pas un cheveux en quatre

2013-11-13T09:35:34+01:00

Snowpiercer est basé sur une bande dessinée française du début des années 80. L'idée original est de nous plonger avec les rares survivants de l'espèce humaine dans un train en perpétuel mouvement. Le monde a gelé lors de l'apocalypse déclenchée pour contrer le réchauffement climatique. Très hiérarchisé, ce train segmente son monde en wagons, chacun ayant leur niveau social (les riches en tête, les pauvres en queue) ou leur utilité (école, aquarium, serre, ...). Mais comment vivent ces classes ? Telle est la base de l'oeuvre française et le but annoncé de la transposition ciné.

Avant d'aller voir ce film je me suis refusé à lire les critiques, me cantonnant à la bande annonce et les infos que j'ai pu glaner sur la BD (à défaut de la lire pour le moment). Assez motivé ma peur d'un nanard d'action se mélengeait à l'envie de découvrir une psychanalyse sur l'enfermement humain.

[video]http://www.youtube.com/watch?v=DgLCvNbtcFE[/video]

Le film commence en nous décrivant la bétise humaine (une nouveauté tiens) : il y a le réchauffement climatique, on ne fait que de la pseudo-science de bas étage et on se prend pour des cadors capables de changer le monde. Du coup, tout le monde meurt, sauf une poignée de chanceux, sauver de l'apocalypse par le visionnaire Wilford qui a penser à se préparer une porte de sortie (construction d'un immense réseau ferroviaire parcourant le monde sans fin et d'un train pour s'y promener à grande vitesse).

Jusque là, tout va bien. Là où la bande dessinée se focalisait sur le vécu et le questionnement des gens de queue, le film lui se focalise sur leur volonté de rebellion. Cette différence notable va faire virer le film pourtant bien parti vers l'action volontaire. Et là est le drame. De l'action, on va en avoir. Bien trop. Le point d'orgue de cette action est l'ouverture du wagon des bouchers : longs impers, haches aiguisées, on sait à l'avance que cela va être un bain de sain. Mais quelle est l'utilité de nous montrer ce bain de sang, de le rallonger pendant de longues minutes au point de le faire devenir écoeurant ?

Tout dans ce film devient dès lors "trop". Trop de violence. Trop de n'importe quoi. Trop d'action. Trop de discours dans le vent. Trop de jeux d'acteur à la petite semelle (Chris Evans est aussi perdu que son personnage). Seule Tida arrive à sortir son épingle du jeu avec un rôle à sa mesure. Mais ce n'est point suffisant pour remonter le niveau du film. Le train se prend pour Titanic et s'enfonce dans les goufres sans fin du nanard d'action que l'on veut vite oublier.

Le China : le temps d'une soirée à Macao

2013-11-07T09:37:28+01:00

Mon petit plaisir est de découvrir des lieux plus ou moins insolites. A force de parler de partenaires et clients chinois au bureau, le nom du China est sortie. Qu'est-ce ? Simplement un immense bar-lounge/restaurant, ambiance Macao, caché entre Bastille et Ledru-Rollin. Petit retour sur un lieu à partager.

Quand on me parle de Macao et de ses bars, je me souviens de l'ambiance des vieux films dans les restaurants occidentaux de Macao, esprit feutré, luxe, calme ; toujours un crooner ou une chanteuse pour mettre l'ambiance et motiver la clientèle à consommer ; un nuage de fumée dégagé par les cigares de ces messieurs et les cigarettes de ces dames. Ici, loi française oblige, on oublie la fumée, mais on conserve tout le reste.

De l'extérieur, cela ne paie pas de mine et on s'attend à un restaurant Chinois un peu luxe mais quelconque. Pénétrez et vous découvrirez trois salles immenses et magnifiques, celle du bas étant dédié aux concerts privés. De la pop, du jazz, des musiques diverses, le plaisir auditif sera là (juste pu entendre les répétitions question de temps).

Cela reste un bar et un restaurant. Le lieu est dédié aux cocktails, alcoolisés ou non. Vautré dans les canapés en cuir, on appréciera les mélanges généreux en tout servis par les charmantes hôtesses. La nourriture est bonne, sans être exceptionnelle et conviendra parfaitement à l'accompagnement des boissons. Installés pour dîner, la carte des vins prendra la place de celles des cocktails pour le plaisir de vos papilles.

Une courte soirée m'a permis de découvrir ce mieux totalement dépaysant. Un plaisir à tous les niveaux qui se renouvellera sûrement, mais avec modération, les tarifs étant un peu élevés.

Malavita : tu ne toucheras pas à la Famille

2013-10-23T16:08:03+02:00

Qui ne se souvient pas d'une des règles sacrés imposées par tout Parrain, Don Corleone en tête : on ne doit pas toucher à la Famille. Bien qu'ayant endossé le rôle du Parrain en devenir, joue aujourd'hui avec le feu en violant cette règle. Malavita signifie pègre en italien. C'est aussi le nom du fichier des Blakes dans ce film. C'est surtout le nom donné à ceux qui pourchassent De Niro et sa famille.

Produit par Scorsese, réalisé par Besson, ce film ne fait pas dans la demi-mesure sans pour autant jouer d'un spectale "trop" en tout.

[video]http://www.youtube.com/watch?v=jeXQjWnSWEk[/video]

Il faut dire qu'on fait dans l'évidence des rôles :

Robert De Niro en mafieux
Tommy Lee Jones en agent gouvernemental
Michelle Pfeiffer en femme pas très net mais présentant très bien

Alors que nous raconte Malavita ? Déjà que le chien Malavita est trop absent de l'écran. Dommage. On nous présente une famille qui est parfaitement en harmonie au niveau des dérapages, pour autant, le chien ... ne nous apporte rien. Dommage, vu son nom. Par contre le film Malavita nous raconte beaucoup de chose sur le repenti De Niro et sa famille qui ont du mal à perdre leurs (mauvaises) habitudes. Après tout, il ne faut jamais manquer de rester à la Famille.

En près de deux heures de séance, le film n'a que peu de réels temps d'arrêt. A la rigueur, il s'agit plus de moment pour nous laisser reprendre notre souffle, tel le torturé que l'on plonge dans la baignoire pour faire avouer ses crimes. Pour le coup, j'ai envie d'avouer mon crime du jour : avoir aimé ce film.

Loin du gros spectacle Hollywoodien, ce film, planté dans un décors de Normandie, respire la vie à la campagne, loin de la folie de la ville, mais surtout de la folie mafieuse. Puis l'on se rappelle qu'une famille, c'est avant tout une réunion de membres, et que dire sur ceux de la famille Blakes !

Certes, le film ne rentrera jamais au panthéon du 7e art comme son aïeul Le Parrain. Pour autant, il est rafraichissant, plus encore que le fût Mafia Blues que l'on sentait poussif et forcé. Là tout semble si naturel pour cette famille. Allez voir cette famille et surtout, souvenez-vous : respectez la Famille !

Neuf mois ferme : allez tout droit en prison ... ou pas

2013-10-18T16:48:37+02:00

Quand on pense à Dupontel, on pense à un personnage déjanté. Quand on pense à Dupontel en tant que réalisateur, on pense à la première grosse claque reçue : Bernie. Prenez Bernie, rendez-le presque intelligent, dans un univers plus propret et vous obtenez neuf mois ferme. En tout cas, c'est ainsi que j'ai pressenti ce film avant de pénétrer dans une salle obscure.

Ariane, juge bobo, coincée, persuadée que les hommes ne servent à rien, ne vit que pour et par son boulot. Elle en fait trop. Ses collègues le savent et la retrouve logiquement à son bureau alors que tout le monde fête la St Sylvestre dans le Grand Hall. Traînée sur les lieux de la débauche, elle est contrainte de rentrer dans le moule et de boire plus que raison. Voilà son crime : avoir céder et voulu faire comme les autres.

[video]http://www.youtube.com/watch?v=YFJ1XAZh2OI[/video]

Six mois plus tard, malade, elle se rend compte qu'elle est enceinte. Et voici que notre juge décide de détourner les moyens légaux mis à sa disposition pour son propre bénéfice : mener une petite enquête pour trouver le père de sa progéniture. Malheureusement pour elle, le père est ~~Bernie~~, pardon, Bob Nolan. Ce tôlard multi-récidiviste, soucieux de prouver son innocence dans une autre histoire abracadabrantesque, propose un échange de bon procéder à notre juge.

Et c'est alors parti pour 1h20 de délire à la Dupontel. Impossible de garder son sérieux plus de 30 secondes. Les rares fois où l'on croit pouvoir, c'est simplement pour rire de plus belle. Je ne saurais dire que ceci : "Merci Albert pour la séance d'abdos, ca fait du bien avec le popcorn". Un film rafraichissant où même la plus fervente supporter du "pas besoin des hommes" ne restera pas indifférente à notre cher Albert.

Par contre, petite question, Albert : vous en avez déjà parler à un psy de votre soucis avec votre mère ? Parce qu'entre le vide-ordure et le four, les mères que vous dépeigner ont de gros soucis avec leur progéniture.

River Café : un repas à la mer !

2013-10-18T11:15:11+02:00

Enfin pas à la mer, mais sur la Seine en tout cas. Pour ceux qui ne connaissent pas, le River Café est un restaurant installé sur une péniche sur les quais d'Issy-les-Moulineaux. Cadre luxe, service élégant, une partie de la péniche beigne dans une musique jazzy live. Tout les ingrédients semblent réunis pour passer une excellente soirée. Retour sur un repas d'affaire au River Café.

On débute avec une mauvaise surprise à l'arrivée alors que nous avions réservé via le site de La Fourchette pour un dîner le vendredi soir. On nous annonce que les réservations via La Fourchette donnent droit à une promotion (traduire : une salle sans concert) et qu'il faut les appeler pour réserver une table avec concert. J'ai beau lire et relire la page sur le site de réservation, il est bien possible de réserver directement en ligne pour une table avec concert. Peu honnête et le "on va vous prévenir dès qu'une table se libèrera" alors que la salle n'est pas remplie passe moyennement (et cet engagement ne sera jamais respecté). Bref, on démarre sur une note malhonnête de la part du maître d'hôtel.

On est donc quatre pour un repas d'affaire mais je vais me focaliser sur ma part du diner. En entrée, des ravioles au foie gras accompagné de cèpes poêlés. Pour avoir pu manger cette entrée dans bons nombres de restaurant, la critique et la comparaison est aisée. De même, il est clairement définit que les champignons ont un goût prononcé qui noie facilement celui du foie gras. Malheureusement, ici on nous rappellent très vite cette règle : les ravioles n'ont que des miettes de foie gras (donc aucun goût à sentir) et le tout baigne dans une soupe aux champignons (je croyais que c'était l'accompagnement). On est loin de la qualité énoncé. Petite aparté, un collègue a pris une terrine des champignons ... et a eu une bonne indigestion pour tout le WE. De là à dire que certains produits sont peu frais et qu'il faut s'en débarrasser au plus vite en augmentant les quantités par rapport au reste, il n'y a qu'un pas.

Le plat, est plus simple ne se rappelle à mon bon souvenir que par les frites maison qui l'accompagnait. La tartare choisi était déjà préparé, peu épicé, sans oeuf. Certes la viande était fraiche (encore heureux sur un tartare) mais le goût était relativement absent.

La fin du repas a été marquée par le choix quasi unanime d'un Paris-Brest au Nutella. Ce dessert riche sait rester léger. On l'apprécie d'autant plus en tout fin de soirée avant de devoir reprendre la route. Un vrai régal qui relève le niveau global de cette péniche.

Quand je lis les commentaires sur les différentes sites pour ce restaurant, je me dis que beaucoup se laisse éblouir par les artifices mis en oeuvres à travers la décoration (luxe), le service (pro) et les plats (bien présentés). Sûrement que la musique Jazz réhausse également le cadre. Cependant, la qualité n'est vraiment pas au rendez-vous, la vue est absente, et bien des brasserie parisienne font bien mieux à tous les niveaux et à un prix bien moindre. Ce n'est pas une péniche que je recommanderais.

T.S. Spivet : un oisillon prend son envol

2013-10-16T11:39:33+02:00

Avec son titre français à rallonge (bien que l'original ne soit pas si court), L'extravagant voyage du jeune et prodigieux T.S. Spivet annonce un voyage initiatique intéressant. On hésite à avoir un voyage fantastique mais la bande annonce nous rappelle que le voyage est extravagant et que la force du film est dans son jeune acteur.

Le jeune T.S. Spivet, petit garçon de 12 ans perdu dans sa famille, entre des parents trop pris par leurs activités à la ferme, et une soeur superficielle qui le dénigre en permanence, décide de fuguer à l'occasion d'un quiproquo qui le mènera à Washington, D.C. pour une remise de prix scientifique.

[video]http://www.youtube.com/watch?v=aZe7i1Ty5f4[/video]

Quand je lis Jean-Pierre Jeunet, je pense à du très bon (La cité des enfants perdus) et à du très mauvais (Le fabuleux destin d'Amélie Poulin - bah oui). Du coup, je ne sais trop à quoi m'attendre. Mais bon, le synopsis m'intrigue tout autant que la bande annonce alors j'y vais.

Démarre alors le voyage initiatique et poétique du jeune T.S.. Et c'est avec plaisir qu'on l'accompagne dans son périple à travers l'Amérique, tel le vagabond caché dans son train de marchandise. T.S., c'est ce genre de petit garçon qui ne se sent pas à sa place dans son Montana natal et qui passe son temps à analyser son monde, le comprendre, et l'imaginer pour pouvoir fuir son quotidien.

Touchant dans le jeu du petit, l'histoire l'est tout autant et on vibre pour lui quand il nous raconte son quotidien et le passé de son frère jumeau, très différent de lui. On s'imagine l'accompagnant durant son périple, asseyant de l'aider dans l'adversité. Des personnages hauts en couleurs parsèment également la route du jeune T.S..

Malheureusement, le film se veut léger et finit de manière trop catapultée. L'envie de Jeunet d'en finir pour ne pas avoir un film trop long se fait sentir. Les derniers évènements se précipitent à une vitesse où le film en devient presque indigeste alors que jusque là on se délectait du récit. La poésie jusque lors enivrante laisse sa place à un mélange entre plaisir et stupeur. Un travail bâclé sur une histoire et une mise en scène magnifique.

Judgement Day - Ash of Sound

2013-09-30T17:10:25+02:00

Pour ceux qui connaissent ce blog depuis assez longtemps, vous savez que je suis quelques artistes autant que je le peux. Les Ash of Sound font parti de ces groupes que je prend plaisir à écouter régulièrement. Ils sont également à l'origine de la webradio que j'avais mis en place ici (désactivée pour le moment). A l'occasion de l'ouverture de leur site, ils avaient profité pour mettre en ligne leur nouveau single : Judgement Day.

Jour du jugement donc à travers ce billet de la nouvelle affiche que tiennent les Ash. Ok j'ai un peu traîné (comme pour mes autres billets dont je rattrape le retard aujourd'hui), mais toute bonne chose sait se faire attendre, comme ce clip sur fond d'Hitman :

[video]http://www.youtube.com/watch?feature=player_embedded&v=5Gi3NNZuSpc[/video]

Quand j'ai découvert le nouveau clip, j'ai écouté... plus d'une fois... et mes réactions furent assez claires et directes (dans l'ordre) :

tiens un peu d'électro ?
tiens le clip a des airs de Money for Nothing ?
hmmm en fait non, c'est plus dans le style (sonorité/voix) d'un U2 de la fin des années 90

Puis je me suis laissé porter par le son, sans les images ... puis par le son avec les images... J'accroche vraiment au nouveau style que l'électro leur apporte, grâce à l'intégration de Lionel dans le groupe. Vraiment un plaisir d'écouter ce groupe en boucle.

Bon, par contre les gars, le logo à la Avenger, ca le fait moyen. J'ai beau être fan, là non. Mais bon, je suis un râleur-né !

L'Oga : voyage gustatif dans le 11e

2013-09-07T09:33:20+02:00

Ce vendredi, plusieurs choses à fêter. Du coup, on cherche un restaurant totalement atypique pour le cadre et pour la nourriture. Nous jettons notre dévolu sur L'Oga, un restaurant dans le 11^e. Le restaurant semble spécialisé dans les brunch (assez honéreux pour le quartier) mais propose également une carte pour le soir assez surprenante. En effet, on y parle de viande de crocodile, de zèbre, ...

Réservation faite, il s'avère, en arrivant bien plus tôt qu'il y avait de la place. On demande pour pouvoir déjeuner plus tôt, grand sourire du serveur qui nous place directement. Et là, nous découvrons le cadre. Un mélange entre du Rainforest et du baroque. On ne sait pas trop où on est. L'éclairage faible est propice aux diners aux chandelles ... déjà allumées sur les tables. Pile ce qu'il nous fallait comme cadre.

On peut alors s'attaquer à la carte. Là, un rouleau façon vieille carte au trésor nous est apporté. On le déroule pour découvrir une carte pas très longue sur le choix, mais qui en dit long sur le type de nourriture. Ici, on cherche réellement le dépaysement dans la nourriture. Cependant, il faut contenter toute le monde et les moins téméraires trouveront aussi de quoi manger. Les plats sont choisis :

Entrées
- Poisson tropical : un carpaccio de poisson exotique (rupture pour l'occasion donc remplacé par du thon) avec du lait de coco, des épices, ...
- Des gambas : le secret réside dans la préparation donc ... à découvrir
Plats
- Un mi-cru de thon
- De la viande de crocodile à la vanille accompangée de frittes de patates douces

Les plats se dégustent sans fin et les portions sont vraiment généreuses. Mais, tout bon repas qui se respecte s'accompagne d'un bon vin. La carte des vins du monde est longue et on décide de choisir un rouge d'Afrique du Sud : Le Fort Simon. La carte annonce beaucoup de choses le concernant ... toutes sont validées : vanillé, fumé, fort en bouche. Au final, il accomode parfaitement le repas jusqu'à l'arrivée des desserts.

Une nouvelle carte, assez simple, nous est présentée. Notre choix se porte sur un trio de glaces (miel/lavande, gingembre, ...) et un cheesecake au chocolat blanc. On se disait avant le dessert que la cuisine était bonne mais là ... Tout se termine parfaitement. Un petit café de mon côté. De l'autre, une tisaine d'herbes fraîches (il est possible de les mélanger).

Une véritable découverte. Un véritable dépaysement. Si vous cherchez de l'atypique pour un dîner romantique c'est l'adresse idéale. Cependant, il ne fait que frôler la perfection. Alors que le repas et le cadre sont complétés par un service irréprochable, le réveil se révélera brutale avec l'arrivée de la douloureuse. 126 € pour deux. Le souvenir reste cependant plus que positif.

Pacific Rim : quand Godzilla rencontre Evangelion

2013-07-12T10:45:29+02:00

Il y a de ces blockbusters que l'on attend car la bande-annonce fait résonner plein de souvenirs dans notre petite tête et du coup, titille notre curiosité et notre impatience. C'est le cas de Pacific Rim. Pour autant certains points de la promotion me choquent. Par exemple, pourquoi diable avoir deux pilotes ? Jeudi soir, Julien de Golem13 m'a refilé des invit' pour l'avant-première au Normandie. Retour sur plus de 2h de transpiration dans la salle obscure.

[video]http://www.youtube.com/watch?v=dY9wTJYLLcs[/video]

Pour commencer, merci Julien, j'ai pris de l'avance pour une fois sur mon programme ciné ! De plus, merci UGC de ne pas avoir allumé la climatisation de la salle vu la température extérieure : on aurait pu s'enrhumer bêtement.

Quand j'ai vu les premières images de promotion, je me suis dit : tiens, ils font une version Live Action d'Evangelion. Puis j'ai vu les monstres : tiens, ils font un nouveau Godzilla. Puis la date est annoncé : été 2013. Après Battleship en 2012 qui fut mémorable (ou pas), ce sera donc Pacific Rim le blockbuster pour griller les neurones cet été. Il faut aussi rajouter qu'avec la promotion en parallèle du nanard de chez The Asylum, Atlantic Rim, il faut bien voir l'original pour pouvoir d'autant plus rire sur l'autre.

Pour avoir pu apprécier le travail de Guillermo del Toro sur les Hellboy ou encore le Labyrinthe de Pan, j'espère encore un travail dans le détail et la qualité avant d'y aller. Et pour cela, on est servi. Un véritable feu d'artifice d'animations et de couleurs. C'est propre. C'est fluide. C'est beau. Les yeux pétillent. Par contre, la 3D est à bannir car elle floute l'action (en retirant les lunettes, plus de flou). D'ailleurs, sur ce dernier point, il ne faut pas que Guillermo del Toro ne voulait pas de la 3D avant qu'un gros chèque ne lui soit présenté.

Le scénario est à la limite d'un film de série Z mais Guillermo a su le rendre suffisamment sexy pour nous garder accroché. Pour autant, tout reste excessivement téléscopé. Un peu dommage. Le point le plus intrigant et qui reste le plus comique est le pilotage des Jaeger (les robots). Pourquoi diable avoir mis deux pilotes qui doivent se connecter (on dit "dériver") mentalement pour pouvoir piloter ? La seule raison valable que je vois, c'est le clin d'oeil aux bons vieux Sentai. Quelques autres scènes risibles font que le film fleurte dangereusement avec les nanards. Attention, M. del Toro !

Des moments d'anthologie remonte un peu le niveau et font appel à l'inconscient Geek du public. C'est le cas de l'arrivée d'Hannibal Chow (joué par Ron Perlman) qui t'explique que tout en lui est faux : du nom au costume. Pour autant, il ne faut pas se moquer de lui car il tient à son image ... et à ses chaussures !

Le film tient au final son engagement : nous en mettre plein la vue, narguer les nanards sans en être un, et nous griller les quelques neurones qui auraient survécus à la chaleur. Pour autant, toujours pas le film de SF de la décennie.

Copenhague

2013-05-12T10:00:36+02:00

[gallery ids="10362,10361,10360,10359,10358,10357,10356,10355,10354,10353,10352,10351,10350,10349,10348,10347,10346,10345,10344,10343,10342,10341,10340,10339,10338,10337,10336,10335,10334"]

Fjords norvégiens

2013-05-04T10:54:30+02:00

[gallery ids="9545,9546,9547,9548,9549,9550,9551,9552,9553,9554,9555,9556,9557,9558,9559,9560,9561,9562,9563,9564,9565,9566,9567,9568,9569,9570,9571,9572,9573,9574,9575,9576,9577,9578,9579,9580,9581,9582,9583,9584,9585,9586,9587,9588,9589,9590,9591,9592,9593,9594,9595,9596,9597,9598,9599,9600,9601,9602,9603,9604,9605,9606,9607,9608,9609,9610,9611,9612,9613,9614,9615,9616,9617,9618,9619,9620,9621,9622,9623,9624,9625,9626,9627,9628,9629,9630,9631,9632,9633,9634,9635,9636,9637,9638,9639,9640,9641,9642,9643,9644,9645,9646,9647,9648,9649,9650,9651,9652,9653,9654,9655,9656,9657,9658,9659,9660,9661,9662,9663,9664,9665,9666,9667,9668,9669,9670,9671,9672,9673,9674,9675,9676,9677,9678,9679,9680,9681,9682,9683,9684,9685,9688,9691,9694,9696,9698,9702,9705,9708,9711,9715,9718,9721,9725,9729,9733,9736,9739,9742,9745,9749,9753,9755,9759,9762,9765,9769,9773,9776,9779,9781,9784,9788,9791,9793,9796,9798,9800,9802,9804,9806,9808,9810,9811,9813,9815,9817,9819,9820,9822,9824,9827,9829,9831,9833,9835,9837,9840,9842,9845,9847,9849,9851,9853,9855,9857,9859,9861,9864,9866,9868,9870,9872,9874,9876,9877,9879,9881,9883,9885,9887,9889,9891,9893,9895,9896,9898,9900,9901,9903,9904,9906,9907,9909,9910,9912,9913,9915,9917,9918,9919,9921,9922,9924,9926,9927,9929,9930,9932,9933,9935,9937,9938,9940,9942,9944,9946,9948,9950,9951,9954,9955,9957,9958,9960,9961,9963,9964,9966,9968,9969,9971,9972,9974,9976,9978,9981,9982,9984,9985,9987,9989,9990,9993,9995,9997,9999,10001,10003,10005,10007,10009,10011,10013,10015,10017,10019,10020,10022,10024,10026,10028,10030,10033,10035,10037,10039,10042,10044,10047,10049,10052,10054,10056,10058,10061,10063,10065,10067,10069,10071,10073,10075,10077,10080,10082,10085,10087,10089,10091,10093,10095,10097,10099,10101,10103,10105,10107,10109,10111,10114,10115,10118,10120,10122,10125,10127,10129,10131,10134,10137,10140,10142,10145,10147,10149,10151,10153,10156,10159,10162,10164,10167,10169,10171,10173,10176,10179,10182,10183,10186,10189,10191,10193,10195,10196,10198,10201,10203,10205,10207,10209,10210,10212,10215,10217,10219,10221,10223,10226,10228,10231,10233,10235"]

Warm bodies : Roméo et Juliette dans Zombieland

2013-03-28T10:00:27+01:00

Alors que la mode hollywoodienne est au mauvais remake, certains films donnent dans la création ou l'adaptation de livres. C'est le cas de Warm Bodies qui reprend la nouvelle d'Isaac Marion. On reprend donc l'éternel fin du monde qui déclenche le réveil des morts et on le vit autrement. Entamée du point de vue des zombies, l'histoire se transforme vite en Roméo et Juliette version horreur comique. Dressez-vous. Soyez raides. Jouer-la ... zombie !

Un zombie peut en cacher un autre

Quand on parle zombie, on pense d'abord aux oeuvres du Maître (Georges A. Romero) puis aux petites perles (Zombieland ou Shawn of the Dead). Bien que ces derniers soient volontairement comiques, pour se démarquer de la forte vague de films zombifiés, le point de vue est toujours le même. Le zombie est mort. Le zombie est con. Le zombie est inutile. Le zombie a faim. Mais si ce n'était pas le cas ?

[video]http://www.youtube.com/watch?v=CUDdGX78_6E[/video]

Alors pour toute justification sur la présence des zombies, vous n'aurez le droit qu'à un simple zapping express avec des séquences non sans rappeler d'autres film. R(omeo) est donc un zombie. Il est conscient mais n'a plus de souvenir. Il cherche à survivre dans ce que la vie lui a imposé : être un mangeur de chair. Il nous présente alors ses habitudes, ses balades entre potes zombifiés, ... leur quête à la nourriture. On notera rapidement le titre Québécois du film : Zombie malgré lui. Mais que se passerait-il si le destin mettait sur sa route une jeune petite blonde charmante ?

Julie(tte) est une humaine tout ce qu'il y a de plus vivante. Elle vit dans la dernière colonie humaine, protégée par une immense enceinte entourant un centre ville américain. Elle fait partie d'une équipe expéditionnaire, chargée de trouver des ravitaillements (nourriture, médicaments, ...). Perdue dans sa relation avec son petit ami, que se passerait-il si le destin la mettait sur la route d'un jeune zombie en mal de vie ?

Le destin fait son travail. Les chemins se croisent. Les regards se croisent. R mange le petit copain de Julie et apprécie particulièrement son cerveau. C'est un met tellement délicat qui en plus, permet de s'approprier les souvenirs de la victime. Tout est fait pour que les deux puissent tomber amoureux. Là, le cadavre peut alors se réchauffer. Malheureusement, la famille de Julie est vivante et celle de R n'est que zombie. Nos Roméo & Juliette vont donc apprendre à se connaître, à s'aimer ... et à se sauver.

Le film est très léger et alterne petites erreurs du scénario et travail fin sur les détails. Par exemple, on appréciera le travail des nuances de couleur de peau de R qui évoluent tout au long du film. Ce n'est pas sans rappeler le travail de nuance des tenues de Rose Da Silva dans le Silent Hill de Christophe Gans.

Véritable hymne à la vie et à l'amour, on ressort de ce film exhumé. On cherche alors à communiquer, à échanger, à exprimer nos sentiments (référence à la bande annonce). J'hésite à le classer à côté de Romeo+Juliette ou avec les chefs d'oeuvre zombifiés. En tout cas, à ranger loin des nanards.

Création d'un cluster MySQL haute disponibilité

2013-03-13T19:54:26+01:00

L'un des problèmes récurrents des architectures mutualisés (ou non) utilisant du MySQL est la disponibilité mais aussi la performance de ce dernier. Quelques habitudes existent, chacun avec leurs lots d'avantages et inconvénients. Je vais tenter de vous proposer une mise en oeuvre qui me semble être un bon compromis entre les différents points à prendre en compte : haute disponibilité, performance, type de table MySQL géré, compétences en interne, coût, facilité de déploiement.

MySQL en haute disponibilité

MySQL, beaucoup le critique à tord ou à raison. Le premier à le faire ? Michael Widenius, fondateur de MySQL qui s'affirme avec MariaDB. De manière générale, on notera certaines fonctionnalités (voire performances) en retrait par rapport à d'autres moteurs, que cela soit PostgreSQL, Oracle ou MSSQL. Reste que ces derniers sont cher à mettre en oeuvre et que PostgreSQL nécessite une compétence qui est bien trop rare dans nos contrées. De fait, MySQL reste quelque part une valeur sûre si l'on prend le temps de travailler correctement avec : définir une bonne architecture, le superviser et l'optimiser au fil du temps.

Quand on parle de haute disponibilité, je balaie d'office le fonctionnement basique maître-esclave disponible nativement. En effet, il n'apporte aucune haute disponibilité et le bricolage nécessaire pour inverser les rôles n'est tout bonnement pas industrialisable et encore moins réaliste. Que reste-t-il alors comme solution ?

MySQL Cluster
- solution opensource mais un support de la part d'Oracle est conseillé
- avantage(s) : supporté par l'éditeur (Oracle) ; performance
- inconvénient(s) : un seul type de moteur de table (NDB)
Percona XtraDB
- solution opensource qui dispose d'un support mais où l'on peut se débrouiller ; il s'agit d'une version lourdement mise à jour de MySQL (utilise la librairie Galera)
- avantage(s) : support de l'éditeur (Percona) ; extension du moteur InnoDB (renommé XtraDB) ; synchro temps réel
- inconvénients : principalement au niveau des LOCK (mais il y a une solution embarquée pour cela) ; que InnoDB pour le moment ; les statements DDL sont encore problématiques (mais en cours de correction)
Multi Master Replication
- solution opensource qui repose sur un abus d'utilisation d'une fonction de mysql (une instance peut être à la fois maître et esclave)
- avantage(s) : natif à MySQL ; tous les formats de table de MySQL (MyISAM, InnoDB, ...)
- inconvénients : peu stable sur le long terme - lié au fonctionnement en boucle, nécessite du bricolage et l'implémentation d'outils tiers (par ex, MMM)

InnoDB étant plutôt conseillé et apprécié par rapport à MyISAM, j'ai choisi la solution de Perconna. En effet, elle me semble sur le papier très industrialisable avec des inconvénients que l'on peut facilement contourner ou qui vont venir à disparaître.

Percona XtraDB Cluster en pratique

L'environnement utilisé est un environnement de type Prod + PRA. Le principe s'applique facilement dans les autres environnements (Prod + PCA, Prod seule, ...). Il faut juste noter un impératif de PXC : il faut minimum trois noeuds.

L'intérêt dans l'architecture est multiple :

tous les noeuds communiquent ensemble
on voudra séparer les flux "lecture/écriture" des flux "lecture seule"

Dans ce mode, on va dispatcher des VIP par site :

PRDVIPRO - lecture seule PRD : 192.168.2.5
PRDVIPRW - lecture/écriture PRD : 192.168.2.6
PRAVIPRO - lecture seule PRA : 192.168.12.5
PRAVIPRW - lecture/écriture PRA : 192.168.12.6

Ainsi, on va isoler les utilisateurs sur les différentes VIP. On pourra définir des super-alias qui pointent sur un site ou l'autre en fonction des besoins et disponibilités. Pour répondre à ces VIP, on supposera les machines suivantes :

PRDMYSQL01 : 192.168.1.1/24 (management) + 192.168.2.1/24 (métier)
PRDMYSQL02 : 192.168.1.2/24 (management) + 192.168.2.1/24 (métier)
PRAMYSQL01 : 192.168.11.1/24 (management) + 192.168.12.1/24 (métier)
PRAMYSQL02 : 192.168.11.2/24 (management) + 192.168.12.2/24 (métier)

La séparation des droits (RO/RW) ne se fera pas au niveau des rôles des noeuds (côté MySQL) mais au niveau de l'assignation des VIP et définitions des comptes utilisateurs. Il faut donc être attentif de ce côté.

Installation de Percona XtraDB Cluster

On commence par déployer tous les packages nécessaires

gpg --keyserver  hkp://keys.gnupg.net --recv-keys 1C4CBDCDCD2EFD2A
gpg -a --export CD2EFD2A | sudo apt-key add -
echo << EOF >> /etc/apt/sources.list
deb http://repo.percona.com/apt squeeze main
deb-src http://repo.percona.com/apt squeeze main
EOF
apt-get update
apt-get install libnet-daemon-perl libplrpc-perl libdbi-perl libaio1 libmysqlclient18 percona-xtradb-cluster-server-5.5 percona-xtradb-cluster-client-5.5 percona-xtradb-cluster-common-5.5 percona-xtrabackup xtrabackup netcat-openbsd rsync

On continue par la configuration du mysql. La configuration est une base pour un serveur avec 8 Go Ram et 4 coeurs. A faire évoluer donc.

echo << EOF > /etc/mysql/my.cnf
[client]
port = 3306
socket = /var/run/mysqld/mysqld.sock
[mysqld_safe]
socket = /var/run/mysqld/mysqld.sock
nice = 0
[mysqld]
server_id=1
wsrep_node_name=prdmysql01
auto_increment_offset = 4
auto_increment_increment = 4
wsrep_provider=/usr/lib64/libgalera_smm.so
wsrep_cluster_address=gcomm://192.168.2.2,192.168.12.1,192.168.12.2
#wsrep_cluster_address=gcomm://
wsrep_slave_threads=16
wsrep_sst_method=xtrabackup
wsrep_cluster_name=pxc
wsrep_sst_auth=root:secret
wsrep_sst_receive_address=192.168.2.1:4444
wsrep_provider_options ="gmcast.listen_addr=tcp://192.168.2.1:4567; ist.recv_addr=192.168.2.1:4568;"
binlog_format=ROW
log_bin=mysql-bin
log_slave_updates
default_storage_engine=InnoDB
innodb_autoinc_lock_mode=2
innodb_locks_unsafe_for_binlog=1
innodb_buffer_pool_size=400M
innodb_log_file_size=64M
innodb_data_file_path = ibdata1:10M:autoextend:max:128M
performance_schema
key_buffer = 1M
max_allowed_packet = 4M
table_cache = 64K
query_cache_limit = 64M
sort_buffer_size = 2M
net_buffer_length = 64K
read_buffer_size = 4M
read_rnd_buffer_size = 8M
myisam_sort_buffer_size = 64M
low_priority_updates = 1
old_passwords = 0
max_connections = 200
max_user_connections = 100
join_buffer_size = 256K
long_query_time = 2
slow-query_log_file = /var/log/mysql/mysql.slow.log
thread_cache_size = 5
query_cache_size = 0
query_cache_type = 1
tmp_table_size = 128M
max_heap_table_size = 128M
concurrent_insert = 2
delay_key_write = all
wait_timeout = 30
interactive_timeout = 30
key_buffer_size = 2G 
user = mysql
pid-file = /var/run/mysqld/mysqld.pid
socket = /var/run/mysqld/mysqld.sock
port = 3306
basedir = /usr
datadir = /var/lib/mysql
tmpdir = /tmp
skip-external-locking
bind-address = 0.0.0.0
myisam-recover = BACKUP
expire_logs_days = 10
max_binlog_size = 100M
[mysqldump]
quick
quote-names
max_allowed_packet = 16M
[mysql]
[isamchk]
key_buffer = 16M
!includedir /etc/mysql/conf.d/
EOF
chmod 600 /etc/mysql/my.cnf

Les lignes en gras sont à adapter pour chaque serveur :

un server-id unique à chaque fois
l'IP métier du serveur abstente du cluster-adress
le mot de passe root mysql

ATTENTION : ne pas utiliser le même mot de passe root en mysql et sur le système

Une fois le premier serveur mis en place, on arrête le mysql (via service ou init) sur TOUS les serveurs. Ensuite, on duplique le fichier /etc/mysql/debian.cnf et tout le contenu de /var/lib/mysql du premier vers les trois autres.

Une petite subtilité existe sur la version Debian/Ubuntu du package Percona. Au démarrage du premier node d'un cluster (au sens que tout le cluster est arrêté), il faut éditer le fichier my.cnf pour commenter la ligne

wsrep_cluster_address=gcomm://IP,IP,IP

et décommenter la ligne

wsrep_cluster_address=gcomm://

Ensuite, on peut démarrer simplement le service sur la machine puis remodifier le fichier my.cnf. C'est rébarbatif, mais il faut le savoir. Après, on n'aura à le refaire qu'en cas de relance complète depuis zéro du cluster.

Ensuite, on va déployer quelques modifications sur les droits MySQL :

mysql> GRANT ALL PRIVILEGES ON *.* TO 'root'@'192.168.2.%' IDENTIFIED BY 'secret';
mysql> CREATE USER 'perconha'@'localhost' IDENTIFIED BY 'secret';
mysql> FLUSH PRIVILEGES;

Ceci permettra aux différents nodes de communiquer pour la synchro et de disposer d'un user perconha qui n'a accès qu'en consultation aux variables applicatives de MySQL.

Nous n'avons plus qu'à démarrer les différents noeuds MySQL. Sur les versions Debian/Ubuntu, le premier démarrage pourra se faire en erreur. En effet, le script d'init considère que le serveur ne démarre pas car le binaire lui renvoie une erreur. En fait d'erreur, il s'agit juste d'un retour qui signale que le serveur est désynchro. On lui laisse le temps de bien démarrer (on peut consulter syslog pour cela) puis, à volonté, redémarrer le service une dernière fois.

Le cluster est maintenant installé.

VIP & Monitoring

Pour répondre au besoin de la gestion d'une VIP sans outil tiers ou de load balancer, ainsi qu'au monitoring complémentaire de PXC, j'ai mis à disposition des scripts sur mon github.

Le script pour Nagios est relativement simple à utiliser :

usage: ./check_percona -H $HOSTADDRESS$ -p $PORT$ -w $ARG1$ -c $ARG2$ -t $ARG3$ \(-U $ARG4$ \(-P $ARG5$\)\)
-H hostname or IP
-p service port
-w warning in seconds for replication delay
-c critical in seconds for replication delay
-t timeout for command input
-U user if needed
-P password if needed

Il ne nécessite que la création d'un compte (comme le compte perconha) pour permettre à Nagios de s'y connecter. Attention, il vient en complément du check_mysql disponible de base.

Concernant la VIP, le script va vérifier l'état d'un noeud dans le cluster (mysql disponible, intégré au cluster, synchro avec le cluster) pour assigner les VIP à la machine. Les VIP sont séparés niveau logique entre une pour l'écriture et l'autre pour la lecture. Pour définir le "rôle" d'un noeud, il suffit de créer des fichiers vide "RO" (lecture seule) ou "RW" (lecture/écriture) dans le dossier /etc/perconHa/. une fois placé en cron, le script fera le reste.

Il vérifie bien évidemment qu'une IP n'est pas déjà utilisée avant de l'assigner. Notez qu'il faut éditer le fichier pour y définir les informations relatives à la connexion à MySQL, les VIP ainsi que l'interface métier.

Conclusion

On a donc pu créer rapidement un cluster MySQL autonome, avec une haute disponibilité, une performance certaine mais liée au fine tuning du MySQL (qui se fait tout au long de la vie du cluster) et souple. La base présentée est simple, viable mais reste une base. La partie VIP par exemple serait mieux gérer via un load balancer qui serait plus réactif que la cron. Mais on peut réutiliser le script pour se faire. De la même manière, on pourrait superviser de manière plus fine la consommation en ressource du cluster.

11.6 : j'aurais dit 2 de tension

2013-03-12T15:38:58+01:00

Il y a de ces faits divers qui nous interpellent quand on les lit. C'est le cas du vol de Toni Musulin. Pour rappel, il a délesté son employer (un convoyeur de fonds) de près de 11,6 millions d'euros le 5 novembre 2009. Après une chasse à l'homme, il s'est naturellement rendu à la police et a été inculpé ... pour tentative d'escroquerie à l'assurance dans une autre affaire. Récit cinématographique du plus grand hold-up de l'histoire, n'ayant nécessité ni arme, ni blessé, ni otage. D'office, ne vous attendez pas à une tension insupportablement forte, ce n'est pas le nouvel Olivier Marchal.

Toni a trop de tensions

A l'occasion d'un Label du spectateur UGC, j'ai pu découvrir avec un peu d'avance le film 11.6 adaptant sur grand écran les aventures de Toni.

[video]http://www.youtube.com/watch?v=8Pwqv7jHv8E[/video]

Le fait divers était intéressant. Bien préparé, c'est comme à l'habitude le côté humain qui a failli. Toni avait préparé le fait de ne pas pouvoir récupérer tout l'argent stocké dans le garage et en a planqué une partie (2,5 millions) ailleurs. Pour le moment, ce reste d'argent reste introuvé. L'affaire avait eu pas mal d'écho du fait de la méthode mais aussi des conséquences, principalement pour son ex-employeur. Un vrai pieds de nez à une direction qui se croyait protégée. Cependant, à tord, beaucoup lui ont donné une pseudo renommée de Robin des Bois. Vraiment mal venu.

Du coup, quand la com' a commencé pour ce film, je me suis dit qu'ils allaient s'appuyer sur ce point humain, limite comique, pour présenter l'affaire sous un angle différent. Après tout, pas de feu d'artifice, pas de sang, pas de sexe ... Il faut bien trouver un moyen pour faire le spectacle.

Et là est le drame : on nous présente le film comme n'importe quel film policier français, nettoyé de tout spectacle. Le film en devient d'une platitude qui n'a d'égale que la mer baltique un matin d'été un peu frais. On enchaîne l'histoire telle que nous la raconterait Toni. Simple. Ennuyante. Plate. Dur de se lier à lui et de générer un lien affectif. Dur d'accepter la justification pour ses actes. Au final, le calme des montages dont il rêve ... On finit par nous l'imposer avec le peu de tension que le film apporte. Le seul point qui permet de sauver le film du naufrage ? Le jeu d'acteur, François Cluzet en tête, toujours aussi parfait.

Ce film aurait eu plus sa place un soir de semaine, en seconde partie de soirée, sur ARTE qu'au cinéma. Inutile de financer Toni Musulin via le billet de cinéma.

Restaurant Zagros : du méditerrannéen au Père Lachaise

2013-03-04T23:46:02+01:00

Après une petite marche au Père Lachaise, le ventre de l'orgre réclame son dû. Je descend Ménilmontant en misant sur une salade. Le restaurant visé est fermé. Un autre attire le regard : un gréco-kurde. Sûrement par méconnaissance, lorsqu'on me parle de cuisines grec et kurde, je suis très basique. Le vrai grec, des salades, de la fraîcheur. Le kurde, des grillades. Zagros, ton heure est venue ! Et comme on est deux pour le coup, on va d'autant pouvoir t'essayer.

Pas Zagros sur la patate

La terrasse est alléchante avec le soleil de ce dimanche. Mais la fraîcheur de l'hiver se rappelle rapidement à notre bon souvenir et nous pousse à l'intérieur. Là, un première salle de restaurant s'offre à nouveau. C'est clair. C'est propre. Des tapis a priori ancien tapissent les murs. Les tables chaleureuses. L'accueil tout autant. On s'installe, on prend la carte en main. On veut rester sage, donc une seule entrée qu'on se partagera suivi d'un plat par tête. Bon pas si sage, on commande un vin grec rosé pour accompagner.

Et là, un ballet de saveurs s'engage. Entre un vin jeune mais non pétillant, à la couleur cuivrée et au goût vert et fruité, l'assortiment de salades diverses et fraîches (et la féta, ...), ou encore les plats ... Le régal n'a d'égal que le coup de fourchette qui se fait presque délicat pour profiter de la dégustation de chaque bouchée. Les viandes grillées sont fondantes. Pas un assaisonnement de trop. Les légumes en papillottes enchantent les papilles. Mon seul bémol ? Je me forcerais à dire que la pomme de terre au four aurait pu être un poil plus cuite/grillée. Mais cette remarque est vraiment là pour chipotter. Les quantités sont parfaites, équilibrés. Ce n'est pas trop. Ce n'est pas trop peu. C'est juste ce qu'il fallait, même pour un orgre comme moi.

Repus et heureux du repas proposé, on ne peut refuser l'appel gourmand d'un dessert. Là, on se dit qu'on a vraiment été gourmand en voyant la générosité du dessert. Ca change des restaurants où l'on se mort les doigts au dessert. L'addition arrive alors, c'est dans la moyenne parisienne. Mais vu le repars, cela le vaut amplement. Rien que d'écrire ces quelques lignes et me souvenir de ce repas, je salive comme un chien devant un os tout frais. Et la qualité du service renforce l'envie de se rassoir à l'un de leurs tables.

Le 20e, que cela soit côté Belleville ou Père Lachaise, dispose vraiment de nombreuses perles culinaires à des tarifs abordables et c'est toujours un plaisir de pousser la porte de nouvelles tables à découvrir.

Die Hard 5 : yippie kay yay pauv' con

2013-03-04T21:00:45+01:00

Il y a de ces sagas, qui ont fait l'Histoire du cinéma. C'est le cas des aventures de John MacClane dans les différents Die Hard. Enfin ... Les trois premiers opus ont en tout cas marqués monumentalement le cinéma d'action avant de nous accablé d'un pittoyable quatrième Opus qui a blessé bien des amateurs mais surtout des geeks. Qui d'un cinquième opus ? Episode de trop ? Renouveau de la Saga ? John nous dit tout ...

Die Hard 5 : déception ou illusion

Avant d'aller voir ce film la semaine dernière, j'avais lu pas mal de critique, tellement la bande annonce me faisait peur. A chaque fois, même retour : très gros/bon spectacle la première moitié du film, dans le pure style Die Hard puis une seconde partie baclée. Je me dis alors que ca sera toujours mieux qu'aucune minute dans le pure style Die Hard.

[video]http://www.youtube.com/watch?v=gZR-DqSSGG0[/video]

Je pars, je m'arme du nécessaire pour ce genre film (dont des provisions), je m'installe, le film commence et là, c'est le drame. Mais où vous avez vu le pure style Die Hard ? Oui on prend les quatre précédents films (et malheureusement, le quatrième est trop présent), on mixe le tout au shaker, pas à la cuillère, et on obtient un film tout entier aberrant et qui ne respecte en rien la saga Die Hard.

Juste pour rappel, notre ami John est le genre de flic qui se retrouve au mauvais endroit au mauvais moment. Plus il fuit les emmerdes, plus il les trouve. Souvenez-vous les conduits de ventilations du Nakatomi Plaza ! Puis une fois dans la merde jusqu'au coup, il ne pouvait plus faire marche arrière. Même le quatrième film respectait au moins cette règle. Mais là, non ! Dès le début, John se montre volontaire : d'un pas bien assuré, il fonce tête bessée dans les emmerdes, quite à en générer sans réfléchir. Un vrai cowboy. On dit que la vieillesse rend sage ... Pour John, c'est le contraire.

Alors où, on bouffe pendant de la première moitié de film de l'action dont le scénario tient sur le fil du rasoir. Par contre, la réalisation, les faux raccords ... on est en pleine série Z. Rien que la course poursuite en voiture qui occupe une bonne partie de cette partie est hallucinante. On roule à contre sens sur les quais de la Moskva. On dégomme des voitures. Puis la seconde d'après, on est dans une artère qui déboule sur le même quai, en sens opposé du précédent passage, mais pour autant toujours à contre sens avec les mêmes voitures accidentées sur le bas côté. On remarque la même chose pour un semi qu'on croise une première fois au début, puis deux fois entre temps, pour finir la course encrée dedans. On a peu tourné selon la vidéo, mais le trafic automobile lui s'est téléporté d'un sens de la route à l'autre comme par magie. Voire à changer d'orientation sur la même voie. Bref ... Et le reste de la première moitié est du même accabit.

Puis, passé le coup de théatre à mi parcours, même le scénario devient baclé. Vu qu'on a déjà ruiné la moitié de Moscou (le palais de justice, les quais, les artères principales, un hôtel de luxe, et j'en passe, sans compter le tank, un superbe MI-24 et tout le feu d'artifice qui va avec ... Bah il fallait bien trouvé mieux à faire. Quoi de mieux de faire un second grand n'importe quoi directement à Tchernobyl ! En fait, je viens de tilter, mais le scénariste a du y aller pendant ses dernières vacances. Cela explique l'état de ses neurones.

J'ai honte pour John. Et même le passage de flambeau à Junior se fait dans notre douleur. Un supplice. Une honte à payer. Deux heures de ma vie irrémédiablement gâcher. Je crois que, mis à part Immortel où je m'étais endormi, je n'avais jamais ressenti ce tel sentiment de gâchi et de tristesse en sortant du cinéma. John (Moore) m'a tuer. John a pulvériser tous mes neurones. J'irais me réconforter seul devant les trois premiers. Yippie Kay Yay, pauv' con.

Les Misérables se font épiques

2013-02-08T12:05:37+01:00

Une petite avant-première intimiste chez Universal pour voir la nouvelle version des Misérables une semaine avant. C'est sympa. La prochaine fois, prévoyez le pot ou le popcorn, ca sera parfait. Trève de plaisanterie, nous voici avec une énième adaptation de l'oeuvre de Victor Hugo au cinéma. Nombre de versions sont trop lourdes car l'équipe voulait coller au livre. Quid de cette version remaniée en film musical ?

Les Misérables savent chanter

Alors oui, on parle de film musical et non de comédie musicale car, jusqu'à preuve du contraire, on ne rira pas puisque le sujet ne s'y prête pas. Tom Hooper reprend ici la version comédie musicale éponyme de 1980 et non pas directement le roman français.

[video]http://www.youtube.com/watch?v=IuEFm84s4oI[/video]

L'introduction, très théatrale, très épique, nous le rappelle d'ailleurs très bien. Dans cet opéra moderne, pas une personne ne s'exprimera sans chanter. D'ailleurs, point intéressant et à contre-pied de la quasi intégralité des films musicaux, les enregistrements des chants se sont fait durant le jeu d'acteur sur le plateau et non en décallé et en studio. Et là, on se rend vite compte que la les acteurs présents, même si peu son rompu au chant (Hugh Jackman, Amanda Seyfried par ex), ont un sacré talent à exprimer.

Chaque protagoniste, ou couple dans le cas des Thénardier, aura au moins un moment à lui pour exprimer ce talent. Entre chaque, les joutes chantées, les osmoses amoureuses virvoltantes et autres chorales révolutionnaires vont s'alterner au rythme de ce film de près de 3h.

Et là, on se rend d'autant plus compte du travail de toute l'équipe autour des acteurs : maquilleurs, musiciens, décors, ... tout vous fait oublier la durée et la lourdeur habituelle des adaptations du roman de Victor Hugo. Impossible de ne pas se refaire toutes les chansons à longueur d'heures, une fois sorti de la salle obscur. On en redemanderait presque. Presque car bon, pleurer, c'est pour les faibles. D'ailleurs, Kleenex est-il partenaire du film ? Si ce n'est pas le cas, ils ont loupé une belle opération de promotion.

Que dire, pas de louper notable. Juste des libertés prises liés au format (film musical, durée restreinte). Mais rien de choquant. Au final, cette adaptation se place avec la version de Lelouch de 95 avec Belmondo dans mes adaptations de coeur et que je revois avec plaisir.

Intégration d'un parc de machines Linux à un domaine Active Directory

2013-01-15T18:21:05+01:00

Dans un monde professionnel où les environnements informatiques sont de plus en plus hétérogènes, il est nécessaire de pouvoir centraliser les informations la gestion des comptes ainsi que les droits associés. Alors que la documentation d'intégration des Linux (ou Mac) à un annuaire LDAP est très documentée sur internet, les guides pour l'intégration à un Active Directory est quasi absente. Elle est pourtant de plus en plus requise ... et facile ! Des comptes unifiés pour tous les OS. Une gestion des comptes fines et centralisés est alors en place. Un sudo centralisé sur l'Active Directory implique un fichier /etc/sudoers obsolète.

Avant propos

Pour la suite différents points sont supposés acquis ou en place. Vous disposez d'un domaine Active Directory Windows 2008 R2 en place. Ici, nous l'appellerons integration.infra. Notez que les manipulations peuvent se faire à partir des versions Windows 2003 sans problème.

Les Linux sont des debian. Encore une fois, les packages sont disponibles pour toutes les grosses distributions, donc je vous laisse adapter.

Côté résolution DNS, les machines Linux doivent pouvoir déjà résoudre le domaine integration.infra :

dig +short integration.infra
192.168.101.1

Si ce n'est pas le cas, une petite modification du /etc/resolv.conf est à faire en rajoutant l'Active Directory :

echo nameserver 192.168.101.1 >> /etc/resolv.conf

L'intégration à l'Active Directory est simplfiée depuis l'arrivée de Likewise Open (maintenant appelé PowerBroker Identity Services). On supposera nos Linux comme étant en 64 bits.

Dernier point, on suppose avoir un compte ADMIN côté Windows avec les droits de rajout de machines.

Côté Active Directory

Pré-requis

Avant Windows 2008, il est nécessaire de rajouter les attributs Unix à l'Active Directory. Pour cela, il suffit d'installer le package Identity Management for UNIX.

Ensuite, nous devons rajouter un compte ldapquery : en effet, nous voulons centralisé la gestion des droits sudo et ceci ne peut se fait que via le protocole LDAP nativement embarqué dans l'AD. Pour cela, on ouvre Active Directory Users and Computers puis on clique droit sur Users puis New et User. On note le mot de passe.

NB : Il peut être intéressant de travailler en LDAPS plutôt qu'en LDAP. Je vous renvoie aux nombreuses documentations disponibles sur internet (ou à votre administrateur Windows) pour son activation.

Modification de l'Active Directory

Arrive alors la partie tricky : étendre le schéma Active Directory pour y intégrer le sudo. Le fichier de schéma est disponible sur vos Linux dans /usr/share/doc/sudo-ldap/schema.ActiveDirectory.gz mais également ici.

Pensez à l'éditer pour remplacer le dc=X par votre domaine (ici, dc=integration,dc.infra).

En ligne de commande, il ne reste alors qu'à taper :

ldifde -i -e schema.ActiveDirectory.txt -c "CN=Schema,CN=Configuration,DC=integration,DC=infra" #schemaNamingContext

Ceci va vous rajouter tous les attributs sudo (sudoHost, sudoUser, ...) ainsi que la classe sudoRole.

Création des groupes

Concernant sudo, une dernière manipulation est à faire : créer une OU sudoers"(via l'ADSI) puis la "peupler" avec des sudoRole comme vous le feriez avec le fichiers /etc/sudoers :

une ligne revient à un rôle
un rôle contient un ou plusieurs sudoHost
un rôle contient un ou plusieurs sudoUser en corrélation avec les groupes utilisateurs que nous souhaiterions
un rôle contient un ou plusieurs sudoOptions
un rôle contient un ou plusieurs sudoCommand
un rôle contient un ou plusieurs sudoRunAs (ALL à mettre par défault)

On peut alors créer les utilisateurs et groupes dont on aura besoin pour l'usage normal.

Côté Linux

L'ensemble des commandes s'enchaîne rapidement :

wget http://download.beyondtrust.com/PBISO/7.0.4/918/pbis-open-7.0.4.918.linux.x86_64.deb.sh
chmod +x pbis-open-7.0.4.918.linux.x86_64.deb.sh
./pbis-open-7.0.4.918.linux.x86_64.deb.sh
cd /opt/pbis/bin
./domainjoin-cli join integration.infra ADMIN
./domainjoin-cli configure --enable nsswitch
./domainjoin-cli configure --enable pam
./domainjoin-cli configure --enable ssh
./config HomeDirTemplate %H/%D/%U
./config AssumeDefaultDomain true
./config LoginShellTemplate /bin/bash
aptitude install nslcd sudo-ldap
grep bind /etc/nslcd.conf >> /etc/ldap/ldap.conf
echo "sudoers_base ou=sudoers,dc=integration,dc=infra" >> /etc/ldap/ldap.conf
ln -s /etc/ldap/ldap.conf /etc/sudo-ldap.conf

Pour l'installation de nslcd, préciser la bonne URI mais surtout le compte ldapquery.

Pour ceux qui voudrait automatiser l'installation (via Fabric par exemple), le déroulement du script de PBIS requiert l'utilisation d'expect :

aptitude install expect tcl8.5
echo < EOF > /opt/install_pbis.sh
#!/bin/bash
VAR=$(expect -c "
spawn sh pbis-open-7.0.4.918.linux.x86_64.deb.sh --confirm
expect {
Y/n { send \"y\r\"; exp_continue }
Y/n { send \"y\r\"; exp_continue }
yes/no { send \"yes\r\"; exp_continue }
yes/no { send \"yes\r\"; exp_continue }
}
exit
")
EOF
chmod +x /opt/install_pbis.sh

L'installation et le déploiement s'en trouvera grandement faciliter. Petite subtilité à prévoir : l'obligation de reboot les Linux pour une intégration propre de l'authentification Active Directory en local à la machine.

2013 - New Year's Party Mix

2013-01-10T15:35:15+01:00

The American Dream, mon cauchemar culinaire

2013-01-09T10:18:45+01:00

Hier soir, c'était repas de début d'année avec deux anciens collègues. Pour faire léger, on a choisi un restaurant que je n'avais jamais osé testé vu ce qui j'ai vu voir et surtout ce que l'extérieur me laissait penser. Bienvenu dans mon cauchemard culinaire à l'American Dream (21 rue Daunou, Paris 2e).

American look

Je dirais plutôt American Museum. De l'extérieur, les murs ont l'apparence d'une vierge auberge repeinte avec une tripotée de statue d'acteur en situation, façon Planet Hollywood. L'intérieur, est un mix entre un pub anglais, une brasserie parisienne et un restaurant "à l'américaine". La carte, pardon, le livre du menu devrais-je dire, vu son nombre de page, alterne pages de menu et photo-montages pour nous faire croire que le restaurant est sponsorisé par les stars d'Hollywood. Mais bon, autant le patron de Planet Hollywood a pu sortir le carnet de chèques pour les faire venir, autant là, ce n'est pas le cas. Bref, l'ambiance appelle clairement au piège à touriste.

American beurk

Passons l'accueil qui nous fait penser qu'on pourrait être bien servi, le service en lui-même laisse à désirer. On nous bazarde la carte sur la table à peine dressée. Aucune carafe d'eau disponible, on pourrait rouiller. Surtout vu le prix de la conso (4,5€ le petit verre de Coca, 12€ minimum la pinte de bière - et quelle bière ... - ), on se souvient que le manque d'hydratation a le même résultat que l'alcool sur le cerveau.

On prend alors le temps de lire le roman qui sert de menu. Des burgers. Des bagels. Des omelettes. Des pizzas. Des sushis. De tout pour tous. Mais comme on dit "trop de choix, tue le choix". Notre côté macho se rappelle à nous lorsque nous voyons le plat "Cheeseburger Tower" avec 6 steaks, accompagné de frites et oignons rings. Laissons nous tenter. Pour faire court, on n'aurait pas dû !

Première désillusion au service, sur les six steaks, quatres sont réellement présents, les deux autres remplacés par du pain. La garniture, moyenne. Les sauces absentes (normale : la sauce supplémentaire est facturée 5,50 € ! ). La seconde vient au fur et à mesure de l'ingurgitation. Plus on descend dans les couches plus le burger se transforme. De haut en bas, la viande devient toujours moins cuite alors que le pain devient plus grillé. Un cauchemar gustatif.

L'accompagnement n'est pas tellement mieux. Les frites allumettes sont des éponges à huiles. Même le McDo n'arrive pas à les imbiber autant. Les oignons rings ont perdu une bonne parti de la chapelure (à moins que ca aussi ca soit un supplément sur taxé ? ). Et grand mal vous prendrait de vouloir changer un des accompagnement : 4€ par changement ! Nul question de rajout par contre ...

Ecoeurés, nous ne tentons pas les desserts qui laissent présager le pire. D'ailleurs, à 8 ou 9 € le café gourmand ... D'ailleurs il n'a de gourmand que le tarif, le café n'étant accompagné que d'un pauvre petit muffin ou donut ...

J'en suis sorti en louant mes regretés tickets restos lâchés sur la table pour payer cette addition honteuse. A la limite du racket. Ce matin, mon estomac vient à me rappeler que mes tickets auraient été plus que mieux utilisés ailleurs. Il n'y a pas de mot. Adresse à fuir. Information à faire connaître. Guide touristique à prévenir. L'American Dream de Paris est LE lieu où l'on mange le plus mal à Paris avec un tarif exhorbitant. Mais que fait le Président ? L'a-t-on prévenu ?

Création d'une plateforme anti-ddos modulaire

2013-01-04T14:00:25+01:00

Q'est-ce qu'un DDoS ? Que faire en cas de DDoS ? Comment se protéger ? Ce sont là des questions récurrentes ces temps-ci sur internet. Je vais exposer dans le présent article une solution pour se prémunir un minimum avec une architecture modulaire. L'exemple se focalisera sur les services HTTP.

Avant-propos

Un DDoS, pour faire simple, se rapporte à une attaque de type déni de service distribué. En gros, l'attaquant cherche à rendre votre service (site web, serveur mail, platefome complète...) indisponible grâce à plusieurs outils déployés sur PC zombies lancés à vos dépends en parallèle. Plus il y a d'armes (PC zombies), plus l'attaque prend de l'ampleur. De base, pour déjouer ces attaques, c'est un peu le jeu de qui a la plus grosse. Reste qu'on peut se prémunir de pas mal de chose, sans passer pour autant par des solutions (trop) honéreuses de type Arbor Networks.

On n'est pas tous milliardaires (ou du moins, pas encore). On ne peut pas tous investir dans ces solutions ni payer le tuyaux nécessaire pour jouer à qui a la plus grosse. Mais on doit se protéger. L'idée principale de cet article, réside donc dans la différence entre les notions de DoS et de DDoS, à savoir, le distributed. On cherche donc à se rapprocher autant que possible d'un DoS en segmentant l'attaque puis on travaille sur ces réductions en fonction du protocole.

Dans la suite, nous discutons de flux HTTP. Donc on filtre au niveau réseau avec du firewall puis on analyse la partie HTTP avec un WAF et on réduit les connexions au serveur client (le backend) avec une plateforme de Caching. Chaque fonction est isolée sur une brique indépendante des autres qu'on peut remplacer ou supprimer en fonction de l'usage qu'on veut avoir.

Je resterais assez succint sur la mise en place de certaines fonctionnalités avancées, sur l'évolutivité ou encore sur la centralisation des informations, ayant livré un produit un peu plus complet il y a peu.

L'architecture est dans le Cloud : pourquoi ? parce que la virtualisation offre la souplesse nécessaire à ce type d'architecture et qu'on pourra voir dans de potentielles évolutions, à définir des règles au niveau DNS pour isoler des régions géographiques sur tel ou tel fournisseur sans impacter les autres datacenter virtuel.

Spécificités de la plateforme

La plateforme est découpée en "colonne". Toutes les colonnes sont équivalentes à la base. On essaie d'isoler une colonne par opérateur. A l'intérieur de chaque colonne, on aura une "ligne" de fonction composée d'autant de serveur de chaque type appelé "brique". Dans le cas de l'article, une colonne HTTP contient trois lignes d'un seul serveur à chaque fois :

firewall
WAF (Web Application Firewall)
Caching

J'ai rédigé cet article et les scripts liés de manière spécifique au serveur OVH. Des adaptations sont à prévoir pour d'autres mais dans l'absolu, tout devrait être fonctionnel tel quel. Chaque brique est en soit une machine virtuelle (dans le cas présent, une Debian Squeeze) avec des ressources affectées en fonction de vos besoins et moyens. Ici, 2 core et 8 Go de Ram à chaque fois. On y copie importe l'arborescence de deploiement qui va bien, on lance le script, et rouler jeunesse.

Au niveau réseau, on sépare la partie management de la partie service.

Le serveur VMware ESXi 5.0 n'a de base qu'une IP de management. On restreint ces services de management aux seules IP qui s'y connecteront : votre bureau.

Ensuite, vient le cas des différentes VIP qu'on demande à OVH :

3 pour les services publiques (dont la première servira aussi pour le VPN
1 pour le honeypot
1 pour la communication du caching avec le backend

Entre eux, chaque niveau communique sur un VLAN spécifique.

Enfin, chaque serveur a une patte de management sur un réseau privé, utilisable exclusivement via le serveur de VPN.

Le comportement est simple : lorsqu'un client se veut se connecter à la plateforme protégée, il le fait via une requête HTTP sur un fqdn précis. Ce fqdn est un alias vers un catch-all DNS de notre service de protection. Ce catch-all correspond à un gros Round Robin DNS vers les différentes VIP. C'est le point qui génère la segmentation. Plus de VIP seront disponible, plus la segmentation sera importante. L'attaquant visera soir le fqdn et donc toutes les VIP, se qui va répartir ses PC zombies, soit les différentes VIP, mais lui même devra avoir assez de PC zombies sous la main.

Le firewall entame alors son petit travail : analyser les paquets. Ici on reste basique avec un lot de règles iptables. On pourrait y greffer à la limite un IPS pour compléter la brique. Les règles sont de deux types :

basique : pré enregistrées au démarrage du service
dynamique : générée par les outils de bannissement

Les règles basiques correspondent à des règles de "bonne usage" contre les DoS classiques. Les règles dynamiques sont produites soit à la main, soit par l'ensemble du service : détection des scans de port, fail2ban, ... Peu importe quelle brique détecte une IP à bannir, celle-ci le sera au niveau du firewall. De plus, le bannissement se fait via un TARPIT pour la partie TCP et un DROP pour le reste.

Les scripts qui suivront sont issues de la première version du PoC. Certains points sont à faire évoluer mais la base est présente.

Le firewall

Au début je pensais utiliser une BSD avec du pf. Mais je me suis ravisé : pf ne permet pas la partie TARPIT qui est tout de même bien sympathique. Qu'est-ce que TARPIT ? C'est un redimensionnement de la fenêtre TCP à 0. Ou de manière plus imagée, c'est le pendant d'un SYN Flood côté défense. On ne renvoie pas l'ACK à un client mais on tue sa requête. Le résultat est d'engorger progressivement sa pile TCP. Le tout proportionnellement à l'ampleur de l'attaque.

Le firewall portent donc trois VIP de service. Chaque voit son port 80 poussé vers le WAF. La première voit en plus un port poussé vers le VPN. Ici, le 3006/tcp.

A côté de cela, pour garder une certaine dynamique dans les règles iptables, on ne bloque pas tout. Juste quelques attaques de type DoS standard. Le reste, on fera du préventif ou cas par cas.

Du coup, portsentry est utilisé pour détecter les scans de ports et déclencher le bamnissement.

On y installe aussi un honeypot qui simule un serveur Windows bien ouvert sur la 4e VIP. Toute tentative de connexion dessus sera détectée dans les logs par un fail2ban qui déclenchera le bannissement.

Enfin, quelques paramétrages fins sont à faire spécifiquement sur le firewall :

# Tuning automatique de la fenêtre TCP
net.ipv4.tcp_moderate_rcvbuf=1
# Communication entre les différents noeuds pour notifier d'un engorgement (RFC 3168)
net.ipv4.tcp_ecn=0
# Désactive le discover automatique du MTU
net.ipv4.ip_no_pmtu_disc=0
# On désactive le démarrage lent d'une nouvelle connexion qui a déjà ouvert une session HTTP
net.ipv4.tcp_slow_start_after_idle=0
# On bloque les requêtes de type ICMP echo en broadcast
net.ipv4.icmp_echo_ignore_broadcasts=1
# On préfère traiter toutes les requêtes TCP afin de peupler les règles iptables
net.ipv4.tcp_abort_on_overflow = 1
# C'est l'arme contre les SYN FLOOD : une connexion n'est gardée en mémoire que si le serveur a reçu l'ACK
net.ipv4.tcp_syncookies = 1
# On ne laisse pas retenter un paquet TCP
net.ipv4.tcp_orphan_retries = 0
# Simple réduction de taille du paquet TCP en y mettant pas le champ time - moins de charge CPU
net.ipv4.tcp_timestamps = 0
# Active les acknoledge selectif : on ne répond pas à tous - pour de la perf, pour pourrait le mettre à 0
net.ipv4.tcp_sack = 1
# Tuning de la fenêtre TCP - on est restrictif
net.ipv4.tcp_window_scaling = 1

D'autres paramètres plus globaux sont initialisés également.

Le WAF

Le WAF est donc le firewall applicatif. En gros, c'est une brique HTTP permettant d'analyser les requêtes et générer un comportement sécuritaire spécifique. On peut utiliser du mod_security (qui existe aussi pour nginx maintenant) ou du naxsi. La grosse différence, le premier fonctionne à coup de blacklist statiques, le second fonctionne à coup de whitelist et de blacklist générée lors d'un mode d'apprentissage.

Lorsqu'un client HTTP est connecté et a un comportement suspicieux, on aura la joie d'avoir une ligne dans les logs correspondants. En interfaçant avec fail2ban et le script qui va bien, on pourra déclarer l'IP de ce client au firewall qui la bannira.

N'oubliez pas de déclarer les VIP sur la loopback.

Le caching

J'ai déjà eu l'occasion de rédiger différents articles sur le caching (création et comparaison). Ici le but est juste de mettre une brique rapidement en place pour démontrer le fonctionnement.

On reprend donc un nginx configuré pour le caching. La spécificité de cette brique est qu'elle sort directement sur internet via son IP publique (donc sans repasser par le firewall, contrairement aux autres briques).

Au niveau sécurité de la patte publique, on bloque tout à coup de TARPIT/DROP par défaut sur celle-ci.

Conclusion

L'ensemble des scripts est disponible sur mon github. La commande magique deploy se charge d'installer et configurer les différents points pour un rôle donné.

La commande de management ddos permet déjà quelques outils. Elle est à lancer avec un compte nommé sysadmin à qui on réduira les possibilité via sudo. Le compte root est bloqué pour le SSH.

N'oubliez pas que ceci est un PoC et doit donc servir de base. Il est utilisable quasiment tel quel mais il serait mieux d'avoir un niveau suffisant pour l'adapter et l'améliorer.

Imaginez une centralisation des informations, un back office, une mutualisation des firewall pour différents protocoles, des tunnels GRE entre vous et les plateformes cibles, un TARPIT directement intégré au SMTP (cf BSD), ...

Dans tous les cas, voici une idée du résultat au niveau filtrage :

Complément Redis en haute disponibilité

2012-12-28T13:58:43+01:00

Pour ceux qui seraient intéressés, j'ai mis en place un repository GitHub concernant le déploiement de Redis 2.6 en haute disponibilité. Vous y trouverez :

configuration Redis Server
configuration Redis Sentinel
script d'init (Debian/Ubuntu) Redis Server
script d'init (Debian/Ubuntu) Redis Sentinel
plugin Nagios (check_redis) qui gère l'usage d'un mot de passe

Infrastructure Redis en haute disponibilité

2012-12-14T16:33:29+01:00

A l'heure où tout devient "connecté", "disponible en ligne", les échanges par l'internet se multiplient. Pour accompagner la démocratisation des liens rapides mais également pour améliorer l'expérience cliente, il est nécessaire que les fournisseurs de service en ligne optimisent leurs applications et la manière dont ils les livrent. Bien sûr, on peut toujours augmenter les ressources matériels, mais le coût n'est pas négligeable. Parfois, les développeurs peuvent travailler main dans la main avec les administrateurs. C'est le cas de l'utilisation des caches applicatifs (Memcached,Couchbase, Redis...).

Avant-propos

Redis, dans la version stable actuelle (2.6) n'offre aucune fonctionnalité de mise en cluster comme Couchbase. Je ne parle pas non plus de l'absence totale d'organes de sécurité. Le but est clairement énoncé : la PER-FOR-MANCE.

Du coup, peu de solution pour la haute disponibilité si ce n'est mettre en place une architecture type maître/esclave avec une promotion automatique de l'esclave en tant que maître en cas de défaillance du premier. Nous allons voir cette mise en place puis tant qu'à faire, sa supervision.

Installation de l'infrastructure Redis

On suppose pré-installés deux serveurs Debian Squeeze 64 bit. Notez que la version disponible de Redis dans les repositories officiels est une vieille 1.2.6 et que seule la branche 2.4 est disponible dans les backports. Traduction : nous allons être obligés de tout compiler à la main.

Pour cela, quelques pré-requis à installer :

aptitude install build-essential tcl8.5 pwgen

Le package tcl8.5 est là pour vous permettre d'effectuer quelques tests au besoin lors de la séance de compilation. Nous pouvons alors nous attaquer à Redis :

cd /usr/src
wget http://redis.googlecode.com/files/redis-2.6.7.tar.gz
tar -xzf redis-2.6.7.tar.gz
rm redis-2.6.7.tar.gz
cd redis-2.6.7
make
make install
useradd redis
mkdir /opt/redis
chown redis:redis /opt/redis
chmod 770 /opt/redis

Configuration Redis

Je vous met à disposition un fichier un peu préparer, ici. Cependant, quelques modifications sont à prévoir.

wget http://cdn.aichelbaum.com/files/r/redis.conf -O /etc/redis.conf

Dans le cas que je présente ici, je bind l'application sur toutes les interfaces car les serveurs Redis sont sur un VLAN précis et isolé. Au besoin, on peut simplement l'isoler sur une IP en rajoutant dans la configuration un :

bind X.X.X.X

Il s'agit également de traitement en temps réel mais donc j'ai besoin d'avoir un maximum de garanties sur la pérennité des informations stockées, je sauvegarde toutes les 60 secondes s'il y a eu au moins une modification en base.

Redis a (trop) peu de sécurité. Cependant, autant mettre au moins un mot de passe pour la réplication. Pour se faire, on va en générer un propre avec pwgen :

pwgen -s -y 16

Il est à renseigner à la ligne commençant par masterauth. On réutilise le même mot dfe passe pour le champ requirepass.

Autre point important à modifier dans la configuration : la taille de la mémoire allouée à Redis. Dans mon exemple :

maxmemory 512mb

On peut aussi la passer à 8 Go par exemple :

maxmemory 8gb

Penser également à rajouter la ligne suivante dans votre /etc/security/limits.conf :

redis - nofile 20000

Redis nécessite un rajout à sysctl :

cat < EOF >> /etc/sysctl.conf 
vm.overcommit_memory=1
net.ipv4.conf.eth0.arp_ignore = 1
net.ipv4.conf.eth1.arp_ignore = 1
net.ipv4.conf.eth0.arp_announce = 2
net.ipv4.conf.eth1.arp_announce = 2
EOF
sysctl -p

Mise en place de la réplication

On a donc installé deux serveurs. On suppose leurs noms et IP :

redis01 - 192.168.1.1
redis02 - 192.168.1.2

On veut que redis02 soit esclave de redis01 :

sed -i "s/# slaveof <masterip> <masterport>/# slaveof <masterip> <masterport>\n#slaveof 192.168.1.1 6379/" /etc/redis.conf

Mais aussi l'inverse pour que redis01 devienne automatiquement esclave de redis01 en cas de failover :

sed -i "s/# slaveof <masterip> <masterport>/# slaveof <masterip> <masterport>\n#slaveof 192.168.1.2 6379/" /etc/redis.conf

Mise en place du failover Redis

On va entre s'appuyer sur redis-sentinel qui est une solution permettant de gérer facilement le failover entre les serveurs.

cp /usr/src/redis-2.6.7/src/redis-sentinel /usr/local/bin/redis-sentinel

Plus qu'à importer la configuration (et l'adapter avec vos IP et mots de passe) :

wget http://cdn.aichelbaum.com/files/s/sentinel.conf -O /etc/sentinel.conf

Petite précision : sentinel gère le failover, pas le fallback automatique. Il faut donc que l'ancien maître (redis01) devienne un esclave du nouvellement promu (redis02).

Pensez à installer un 3e sentinel sur le serveur de supervision avec les mêmes informations. Il vous permettra d'avoir un quorum de 2 sur les 3 sentinels possibles, très utile en cas de split-brain (chaque serveur est UP & Running mais ne voit plus son voisin).

On n'avait pas encore les fichiers d'init donc on va les mettre en place avec l'intelligence. J'ai préparé deux scripts d'init pour le coup

wget http://cdn.aichelbaum.com/files/r/redis-server.init -O /etc/init.d/redis-server
wget http://cdn.aichelbaum.com/files/r/redis-sentinel.init -O /etc/init.d/redis-sentinel
chmod +x /etc/init.d/redis-se*
update-rc.d redis-sentinel defaults
update-rc.d redis-server defaults
insserv redis-sentinel
insserv redis-server

Load balancing

On va gérer l'IP flottante permettant de n'accéder qu'au maître (pour fonctionner en actif/passif) avec un bête script. Pourquoi bête ? parce que le mode de fonctionnement ne requière pas l'installation d'une usine à gaz et qu'on a un simple cron qui peut faire le boulot. Pensez juste à éditer l'IP mise pour la VIP.

wget http://cdn.aichelbaum.com/files/r/redis-vip.sh -O /usr/local/bin/redis-vip.sh
chmod +x /usr/local/bin/redis-vip.sh
echo "* * * * * /usr/local/bin/redis-vip.sh &> /dev/null" > /etc/cron.d/redis-vip

Supervision Nagios pour Redis

On va s'appuyer sur un plugin existant : check_redis. Il permet aussi bien de superviser l'instance Redis en elle-même, que la réplication. Pour cela, il demande au serveur son rôle dans la réplication et dans le cas d'un esclave (slave) son status.

Rien de particulier pour l'installation en soit. Le plugin est vraiment standard :

Usage: check_redis -H HOSTNAME -p PORT -c CRITICAL -w WARNING -t TIMEOUT (-P PASSWORD)

Par contre, il faut également superviser les sentinels. Au choix : un check_tcp sur le port 26379 ou vérifier en NRPE ou SNMP le status du service redis-sentinel.

Partager des mots de passe en sécurité

2012-12-12T15:27:42+01:00

Voici un problème récurrent avec les allers et venues dans les sociétés. Comment partager les mots de passe d'une plateforme, la maintenir de tout changement, et éviter les fuites d'informations ?

Certains choisissent d'avoir un mot de passe unique ... C'est mal.

D'autres préconisent d'avoir un mot de passe avec une partie mémotechnique variable (liée par exemple, au nom du serveur). C'est prédictible donc c'est mal.

Certains reposent sur une centralisation des identifiants (avec un LDAP ou un Active Directory) et se partagent les informations via des fichiers type KeePassX. On se rapproche de quelque chose. Cependant, subsiste le problème d'accès à la base et de son maintient.

On va avancer sur cette solution et voir à la fiabiliser.

Avant propos

Juste quelques rappels avant d'exposer quelques bonnes méthodes à appliquer à cette solution.

A chaque mouvement de personnel, il faut révoquer les accès de l'utilisateur, et modifier les accès administrateurs sur les différents serveurs/services. La centralisation des comptes et le maintient d'une base d'information prend tout son sens.

Chaque modification sur la base nécessite d'être conservé (trace de la modification et conservation d'un historique des mots de passe à la rigueur).

Je ne traiterais pas de la centralisation des comptes. Guillaume Vaillant vous propose un billet sur le sujet orienté LDAP et je verrais peut-être à en rédiger un orienté Active Directory sous peu.

Sécuriser la donnée

On va se baser sur l'outil KeePass 2 (avec le plugin IOProtocolExt). Ce logiciel permet de sauvegarder les différents mots de passe dans une base encrypté (en AES256 de base). Le plugin quant à lui permet de centraliser la base sur un serveur SFTP.

Installer une distribution Linux ne doit pas être top un problème, donc on passe. Installer un serveur SSH, aussi.

On modifie les utilisateurs concernés par l'accès à la base en les affectant à un groupe dédié :

groupadd keepass
gpasswd -a francois keepass

Ensuite, on crée un dossier, et on le prépare au niveau des droits et ACL (on pense à installer le package acl) :

mkdir /home/keepass
chgrp keepass /home/keepass
chmod 070 /home/keepass
chmod g+s /home/keepass
setfacl -Rmd g:keepass:rwx /home/keepass

On rajoute le logging des actions en SFTP en éditant le fichier /etc/ssh/sshd_config puis en relançant le service ssh :

sed -i '^Subsystem sftp /usr/lib/openssh/sftp-server^Subsystem sftp /usr/lib/openssh/sftp-server -l INFO^' /etc/ssh/sshd_config
/etc/init.d/ssh reload

Installer KeePass 2

Sur Windows

Pour une fois, au grand dam des trolleurs du vendredi, ce sont aux amis de Windows qui s'en sortent le plus facilement. Une simple installation en clic-next fait son affaire. Concernant le plugin, on copie les fichiers dans le dossier d'installation de KeePass et on relance l'application.

Sur Linux

Bien que des packages soient disponibles pour les distributions majeurs, le plugin pour le SFTP utilisent des classes .NET non disponibles sur Mono. Obligé de passer par Wine. On part d'un préfixe wine vierge :

cd ~
winetricks dotnet40
wine Downloads//KeePass-2.20.1-Setup.exe

On copiera là encore les fichiers de plugin dans le dossier qui va bien.

SUR MAC OS X

Même problème que sur Linux. Même solution : wine. Il faut donc installer MacPorts puis wine :

sudo port install wine
cd ~
winetricks dotnet40
wine KeePass-2.20.1-Setup.exe

On copiera là encore les fichiers de plugin dans le dossier qui va bien.

Générer la donnée

Il faut bien initialiser la base. On a donc installé KeePass 2. On crée une nouvelle base. On la sauvegarde. On la transfert en scp sur le serveur dans le bon dossier (avec WinSCP, FileZilla, ssh, ...). Pour sécuriser la base, on va utiliser un master key sous la forme d'un fichier générer par l'entropie de la souris. On garde le fichier dans un coin.

On supposera que la base s'appelle base.kdbx et la clé base.key.

Accéder à la donnée

La partie simplissime : File > Open > Open URL. On renseigne les informations :

URL : sftp://ip/home/keepass/base.kbdx
user name : votre identifiant
password : votre mot de passe (il n'y a pas de gestion par clé pour le moment)

Le fichier sera chargé automatiquement.

Mise à jour de la donnée

La modification des informations se fait simplement en sauvegardant (File > Save – et non File > Save As).

Il est intéressant de sauvegarder une copie locale pour des raisons de mobilité par exemple ou d'indispo du serveur. Pour se faire : File > Save As > Save copy to file

La gestion des mises à jour par plusieurs utilisateurs et des risques de conflit se fait de la manière suivante :

Les mises à jours se font seulement sur les entrées modifiées ; KeePass 2 se base principalement sur la date de modification
Quand l’utilisateur A sauvegarde ses modifications sur le serveur, il récupère au même moment les mises à jour des autres utilisateurs
S’il y a un conflit (A et B mettent à jours la même entrée en base), l’entrée la plus récente sera conservée (date de modification prise en compte)
Le serveur prévient et demande une confirmation de l’action à mener au moment de la sauvegarde

Derniers points

Pensez à transmettre le master key aux bons utilisateurs.

Pensez à mettre à jour régulièrement la master key surtout lors des départs d'utilisateurs.

Ne déposez pas la base sur des partages publiques, même si elle est encryptée (GDrive, DropBox, ...).

Ne transmettez pas la master key par email (surtout jointe avec les informations "vitales").

Optimiser les images de son site

2012-11-27T12:36:42+01:00

Pourquoi optimiser les images de son site ? Tout simplement, parce que cela a son importance pour le référencement mais aussi et surtout pour l'expérience utilisateur. Après tout, un site web est fait pour être consulté donc autant que l'expérience utilisateur soit la meilleure possible.

La bonne taille de l'image

Première erreur fréquemment rencontrée, la taille de l'image inadaptée. Régulièrement, on peut tomber soit sur une image agrandie (et donc pixélisée), soit sur une image réduite.

Dans le premier cas, l'image est moche, l'expérience utilisateur dégradée car l'internaute reste critique dans l'âme et ne reviendra pas si le site n'est pas un minimum agréable. Seule solution : trouver la même image dans le bon format ou a fortiori dans un format bien supérieur (cf ci-dessous).

Dans le second cas, on garde ce format "géant" sur notre PC et on prépare des versions adaptée grâce à notre logiciel d'image favori (The Gimp par exemple). Ainsi, transférer le fichier image au bon format et à la bonne résolution aura plusieurs impacts :

réduire la quantité de données à envoyer au navigateur de votre visiteur (donc le site s'affiche plus vite)
moins de travail pour le navigateur de votre visiteur (le site s'affiche plus vite et consomme moins de ressources)
l'image sera agréable à regarder
la variété des formats pour une image sur le site augmente indirectement le contenu à référencer sur le site et donc améliore le référencement du site

Dans tous les cas, l'expérience utilisateur s'améliore nettement.

Combiner les images via des CSS Sprites

Parfois, vous aller avoir tout un semble de petits logos/icônes sur une même page et qui reviennent régulièrement sur votre site. Il est alors intéressant de combiner toutes ces images dans un seul fichier, qui sera importé et "découpé" par CSS.

Pour combiner les images, si vous ne travailler par directement sur le format unifié, vous pouvez le faire via ImageMagick.

aptitude -y install imagemagick

Ensuite, pour combiner des images au format JPEG par ex :

convert image1.jpg image2.jpg image3.jpg +append -quality 75 combine.jpg"

Il est possible de le faire pour d'autres formats image. ImageMagick est vraiment une belle boite à outil pour le traitement image.

On peut alors intégré dans le CSS ainsi (extrait du CSS de mon blog) :

#wp-social-login-connect-options a.Tumblr {
 display:block;
 float:left;
 height:32px;
 width:32px;
 margin:0px;
 text-indent:-9999px;
 background-image:url('https://cdn.aichelbaum.com/images/S/sprites.png');
 background-position:-256px 0px;
}

#wp-social-login-connect-options a.Mixi {
 display:block;
 float:left;
 height:32px;
 width:32px;
 margin:0px;
 text-indent:-9999px;
 background-image:url('https://cdn.aichelbaum.com/images/S/sprites.png');
 background-position:-288px 0px;
}

#wp-social-login-connect-options a.Steam {
 display:block;
 float:left;
 height:32px;
 width:32px;
 margin:0px;
 text-indent:-9999px;
 background-image:url('https://cdn.aichelbaum.com/images/S/sprites.png');
 background-position:-320px 0px;
}

On ne transfert donc plus qu'une seule image, plutôt petite, et on repositionne et redimensionne l'affichage de la cellule au style demandé. Encore une fois, on réduit la quantité de données à envoyer au navigateur de votre visiteur. Son expérience s'améliore encore.

Optimiser les images

Aujourd'hui, les images, que cela soit en JPEG ou en PNG, embarque énormément d'infomations. Limite de la pollution dans certains cas. Des outils existent et permettent de nettoyer tout cela automatiquement : optipng et jpegoptim :

aptitude -y install optipng jpegoptim

Pour les utiliser d'un coup et simplement (voire les mettre dans une cron), un petit script :

cat > /usr/local/bin/optimage.sh << EOF
#!/bin/bash
find $1 -name "*.jpg" -exec jpegoptim --strip-all {} \; | grep -v skipped
find $1 -name "*.png" -exec optipng -o 7 {} \; 2> /dev/null
exit 0
EOF

Du coup à l'usage, il suffit d'appeler le script avec en paramètre le dossier parent à traiter récursivement puis le tour est joué.

Les fichiers gagnent encore en taille etc etc.

Le site est toujours plus performant. L'utilisateur apprécit et revient. Le référencement s'amliore

Skyfall : le paradoxe du grand père façon James Bond

2012-10-29T12:24:23+01:00

James Bond est l'une des sagas qui m'a le plus bercé depuis mes débuts de spectateurs. Ces longues soirées d'hiver à regarde le flegme britannique donner une leçon à ces vils espions russes ou ces escrocs en col blanc. Malheureusement, ce flegme britannique a pris un gros coup à deux reprises. Une touche trop américaine avec le style de Timothy Dalton. Une touche trop russe avec le style de Daniel Craig. Dès que je le vois, je repense à l'espion soviétique de Bon baiser de Russie. Bref, Skyfall est sorti vendredi donc obligation de le voir ... puis de le critiquer

Le paradoxe de James Bond

Les épisodes 21 et 22 marquait un retour dans en arrière compliqué pour l'espion anglais. Il fallait revenir aux origines du personnes, tout en avançant dans le temps pour coller à la modernité de l'actualité. Compliqué mais pas impossible, jusqu'au moment où le lien devait être fait avec le reste de la saga. C'est le but de Skyfall.

[video]http://www.youtube.com/watch?v=6kw1UVovByw[/video]

Comment revenir sur l'origine de l'espion, de son univers, et continuer d'avancer ? Tout simplement en programmant une destruction globale de l'existant (MI6, M, ...) pour repartir sur de nouvelles bases. Le film se charge donc de détruire le magnifique QG (réel) du MI6 pour le remplacer par les sous terrains de Churchill. "M" est mise sur le pilori pour annoncer son futur remplacement dès le début du film. Et Moneypenny fait enfin son apparition, justifiant au passage le petit jeu de séduction entre elle et Bond. Peu de gadget dans cet opus si ce n'est une petite balise radio old-school mais miniature de la part du nouveau Q.

Là où ce James Bond échoue lamentablement ? L'ennemi. Ce n'est plus la mode aux magnats de la finance (bah oui, c'est l'heure de la crise donc on ne va pas taper sur la production). Et alors qu'un retour aux luttes contre l'armée rouge aurait été bienvenu, on ne nous annonce un ennemi bien pire : un renegat anglais ... qui n'a rien d'anglais. Après tout, on n'a bien un espion soviet pour camper le rôle du plus anglais des espions. Alors on n'est plus à ca près. Et encore, je ne vous dit pas les crises de fous rires qui s'annoncent en regardant le jeu d'acteur de Javier Bardem.

Par contre, comme bien souvent, la bande originale est magnifique. Signée Adèle, s'il vous plaît (et il vous plaira).

[video]http://www.youtube.com/watch?v=7HKoqNJtMTQ[/video]

Cette douceur ne suffira malheureusement pas à masquer la violence et le côté américain du film. On frappe. On tue. Et s'il y a des survivants on se pose des questions. Les James Bond girls sont là, mais au final, bien trop transparentes. Où sont donc passées les bases des bons vieux James Bond ? Réponse, espérons-le, au prochain opus. Pour le coup, j'ai bien failli m'endormir.

Astérix et Obélix : Au service de Sa Majesté

2012-10-29T11:48:49+01:00

Ah, les aventures d'Astérix et Obélix. Toujours un grand moment de lecture que l'on soit jeune ou moins jeune. Par contre, pour ce qui est des adaptions cinémas "live", c'est une autre histoire. Sur trois films, un seul tire son épingle du jeu (Mission Cléopatre) et mérite d'être vu : il faut dire que la bande à Chabat est une arme de rire massive. Quid de la nouvelle adaptation au cinéma ?

Astérix en voyage

Cette fois-ci, notre blond ami décolle pour voir les bretons cousins. Les normands cousins seront également de la partie. Un voyage haut en couleur en perspective annonce-t-il un niveau de qualité élevé ?

[video]http://www.youtube.com/watch?v=eLr8aU-sTb8[/video]

Quatrième film, et encore un nouvel Astérix : Edouard Baer. Je dois dire que j'aime la symbiose du duo Depardieu-Clavier depuis de nombreux films. Cornillac est un bon acteur mais le rôle ne lui allait pas du tout. Edouard Baer est tout simplement PAR-FAIT !

De même, un nouveau César entre en scène : Fabrice Luchini. C'est sûr, il n'a pas le nombrilisme que dégage Alain Delon et qui était fort sympatique pour le rôle. Pour autant, sa prose et sa verbale font de lui un grand et agréable César.

Par contre, premier point qui m'attriste ? Les bretons sont tous joués par des Français. C'est sûr que l'ouverture à l'international est impossible pour un produit tel qu'Astérix : il ne s'est vendu qu'à 325 millions de part le monde et traduit exclusivement dans 107 langues. Du coup, ces français bretons nous sur-jouent du début à la fin l'anglais accent. Ce qui est comique les premières minutes du film devient vite ennuyeux voire fatigant.

De plus, alors que l'anachronisme de la BD est connu mais léger, celui de ce film est lourd : des huttes celtes renferment des habitations aux décorations victorienne. Usant. Ces deux points sont bien fatigant et gâche le potentiel du film.

Par contre, les normands, avec un Dany Boon en principal représentant, s'en sortent très bien. J'ai beau ne pas aimé l'acteur en général, ici, il se laisse regarder et assume très bien son rôle de géant du nord.

Au final, le film se révèle en demi teinte : les acteurs sont à leur place (ou presque ...) mais une ouverture à l'internationale et une liberté moins grande sur les anachronismes aurait rendu le film parfait. N°2 en qualité dans la saga.

Code Club - Talking code

2012-10-07T15:39:42+02:00

Création d'une plateforme (S) FTP (S) sécurisée avec authentification centralisée et utilisant divers stockages

2012-09-26T17:02:49+02:00

Il y a quelques années, pour l'un de mes employeurs (un gros CDN français pour ne pas le citer), une problématique s'est posée suite à une utilisation abusive des plateformes FTP. En l'occurrence, il y avait plusieurs serveurs FTP :

sous Windows :IIS, Filezilla Server et CoreFTP (SFTP)
sous Linux, plusieurs proftpd différents

Suite à l'utilisation abusive de la plateforme (historique) et l'impossibilité de remonter les traces, il a été demandé de sécuriser l'ensemble. J'en ai profité pour faire pas mal de modifications :

avoir un seul point d'entrée (un même pool de VIP) peu importe le service
avoir une authentification centralisée que ca soit en FTP, FTP avec SSL ou SFTP (à l'époque avec un Active Directory)
avoir une seule et même arborescence pour tous les NAS utilisés, peu importe l'origine et réduire le nombre de comptes clients
enregistrer toute l'activité des serveurs (accès, commandes exécutées)
bannir les comportements anormaux

J'avais nommé ce genre de plate-forme FTPx. Je cherchais un nouveau sujet de billet. Je me suis dis que j'allais dépoussiérer cette plateforme (la refaire pour le billet donc) en lui rajoutant une petite couche complémentaire (portsentry, honeypot, ...).

Avant propos sur la plateforme FTP

L'architecture va se baser exclusivement sur du gratuit. Du coup, je remplace l'Active Directory par un plus basique MySQL. La plateforme montée rapidement se base sur les machines suivantes :

fw : firewalling et loadbalancing
ftpx01 & ftpx02 : serveurs SFTP + FTP(S)
mysql : serveur MySQL

Bien sûr, on pourrait redondé la partie fw ou mysql mais ce n'est pas le sujet de ce billet (je pourrais toujours rédiger un billet dédié s'il y a de la demande pour). Au niveau accès, de l'extérieur, un utilisateur qui fait du SFTP ne pourra pas faire de SSH. De plus, il sera restreint à son arborescence et ne pourra remonté ailleurs.

Au niveau NAS, je ne ferais que la partie cliente, de manière rapide pour montrer la logique. Donc un serveur NFS et un serveur CIFS sont supposés exister.

On suppose à chaque fois partir d'une Debian légère et plutôt vierge. On ignore l'installation du serveur MySQL qui n'a rien de bien particulier.

Au niveau réseau, on notera les réseaux ainsi :

x.x.x.y : IP publique se finissant en y (on suppose une /24 de manière abusive)
z.z.a.y : IP pour le routage vers fw (on travaille sur une /24 encore)
z.z.b.y : IP de service entre les serveurs FTP et MySQL
z.z.c.y : IP de service entre les serveurs FTP et les NAS

Du coup, on se retrouve avec le plan d'adressage suivant :

fw
- public : x.x.x.1/24
- honeypot : x.x.x.2/24
- vip : x.x.x.3/24
- vers ftpx01 & ftpx02 : z.z.a.1/24
ftpx01 & ftpx02
- vers fw : z.z.a.11/24 et z.z.a.12/24
- vers mysql : z.z.b.11/24 et z.z.b.12/24
- vers les nas : z.z.c.11/24 et z.z.c.12/24
mysql
- vers ftpx01 & ftpx02 : z.z.b.21/24
nfs & cifs
- vers ftpx01 & ftpx02 : z.z.c.31/24 & z.z.c.32/24

Création de fw

On commence par installer les premiers packages.

apt-get -y install bind9 libnetfilter-conntrack3 ldirectord apticron ntp iptables module-assistant xtables-addons-common honeyd fail2ban portsentry

On implémente le module complémentaire d'iptables.

module-assistant --verbose --text-mode auto-install xtables-addons

Serveur DNS récursif

On s'installe un serveur DNS récursif en local pour diverses raisons (dont des histoires de performance).

cat << EOF > /etc/bind/named.conf.options
options {
 directory "/var/cache/bind";
 query-source address * port *;
 forwarders { 208.67.222.222; 208.67.220.220; };
 auth-nxdomain no; # conform to RFC1035
 listen-on-v6 { none; };
 listen-on { 127.0.0.1; };
 allow-transfer { none; };
 allow-query { any; };
 allow-recursion { any; };
 version none;
};
EOF
/etc/init.d/bind9 restart
echo "nameserver 127.0.0.1" > /etc/resolv.conf

Optimisations système

On s'applique à faire quelques optimisations qui seront bien pratique pour la suite.

cat << EOF > /etc/security/limits.conf
* - nofile 65536
EOF
cat << EOF >> /etc/profile
ulimit -n 65536
EOF
cat << EOF > /etc/sysctl.conf
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.arp_filter = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.arp_filter = 1
net.core.rmem_default = 4194304
net.core.rmem_max = 4194304
net.core.wmem_default = 4194304
net.core.wmem_max = 4194304
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304
net.ipv4.tcp_mem = 4096 65536 4194304
net.ipv4.tcp_low_latency = 0
net.core.netdev_max_backlog = 30000
fs.file-max = 65536
kernel.shmmax = 8000000000
kernel.shmall = 8000000000
net.ipv4.tcp_abort_on_overflow = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_fin_timeout = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.ip_local_port_range = 1024 65535
vm.min_free_kbytes = 65536
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.lo.arp_ignore = 1
net.ipv4.conf.eth0.arp_ignore = 1
net.ipv4.conf.eth1.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.lo.arp_announce = 2
net.ipv4.conf.eth0.arp_announce = 2
net.ipv4.conf.eth1.arp_announce = 2
net.ipv4.tcp_orphan_retries = 0
net.ipv4.tcp_timestamps = 0 
net.ipv4.tcp_sack = 1
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_keepalive_intvl = 1
net.ipv4.tcp_keepalive_probes = 1 
net.ipv4.ip_forward = 1
net.ipv4.conf.default.proxy_arp = 1
net.ipv4.conf.all.proxy_arp = 1
kernel.sysrq = 1
net.ipv4.conf.default.send_redirects = 1
net.ipv4.conf.all.send_redirects = 1
kernel.core_uses_pid=1
kernel.core_pattern=1
vm.dirty_background_ratio = 20
vm.dirty_ratio = 40
vm.swappiness = 1
vm.dirty_writeback_centisecs = 1500
net.ipv4.tcp_max_syn_backlog = 65536
net.core.optmem_max = 40960
net.ipv4.tcp_max_tw_buckets = 360000
net.ipv4.tcp_reordering = 5
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_no_metrics_save = 1
net.ipv4.tcp_max_orphans = 262144
net.ipv4.tcp_rfc1337 = 0
net.core.somaxconn=65536
net.ipv4.tcp_moderate_rcvbuf=1
net.ipv4.tcp_ecn=0
net.ipv4.ip_no_pmtu_disc=0
net.ipv4.tcp_slow_start_after_idle=0
net.netfilter.nf_conntrack_acct=1
net.ipv4.icmp_echo_ignore_broadcasts=1
EOF
sysctl -p

Fail2ban & honeypot

L'idée est d'utiliser le honeypot pour bannir les mauvaises personnes. Pour se faire, vu qu'on doit appliquer les règles au niveau de fw, aussi bien pour du INPUT que du FORWARD et sur plusieurs IP, on va le faire via fail2ban.

cat << EOF > /etc/rc.local
farpd x.x.x.2 -i eth0
/usr/local/bin/rules.sh start 
exit 0
EOF

farpd x.x.x.2 -i eth0
wget http://www.alunos.di.uminho.pt/~a43175/code/perl/customPie.pm -O /etc/honeypot/customPie.pm
wget http://www.alunos.di.uminho.pt/~a43175/code/perl/buildPie.pl -O /etc/honeypot/buildPie.pl
cat << EOF > /etc/default/honeyd
RUN="yes"
INTERFACE="eth0"
NETWORK=x.x.x.2
OPTIONS="--disable-webserver"
EOF

cat << EOF > /etc/honeypot/honeyd.conf
create win2k
set win2k personality "Microsoft Windows 2000 SP2"
set win2k default tcp action block
set win2k default udp action block
set win2k default icmp action block
set win2k uptime 3567
set win2k droprate in 13
add win2k tcp port 23 "sh /usr/share/honeyd/scripts/unix/linux/suse8.0/telnetd.sh $ipsrc $sport $ipdst $dport"
add win2k tcp port 21 "sh /usr/share/honeyd/scripts/win32/win2k/msftp.sh $ipsrc $sport $ipdst $dport"
add win2k tcp port 25 "sh /usr/share/honeyd/scripts/win32/win2k/exchange-smtp.sh $ipsrc $sport $ipdst $dport"
#add win2k tcp port 80 "sh /usr/share/honeyd/scripts/win32/win2k/iis.sh $ipsrc $sport $ipdst $dport"
add win2k tcp port 110 "sh /usr/share/honeyd/scripts/win32/win2k/exchange-pop3.sh $ipsrc $sport $ipdst $dport"
add win2k tcp port 143 "sh /usr/share/honeyd/scripts/win32/win2k/exchange-imap.sh $ipsrc $sport $ipdst $dport"
add win2k tcp port 389 "sh /usr/share/honeyd/scripts/win32/win2k/ldap.sh $ipsrc $sport $ipdst $dport"
add win2k tcp port 5901 "sh /usr/share/honeyd/scripts/win32/win2k/vnc.sh $ipsrc $sport $ipdst $dport"
add win2k udp port 161 "perl /usr/share/honeyd/scripts/unix/general/snmp/fake-snmp.pl public private --config=/usr/share/honeyd/scripts/unix/general/snmp"
# This will redirect incomming windows-filesharing back to the source
add win2k udp port 137 proxy $ipsrc:137
add win2k udp port 138 proxy $ipsrc:138
add win2k udp port 445 proxy $ipsrc:445
add win2k tcp port 137 proxy $ipsrc:137
add win2k tcp port 138 proxy $ipsrc:138
add win2k tcp port 139 proxy $ipsrc:139
add win2k tcp port 445 proxy $ipsrc:445
bind x.x.x.2 win2k
EOF

/etc/init.d/honeyd restart

cat << EOF > /etc/fail2ban/filter.d/honeyd.conf
[Definition]
failregex = .* S <HOST> .*$
ignoreregex = 
EOF

cat << EOF > /etc/fail2ban/action.d/banhost.conf
[Definition]
actionstart = 
actionstop = 
actioncheck = 
actionban = /usr/local/bin/banip.sh <ip>
actionunban = /usr/local/bin/unbanip.sh <ip>
EOF

cat << EOF > /etc/fail2ban/jail.conf
[DEFAULT]
ignoreip = 127.0.0.1 x.x.x.1
bantime = 86400
maxretry = 3
backend = polling
destemail = root@localhost
banaction = iptables-multiport
mta = sendmail
protocol = tcp
action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]
action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]
 %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s]
action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]
 %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s]

action = %(action_)s
[ssh]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 6
[honeyd]
enabled = trueinitctl list
filter = honeyd
port = all
logpath = /var/log/honeypot/honeyd.log
maxretry = 1
banaction = banhost
EOF

/etc/init.d/fail2ban restart

Toute personne tentant d'ouvrir un port sur l'honeypot sera automatiquement banni de la plateforme à coup de TARPIT pour la partie TCP et de DROP pour tout le reste.

Portsentry

Comment lutter contre un scan de port ? Grâce à portsentry bien sûr !

cat << EOF > /etc/default/portsentry
TCP_MODE="atcp"
UDP_MODE="audp"
EOF

cat << EOF > /etc/portsentry/portsentry.conf
TCP_PORTS="1,7,9,11,15,20,21,2370,79,109,110,111,119,138,139,143,512,513,514,515,540,635,1080,1524,2000,2001,4000,4001,5742,6000,6001,6667,12345,12346,20034,27665,30303,32771,32772,32773,32774,31337,40421,40425,49724,54320"
UDP_PORTS="1,7,9,66,67,68,69,111,137,138,161,162,474,513,517,518,635,640,641,666,700,2049,31335,27444,34555,32770,32771,32772,32773,32774,31337,54321"
ADVANCED_PORTS_TCP="65536"
ADVANCED_PORTS_UDP="65536"
ADVANCED_EXCLUDE_TCP="80"
ADVANCED_EXCLUDE_UDP=""
IGNORE_FILE="/etc/portsentry/portsentry.ignore"
HISTORY_FILE="/var/lib/portsentry/portsentry.history"
BLOCKED_FILE="/var/lib/portsentry/portsentry.blocked"
RESOLVE_HOST = "0"
BLOCK_UDP="2"
BLOCK_TCP="2"
KILL_ROUTE="/sbin/route add -host $TARGET$ reject"
KILL_HOSTS_DENY="ALL: $TARGET$ : DENY"
KILL_RUN_CMD_FIRST = "0"
KILL_RUN_CMD="/usr/local/bin/banip.sh $TARGET$"
SCAN_TRIGGER="0"
EOF

cat << EOF > /etc/portsentry/portsentry.ignore.static
208.67.222.222
208.67.220.220
x.x.x.254
EOF

Encore une fois, on va utiliser un script qui va nous bannir correctement l'IP sur l'ensemble de la plateforme.

Toute personne tentant un scan de port sera automatiquement banni de la plateforme à coup de TARPIT pour la partie TCP et de DROP pour tout le reste.

Scripting

On va utiliser quelques scripts selon la tâche à exécuter :

rules.sh va définir les règles par défaut
banip.sh va bannir une IP donnée
unbanip.sh va débannir une IP donnée

cat << EOF > /usr/local/bin/rules.sh
#!/bin/bash

start() {
 echo "Routing"
 iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE
 iptables -t nat -A PREROUTING -d x.x.x.3 -m tcp -p tcp --dport 21 -j DNAT --to-destination z.z.a.11
 iptables -t nat -A PREROUTING -d x.x.x.3 -m tcp -p tcp --dport 22 -j DNAT --to-destination z.z.a.11
 iptables -t mangle -A PREROUTING -i eth0 -p tcp -s 0.0.0.0/0 -d x.x.x.3/32 --dport ftp -j MARK --set-mark 1
 iptables -t mangle -A PREROUTING -i eth0 -p tcp -s 0.0.0.0/0 -d x.x.x.3/32 --dport 55000: -j MARK --set-mark 1
 for chain in INPUT FORWARD; do
  echo "Block DOS - $chain - Ping of Death"
  iptables -A $chain -p ICMP --icmp-type echo-request -m length --length 60:65535 -j ACCEPT;
  echo "Block DOS - $chain - Teardrop"
  iptables -A $chain -p UDP -f -j DROP;
  echo "Block DDOS - $chain - SYN-flood"
  iptables -A $chain -p TCP ! --syn -m state --state NEW -j TARPIT;
  iptables -A $chain -p TCP ! --syn -m state --state NEW -j DROP;
  echo "Block DDOS - $chain - Smurf"
  iptables -A $chain -m pkttype --pkt-type broadcast -j DROP;
  iptables -A $chain -p ICMP --icmp-type echo-request -m pkttype --pkt-type broadcast -j DROP;
  iptables -A $chain -p ICMP --icmp-type echo-request -m limit --limit 3/s -j ACCEPT;
  echo "Block DDOS - $chain - UDP-flood (Pepsi)"
  iptables -A $chain -p UDP --dport 7 -j DROP;
  iptables -A $chain -p UDP --dport 19 -j DROP;
  echo "Block DDOS - $chain - SMBnuke"
  iptables -A $chain -p UDP --dport 135:139 -j DROP;
  iptables -A $chain -p TCP --dport 135:139 -j TARPIT;
  iptables -A $chain -p TCP --dport 135:139 -j DROP;
  echo "Block DDOS - $chain - Connection-flood"
  iptables -A $chain -p TCP --syn -m connlimit --connlimit-above 3 -j TARPIT;
  iptables -A $chain -p TCP --syn -m connlimit --connlimit-above 3 -j DROP;
  echo "Block DDOS - $chain - Fraggle"
  iptables -A $chain -p UDP -m pkttype --pkt-type broadcast -j DROP;
  iptables -A $chain -p UDP -m limit --limit 3/s -j ACCEPT;
  echo "Block DDOS - $chain - Jolt"
  iptables -A $chain -p ICMP -f -j DROP; 
 done
 /etc/init.d/portsentry start
}
stop() {
 /etc/init.d/portsentry stop
 iptables -F
 iptables -X 
 iptables -F -t nat
 iptables -X -t nat
 iptables -F -t mangle
 iptables -X -t mangle
}
case "$1" in
 start)
  start
  ;;
 stop)
  stop
  ;;
 restart|reload)
  stop
  start
  ;;
 *)
  echo "$0 <start|stop|restart|reload>"
  exit 1
  ;;
esac
exit 0
EOF

chmod +x /usr/local/bin/rules.sh

cat << EOF > /usr/local/bin/banip.sh
#!/bin/bash
if [ $# -ne 1 ]; then
 echo "usage: $0 IP";
 exit 1;
fi

/sbin/iptables -I INPUT -s $1 -m tcp -p tcp -j TARPIT 
/sbin/iptables -I INPUT -s $1 -j DROP 
/sbin/iptables -I FORWARD -s $1 -m tcp -p tcp -j TARPIT 
/sbin/iptables -I FORWARD -s $1 -j DROP 
/sbin/iptables -I INPUT -s $1 -m limit --limit 1/minute --limit-burst 3 -j LOG --log-level debug --log-prefix 'Portsentry: tarpiting: '
exit 0
EOF

chmod +x /usr/local/bin/banip.sh

cat << EOF > /usr/local/bin/unbanip.sh
#!/bin/bash
if [ $# -ne 1 ]; then
 echo "usage: $0 IP";
 exit 1;
fi
for chain in INPUT FORWARD; do
 for id in `iptables -L $chain -n --line-numbers | grep $1 | awk '{ print $1 }'`; do
  iptables -D $chain $id;
 done
done
exit 0
EOF

chmod +x /usr/local/bin/unbanip.sh

Load balancing

On enchaine avec le load balancing. On déclare l'IP de la VIP en alias.

cat << EOF >> /etc/network/interfaces
auto eth0:0
iface eth0:0 inet static
 address x.x.x.3
 netmask 255.255.255.255
EOF

Puis on configure le load balancing en lui-même. Attention, le serveur FTP va fonctionner en mode passif, donc on prévoir l'ouverture des ports dynamiques et non prévisibles au niveau du load balancing.

echo CONFIG_FILE=/etc/ldirectord.cf >> /etc/default/ldirectord

cat << EOF > /etc/ldirectord.cf
 checktimeout=1
 negotiatetimeout=1
 checkinterval=5
 autoreload=yes
 logfile="l0"
 quiescent=yes
 virtual=1
 real=z.z.a.11 gate
 real=z.z.a.12:21 gate
 service=ftp
 scheduler=lc
 protocol=fwm
 persistent=5
 checktype=negotiate
 virtual=x.x.x.3:22
 real=z.z.a.11:22 gate
 real=z.z.a.12:22 gate
 service=ftp
 scheduler=lc
 protocol=tcp
 persistent=5
 checktype=negotiate
 EOF

/etc/init.d/ldirectord restart

Création d'un serveur ftpx

On commence par installer les premiers packages.

apt-get -y install bind9 iptables fail2ban libpam-mysql mysql-client libnss-mysql-bg nscd pure-ftpd

SERVEUR DNS RÉCURSIF

On s'installe un serveur DNS récursif en local pour diverses raisons (dont des histoires de performance).

cat << EOF > /etc/bind/named.conf.options
options {
 directory "/var/cache/bind";
 query-source address * port *;
 forwarders { 208.67.222.222; 208.67.220.220; };
 auth-nxdomain no; # conform to RFC1035
 listen-on-v6 { none; };
 listen-on { 127.0.0.1; };
 allow-transfer { none; };
 allow-query { any; };
 allow-recursion { any; };
 version none;
};
EOF
/etc/init.d/bind9 restart
echo "nameserver 127.0.0.1" > /etc/resolv.conf

OPTIMISATIONS SYSTÈME

On s'applique à faire quelques optimisations qui seront bien pratique pour la suite.

cat << EOF > /etc/security/limits.conf
* - nofile 65536
EOF
cat << EOF >> /etc/profile
ulimit -n 65536
EOF
cat << EOF > /etc/sysctl.conf
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.arp_filter = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.arp_filter = 1
net.core.rmem_default = 4194304
net.core.rmem_max = 4194304
net.core.wmem_default = 4194304
net.core.wmem_max = 4194304
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304
net.ipv4.tcp_mem = 4096 65536 4194304
net.ipv4.tcp_low_latency = 0
net.core.netdev_max_backlog = 30000
fs.file-max = 65536
kernel.shmmax = 8000000000
kernel.shmall = 8000000000
net.ipv4.tcp_abort_on_overflow = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_fin_timeout = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.ip_local_port_range = 1024 65535
vm.min_free_kbytes = 65536
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.lo.arp_ignore = 1
net.ipv4.conf.eth0.arp_ignore = 1
net.ipv4.conf.eth1.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.lo.arp_announce = 2
net.ipv4.conf.eth0.arp_announce = 2
net.ipv4.conf.eth1.arp_announce = 2
net.ipv4.tcp_orphan_retries = 0
net.ipv4.tcp_timestamps = 0 
net.ipv4.tcp_sack = 1
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_keepalive_intvl = 1
net.ipv4.tcp_keepalive_probes = 1 
net.ipv4.ip_forward = 1
net.ipv4.conf.default.proxy_arp = 1
net.ipv4.conf.all.proxy_arp = 1
kernel.sysrq = 1
net.ipv4.conf.default.send_redirects = 1
net.ipv4.conf.all.send_redirects = 1
kernel.core_uses_pid=1
kernel.core_pattern=1
vm.dirty_background_ratio = 20
vm.dirty_ratio = 40
vm.swappiness = 1
vm.dirty_writeback_centisecs = 1500
net.ipv4.tcp_max_syn_backlog = 65536
net.core.optmem_max = 40960
net.ipv4.tcp_max_tw_buckets = 360000
net.ipv4.tcp_reordering = 5
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_no_metrics_save = 1
net.ipv4.tcp_max_orphans = 262144
net.ipv4.tcp_rfc1337 = 0
net.core.somaxconn=65536
net.ipv4.tcp_moderate_rcvbuf=1
net.ipv4.tcp_ecn=0
net.ipv4.ip_no_pmtu_disc=0
net.ipv4.tcp_slow_start_after_idle=0
net.netfilter.nf_conntrack_acct=1
net.ipv4.icmp_echo_ignore_broadcasts=1
EOF
sysctl -p

Rajout d'un point d'entrée pour syslog-ng

Pensez simplement à rajouter la ligne suivante dans less sources de syslog-ng (/etc/syslog-ng/syslog-ng.conf) pour logguer tout ce que font vos utilisateurs).

unix-stream("/chroot/log" max-connections(2048));

Configuration de PAM & NSS pour utiliser MySQL

On suppose le serveur MySQL pré-installé. On y configure un compte pour PAM et la table d'utilisateurs qui va bien.

cat << EOF | mysql -u root -h z.z.b.21 -p
CREATE DATABASE pam;
GRANT SELECT ON pam.* TO 'pam'@'%' IDENTIFIED BY 'pampass';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP ON pam.* TO 'pamadm'@'%' IDENTIFIED BY 'pamadmpass';
FLUSH PRIVILEGES;
USE pam;
CREATE TABLE `accounts` (
`id` INT NOT NULL auto_increment primary key,
`username` VARCHAR( 30 ) NOT NULL ,
`login` VARCHAR( 30 ) NOT NULL ,
`pass` VARCHAR( 50 ) NOT NULL ,
UNIQUE (`username`)
) ENGINE = MYISAM ;
quit;
EOF

On poursuit avec la modification de nsswitch.conf. Pour cela on remplace les lignes passwd et shadow (mais pas group) :

passwd:  compat files  mysql 
shadow:  compat files  mysql

Puis on prépare l'accès MySQL de nsswitch.

cat << EOF > /etc/libnss-mysql.cfg
getpwnam SELECT login,'x',id+'2000','2000',username,CONCAT('/opt/ftpx/',login,login),'/bin/false' \ 
 FROM accounts \ 
 WHERE login='%1$s' \ 
 LIMIT 1 
getpwuid SELECT login,'x',id+'2000','2000',username,CONCAT('/opt/ftpx/',login,login),'/bin/false' \ 
 FROM accounts \ 
 WHERE id='%1$u'-2000 \ 
 LIMIT 1 
getspnam SELECT login,pass,'','','','','','','' \ 
 FROM accounts \ 
 WHERE login='%1$s' \ 
 LIMIT 1 
getpwent SELECT login,'x',id+'2000','2000',username,CONCAT('/opt/ftpx/',login,login),'/bin/false' \ 
 FROM accounts 
getspent SELECT login,pass,'','','','','','','' \ 
 FROM accounts 
getgrnam SELECT name,password,gid \ 
 FROM groups \ 
 WHERE name='%1$s' \ 
 LIMIT 1 
getgrgid SELECT name,password,gid \ 
 FROM groups \
 WHERE gid='%1$u' \ 
 LIMIT 1 
getgrent SELECT name,password,gid \ 
 FROM groups 
memsbygid SELECT username \ 
 FROM grouplist \ 
 WHERE gid='%1$u' 
gidsbymem SELECT gid \ 
 FROM grouplist \ 
 WHERE username='%1$s' 
host z.z.b.21
database pam 
username pam 
password pampass
port 3306
EOF

cat << EOF > /etc/libnss-mysql-root.cfg
host        z.z.b.21 
database    accounts 
username    pamadm
password    pamadmpass
port        3306
EOF

On ne définit en soit que les utilisateurs à qui on n'impose un groupe bien précis 'sftponly'.

groupadd -g 2000 sftponly

Reste à finir la configuration de PAM.

cat << EOF > /etc/pam_mysql.conf
users.host=z.z.b.21
users.db_user=pamadm
users.db_passwd=pamadmpass
users.database=pam
users.table=accounts 
users.user_column=login 
users.password_column=pass 
users.password_crypt=2
verbose=1
EOF

echo auth   required     pam_mysql.so    config_file=/etc/pam_mysql.conf >> /etc/pam.d/common-auth
echo account required pam_mysql.so config_file=/etc/pam_mysql.conf >> /etc/pam.d/common-account
echo session required pam_mysql.so config_file=/etc/pam_mysql.conf >> /etc/pam.d/common-session 
echo password required pam_mysql.so config_file=/etc/pam_mysql.conf >> /etc/pam.d/common-password

Restrictions pour SSH

Maintenant que l'on peut s'authentifier avec des données en base, il faut restreindre la partie SSH. Le chroot de base ne me convient pas. En effet, il nécessite que le groupe d'utilisateurs ait accès en lecture au dossier parent. Or, je souhaite leur restreindre un maximum la visibilité sur leurs petits voisins. Pour cela, il faut patcher openssh en conséquence.

apt-get source openssh-server
apt-get build-dep openssh-server
cd openssh-5.9p1
cat << EOF > patch.diff
--- session.c.orig 2012-09-26 15:34:02.119243513 +0200
+++ session.c 2012-09-26 15:34:24.951244387 +0200
@@ -1457,7 +1457,7 @@
 if (stat(component, &st) != 0)
 fatal("%s: stat(\"%s\"): %s", __func__,
 component, strerror(errno));
- if (st.st_uid != 0 || (st.st_mode & 022) != 0)
+ if (st.st_uid != 0 || (st.st_mode & 077) != 0)
 fatal("bad ownership or modes for chroot "
 "directory %s\"%s\"", 
 cp == NULL ? "" : "component ", component);
EOF 
patch < patch.diff 
dpkg-buildpackage -rfakeroot -sa -b
cd ..
dpkg -i openssh-server*deb
rm -fR openssh*

On peut maintenant finaliser la configuration d'openssh.

sed "s^Subsystem sftp /usr/lib/openssh/sftp-server^^" /etc/ssh/sshd_config
mkdir /opt/sftpd
chmod 700 /opt/sftpd
cat << EOF >> /etc/ssh/sshd_config
Subsystem sftp internal-sftp -f AUTH -l VERBOSE
Match Group sftponly
        ChrootDirectory /opt/sftp/%u/%u
        ForceCommand internal-sftp
        AllowTcpForwarding no
        GatewayPorts no
        X11Forwarding no
EOF
/etc/init.d/ssh restart

Mise en place de la partie FTP

On va utiliser pure-ftpd. Pourquoi ? Pour une raison parfaitement objective indépendante de toute pollution extérieure : juste "j'aime bien". Au delà de ce point, il reste un très bon produit.

cat << EOF > /etc/default/pure-ftpd-common
STANDALONE_OR_INETD=standalone
VIRTUALCHROOT=true
UPLOADUID=
UPLOADGID=
EOF

echo yes > /etc/pure-ftpd/auth/65unix
echo yes > /etc/pure-ftpd/auth/70pam

echo 1 > AllowUserFXP
echo stats:/var/log/pure-ftpd/transfer.log > AltLog
echo 21 > Bind
echo yes > ChrootEveryone
echo 1 > CustomerProof
echo 1 > DisplayDotFiles
echo 1 > DontResolve
echo UTF-8 > FSCharset
echo 100 > MaxClientsNumber
echo 10 > MaxClientsPerIP
echo 99 > MaxDiskUsage
echo 5 > MaxIdleTime
echo 2000 > MinUID
echo yes > NoAnonymous
echo 1 > NoTruncate
echo yes > PAMAuthentication
echo 55000 56000 > PassivePortRange
echo /etc/pure-ftpd/pureftpd.pdb > PureDB
echo ftp > SyslogFacility
echo 1 > TLS
echo 117 007 > Umask
echo yes > UnixAuthentication
echo 1 > VerboseLog

mkdir -p /etc/ssl/private
openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem
chmod 600 /etc/ssl/private/pure-ftpd.pem

/etc/init.d/pure-ftpd restart

Montage des arborescences réelles et virtuelles

Comme à l'habitude, vous monter vos différents points d'accès NFS et CIFS. On suppose qu'il s'agit de sous dossier de /mnt.

cat << EOF > /etc/init.d/masquerade
#!/bin/sh
case "$1" in
start)
 echo "Start 'masquarade'..."
 echo " mount remote fs"
 mount -t cifs -a
 mount -t nfs -a
 echo " enslave remote fs"
 mount --make-slave /mnt/cifs01
 mount --make-slave /mnt/cifs02
 mount --make-slave /mnt/cifs03
 mount --make-slave /mnt/nfs01
 mount --make-slave /mnt/nfs02
 mount --make-slave /mnt/nfs03
 echo " bind user mounts/chroot"
 /usr/local/bin/masquarade.sh add > /var/log/masquarade.log 2> /var/log/masquarade.err
 [ $? -ne 0 ] && echo " failed to bind all users mounts/chroots."
 ;;
stop)
 echo "Stop 'masquarade'..."
 echo " unbind users mounts/chroot" 
 /usr/local/bin/masquarade.sh del > /var/log/masquarade.log 2> /var/log/masquarade.err
 [ $? -ne 0 ] && echo " failed to unbind all users mounts/chroots."
 echo " free remote fs"
 umount /mnt/cifs01
 umount /mnt/cifs02
 umount /mnt/cifs03
 umount /mnt/nfs01
 umount /mnt/nfs02
 umount /mnt/nfs03
 ;;
restart)
 $0 stop
 sleep 5
 $0 start
 ;;
reload)
 $0 restart
 ;;
force-reload)
 $0 restart
 ;;
*)
 echo "Usage: $0 {start|stop|restart|force-reload}" >&2
 exit 3
 ;;
esac
exit 0
EOF
chmod +x /etc/init.d/masquerade
update-rc.d masquerade defaults

cat << EOF > /usr/local/bin/masquarade.sh
#!/bin/bash
CONF="/usr/local/etc/mounts"
DATE=`date +%s`
# USAGE
function usage()
{
 echo "Usage: $0 <help> <add|del> [[<mount>] ...]";
 echo " add - to add one or several mount";
 echo " del - to remove one or several mount";
 echo " mount - mount name from config file";
 echo " help - this usage";
 echo "";
 echo "If no mount point is provided, all mount points from config file will be treated";
 echo "Configuration: $CONF";
 echo "";
}
# ADD A PMOUNT POINT
function addMount()
{
 touch /tmp/masquarade.$DATE
 if [ $# -ne 0 ]
 then
 echo "[ Traitement de points particuliers ]"
 echo " Preparation du listing: "
 for point in $*
 do
 if [ `grep -ve '^#' $CONF | grep -ve '^\s*$' | grep -F $point | wc -l` -eq 0 ]
 then
 echo " Aucun point $PBIND existant dans la configuration"
 continue
 fi
 grep -ve '^#' $CONF | grep -ve '^\s*$' | grep -F $point >> /tmp/masquarade.$DATE
 done
 else
 echo "[ Utilisation du fichier complet ]"
 echo " Preparation du listing: "
 grep -ve '^#' $CONF | grep -ve '^\s*$' >> /tmp/masquarade.$DATE
 fi
 cat /tmp/masquarade.$DATE | while read line
 do
 # extract data for mount point
 PTYPE=`echo $line | awk -F';' '{ print $1 }'` # NOT USED
 PMOUNT=`echo $line | awk -F';' '{ print $3 }'`
 PBIND=`echo $line | awk -F';' '{ print $2 }'`
 PRIGHTS=`echo $line | awk -F';' '{ print $4 }'`
 echo -n "( + ) $PBIND: "
 # check the source
 if [ ! -d $PMOUNT ]
 then
 echo "$PMOUNT n'existe pas";
 continue
 fi
 # create the binding
 mkdir -p $PBIND
 #echo "mount -vvv -o bind $PMOUNT $PBIND" &> /tmp/pouet.log; 
 #mount -vvv -o bind $PMOUNT $PBIND &>> /tmp/pouet.log; 
 mount -o bind $PMOUNT $PBIND 2> /dev/null;
 if [ $? -ne 0 ]
 then
 echo " impossible de monter $PBIND"
 continue
 fi
 if [ $PRIGHTS == "ro" ]
 then
 mount -o remount,ro $PBIND 2> /dev/null
 if [ $? -ne 0 ]
 then
 echo " impossible de passer $PBIND en lecture seule"
 continue
 fi
 fi
 echo -n "$PBIND mounted ($PRIGHTS) "
 echo "ok"
 done
 if [ $# -ne 0 ]
 then
 for point in $*
 do
 account=${point#/opt/sftp/}
 account=${account%/*}
 echo -n "* $account: "
 if [ `mount | grep -F /opt/sftp/$account/dev | wc -l` -gt 0 ]
 then
 echo "already exists"
 else
 mkdir -p /opt/sftp/$account/$account/dev/ 2> /dev/null
 mount -o bind /chroot/ /opt/sftp/$account/$account/dev/ 2> /dev/null
 chmod 700 /opt/sftp/$account 2> /dev/null
 chown root:root /opt/sftp/$account 2> /dev/null
 chmod 500 /opt/sftp/$account/$account/dev 2> /dev/null
 fi
 echo "ok"
 done
 else
 for account in `ls /opt/sftp`; do
 echo -n "* $account: "
 if [ `mount | grep -F /opt/sftp/$account/$account/dev | wc -l` -gt 0 ]
 then
 echo "already exists"
 else
 mkdir -p /opt/sftp/$account/$account/dev/ 2> /dev/null
 mount -o bind /chroot/ /opt/sftp/$account/$account/dev/ 2> /dev/null
 chmod 700 /opt/sftp/$account 2> /dev/null
 chown root:root /opt/sftp/$account 2> /dev/null
 chmod 500 /opt/sftp/$account/$account/dev 2> /dev/null
 fi
 echo "ok"
 done
 fi
 rm -f /tmp/masquarade.$DATE
 return
}
# DELETE A PMOUNT POINT
function delMount()
{
 if [ $# -ne 0 ]
 then
 echo "[ Traitement de points particuliers ]"
 echo " Preparation du listing: "
 for point in $*
 do
 if [ `grep -ve '^#' $CONF | grep -ve '^\s*$' | grep -F $point | wc -l` -eq 0 ]
 then
 echo " Aucun point $PBIND existant dans la configuration"
 continue
 fi
 grep -ve '^#' $CONF | grep -ve '^\s*$' | grep -F $point >> /tmp/masquarade.$DATE
 done
 else
 echo "[ Utilisation du fichier complet ]"
 echo " Preparation du listing: " 
 grep -ve '^#' $CONF | grep -ve '^\s*$' >> /tmp/masquarade.$DATE
 echo " Retrait des logs"
 for account in `ls /opt/sftp`
 do
 umount -f /opt/sftp/$account/$account/dev/ 2> /dev/null
 #rmdir /opt/sftp/$account/$account/dev/ 2> /dev/null
 done
 fi
 tac /tmp/masquarade.$DATE | while read line
 do
 PBIND=`echo $line | awk -F';' '{ print $2 }'`
 PRIGHTS=`echo $line | awk -F';' '{ print $4 }'`
 echo -n "( - ) $PBIND: "
 if [ `grep $PBIND /proc/mounts | grep -v grep | wc -l` -eq 0 ]
 then
 echo "$PBIND n'est pas/plus monte"
 else
 umount -f $PBIND 2> /dev/null
 if [ $? -ne 0 ]
 then
 echo "Impossible de demonter $PBIND"
 continue
 fi
 fi
 echo "ok"
 done
 rm /tmp/masquarade.$DATE
}
if [ $# -eq 0 ]
then
 usage
 exit 0
fi
if [ ! -f $CONF ]
then
 echo "Fichier $CONF manquant !"
 echo "Syntaxe du fichier: PTYPE;PMOUNT;PBIND;PRIGHTS"
 exit 1
fi
action=0;
pos=0;
points="";
for arg in `echo $*`; do
 ((pos++))
 case "$arg" in
 help)
 usage;
 exit 0;
 ;;
 add)
 action=1;
 if [ $# -eq 1 ]; then
 addMount;
 fi
 ;;
 del)
 action=-1;
 if [ $# -eq 1 ]; then
 delMount;
 fi
 ;;
 *)
 points="${points} $arg";
 if [ $pos -eq $# ]; then
 if [ $action -eq 0 ]; then
 usage;
 exit 0;
 else if [ $action -gt 0 ]; then
 addMount $points;
 else 
 delMount $points;
 fi
 fi
 exit 0;
 fi
 ;;
 esac
done
exit 0
EOF 
chmod +x /usr/local/bin/masquarade.sh

/etc/init.d/masquerade start

L'idée est que chaque utilisateur est isolé et chrooté dans son coin. Il ne remonte pas l'arborescence et n'a même pas les droits en lecture chez ses voisins. De plus, chaque action peut être loguée puisque transmise à syslog-ng.

VIP

Pour que le load balancing fonctionne avec la bonne IP dans le paquet réseau, on pense à définir un alias.

cat << EOF >> /etc/network/interfaces
auto lo:0
iface lo:0 inet static
 address x.x.x.3
 netmask 255.255.255.255
EOF

Création d'un utilisateur

Avec votre client MySQL préféré (CLI, phpMyAdmin, autre...), il vous suffit alors de rajouter une entrée en respectant les points suivants :

username correspond au nom de l'utilisateur (par ex, "Nom Prénom")
login correspond à son identifiant
pass est le mot de passe encrypté via la fonction PASSWORD() de MySQL
id est laissé vide pour être automatiquement incrémenté.

Conclusion

Avec cette base de plateforme, vous avez de quoi avoir un dépôt de fichiers multi utilisateur en FTP (avec ou sans SSL) et en SFTP avec un seule et unique point d'authentification, et pas mal de sécurisation au niveau des accès et remontées d'arborescence. Si vous avez des questions ou remarque, comme à l'habitude, n'hésitez pas.

Merci à Guillaume Vaillant qui m'a ressorti mes archives.

Jason Bourne : l'héritage ... en maison de retraite

2012-09-20T10:57:27+02:00

Au niveau des films d'action, la trilogie des Jason Bourne était mon petit plaisir de la dernière décennie. Quand un quatrième film, sorte de spin-off/suite avec un autre agent, a été annoncé, j'ai oscillé entre peur (de l'épisode de trop) et plaisir. Héritage lourd d'une trilogie puissante. Héritage pesant d'un agent campé par un Matt Damon ultra performant. Quid de ce nouvel opus ? Aaron Cross sera-t-il plus fort que Jason Bourne ?

L'héritage peut avoir du bon mais aussi du mauvais

Le premier Jason Bourne avait créé une petite surprise en soit, avec un rythme effreiné et quelques pauses pour permettre au spectateur de reprendre son souffle. Les deux opus suivants, en respectant le schéma, permettait de découvrir un peu plus de l'univers Bourne. Ce quatrième opus nous propulse donc à la poursuite de Cross, agent à éliminer suite aux révélations de Bourne.

[video]http://www.youtube.com/watch?v=jMzs8Hew770[/video]

Alors que la première trilogique se basait sur les livres de Robert Ludlum, ce nouvel opus s'inspire de l'oeuvre d'Eric Van Lustbader qui prend la suite de Ludlum (décédé en 2001). Du coup, on essaie de prendre la même base, dans une aventure en parallèle avec les déboires de Bourne. A défaut d'un vrai rythme effreiné, une caméra trop nerveuse et régulièrement floutée. Du close combat moins bien orchestré et visuel que précédemment. Un agent 10 ans ~~trop~~ plus vieux par rapport à Bourne. Une intrigue qui se cherche et passe son temps à se raccrocher via des flashs d'infos aux aventures de Bourne. L'héritage se sent. L'incapacité à s'en défaire aussi. A croire que justement, cet héritage est trop lourd à porter. Problème de l'auteur ? Problème du réal ? Problème de la prod ? Tout en même temps, mon Colonel. Tous se sont fourvoyé. Bien dommage.

Je me suis ennuyé mortellement pendant ces 135 minutes de films. Les acteurs ne sont pas mauvais. Mais le scénario n'est pas là, et l'impression d'ECG quasi plat qui émane du film avec quelques sursaut éparses reflète clairement mon ECG pendant le film.

Donc non, Aaron Cross n'est pas meilleur que Jason Bourne. Cross est déjà un retraité que l'on a repeint façon camion volé pour prétendre à une nouveauté et ainsi voler un jackpot commercial non mérité.

Comparatif des serveurs pour PHP

2012-09-11T11:49:09+02:00

Après le comparatif des outils de caching et la création d'un CDN (scalable), voici un comparatif pour le déploiement de PHP. On s'intéresse donc à PHP 5.4 dans les environnements suivants :

apache22-php-mod : apache 2.2 + module PHP 5.4
apache22-php-fpm : apache 2.2 + PHP 5.4-FPM
apache24-php-mod : apache 2.4 + module PHP 5.4
apache24-php-cgi : apache 2.4 + PHP 5.4-FPM
nginx-php : nginx + PHP 5.4-FPM
lighttpd-php : lighttpd + PHP 5.4-FPM
cherokee-php : cherokee + PHP 5.4 FCGI
standalone-php : PHP 5.4 webserver

On va faire le test en 2 temps :

utilisation de phpbench pour le théorique
utilisation d'un wordpress non optimisé (reprise de ce Wordpress privé des divers plugins d'optimisations)

On utilise wget pour le test pour simplement afficher le résultat : on ne compare pas la capacité des serveurs web à monter en charge. L'idée étant de voir la performance de rendu dans un milieu équivalent, on reprend des machines virtuelles identiques (2 CPU, 8 Go Ram).

Pour rester dans une logique assez proche, tous les applicatifs testés seront installés par compilation.

Installation de apache22-php-mod

On commence par les packages requis pour l'installation :

[crayon]aptitude install build-essential libxml2-dev libz-dev libzip-dev libcurl4-gnutls-dev mysql-server mysql-client libmysqlclient-dev[/crayon]

On suit par apache 2.2 :

On termine par php :

[crayon language=shell]cd /usr/src
wget http://fr2.php.net/get/php-5.4.6.tar.gz/from/fr.php.net/mirror -O php-5.4.6.tar.gz
tar -xzf php-5.4.6.tar.gz
cd php-5.4.6
./configure --with-apxs2=/usr/local/apache2/bin/apxs --disable-cgi --with-zlib --with-pcre-regex --with-zlib --with-curl --with-mysql --with-mysqli --with-pdo-mysql --with-xmlrpc --enable-zip --with-pear --enable-bcmath
make && make install[/crayon]

On rajout le module sur apache en rajoutant à la fin de /usr/local/apache2/conf/httpd.conf :

[crayon language=apache]LoadModule php5_module /usr/local/apache2/modules/libphp5.so
<IfModule mod_php5.c>
<FilesMatch "\.ph(p3?|tml)$">
SetHandler application/x-httpd-php
</FilesMatch>
<FilesMatch "\.phps$">
SetHandler application/x-httpd-php-source
</FilesMatch>
</IfModule>[/crayon]

On relance enfin apache :

[crayon language=shell]/usr/local/apache2/bin/apachectl restart[/crayon]

Reste à mettre en place le blog que j'importe - non traîté ici -) et le fichier de benchmark :

[crayon language=shell]cd /usr/local/apache2/htdocs/
wget http://www.php-benchmark-script.com/bench.zip && unzip bench.zip[/crayon]

Reste plus qu'à benchmarker tout à l'heure.

Installation de apache22-php-fpm

On commence par les packages requis pour l'installation :

[crayon language=shell]aptitude install build-essential libxml2-dev libz-dev libzip-dev libcurl4-gnutls-dev mysql-server mysql-client libmysqlclient-dev[/crayon]

On suit par apache 2.2 :

[crayon language=shell]cd /usr/src
wget http://mirror.cc.columbia.edu/pub/software/apache//httpd/httpd-2.2.22.tar.gz
tar -xzf httpd-2.2.22.tar.gz
cd httpd-2.2.22
./configure --enable-mime-magic --enable-http --disable-status --enable-so --enable-rewrite --with-mpm=worker
make && make install
cd /usr/src
wget http://www.fastcgi.com/dist/mod_fastcgi-current.tar.gz
tar -xzf mod_fastcgi-current.tar.gz
cd mod_fastcgi-2.4.6
cp Makefile.AP Makefile
make && make install[/crayon]

On rajout le module sur apache en rajoutant à la fin de /usr/local/apache2/conf/httpd.conf :

[crayon language=apache]LoadModule fastcgi_module modules/mod_fastcgi.so
<IfModule mod_fastcgi.c>
ScriptAlias /fcgi-bin/ "/usr/local/bin/"
FastCGIExternalServer /usr/local/bin/php-cgi -host 127.0.0.1:9000 -pass-header Authorization
AddHandler php-fastcgi .php
Action php-fastcgi /fcgi-bin/php-cgi
<Directory /usr/local/bin>
Order Deny,Allow
Deny from All
Allow from env=REDIRECT_STATUS
</Directory>
</IfModule>[/crayon]

On relance enfin apache :

[crayon language=shell]/usr/local/apache2/bin/apachectl restart[/crayon]

Reste à mettre en place le blog que j'importe - non traîté ici -) et le fichier de benchmark :

[crayon language=shell]cd /usr/local/apache2/htdocs/
wget http://www.php-benchmark-script.com/bench.zip && unzip bench.zip[/crayon]

On termine par php :

[crayon language=shell]cd /usr/src
wget http://fr2.php.net/get/php-5.4.6.tar.gz/from/fr.php.net/mirror -O php-5.4.6.tar.gz
tar -xzf php-5.4.6.tar.gz
cd php-5.4.6
./configure --enable-fpm --with-fpm-group=www-data --with-fpm-user=www-data --with-zlib --with-pcre-regex --with-zlib --with-curl --with-mysql --with-mysqli --with-pdo-mysql --with-xmlrpc --enable-zip --with-pear --enable-bcmath
make && make install[/crayon]

On préparer FPM en éditant le fichier /usr/local/etc/php-fpm.conf :

[crayon][global]
[www]
user = www-data
group = www-data
listen = 127.0.0.1:9000
pm = dynamic
pm.max_children = 5
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 3
php_admin_value[open_basedir]=/usr/local/apache2/htdocs/[/crayon]

Bien sûr, on lance PHP-FPM :

[crayon language=shell]/usr/local/bin/php-fpm[/crayon]

Reste plus qu'à benchmarker tout à l'heure.

Installation de apache24-php-mod

On commence par les packages requis pour l'installation :

[crayon language=shell]aptitude install build-essential libxml2-dev libz-dev libzip-dev libcurl4-gnutls-dev mysql-server mysql-client libmysqlclient-dev libpcre3-dev[/crayon]

On suit par apache 2.4 :

[crayon language=shell]cd /usr/src
wget http://wwwftp.ciril.fr/pub/apache//httpd/httpd-2.4.3.tar.gz
tar -xzf httpd-2.4.3.tar.gz
wget http://mirrors.ircam.fr/pub/apache//apr/apr-1.4.6.tar.gz
tar -xzf apr-1.4.6.tar.gz -C httpd-2.4.3/srclib/
wget http://mirrors.ircam.fr/pub/apache//apr/apr-util-1.4.1.tar.gz
tar -xzf apr-util-1.4.1.tar.gz -C httpd-2.4.3/srclib/
cd httpd-2.4.3
mv srclib/apr-1.4.6 srclib/apr
mv srclib/apr-util-1.4.1 srclib/apr-util
./configure --enable-mime-magic --enable-http --disable-status --enable-so --enable-rewrite --with-mpm=prefork
make && make install[/crayon]

On termine par php :

On rajout le module sur apache en rajoutant à la fin de /usr/local/apache2/conf/httpd.conf :

On relance enfin apache :

[crayon language=shell]/usr/local/apache2/bin/apachectl restart[/crayon]

Reste à mettre en place le blog que j'importe - non traîté ici -) et le fichier de benchmark :

[crayon language=shell]cd /usr/local/apache2/htdocs/
wget http://www.php-benchmark-script.com/bench.zip && unzip bench.zip[/crayon]

Reste plus qu'à benchmarker tout à l'heure.

Installation de apache24-php-fpm

On commence par les packages requis pour l'installation :

[crayon language=shell]aptitude install build-essential libxml2-dev libz-dev libzip-dev libcurl4-gnutls-dev mysql-server mysql-client libmysqlclient-dev libpcre3-dev[/crayon]

On suit par apache 2.4 :

On rajout le module sur apache en rajoutant à la fin de /usr/local/apache2/conf/httpd.conf :

[crayon language=apache]ProxyPassMatch ^/(.*\.php)$ fcgi://127.0.0.1:9000/usr/local/apache2/htdocs/$1[/crayon]

On relance enfin apache :

[crayon language=shell]/usr/local/apache2/bin/apachectl restart[/crayon]

Reste à mettre en place le blog que j'importe - non traîté ici -) et le fichier de benchmark :

[crayon language=shell]cd /usr/local/apache2/htdocs/
wget http://www.php-benchmark-script.com/bench.zip && unzip bench.zip[/crayon]

On termine par php :

[crayon language=shell]cd /usr/src
wget http://fr2.php.net/get/php-5.4.6.tar.gz/from/fr.php.net/mirror -O php-5.4.6.tar.gz
tar -xzf php-5.4.6.tar.gz
cd php-5.4.6
./configure --enable-fpm --with-fpm-group=www-data --with-fpm-user=www-data --with-zlib --with-pcre-regex --with-zlib --with-curl --with-mysql --with-mysqli --with-pdo-mysql --with-xmlrpc --enable-zip --with-pear --enable-bcmath
make && make install[/crayon]

On préparer FPM en éditant le fichier /usr/local/etc/php-fpm.conf :

Bien sûr, on lance PHP-FPM :

[crayon language=shell]/usr/local/bin/php-fpm[/crayon]

Reste plus qu'à benchmarker tout à l'heure.

Installation de nginx-php

On commence par les packages requis pour l'installation :

[crayon language=shell]aptitude install build-essential libxml2-dev libz-dev libzip-dev libcurl4-gnutls-dev mysql-server mysql-client libmysqlclient-dev libpcre3-dev[/crayon]

On suit par nginx 1.2.3 :

[crayon language=shell]cd /usr/src
wget http://nginx.org/download/nginx-1.2.3.tar.gz
tar -xzf nginx-1.2.3.tar.gz
cd nginx-1.2.3
./configure --without-mail_pop3_module --without-mail_imap_module --without-mail_smtp_module
make && make install[/crayon]

On configure ensuite nginx /usr/local/nginx/conf/nginx.conf :

[crayon]worker_processes 4;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
gzip on;
server {
listen 80;
server_name test;
location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /var/www$fastcgi_script_name;
include fastcgi_params;
}
location / {
root /var/www;
}
}
}[/crayon]

On relance enfin nginx :

[crayon language=shell]/usr/local/nginx/sbin/nginx -c /etc/nginx/nginx.conf[/crayon]

Reste à mettre en place le blog que j'importe - non traîté ici -) et le fichier de benchmark :

[crayon language=shell]cd /var/www/
wget http://www.php-benchmark-script.com/bench.zip && unzip bench.zip[/crayon]

On termine par php :

[crayon language=shell]cd /usr/src
wget http://fr2.php.net/get/php-5.4.6.tar.gz/from/fr.php.net/mirror -O php-5.4.6.tar.gz
tar -xzf php-5.4.6.tar.gz
cd php-5.4.6
./configure --enable-fpm --with-fpm-group=www-data --with-fpm-user=www-data --with-zlib --with-pcre-regex --with-zlib --with-curl --with-mysql --with-mysqli --with-pdo-mysql --with-xmlrpc --enable-zip --with-pear --enable-bcmath
make && make install[/crayon]

On préparer FPM en éditant le fichier /usr/local/etc/php-fpm.conf :

Bien sûr, on lance PHP-FPM :

[crayon language=shell]/usr/local/bin/php-fpm[/crayon]

Reste plus qu'à benchmarker tout à l'heure.

Installation de lighttpd-php

On commence par les packages requis pour l'installation :

[crayon language=shell]aptitude install build-essential libxml2-dev libz-dev libzip-dev libcurl4-gnutls-dev mysql-server mysql-client libmysqlclient-dev libpcre3-dev[/crayon]

On suit par lighttpd 1.4.31 :

[crayon language=shell]cd /usr/src
wget http://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.31.tar.gz
tar -xzf lighttpd-1.4.31.tar.gz
cd lighttpd-1.4.31
./configure --without-bzip2
make && make install
cp -a doc/config /etc/lighttpd
mkdir /var/www/htdocs
mkdir /var/log/lighttpd
chown -R www-data:www-data /var/log/lighttpd /var/www[/crayon]

On configure ensuite lighttpd /etc/lighttpd/conf.d/fastcgi.conf :

[crayon]server.modules += ( "mod_fastcgi" )
fastcgi.server += ( ".php" =>
((
"host" => "127.0.0.1",
"port" => "9000",
"broken-scriptfilename" => "enable"
))
)[/crayon]

On met aussi à jour le /etc/lighttpd/lighttpd.conf :

[crayon]server.username = "www-data"
server.groupname = "www-data"[/crayon]

On relance enfin lighttpd :

[crayon language=shell]lighttpd -f /etc/lighttpd/lighttpd.conf[/crayon]

Reste à mettre en place le blog que j'importe - non traîté ici -) et le fichier de benchmark :

[crayon language=shell]cd /var/www/htdocs/
wget http://www.php-benchmark-script.com/bench.zip && unzip bench.zip[/crayon]

On termine par php :

[crayon language=shell]cd /usr/src
wget http://fr2.php.net/get/php-5.4.6.tar.gz/from/fr.php.net/mirror -O php-5.4.6.tar.gz
tar -xzf php-5.4.6.tar.gz
cd php-5.4.6
./configure --enable-fpm --with-fpm-group=www-data --with-fpm-user=www-data --with-zlib --with-pcre-regex --with-zlib --with-curl --with-mysql --with-mysqli --with-pdo-mysql --with-xmlrpc --enable-zip --with-pear --enable-bcmath
make && make install[/crayon]

On préparer FPM en éditant le fichier /usr/local/etc/php-fpm.conf :

Bien sûr, on lance PHP-FPM :

[crayon language=shell]/usr/local/bin/php-fpm[/crayon]

Reste plus qu'à benchmarker tout à l'heure.

Installation de cherokee-php

On commence par les packages requis pour l'installation :

[crayon language=shell]aptitude install build-essential libxml2-dev libz-dev libzip-dev libcurl4-gnutls-dev mysql-server mysql-client libmysqlclient-dev libpcre3-dev[/crayon]

On suit par cheroke 1.2.101 :

[crayon language=shell]cd /usr/src
wget http://cherokee-project.com/install && python install[/crayon]

On relance enfin cherokee :

[crayon language=shell]/etc/init.d/cherokee-opt start[/crayon]

Reste à mettre en place le blog que j'importe - non traîté ici -) et le fichier de benchmark :

[crayon]cd /opt/cherokee/var/www
wget http://www.php-benchmark-script.com/bench.zip && unzip bench.zip[/crayon]

On termine par php :

[crayon language=shell]cd /usr/src
wget http://fr2.php.net/get/php-5.4.6.tar.gz/from/fr.php.net/mirror -O php-5.4.6.tar.gz
tar -xzf php-5.4.6.tar.gz
cd php-5.4.6
./configure --enable-fpm --with-fpm-group=www-data --with-fpm-user=www-data --with-zlib --with-pcre-regex --with-zlib --with-curl --with-mysql --with-mysqli --with-pdo-mysql --with-xmlrpc --enable-zip --with-pear --enable-bcmath
make && make install[/crayon]

On préparer FPM en éditant le fichier /usr/local/etc/php-fpm.conf :

Bien sûr, on lance PHP-FPM :

[crayon language=shell]/usr/local/bin/php-fpm[/crayon]

On finit par l'implémentation de PHP dans cherokee :

[crayon language=shell]/opt/cherokee/sbin/cherokee-admin[/crayon]

On se connecte à http://127.0.0.1:9090/ :

Pensez ensuite à sauvegarder et faire un "Graceful Restart".

Reste plus qu'à benchmarker tout à l'heure.

Installation de php en standalone

On commence par les packages requis pour l'installation :

[crayon language=shell]aptitude install build-essential libxml2-dev libz-dev libzip-dev libcurl4-gnutls-dev mysql-server mysql-client libmysqlclient-dev libpcre3-dev[/crayon]

On suit par php :

[crayon language=shell]cd /usr/src
wget http://fr2.php.net/get/php-5.4.6.tar.gz/from/fr.php.net/mirror -O php-5.4.6.tar.gz
tar -xzf php-5.4.6.tar.gz
cd php-5.4.6
./configure --with-zlib --with-pcre-regex --with-zlib --with-curl --with-mysql --with-mysqli --with-pdo-mysql --with-xmlrpc --enable-zip --with-pear --enable-bcmath --enable-cli
make && make install[/crayon]

Plus qu'à lancer le serveur intégré :

[crayon language=shell]nohup /usr/local/bin/php -S 0.0.0.0:80 -t /var/www/ &> /dev/null &[/crayon]

Bien sûr, il nous faut aussi le script de benchmark (et le blog à importer)

[crayon language=shell]cd /var/www
wget http://www.php-benchmark-script.com/bench.zip && unzip bench.zip[/crayon]

Plus qu'à tester.

Comparatif

On collecte donc l'ensemble des résultats :

[crayon language=shell]for server in x.x.x.1 x.x.x.2 x.x.x.3 x.x.x.4 x.x.x.5 x.x.x.6 x.x.x.7 x.x.x.8; do wget http://$server/bench.php -O - ; done[/crayon]

Résultats pour apache22-php-mod

[crayon]--------------------------------------
| PHP BENCHMARK SCRIPT |
--------------------------------------
Start : 2012-09-11 09:25:25
Server : x.x.x.1@x.x.x.1
PHP version : 5.4.6
Platform : Linux
--------------------------------------
test_math : 2.374 sec.
test_stringmanipulation : 2.433 sec.
test_loops : 1.864 sec.
test_ifelse : 1.336 sec.
--------------------------------------[/crayon]

Résultats pour apache22-php-fpm

[crayon]--------------------------------------
| PHP BENCHMARK SCRIPT |
--------------------------------------
Start : 2012-09-11 09:25:57
Server : x.x.x.2@x.x.x.2
PHP version : 5.4.6
Platform : Linux
--------------------------------------
test_math : 2.265 sec.
test_stringmanipulation : 2.362 sec.
test_loops : 2.168 sec.
test_ifelse : 1.224 sec.
--------------------------------------[/crayon]

Résultats pour apache24-php-mod

[crayon]--------------------------------------
| PHP BENCHMARK SCRIPT |
--------------------------------------
Start : 2012-09-11 09:26:03
Server : x.x.x.3@x.x.x.3
PHP version : 5.4.6
Platform : Linux
--------------------------------------
test_math : 3.236 sec.
test_stringmanipulation : 3.274 sec.
test_loops : 2.113 sec.
test_ifelse : 1.453 sec.
--------------------------------------[/crayon]

Résultats pour apache24-php-fpm

[crayon]--------------------------------------
| PHP BENCHMARK SCRIPT |
--------------------------------------
Start : 2012-09-11 09:26:12
Server : x.x.x.4@x.x.x.4
PHP version : 5.4.6
Platform : Linux
--------------------------------------
test_math : 2.225 sec.
test_stringmanipulation : 2.361 sec.
test_loops : 2.094 sec.
test_ifelse : 1.223 sec.
--------------------------------------[/crayon]

Résultats pour nginx-php

[crayon]--------------------------------------
| PHP BENCHMARK SCRIPT |
--------------------------------------
Start : 2012-09-11 09:26:23
Server : x.x.x.5@x.x.x.5
PHP version : 5.4.6
Platform : Linux
--------------------------------------
test_math : 2.310 sec.
test_stringmanipulation : 2.379 sec.
test_loops : 2.175 sec.
test_ifelse : 1.231 sec.
--------------------------------------[/crayon]

Résultats pour lighttpd-php

[crayon]--------------------------------------
| PHP BENCHMARK SCRIPT |
--------------------------------------
Start : 2012-09-11 09:26:38
Server : x.x.x.6@x.x.x.6
PHP version : 5.4.6
Platform : Linux
--------------------------------------
test_math : 2.194 sec.
test_stringmanipulation : 2.314 sec.
test_loops : 2.194 sec.
test_ifelse : 1.255 sec.
--------------------------------------[/crayon]

Résultats pour cherokee-php

[crayon]--------------------------------------
| PHP BENCHMARK SCRIPT |
--------------------------------------
Start : 2012-09-11 09:26:53
Server : x.x.x.7@x.x.x.7
PHP version : 5.4.6
Platform : Linux
--------------------------------------
test_math : 2.268 sec.
test_stringmanipulation : 2.381 sec.
test_loops : 2.076 sec.
test_ifelse : 1.236 sec.
--------------------------------------[/crayon]

Résultats pour standalone-php

[crayon]--------------------------------------
| PHP BENCHMARK SCRIPT |
--------------------------------------
Start : 2012-09-11 09:26:26:59
Server : 0.0.0.0@
PHP version : 5.4.6
Platform : Linux
--------------------------------------
test_math : 2.351 sec.
test_stringmanipulation : 2.455 sec.
test_loops : 2.112 sec.
test_ifelse : 1.250 sec.
--------------------------------------[/crayon]

Reproduire les tests ne fait varier les résultats que de quelques milli secondes, donc rien de significatif. Il en ressort donc, qu'hors optimisation de php (via ses modules entre autres) ou du serveur web, l'implémentation semble plus performante varie selon le calcul effectué. Cependant, sur le traitement global, les résultats avantagent apache24-php-fpm suivi de près par lighttpd-php et cherokee-php. A noter les bons résultats des implémentations en Apache 2.2 (module et FPM) mais les très mauvaises performances en module sur Apache 2.4.

Les benchmarks sur le blog renvoient les mêmes résultats.

Comparatif caching : nginx/varnish/squid/apache

2012-09-07T18:48:24+02:00

Suite à la publication de mon précédent billet (Créer un caching HTTP façon CDN), j'ai eu une petite discussion sur twitter avec Nicolas Hennion sur un comparatif des outils de mise en cache HTTP. Je me suis donc proposé de (re)faire un billet sur le sujet. Je m'attaque donc aux outils suivants : nginx, varnish, squid et apache (avec mod_cache/mod_proxy).

Avant propos

Le but n'étant pas de refaire une optimisation système et matérielle, je vais faire au plus simple pour le comparatif. Certains pourront considérer ma démarche simpliste mais bon, c'est la vie.

Architecture pour le comparatif

Ne voulant pas avoir trop de différences j'ai utilisé des machines virtuelles lancées sur des machines couillues. Une machine de créée en debian stable 64 bits, 2 vCPU pour 8 Go Ram et 1 Gbps en réseau, pour me faire un template et ensuite je l'ai clonée ainsi :

cache-apache : machine de cache en apache
cache-nginx : machine de cache en nginx
cache-squid : machine de cache en squid
cache-varnish : machine de cache en varnish
source-apache : machine qui distribue les fichiers de tests en http pour le serveur apache
source-nginx : machine qui distribue les fichiers de tests en http pour le serveur nginx
source-squid : machine qui distribue les fichiers de tests en http pour le serveur squid
source-varnish : machine qui distribue les fichiers de tests en http pour le serveur varnish
siege : la machine qui servira à générer les tests
temoin : machine qui distribue les fichiers de tests en http sans caching

Je mets un serveur "origin" (marque source-xxxxx) par serveur de cache afin qu'un test ne perturbe pas l'autre et ainsi pouvoir faire mes tests en parallèle.

Tous les serveurs seront sur le même réseau (pas de routage) afin de ne pas risquer d'avoir des ACL ou des problèmes de performance de routage entre elles.

Critères et méthodologie de comparaison

Les critères pris en compte sont les suivants

ergonomie pour un déploiement de masse
possibilité de configuration fine des vhosts/directory/...
optimisation de la consommation des ressources fournies
temps de réponses
débits
montée en charge

Afin de tester l'ensemble de ces critères, et parce que je n'ai pas envie de m'installer d'outils complémentaires (et potentiellement lourds) pour le report de la métrologie, je ferais un simple visuel sur le résultat de top sur chaque serveur (cache-xxxx et source-xxxx) pendant le test.

Les tests se feront à coup d'ab et de siege sur des fichiers de 1 ko, 10 ko, 100 ko, 1 Mo, 10 Mo, 100 Mo et 1 Go. De plus, tous se feront sans keepalive d'activé.

Machine de siege

On lui installe le nécessaire :

# aptitude install siege apache2-utils

Afin de me simplifier la vie, les noms des machines sont écrites dans le fichier /etc/hosts.

Machine source et témoin

On installe le nécessaire. N'y cherchant pas la performance, on installe un basique apache.

# aptitude install apache2

Ni on le configure, ni on l'optimise.

On lui prépare ensuite les fichiers de tests dans /var/www :

# cd /var/www
# dd if=/dev/urandom of=1k bs=1k count=1
# dd if=/dev/urandom of=10k bs=1k count=10
# dd if=/dev/urandom of=100k bs=1k count=100
# dd if=/dev/urandom of=1m bs=1024k count=1
# dd if=/dev/urandom of=10m bs=1024k count=10
# dd if=/dev/urandom of=100m bs=1024k count=100
# dd if=/dev/urandom of=1g bs=1024k count=1000

On a donc bien nos fichiers de test :

# ls -lh
total 1.1G
-rw-r--r-- 1 root root 100K Sep 7 10:43 100k
-rw-r--r-- 1 root root 100M Sep 7 10:44 100m
-rw-r--r-- 1 root root 10K Sep 7 10:43 10k
-rw-r--r-- 1 root root 10M Sep 7 10:44 10m
-rw-r--r-- 1 root root 1000M Sep 7 10:48 1g
-rw-r--r-- 1 root root 1.0K Sep 7 10:43 1k
-rw-r--r-- 1 root root 1.0M Sep 7 10:44 1m
-rw-r--r-- 1 root root 177 Sep 7 10:41 index.html

Caching façon apache

On lui installe apache:

# aptitude install apache2

On jongle avec les modules utiles et non-utiles :

# a2dismod auth_basic authn_file authz_default authz_groupfile hostz_user autoindex cgid dir env reqtimeout status
# a2enmod  disk_cache proxy_http

On modifie les paramètres prefork dans /etc/apache2/apache2.conf :

<IfModule mpm_prefork_module>
 StartServers 16
 MinSpareServers 16
 MaxSpareServers 10
 MaxClients 250
 MaxRequestsPerChild 0
</IfModule>

On paramètre ensuite le proxy et le caching. Pour cela on se crée un vhost dédié /etc/apache2/sites-available/crash :

<VirtualHost *:80>
 NameServer crash
 CacheRoot /opt
 CacheMaxFileSize 1500000
 ProxyPass / http://crash/
 ProxyPassReverse / http://source-apache/
</VirtualHost>

On l'active :

# a2ensite crash
# /etc/init.d/apache2 restart

Il y a vraiment peu de paramètres que l'on peut configurer à ce niveau pour améliorer le fonctionnement. Une petite modification côté système est à faire dans /etc/security/limits.conf :

* - nofile 65535

Installer une usine à gaz pour une petite fonctionnalité qui est en plus ne dispose d'aucun paramétrage fin.

Caching façon nginx

On rajoute les mirroirs nginx :

deb http://nginx.org/packages/debian/ squeeze nginx
deb-src http://nginx.org/packages/debian/ squeeze nginx

Puis :

# wget http://nginx.org/packages/keys/nginx_signing.key -O - | apt-key add -
# aptitude update

On installe le nécessaire :

# aptitude install nginx

On configure le vhost en créant un fichier /etc/nginx/sites-available/crash :

server {
 listen 80;
 server_name crash;
 proxy_cache_key $scheme://$host$uri;
 location ~* / {
  proxy_hide_header "Vary";
  add_header "Vary" "Accept-Encoding";
  proxy_cache big;
  proxy_pass http://source-nginx;
 }
}

Puis en l'activant :

# ln -s /etc/nginx/sites-available/crash /etc/nginx/sites-enable/
# /etc/init.d/nginx restart

Ensuite on remplace le fichier /etc/nginx/nginx.conf par le suivant :

user www-data;
worker_processes 4; 
worker_rlimit_nofile 10000;
error_log /var/log/nginx/error.log;
pid /var/run/nginx.pid;
timer_resolution 1ms;
events {
 worker_connections 10000;
 multi_accept on;
 use epoll;
 accept_mutex_delay 1ms;
}

http {
 include /etc/nginx/mime.types;
 client_body_temp_path /tmp 1 2;
 client_header_timeout 5s;
 client_body_timeout 5s;
 send_timeout 10m;
 connection_pool_size 128k;
 client_header_buffer_size 16k;
 large_client_header_buffers 1024 128k; 
 request_pool_size 128k; 
 keepalive_requests 1000;
 keepalive_timeout 10;
 client_max_body_size 10g;
 client_body_buffer_size 1m;
 client_body_in_single_buffer on;
 open_file_cache max=10000 inactive=300s; 
 reset_timedout_connection on;
 gzip on;
 gzip_static on;
 gzip_min_length 1100;
 gzip_buffers 16 8k;
 gzip_comp_level 9;
 gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
 gzip_vary on;
 gzip_proxied any;
 output_buffers 1000 128k;
 postpone_output 1460;
 sendfile on; 
 sendfile_max_chunk 256k;
 tcp_nopush on;
 tcp_nodelay on;
 server_tokens off;
 resolver 127.0.0.1;
 ignore_invalid_headers on;
 index index.html;
 add_header X-CDN "Served by myself";
 proxy_cache_path /opt/disk/ levels=1:2 keys_zone=big:10m max_size=2G;
 proxy_temp_path /opt/temp/ 1 2;
 proxy_cache_valid 404 10m;
 proxy_cache_valid 400 501 502 503 504 1m;
 proxy_cache_valid any 4320m;
 proxy_cache_use_stale updating invalid_header error timeout http_404 http_500 http_502 http_503 http_504;
 proxy_next_upstream error timeout invalid_header http_404 http_500 http_502 http_503 http_504;
 proxy_redirect off;
 proxy_set_header Host $http_host;
 proxy_set_header Server Apache;
 proxy_set_header Connection Close;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_pass_header Set-Cookie;
 proxy_pass_header User-Agent;
 proxy_set_header X-Accel-Buffering on;
 proxy_hide_header X-CDN;
 proxy_hide_header X-Server;
 proxy_intercept_errors off;
 proxy_ignore_client_abort on;
 proxy_connect_timeout 60;
 proxy_send_timeout 60;
 proxy_read_timeout 60;
 proxy_buffer_size 128k;
 proxy_buffers 16384 128k;
 proxy_busy_buffers_size 256k;
 proxy_temp_file_write_size 128k;
 proxy_cache_min_uses 0;
 include /etc/nginx/conf.d/*.conf;
 include /etc/nginx/sites-enabled/*;
}

Une petite modification côté système est à faire dans /etc/security/limits.conf :

* - nofile 65535

A mon sens, c'est celui qui offre le plus de possibilités dans le paramétrage fin et aussi dans l'évolutivité. Il ne lui manque que peu (SSI en tête de liste) pour être parfait.

Caching façon squid

On commence par installer l'applicatif :

# aptitude install squid

Vous remarquerez que l'installe une version de la branche 2.x et non 3.x. La raison est simple : squid3 est encore largement en retrait au niveau fonctionnalité (et stabilité) par rapport à la précédente branche, que l'ancienne évolue toujours et qu'on cherche à comparer des produits à mettre en prod.

On a besoin de changer les droits sur le dossier /opt :

# chmod 777 /opt

On paramètre alors le caching en éditant /etc/squid/squid.conf :

acl all src all
acl localnet src 192.168.0.0/16
acl Safe_ports port 80
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access allow localnet
http_access deny all
icp_access allow localnet
icp_access deny all
http_port 80 transparent
refresh_pattern . 0 20% 4320
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
extension_methods REPORT MERGE MKACTIVITY CHECKOUT
hosts_file /etc/hosts
coredump_dir /var/spool/squid
cache_peer source-squid parent 80 0 no-query originserver
cache_dir aufs /opt 2000 16 256
tcp_recv_bufsize 131072 bytes
maximum_object_size 1500000000 bytes

On n'oublie pas de modifier le fichier /etc/default/squid :

SQUID_MAXFD=10240

On pense encore à la petite modification côté système à faire dans etc/security/limits.conf en rajoutant :

* - nofile 65535

Squid est je pense celui qui a la configuration la moins claire. L'optimisation est très restreinte. Son avantage est l'implémentation complète de l'HTCP qui permet à l'architecture de caching de faire communiquer les noeuds entre eux, là où les autres demandes des petites astuces. Mono process, il ne profite pas des possibilités de la machine.

Caching façon varnish

On commence par l'installation :

# aptitude install varnish

On suit par la configuration en commencant par modifier les lignes suivantes dans /etc/default/varnish :

START=yes
DAEMON_OPTS="-a :80 \
 -f /etc/varnish/default.vcl \
 -S /etc/varnish/secret \
 -p thread_pools=4 \
 -s file,/var/lib/varnish/$INSTANCE/varnish_storage.bin,2G"

On enchaîne avec la configuration de /etc/varnish/default.vcl :

backend default {
 .host = "source-varnish";
 .port = "80";
 .connect_timeout = 1s;
 .first_byte_timeout = 5s;
 .between_bytes_timeout = 2s;
}
sub vcl_recv {
 return(lookup);
}
sub vcl_fetch {
 return(deliver);
}

On rajoute la petite modification côté système dans etc/security/limits.conf :

* - nofile 65535

Varnish n'a pas une syntaxe super claire. De plus, le paramétrage fin s'arrête à définir les durées des objets, les latences et les actions à mener sur les HIT/MISS & co. Le seul intérêt que j'ai trouvé à varnish est l'implémentation complète des SSI (qui n'est que partielle sur nginx par ex).

Comparatif

siege

Siege fournit un test sur la durée et la qualité de réponse sur cette durée. Pour chaque fichier de test (remplacer XX par le nom du fichier), on lance les commandes suivantes :

siege -b -c 1 -t 1M http://crash/XX
siege -b -c 10 -t 1M http://crash/XX
siege -b -c 100 -t 1M http://crash/XX
siege -b -c 1000 -t 1M http://crash/XX 
siege -b -c 10000 -t 1M http://crash/XX

Siege étant très gourmand en mémoire, on est obligé de restreinte les tests sur la VM utilisée. Le tableau de résultat est disponible directement au format PDF.

Notez les points suivants :

les durées sont annoncées en secondes
les débits sont en Mo/s
les erreurs sont dûes soit à la partie cliente (siege) soit à la partie serveur et donc sont à mettre entre parenthèses

Siege présente des résultats assez incohérent selon la relance sur les valeurs mais aussi sur sa consommation locale de ressources. Je ne suis pas sûr de pouvoir l'utiliser pour ma conclusion (variation de plus de 10% à chaque reprise).

ab

ab fournit un test instantanné pour définir la qualité de réponse du serveur sur une charge pré définie. Pour chaque fichier de test (remplacer XX par le nom du fichier), on lance les commandes suivantes :

ab -n 1 -c 1 http://crash/XX
ab -n 10 -c 10 http://crash/XX
ab -n 100 -c 100 http://crash/XX
ab -n 1000 -c 1000 http://crash/XX

Le tableau de résultat est disponible directement au format PDF.

Notez les points suivants :

les durées sont annoncées en secondes
global est la durée globale du test
moyenne est le temps moyen rencontré
max est le temps maximum de chargement de la page
erreur est le nombre de retour non valide

Conclusion

varnish est une très bonne solution en soit mais il s'avère que le potentiel et les performance de nginx n'en ont pas fait l'un des serveurs HTTP de warez N°1 pour rien en son temps. Aujourd'hui, l'utiliser pour du caching a toutes ses raisons et bien plus encore.

MAJ le 8 septembre 2012 à 16h20 : Modification de la mise en page des PDF et correction d'un lien

Créer un caching HTTP façon CDN

2012-09-05T15:17:41+02:00

C’est la mode au tout Cloud. Je ne m’étalerais pas sur mon avis très critique à cette mode commerciale. Cependant, le fonctionnement des sites en eux-mêmes changent peu et la mode du Cloud n’entache en rien le besoin de performance. C’est le service proposé par de nombreuses société de part de le monde avec des services de livraison de contenu (CDN) qui inclus :

distribution HTTP de contenus statiques
accélération HTTP de contenus statiques
streaming audio/vidéo live ou on-demand

Je vais donc me focaliser sur comment monter une plateforme minimale de livraison HTTP et d’accélération HTTP.

Avant propos et plateforme HTTP

L’accélération web consiste en la fourniture d’un service HTTP fiable, perfomant, et allégeant la charge sur la plateforme web du client : tout le contenu statique doit être fournit par la plateforme d’accélération ou au maximum, alors que les pages dynamiques sont services par la plateforme du client. Une plateforme d’accélération est simple à mettre en place. La problèmatique par contre, va résider principalement dans les performances (systèmes et réseaux) et dans les fonctionnalités avancées offertes aux clients. Le service doit être mutualisé avec un maximum de clients mais être également flexible et adapté à chacun. La distribution HTTP repose sur le même principe à la différence que l’on doit héberger le contenu. Il est important qu’une machine qui fait de la distribution ne fasse pas d’accélération et inversement. Cette restriction est importante car les optimisations divergent quelques peu. Je ne m’attarderais pas sur l’installation des systèmes en eux-même.

Le matériel

Les performances dépendent aussi bien des logiciels et de leurs configurations, que du matériel choisi. Selon les moyens, on choisira entre l’aggrégat d’interface en gigabit ou la mise en place de cartes 10 Gbps. Il est à noté que les temps d’accès sont différents entre de l’optique et du cuivre, à l’avantage de l’optique. De même, des SSD sont à privilégier pour le cache disque lors que des disques en 15k rpm ou 10k rpm peuvent suffire sur la partie distribution. Pourquoi je me refuse à prendre des appliances ?

limitées dans les fonctions additionnelles (ou sous licenses trop chères)
peu évolutives
performances largement en retrait par rapport à du home-made

Le logiciel

Il est intéressant de privilégier pour les noeuds de cache, des machines diskless, au système démarré en PXE et mis en Ramdisk. Si vous avez besoin d’un article sur ce point, laissez-moi savoir. L’avantage est de réduire les I/O disques lié au système. Côté mise en cache des objets, on se penchera sur un gros RAID0 de disques en SSD, le tout avec un formatage en XFS. Pourquoi pas en Ram ? simplement parce qu’il est facile de saturer les accès concurrents en Ram dans le cas d’un CDN et que les performances sont largement suffisantes avec une belle grappe de SSD. Côté service HTTP, on utilisera nginx, aussi bien pour la distribution que pour le caching. Pourquoi pas d’autres ?

varnish en caching : il est moins extensible que nginx, un chouillat plus lourd et je le trouve clairement moins agréable à l’utilisation
squid en caching : monolithique et non multithreadé, on y perd en performance et en optimisation ; de plus sa configuration est trop lourde et ses performances sont au final en retrait
apache en caching ou en distribution : oui, pourquoi ne pas utiliser une gros usine à gaz polluante, archaïque et peu performante à la place de solution légère et performante ?

On n’écrit rien en local niveau log : on mettra en place un syslog distant et centralisé. L’attrait est double : réduire les I/O locales et pouvoir facilement générer les statistiques HTTP.

La plateforme HTTP

Celle-ci regroupe donc à minima (et hors volonté de redondances sur tout) :

un serveur PXE pour fournir les OS aux machines diskless (non détaillé ici) (pxe)
un serveur syslog et statistiques (stats)
un serveur de base de données pour le backoffice offrant aux clients ou à l’équipe les outils pour le déploiement des configurations par vhosts (non détaillé ici) (db)
les serveurs de monitoring et management (master)
les serveurs de caching (on parle d’edges) ; il y aura 2 niveaux, donc on détaillera en edge / source
les serveurs origins HTTP

Pour des raisons de disponibilité (et de proximité), on sera amené à dupliquer autant de fois qu’il le faut chaque élément sur des sites distants. La plateforme est duplicable à volonté. L’architecture est une pyramide inversée, à savoir à minima :

4 serveurs edge qui attaquent
2 serveurs source qui attaquent
la plateforme du client ou 2 serveurs origin

Les autres serveurs sont mis en parallèle de ce déploiement.

Le réseau

Les VIP en mode DSR seront gérées par des LVS déployés sur les masters. On peut aussi investir dans des cartes ACE. Sur la partie GSLB (load balancing géolocalisé) je vous conseille de vous référer à votre ingé réseau sur les possibilités de votre infra au niveau déclaration des entêtes & co. En effet, faire du GSLB en DNS pour la plateforme en elle-même est un peu moins efficace :

à cause des serveurs DNS des FAI qui ne respectent pas les TTL (Free par ex …)
à cause des utilisateurs passant par des serveurs DNS tiers (Google, OpenDNS) qui faussent le calcul de géolocalisation
du fait que le site mis en cache doit aussi l’appliquer dans sa zone DNS et que c’est parfois compliqué de motiver un client

La qualité du transit et des peerings est un point important pour assurer d’excellentes performances du CDN. On note :

X.X.A.0/24 le range d’IP public du datacenter A
X.X.B.0/24 le range d’IP public du datacenter B
10.0.A.0/8 le range d’IP privé du datacenter A
10.0.B.0/8 le range d’IP privé du datacenter B

Les zones privées communiquent entre elles.

Installation des serveurs origin

Matériel

Au niveau matériel il s’agit, dans mon cas, de serveurs Dell R510 avec 12 disques de 2 To (pour le moment), 24 Go Ram, interfaces en 10 Gbps optiques. On commence par déployer les packages dont on a besoin :

aptitude -y install nginx-extras bind9 ntp sysfsutils xfsprogs syslog-ng

Les serveurs origin se duplique automatiquement les fichiers du client grâce à une réplication en GlusterFS :

wget http://download.gluster.org/pub/gluster/glusterfs/LATEST/Debian/5.0.3/glusterfs_3.3.0-1_amd64.deb
dpkg -i glusterfs_3.3.0-1_amd64.deb

La partie concernant l’importation des fichiers clients n’est pas exploitées ici. Du simple FTP au serveur SFTP utilisant un backend en LDAP, le choix est large.

NTP

On modifie simplement les lignes server du fichier /etc/ntp.conf :

server 10.0.A.201
server 10.0.B.201

DNS

Le service ne sera utilisé qu’en local pour la résolution DNS pour les besoins du nginx. Pour cela, on édite le fichier /etc/bind/named.conf/options :

options {
 directory "/var/cache/bind";
 query-source address * port *;
 forwarders { 10.0.A.201; 10.0.B.201; };
 auth-nxdomain no;
 listen-on-v6 { none; };
 listen-on { 127.0.0.1; };
 allow-query { any; };
 allow-recursion { any; };
 version none;
 max-clients-per-query 0;
 clients-per-query 0;
 recursive-clients 10000;
 minimal-responses yes ;
};

OPTIMISATION SYSTEME

On s’attaque au scheduler disque en modifiant le fichier /etc/sysfs.conf :

block/sdb/queue/scheduler = noop

On pense à adapter la partie en gras en fonction de ses disques. Dans la même idée, on modifier le bootloader grub en modifiant /etc/default/grub :

GRUB_CMDLINE_LINUX="elevator=noop quiet"

puis en mettant à jour grub :

update-grub

Le filesystem de l’espace de cache a aussi son importance :

mkfs.xfs -f -l size=128m /dev/sda3

On adapte aussi le fichier /etc/fstab :

/dev/sdb1 /data/store/ xfs rw,nobarrier,largeio,noatime,nodiratime,logbufs=8,inode64 0 2

On organise ensuite la réplication entre les serveurs source. La réplication GlusterFS n’est à configurer que sur l’un des noeuds :

gluster volume create store replica 2 transport tcp origin1:/data/store origin2:/data/store
gluster volume start store
gluster volume set store performance.write-behind-window-size 1024
gluster volume set store cluster.self-heal-window-size 1024
gluster volume set store cluster.lookup-unhashed off
gluster volume set store performance.flush-behind on
gluster volume set store nfs.disable on
gluster volume set store cluster.self-heal-daemon on
gluster volume set store performance.cache-size 2147483648
gluster volume set store performance.io-thread-count 64
gluster volume set store feature.read-only off

Notez qu’on peut répliquer autant que l’on désire. On prépare ensuite le montage du volume répliquer pour travailler dessus (/etc/fstab) :

origin1:/store /data/tmp glusterfs defaults,_netdev 0 0

On peut laisser le nom du premier serveur partout : le client GlusterFS l’utilise juste pour créer la connexion mais utilise le serveur qu’il considère le meilleur (en temps de réponse) pour les accès lecture/écrite. La partie sysctl est importante (/etc/sysctl.conf) :

net.ipv4.conf.default.rp_filter = 0 
net.ipv4.conf.default.arp_filter = 0
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.all.arp_filter = 0
net.core.rmem_default = 16777216
net.core.rmem_max = 16777216
net.core.wmem_default = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
net.ipv4.tcp_mem = 4096 65536 16777216
net.ipv4.tcp_low_latency = 0
net.core.netdev_max_backlog = 30000
fs.file-max = 262144
kernel.shmmax = 16000000000
kernel.shmall = 16000000000
net.ipv4.tcp_abort_on_overflow = 1
net.ipv4.tcp_syncookies = 0
net.ipv4.tcp_fin_timeout = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.ip_local_port_range = 1024 65535
vm.min_free_kbytes = 65536
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.lo.arp_ignore = 1
net.ipv4.conf.eth0.arp_ignore = 1
net.ipv4.conf.eth1.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.lo.arp_announce = 2
net.ipv4.conf.eth0.arp_announce = 2
net.ipv4.conf.eth1.arp_announce = 2
net.ipv4.tcp_orphan_retries = 0
net.ipv4.tcp_timestamps = 0 
net.ipv4.tcp_sack = 0
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_keepalive_intvl = 1
net.ipv4.tcp_keepalive_probes = 1 
net.ipv4.ip_forward = 1
net.ipv4.conf.default.proxy_arp = 1
net.ipv4.conf.all.proxy_arp = 1
kernel.sysrq = 1
net.ipv4.conf.default.send_redirects = 1
net.ipv4.conf.all.send_redirects = 1
kernel.core_uses_pid=1
kernel.core_pattern=1
vm.dirty_background_ratio = 20
vm.dirty_ratio = 40
vm.swappiness = 1
vm.dirty_writeback_centisecs = 1500
fs.xfs.xfssyncd_centisecs = 360000
fs.xfs.xfsbufd_centisecs = 3000
net.ipv4.tcp_max_syn_backlog = 65536
net.core.optmem_max = 40960
net.ipv4.tcp_max_tw_buckets = 360000
net.ipv4.tcp_reordering = 5
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_no_metrics_save = 1
net.ipv4.tcp_max_orphans = 262144
net.ipv4.tcp_rfc1337 = 0
net.core.somaxconn=262144
net.ipv4.tcp_ecn = 0
net.ipv4.ip_no_pmtu_disc = 0
net.ipv4.tcp_slow_start_after_idle = 0
net.ipv4.tcp_moderate_rcvbuf = 1

A adapter selon les interfaces réseaux et la Ram (partie en gras). On l’applique avec un simple :

sysctl -p

Il est important d’appliquer les limites correspondantes au système (/etc/security/limits.conf) :

*    soft    nofile    262144
*    hard    nofile    262144

Certaines modifications sont à appliquer au démarrage du système (/etc/rc.local) :

ifconfig eth0 txqueuelen 10000
ifconfig eth1 txqueuelen 10000
ifconfig eth0 mtu 9000
ifconfig eth1 mtu 9000
ethtool -K eth0 rx off tx off
ethtool -K eth1 rx off tx off

Distribution HTTP

On s’attaque donc à nginx. D’abord pour la partie globale :

{% highlight conf %} user www-data; worker_processes 2; worker_rlimit_nofile 250000;

error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid;

timer_resolution 1ms;

events { worker_connections 102400; use epoll; multi_accept on; accept_mutex_delay 1ms; }

http { include /etc/nginx/mime.types; default_type application/octet-stream;

log_format access ‘[$time_local] $request_time “$request_method $scheme://$host$request_uri $server_protocol” $request_length $status $bytes_sent “$http_referer” $remote_addr “$http_user_agent”’; access_log /data/log/access.log access; # Client connection client_body_temp_path /tmp 1 2; client_header_timeout 5s; client_body_timeout 5s; send_timeout 10m; connection_pool_size 256k; client_header_buffer_size 16k; large_client_header_buffers 1024 128k; request_pool_size 128k; keepalive_requests 1000; keepalive_timeout 10; client_max_body_size 10g; client_body_buffer_size 1m; client_body_in_single_buffer on; open_file_cache max=250000 inactive=300s; reset_timedout_connection on;

# Compression gzip on; gzip_static on; gzip_min_length 1100; gzip_buffers 16 8k; gzip_comp_level 9; gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript; gzip_vary on; gzip_proxied any;

# Network optimizations output_buffers 1000 128k; postpone_output 1460; sendfile on; sendfile_max_chunk 256k; tcp_nopush on; tcp_nodelay on; server_tokens off;

# DNS resolver 127.0.0.1;

# HTTP Request ignore_invalid_headers on; index index.html; add_header X-CDN “Served by myself”; add_header Connection close;

server_names_hash_max_size 5120; server_names_hash_bucket_size 256;

upstream_fair_shm_size 1024k;

# Includes include /etc/nginx/conf.d/.conf; include /etc/nginx/sites-enabled/; } {% endhighlight %}

Ensuite, voici le template par vhost (au format twig) que votre robot déploiera :

{% highlight conf %}

server { listen :80; server_name {{ frontends|join(‘ ‘) }}; { % raw %} {% for option in default_options %} {{- option.name }} {{ option.value }}; {% endfor %} {% for location in locations %} {% for rule_expert in location.rules_expert %} # {{ location.name }} location ~ {{ rule_expert.pattern }} { {% for option in location.options %} {{- option.name }} {{ option.value }}; {% endfor %} root /data/tmp/vhosts/{{ vhost }}.nginx_backend/; } {% endfor %} {% endfor %} { % endraw %} error_page 404 /404.html; error_page 500 /500.html; error_page 502 /502.html; error_page 503 /503.html; error_page 504 /504.html; location = /404.html { root /var/www/nginx-default; } location = /500.html { root /var/www/nginx-default; } location = /502.html { root /var/www/nginx-default; } location = /503.html { root /var/www/nginx-default; } location = /504.html { root /var/www/nginx-default; } } {% endhighlight %}

Installation des serveurs source

Matériel

Au niveau matériel il s’agit, dans mon cas, de serveurs Dell R510 avec 12 disques de 2 To, 24 Go Ram, interfaces en 10 Gbps optiques. On commence par déployer les packages dont on a besoin :

aptitude -y install nginx-extras bind9 ntp sysfsutils xfsprogs syslog-ng

Les serveurs source se duplique automatiquement les fichiers mis en cache grâce à une réplication en GlusterFS :

wget http://download.gluster.org/pub/gluster/glusterfs/LATEST/Debian/5.0.3/glusterfs_3.3.0-1_amd64.deb
dpkg -i glusterfs_3.3.0-1_amd64.deb

NTP

On modifie simplement les lignes server du fichier /etc/ntp.conf :

server 10.0.A.201
server 10.0.B.201

DNS

Le service ne sera utilisé qu’en local pour la résolution DNS pour les besoins du nginx. Pour cela, on édite le fichier /etc/bind/named.conf/options :

options {
 directory "/var/cache/bind";
 query-source address * port *;
 forwarders { 10.0.A.201; 10.0.B.201; };
 auth-nxdomain no;
 listen-on-v6 { none; };
 listen-on { 127.0.0.1; };
 allow-query { any; };
 allow-recursion { any; };
 version none;
 max-clients-per-query 0;
 clients-per-query 0;
 recursive-clients 10000;
 minimal-responses yes ;
};

OPTIMISATION SYSTEME

On s’attaque au scheduler disque en modifiant le fichier /etc/sysfs.conf :

block/sdb/queue/scheduler = noop

On pense à adapter la partie en gras en fonction de ses disques. Dans la même idée, on modifier le bootloader grub en modifiant /etc/default/grub :

GRUB_CMDLINE_LINUX="elevator=noop quiet"

puis en mettant à jour grub :

update-grub

Le filesystem de l’espace de cache a aussi son importance :

mkfs.xfs -f -l size=128m /dev/sda3

On adapte aussi le fichier /etc/fstab :

/dev/sdb1 /data/cache/ xfs rw,nobarrier,largeio,noatime,nodiratime,logbufs=8,inode64 0 2

On organise ensuite la réplication entre les serveurs source. La réplication GlusterFS n’est à configurer que sur l’un des noeuds :

gluster volume create cache replica 2 transport tcp source1:/data/cache source2:/data/cache
gluster volume start cache
gluster volume set cache performance.write-behind-window-size 131072
gluster volume set cache cluster.self-heal-window-size 1024
gluster volume set cache cluster.lookup-unhashed off
gluster volume set cache performance.flush-behind on
gluster volume set cache nfs.disable on
gluster volume set cache cluster.self-heal-daemon on
gluster volume set cache performance.cache-size 2147483648
gluster volume set cache performance.io-thread-count 64
gluster volume set cache feature.read-only off

Notez qu’on peut répliquer autant que l’on désire. On prépare ensuite le montage du volume répliquer pour travailler dessus (/etc/fstab) :

source1:/cache /data/tmp glusterfs defaults,_netdev 0 0

net.ipv4.conf.default.rp_filter = 0 
net.ipv4.conf.default.arp_filter = 0
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.all.arp_filter = 0
net.core.rmem_default = 16777216
net.core.rmem_max = 16777216
net.core.wmem_default = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
net.ipv4.tcp_mem = 4096 65536 16777216
net.ipv4.tcp_low_latency = 0
net.core.netdev_max_backlog = 30000
fs.file-max = 262144
kernel.shmmax = 16000000000
kernel.shmall = 16000000000
net.ipv4.tcp_abort_on_overflow = 1
net.ipv4.tcp_syncookies = 0
net.ipv4.tcp_fin_timeout = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.ip_local_port_range = 1024 65535
vm.min_free_kbytes = 65536
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.lo.arp_ignore = 1
net.ipv4.conf.eth0.arp_ignore = 1
net.ipv4.conf.eth1.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.lo.arp_announce = 2
net.ipv4.conf.eth0.arp_announce = 2
net.ipv4.conf.eth1.arp_announce = 2
net.ipv4.tcp_orphan_retries = 0
net.ipv4.tcp_timestamps = 0 
net.ipv4.tcp_sack = 0
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_keepalive_intvl = 1
net.ipv4.tcp_keepalive_probes = 1 
net.ipv4.ip_forward = 1
net.ipv4.conf.default.proxy_arp = 1
net.ipv4.conf.all.proxy_arp = 1
kernel.sysrq = 1
net.ipv4.conf.default.send_redirects = 1
net.ipv4.conf.all.send_redirects = 1
kernel.core_uses_pid=1
kernel.core_pattern=1
vm.dirty_background_ratio = 20
vm.dirty_ratio = 40
vm.swappiness = 1
vm.dirty_writeback_centisecs = 1500
fs.xfs.xfssyncd_centisecs = 360000
fs.xfs.xfsbufd_centisecs = 3000
net.ipv4.tcp_max_syn_backlog = 65536
net.core.optmem_max = 40960
net.ipv4.tcp_max_tw_buckets = 360000
net.ipv4.tcp_reordering = 5
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_no_metrics_save = 1
net.ipv4.tcp_max_orphans = 262144
net.ipv4.tcp_rfc1337 = 0
net.core.somaxconn=262144
net.ipv4.tcp_ecn = 0
net.ipv4.ip_no_pmtu_disc = 0
net.ipv4.tcp_slow_start_after_idle = 0
net.ipv4.tcp_moderate_rcvbuf = 1

A adapter selon les interfaces réseaux et la Ram (partie en gras). On l’applique avec un simple :

sysctl -p

Il est important d’appliquer les limites correspondantes au système (/etc/security/limits.conf) :

*    soft    nofile    262144
*    hard    nofile    262144

Certaines modifications sont à appliquer au démarrage du système (/etc/rc.local) :

ifconfig eth0 txqueuelen 10000
ifconfig eth1 txqueuelen 10000
ifconfig eth0 mtu 9000
ifconfig eth1 mtu 9000
ethtool -K eth0 rx off tx off
ethtool -K eth1 rx off tx off

CACHING

On s’attaque donc à nginx. D’abord pour la partie globale :

{% highlight conf %} user www-data; worker_processes 2; worker_rlimit_nofile 2500004;

error_log /var/log/nginx/error.log error; pid /var/run/nginx.pid;

timer_resolution 1ms;

events { worker_connections 102400; use epoll; multi_accept on; accept_mutex_delay 1ms; }

http { include /etc/nginx/mime.types; default_type application/octet-stream;

log_format access ‘[$time_local] $request_time “$request_method $scheme://$host$request_uri $server_protocol” $request_length $upstream_cache_status $status $proxy_host $upstream_addr $bytes_sent “$http_referer” $remote_addr “$http_user_agent”’; #access_log /data/log/access.log access; access_log off; # Client connection client_body_temp_path /tmp 1 2; client_header_timeout 5s; client_body_timeout 5s; send_timeout 10m; connection_pool_size 256k; client_header_buffer_size 16k; large_client_header_buffers 1024 128k; request_pool_size 128k; keepalive_requests 1000; keepalive_timeout 10; client_max_body_size 10g; client_body_buffer_size 1m; client_body_in_single_buffer on; open_file_cache max=250000 inactive=300s; reset_timedout_connection on;

# Network optimizations output_buffers 1000 128k; postpone_output 1460; sendfile on; sendfile_max_chunk 256k; tcp_nopush on; tcp_nodelay on; server_tokens off;

# DNS resolver 127.0.0.1;

# HTTP Request ignore_invalid_headers on; index index.html; add_header X-CDN “Served by myself”; add_header Connection close;

server_names_hash_max_size 5120; server_names_hash_bucket_size 256;

upstream_fair_shm_size 1024k; # Proxy proxy_cache_path /data/tmp/disk/ levels=1:2 keys_zone=big:1000m max_size=16000G; proxy_temp_path /data/tmp/temp/ 1 2; proxy_cache_valid 404 10m; proxy_cache_valid 400 501 502 503 504 1m; proxy_cache_valid any 4320m; proxy_cache_use_stale updating invalid_header error timeout http_404 http_500 http_502 http_503 http_504; proxy_next_upstream error timeout invalid_header http_404 http_500 http_502 http_503 http_504; proxy_redirect off; proxy_set_header Host $http_host; proxy_set_header Server Apache; proxy_set_header Connection Close; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass_header Set-Cookie; proxy_pass_header User-Agent; proxy_set_header X-Accel-Buffering on; proxy_hide_header X-CDN; proxy_hide_header X-Server; proxy_intercept_errors off; proxy_ignore_client_abort on; proxy_connect_timeout 60; proxy_send_timeout 60; proxy_read_timeout 60; proxy_buffer_size 128k; proxy_buffers 16384 128k; proxy_busy_buffers_size 256k; proxy_temp_file_write_size 128k; proxy_cache_min_uses 0; # Includes include /etc/nginx/conf.d/.conf; include /etc/nginx/sites-enabled/; } {% endhighlight %}

Ensuite, voici le template par vhost (au format twig) que votre robot déploiera :

{% highlight conf %}

proxy_cache_path /data/tmp/disk/{{ upstream }} levels=1:2 keys_zone={{ upstream }}:1000m inactive=4320m max_size=16000G; upstream {{ upstream }}.nginx_backend { { % raw %} {% for backend in backends %} server {{ backend.name }}{% for key, value in backend.options %} {{ key }}={{ value }}{% endfor %}; {% endfor %} { % endraw %} fair; } server { listen :80; server_name {{ frontends|join(‘ ‘) }}; { % raw %} {% for option in default_options %} {{- option.name }} {{ option.value }}; {% endfor %} proxy_no_cache $cookie_nocache $arg_nocache $arg_comment; proxy_no_cache $http_pragma $http_authorization; {% for location in locations %} {% for rule_expert in location.rules_expert %} # {{ location.name }} location ~ {{ rule_expert.pattern }} { {% for option in location.options %} {{- option.name }} {{ option.value }}; {% endfor %} {% for header in location.del_headers -%} proxy_hide_header “{{ header.name }}”; {% endfor %} {% for header in location.mod_headers %} proxy_hide_header “{{ header.name }}”; add_header “{{ header.name }}” “{{ header.value }}”; {% endfor %} proxy_cache {{ upstream }}; proxy_pass http://{{ upstream }}.nginx_backend; } {% endfor %} {% endfor %} { % endraw %} error_page 404 /404.html; error_page 500 /500.html; error_page 502 /502.html; error_page 503 /503.html; error_page 504 /504.html; location = /404.html { root /var/www/nginx-default; } location = /500.html { root /var/www/nginx-default; } location = /502.html { root /var/www/nginx-default; } location = /503.html { root /var/www/nginx-default; } location = /504.html { root /var/www/nginx-default; } } {% endhighlight %}

Installation des serveurs edge

Matériel

Au niveau matériel il s’agit, dans mon cas, de serveurs avec les matériels suivants :

2 CPU Intel E5620 (la plateforme date un peu)
96 Go Ram
6 x 100 Go en SSD
interfaces réseaux optiques 10 Gbps

Ce qui suit est à faire sur l’image PXE ou sur le système local si vous en avez mis un. On commence par déployer les packages dont on a besoin :

aptitude -y install nginx-extras bind9 ntp sysfsutils xfsprogs syslog-ng

NTP

On modifie simplement les lignes server du fichier /etc/ntp.conf :

server 10.0.A.201
server 10.0.B.201

DNS

Le service ne sera utilisé qu’en local pour la résolution DNS pour les besoins du nginx. Pour cela, on édite le fichier /etc/bind/named.conf/options :

options {
 directory "/var/cache/bind";
 query-source address * port *;
 forwarders { 10.0.A.201; 10.0.B.201; };
 auth-nxdomain no;
 listen-on-v6 { none; };
 listen-on { 127.0.0.1; };
 allow-query { any; };
 allow-recursion { any; };
 version none;
 max-clients-per-query 0;
 clients-per-query 0;
 recursive-clients 10000;
 minimal-responses yes ;
};

OPTIMISATION SYSTEME

On s’attaque au scheduler disque en modifiant le fichier /etc/sysfs.conf :

block/sda/queue/scheduler = noop

On pense à adapter la partie en gras en fonction de ses disques. Dans la même idée, on modifier le bootloader grub en modifiant /etc/default/grub :

GRUB_CMDLINE_LINUX="elevator=noop quiet"

puis en mettant à jour* grub* :

update-grub

Le filesystem de l’espace de cache a aussi son importance :

mkfs.xfs -f -l size=128m /dev/sda3

On adapte aussi le fichier /etc/fstab :

/dev/sda3 /data/cache/ xfs rw,nobarrier,largeio,noatime,nodiratime,logbufs=8,inode64 0 2

La partie sysctl est importante (/etc/sysctl.conf) :

net.ipv4.conf.default.rp_filter = 0 
net.ipv4.conf.default.arp_filter = 0
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.all.arp_filter = 0
net.core.rmem_default = 16777216
net.core.rmem_max = 16777216
net.core.wmem_default = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
net.ipv4.tcp_mem = 4096 65536 16777216
net.ipv4.tcp_low_latency = 1
net.core.netdev_max_backlog = 30000
fs.file-max = 262144
kernel.shmmax = 16000000000
kernel.shmall = 16000000000
net.ipv4.tcp_abort_on_overflow = 1
net.ipv4.tcp_syncookies = 0
net.ipv4.tcp_fin_timeout = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.ip_local_port_range = 1024 65535
vm.min_free_kbytes = 65536
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.lo.arp_ignore = 1
net.ipv4.conf.eth0.arp_ignore = 1
net.ipv4.conf.eth1.arp_ignore = 1
net.ipv4.conf.eth2.arp_ignore = 1
net.ipv4.conf.eth3.arp_ignore = 1
net.ipv4.conf.eth4.arp_ignore = 1
net.ipv4.conf.eth5.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.lo.arp_announce = 2
net.ipv4.conf.eth0.arp_announce = 2
net.ipv4.conf.eth1.arp_announce = 2
net.ipv4.conf.eth2.arp_announce = 2
net.ipv4.conf.eth3.arp_announce = 2
net.ipv4.conf.eth4.arp_announce = 2
net.ipv4.conf.eth5.arp_announce = 2
net.ipv4.tcp_orphan_retries = 0
net.ipv4.tcp_timestamps = 0 
net.ipv4.tcp_sack = 0
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_keepalive_intvl = 1
net.ipv4.tcp_keepalive_probes = 1 
net.ipv4.ip_forward = 1
net.ipv4.conf.default.proxy_arp = 1
net.ipv4.conf.all.proxy_arp = 1
kernel.sysrq = 1
net.ipv4.conf.default.send_redirects = 1
net.ipv4.conf.all.send_redirects = 1
kernel.core_uses_pid=1
kernel.core_pattern=1
vm.dirty_background_ratio = 20
vm.dirty_ratio = 40
vm.swappiness = 1
vm.dirty_writeback_centisecs = 1500
fs.xfs.xfssyncd_centisecs = 360000
fs.xfs.xfsbufd_centisecs = 3000
net.ipv4.tcp_max_syn_backlog = 65536
net.core.optmem_max = 40960
net.ipv4.tcp_max_tw_buckets = 360000
net.ipv4.tcp_reordering = 5
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_no_metrics_save = 1
net.ipv4.tcp_max_orphans = 262144
net.ipv4.tcp_rfc1337 = 0
net.core.somaxconn=262144
net.ipv4.tcp_ecn = 0
net.ipv4.ip_no_pmtu_disc = 0
net.ipv4.tcp_slow_start_after_idle = 0
net.ipv4.tcp_moderate_rcvbuf = 1

A adapter selon les interfaces réseaux et la Ram (partie en gras). On l’applique avec un simple :

sysctl -p

Il est important d’appliquer les limites correspondantes au système (/etc/security/limits.conf) :

*    soft    nofile    262144
*    hard    nofile    262144

Certaines modifications sont à appliquer au démarrage du système (/etc/rc.local) :

ifconfig eth0 txqueuelen 10000
ifconfig eth1 txqueuelen 10000
ifconfig eth2 txqueuelen 10000
ifconfig eth3 txqueuelen 10000
ifconfig eth4 txqueuelen 10000
ifconfig eth5 txqueuelen 10000
ifconfig eth0 mtu 9000
ifconfig eth1 mtu 9000
ifconfig eth2 mtu 9000
ifconfig eth3 mtu 9000
ifconfig eth4 mtu 9000
ifconfig eth5 mtu 9000
ethtool -K eth0 rx off tx off
ethtool -K eth1 rx off tx off
ethtool -K eth2 rx off tx off
ethtool -K eth3 rx off tx off
ethtool -K eth4 rx off tx off
ethtool -K eth5 rx off tx off

CACHING

Afin d’optimiser le nombre de socket par machine en fonction des ressources, on affecte plusieurs IP en alias à l’interface publique. De même, on pense à rajouter les IP des VIP à la loopback (/etc/network/interfaces).

auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
 address X.X.A.10
 netmask 255.255.255.0
 gateway X.X.A.1
 post-up ifconfig eth0:0 X.X.A.11/32
 post-up ifconfig eth0:1 X.X.A.12/32
 post-up ifconfig eth0:2 X.X.A.13/32
 post-up ifconfig eth0:3 X.X.A.14/32
 post-up ifconfig eth0:4 X.X.A.15/32
 post-up ifconfig eth0:5 X.X.A.16/32
 post-up ifconfig eth0:6 X.X.A.17/32
 post-up ifconfig eth0:7 X.X.A.18/32
 post-up ifconfig eth0:8 X.X.A.19/32
auto lo:0
iface lo:0 inet static 
 address X.X.A.248
 netmask 255.255.255.255
auto lo:1
iface lo:1 inet static
 address X.X.A.249
 netmask 255.255.255.255

Ensuite, on s’attaque à nginx. D’abord pour la partie globale :

{% highlight conf %} user www-data; worker_processes 32; worker_rlimit_nofile 262144;

error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid;

timer_resolution 1ms;

syslog local5 nginx;

events { worker_connections 262144; use epoll; multi_accept on; accept_mutex_delay 1ms; }

http { include /etc/nginx/mime.types; default_type application/octet-stream;

# Client connection aio off; client_body_temp_path /tmp 1 2; client_header_timeout 5s; client_body_timeout 5s; send_timeout 10m; connection_pool_size 256k; client_header_buffer_size 16k; large_client_header_buffers 1024 256k; request_pool_size 128k; keepalive_requests 1000; keepalive_timeout 10; client_max_body_size 10g; client_body_buffer_size 1m; client_body_in_single_buffer on; open_file_cache max=1000 inactive=3600s; reset_timedout_connection on;

# Network optimizations output_buffers 1000 128k; postpone_output 1460; sendfile on; sendfile_max_chunk 256k; tcp_nopush on; tcp_nodelay on; server_tokens off;

# DNS resolver 127.0.0.1;

# HTTP Request ignore_invalid_headers on; index index.html; add_header X-CDN “Served by myself”; add_header Connection close;

# Proxy proxy_cache_path /data/cache/disk levels=1:2 keys_zone=big:4000m inactive=4320m max_size=500G; proxy_temp_path /data/cache/temp 1 2; proxy_cache_valid 404 10m; proxy_cache_valid 400 501 502 503 504 1m; proxy_cache_valid any 4320m; proxy_cache_use_stale updating invalid_header error timeout http_404 http_500 http_502 http_503 http_504; proxy_next_upstream error timeout invalid_header http_404 http_500 http_502 http_503 http_504; proxy_redirect off; proxy_set_header Host $http_host; proxy_set_header Server Apache; proxy_set_header Connection Close; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass_header Set-Cookie; proxy_pass_header User-Agent; proxy_set_header X-Accel-Buffering on; proxy_hide_header X-CDN; proxy_hide_header X-Server; proxy_intercept_errors on; proxy_ignore_client_abort on; proxy_connect_timeout 10; proxy_send_timeout 10; proxy_read_timeout 10; proxy_buffer_size 128k; proxy_buffers 65536 128k; proxy_busy_buffers_size 256k; proxy_temp_file_write_size 128k;

server_names_hash_max_size 5120; server_names_hash_bucket_size 256;

upstream_fair_shm_size 1024k;

# Includes include /etc/nginx/conf.d/.conf; include /etc/nginx/sites-enabled/; } {% endhighlight %}

Ensuite, voici le template par* vhost* (au format twig) que votre robot déploiera :

{% highlight conf %}

proxy_cache_path /data/cache/disk/{{ upstream }} levels=1:2 keys_zone={{ upstream }}:1000m inactive=4320m max_size=400G; upstream {{ upstream }}.nginx_backend { server X.X.A.101 max_fails=1 fail_timeout=1; server X.X.B.101 max_fails=1 fail_timeout=1; fair; } server { listen :80; server_name {{ frontends|join(‘ ‘) }}; { % raw %} {% for option in default_options %} {{- option.name }} {{ option.value }}; {% endfor %} proxy_no_cache $cookie_nocache $arg_nocache $arg_comment; proxy_no_cache $http_pragma $http_authorization; {% for location in locations %} {% for rule_expert in location.rules_expert %} # {{ location.name }} location ~ {{ rule_expert.pattern }} { {% for option in location.options %} {{- option.name }} {{ option.value }}; {% endfor %} {% for header in location.del_headers %} proxy_hide_header “{{ header.name }}”; {% endfor %} {% for header in location.mod_headers %} proxy_hide_header “{{ header.name }}”; add_header “{{ header.name }}” “{{ header.value }}”; {% endfor %} proxy_cache {{ upstream }}; proxy_pass http://{{ upstream }}.nginx_backend; } {% endfor %} {% endfor %} { % endraw %} error_page 404 /404.html; error_page 500 /500.html; error_page 502 /502.html; error_page 503 /503.html; error_page 504 /504.html; location = /404.html { root /var/www/nginx-default; } location = /500.html { root /var/www/nginx-default; } location = /502.html { root /var/www/nginx-default; } location = /503.html { root /var/www/nginx-default; } location = /504.html { root /var/www/nginx-default; } } {% endhighlight %}

SYSLOG

On envoie les logs nginx directement sur le syslog centralisé, en modifiant le fichier /etc/syslog-ng/syslog-ng.conf :

destination d_remote { tcp("10.0.A.202", port(514)); };
filter f_nginx { facility(local5); };
log { source(s_src); filter(f_nginx); destination(d_remote); };

Installation d’un serveur stats

Matériel

Pour la partie matériel, j’ai pris un HP G7 avec des disques 15k rpm mis en RAID 10. Au niveau réseau, les interfaces gigabit suffisent amplement.

Packages

On installe les packages nécessaires :

aptitude -y install bind9 awstats jdresolve syslog-ng geoip-bin groip-database ntp

NTP

On modifie simplement les lignes server du fichier /etc/ntp.conf :

server 10.0.A.201
server 10.0.B.201

DNS

Le service ne sera utilisé qu’en local pour la résolution DNS des IP utilisateurs au moment de l’écriture des logs (ce qui évitera de le faire a posteriori pendant le calcul des statistiques). Pour cela, on édite le fichier /etc/bind/named.conf/options :

options {
 directory "/var/cache/bind";
 query-source address * port *
 forwarders { 10.0.A.201; 10.0.B.201; };
 auth-nxdomain no;
 listen-on-v6 { none; };
 listen-on { 127.0.0.1; };
 allow-query { any; };
 allow-recursion { any; };
 version none;
 max-clients-per-query 0;
 clients-per-query 0;
 recursive-clients 10000;
 minimal-responses yes ;
};

SYSLOG

On centralise donc l’arrivée des logs nginx via syslog-ng. Pour cela, on édite simplement le fichier /etc/syslog-ng/syslog-ng.conf :

source s_net {
 udp(ip(0.0.0.0) port(514));
 tcp(ip(0.0.0.0) port(514) max-connections(512));
};
destination d_nginx { program("/usr/bin/jdresolve -a - | /usr/bin/php /opt/cdn/bin/dispatch.php"); };
log { source(s_net); destination(d_nginx); };

jdresolve est une application java permettant la résolution DNS à la volée. On le fait à ce moment plutôt que sur le nginx pour éviter de rallonger la durée de traitement de la requête HTTP. Idem, il est fait avant le calcul des statistiques pour ne pas rallonger le traitement. En effet, awstats est une véritable limace quand il s’agit de résoudre la partie DNS. Le script dispatch.php permet de dispatcher la ligne dans un fichier spécifique à son vhost.

foreach (explode("\n", file_get_contents('php://stdin')) as $log) {
 if (empty($log)) continue;
 if (preg_match('%.*".* http://([^/]*)/.* .*".* ([^\s]+).nginx_backend.*".*" .* ".*"%i', $log, $match) === FALSE) {
  die("Invalid log format on line $id.");
 }
 if (isset($match[1])) {
  $dir = '/mnt/nfs/log/'.date('Y/m/d');
  @mkdir($dir, 0777, true);
  $match[0] = substr($match[0], strpos($match[0], '['));
  file_put_contents($dir.'/'.$match[2].'.log', $match[0]."\n", FILE_APPEND);
 } else if (isset($match[0]) && sizeof($match[0])) {
  file_put_contents("/tmp/trash.log", $match[0]."\n", FILE_APPEND);
 }
}

Pensez à modifier le chemin de dépôt pour les logs (en gras).

Statistiques

La partie des statistiques repose sur awstats. Un script permet de collecter les informations en base pour chaque vhost et la génération en dynamique de sa configuration en cas de besoin. Je ne vais pas pouvoir vous fournir le script. Cependant, voici le modèle pour les fichiers de configuration d’awstats.

LogFile="###LOG###"
LogType=W
LogFormat = "%time1 %extra1 %methodurl %extra2 %extra3 %code %extra4 %extra5 %bytesd %refererquot %host %uaquot"
LogSeparator=" "
SiteDomain="###VHOST###"
HostAliases="###FQDN###"
DNSLookup=0
DirData="/var/lib/awstats"
DirCgi="/cgi-bin"
DirIcons="/awstats-icon"
AllowToUpdateStatsFromBrowser=0
AllowFullYearView=2
EnableLockForUpdate=0
DNSStaticCacheFile="dnscache.txt"
DNSLastUpdateCacheFile="dnscachelastupdate.txt"
SkipDNSLookupFor=""
AllowAccessFromWebToAuthenticatedUsersOnly=0
AllowAccessFromWebToFollowingAuthenticatedUsers=""
AllowAccessFromWebToFollowingIPAddresses=""
CreateDirDataIfNotExists=0
BuildHistoryFormat=text
BuildReportFormat=html
SaveDatabaseFilesWithPermissionsForEveryone=0
PurgeLogFile=0
ArchiveLogRecords=0
KeepBackupOfHistoricFiles=0
DefaultFile="index.html"
SkipHosts="REGEX[^X\.X\.A\.] REGEX[^X\.X\.B\.]"
SkipUserAgents=""
SkipFiles=""
SkipReferrersBlackList=""
OnlyHosts=""
OnlyUserAgents=""
OnlyFiles=""
NotPageList=""
ValidHTTPCodes="200 206 300 301 302 303 304 305 307"
ValidSMTPCodes="1 250"
AuthenticatedUsersNotCaseSensitive=0
URLNotCaseSensitive=0
URLWithAnchor=0
URLQuerySeparators="?;"
URLWithQuery=0
URLWithQueryWithOnlyFollowingParameters=""
URLWithQueryWithoutFollowingParameters=""
URLReferrerWithQuery=0
WarningMessages=1
ErrorMessages=""
DebugMessages=0
NbOfLinesForCorruptedLog=50
WrapperScript=""
DecodeUA=0
MiscTrackerUrl="/js/awstats_misc_tracker.js"
LevelForBrowsersDetection=2 # 0 disables Browsers detection.
 # 2 reduces AWStats speed by 2%
 # allphones reduces AWStats speed by 5%
LevelForOSDetection=2 # 0 disables OS detection.
 # 2 reduces AWStats speed by 3%
LevelForRefererAnalyze=2 # 0 disables Origin detection.
 # 2 reduces AWStats speed by 14%
LevelForRobotsDetection=2 # 0 disables Robots detection.
 # 2 reduces AWStats speed by 2.5%
LevelForSearchEnginesDetection=2 # 0 disables Search engines detection.
 # 2 reduces AWStats speed by 9%
LevelForKeywordsDetection=2 # 0 disables Keyphrases/Keywords detection.
 # 2 reduces AWStats speed by 1%
LevelForFileTypesDetection=2 # 0 disables File types detection.
 # 2 reduces AWStats speed by 1%
LevelForWormsDetection=0 # 0 disables Worms detection.
 # 2 reduces AWStats speed by 15%
UseFramesWhenCGI=1
DetailedReportsOnNewWindows=1
Expires=0
MaxRowsInHTMLOutput=1000
Lang="fr"
DirLang="/usr/share/awstats/lang"
ShowMenu=1 
ShowSummary=UVPHB
ShowMonthStats=UVPHB
ShowDaysOfMonthStats=VPHB
ShowDaysOfWeekStats=PHB
ShowHoursStats=PHB
ShowDomainsStats=PHB
ShowHostsStats=PHBL
ShowAuthenticatedUsers=0
ShowRobotsStats=HBL
ShowWormsStats=0
ShowEMailSenders=0
ShowEMailReceivers=0
ShowSessionsStats=1
ShowPagesStats=PBEX
ShowFileTypesStats=HB
ShowFileSizesStats=0 
ShowOSStats=1
ShowBrowsersStats=1
ShowScreenSizeStats=0
ShowOriginStats=PH
ShowKeyphrasesStats=0
ShowKeywordsStats=0
ShowMiscStats=0
ShowHTTPErrorsStats=1
ShowSMTPErrorsStats=0
ShowClusterStats=0
AddDataArrayMonthStats=1
AddDataArrayShowDaysOfMonthStats=1
AddDataArrayShowDaysOfWeekStats=1
AddDataArrayShowHoursStats=1
IncludeInternalLinksInOriginSection=0
MaxNbOfDomain = 10
MinHitDomain = 1
MaxNbOfHostsShown = 10
MinHitHost = 1
MaxNbOfLoginShown = 10
MinHitLogin = 1
MaxNbOfRobotShown = 10
MinHitRobot = 1
MaxNbOfPageShown = 10
MinHitFile = 1
MaxNbOfOsShown = 10
MinHitOs = 1
MaxNbOfBrowsersShown = 10
MinHitBrowser = 1
MaxNbOfScreenSizesShown = 5
MinHitScreenSize = 1
MaxNbOfWindowSizesShown = 5
MinHitWindowSize = 1
MaxNbOfRefererShown = 10
MinHitRefer = 1
MaxNbOfKeyphrasesShown = 10
MinHitKeyphrase = 1
MaxNbOfKeywordsShown = 10
MinHitKeyword = 1
MaxNbOfEMailsShown = 20
MinHitEMail = 1
FirstDayOfWeek=1
ShowFlagLinks=""
ShowLinksOnUrl=1
UseHTTPSLinkForUrl=""
MaxLengthOfShownURL=64
HTMLHeadSection=""
HTMLEndSection=""
BarWidth = 260
BarHeight = 90
StyleSheet=""
color_Background="FFFFFF" # Background color for main page (Default = "FFFFFF")
color_TableBGTitle="CCCCDD" # Background color for table title (Default = "CCCCDD")
color_TableTitle="000000" # Table title font color (Default = "000000")
color_TableBG="CCCCDD" # Background color for table (Default = "CCCCDD")
color_TableRowTitle="FFFFFF" # Table row title font color (Default = "FFFFFF")
color_TableBGRowTitle="ECECEC" # Background color for row title (Default = "ECECEC")
color_TableBorder="ECECEC" # Table border color (Default = "ECECEC")
color_text="000000" # Color of text (Default = "000000")
color_textpercent="606060" # Color of text for percent values (Default = "606060")
color_titletext="000000" # Color of text title within colored Title Rows (Default = "000000")
color_weekend="EAEAEA" # Color for week-end days (Default = "EAEAEA")
color_link="0011BB" # Color of HTML links (Default = "0011BB")
color_hover="605040" # Color of HTML on-mouseover links (Default = "605040") 
color_u="FFAA66" # Background color for number of unique visitors (Default = "FFAA66")
color_v="F4F090" # Background color for number of visites (Default = "F4F090")
color_p="4477DD" # Background color for number of pages (Default = "4477DD")
color_h="66DDEE" # Background color for number of hits (Default = "66DDEE")
color_k="2EA495" # Background color for number of bytes (Default = "2EA495")
color_s="8888DD" # Background color for number of search (Default = "8888DD")
color_e="CEC2E8" # Background color for number of entry pages (Default = "CEC2E8")
color_x="C1B2E2" # Background color for number of exit pages (Default = "C1B2E2")
#LoadPlugin="hashfiles"
#LoadPlugin="geoip GEOIP_STANDARD /usr/share/GeoIP/GeoIP.dat"
ExtraTrackedRowsLimit=500
ExtraSectionName1="Hit cache status"
ExtraSectionCodeFilter1="" 
ExtraSectionCondition1=""
ExtraSectionFirstColumnTitle1="Cache Status"
ExtraSectionFirstColumnValues1="extra3,(.*)"
ExtraSectionFirstColumnFormat1="%s" 
ExtraSectionStatTypes1=H 
ExtraSectionAddAverageRow1=0 
ExtraSectionAddSumRow1=1 
MaxNbOfExtra1=100 
MinHitExtra1=1

Il est intéressant que le script gérant ces statistiques précalcule aussi les pages statiques HTML pour éviter des chargements trop long lors des consultations.

Installation d’un serveur master

Materiel

Au niveau matériel, on recycle ce qu’on a. Il n’y a pas besoin de performances réelles sauf pour la base de données donc le choix est libre.

Packages

On installe les packages principaux :

aptitude -y install ldirectord ipvsadm bind9 ntp

Pour la partie backoffice et outils de cron développés en interne, je vous laisse le choix. Je ne peux pas vous fournir mon code pour le moment. Pour autant, une bonne partie de la magie se passe là concernant le déploiement automatique, la customisation par site et le monitoring.

DNS

Le serveur DNS serveur de forwarders aux autres serveurs DNS. Lui utilisera ceux d’OpenDNS tant qu’à faire. Pour cela, on édite le fichier /etc/bind/named.conf/options :

options {
 directory "/var/cache/bind";
 query-source address * port *;
 forwarders { 208.67.222.222; 208.67.220.220; };
 auth-nxdomain no;
 listen-on-v6 { none; };
 listen-on { 127.0.0.1; 10.0.A.201; };
 allow-transfer { 127.0.0.1; 10.0.0.0/8; };
 allow-query { any; };
 allow-recursion { any; };
 version none;
 max-clients-per-query 0;
 clients-per-query 0;
 recursive-clients 10000;
 minimal-responses yes ;
};

Il servira aussi la zone DNS dédiée au CDN. On préconisera au client (même si l’on perd un peu en performance) de faire des CNAME vers ces enregistrement. Cela évitera d’avoir à le prévenir si l’on fait des changements. Si les changements ne sont pas prévu, que l’on gère les zones clientes en interne, ou que l’on préfère les performances, on se refusera de faire des CNAME.

Load-balancing

On édite le fichier /etc/network/interfaces et on rajoute à l’interface publique (eth0 ici) :

post-up ifconfig eth0:0 X.X.A.248/32
post-up ifconfig eth0:0 X.X.A.249/32

On utilise donc ldirector/ipvsadm. Dans /etc/default/ldirectord on définit le chemin de la configuration :

CONFIG_FILE=/etc/ldirectord.conf

Puis, on modifie le fichier correspondant :

checktimeout=2
negotiatetimeout=2
checkinterval=10
autoreload=yes
logfile="l0"
quiescent=yes
emailalert=support@domaine.tld
virtual=X.X.A.248:http
 real=X.X.A.10:http gate
 real=X.X.A.11:http gate
 real=X.X.A.12:http gate
 real=X.X.A.13:http gate
 real=X.X.A.14:http gate
 real=X.X.A.15:http gate
 real=X.X.A.16:http gate
 real=X.X.A.17:http gate
 real=X.X.A.18:http gate
 real=X.X.A.19:http gate
 real=X.X.A.20:http gate
 real=X.X.A.21:http gate
 real=X.X.A.22:http gate
 real=X.X.A.23:http gate
 real=X.X.A.24:http gate
 real=X.X.A.25:http gate
 real=X.X.A.26:http gate
 real=X.X.A.27:http gate
 real=X.X.A.28:http gate
 real=X.X.A.29:http gate
 service=http
 scheduler=sed
 protocol=connect
 persistent=5
virtual=X.X.A.249:http
 real=X.X.A.10:http gate
 real=X.X.A.11:http gate
 real=X.X.A.12:http gate
 real=X.X.A.13:http gate
 real=X.X.A.14:http gate
 real=X.X.A.15:http gate
 real=X.X.A.16:http gate
 real=X.X.A.17:http gate
 real=X.X.A.18:http gate
 real=X.X.A.19:http gate
 real=X.X.A.20:http gate
 real=X.X.A.21:http gate
 real=X.X.A.22:http gate
 real=X.X.A.23:http gate
 real=X.X.A.24:http gate
 real=X.X.A.25:http gate
 real=X.X.A.26:http gate
 real=X.X.A.27:http gate
 real=X.X.A.28:http gate
 real=X.X.A.29:http gate
 service=http
 scheduler=sed
 protocol=connect
 persistent=5

Pour information sur cette configuration :

gate permet le fonctionnement en DSR du load balancing
persistent définit la durée du sticky pour la session (ici 5 secondes)
autoreload déclenche le rechargement de la configuration à chaque modification du fichier
emailalert nous préviendra par email de tout changement d’état dans la VIP

Plus qu’à lancer relancer l’interface réseau puis le service et voilà la VIP prête.

NTP

On veut que tous les serveurs soit synchro niveau temps. Autant avoir un serveur de référence à proximité. On a donc installé le package. Aucune modification de base à faire.

Du vent dans mes molllets : un vent de jeunesse

2012-09-05T11:11:01+02:00

Après une publication à succès aux formats livre et BD, Raphaële Moussafir nous offre une version cinéma de son oeuvre Du vent dans mes mollets. Elle nous y raconte donc les déboires de la jeune Rachel qui, du haut de ses neuf ans, vit bien des aventures après sa rencontre avec Valérie. Transportés dans les années 80 par son récit, nous transporte-t-elle également dans ses émotions ? Chronique d'une enfant des années 70/80.

La jeunesse et ses soucis

L'introduction animée, façon Alinéa, nous raconte la naissance et les très jeunes années de la petite Rachel. On voit donc en accéléré toutes les tristesses qui l'ont traumatisée au point de dormir habillée et avec son cartable sur le dos. Bonne pour un tour chez le psy selon sa mère.

[video]http://www.youtube.com/watch?v=ovPGdCoPmzc[/video]

Arrivée à neuf ans, dans une nouvelle classe, elle rencontre donc l'intrépide Valérie. Fille d'une mère célibataire, celle-ci est prête pour les 400 coups dans lesquels elle embarque Rachel.

On se fait donc transporté au début des années 80 (1981, la meilleure :-P) les larmes aux yeux tellement on rigole. C'est dans les petits détails que l'on reconnait les bons artisants dit le père. C'est dans les détails du décors, des scènes et du magnifique jeune d'acteurs (Agnès Jaoui mais aussi les deux jeunes gamines) que l'on admire et reconnaît le travail de qualité. Les cuisines kitch. Les tenues hautes en couleur. Les parents qui se parlent en franglais pour que la jeune tête blonde ne comprenne pas (selon eux).... Un moment quasi inoubliable.

Mais, parce que je suis mauvais en râlerie, voici les (rares) points noirs relevés :

tellement de participants au film qu'on nous détaille même les employés de la cantine du tournage ou la marque de café pour le ravitaillement ; faut bien une durée minimale au générique
tout est fait dans le détail des années 80 sauf ... la signalisation routière trop moderne ; penser aux cyclistes sur la route, c'est plus récent ...

Tout ceci n'enlève rien à la réussite du film qui mérite qu'on aille prendre sa place. Enfin un bon film français dans les règles de l'art et ca faisait (presque) longtemps qu'on en attendait.

Revue du web du 3 septembre 2012

2012-09-03T16:42:07+02:00

C’est lundi. C’est la pluie. C’est pas rose. C’est la faute à morose. Mais bon, il y a toujours de la musique pour nous ramener un peu de baaume au coeur. Ainsi il ira alors de la revue du web du jour. Au passage, allez faire un tour sur cette page du blog pour écouter (et soutenir) des talents emmergeants.

Quentin Tarantino dans un mashup hommage

La semaine dernière, Kubrick a eu le droit à un hommage en vidéo. Cette fois, c’est au tour du déjanté Quentin Tarantino de passer à la moulinette d’un mashup en règle. Hommage de qualité. via Golem13.

Le web et ses mashup

A croire que c’est la mode de faire des mélanges. Cette fois ci, on nous mélange des bandes sons de films et chansons diverses pour un résultat sans équivoque. Du pur plaisir pour les oreilles. via Golem13.

Il n’est pas bon d’écouter la musique trop fort

Même quand il s’agît du magistral Highway to Hell d’AC-DC. C’est la dure leçon apprise par cette femme qui a eu la visite régulière de la police : quatre fois en 26h. Bon le titre est magnifique, on se le passe facilement en boucle en montant le son. Il faut croire que ce n’est pas du goût de tous. via Golem13 (oui encore !)

Les androïdes jouent-il de la musique ?

C’est une question que Philip K. Dick aurait pu se poser. On voit de plus en plus de présentation de robots aux activités diverses. Dans le cas présent, un robot à 4 bras qui se déchaîne sur sa batterie. Ok, c’est programmé. Ok, on y perd l’âme de l’artiste. Mais le résultat est là. Ca ne vaut Franck Beard des ZZ-Top qui se défonce à la batterie du haut de ses 63 ans dans de longs solos mémorables. via JdG.

Revue du web du 31 août 2012

2012-08-31T12:19:10+02:00

C’est Trolldi. Une semaine sans billet c’est long alors une bonne revue du web pour se détendre et pour compenser. Bon surf !

Beer chase : il y a des priorités dans la vie

Et dans le cas présent, les voleurs préfèrent la bière à l’argent. La bière Carlton Draught s’offre une pub kitchissime avec un bon feeling des années 80 avec une course poursuite entre la police et des voyous. C’est sûrement de la pisse comme diraient certains mais c’est vendeur.

Batman au pays des Tigre & Dragon

Cartoon Network présente régulièrement, au travers du DC Nations, des courts métrages issue de l’univers de DC. Une vidéo qui fait le tour du net est celle du mashup entre Batman (accompagné de Catwoman et Bane) et la Chine médiévale. Un régal.

Le web, le cloud et les américains

On savait les américains légèrement incultes et limités dans leur compréhension du monde mais là je crois qu’il y a une absence totale de capacité d’abstraction. L’information est remontée par le JdG dans un article d’hier. Seuls 16% des américains savent ce qu’est le cloud. Une personne sur deux pensent que la météo influe sur le service. Quand on vous dit que notre métier est du maraboutage.

Je vous mets un petit bout de cervelle avec ca ?

Beaucoup foncent au Camion qui fume en ce moment. Aux US, c’est une pratique très répandu au point qu’il faut avoir de l’imagination pour se démarquer. The Gory Gourmet vous proposer donc la version Zombies. Comme une odeur de vache folle. Why not ?

Kubrick n’est pas cubique

Bon elle était facile celle-là. Kubrick est un maître du cinéma et de la perspective qu’il utilise à foison dans ses films. Golem13 nous présente un petit mashup de ses films avec la bande son (envoutante et magnifique) de Requiem for a Dream. Petit hommage en soi au maître.

Go on : retour de Matthew Perry encore plus speed

2012-08-25T21:11:33+02:00

{.left} Matthew Perry, le Chandler Bing de Friends, revient dans une nouvelle sitcom après l’échec de Mr Sunshine, son projet personnel abandonné par ABC. Traits tirés, poids perdus, le comique de service est-il de retour pour le meilleur ou pour le pire ? En tout cas sa dynamique réclame qu’on le suive. Go on sera diffusée sur NBC à partir de septembre mais son pilote a déjà été diffusé par le network américain.

Matthew Perry sous crack

Autant son projet personnel était dynamique, autant il a été quelque peu mal mené et surtout mal vendu par ABC. Pour autant, il ne s’est pas laissé abattu et a rempilé pour un nouveau projet proposé par Scott Silveri.

J’ai pu voir le pilote. L’acteur se montre fatigué mais pour autant n’a pas perdu de son speed et de son décallage. Animateur radio mis au repos par sa direction suite au décès de sa femme, on lui demande de suivre une thérapie. Le groupe d’anonyme qui lui est affecté travaille sur les “changements de vie”. Entre les difficultés d’intégration, la perte d’un proche, les ennuis de santé, les phobies, … chaque personne du groupe à une multitude de problèmes sur lesquels il doit travailler. Tout un programme.

La thérapiste, aux faux airs de Courteney Cox, a du mal à canaliser l’énergie de Matthew Perry qui ne demande qu’une chose : partager son énergie et maquiller sa propre douleur. Une morale en ressort : il y a toujours pire. Donc, autant regarder vers le haut. Une série à découvrir en septembre.

Vos enfants 2.0

2012-08-25T14:04:24+02:00

Je vais faire mon vieux, mais à mon époque, lorsque l’on cherchait des infos, on sortait et finissait à la bibliothèque. Aujourd’hui, c’est de plus en plus rare de le voir. L’information (qu’il faut apprendre à confirmer) est disponible facilement via internet. Les enfants d’aujourd’hui sont connectés de plus en plus jeune. Et lorsque je vois les débordements qu’il y a (pédo-pornographie, facilité d’accès à des contenus sensibles, …) et la dérive qui en découle dans le comportement de nos enfants, j’ai peur. Du coup, vu que l’un de mes neveux (12 ans) a besoin d’un ordinateur, tant qu’à faire, autant le lui préparer, le sécuriser et lui apprendre à s’en servir. Je m’intéresse dans l’article présent à la sécurisation du PC et surtout du surf de cette petite tête blonde. Je suppose que vous lui avez déjà installer le nécessaire pour le loisir et les études.

Les enfants et les bonnes pratiques à leur inculquée

Déjà, on ne va pas céder totalement à la facilité. Totalement, car autant je ne lui mettrais pas un Windows, autant il aura le droit à une Ubuntu 12.04. Par contre, cela n’empêche pas d’y faire un ménage salvateur (liste non exhaustive) :

Thunderbird, Evolution
Empathy, Pidgin
les accès au bureau à distance

Ensuite, on pense à installer, même si on n’est pas trolldi, un anti-virus. Ce n’est pas le seul ordinateur de la maison, et il risque aussi d’échanger avec l’extérieur (famille, amis…). J’ai choisi pour le coup ClamAV.

sudo apt-get install clamav clamtk

On rajoutera une crontab pour mettre à jour régulièrement la base et pour scanner la machine :

0 18 * * * /usr/bin/freshclam --quiet
10 18 * * * /us/bin/rclamscan -r /

Au besoin, je me connecterais pour le faire à la main. Niveau firewall, j’install ufw pour le moment mais je verrais plus tard pour en faire la configuration selon les besoins, vu qu’il y a déjà un pare-feu dans la maison. On pensera à se garder un compte d’administration sur la machine et à restreindre les droits d’utilisation de l’enfant en lui interdisant tout ce qui est tâche d’administration. Ca se passe simplement dans Users and groups.

Les enfants, un ordinateur et internet

Personnellement, je pense qu’à 12 ans, on ne sait pas ce qui est bon pour nous sur internet et qu’on a besoin d’une supervision compétente. Du coup, exit les emails pour le moment. Au pire, on lui donnera un compte dont on gardera le mot de passe pour pouvoir surveiller. Idem pour tout ce qui est chat. De plus, ils viendront bien vite à y passer trop de temps donc autant encore le limiter comme on le fait pour la TV ou les jeux vidéos (si-si, il faut limiter).

Limiter le temps d’utilisation

Nanny n’étant plus suivi, je me repporte sur TimeKpr (en me basant sur la doc Ubuntu). Au moment de l’écriture de ce billet, la version pour Precise n’est toujours pas disponible donc on suit la version pour Oneiric en ajustant.

sudo add-apt-repository ppa:timekpr-maintainers/ppa
sudo sed -i.bak 's/precise/oneiric/' /etc/apt/sources.list.d/timekpr-maintainers-ppa-precise.list 
sudo rm /etc/apt/sources.list.d/timekpr-maintainers-ppa-precise.list.bak
sudo aptitude update
sudo aptitude install timekpr
sudo echo "account required pam_time.so" >> /etc/pam.d/lightdm
sudo sed -i.bak '/^OnlyShowIn=/s|$|Unity;|' /etc/xdg/autostart/timekpr-client.desktop
sudo rm /etc/xdg/autostart/timekpr-client.desktop.bak

Ensuite, le lancement se fait simplement :

soit par le menu System -> Administration -> TimeKpr Control Panel
soit sous Unity, simplement en tappant TimeKpr dans la recherche d’application

L’interface étant assez simple, je ne vais pas rentrer dans le détail. Par contre, il semble que certains bugs soient toujours d’actualité. Toujours selon la doc :

Irrespect des limites de temps On modifie le fichier /usr/share/python-support/timekpr/timekpr.py pour faire deux modifications. On remplace à la ligne 124

u = getcmdoutput('users')

par

u = getcmdoutput('ps -e -o ruser')

On fait de même à la ligne 207 en remplaçant :

if not isnotified(username):

par

if isfile(conffile) and not isnotified(username):

Pas d’affichage du temps restant On modifie le fichier

/usr/share/python-support/timekpr/timekpr-client.py

en ajoutant après la ligne 42 :

self.lastNotified = datetime.datetime.fromtimestamp(0);

On a donc installé le strict nécessaire au niveau utilisation et on s’est assuré de limiter l’usage de l’ordinateur. Il est donc maintenant temps de filtrer le grand n’importe quoi qu’est internet.

Filtrage du web

On va le faire avec une combinaison Squid/DansGuardian. Pensez à modifier les IP.

sudo aptitiude install squid dansguardian

Squid ne sera utilisé que via le* localhost* car c’est* DansGuardian* qui sera considéré comme proxy dans les configuration. Pour DansGuardian, il faudra commencer par commenter la ligne UNCONFIGURED dans /etc/dansguardian/dansguardian.conf. On définit aussi le langage pour les erreurs.

language = 'french'

Vu qu’on ne veut pas que l’enfant puisse facilement désactiver les paramètres du proxy sur Firefox, on les écrit en dur dans la configuration de Firefox /usr/lib/firefox/firefox.cfg :

lockPref("network.proxy.http","10.202.0.1");
lockPref("network.proxy.http_port",8080);
lockPref("network.proxy.type",1);
lockPref("network.proxy.no_proxies_on","localhost,127.0.0.1");
lockPref("network.proxy.share_proxy_settings", true);

Il faut ensuite activer le vérouillage dans le fichier /etc/firefox/syspref.js :

pref("general.config.obscure_value", 0);
pref("general.config.filename", "firefox.cfg");

Petit cadeau pour mon neveu

Il est fan des jeux de type RPG et veut s’en faire. Je ne vais pas lui mettre RPG Maker qui est pour Windows seulement, mais par contre un équivalent sous Linux, avec un petit jeu bonus. Ca sera toujours ça en attendant qu’il apprenne à coder.

wget http://hamsterrepublic.com/ohrrpgce/archive/debian/ohrrpgce_2012.07.31.alectormancy+2-5284_i386.deb
wget http://hamsterrepublic.com/ohrrpgce/archive/debian/vikings-of-midgard_2012.07.31.alectormancy+2-5284_i386.deb 
aptitude install libncurses5\:i386 libsdl-mixer1.2\:i386 libsdl1.2debian\:i386 libx11-6\:i386 libxext6\:i386 libxpm4\:i386 libxrandr2\:i386 libxrender1\:i386
dpkg -i  ohrrpgce*.deb vikings*.deb

Revue du web du 24 août 2012

2012-08-24T13:23:20+02:00

C’est vendredi, c’est ravioli … Non c’est pas ça ! C’est ravioli, c’est trolldi … presque ! C’est vendredi, c’est trolldi ! Revue du web pour se faire plaisir.

Les jeux qu’on a joué mentalement

Gamins, que ca soit dans la rue, la cour, le jardin, en voiture, on s’est tous imaginé des histoires ou des jeux auxquels on jouait. Journal du Graphique nous présente une vidéo de Followthefoot assez sympa qui les remet en image. Je vous conseille au passage d’explorer sa chaîne Youtube, elle vaut vraiment le détour.

Le Web redécouvre les GIF animés

Le micro-blogging photo de Tumblr : vous connaissez. Mais certains semblent (re)découvrir les GIF animés et les considèrent comme une révolution. Pourquoi pas. Chacun y va de son train d’images. Même les community manager. Parfois, c’est drôle, comme celui d’Orange. Chez Orange, c’est trolldi tous les jours.

Fan de modélisme et des Avengers, c’est par ici

Certains occupent leur vendredi différemment. Journal du Geek nous présente un fan des deux ayant reproduit l’héliporteur du film. Par contre, dans Captain Sky, il y en avait un paquet à la fin. D’ailleurs à croire qu’il faut être borgne pour commander ces machines.

On se demandait comment le sol de l’Etoile Noire pouvait être aussi brillant

Et bien avec un nettoyage régulier et un petit passage de cape … pardon, de serpillère. Via @jeremybenmoussa sur Twitter.

Krung Thep : un Thaïlandais à Belleville

2012-08-24T10:00:10+02:00

Bon ok, c'est facile, il y a trois quartiers asiatiques à Paris : rue au Maire, dans le III^e arrondissement, le Triangle de Choisy, dans le XIII^e, Belleville, à cheval sur le XIX^e et le XX^e. Pour autant, la majorité des restaurants proposés sont des Chinois ou des Japonais (en style de nourriture, je parle). Pour le coup, j'ai pu testé un Thaïlandais : Krung Thep. Dépaysement ? Goût ? Voyagons et découvrons.

Un Thaïlandais mitigé

La devanture s'apparente à n'importe quel restaurant asiatique du quartier. Par contre, contrairement aux cantines chinoises de la rue de Belleville, une fois la porte passée, on se retrouve presque en Thaïlande.

Alors que bien des restaurants Thaïlandais se contente de chaises et tables à l'occidentale, ici, on vous propose une mise à table plus proche de la thaïlandaise. Proche car on ne vous l'impose pas. Alors que l'on devrait s'assoir en tailleur et s'accouder à une table basse, la table est réhaussée et les coussins vous offrent le choix entre une position occidentale ou l'attendu tailleur. Il faudra cependant un minimum de souplesse pour s'installer : on n'y emmènera pas nos vieux. L'ameublement et la décoration sont là pour vous orienter vers un esprit du pays bien que le batiment et le quartier se rappellent vite à vous. A noter aussi l'intégralité du personnel féminin. Après tout, la thaïlande a une culture matriarcale. Pour autant, le service peut paraître assez froid (étonnant en comparaison au Tibétain).

Le menu à rallonge m'inspire peu ou trop. En effet, trop de choix tue le choix. Mais surtout, trop de choix signifie pas de spécialisation et un à peu près en tout. Et c'est bien là le cas. Après un choix compliqué pour varier les saveurs et tester un maximum de choses, on s'affaire à goûter. Et là, rien d'exceptionnel. C'est bon, mais sans plus.

Pour avoir testé rapidement par le passé d'autres restaurants Thaïlandais, je peux vous le dire, celui-ci n'a rien d'exceptionnel. Il ne restera pas dans les annales. Mais le cadre et le niveau correct de la nourriture vous offriront une excellente alternative aux cantines chinoises de Belleville si vous êtes dans le quartier.

Dupliquer une machine sous Linux en ssh (à la bourrin)

2012-08-23T19:48:17+02:00

Pour des besoins divers, j'ai besoin de dupliquer un grand nombre de machines. Dans le cas de ces derniers jours, je dois faire du P2V sur une plateforme d'une 50e de machine. Le P2V, c'est transformer une machine physique en machine virtuelle (pour le coup sur VMWare). La plateforme étant en production et le calendrier définissant une migration s'étalant sur un mois, je duplique tout maintenant, fait la bonne configuration et ferait juste un offset des sites web (scripts PHP, images, bases SQL) au moment de la bascule avec les DNS. Petit décryptage de comment se simplifier la vie. Le but est d'être rapide et efficace et d'avoir peut de boulot à refaire.

1 - Avant propos

Selon vos besoins et le nombre de machines certaines étapes peuvent être supprimées. Dans mon cas, on ouvrira un tunnel SSH via une machine qui sert de passerelle pour le transfert.

Dans la suite on nommera :

bridge : la machine qui sert pour le tunnel SSH
phy1 ... phy9 : les machines physiques 1 à 9
vm1 ... vm9 : les vm1 à vm9 qu'on aura préparé sur notre infra (VMWare, Xen, Proxmox ...) avec les bonnes spécifications matériel (on gardera une cohérence avec les machines physiques au niveau des numéros dans la suite)
login : le login qu'on utilise non root qu'on utilise par défaut sur les serveurs

On suppose que notre machine perso est sur une Debian-like pour install des packages manquant. On suppose également que les configurations serveurs sont homogènes sur le parc de serveurs physiques (sinon rapprenez vos bases).

2 - Préparer sur les machines physiques (pré-configuration SSH)

Vu qu'on a une plateforme existente, on suppose qu'on a les moyens de s'y connecter facilement via une patte réseau de management (clées SSH + sudo par ex).

Sur notre machine on installera le package cssh.

$ sudo aptitude install clusterssh

Ce package permet de lancer plusieurs sessions SSH via une seule ligne de commande et d'y reproduire les mêmes commandes sur chaque session.

On se génère aussi une clé SSH (type RSA) :

$ ssh-keygen -t rsa

On met ensuite la clé .ssh/id_rsa.pub disponible en HTTP pour la plateforme physique (et pas pour la Terre entière !). Pensez à la supprimer après la duplication.

On se connecte alors à chaque machine et on y exécute les commandes suivantes.

$ cssh phy1 phy2 phy2 ...  phy9
$ sudo su -

On aura besoin de l'accès root pour le transfert, donc on se l'autorise temporairement en SSH.

# mkdir -p .ssh
# wget http://mon-serveur-perso/macle.pub -O - >> .ssh/authorized_keys

Ne cherchez ma clé publique, elle n'est pas sur le net.

Choisissez ensuite votre éditer favori (vim, nano, ed...) pour éditer le fichier /etc/ssh/sshd_config :

- PermitRootLogin no
+ PermitRootLogin yes
+ AllowUsers root@bridge login@* - RSAAuthentication no
- PubkeyAuthentication no
- #AuthorizedKeysFile %h/.ssh/authorized_keys
+ RSAAuthentication yes
+ PubkeyAuthentication yes
+ AuthorizedKeysFile %h/.ssh/authorized_keys

Si vos équipes de dev se connectent aussi en SSH, pensez à les rajouter dans les AllowUsers. On peut alors relancer le service sshd :

# /etc/init.d/ssh restart

On pense à s'assurer que le package rsync est installé.

# aptitude install rsync

On prendra le temps d'analyser la volumétrie des dossiers pour ne pas copier ce qui n'est pas vraiment nécessaire. Donc mon cas, je cherche à ne pas trop me casser la tête, donc je ne transfert pas ce qui est de type backup et aussi les montages NFS (que j'ai armonisés en les montant en sous-dossiers de /mnt/nfs).

On peut alors se délogguer de ces machines.

3 - Lancer la synchro en rsync via un tunnel SSH

Afin d'éviter de trop saturer les liens réseaux (vu que l'ancienne plateforme physique reste en production le temps du transfert), on évitera de faire trop de duplication en simultané.

On démarre donc la vm1, qui remplacera phy1 et que l'on aura préalablement bien provisionné. La machine sera démarrée sur un liveCD (personnellement, je démarre sur une ISO Gentoo). Une fois l'OS disponible, on se lance un terminal si l'on est sur l'interface graphique. Ensuite, tout se fera de la même manière, en ligne de commande. Je suppose que vous connaissez la configuration IP qui va bien pour vm1.

$ sudo ifconfig eth0 IPVM1/CIDR
$ sudo route add default gw IPGW

On partitionne le disque comme il faut. Là encore j'ai une préférence pour le vieillissant cfdisk. Ensuite formatage des partitions. Puis montage. On supposera que l'on a fait très basique avec juste un / accompagné d'un /boot et d'un swap pour le partitionnement du disque /dev/sda (ADAPTEZ !).

$ sudo mount /dev/sda3 /mnt/gentoo
$ sudo mkdir /mnt/gentoo/boot 
$ sudo mount /dev/sda1 /mnt/gentoo/boot
$ mkdir .ssh
$ echo "Host phy1" >> .ssh/config
$ echo " ProxyCommand nohup ssh bridge nc -w1 %h %p" >> .ssh/config
$ wget http://mon-serveur-perso/macle.priv -O .ssh/id_rsa

Encore une fois, inutile de chercher ma clé privée ...

On peut enfin s'occuper du transfert. Certains dossiers sont donc à éviter. A vous d'en rajouter.

$ sudo rsync -av --progress root@phy1:/* /mnt/gentoo/ --exclude="/dev/*" --exclude="/sys/*" --exclude="/proc/*" --exclude="/mnt/nfs/*/*"

Maintenant que c'est fini, occupons-nous de la configuration finale.

$ sudo mount -t proc none /mnt/gentoo/proc
$ sudo mount -t sysfs none /mnt/gentoo/sys
$ sudo cp -a /dev/* /mnt/gentoo/dev
$ sudo mount -o bind /dev /mnt/gentoo/dev
$ sudo chroot /mnt/gentoo /bin/bash

Vu qu'on a supposé être sur une Debian, on modifiera les fichiers suivant comme il va bien :

/etc/fstab
/etc/hosts
/etc/networks
/etc/network/interfaces
/etc/ssh/sshd_config (pour supprimer les modifications faites au point 2)
/etc/udev/rules.d/70-persistent-net.rules ou z25-persistent-net.rules (ou du genre, selon la version, qui est à vider de son contenu)

Je vous laisse adapter aux applications installées sur la machine. De la même manière, on purge la clé SSH rajoutée pour le transfert. Ensuite il faut mettre à jour grub.

# update-grub
# /usr/sbin/grub-install /dev/sda

Sur certaines vieilles Debian, il m'est arrivé de devoir modifier le fichier /boot/grub/menu.lst et /etc/mtab à la main avant de lancer grub-install.

Une fois fini, il vous suffit de redémarrer la VM sans l'ISO de Gentoo et voilà!

A reproduire pour chaque migration P2V.

4 - Nettoyage

Une fois les machines dupliquées (ou à chaque), on pense à faire un rollback des modifications du point 2 en supprimant la clé SSH et en remodifiant la configuration de SSH.

Revue du web du 23 août 2012

2012-08-23T14:58:47+02:00

Il fait beau. Les oiseaux chantent. Les navets sont au cinéma. L'estomac se creuse. Les méninges se réveilles sur le web. Petite revue du jour ...

Jack Bauer se recycle dans la patisserie

La vidéo a fait le tour du web hier et j'ai pu en profiter au cinéma pendant les bandes annonces aussi. Jack Bauer veut faire de la patisserie et avoir une boutique en ligne. Donc il se trouve un geek pour le faire mais surtout, le nouvel ultrabook Acer.

[video]http://www.youtube.com/watch?v=5zemXwxg8Og[/video]

Le web montre le meilleur ... de nos photographes

Il n'est pas question de Mme Michu et de ses photos ou de mon blog et mes ridicules clichés de promenades mais simplement d'une collecte de photos pro ... bonnes pour la poubelle. Certains photographes devraient se demander pourquoi il y a des écoles de photographies. Vous n'êtes pas un photographe.

Un webdesigner propose son CV façon Zelda

Alors que certains ne savent toujours pas rédiger un simple CV sans faute. Alors que d'autres préfère remplacer le papier par la chanson. Alors que certains tentent le CV vidéo. Daniel Sternlicht propose son CV en un jeu HTML aux graphismes qui ne sont pas sans rappeler les vieux Zelda. Ca s'appelle "savoir se vendre".

Quand des femmes défendent Assange

Ca se passe dans les colonnes web (papiers aussi ?) du Guardian. Katrin Alexsson et Lisa Longstaff dénonce une machination politico-judiciaire. Alors qu'elles se revendique Femmes (logique) et contre le viol (re-logique), elles rappellent les nombreux non-respects de procédure dans l'affaire, le changement de dénomination du dossier, les manipulations médiatiques. Elles mettent également en exergue que les médias majeux s'intéresse à Assange comme s'il avait été déclaré coupable. De même, elles opposent le comportement des autorités anglaises contre Assange, à leur comportement contre Pinochet à l'époque. On rajoute ceci aux déclarations du jour d'un des avocats d'Assange, le dossier est loin d'être fini. Merci mesdames pour votre article.

The expendables 2 ou une indigestion bouchère d’action

2012-08-23T10:21:26+02:00

Le premier film avait été un plaisir : réunir un wagon de stars des films d'actions des 30 dernières années sur un seul plateau. Scénario et réalisation pour Sly, qui n'est plus un débutant. Le film se présentait bien malgré un accueil mitigé à l'époque. Selon les codes des nanards d'actions, il avait cependant peu de points faibles.

Aujourd'hui, XP2012 (comme écrit sur l'avion de Sly), change de réal et de scénariste. Il présente de nouvelles têtes. Il nous fait des promesses. C'était hier sa sortie officielle. C'est ce matin que je me fais un maximum d'ennemis, sans spoiler.

De l'action nerveuse ... même derrière la caméra

Bon c'est tout excité que je fais mon téméraire pour me taper un block-buster au ciné le jour de sa sortie. Après tout, c'est un film sous testostérone donc autant faire ressortir la mienne.

[video]http://www.youtube.com/watch?v=7rkdTcQLwZ4[/video]

Sly avait été très fédérateur pour le premier opus. D'ailleurs, on ressentait un certain plaisir pour ses collègues de jouer devant sa caméra. On s'étonne alors qu'il ait laissé sa place de réal et de scénariste à Simon West. Simon West n'est pas un inconnu de l'action pour autant. Au cinéma, il nous a déjà réalisé les Ailes de l'Enfer (plutôt bon), le déshonneur d'Elisabeth Campbell (très mauvais) et Lara Croft (plutôt mauvais). Côté série, il s'est attaqué aux pilotes de Human Target et The Cape, tous deux motivant les spectateurs. A croire que le cinéma n'est pas sa tasse de thé. Aujourd'hui, il désire offrir une suite à The Expendables, suite justement expendable (sacrifiable) car pas indispensable.

Alors oui, à vouloir faire une suite à tout prix, on est obligé de faire de la sur-enchère. Cependant certaines choses manquent ou sont mal faites. L'absence de Mickey Rourke au bar est bien malheureuse. Tout comme les acteurs espérés (un jour ?) : Jackie Chan (indisponible), Nicolas Cage (trop cher), John Travolta (non intéressé), Antonio Banderas (indisponible), Clint Eastwood (?), Steven Segal (?), Wesley Snipes (en prison pour fraude fiscale - libéré en 2013) ... Par contre, d'autre sont présents : Schwarzy (avec une tenue rappelant le premier Terminator), Bruce Willis, Chuck Norris, mais surtout (et malheureusement quelque part), Jean-Claude Van Damme bien trop aware. Liam Hemsworth représente la très jeune vague d'acteurs de films d'action.

Alors pour ces nouveaux (qui ne sont pas que des caméos), comment s'intègrent-ils ? Pour ce qui est de Willis, rien à dire, il n'a jamais arrêté et a même fait évolué son personnage de simple flic à agent de la CIA (Sans issue par ex). Egale à lui-même.

Schwarzy avait mis sa carrière d'acteur en stand by. Il n'a jamais eu un jeu parfait surtout avec ses difficultés de prononciation pour ses premiers films. Cependant, il a toujours été convaincant. Là encore, il ne déroge pas à la règle et répond à ce dont on attend de lui.

Chuck Norris est l'archétype de l'acteur qui n'a pas pris la grosse tête alors que tout le monde et surtout tout internet parle de lui. L'auto-dérision lui était déjà connu après les Chuck Norris Facts. Sa prestation continue dans ce sens et l'arrivée du Texas Ranger pour les sauver tous est à savourer. D'ailleurs un des facts est repris : "Un jour, un cobra royal a mordu Chuck Norris. Après cinq jours de longue agonie, le cobra est mort".

Liam Hemsworth a le spectre de l'un de ses ainés à combattre (Chris, vu dans Thor et The Avengers entre autres). Et avoir la même trombine et le même regard que son frangin ne va pas l'y aider s'il reste dans les films d'action. Mais bon, il ne joue pas trop mal ... tant que le script (merci West ...) ne le démolie pas : ex-soldat, il dit avoir abandonné l'armée à cause des atrocités de la guerre. C'est sûr que se faire recruter comme boucher dans une équipe de mercernaires, ca sera bien moins violent.

JCVD. Un cas à part. On ne le présente plus. Par contre, on rigole de son retournement de veste. Il était connu qu'il avait refusé l'invitation pour le premier opus car il n'avait pas envie de perdre contre Jet Li et qu'il ne croyait pas en ce projet. Pour autant, dans une récente interview, il annonce que c'est simplement pour des raisons d'emploi du temps. Vu l'avancé de son projet, cette raison est peu valable. Avec cette mauvaise fois, se rajoute un jeu d'acteur en déclin. Il partait pourtant de très bas. Le travail aide ... Ridicile. D'ailleurs, il interprête le vilain de l'histoire, sobrement nommé Vilain. C'est dire.

Au niveau du film en lui-même, que dire ? Dès le début, un goût de déjà-vu se fait sentir. C'est sûr, l'intro n'est pas sans rappeler le dernier A-Team. Et ce sentiment se renforcera à chaque cliché, à chaque clin d'oeil. En fait, si on veut faire court, là où The Expendables était un agréable plaisir bourré d'action rénovée, ce second film n'est qu'un immense clin d'oeil proche d'un fanfic. Les acteurs se balancent leurs répliques cultent (ou se les échangent). Les plans vu dans les autres films s'enchaîne. Par ex, un hélico abattu par Bruce Willis avec une voiture dans Die Hard 4, se transforme en un hélico abattu par Sylvester Stallone. Les tenues sont là aussi pour rappeler les précédents films : tenue de Terminator pour Schwarzy, tenues de Demolition Man et Rocky pour Sly par ex.

Tout ceci pourrait tirer le film vers le kitch qui plait presque sans problème si la réalisation suivait. Enormément d'erreurs. Trop d'erreurs. D'ailleurs, inspirés de cette émission, les muscles devraient s'occuper de son cas mais surtout du directeur de la photographie. Ca manque de bimbos ! Du coup, on aurait pu espérer que Charisma Carpenter la joue pour compenser. Mais non. Dommage. Et que dire justement du directeur de la photographie : on n'a pas idée de filmer en analogique puis de faire un zoom "de la mort qui tue" en numérique en post-prod. Ca pique les yeux ! Certains acteurs sont transparents : Jet Li malgré l'intro ou encore Randy Couture. Quel gâchis.

Bref, j'ai passé un bon moment en salle en me grillant les derniers neurones vivants hier soir. On profite des acteurs présents et on se remémore les films précédents. Pour autant, l'arrière goût de déjà-vu/vu-et-revu ne passe pas et laisse une certaine amertume envers Simon West.

Revue du web du 22 août 2012

2012-08-22T12:40:44+02:00

Comme tous les jours ou presque, petite revue du web. Cette fois, on s’intéresse à notre petite personne en priorité.

Vieux (pas si) con

Rah les vieux cons qu’ils disaient. Ces ‘jeunz en jean-t-shirt-basket-casquette à l’envers. S’ils savaient. Mais il ne peuvent pas le savoir. Comme ils ne savent pas ce qu’ils feront de leur vie, du fait de leur jeunesse. Après tout, le cerveau n’est pas mature avant 30 ans. Merci le site web de Slate. Ca me rappelle du Brassens tiens.

Parmi les super-héros : le … cochon-d’inde !

Vous ne connaissez pas le sketch de Bruno Salomon ? Pas grave. Par contre, Slate (oui encore eux ce matin), nous rapporte une étude de psys américains. Selon cette étude, il est sain (psychologiquement voire physiquement) de s’identifier à des Super-héros. Bon bah je retourne sortir ma panoplie du Punisher et régler leur compte à ces mécréants de l’open-space.

Mars attacks

Alors pour ceux qui n’ont pas suivi, un nouveau robot (Curiosity) a été déployé sur Mars. Depuis il nous envoie régulièrement des clichés. Un vrai paparazzi. D’ailleurs, il tient à nous présenter ses amis les martiens. Article fort sympa de chez Gizmodo FR. Préparez-vous à l’invasion !

Couper l’accès au web peut vous coûter la vie

Petit fait divers rapporté par le Journal du Geek. Une timbrée de 19 ans a simplement tué son oncle pour lui avoir couper l’accès au net. Elle était droguée au net. Quand on voit que les jeunes ne pourraient pas survivre sans être connectés, on se rend compte qu’ils pourraient aussi tuer pour être connectés. SFR l’avait prédit.

Abraham Lincoln, chasseur de vampires de pourfandeur d'Histoire

2012-08-22T11:18:30+02:00

Il est de ces hommes dont la vie est devenue une légende. Abraham Lincoln fait partie de ceux-là. Une vie tellement remplie et importante pour l'évolution d'un pays qu'il a inspiré nombre de mouvements et de sentiments. Nombre d'histoires aussi sont nés de sa légende. Une des ces histoires est la biographie fictive de Seth Grahame-Smith de 2010. Et fictive, elle l'est très largement, surtout lorsqu'elle modifie des faits réels pour justifier de ses idées. Classé en horreur, faut-il frissonner de sa version cinéma ?

Abraham Lincoln aime la hache ...

... et l'auteur du bouquin mais surtout Timur Bekmambetov aussi. Ce russe ne vous est peut-être pas inconnu : Night Watch, Day Watch (il est où le 3e opus tant attendu ?), et le m****** Wanted.

[video]http://www.youtube.com/watch?v=34x6m-ahGIo[/video]

Alors oui, Smith présente son oeuvre comme une autobiographie fictive. Mais est-ce une raison pour modifier des faits avérés ? Il aurait été plus salutaire de ne pas le faire pour amplifier la possible véracité des faits fictifs contés. Au final, la vie et l'oeuvre de Lincoln sont coupées et modifiées à grands coups de hache. De la vraie bouillie. Quand on sait que Tim Burton est à la production, on se demande s'il n'avait pas un coup dans le pif au moment de signer le contrat.

Je dois avouer que je suis aller voir le film pour une double raison : l'ambiance ressentie sur la bande annonce qui m'interpelait et le grand bordel qui en ressortait. Le film est-il aussi bordélique ? En fait non. Mais cela ne le sauve pas pour autant.

Des films bordéliques, il y en a eu. Et bien souvent, le résultat était bénéfique : Serenity (et la série Firefly), Iron Sky, ... Mais là, le bordelique s'amoindrit, le soufflé retombe et le navet s'enfonce.

Faux raccords à foisons, aberrations à répétitions, jeu d'acteurs très en retrait, qualité des effets graphiques qui joue au yo-yo, Histoire trop modifiée... Le film n'a pas grand chose pour plaire. Et c'est ce qui ressort du film. On y reste pour voir comment va évoluer le film, mais connaissant la fin, peu de surprises pour nous réconforter d'avoir attendu.

Une énorme déception et un film à fuire.

Revue du web du 21 août 2012

2012-08-21T11:04:19+02:00

Aujourd’hui la revue du web sera très geek. Pour autant, je vais tenter de titiller vos souvenirs, vos plaisirs et votre curiosité.

## X-or, le shériff, le shériff de l’espace

En 5/1000e il se transforme. En 5/1000e, je rédige ce billet … ou presque. Certains se souviendront sûrement de lui ou de ses successeurs. Par contre, je ne vais pas paraphraser l’article du site web Séries Live et vais vous laisser gratter un peu vos souvenirs et la poussière déposée dessus. Par contre, pour le plaisir, … le générique d’antant.

## La télécommande universelle façon gamin

Quand on me parle de télécommande universelle, je pense à deux choses : les télécommandes universelles pour remplacer les 50.000 télécommandes du salon et les montres-télécommandes à l’époque du collège. Là, nous avons le droit à un petit plaisantin qui prend plaisir à utiliser son petit montage dans la rue pour éteindre les TV des bars ou boutiques. Vraiment dans l’esprit des montres de l’époque. Bizarrement, je trouvais ca plus comique à l’époque, vieux con que je suis.

## Disney, l’open-source et le web

Quand je vois la news reprise sur le net depuis hier, je pense que Disney vient de se faire un paquet d’ennemi et que ca promet un joli bizutage. En cause, une séquence dans l’une des séries produites et diffusées par Disney Channel où l’on peut entendre un joli “As-tu utilisé du code open source pour gagner du temps et un virus était caché dedans ?”. Personnellement, je doute que cela soit dû à une mauvaise information du scénariste. Je miserais plus sur un partenaire à la noix (à la pomme vu l’ordinateur de la séquence) ayant demandé une petite séquence propagande.

## Le Lazer Game nouveau est arrivé

Beaucoup d’entre vous connaissent les Lazer Games, peu importe le nom commercial du produit. Souvent en entrepôt, le jeu part à la conquête de la ville. Gizmodo FR nous présente donc une évolution du produit très intéressante pour les aficionados du jeu. Ce n’est pas excessif au niveau prix, c’est à la page (version iPhone seulement pour le moment).

## Michael Moore, Oliver Stone et les US

Michael Moore critique ouvertement les US avec des films-documentaires : Bowling for Columbine, Fahrenheit 9/11, SiCKO … Oliver Stone le fait de manière souvent plus poétique : Tueurs nés, Né un 4 juillet, JFK, Nixon, W … Aujourd’hui, ils nous offrent un papier commun dans l’édition du NY Times, disponible sur son site web. A lire sans modération.

## L’Elysee et la sécurité

Dans certains pays, d’autres seraient morts pour moins que ça. Il est donc question d’un entrepreneur se baladant avec une clé USB non cryptée contenant les plans de l’Elysée. Clé volée directement dans sa voiture. C’est Rue 89 qui le rapporte sur son site web. De quoi lancer un film de série Z.

Total Recall : ma mémoire a le hoquet

2012-08-17T22:58:08+02:00

{.left} Qui n’a jamais rêvé que le fruit de son imagination soit réel ? Malheureusement, il est dur de réaliser tous nos rêves. Pour autant, pourquoi ne pas s’assurer qu’ils deviennent de vrais souvenirs, gravés dans votre mémoire. C’est le business de Rekall Inc : “Dites-nous vos rêves, nous les réalisons”. Inspiré de la courte nouvelle de Philip K. Dick (We Can Remember It for You Wholesale), le film de 2012 est surtout un remake de celui de 1990 avec Schwarzy. Quelques différences nous offrent un film qui sait se distinguer de son aïeul.

Une mémoire à déprogrammer

Le premier réflexe que l’on a, est de se souvenir de la première version. Cependant, même si l’on se prend à chercher les clins d’oeil et les différences, il est plus agréable d’essayer de découvrir se film comme une nouvelle aventure, indépendante et vierge.

Pourquoi partir dans cette optique ? Simplement parce que la nouvelle de Philip K. Dick ne fait que tracer les lignes initiales de ces deux films (1 et 2), mais aussi de la série Total Recall 2070. En effet, il n’y est question que de Douglas Quaid rêvant d’aller sur Mars sans en avoir les moyens. Il s’intéresse alors à la société Rekall Inc, offrant d’implanter de faux souvenirs dans votre mémoire. Mais le service vient à déparer pour en interférant avec de vrais souvenirs enfouis. Rien de plus. Dans la version de 1990, on enchaîne sur ce que serait ce souvenir enfoui. L’action majeur se passe sur Mars, planète que notre ami body-buildé Douglas Quaid va sauver. Dans la série de 1999, il s’agit de suivre des enqueteurs dont la plupart des affaires gravitent autour de Rekall. Aujourd’hui, Douglas Quaid est de nouveau parmi nous mais vit sur une Terre divisée entre les riches britanniques et les pauvres ouvriers australiens (oui je schématise).

Bien accompagné cette fois-ci encore (spéciale dédicace à Jessica Biel pour ma part), Douglas travaille comme ouvrier sur les chaines d’assemblage de soldats-robots. Pauvre, il aspire à plus grand de son côté du globe. Surtout qu’un rêve récurrent le perturbe, à croire que sa mémoire veut lui dire quelque chose. Une publicité pour Rekall va l’attirer dans l’usine à souvenir. De là, sa mémoire va commencer à se libérer. Et pour nous, le début d’un film au pas de course, à l’action nerveuse mais pourtant claire. Calé sur la version de 1990 en bien des points et surtout l’enchaînement des séquence, le film se dénote pourtant sur l’univers, plus proche de Blade Runner que du premier Total Recall. La partie graphique plus dans le détail mais aussi la bande son plus recherchée marquent là encore des différences avec le précédent. Mais le remake se veut aussi un hommage au travail accompli par le passé et les clins d’oeil se multiplient. On finit par se faire transporter dans ce film à grandes prétentions dans une aventure sous crack mêlant action dynamique, thème inspirant et jolie plastique. Cependant, les nombreux faux raccords pourraient causer du tord au film si l’on y fait trop attention. Reste qu’il m’avait fait peur à son annonce, mais qu’il a presque su me faire oublier l’espace de deux heures le précédent film. Un bon moment qui aurait pu être exceptionnel avec un travail mieux fini, remake oblige.

P.S. : une fille pourrait-elle m’expliquer à quoi cela sert-il de mettre une culotte blanche presque transparente par dessus un string blanc ?

Rebelle : douche écossaise

2012-08-17T16:13:12+02:00

{.left} Le Rebelle : il était flic, il faisait du bon travail mais il a commis le crime le plus grave en témoignant contre d’autres flics … La testostérone à l’état brut sur petit écran. Mais avec un grand coeur, faut pas déconner. Que de souvenir. Donc le film sort au cinéma …. Hmm ? On me souffle dans l’oreillette que je me serais trompé de Rebelle ? Dommage ! Donc, hier j’ai pu voir le dernier Pixar avec deux semaines de retard. Une morale au ton comique pour les enfants (petits et grands). Dé-pixélisation d’un bon moment en salle obscure.

Pixar se rebelle en roux

Pixar, c’est un film d’animation par an en moyenne. Un chef d’oeuvre artistique presque à chaque fois : Toy Story, Monstre & Cie, le Monde de Nemo,les Indestructibles, Ratatouille, Wall-E, Là-Haut. Rebelle est-il de cette étoffe. Pour les trop pressés, un grand Oui !

Pour résumer l’histoire, nous suivons donc Merida, princesse héritière du roi d’Ecosse, destinée à se marier et devenir une sage petite princesse avec de bonnes manières. Bah, oui ! Une fille, ça ne rôte pas. Ca ne pète pas. Ca ne fait pas caca. Ca n’a pas besoin de savoir chasser. Sauf que Merida rêve du parfait contraire. Une demande à la sorcière du coin devrait l’y aider … Début des ennuis pour elle et du spectacle pour nous. J’ai eu l’occasion de voir le film en VO et là, l’accent écossais fait une énorme différence sur le film en français. Cependant, avec des enfants, on fuiera clairement cette version. Mais pour les grands enfants, un plaisir additionnel, surtout à se dire “Mais qu’est-qu’il dit le blondinet ?” Comme toujours avec les Pixar, une morale doit nous être livrée. Et pour ne pas déroger à la règle, les crises de fous rire vont nous y aider. Comment résister aux mini roux prêts à tout pour la farce ? Comme résister aux Jeux Ecossais bien moins ridicule que nos chers JO ? Réveillons le rebelle écossais qui dort en nous et allons taquiner du rouquin ! Sur le plan artistique, chaque détail compte. On sentirait presque les vents écossais sur notre visage en humant la bonne mousse fraiche. On pourra s’amuser cependant à chercher les coquilles mais le plaisir est trop présent pour perdre ainsi son temps. Un voyage en Ecosse qu’on aimerait revivre. En attendant, vais me manger un haggis-burger … N.B. : l’hommage pour Steve Jobs.

P.S. : pour un certain père indigne dont je ne citerais pas le nom, oui j’ai aimé et j’assume !

Revue du web du 17 août 2012

2012-08-17T14:50:07+02:00

Allez, c’est vendredi, c’est la journée des trolls pour les geeks mais surtout une veille de WE et il fait chaud. Bref, on se rafraîchit un peu les méninges. Bref, petite revue du web. Très petite vu la journée.

Gros muscles, grosses gaffes

Allociné, outre les infos sur le cinéma, propose quelques web-émissions assez sympa. L’une de mes préférées, c’est “Faux Raccord”. Celle d’aujourd’hui, première de la nouvelle saison est particulièrement risible sur les dialogues. Alors c’est parti pour le trio Sly-Schwarzy-Willis.

Assange ou comment fuire l’Angleterre

Il est de ces personnes dont la vie fait parler la presse du monde entier pendant des semaines. C’est le cas de Julian Assange. Pour rappel, le fondateur de Wikileaks est convoqué en Suède pour être entendu dans une affaire de viol et d’aggression sexuelle. Il n’y est pas encore condamné ni même accusé. Cependant, l’Angleterre souhaite l’y renvoyé par tous les moyens. Certains y voir un complot des Etats Unis. Reste que le pays de sa Majesté n’avait pas mis autant de moyen à l’époque d’un tueur de flic. Mais bon, en marge des manifestations pro-Assange, certains s’en donnent à coeur joie sur le web et imaginent des sorties du pays possible. De quoi bien rire.

C’est l’été, les cités sont de sortie pour la drague

Aller, petit plaisir avec un Tumblr à savourer. Même si la probabilité que certaines ne soient que pure invention, elles ne restent pas très éloignées de la réalité.

Roulez moins cher pour vos vacances

Petite astuce pour ceux qui prennent la route pour les vacances (et même les autres). Voici un petit site avec une carte interactive qui permet de définir le trajet le plus économique au niveau des péages, quite à sortir pour re-rentrer sur l’autoroute. Bonne idée. Très utile surtout vu l’augmentation régulière des tarifs autoroutiers.

Téléphoner ou manger, il faut choisir

Dans la série des bons plans qu’il faudra faire venir chez nous, voici l’idée d’un chef de LA. Pour redonner un côté convivial aux tables et déconnecter ses clients, le chef offre une réduction sur l’addition de 5% si on n’utilise pas son smartphone. A développer.

Revue du web du 14 août 2012

2012-08-14T12:27:06+02:00

Nouvelle révue du web avec du plaisir et de l’image choc. Bon surf !

Un holodeck à la maison

Petit rappel sur ce qu’est un holodeck. C’est un concept issu de Star Trek qui propose une salle “toute virtuelle”. Un monde y est recré et vous y intéragissez à volonté. C’est le summum de la réalité virtuelle. Bah de petits étudiants californiens en ont monté un. Bon, ok ce n’est pas encore du niveau de celui de Star Trek, mais ca vaut le détour.

Gotye, ses fans et le web

Gotye et son Somebody that I used to know a été repris un paquet de fois sur le web, de manière détournée ou non. Petit signe de reconnaissance, l’artiste publie une vidéo en mixant une bonne partie. Aucune modification aux reprises des fans, juste une compilation des sons. Très agréable et presque zen.

Des pyramides englouties … dans le désert

Bon cette fois-ci il ne s’agit pas de pyramides englouties dans l’océan. Des photos de Google Earth auraient mis à jour de nouvelles dans le désert égyptien. Elles semblent bien vieille, bien erodées. Il n’y a plus qu’à y envoyer Indy ou Lara sur place pour s’assurer de la chose.

Le choc du jour : mort pour une photo

Il y a des morts violentes et absurdes. Et clairement, celle qui fait le tour de la presse aujourd’hui l’est. Le tord de la victime : avoir apprécié une moto et la toucher pour une prise de photo. Le (présumé) coupable : un agent de sécurité au sang un peu trop chaud. L’arme : les chaussures de sécurité (coquées donc) de l’agent dans la figure de la victime. L’action se passe en deux temps car bon, mettre un homme à terre seul, c’est peu amusant. Donc autant revenir avec ses potes pour l’achever. Mon commentaire ? 1981.

C’est de l’art on vous dit !

Aussi inutile qu’un frigo sur la banquise. Aussi artistique qu’un monochrome de Whiteman. Voici les photos des caméras de surveillances exposées tels des chefs d’oeuvre. On va oublier le droit à l’image, l’accès à des données de sécurité et surtout que l’artiste n’a rien fait si ce n’est une capture d’une image qu’il ne contrôle pas. Bref, c’est de l’art puisqu’on nous le dit. Point barre.

Des bandes annonces comme vous en rêviez

Des amateurs. Des jeux vidéos. Des bandes annonces. De futurs films du box office. Il n’en fallait pas plus et le Journal du Gamer nous gratifie d’une petit Top5 qui fait du bien par où ca passe. Après tout, on a eu un florilège d’adaption vidéo ludique (voire ludique) au cinéma. Non je ne parle pas de la bataille navale transformée en Battleship en tête de liste.

The Expendables 3

Alors que l’épisode 2 sort au cinéma cet été, un graphiste nous offre sa vision des Expendables qui serait au final digne de faire l’affiche d’un 3e opus. On remplace donc les stars du cinéma d’action par les stars du jeu vidéo d’action. Un bon plaisir.

Hail to the Kings, Baby!

What a piece of Chalk

Petit court métrage présenté par le Journal Graphic. C’est beau. C’est porteur de plein de choses. Juste à apprécier … et à méditer.

Valentin : la cuisine familiale de Belleville et de Thaïlande

2012-08-12T14:02:21+02:00

Samedi soir, la fatigue de la journée s'est fait sentir. La ballade en forêt m'a ouvert l'appétit. Direction un petit restaurant offrant de la cuisine familiale. Le choix s'est porté sur Valentin, petit restaurant à la devanture sans prétention, en haut de la rue Rebeval, dans le 19e.

Valentin ou la cuisine familiale voyage en Thaïlande

La carte de Valentin se fait alléchante, mélangeant une cuisine du terroir à de la cuisine aux saveurs Thaïlandaises. La carte est annoncée sur des enveloppes marrons rangées dans des portes dessins. La carte du jour écrite rapidement sur un feuille de carnet. On se croirait presque revenu à l'école. A deux, petit tour du repas choisi.

Entrées : os à moelle ; calamars à la thaïlandaise
Plats : tomates farcies ; raie au curry doux
Desserts : tiramisu ; tarte tatin
Boissons : Saint Géron et bière Organic

Que dire : tout est parfait pour de la cuisine familiale. On sent que la patron a voyagé et apprécié la Thaïlande : il n'a qu'une envie, nous le faire partager au travers de la carte. On déguste l'entrée. L'os à moelle est divin ; les calamars bien frais et assaisonné. La sauce au curry et lait de coco relève parfaitement la raie très bien cuite. Cependant, la préparation aurait pu être parfaitement finie en retirant le cartilage des filets. Pour un néophyte, cela peut être rébarbatif. Heureusement, cela n'enlève rien au goût. Côté tomates farcies, rien a redire, c'est très bon. La fin du repas se marque par deux desserts magnifiques (oui, le tiramisu n'est ni du terroir ni de Thaïlande). Assis à une table collée au bar, on voit les autres desserts se faire dresser et l'eau reste en bouche pour multiplier les goûts.

On en reste cependant là. L'estomac est bombé. Les papilles en ébullition. La note un peu élevé mais sobre (64€). L'accueil a été très chaleureux avec quelques blagues du patron. L'adresse est notée pour un nouveau rendez-vous.

[print_gllr id=5291]

Restaurant du Tibet-Pemathang : dépaysement et chaleur

2012-08-12T13:29:04+02:00

Vendredi soir, affamé et d'humeur aventureuse, je me suis retrouvé dans mon vieux V^e arrondissement de Paris en direction d'un restaurant Thaïlandais à Maubert-Mutualité que l'on m'avait recommandé. Fermé pour les vacances, je me suis rabattu sur un Tibétain (tout aussi recommandé) un peu plus haut dans la rue. Découverte de la chaleur et des saveurs du Tibet-Pemathang, au 13 rue Montagne Sainte Geneviève, Paris 5^e.

Au Tibet, société matriarcale ; ici, restaurant féminin

Premier étonnement culturel : de l'accueil à la cuisine, en passant par le service, tout est accompli par des femmes tibétaines. Un peu d'explication nous fait comprendre que la société tibétaine est une société matriarcale. La hiérarchie est ici reportée. L'accueil se montre alors hyper chaleureux et il est clair que le client est plus que soigné.

Second étonnement culturel : je suis le seul homme présent dans le restaurant pendant toute la soirée. A croire que la clientèle se passe le mot seulement entre femmes et que les hommes sont bannis de cette importation de société matriarcale. Amusant mais malheureux quelque part. Pour autant, j'en profite bien car l'ambiance y est agréable.

D'ailleurs, tout de l'attention du personnel à la décoration est chaleureux. Sans trop en faire pour nous transporter au Tibet, les quelques photos et la présence du bois apparent suffisent amplement à nous faire voyager et à sentir la chaleur de l'accueil, ancrée dans cette société. Plus qu'à mettre les pieds sous la table, lire le menu et déguster.

Voyage au Tibet au travers de la nourriture

Chaque plat au menu est présenté sous son nom tibétain et accompagné d'une explication en français. C'est limpide et les babines salivent délicieusement. On va faire donc simple, une entrée variée qui reprend chaque entrée (hors soupe) en petite quantité. Suivra un boeuf sauté et épicé. Et pour finir, une coule douce du Tibet. Le tout accompagné d'un Dhara : yaourt mélangé façon milk shake avec du miel. Addition : environ 30€ pour ce menu. Verdict ?

De manière générale, les produits sont frais et bien préparés. L'entrée est parfaite pour découvrir plusieurs spécialités rapidement. Le plat, très épicés est un régal. Le Dhara est alors parfait pour calmer les épices du plat. D'ailleurs j'en redemande volontiers. Pour ce qui est du dessert, il clôt ce repas. A travers les plats, on ressent les différentes influences des immigrants ayant rejoint le Tibet à travers le temps. Les saveurs tendent aussi bien vers l'Inde que vers la Chine avec des pointes d'épices venant d'ailleurs. Un savoureux mélange qui assure le voyage.

Sans conteste, l'une de mes plus belles aventures culinaires de ces derniers temps. Le prix vaut largement la qualité du repas et le voyage au Tibet ainsi réalisé. On comprend vite la panoplie de stickers du Guide du Routard sur la devanture. A refaire !

Revue du web du 10 août 2012

2012-08-10T14:24:08+02:00

Comme depuis quelques temps, petite revue du web en vidéos, en images et en textes.

Les cariboux soutiennent leur équipe olympique sur le web

Nos cousins de l’autre côté de l’Atlantique soutiennent à fond leur équipe olympique. La société Rona, l’équivalent de notre Leroy Merlin, le montre dans un spot mis sur le web.

Pour l’amour du bien gras

Un bon burger, il n’y a que ca de vrai. Ca nourrit. Ca remonte le moral. Ca guérit de beaucoup de choses (c’est beau l’utopie non ?). C’est aussi un art. Petite galerie sur Tumblr.

Les nounours sont nos amis

En tout cas, l’ours en peluche se veut signe de paie et de démocratie selon certains suédois qui en ont parachuté un paquet sur la Biélorussie. Le Monde dans son édition web nous explique rapidement la violence de l’acte suédois contre la paisible dictature biélorusse.

L’athétisme est dangereux pour votre santé

Le Huffington Post rapporte les dangers de l’athlétisme amateur au travers d’une série de GIFs animés. Attention, risque sévère de migraine en perspective.

Le cinéma peut être meûgnon

Qu’ils peuvent être chou les bouts-de-choux. Personnages de cinéma revisités façon garderie. C’est frais. C’est sur Golem13.

FF est mort. Pas vive FF

C’est le Journal du Gamer qui publie une critique sur la décadence du jeu vidéo à la japonaise, license Final Fantasy en tête. Ca fait du bien de lire quelqu’un du même avis. La profondeur des histoires et des univers, sans parler d’un vrai character design est absent depuis bien trop longtemps au profit de la technique sur ce genre de jeux. Personnellement, oui FF VII me hante et FF XII a achevé la saga en s’orientant dans un gameplay à la MMO alors que FF XI n’aurait jamais dû être. C’était mieux avant.

Faire du camping et emmener un stock de bière

Quand on fait dans le roots, on a très peu de place. Pour autant, on n’abandonne pas sa bibine. Gizmodo présente une solution : la bière en poudre. A tester mais j’ai peur.

Jusqu'à ce que la fin du monde nous sépare : j'en suis mort

2012-08-09T11:15:27+02:00

2012. La fin du monde approche selon la croyance populaire (non ce ne sont pas les mayas qui l'ont dit). Cependant, un astéroïde nous menace. Bruce Willis veut nous en sauver dans Armageddon. Mais ici, le vaisseau Delivrance explose en vol et nous voilà définitivement condamnés. Mort clinique d'un spectateur en salle obscure.

La mort d'un genre

Hier sortait donc Jusqu'à ce que la fin du monde nous sépare. J'y suis allé. J'ai vu. Je n'ai pas vaincu.

[video]http://www.youtube.com/watch?v=0NPhBOWA2VI[/video]

Les films sur la fin du monde, une grande histoire de non amour avec le cinéma sur les dernières décennies. Le Jour où la Terre s'arrêta (1951). Le jour d'après (1983). Deep Impact (1997). Armageddon (1998). Last Night (1999). La fin des temps (1999). Fusion (2001). Le jour d'après (2004). La guerre des mondes (2005). Melancholia (2007). Sunshine (2007). Le Jour où la Terre s'arrêta (2008). Phénomènes (2008). 2012 (2009). Prédictions (2009). Petite liste non exhaustive donc. Mais le genre tourne quelque peu en rond : astéroïde, cataclysme naturel ou extra-terrestres. Peu de changement aux scénarios. La mort d'un genre. Ici on rejoue Armageddon sous un autre angle.

Cette fois-ci, on la vie façon Eternal sunshine in spotless mind. Le couple qui s'y forme ne cherche pas désespérément à survivre mais simplement à finir sa vie ensemble. Dodge (Steve Carell) a été largué par sa femme (la vraie femme de Steve dans la vie) suite à l'annonce de l'explosion de la navette Delivrance. Penny (Keira Knightley) est une jeune fille perdue dans sa vie, hypersomniaque à ses moments perdus et amoureuse d'un loser. Tous deux, voisins depuis quelques années mais pourtant inconnus, vont profiter de la situation pour faire connaissance et tenter de s'entraider à réaliser leur dernier rêve. Revoir ses parents pour elle. Revoir son amour de jeunesse pour lui.

La mort du spectateur

Alors qu'une vraie osmose se sentait entre les héros d'Eternal sunshine in spotless mind, nos deux tourtereaux en devenir sont ici transparents l'un pour l'autre. Tout comme le jeu d'acteur plat, le film enchaîne les platitudes de situations, les évidences dans les enchaînements. C'est long. Les temps morts s'enchaînent. Petit réconfort, le personnage de Penny aime le bon son et emmène ses vinyls. L'occasion d'avoir au moins une bonne chose dans ce film : de la bonne musique. Insuffisant.

Par deux fois, on nous envoie des électrochocs pour s'assurer que nous ne sommes pas mort dans la salle obscure. Heureusement. Mais encore une fois insuffisant. Quinze personnes ont fuit la salle pour se préserver. Je suis mort sur mon siège.

Petite revue du web du 8 août 2012

2012-08-08T15:13:16+02:00

Mercredi, jour des enfants, sorties aux cinémas, … Revue du web en attendant l’heure de la sortie des classes !

Jukebox humain dans la Grosse Pomme

En ce début d’après midi, le site web des InRocks nous propose de (re)découvrir les performances du groupe CDZA. Cette fois, c’est au travers d’un jeu de jukebox vivant dans les rues de New York City que le show se passe et on en redemande volontiers. Profitez pour aller découvrir leurs autres expériences musicales, cela vaut vraiment le détour.

Se protéger c’est bien, le faire bien, c’est mieux

Un peu de technique sur le web. Je viens de tomber sur un article du blog de Korben : comment bloquer les attaques les plus courantes. L’article est intéressant. L’idée louable. Mais je ne suis pas fan de Korben pour ses articles techniques et là encore ça se révèle incomplet. L’exercice qui vise à protéger un site perso est très complexe en soi. Le résumer à quelques lignes même pour se protéger des attaques les plus courantes. La configuration proposée par Korben (repris d’un tutoriel de Howtoforge.com) est bien trop simpliste et réductrice. Par contre, proposer l’intégration d’un mod-security (bien configuré !) sur un Apache ou dans le cas présent, d’un naxsi sur un nginx est bien plus intéressant et bien plus viable à terme. Contrairement à mod-security, naxsi fonctionne sur une liste blanche du “bon comportement du site” qu’on va lui faire apprendre au cours d’une session rapide. Donc oui, pendant les premières minutes/heures (selon l’affluence du site ou ce que l’on veut faire), le site n’est pas encore réellement protéger. Mais il ne l’était pas en amont. Au final, la protection est bien plus complète et plus fine, en autant de temps et avec moins de ligne de configuration.

Il est en vie ! En vie !

Petite news du web rapportée par Golem13 : un Wall-E construit par un lambda. Bon, le créateur n’est pas entièrement un anonyme puisqu’il avait déjà reproduit de la même manière un R2-D2 en 2003. Travail magnifique au demeurant, qui me rappelle avec la larme à l’oeil l’oeuvre de Pixar. Seul point sombre selon moi ? Le robot n’est pas entièrement autonome.

Une part de serpent

Pour ceux qui se prépare à goûter, c’est Gizmodo France qui nous propose de découvrir un python sous un angle différent. Alors on le regarde sous tous les angles, on comprend que c’est une réplique puis … on s’interroge. Personnellement, ca m’ouvre l’appétit pour changer. A vos fourchettes !

Il était une fois Zelda au far-west

Je ne vous présente par Zelda, un des emblèmes du jeu vidéo made in Nintendo. Le Journal Graphic nous présente un web-serie mélangeant l’univers de Zelda aux westerns spaghettis. C’est disponible depuis le 7 août, ca divertit et le mélange n’est pas totalement rebutant.

Un verre de WD-40, patron !

Les mécaniciens en herbe connaissent bien le WD-40. Mais pas sûr qu’ils le connaissent comme nous le présente Gizmodo US. Les 10 usages proposés par le site ne sont pas une excuse pour faire n’importe quoi. Il nous est donc rappelé/apporté quelques règles non négligeables.

5 ans de réflexion : avec ou sans gâteau

2012-08-08T11:39:42+02:00

{.left} Le mariage, que de réflexion à avoir et de questions à se poser. Savoir si le partenaire est le bon. Choisir la date. Choisir le mariage religieux ou non. Si oui, de quelle(s) confession(s) la cérémonie doit être. Décider d’un cadre pour la cérémonie. Tester les restaurants. Se mettre d’accord sur la liste des invités. Résoudre les soucis de son couple avant … ou pas. Bref, Que de réflexion à avoir !

5 minutes de réflexion pour se dire si on aime

Hier j’ai donc choisi après une très rapide réflexion d’aller voir le film “5 ans de réflexion”, comédie avec Jason Segel et Emily Blunt.

Le film se présente donc comme une petite comédie romantique avec Jason Segel au scénario, pour un film sans prétention qui demande à se goûter. Donc gâteau de mariage ou donut de fast-food ? Simplement un donut de mariage. Tom et Violet ont la vie qui leur réussi. Tom est chef dans un restaurant à la mode. L’avenir de Violet se profile dans une université de renom pour des recherches en psychologie sociale. Au delà de leurs CV, ils sont surtout amoureux et tous leurs proches les considèrent comme le couple parfait. Donc tant qu’à faire, autant se marier. Mais vient alors les questions à se poser. Et les déboires de la vie courante qui demande la réorganisation. Et comme le bazar que va devenir leur vie pendant 5 ans le film est un gros n’importe quoi. Totalement sur joué. Des découpages parfois peu logique. Un couple qui ne fusionne jamais. Et de ce chaos nait une comédie irrésistible qui nous emporte pourtant. A ne pas comprendre. On se balade avec Tom & Violet, et attendont le Happy End évident avec la bave au coin des lèvres. C’est rapide. Ca ne restera pas dans les mémoires. Mais ça s’apprécie clairement. Un très bon moment de relaxation.

Ah les Parigots : carte de Paris

2012-08-08T10:54:23+02:00

Je viens de recevoir ça par email, je suis plié et donc je partage … Cela vous occupera en attendant la revue de “5 ans de réflexion” qui arrive dans la journée. Pour ceux qui n’ont pas été voir Olivier Giraud, ca peut vous motiver à y aller.

News du jour sur internet

2012-08-02T12:04:52+02:00

Ca se passe sur internet

Rien à critiquer ou à tester aujourd’hui. Pas d’argumentaire. Ca sent vraiment les vacances. Alors du coup, je vais faire un billet que je mettrais peut être à jour courant de la journée avec les conneries plus ou moins sérieuses que l’on peut trouver sur internet. Allez, commentons un peu l’actualité du jour.

Les sales gosses

C’est le Parisien qui publie un article sur son site internet : le comportement des enfants en voiture. Personnellement, on me parle d’enfants en voiture, je repense à un trio infernal qui joue les sales gosses (Guillaume - Pauline - votre serviteur) avec leur “c’est quand qu’on arrive ?” et autre “pipi!”. Bref. L’article se focalise sur un fait bien connu : les enfants n’ont que peu de patience en voiture. Il faut donc savoir les occuper en les divertissant. Bon rappel. Par contre, la fée DVD est à déconseiller de mon point de vue. Les vacances sont faites pour décrocher du train-train habituel. Les enfants sont déjà trop accrochés à la TV, au PC ou à la console. Laissez la place aux jeux de société pour la voiture ou inventez des jeux !

Jurassic Park

C’est l’histoire d’un milliardaire qui ne va jamais au cinéma. Du coup, il veut cloner les dinosaures. Puis pourquoi s’arrêter en si bon chemin : il faut les mettre dans un parc. C’est le site internet français de Gizmodo qui nous le rapporte. Bref, il n’a pas vu la trilogie et il serait bon que quelqu’un la lui offre. Une leçon à tirer de cette news : aller au cinéma est bon pour apprendre à ne pas faire de bétises.

Il est sain d’avoir un compte Facebook

Et c’est même mieux. Ainsi se présente l’information rapportée par MSN Techno. Ne pas être présent sur les réseaux sociaux peut paraître suspect et détonerait même de trouble psychologique. Comment ça, il faut être parano pour ne vouloir aucune empreinte numérique sur internet ?

La guerre des robots viendra

Même si Skynet est à la bourre de quelques années, la guerre des robots viendra. Avant ou après l’invasion zombie n’est pas le soucis. Par contre, savoir y survivre oui. Petit cours sur internet rapporté par Gizmodo US.

Les super-héros aussi ont une vie

Un petit reportage photo est mis en ligne par Golem13 sur la vie cachée des super-héros. Après tout, sont humains. Quoique …

Supprimer des axes rapides réduit la pollution …

… dixit la Mairie de Paris. C’est la logique présentée pour justifier la fermeture des quais rapporté par le Parisien. C’est sûr que rajouter des voitures à des axes déjà saturés, ca ne polluera pas plus. Comme le fait que les parisiens et banlieusards se reporteront sur des transports saturés. Que d’air dans le métro ou le RER. Que de plaisir à rester bloquer en bus à des carrefours saturés par les flots de voitures. Quel bonheur d’attendre dans les tunnels que les secours ramassent le hachis déposé sur les rails par un malheureux à qui son employeur vient d’annoncer qu’il était viré car il ne pouvait utiliser sa voiture et que les transports parisiens ne marchent pas. Et non le Vélib’ n’est pas une solution : vous ne savez pas faire du vélo et les chauffeurs (voiture, bus, camion) vous ignorent. Ah, le bon air pollué de Paris. Bientôt en plus forte dose.

Nettoyons la planète

C’est une news d’Univers Freebox concernant la participation de Free au World Clean Up 2012. J’en avais déjà parler il y a peu sur les réseaux sociaux car l’affiche rapporte un autre participant de poids : la Fondation PSA (du groupe PSA). D’ailleurs, PSA a déjà commencé le nettoyage, mais par Aulnay.

Météo et politique font bon ménage

Vous vous souvenez peut-être de mon billet sur le climat. Aujourd’hui c’est le site Slate qui se prête au jeu et marie la météo avec la politique. Le résultat est convaincant de comique.

Aux bons Amis : un couscous excellent et très bon marché

2012-07-30T19:27:45+02:00

Le couscous est un de ces plats facile à trouver, surtout dans les quartiers populaires de Pariset qui réunit les critères suivants :

appétissant
bon marché
nourrissant

Petite revue rapide du Grenier mais surtout du restaurant Aux Bons Amis.

Il y a peu j'avais pu découvrir Le Grenier (rue Oberkampf à Paris). N'y allez pas n'importe quel jour, le bar ne sert le couscous que le vendredi et samedi soirs. La particularité ? Le couscous y est gratuit avec pour seule obligation de consommer. Les boissons étant aux prix classiques de Paris, le tarif est largement honnête. Donc couscous à volonté. Seulement des merguez pour viande. Semoule fine. Légumes bons mais sans plus. Vu le prix, rien à redire en fait et à noter pour tous les radins.

Par contre, hier j'ai pu tester une autre catégorie : aux Bons Amis, dans le quartier de Belleville, toujours à Paris. Cadre sympathique avec les poutres apparentes dans la première salle, patron timide mais sympa, à l'ambiance de cantine lors du plein et reposant en cette période de ramadan. La spécialité de la maison ? Le couscous évidemment, les viandes grillées accessoirement.

On s'est focalisé sur le plat pour faire simple. Pour deux, note à la sortie : 30€. A priori, tarif moyen, mais décomposons : 9€ par tête pour le couscous "Maison" (entre 6,5 et 11€ selon la recette choisie) et 12€ pour une bouteille de vin gris du Maroc.

Le couscous "Maison" se présente en trois plats conviviaux : les viandes (mergez, keftas, brochettes d'agneaux), les légumes et la semoule fine. Rien n'est raté : la semoule est fine sans grumeaux, les légumes assaisonnés et cuits parfaitement, la viande est grillée comme il se doit. Les merguez sont parmi les meilleures que j'ai pu manger, tout comme le kefta à l'assaisonnement excellent. Les brochettes d'agneaux offrent de beaux morceaux en taille et qualité. Une verrine d'harissa maison est proposée pour relevé le tout. Pour le prix, une qualité parfaite. A tester les autres recettes ou grillades. Côté vin, rien de tel qu'un vin gris pour l'accompagnement : léger, sucré mais pas trop, il réhausse le goût global.

Pour faire simple : un couscous excellent et très bon marché. A refaire.

The Dark Knight rises : ou comment Batman chute

2012-07-30T12:00:54+02:00

Mercredi dernier, Batman nous a livré le dernier chapitre de sa trilogie. Batman Begins avait marqué par son côté sombre et violent. The Dark Knight nous avait offert une nouvelle référence pour le Joker (Heath Ledger). The Dark Knight Rises nous offre juste une film à potentiel non converti. Trop long. Trop de (petits) ratés. Une Catwoman perfectible. Un Bane en demi teinte. Une Marion Cotillard qui devrait avoir honte. Une ouverture lors du final qui aurait pu ne pas être faite. Décryptage d’un loupé qui, cependant, divertit.

Batman : une trilogie à ne pas louper

On se souvient tous des films des années 90. Deux films gothiques du maître Tim Burton (1 & 2) qui mélangeait son univers à celui du héros masqué sans problème. Deux films de Joel Schumacher (3 & 4) qu’on espère oublier avec leurs délires psychotiques. Christopher Nolan avait entamé sa version du chevalier sombre de manière magistrale et allant crescendo. Il nous avait annoncé une fin en apothéose et ne devait surtout pas se louper, tellement le rouleau compresseur médiatique nous en a fait bouffer pendant des semaines avant la sortie. Avec Batman Begins, Nolan et Bale nous faisaient rentrer dans un univers sombre et torturé du chevalier. On lui découvrait des origines complémentaires absentes des versions précédentes (dont Ra’s Al Ghul). Grosse surprise en sortie de salle qui a mis l’eau à la bouche de tous les fans en désespoir depuis les dernières adaptations. Malheureusement, l’épouventail y avait été assez transparent. Dans The Dark Knight, nous y découvrions le némésis de la chauve-souris : le Joker. Campé par Jack Nicholson précédemment, ce dernier avait défini de belles règles pour le rôle. Il était alors très dur d’arriver à sa hauteur. Mais le drogué Heath Ledger avait de la ressource à vendre. Il n’a d’ailleurs pas démérité son Oscar posthume tant la performance était magnifique.

Un Batman en déchéance

Annoncé avec des personnages importants de l’univers de Batman (à savoir Catwoman et Bane), ce Dark Knight Rises s’annonçait surpuissant. Et rien que pour eux, les loupés existent. Oui, Bane y est enfin intelligent comme il le devrait (et contrairement à la version de Schumacher), mais reste que le jeu d’acteur, la posture et l’expression orale montrent quelques restes de ce passé atardé. Dans le cas de Catwoman c’est plus compliqué. Michelle Pfeiffer a donné au rôle ses titres de noblesse. Halle Berry a ruiné le personnage. Anne Hathaway résiste, est sexy dans son latex moulant mais reste totalement transparente tout au long du film. Décidément pas Miaou la chatte bien que sortant les griffes. Les clins d’oeil aux personnages précédents sont agréables … Il en manque cependant un pour le Joker qui a fait la renommée du second opus. Ca c’est pour les personnages. Le film en lui-même enchaîne les ratés. Commençons par la durée : 2h45 en plein été, dans des salles où la climatisation n’est soit pas en état, soit pas suffisante, c’est du suicide ! On se croirait dans le RER, en heure d’affluence avec une panne. Ensuite, la chronologie des évènements et la gestion du calendrier est digne d’un Harry Potter : on enchaîne les changements de jours (parfois mois) sans rien comprendre. C’est totalement décousu et mal expliqué. Comment perdre le spectateur. C’est sûr qu’en 2h45 de film, Nolan n’avait pas le temps de rendre la chose agréable et propre. Pour le jeu des acteurs, autant faire une liste nomminative :

Catwoman/Selina Kyle : transparente
Alfred : fatigué émotionnellement, touchant, mais trop absent
Lucius Fox : les chevilles sont tros grosses et heureusement, il apparaît peu
Bane : c’est quoi cette tenue ?!
Mlle Tate : Marion Cotillard, vous faites honte au cinéma français et au montant du chèque perçu pour ce rôle ; depuis quand on sur-joue autant dans ce genre de film ?!
Batman : fatigué physiquement, limite grabataire ; oui, il doit clairement se relever

On nous annonçait une trilogie, la fin ouvre sur une double possibilité (attention, ça spoile donc passez au paragraphe suivant si vous ne voulez pas lire) :

soit la création du Robin/Nightwing (bien qu’il ne soit pas question de Dick Grayson)
soit la création d’un nouveau Batman

Accessoirement, pour votre information, John Blake existe dans les comics (il apparaît dans le #13 de 1942 et est le Robin de l’époque) : peu connu mais bon à savoir. Ce qu’il reste donc au final à ce film ? Son gros spectacle, un scénario qui tient la route (pour les grandes lignes) et son côté sombre. Mais bon, comme disait Funny or Die dans un de leurs derniers podcasts vidéos, quand on en a vu un, on les a tous vu. Pas convaincu qu’il vaille le coup d’aller s’étouffer au cinéma pour le voir.

Holy Motors : pour Oscar, ca tourne !

2012-07-26T22:34:38+02:00

Holy Motors : Oscar de la Jeunesse ?

{.left} Présenté en compétition officielle du festival de Cannes 2012, Holy Motors est primé par un Oscar de la Jeunesse. Et là, je me dis que la jeunesse n’est pas une génération totalement perdue tant le film peut s’interpréter de manières diverses, voire rebuter si l’on ne prend pas le temps. Oscar est le nom de cet être étrange que nous suivons, alors qui’il vogue de vie en vie. Dix vies. Dix actes. Dix leçons. La première scène nous montre un public endormi au cinéma : allons-nous aussi nous endormir devant cet ovni ?

Une ode au cinéma et au théatre ou sujet d’anthropologie ?

Oscar est donc cet homme dont on ne voit jamais le vrai visage qui va prendre la vie d’un autre pendant quelques minutes ou heures. Tour à tour vieux banquier, vieille mendiante russe, monstre dans un cimetière, père de famille… Chaque scène, chaque rendez-vous, est orchestré à la seconde et nous propose un film à part entière. Sans lien, chaque scène est un acte de la pièce jouée par Oscar (Denis Lavant) et accompagné par Céline (Edith Scob) qui lui sert de chauffeur de limousine et d’assistante. La journée est chargée. Dix actes nous attendent. On pourra passer de la vie peu passionnante du banquier aux trubliations d’un monstre du cimetière se la jouant Fantome de l’Opera et kidnappant une mannequin, campée par Eva Mendes. Et là, l’un des points clés du film : la relation d’Oscar avec les femmes. Toutes veulent le manipuler à leur façon : l’assistance et la planification pour Céline, le calme et l’acceptation pour le mannequin, le mensonge par la petite fille, les souvenirs pour sa collègue … Toutes prendront l’ascendant sur lui, le menant où elles désirent ou le faisant réfléchir à sa situation, à sa vie (absente). Puis, comme au théatre, nous avons le droit à notre entracte. Ou simplement, le 6e rendez-vous d’Oscar. Un boeuf d’accordéons dans une église. Rafraîchissant et bien placé. A noter la présence de Bertrand Cantat pour manier l’harmonica. ”3 ! 12 ! Merde !”

Puis c’est la descente aux enfers pour Oscar dont la fatigue de la journée se fait sentir. Le stress se ressent. On est essoufflé pour lui. Perdu dans ses dossiers comme lui. A ne plus savoir qui il a été, qui il est et qui il va être. La rencontre de la Fée Verte, Kylie Minogue, apparaît comme une divine venue. Chantante (“Who were we”), elle rappelle à Oscar son passé, leur passé. Ces êtres sans visages, sans vie propre, ces mannequins, nous font visiter les ruines de la Samaritaine, le sol jonché de mannequins démembrés, en compagnie de ses êtres sans visage est oppressant. Mais le passé doit rester le passé. Le présent se charge de le lui rappeler de manière violente. Céline dépose alors Oscar à son dernier rendez-vous avant de ramener la limousine au hangar d’Holy Motors. Alors qu’on ne voit jamais le vrai visage d’Oscar, Céline masque enfin le sien en nous quittant. S’engage alors un épilogue entre les âmes de ces vaissaux guidant les gens vers leurs derniers voyages, comme s’amuse à le dire Leos Carax. Ce film est déroutant : ce qui est réel semble irréel et inversement. Les standards sont bousculés. On ne comprend jamais vraiment le but à tout ceci. On se plait à repenser à Code Quantum dans lequel Sam voyageait de vie en vie afin d’aider les autres, accompagné d’Al. Les choses sont ici bien plus rapides, brutales. Al est devenu une femme et Ziggy une limo. Une manière de marqué l’impulsivité et le mouvement, alors que la série prenait son temps. Mais alors que tout va mal pour lui et que sa vie ne lui plait pas, pourquoi continuer ? Et nous, pourquoi continuer à regarder ce film qui semble décousu ? Comme le dit Oscar, on continue pour le spectacle. Et c’est pour cela qu’on va voir ce film. Profiter de l’esthétisme. Inspirer la méditation. Apprécier la vie. Arriver à sa conclusion, le cerveau bouillonne. La digestion est longue mais bénéfique. A voir sans conteste.

La tontine : un penny bien placé

2012-07-18T12:02:45+02:00

{.left} La tontine : pensez à votre avenir, faites des projets, placez bien vos pennys, qu’ils disaient. Ca fait quelques jours que je n’ai rien posté. Normal, rien de bien passionant ici bas. Hier, on m’a proposé une réunion Tupperware financier : me faire l’article sur les tontines. Alors qu’est-ce qu’une tontine ? Quels sont mes projets ? Ai-je signé un contrat ? On va voir tout ceci.

Késako la tontine ?

Déjà personnellement, me parler de tontine, de placement ou simplement de mettre des sous de côté, ça me fait tout de suite penser à Mary Poppins.

Ca, c’est fait, comme on dit. Mais késako une tontine, bande d’ignards ? Selon la page wikipedia, ça serait : la tontine est un contrat aléatoire correspondant au financement collectif de l’achat d’un actif financier ou d’un bien dont la propriété revient à une partie seulement des souscripteurs. Voici pour la définition. Pour les curieux, je vous laisse lire le document pour l’histoire et les informations complémentaires. A l’habitude, c’est votre banquier ou un courtier en assurance qui vous contacte pour vous faire souscrire à une assurance vie ou un placement à long terme. Ca se passe en privé. Ici, le Conservateur utilise la technique des réunions Tupperware pour faire sa pub et attirer les ~~clients~~ mutualistes.

Indigestion … de chiffres

Après s’être fait mettre à l’aise par l’hôte de maison avec les classiques plateaux charcuteries/fromages/vins, le courtier commence son show. On va nous vendre l’histoire de la mutuelle non régie par un actionnariat et donc indépendante, vieille de près de 170 ans, oeuvrant toujours à l’intérêt de ses mutualistes, et toujours meilleure que la concurrence. Alors, oui, les chiffres annoncent beaucoup de choses, la revue de presse chante leur louange, mais bon il faut que ça interpèle. Le but premier est de vous faire réaliser que le modèle de retraite partagée auquel on participe en France n’est pas à notre avantage et qu’on sera tous en faillite une fois arrivé à la retraite et qu’il y a aujourd’hui (selon les chiffres) un manque à gagner de 20% entre ce qu’on va toucher et ce dont on va avoir besoin. Enfin 20%, c’est pour les employés. Pour les cadres ou professions libérales, c’est bien pire et monte jusqu’à 45%. Mais la tontine est là pour réhausser le sacro-saint pouvoir d’achat

Bref, des chiffres alarmistes pour vous dire une chose : faites des projets et mettez de l’argent de côté … dans une tontine par exemple. Alors, pour ma part, d’autres points me choquent : l’idée du projet qui sera respecté et l’argent mis de côté.

C’était mieux avant

Le Conservateur s’appuie sur son expertise de 170 ans pour nous garantir qu’il sait ce qu’il dit et que le modèle mis en place en 1844 est toujours valable aujourd’hui. Reste que le monde a changé, les moeurs aussi, tout comme les habitudes liées à l’emploi. Et que dire de la capacité des jeunes couples à pouvoir faire des projets ? Oui en 1844 ou encore pour la génération du baby-boom, il était courant de rester fidèle à son employeur toute sa vie, comme le couple était fidèle l’un à l’autre. Mais aujourd’hui, les changements de boulot en cours de route sont réguliers avec une moyenne, en 2010, de 7 ans pour 58% des actifs et 3 ans pour 25%. On est loin du poste à vie de nos parents. Et de manière amusée, les durées de vie des couples sont assez proches, avec un nombre sans cesse croissant des divorces. Alors les projets … Et c’est bien sûr sans prendre en compte une vie qui semble tenir à un fil toujours plus fin. La partie financière n’est pas en reste avec une succession de crises au XXe siècle et en ce début de XXIe siècle, des marchés financiers qui régissent toujours plus notre vie quotidienne et des conséquences pesant sur les moyens pécuniers des jeunes couples. Avec les frais quotidiens en perpetuelle augmentation et de manière bien plus rapide que l’inflation annoncée par l’insee et des salaires en régression, le niveau de vie de ces couples est loin d’être idyllique et mettre de côté des 200€ mensuels recommandés par le courtier s’avère un calvère financier. Et justement, cela empêche tout projet autre que la retraite et encore plus de se préserver de toute situation d’urgence.

Round 1 : fight !

Avec ces éléments et bien d’autres dans les manches de mon t-shirt, je titille le courtier qui se rebiffe tel un chihuahua dans le coin d’une pièce : ça montre les crocs, ça grogne pour démontrer que les chiffres ont raison. Tout ça dans le but de contrer les arguments et pouvoir rassurer le reste de l’assistance. Mais bon, il cherche mais n’y arrive point. Il n’est jamais bon de s’exciter pour se justifier et soutenir sa position. Et les chiffres, on leur faire dire ce qu’on veut. Maintenant, dans l’absolu, il a raison : il faut, tant que possible prendre les devants et prévoir notre vieillesse, comme il faut prévoir demain. La tontine permet à moindre coup de se composer un capital honnête. Le dernier exemple était d’ailleurs intéressant.

Round 2 : K.O.

Un couple de jeunes de 25 ans commence à se pencher sur la question. Chacun va mettre mensuellement 100€ répartis en deux tontines par tête (pour des raisons fiscales). La tontine choisie est une tontine avec rente sur 20 ans. Donc arrivés à 45 ans, ils se retrouvent avec leur rente. Cette rente, vu qu’ils n’en ont pas besoin (bah oui, ils bossent encore), il la réinvestissent de nouveaux dans des tontines de 20 ans avec pour objectif un capital. Arrivés à la retraite (oui on espère qu’elle soit toujours à 65 ans), le capital se débloque avec un joli montant de 372.000 € pour 48.000€ investi. C’est magique. C’est le rêve. Sauf que l’évolution de notre civilisation montre qu’à 65 ans on ne sera toujours pas à la retraite. Qu’on vivra toujours plus vieux. Qu’on changera toujours plus de taff. Que mettre de côté 200€ à 25 ans, c’est déjà trop tard. Qu’on devrait mettre 800€ tous les mois à 45 ans pour compenser, chose qui ne se fera pas. Bref, les chiffres du courtier annoncent le miracle qui existerait si l’on vivait encore 30 ans plus tôt, ce qui n’est pas le cas.

And the winner is …

Le concept de reprendre les réunions Tupperware pour présenter des produits financiers fait son affaire puisque l’ambiance est plus détendue, et que l’échange avec le courtier est plus franc et plus intéressant. Une heure de show, c’est chaud. C’est épuisant pour lui, mais un régal pour une personne comme moi. On ne peut que réagir. On essaie alors d’imaginer, de prévoir. Mais la vie est faite de contre projets qui remettent toujours tout en question, de nos jours. Pour autant, rien n’empêche de tenter de sauver nos vieux jours. Pas de signature, mais un intérêt relevé. Pour clore, juste un phrase qui peut prendre son importance ici : faites que le rêve dévore votre vie, afin que la vie ne dévore pas votre rêve.

Rock Forever : Rock'n'Roll is all about love, Babe

2012-07-12T00:18:25+02:00

Et Dieu créa le Rock

{.left}

Vous savez tous ce que Dieu créa pendant les six premiers jours. Le septième, il ne s’est pas reposé : il a créé le Rock’n’Roll ! Combien de courants musicaux en sont nés ? Combien de destins s’y sont liés ? Combien d’enfants ont été conçus sur des banquettes arrières au son de ses rifts de guitare ? Le Rock est Vie. Le Rock est Amour. Mais pour raconter cette partition de sentiments, Broadway créa la comédie musicale Rock of Ages (Rock Forever). Hollywood en fit un film.

Branchez les guitares. Moi j’accorde ma basse.

Pourquoi mettre ce billet dans trois catégories ? Tout simplement parce qu’un film se regarde mais le rock s’écoute et se ressent. J’ai choisi ce film avec la peur au ventre. Peur que la bande son ne soit pas à la hauteur avec autant de reprises. Peur de l’interprétation de Tom Cruise qui me désespère de plus en plus à chacune de ses apparitions.

Mais bon, le casting regroupe quand même quelques chanteurs : Julianne Hough et Diego Boneta (deux chanteurs de Country), Mary J. Blige (the Queen of Hip-Hop Soul). Ceci permet un niveau de chant agréable forçant les autres acteurs à travailler. Le playback se ressent un peu trop malheureusement et laisse supposer un gros travail en studio pour corriger les voix. Pour autant, la playlist est généreuse et agréable. Au niveau des acteurs, je remercie qui de droit de n’avoir pas donné une trop grande importance à l’écran à Tom Cruise : son ~~encombrance~~ importance s’arrête à l’affiche du film. Nous sommes projetés en 1987, excellente année pour le Rock sur le Sunset Boulevard de Los Angeles. La foule se déchire entre frigides coincés et amoureux of the devil. Nous y suivons l’arrivée de Sherrie dans la cité des Anges avec ses rêves de gloire musicale. Elle débarque donc de son Tulsa natal (Oklahoma), sans un sous, les yeux rivés sur le Bourbon Room, le bar rock N°1. Sa (mal)chance la mettra sur la route de Drew, son Don Juan, et toute la fine équipe du bar. Stacee Jaxx (alias Tom Cruise), l’idole de ces jeunes, est un mix entre Jim Morrison, Axl Rose, Keith Richards et Iggy Pop. Mais comme toute rock star, Stacee se fait désirer et donc n’apparaît que peu à l’écran. Une chance pour nous qui permet presque de savourer une prestation honorable du scientologue. Personnellement, je l’ai trouvé relativement “plat” (comme à son habitude) jusqu’à un certain regard de sa part lors de sa deuxième venue au Bourbon Bar. J’ai alors retrouvé le Tom des années 80 pendant quelques brèves secondes.

Rock ! Rock ! Rock’n’Roll !

Pour le plaisir, voici donc les chansons qui ont été reprises. Mais dans leurs versions originales. Une playlist YouTube est disponible.

“Sister Christian” / “Just Like Paradise” / “Nothin’ but a Good Time”
“Juke Box Hero” / “I Love Rock ‘n’ Roll”
“Hit Me with Your Best Shot”
“Waiting for a Girl Like You”
“More Than Words” / “Heaven (Warrant song)”
“Wanted Dead or Alive (Bon Jovi song)”
“I Want to Know What Love Is”
“I Wanna Rock”
“Pour Some Sugar on Me”
“Harden My Heart”
“Get Nervous”
“Here I Go Again”
“Can’t Fight This Feeling”
“Any Way You Want It”
“Undercover Love” (euh … euh … bouuuuuuuuuuuuuh !! Du - faux - Boys Band !!)
“Every Rose Has Its Thorn”
“We Built This City” / “We’re Not Gonna Take It (Twisted Sister song)”
“Don’t Stop Believin’”
“Paradise City”
“Rock You Like a Hurricane”

D’autres chansons arrosent nos oreilles de leurs notes, directement dans leurs versions d’origine. Une playlist YouTube est disponible.

A voir ? Non juste à écouter

Au final, malgré un très bon son dans les oreilles, un bon casting et des moyens non négligeables, les rôles sont sur-joués, les émotions non transmises et le spectacle qui se voulait détonnant fait office de pétard mouillé. A voir … en vidéo chez soi si vous voulez la vidéo, sinon autant allez acheter la BO.

Starbuck : tiguidou !

2012-07-11T11:37:46+02:00

Viens che-nous

{.left} Nos cousins québécois, on les connait pour leurs expat’ musiciens. Mais leur joual s’exprime aussi au cinéma, plus rare dans nos contrées si ce n’est avec quelques acteurs. Place à Starbuck. Cette fois, c’est un film de 2011 qui nous arrive au cinéma. Un sujet mêlant dans leur univers, sous titré pour les passages trop hardus à comprendre. Le titre laisse perplexe au début, mais la bande annonce impose d’aller voir le film.

Who the fuck is Starbuck ?

Comme quatre à cinq milliards d’humains le lendemain, on est tous à se poser cette question : mais, who the fuck is Starbuck ?

C’est El Masturbator. C’est l’histoire d’un jeune sans bidoux à la fin des années 80 qui vend sa semence à une banque de sperme plus de 600 fois. Un sperme d’une grande qualité puisqu’utilisé avec succès à 533 reprises. Ce jeune, 22 ans plus tard, la quarantaine approchant, se retrouve père géniteur de 533 enfants dont 142 veulent faire sa connaissance. Sauf qu’à 40 ans, David Wosniak est irresponsable, pire livreur de viandes au monde, incapable d’avoir une relation saine avec sa blonde et qui tente la culture hydroponique pour arrondir ses fins de mois. Toute une descente d’un homme pour pouvoir mieux en rire. Et du rire, il y en a, malgré les différents sujets abordés : don de sperme, parents génétiques, droit à l’anonymat, homosexualité, handicap lourd, décallage, difficultés d’adaptation … Une certaine profondeur d’histoire, racontée avec une certaine légèreté : on est au bord des lieux communs des relations familiales. Découvrir tous ces enfants avec toutes ces vies compliquées vont éveiller chez David tout un tas de sentiments qu’il n’espérait sûrement pas. Il va vibrer, espérer, croire. Et nous avec lui. Entre les zoulous des mange-canayes qui le pourchassent, les banques qui se la jouent pawnshop, sa famille qui le prend pour le mouton noir, sa copine en balloune mais qui ne veut plus de lui, rien n’est fait pour qu’il marque. Sauf justement ses 142 enfants qui l’espèrent et à travers leurs vies croisées vont le motiver à s’enmieuter. Qu’il soit footballeur pro, chanteur dans le métro (David Giguère), acteur décrié, gamine y’é stone à mort et désabusée, ado goth ou encore son fils lourdement handicapé moteur, ses enfants ont tous une leçon à lui offrir de la même manière que lui peut devenir leur ange-gardien (et non leur super-héros en lycra).

Et c’est là l’histoire d’une vie que nous offre David. C’est aussi la leçon qu’il nous apprend dans les larmes et les rires. Le film aurait pu basculé vers la banalité, mais s’en sort. Même la fin “conte de fée” où tout le monde il est heureux passe : pas d’autre choix pour appeler à l’ouverture d’esprit du public. A noter qu’on a pensé à vous autres qui ne connaissez pas le joual avec des sous-titres donc Pratique.. Pas de vrais temps-morts. A voir. A revoir. A respirer. A s’impreigner. A cogiter.

Affaire Goldorak : conjugaison du verbe larguer

2012-07-10T12:42:07+02:00

L'affaire du millénaire : l'affaire Goldorak

Non l'affaire n'est pas une histoire de coeur. Quoique, cela puisse devenir une histoire de coeur pour certains. Après tout, Actarus et son Goldorak ont bercé l'enfance de nombre d'entre nous.

Reste l'un des plus grands mystères de nos vies : mais pourquoi donc Actarus fait-il deux demi-tours au moment de son transfert de la soucoupe vers le géant de fer ? Le débat a duré longtemps, les esprits se sont déchaînés mais la réponse était ailleurs. Ou ici.

Transfert autolargue

Vous vous souvenez probablement tous de Goldorak. Pour les rares ignorants, vous avez loupé quelque chose. Mais rien n'est perdu, il vous suffit de trouver un "un peu plus vieux" que vous pour tout vous dire sur le sujet. En attendant, le mystère a fait grand bruit et ce matin, la pause café m'a imposé un billet sur le sujet : le transfert autolargue.

[video]http://www.youtube.com/watch?v=gx8KtPZsP6o[/video]

Bon d'avance, je remercie l'auteur d'autolargue.net pour les informations complémentaires que j'ai pu y glaner et mon frangibus à l'origine de bien des idées de conspirations. Donc oui, mais pourquoi deux demi-tours lors du transfert ?

A l'inverse de son ancètre Mazinger Z, le navette de pilotage n'est pas un modèle réduit s'imbriquant dans le robot pour le contrôler. Ici, elle sert de module de vol pour le robot et s'en sépare pour les combats directs. De fait, il fallait permettre à son pilote de se transférer du vaisseau vers le robot. De là est né le transfert autolargue : une fois le pilote transféré, le robot est automatiquement largué.

Mais lors de son tranfert, le siège du pilote tourne sur lui en deux temps pour opérer deux demi-tours. Nombres d'hypothèses ont été avancées et Go Nagai, créateurs des sagas de robots géants Mazinger et Grendizer, y a répondu d'une langue de bois inavouable pour éluder la question et garder la réponse toujours aussi secrète. Selon l'annonce officielle, Actarus est bien trop prudent et préfère se retourner.

Or, Actarus ne décide de rien dans l'histoire. En effet, Goldorak est le Golgoth le plus puissant de l'armée de Vega et Actarus n'est qu'un vil voleur ayant soustrait le robot à ses propriétaires. Il n'est donc clairement pas le créateur du robot et n'a donc pas décidé de son fonctionnement ou des rouages du transfert. La réponse officielle du créateur de l'animé n'est donc pas viable. Reste à décortiquer la vidéo du transfert, de se souvenir de nos heures de Mécano et Lego, pour aboutir à de bien meilleures spéculations.

Primo, l'ensemble des commandes (dont celle du transfert) est intégré au siège/nacelle dans lequel est installé le pilote. La seule commande permettant le transfert est une poignée à tirer. Personnellement, je me souviens de mes jouets (Mask en tête par exemple) où une gachette (ou un bouton) dévérouillait le mécanisme complet de transformation. On en demande peu au pilote, c'est prédéfini. Simple mécanisme. D'ailleurs l'animation ne montre aucune autre commande à manipuler pendant le transfert (surtout au moment des demi-tours). L'intervention humaine, encore une fois est à réfuter pleinement.

Secundo, la vidéo montre un double point important : le moment des deux demi-tours. L'un se produit une fois le siège arrivé dans le corps du robot, l'autre avant l'entrée du siège dans la tête qui sert de centre de commande. Un élément est absent de la vidéo et impose une supposition : le tunnel de transfert est intégré au vaisseau et au robot. Mais quelle partie du tunnel reste dans le robot après ? Personnellement je dirais que le coude reste avec la soucoupe et, le reste avec le robot. Ce qui aide à la démonstration.

Tercio, la partie audio montre des bruits bien différents lors des rotations, ce qui suppose des mécanismes différents mis en place. Cela vient appuyer une thèse que la rotation est liée à la mécanique du transfert.

Tout m'oriente vers ce qu'on peut voir sur les plateaux rotatifs pour chemin de fer ou encore les puzzles glissants.

L'idée est donc que le mécanisme nécessite un déblocage ou un dégoupillage pour passer d'un état à un autre. Dans le cas présent, le siège doit se désolidariser du rail de la soucoupe puis se solidariser au rail du robot pour finir par occuper le centre de commande.

Ainsi, le siège, à la fin de la descente, arrive sur un butoire qui le force à se retourner, un nouveau rail le prenant alors en charge. Arrivé à l'entrée de la tête, le même type de mécanisme se reproduit pour le placer dans le bon sens. CQFD.

La mécanique est donc simpliste, la conspiration absente et la prudence innocente. La simplicité de la raison serait-elle la cause de la langue de bois de Go Nagai ?

Le premier générique de 78 en prime (mon préféré)

[video]http://www.youtube.com/watch?v=dOO3LgzXdYg[/video]

Et la version de Noam

[video]http://www.youtube.com/watch?v=SvDsjWerRug&feature=related[/video]

PS : c'est la faute à Henley.

Météo : le jour d'après hier

2012-07-09T15:51:09+02:00

On est en novembre

{.left} L’un des principaux sujets de discussion, où que l’on soit ces derniers jours, c’est la météo. Il n’est pas rare d’entendre des “Mais c’est quoi ce temps de novembre ?” ou de lire des articles sur la mauvaise météo comme si le temps se déréglait. Où encore le titre du jour du parisien : “L’été … seulement dans le sud”. En étant en 2012, on arrive sûrement à la fin du monde …

C’est la fin du monde

Lorsque je vois la pluie des derniers jours, ca me fait immédiatement penser au Jour d’après.

Certains y voient des prémisses de fin du monde. D’autres, la fatalité de l’industrialisation du monde. L’agent Smith lui, y voit les conséquences de l’existence du parasite humain. Bref, les théories sont nombreuses, toutes valables pour peu que l’on soit ouvert, aucune démontrée, pour autant, tout le monde sort sa science.

On sort notre science

Bon déjà, on vire la théorie des Mayas. Pour faire court, c’est un romancier (Steve Alten) qui a voulu se faire mousser en s’auto proclamant expert et, à coup de promotion nous a vendu sa prophétie. Ensuite, replaçons aussi nos chers présentateurs TV à leur rang : les présentateurs de la météo ne sont pas des météorologues. Tout est dans leur titre : PRE-SEN-TA-TEUR. Alors, nous ressortir des statistiques comme cela leur chante, au final, on en revient à la manipulation de masse par les médias, tant adorée par les conspirationnistes et qui ici prend toute sa forme. Bref, passons.

Un peu de concret

Notre galaxie bouge dans l’univers. Notre système solaire bouge dans notre galaxie. Notre planète bleue bouge dans notre système solaire. Ce mouvement est à la fois sur une rotation ovoïdale autour du Soleil, mais également une rotation sur un axe en mouvement (rotation et bascule), axe dont l’inclinaison varie. La Lune aussi bouge. Tout bouge. Mais chacun de ces corps a une incidence sur l’autre. Les plus classiques et visibles, sont la météo et les marées par exemple. Tout ceci pour en venir justement à ce que nous disaient nos chers Mayas (et autres civilisations anciennes, pré-colombiennes en tête) : tout est cycle dans le monde vivant. Ce qui fut dans un sens, sera dans un autre et inversement. L’axe de la Terre a pivoté plus d’une fois. De nombreuses ères glacières se sont succédées. Les saisons s’enchaînent. Lors d’une marée haute d’un côté, la marée est basse ailleurs. Les rivières sous marines tournent. Ok très bien. Tout évolue. Pour autant si l’on suit les médias, la météo semble se dégrader de manière continue et irrémédiable, et les saisons ne plus être ce qu’elles devraient. Oui, mais. Oui tout ceci est un fait, mais parce que nous n’avons aucun recul du fait d’être “la tête dans le trou”, nous ne voyons réellement le pourquoi du comment. Oui il est sûr que l’industrialisation humaine a joué sur la vitesse de réchauffement du climat. Comme le dégazage sauvage de la part des dinosaures pourrait avoir causé leur perte. Mais justement, parce que tout est cycle, le changement est lent et progressif. Après tout, on parle de millions d’années pour les périodes de vies des sauriens contre quelques millénaires pour l’humanité. Que de relativité. Alors que dire de la météo actuelle à notre échelle. Une simple averse dans la longue vie de la Terre. Alors que se passe-t-il ? une accumulation de choses, plus ou moins naturelles, plus ou moins aidées par l’Homme. Voici une petite liste non exhaustive, crédibles ou non.

Les rivières sous-marines

Une idée avancée par Wallace Broecker consiste en l’étude de lents courants sous marins chauds s’étendant à travers les divers océans, et ayant des cycles de 1500 ans. Ces courants influeraient sur la météorolgie globale du fait des écarts de température entre les eaux, de leur mouvement global (à distination des pôles) … Le géochimiste explique d’ailleurs dans sa thèse que le courant aurait ralenti de près du tiers de sa vitesse en un siècle, ce qui pourrait avoir de grave répercussion sur la météo (entre autres choses).

### L’industrialisation

Que cela soit l’industrialisation au sens premier depuis le XIXe siècle ou encore les théories bio-écologiques concernant la production de la viande. Que cela soit les modes d’agricultures, ou encore la génération de méthane par les bovins. Il faut dire ce qui est : les proportions des gaz constituant l’air terrestre ont drastiquement changé en deux siècles et impliquent des changements important au niveau de l’éco système. Ce point est indéniable mais n’explique pas tout à lui seul.

Le cycle de la météo

Je disais donc que tout était cycle. Au niveau météo aussi. Certes il nous manque des données scientifiques pour de grandes périodes, mais certaines données sont suffisantes pour extrapoler une hypothèse valable. Arnaud Lemaistre le rapportait dans un document intitulé “Chronologie climatique du dernier millénaire en Europe”. Ainsi, généralement, la température était bien plus basse avec un temps plus sec. D’ailleurs les hivers étaient plus marqués avec des températures négatives sur toute la période. Mais il y a eu une petite exception d’une trentaine d’année entre 1710 et 1740 où les températures sur l’année étaient équivalentes à celles d’aujourd’hui avant un brusque refroidissement. Notre situation n’est donc pas exceptionnelle, et l’époque citée permet d’innocenter temporairement la présumé-coupable industrialisation. De plus, l’augmentation sur le siècle concerné était de +1,9° contre “seulement” 0.6° pour le siècle dernier. Intéressant. Dans le même ordre d’idées, certains ouvrages concernant l’époque moyennageuse rapportent des hivers en été et des étés en hiver. Difficile d’avoir des données concrètes cependant. La période de glaciation se produisit principalement avant le Xe siècle, les trois siècles suivant offrant une période chaude, propices aux voyages de nos cousins Vikings, par ex. Enfin les périodes glacières s’étalent sur des périodes de 100.000 ans avec des périodes chaudes dites inter-glacières de 10.000 à 20.000 ans.

### Autres causes

Rapidement, une liste non exhaustive d’autres causes qu’on peut lire à gauche à droite :

le changement d’axe de rotation de la Terre
les nazis planqués sur la face cachée de la Lune
les ondes radios (téléphones, wifi, radios, TV, …) qui perturbent le champs magnétique terrestre
l’autre (c’est toujours la faute de l’autre)
le serpent qui se mort la queue : il fait de plus en plus chaud, donc fonte des calottes polaires donc réchauffement
la crise socio-économique (rah les banques et les traders !)
pratiques agricoles pour nourrir la population globale (enfin surtout le “Nord”)
les chinois islamistes du FBI
les cycles de l’activité solaire
42
la famille et les potes de Roswell
les changements géologiques (naturels ou humains) : désertification, déforestation, …
Obi-Wan Kenobi

Je vous laisse faire le tri selon vos croyances ou compétences.

Quoi qu’on fait ?

Tout et rien. Oui, il faut intervenir sur l’industrialisation qui peut se révéler plus que néfaste, mais elle ne peut supporter l’entière responsabilité des changements qui se produisent. On ne peut que constater un cumul entre les actions de la nature, les cycles et bien sûr l’intervention humaine ayant pour conséquence le changement, sa vitesse et son ampleur. Est-ce définitif ? La météo du XVIIIe siècle nous montre que non. Alors profitez simplement de la vie. Profitez du soleil. Profitez de la neige. Profitez de la pluie. Qu’est ce que cela change que l’on soit en juillet ou mars ou que sais-je ? Adaptez-vous et profitez ! Pour finir, petit point qui me fait rire sur les écolos critiquant l’industrialisation : pour modéliser les différentes théories, les chercheurs utilisent les ordinateurs privés à la façon des projets Seti ou des projets sur le cancer … Seulement 150.000 ordinateurs qu’ils disent. Question, on les alimente avec quoi ? (question valable pour le rechargement des voitures électriques).

The Amazing Spider-Man : j'ai une araignée au plafond

2012-07-05T23:37:59+02:00

Un redémarrage nécessité ?

{.left} Alors qu’une première trilogie s’était affichée sur nos écrans entre 2002 et 2007 avec un Tobey Maguire en guise de Peter Parker/Spiderman peu convaincant dans le costume, Sony Pictures remet le couvert avec un redémarrage complet de la license. Cette fois-ci, c’est Andrew Garfield qui revêt la tenue rouge et bleue de l’homme araignée. Personnellement, vu les derniers comics, je pensais que Sony aurait suivi l’orientation de Marvel avec un Peter Parker afro-américain. Mais il faut croire que l’ouverture n’aurait pas aidé aux entrées en salles. Sam Raimi avait accompli un superbe travail sur la précédente saga étalée sur la dernière décennie. Pas sûr qu’un redémarrage soit si nécessaire. Pour autant, quelques corrections étaient à apporter et la nouvelle saga en approche se propose de les corriger.

Du gros spectacle

Des erreurs corrigées, il y en a … Pourquoi Peter repliait seulement deux de ses doigts pour tisser sa toile ? Simplement pour déclencher un appareil de sa création qui la tisse ; non, ce n’est pas lui qui la “produit”. Mary-Jane ? Non ils ne se sont pas connus au lycée ; c’est Tante May qui voulait à tout pris le caser bien plus tard, son pauvre chéri au coeur brisé. Où accroche-t-il sa toile pour voler ? Simplement aux grues qu’on lui sert sur un plateau ; non ca ne tient pas dans le vide. Attention, on nous annonce non plus Spider-man mais The Amazing Spider-man et il va être époustouflant.

Cependant, ici aussi, quelques erreurs sont faites : cartographie de NYC, rencontre avec Curt Connors/The Lizard, absence d’Harry Osborn, … et surtout absence de LA phrase résumant la conscience de notre amical arachnide : “A grand pouvoir, grande responsabilité”. On a bien un simulacre de phrase pour nous la rappeler, mais le poids des mots n’y est pas. Dommage. Dommage aussi la longue introduction, qui semble ramener le film à un teenage-movie lycéen. Mais, place au spectacle. On commencera par apprécier le casting avec un très vieillissant Martin Sheen en Uncle Ben (non pas Uncle Ben’s, ni Ben l’Oncle Soul) - cela reste toujours un succès ; un charismatique Rhys Ifans que l’on a pu voir récemment en James Hook dans Neverland (mini série de Sy-Fy relatant la génèse de Peter Pan) ou en tant qu’un des sorciers dans Harry Potter et les reliques de la Mort ; une sexy Emma Stone très appréciée dans Zombieland. Heureusement, le film ne se résume pas seulement à son casting ou à son introduction pubère à rallonge. Ses deux heures quinze se chargent de nous en mettre plein les mirettes pour nous faire oublier le travail de Sam Raimi. Et il faut dire que le spectacle est là, se déguste, le pop-corn disparaît bien trop vite et les acrobaties de l’araignée nous comble. Andrew nous fait d’ailleurs vite oublier un Tobey Maguire qui donnait une image niaise à Peter Parker. La réal tient la route. Graphiquement, on en prend plein la vue. L’histoire est agencée dans une optique de saga à nous distiller longuement les secrets de l’univers. J’avais apprécié la précédente saga : je sens que je vais adoré la nouvelle saga qui s’amorce depuis hier dans les salles obscures. Allez, pour la route, je vous laisse découvrir un petit plaisir personnel du soir.

Olala, pfff, je suis parisien !

2012-07-05T11:29:34+02:00

Vous vous souvenez certainement de ma revue de How to become parisian in one hour d'Olivier Giraud ? Après avoir fait salle comble pendant 3 ans au théatre de la Main d'Or, il revient, dans une salle bien plus grand, le théatre des Nouveautés pour au moins un an. Il y fait encore le plein. On y rit encore et toujours pendant toute l'heure. Je crois qu'il faut que j'y retourne encore pour un autre shooting. Petit reportage photo ...

PS: Olivier, pour l'exercice final, tu devrais faire monter un étranger pour jouer le parisien et un parisien pour jouer l'étranger.

[print_gllr id=1660]

Les moines danseurs de Majuli

2012-07-03T19:55:36+02:00

Sattriya – danse sacrée (Assam, Inde du nord-est)

Spectacle conçu et dirigé par Bhabananda Barbayan

Depuis dix ans, le sattriya fait officiellement partie des huit danses classiques principales de l’Inde. Sattriya vient du mot « sattra » qui désigne les monastères hindouistes de l’Assam (nord-est de l’Inde) fondés au XVème siècle par le maître Srimanta Sankardeva (1449-1568). La danse sattriya fut créée pour accompagner les Ankiya Naat, une forme locale de théâtre dévotionnel consacré aux épisodes de la vie de Krishna et Rama.

Les moines danseurs de Majuli constituent aujourd’hui la meilleure troupe de sattriya de l’Assam. Artiste au charisme exceptionnel, Bhabananda Barbayan figure parmi les danseurs les plus primés dans sa discipline. Héritier d’une transmission ininterrompue depuis cinq siècles dans les monastères, il guide les moines danseurs de Majuli au-delà des frontières des sattras, de l’Assam et de l’Inde. De magnifiques lampas (lés de soie) de l’Assam datés des XVIème/XVIIIème siècles conservés au musée Guimet seront le fil conducteur de ce nouveau spectacle. Les lampas ont été conçus du vivant du fondateur du sattriya et nous en montrent l’exacte origine : la vie de Krishna, les avatars de Vishnu, Narasimha (homme-lion), les aventures de Ram, Sita, Hanuman (singe), Ravana (démon), etc. Souhaitant apporter un souffle nouveau à la tradition tout en préservant le style chorégraphique propre au sattriya, Bhabananda Barbayan a intégré ces soieries dans la scénographie. Il a notamment opéré d’importants changements dans la création des masques et des costumes, inchangés depuis des siècles. Le plaisir de découvrir le sattriya classique dans sa forme la plus pure se mêlera à la magie de voir les personnages des soieries anciennes prendre vie grâce à la danse, la musique, le chant, le jeu d’acteur et les masques.

Plus d'information sur leur tournée, sur Majitour.

[print_gllr id=1513]

Le texte provient du site du musée Guimet.

Okay café : crêpe à l'eau

2012-06-29T18:43:35+02:00

Avec une météo mitigée qui nous rappelle la Bretagne, pourquoi ne pas manger une crêpe, mais les pieds dans l’eau ? C’est ce que nous propose l’Okay Café, situé sur le canal de l’Ourcq à Paris.

Ambiance

Le cadre, extérieur comme intérieur, fait plaisir : le restaurant et sa terrasse sont posés sur les quais du canal avec une déco simple mais plaisante. On est vraiment les pieds dans l’eau et à part la pollution, on pourrait se croire à la mer (merci les mouettes parisiennes). Petit plus vu le volume disponible, un coin jeu pour les gamins est prévu à l’intérieur. De quoi ravir tout le monde. L’équipe quand à elle est disponible et vraiment agréable, bien que non bretonne : personne n’est parfait !

Nourriture et boisson

Niveau prix, la carte annonce des tarifs dans la moyenne ce qui est agréable avec des crêpes entre 9 et 13€. Dans cette ligne directrice de la moyenne, le goût et la garniture des crêpes se développent : ni exceptionnel ni mauvais. A croire que le cadre devrait tout faire. Dommage car une garniture plus fournie ou des ingrédients aux goûts plus marqués auraient fait un énorme plus. Par contre, le cidre fermier se boit très bien, et sa fraîcheur fait du bien avec les chaleurs (rares ?) des derniers jours. Au final, une crêperie agréable au cadre parfait pour les petits restos d’été à Paris.

The Dictator : Aladeen a dit : "Aladeen !"

2012-06-26T11:06:32+02:00

{.left} Imaginez que l’Amérique soit une dictature. Vous pourriez laisser 1% des gens posséder toutes les richesses du payer. Vous pourriez laisser vos amis s’enrichir en baissant leurs impôts et combler leurs pertes. Vous pourriez interdire aux pauvres les remboursements de santé et l’éducation. Vos médias seraient entièrement libres mais aux mains d’une seule personne et sa famille. Vous pourriez torturer des prisonniers étrangers. Vous pourriez trafiquer les élections. Vous pourriez mentir sur les raisons d’aller en guerre. Vous pourriez remplir vos prisons avec un groupe particulier de personnes et personne ne s’en plaindrait. Vous pourriez utiliser les médias pour effrayer les gens pour qu’ils supportent une politique qui va à l’encontre de leurs intérêts.” … Oui, ne faisons qu’imaginer.

Après tout, Kim Jong-Il considère que ce film est de la bombe. Alors pouvons-nous être d’accord avec un dictateur ? Mis à part leur complexe de supériorité, leur délire psychotique, leur démesurée ridicule (je vous laisse comprendre), ce sont des hommes comme les autres … Nous sommes d’accord sur notre désaccord. Ce film est de la bombe. Mais les dictateurs ne sont pas comme vous et moi. Quoi qu’ils sont peut-être comme moi (concernant leur égo) : bah oui, ce n’est pas moi qui vais être comme eux ! Comment résister aux explosions de rire que nous confère le film tout au long de sa petite heure et demie. Sacha Baron Cohen enfile le costume du dictateur Aladeen regroupant tous les stéréotypes médiatiques des dictateurs récemment tombés ou morts. Un dictateur inculte, champion de ses propres JO, acteur oscarisé à de multiples reprises à sa propre remise de prix pour ses propres films, aimé d’un pays motivé à l’aimer, … Aladeen est parfait en tout point. Tout lui réussit s’il l’a décidé. Sinon … couic … Reste que le pouvoir attire toujours la convoitise, surtout de ceux qui veulent en plus l’argent. Et là, c’est le drame. Le voyage politique à New York se transforme en putsch presque raté qui nous offre l’une des meilleures comédies de l’année, dans la droite ligne de ce que nous avait offert Borat et son voyage en Amérique profonde. Les stéréotypes sont amplifiés. La bien pensante amérique malmenée. La politique bénéfique ridiculisée. Et bien sûr, l’argent ne fait pas le bonheur mais achète tout le monde, les artites en tête de liste (Megan Fox, Edward Norton, …) Aladeen nous offre donc un film Aladeen. Il est donc Aladeen d’aller le voir pour s’Aladeen de rire. Un avis Aladeen sans Aladeen. Juste Aladeen.

Dias de Gracia : Coup de sifflet final

2012-06-20T12:01:03+02:00

Hier soir, le Mexique nous a offert un match de haut rang : le Mexique ensoleillé de la carte postale contre le Mexique violent de la réalité. Le match s’annonçait dur, sauvage, animé. Deux heures de spectacle où les aficionados des Coupes du Monde 2002/2006/2010 étaient les seuls à comprendre le rythme effréné. Ce fut un jour de grâce pour les joueurs. Ce fut leur Dias de Gracia.

Destins croisés entre un jeune boxeur désabusé et perdu, un flic hyper motivé et très manichéen et un otage de la haute. Le tout narré au long de 8 ans, rythmé par les coupes du mondes qui servent de point de repère temporel. Autant dire qu’un néophyte en foot se perdra très vite. Le match s’averrant bien long avant le dénouement permettant de tout remettre à sa place. Dans un pays qu’on dépeint souvent avec son soleil, sa téquilla ou son shivas, ses plages au Spring Break, nous découvrons un envers du décors bien plus violent ou la corruption est reine et fait partie, avec sa soeur violence, du quotidien de tout à chacun. Qui sont les arbitres ? Y en a-t-il vraiment ? Qui contrôle quoi ? Quelle est la vraie vie de chacun ? Un grand médecin (Dr. House pour ne pas le citer) nous disait : “Tout le monde ment”. C’est bien là le soucis, dans ce pays totalement perdu où il est si facile de se perdre soi-même. L’action est ultra nerveuse. La caméra affolée. L’ambiance sur-chauffée. On accroche très vite. Et pour moi, qui suis anti-foot et donc sans connaissances réelles sur les Coupes du Monde, j’ai quelque peu souffert de la chronologie décousue et rafistolée à coup d’annonces de match à la radio ou d’images rapides à la TV. Ca m’a presque gâché le plaisir. Le concept est là. La qualité aussi. On sent que le Mexique vit pour le foot par moment et c’est dommage pour certains d’entre nous. Pour autant, à voir et à subir. Coup de sifflet de fin.

Blanche Neige et le chasseur : neige sombre et le miroir pas si enchanté

2012-06-19T15:35:29+02:00

Il est bon de croire que cette année audio-visuelle (saison 2011-2012) est celle des reprises de contes. Après tout, la télévision nous a offert Grimm et Once upon a time, deux séries prometteuses (et prolongées), alors que le cinéma nous offre deux versions de Blanche Neige en moins de deux mois (1 et 2). Et ce, sans parler des adaptations distribuées directement en vidéo. Pour autant, chaque version apporte sa touche au conte. Cette fois-ci, on s’intéresse à la version sombre.

On a tous en tête au moins la version de Disney. Coloré, (en)chantant, … Disons que les Bisounours ont muri et se racontent trop d’histoire en étant beurrés. Ca devient sombre, glauque et presque sale. C’est un peu le même effet que la Marâtre opère sur son monde. De toutes les versions live du conte qu’on ait pu voir à l’écran, il est une chose certaine, c’est que Charlize Theron est LA reine dont il faut se souvenir : magnifique, imposante, ensorcellante, puissante … Pour autant, sa beauté est une tragédie pour son monde. A moins que sa Dear, Dear Snow White puisse tous les sauver. Et là, c’est le drame. Blanche Neige est censée être belle, pleine de vie, souriante, chantante … Oui, le film nous dit qu’elle est la Vie et que la Nature l’aime. Mais, il y a un énorme hic. On nous impose la morne Kristen Stewart qui a bien du mal à sourire même pour les plus belles choses (rien que son sourire forcé du dernier écran est bien douloureux). Puis bon, on est dans une version “sombre”, alors il faut qu’elle devienne guerrière pour que ca saigne ! Là encore, c’est le drame : elle se veut meneuse d’hommes. Pour un conte anti féministe quelque part, où la femme ne vaut que pour sa beauté éphémère (voir la tirade de Charlize Theron à ce sujet), clairement le monde est peuplé de Simplet. Quelques battement de cils, et la pire harangue pour motiver les troupes de tous les temps suffit à tous les motiver à se faire trucider. Bien sûr, le titre du film nous en prévient, elle est assistée du Chasseur. Pour camper le rôle, c’est Thor (Chris Hemsworth) qui s’y colle. A croire qu’il est séduit par les petites brunettes, le Viking… Alors attention, cette fois-ci, on ne lui demande pas d’être (juste) musclé, ni humaniste, mais aussi d’avoir un coeur d’artichaut. Il en est bien affaiblit le grand gaillard. Son jeu aussi. Mirror, Mirror on the wall est lui quasi transparent. On a beau le voir, planté là, imposant de son reflet d’or, pour autant … il aurait pu être ailleurs, ca n’aurait pas été bien grave. C’est comme le bon “Prince” qui n’est plus que simple fils de Duc et qui, à part vouloir jouer au docteur avec la Princesse, ne sert plus à grand chose. Par contre, les septs nains, et les acteurs choisis (Bob Hoskins, Ian McShane, Toby Jones, Eddy Marsan, Nick Frost, …), sont tout bonnement parfaits dans leurs rôles. Par contre, si vous vous mettez à siffloter en vous remettant au boulot (getting back to/from work), vous risquez de vous faire décapiter par Grincheux. Au final, une affiche prometteuse pour nous oublier la version colorisée avec Julia Roberts, un casting qui serait parfait avec une autre Blanche Neige, de beaux écrans, une bande son bien sympa, des nains sur puissants … Ce film avait tout pour être un bon. Mais l’actrice et l’adaptation en lui même du rôle de Blanche Neige font tâche et pourraient gâcher le film. Heureusement, la reine Ravenna nous permet de passer un bon moment et compense ce raté. Au passage, pour ceux que ca intéresse, un peu de culture, ca ne fait pas de mal donc on demande à notre ami Wikipedia.

21 Jump Street : l'abus de drogue est dangereux pour la santé

2012-06-15T14:07:49+02:00

Il y aura un avant et un après 6 juin 2012. La sortie d’un film a scindé le monde en deux catégories : les vieux et les jeunes. Les vieux, ce sont ce qui regardait la TV le samedi matin dans les années 80/90 pour regarder les exploits de jeunes flics infiltrant les lycées pour démenteler des réseaux de drogues ou attraper des violeurs. Les jeunes, ce sont ces gens de la génération Z, qui n’ont pas connu tout ca. Après ce 6 juin 2012, les premiers se drogueront pour oublier, les derniers continueront à se droguer.

Ce film c’est l’adaptation ciné de 21 Jump Street (rappel de la série d’origine). A la base, la bande annonce m’avait décidé à fuir le film. Au final, Henley confirmant que j’avais raison de le faire a titillé ma curiosité : il est bien connu que j’ai toujours raison mais de là à avoir raison sans savoir … Il fallait que je juge sur pièce. Pour moi, 21 Jump Street. ce sont les aventures d’Hoffs, Ioki, Penhall et bien sûr Hanson, le tout orchestré par le Capitaine Fuller, ces jeunes officiers s’infiltrant dans les écoles pour parler de choses sérieuses sur un ton sérieux limite sombre et moralisateur, dans une amérique en délabrement. Mais aujourd’hui le sérieux n’est pas vendeur. Par contre des teenage movies à la Project X, ca c’est vendeur. Pour le reste, c’est le Deputy Chief Hardy qui nous l’explique.

Nous réactivons un ancien service d’infiltrations policières mis sur pieds dans les années 80 et nous le mettons à l’heure d’aujourd’hui. Voyez vous, les gens chargés de ces services n’ont aucune créativité et sont totalement à court d’idées alors tout ce qu’ils savent faire c’est recycler de vieux trucs du passé et espérer que personne ne re-marquera rien.

Voilà tout est dit : une license à succès existe et il y a surement moyen de s’en mettre plein les poches 20 ans après l’arrêt de la série. Ca sent la parodie à plein nez, le teenage movie sur joué (et mal joué), l’ambiance m’as-tu vu des banlieues chics, l’absence complète de caractère … Et une fois qu’on a passé le quart d’heure d’intro en se forçant à supporter le film, on prend notre rail pour voir un ce navet qu’il faudrait renier. D’ailleurs, je me demande comment les acteurs de la série ont pu accepter d’y participer (Peter DeLuise, Holly Robinson et surtout Johnny Depp) ! D’ailleurs, la chapelle n’est plus la même … Et on se coltine un Christ Coréen, qui n’a pas le temps de s’ocupper de vos conneries, il a déjà bien à faire avec ses merdes coréennes. L’usage de la license n’est qu’un prétexte éhonté pour une sur-enchère devenue habituelle sur grand écran, où rien n’est fait pour être sérieux. D’ailleurs, plus d’une fois, j’avais l’impression de revoir News Kids Turbo. On pourrait se dire que la méthode est là pour faire assimiler à la génération Z certains concepts quant à l’utilisation de la drogue. Mais même là, c’est loupé et la morale échappe à tout contrôle. Décevant en tout point. Et dire qu’ils se sont laissé une porte ouverte à une suite. Les rares bons points selon moi de ce film ?

la voiture
la présence des anciens (encore une fois, le duo Penhall/Hanson est à savourer)
le générique de fin

Vous voulez aller le voir ? si vous êtes “vieux”, droguez-vous, sinon, droguez vous.

Les filles ne comptent pas pour des pêches

2012-06-11T11:22:25+02:00

{.left} Ah, la cérémonie du mariage : les sourires (faux-culs ?), la boisson, les histoires, … les demoiselles d’honneur qui détestent toutes la mariée … C’est ainsi que nous faisons la connaissance de cinq demoiselles d’honneur, au fil de la pièce d’Alan Ball, 5 filles couleur pêche. Entre alcool et joints, déboires amoureux, vies sexuelles compliquées mais débridées, relations avec la mariée, hommes à femmes, … elles nous font vivre leurs sentiments et ressentiments. Tous les sujets y passent, même les plus sérieux, déclenchant l’hilarité du public. Comment garder son sérieux quand on les voit toutes plus folles les unes que les autres, rêvant de leurs ébats dans les poubelles ou utilisant la religion comme excuse à tout et surtout à la niaiserie. On ne peut que se rompre de rire de leurs extravagances et leurs folies. Personnellement, la seule critique que je ne me suis pas gêné de dire aux filles : c’est trop court, on avait encore le temps ! Il ne vous reste qu’une seule et unique représentation parisienne, le 24 juin. C’est au Sonar(t) à Pigalle, c’est gratuit (enfin boisson obligatoire et chapeau pour les filles). A voir. Sinon, vous pourrez les suivre à Avignon cet été !

Prometheus : promettez nous de ne pas crier dans l'espace

2012-06-10T13:26:44+02:00

A la question “qui sont nos créateurs ?”, il est maintenant dans la culture populaire de croire que nos anciennes civilisations avait la réponse : nos dieux-créateurs étaient des extraterrestres. Dans ces conditions, si vous trouvez la route pour aller leur passer un petit coucou, pourquoi ne pas le faire ? C’est ce que nous propose Ridley Scott.

Comment parler de la polémique du film sans spoiler ou sans critique les cinéphiles du dimanche ? Tout simplement en une phrase : “si ca en a le goût, si ca y ressemble, si ca a la consistance et si ca vient de la même bestiole, c’est que c’en est”. Ca c’est dit. Passons. L’intro du film, j’ai mis 24 heures a réellement en comprendre tout le sens et franchement, c’est abusé. On nous la balance à la figure, on s’attend à quelque chose, puis d’un revers de main on passe à autre chose qui n’a aucun lien. Ridley, si tu me lis, c’est la première fois que tu me déboussoles et me perds ainsi : je suis surpris mais surtout déçu. Quoiqu’il en soit, l’art visuel est là : l’image est belle, l’action net, les couleurs dépaysantes, la bande son ennivrante. Mais est-ce suffisant pour nous empêcher de crier ? Pas sûr. Vingt cinq ans avant les mésaventures du Nostromo, le Prometheus part à la rencontre de nos créateurs et ne trouvera que notre fin. Découvrir ce monde de création et de destruction offre tellement de possibilité de terreur que les sentiments autres n’y trouve pas leur place. D’ailleurs, c’est le capitaine qui nous le fait remarquer : “Etes-vous humaine ?” On explore donc cette planète, les poils hérissés pour certains, les mains crispées pour d’autres, les doigts pleines du caramel des popcorns pour les derniers. Le voyage promis est là. Une jolie carte postale d’horreur spatiale que l’on se plait à voir. Mais souvenez-vous :

Dans l’espace, personne ne vous entendra crier.

Bon pour le spoil : non ce n’est pas un clin d’oeil, bande d’ignards !

Blend : Le burger se fait gourmet

2012-06-10T13:04:59+02:00

La France a eu sa mode du restaurant chinois, puis celle du japonais. Aujourd’hui c’est le burger. Combien de restaurant ouvrent avec pour seule carte des variations sur le burger ? J’avais déjà eu l’occasion de tester HAND (d’ailleurs il faudra le rester pour vous gratifier d’un billet), mais je n’avais pas encore fait dans le burger gourmet. C’est la proposition de Blend dans le quartier de Montorgueil. Goutons.

Ambiance

L’ambiance est épurée, design, relativement sobre et simple. Cependant tout est fait pour aller vite. On se tassera à plusieurs couples différents par table si l’on est pas venu en groupe de quatre, on s’assiera sur de simples mais lourds tabourets en bois, on lira la carte sur un simple bout de papier glissé dans une fente en milieu de table. Au passage, concernant la carte, petite erreur de leur part, la carte affichée en grand à l’entrée du restaurant ne correspond pas à celle proposée à table. Inutile de réfléchir à l’avance pour occuper les 30 à 45 minutes d’attentes aux heures de pointe. Le personnel bien que sympathique vous fera comprendre qu’il faut aller vite. On fait dans le gourmet, pas dans la discussion ici !

Nourriture et boisson

Cinq burgers, aux noms sobres mais aux compositions très classieuses, émoustillent nos papilles d’avance et nous posent de sérieux dilème quant au choix à faire pour le diner. Venir nombreux aide à résoudre : chacun en prendra un différent pour partager et faire goûter aux autres. Que cela soit la viande cuite de manière parfaite, le steak de mozarella qui vous en offre une bonne portion d’un goût esquit, ou encore les frites maisons aux patates douces, que de ravissement pour le palet. Et que dire du pain brioché maison ? Le tout servi dans une petite barquette métale simplicime. Bien sûr, un bon repas s’accompagne d’une bonne boisson. On nous propose ici des bières assez exotiques (la Bellerose ou encore la californienne Sierra Nevada) qui s’accomoderont idéaliement aux burgers. On achève cet exercice culinaire par le dessert. Le choix du jour s’est porté sur le cupcake chocolat : je dirais très bien, mais pas excellent. Le moelleux au chocolat servant de base peut s’améliorer. Reste que cette adresse est à recommander et à tester, plusieurs fois, pour confirmer la qualité. Non je ne suis pas gourmand ! D’ailleurs, avec un repas “normalement humain”, pour une fois, j’ai été rassasié. A noter.

La classe : on ne parle pas en classe

2012-06-10T12:15:00+02:00

Une ambiance de classe comme nous avons pu en avoir que l’on soit trentenaire ou plus, une carte prometteuse, voilà ce que nous offre la Classe (Paris 9e).

Ambiance

Les tables sont de tailles adultes mais impossible de ne pas se souvenir à quel point les nôtres pouvaient être petites pour des adultes : la table pour deux, avec la double barre au milieu pour relier les chaises, les casiers en bois ou métal pour ranger les affaires, le trou pour l’encre, la rainure pour poser les stylos ; les cartes de France, d’Europe et du Monde avec leur typo très simplifiée ; les rayonnages de livres vieillis et jaunis ; … Ah, l’école primaire de notre enfance, que de souvenir ….! Tout y est pour nous transporter dans nos souvenirs. Le personnel très sympathique nous apporte alors la carte des vins pour l’apéro dans une couverture de cahier. Vraiment, tout y est. Comme à la cantine, l’eau est servie dans les bons vieux verres Duralex ronds.

Nourriture et boisson

Une carte des vins à rallonge qui nous offre un large choix selon les goûts de chacun, selon les bouteilles, servis au verre ou non. On déguste tranquillement notre petit rouge ou notre petit blanc. Mais vu que nous y sommes aller pour l’apéro plutôt que pour le dîner, il faut bien “éponger” un peu l’alcool consommé pour profiter du reste de la soirée. Pour celà, il suffit de demander une planche charcuterie/fromage. Et là, servis accompagné d’une baguette à l’ancienne bien chaude, l’apéro prend une dimension magique. Tout y est bon. Tout y est fin. Tout y a du goût. On en redemanderait presque. Le prix est légèrement élevé par rapport au petit balto du coin mais vu la qualité des produits et l’ambiance, chaque centime dépensé nous offre du plaisir et nous le fait oublier. A y faire l’apéro et à l’y refaire. A tester aussi un repas car celà sent prometteur !

Hot-dog : et un clébard chaud !

2012-06-07T12:20:53+02:00

L’autre jour, se faisant faim et désirant changer un peu de cantine, mais aussi des plats habituels, on a voulu se faire un hot-dog. Aux Halles, en surface, se trouve le Dog’s Café, qui se targue d’être le meilleur chien chaud en ville. Ambiance et digestion.

Ambiance

Franchement, rien à redire. On est vraiment emmené dans un diner avec ses grandes baies vitrées, son zinc à rallonge sur lequel on va pouvoir diner, installé sur de hautes chaises. Le cadre est là. Le service aussi, la serveuse est disponible, agréable et souriante. Le cuistot agréable et également disponible. On apprécie et on demanderait presque du jus de chaussette à discrétion.

Repas

La carte est prometteuse : entre le hot-dog newyorkais au choux, le hot-dog Miller à l’oignon frit et ce chili con carne, on espère se régaler, et le choix entre une saucisse au porc ou au poulet. Malheureusement, la qualité n’est pas à la hauteur de l’annonce. En bref ?

pain trop sec : un pain grillé à la plancha et n’offre plus le moelleux d’un bon pain pour hot-dog et trop petit pour se manger à la main si l’on prend deux saucisses
une saucisse générique, juste bonne
un fromage à revoir : le supplément fromage offre une vulgaire petite tranche de cheddar fondu, que le burger soit à une ou deux saucisses … copie à revoir
des pommes de terres sautés un poil trop grasses
pas d’oignon frais
la présentation en assiette est dommage : des barquettes auraient été plus dans le trip dinner
le choix dans les bières est plutôt restreint mais la Bud et la Coronna permettent de rester dans l’ambiance

Conclusion

Au final, pour un prix honnête on s’en sort avec une qualité en deçà de la moyenne alors que le cadre est vendeur et l’annonce prometteuse … On peut attaquer pour publicité mensongère ?

Perfect Sense : le 6e sens

2012-06-07T11:46:17+02:00

Deux mois après, je réalise qu’il me manque une revue : celle de Perfect Sense. A croire que justement, j’ai également perdu mes sens puis ma mémoire …

On suit Susan, Michael et un monde malade. Susan est une épidémiologiste désabusée par son histoire amoureuse et ses problèmes de santé. Michael est chef cuisiner et charmeur à ses heures perdues, incapacité à s’attacher. Le monde, lui, est malade et se dépérit. C’est l’occasion qui permettra à nos deux tourtereaux de se rencontrer, de flasher et de découvrir l’Amour. La maladie du monde n’a pas de nom, n’a pas d’origine, n’a pas de patient zéro, n’a pas de remède. Rien de connu. Juste la perte d’un sens à la fois, dans le même ordre pour tout le monde, accompagné de symptômes plutôt expressif qui font ressortir l’instinct animal de l’Homme. Mais au final, quel est le sens le plus important à ne pas perdre ? Comment vivre sans nos sens ? Le film aurait pu virer à l’étude psychologique de masse mais nous offre l’un des couples les plus fusionnels qu’on ait pu voir sur grand écran pour nous glisser cette réflexion à mener. Chacun ira de sa conclusion, mais la vraie question ne serait-elle pas plutôt de savoir ce qui fait que la vie vaut le coup d’être vécue, quelqu’en soit le coût ? Reste que ce que nous fait ressortir le couple Eva/Ewan est tellement fort qu’on aime et souffre avec eux. A ressentir.

Moonrise Kingdom : scout toujours prêt !

2012-06-07T11:12:22+02:00

S’il y a des films qu’on a plaisir de voir et revoir, ce sont les petites comédies infantiles qui nous ramènent à nos souvenirs, à notre propre histoire de gamin. Après tout, nous restons d’éternels enfants. Personnellement, c’est l’effet que me font les films du type la guerre des boutons, la gloire de mon père, le chateau de ma mère et autres … Ce WE, j’ai pu en rajouté un autre à la liste : Moonrise Kingdom.

Une bande annonce qui interpelle par sa bizarrerie et sa fraîcheur, un casting imposant, impossible de ne pas aller voir cet OVNI (Object Visuel Non Identifié). Au final, en regardant de plus près, c’est un peu la période pour ce genre de films (Indian Palace, Perfect Sense, Des saumons dans le désert …). C’est franchement rafraichissant en ces temps … On suit donc la fugue de deux gamins (déjà) désabusés mais amoureux. Un roadtrip dans les bois à la découverte des sentiments, des liens qui peuvent se forger entre les gens, sentiments contre raison, … Une balade en plein ouragan naissant, une chasse à l’homme version scout se prenant pour les Inglorious Basterds, des adultes vraiment pas sain(t)s ni adultes et un cours sur la musique classique (profitez du générique de fin d’ailleurs). Une recette implacable pour des rires tout du long. On ne voit pas le temps passer et on veut y retourner.

Men in Black 3 : j'ai la classe avec un costard

2012-06-06T11:38:55+02:00

Etonnamment, personne dans mes contacts n’avait organisé de soirée en costume pour aller voir Men in Black 3 : pour le coup, vous me décevez les gens ! J’y suis donc aller avec mon Viking. Pour une fois qu’il était sur Paris …

Pour se préparer, je m’étais fais une projection privée des deux premiers en numérique … puis grâce à Panic Cinéma!, une version en salle avec une bobine originale qui saute bien. Et déjà, je peux vous dire que sur les trois, hormis le pourquoi du comment du gros vilain méchant extraterrestre, ce sont les mêmes films, avec les mêmes scènes, dans le même ordre. A une exception : cette fois-ci, K est la demoiselle en détresse. Fil conducteur de l’épisode ? le voyage dans le temps et le paradoxe du grand père revisité. C’est Doc Brown qui aurait apprécié. J doit donc remonter de 40 ans dans le passé pour sauver K tué par le destructeur de planètes, Boris l’Animal (pardon, “Juste, Boris !”). Et pour remplacer le ténébreux Tommy Lee Jones âgé de “110 ou 111 ans”, on nous offre un Josh Brolin tout propre. Celui-ci a du mérite de reprendre le rôle et nous offre là une composition qui nous donne toute l’illusion d’avoir Tommy Lee Jones bien plus jeune (enfin avec un peu de kilométrage quand même pour quelqu’un âgé de 29 ans). A côté de ce jeu, le voyage temporel nous offre une autre vision des extraterrestres : on passe ainsi des modernes numériques aux comédiens grimés façon Star Trek - the original series … Quel plaisir ! Visuellement on se dénote bien les différences avec toutes les références aux vieux films et aux vieilles séries des seventies. Franchement, non ce n’est pas le meilleur des films de la saga car il ne crée pas la surprise du premier, mais il est dans la logique globale de la license et de ce qu’a pu nous offrir le second : un bon spectacle avec de l’action (moins qu’avant, on est trop vieux pour ces conneries), des clins d’oeil, de l’humour et une histoire sympatoche. Juste un bon moment au ciné donc.

C'est Barbie qui a perdu la clé

2012-05-29T21:39:59+02:00

{.left} Ce soir après un taff sous une chaleur assez épuisante, la fraicheur d’une salle obscure avait un air salvateur. Bon par contre, les neurones étaient tous bien grillés donc le choix de genre était tout à fait d’actualité : un gros nanard sous testostérone. C’est donc Lockout qui était tout désigné.

C’est donc l’histoire de Barbie, dite la First Daughter grâce au poste de Président des USA qu’occupe M. Papa Warnock, qui part dans une prison spaciale pour faire dans l’humanitaire. Et là tout dérape…

L’interrogatoire musclé

Pourquoi l’humanitaire ? Parce Papa est méchant. Pourquoi mettre les prisonniers sur orbite ? les cellules les congèlent puis au pire, ca sera l’espace. Pourquoi alors qu’une vitre sépare Barbie du méchant violeur un agent des services secrets est à côté du violeur ? Parce que sinon il ne pourrait pas lui permettre de trouver une arme interdite puis ca flinguerait toute l’intrigue. Pourquoi prendre un gars qu’on considère comme un paria, qui ne fait pas partie de l’armée quand on pourrait aller prendre le meilleur des meilleurs des meilleurs, Sir ? Parce que sinon ce n’est pas drôle, il n’aurait pas la même réthorique.

C’est en frappant qu’on devient forgeron

Demandez donc à Rupert à quel point ca fait plaisir de taper sur Snow ! Il n’y a pas de petit plaisir. Puis il en va de même entre les mutins de prisonniers : pourquoi se limiter aux pauvres gardes sans défense quand on peut se taper sur la gueule non stop … c’est tellement bon toute cette activité physique. Bien sûr, tout ceci est dans le futur, donc appuyé d’effets graphiques dont les Gobelins auraient honte par moment. Et que dire alors de la logique des scénaristes : ils n’ont pas assez regardé les infos je crois : une bombe en collier ca ne décapite par un mec aussi proprement qu’une hache … tout en la désintégrant … Mais bon, c’est ma poussée de testostérone qui me fait mal voir.

Femme qui rit, femme à moitié au lit

Snow, c’est un peu prendre tous nos acteurs fétiches de films d’action des années 80/90, avec une pincée de mec torturé en primaire, et les passer au mixeur. On obtient une savoureuse réthorique cachée par des muscles. Mais le numéro de charme fonctionne. Après tout, c’est ca la recette des vieux films d’actions : un gentil costaud un peu mal béché qui cognent les gros et moches méchants pour libérer la belle Barbie. Mais aujourd’hui ca passe mieux en projection privée ou en vidéo. En tout cas, si l’on vous demande ce qu’il s’est passé dans cette chambre d’hôtel, demander plutôt à votre femme !

Sans issue : c'est pas moi, c'est lui !

2012-05-22T23:34:35+02:00

Ce soir, je continue sur ma lancée du choix du film à l’aveugle : je fonce au cinéma et je prends le premier film qui démarre. C’est ainsi que je me retrouve à m’installer dans la salle pour voir Sans issue, avec entre autres Sigourney Weaver et Bruce Willis pour les pointures américaines mais aussi Henry Cavill, plutôt prometteur, et un gars de chez nous, de la cité d’à côté (puisqu’originaire de Gennevilliers), Roschdy Zem.

Bon avant de rentrer plus dans le vif du sujet, je vais pousser une gueulante : ils ont un soucis les distributeurs français avec les traductions de titres anglais ?! Non mais sérieusement : est-ce que l’un de vous peut m’expliquer comment The Cold Light of Day a pu donner en traduction Sans issue ? Surtout que l’expression anglaise se rapproche plus d’un “voir les choses sous leur vrai jour” … On ne doit vraiment pas parler la même langue. Quoiqu’il en soit, je n’avais rien vu concernant ce film si ce n’est son affiche dans quelques rares salles. A croire que la promo est aussi efficace que la traduction. Du coup, salle quasi vide. Mais bon, je suis d’autant plus libre de vivre le film tranquillement sans parasitage. Pour la faire courte, Will Shaw (joué par Henry Cavill) se retrouve au milieu d’une affaire de contre espionnage américano-israélien pendant des vacances avec sa famille en Espagne. L’enlèvement de celle-ci donnera l’occasion à Will de découvrir les sombres secrets de sa famille. Au passage, on peut noter que Bruce Willis fait de plus en plus d’apparitions courtes dans les films alors que Sigourney Weaver semble se trouver une passion pour les espions (c.f. Identité secrète). Pourquoi pas. Leur jeu reste efficace et la dynamique du film est là sans nous offrir une exagération que l’on a dans la sage de Jason Bourne ou justement Identité secrète. On apprécie l’avancée, les retournements plus ou moins prévisibles et le côté Pierre Richard de l’espion malgré lui. Au final, un thriller d’action comme on dit, sans grandes prétentions, mais efficace si on le prend pour ce qu’il est : un divertissement de type fast food.

Oh une bâche !

2012-05-20T22:16:38+02:00

{.left} Il y a des jours où on ne sait pas se décider pour un film : entre les horaires qui ne vont pas, la salle qui ne va pas … Dans ce cas, ma solution : partir à l’aventure. De bien grands mots vous me dites ? Mais non ! Il suffit de vous faire une bonne balade à pattes dans Paris, pour arriver à votre salle favorite, et choisir le premier film qui démarre (en évitant un film déjà vu). Le sort m’a sélectionné Contrebande.

Jusqu’à ce soir, je n’avais vu que le titre dans les horaires affichés sur Allociné mais cela ne m’avait pas interpellé. Il est donc clair, que sans connaître le synopsis ni avoir vu la bande annonce, je m’engageais sur ce film sans aucun a priori. On suit donc un contrebandier repenti obligé de reprendre les affaires pour sauver sa famille. Son aventure le conduira au Panama. Hasard ou coïncidence, le matin même je me documentais un peu sur le Canal de Panama … Personnellement, cela m’a bien fait rire ! Pour en revenir au film, c’est du déjà vu à maintes reprises. Le premier titre qui me vient en tête, c’est 60 secondes chrono. Mais j’y retrouve un peu l’ambiance d’un The Town. Rien de bien novateur, les habitués décoderont l’intrigue dans les premières minutes du film. Reste quelques scènes sympa et surtout voir les idées pour planquer la marchandise (cf la fin du film). Cependant, je pense qu’un élément du film, démontrant le niveau des douaniers et du capitaine du navire, nous résume assez bien la qualité du film : “Oh une bâche !” Le film se regardant facilement en vidéo ou avec une carte illimité, je vous laisse le soin de replacer cette citation dans son contexte. Sur ce, je retourne programmé ma prochaine contrebande à faire circuler entre la cuisine et le salon.

Indian Palace : mon baluchon pour l'Inde est prêt

2012-05-19T21:59:40+02:00

Il y a des films comme celui-ci, qui vous offrent deux sentiments à la sortie de la salle de cinéma :

préparer votre voyage pour ledit pays le plus vite possible
qu’il manque quand même l’odorama au cinéma pour ce genre de films

Ce film ? Indian Palace.

Je ne savais pas trop à quoi m’attendre avec ce film après avoir vu la bande annonce. Une comédie de et pour vieux de la vieille ? Un mix entre Mange, Prie, Aime et Lost in Translation ? Un déballage de platitudes évidentes ? Un concentré de stéréotypes ? Tout ceci et rien en même temps. Après une rapide présentation de nos retraités, nous partons avec eux pour découvrir l’Inde. Et là, soit votre imagination est assez forte à la vu des couleurs et sons pour vous laisser supposer les odeurs, soit vous regretter l’absence de l’odorama. On découvre le pays, un peu comme on l’a pu faire avec Pékin Express, il y a quelques années (Saison 2 - La route de l’Himalaya - 2007) au travers de nos “jeunes et beaux retraités”. Ainsi, chacun vivra un mini voyage initiatique, pour confirmer qui il est, ce qu’il a perdu, ou ce qu’il a raté. Et il faut dire que John Madden sait nous impliquer dans ses histoires. On vivre avec eux. On prie. On espère. On découvre. On se réjouit. On finit par rentrer pour préparer notre bagage et voir le prochain avion. Si vous me cherchez, je suis sûrement au Best Exotic Marigold Hotel pour une durée indéterminée !

Bankrupt !

2012-05-18T22:24:25+02:00

{.left} Aujourd’hui, je ne metterais point de musique : ce n’est pas que je n’ai aucun artiste à vous proposer, au contraire, mais je prépare un petit truc qui devrait sortir ce WE. Et comme on dit, l’attente augmente le plaisir ! °Par contre, c’est vendredi, donc jour de cinéma. Et quoi de mieux qu’un jour où presque personne ne travaille que de faire bosser nos neurones ? Pour ça, un film est parfait : Margin Call.

Une plétore d’acteurs de cinéma ou de séries TV vont donc s’efforcer de nous montrer une facette de l’origine de la crise de 2008. Malheureusement, le monde de la finance est un domaine bien peu passionnant, même avec des acteurs de renom… Et s’enchaînent alors les images stéréotypées d’Opérateur de marché flambant leur argent, tous dans ce monde par l’appât du gain, peu importe leur formation d’origine, quand ils ne se font pas virer avec tous les égards qui leur sont dus. Il est toujours bon aussi de se faire rappeler qu’il y a toujours un chef au dessus du chef qui, lui, saura prendre la bonne décision en ces temps difficiles. Au final, une phrase très juste du grand patron de la La Firme, John Tuld (Jeremy Irons) : “Il est possible de se faire énormément d’argent avec cette crise”. Et Hollywood nous le montre une fois de plus : peu importe l’état de leurs finances (avec le piratage), il y a toujours un sujet, même anodin pour sortir un film plat qui rapporte potentiellement de gros sous grâce à ses acteurs ou son réalisateur. Là est peut-être la clé de ce film : nous montrer qu’il n’y a pas un sujet qu’on ne puisse traiter pour s’en mettre plain les poches. En un mot comme en cent pour résumer ce film : arnaque.

Chanson pour le printemps

2012-05-16T11:04:34+02:00

Il faut beau, les oiseaux chantent, le printemps se montre pour quelque jour. On va le fêter en musique avec Nad!m et sa chanson Elle me prend la main.

Encore un artiste MMC que j’adore. Si c’est également votre cas, n’hésitez pas à le soutenir !

Ouh un WE sans rien dire

2012-05-14T08:38:03+02:00

Certains vont me faire la tête à force … Aucun morceau matinal … On corrige ca de suite alors. C’est une nouvelle semaine, donc un nouveau départ avec Barbara Green et son Repars à zéro :

Vous pouvez soutenir et produire Barbara sur MMC. D’ailleurs changement de règles sur MMC qui impose qu’un artiste arrive à se faire produire en six mois sinon la porte de sortie lui sera présentée. Très expéditif comme méthode. D’ailleurs petit lot de critique pour MMC :

nouvelles règles qui font partir nombre d’artistes
nouvelles règles qui font fuir bon nombre de potentiels inscrits
les remises à cause de ces départs forcés n’inclus pas la remise des frais empochés par MMC (et il faut donc les repayer)
MMC considère qu’un artiste, avant d’arriver sur son site doit avoir des enregistrements audio et vidéo de bonne qualité et de bons moyens de comm (donc avoir fait une partie de la prod)

Bref MMC, c’est de pire en pire … Et les artistes en patissent. Dommage. Bon nouvelle semaine, je râle sur MMC mais il ne faut pas croire, je suis de très bonne humeur. Je prépare une bonne petite radio pour les artistes que je suis. Ah, pi aussi, accessoirement, spéciale dédicace à son interprête pour le remercier de son concert de vendredi soir, à savoir Fabien Bourguet.

Semaine courte mais super chargée au programme. Courage les gens !

Trêve de plaisanterie

2012-05-11T08:35:35+02:00

{.left} Ce matin, j’ai choisi une chanson qui me touche. C’est celle de Fabien Bourguet, un jour de trêve. [video]http://www.youtube.com/watch?v=cdyK3IQ-v8Y[/video] Si ses chansons vous plaisent, soutenez-le sur MMC. Au passage, pour les parisiens, il se produit ce soir 11 mai 2012 au Caveau des Artistes à 20h45. L’entrée est à 10€. Bon concert !

Dark Shadows : soyez psyché, vous serez cool

2012-05-10T08:52:22+02:00

Ce matin j’ai voulu faire un double billet, mélangeant le film du jour, enfin … d’hier, et la chanson du jour. Bon, c’est sûr, trouver du psychédélique ou du Alice Cooper dans mes perles de MMC, malheureusement, ce n’est pas gagné. Par contre, trouver quelque chose de cool et qui collera au thème du film … Suffit de chercher Morphé et Rose promise :

Comme à l’habitude maintenant, Morphé est à produire sur MMC. Belle introduction à l’amour que cette chanson, non ? Et bien c’est aussi le thème de fond du dernier Tim Burton, Dark Shadows :

Certes ce n’est pas un univers entièrement sorti de l’imagination de Timmy, mais il faut avouer qu’il a particulièrement bien revu la série télévisée des années 60. Le psychédélique et torturé Tim Burton nous fait donc ressucité Barnabas Collins en 1972, en pleine guerre du Vietnam, avec ses mouvements Hippies et ses couleurs d’opposition. Commandés par Tim Burton, ses acteurs fétiches, Helena Bonham Carter et Johnny Depp sont soutenus par Michelle Pfeiffer, qui me rappelle sans cesse l’une des sorcières de Stardust et Eva Green, pour les têtes d’affiche. Et, il faut dire, que ces dernières se sont toutes les deux plus que bien adaptées au style de la maison. On rigole, on frissone, on dévore le popcorn bien trop vite avec ce mélange de Famille Addams (de Barry Sonnenfeld) et Charlie et la Chocolaterie, sauce Scooby, dépeignant cette réunion de famille sur thème de la malédiction amoureuse. Ah, l’Amour … Ce film s’est fait attendre, surtout avec tout le buzz orchestré sur les médias sociaux. Dans ces conditions, il arrive trop souvent que l’on soit déçu (non je ne vise aucune super production américaine de ces dernières années offrant un nombre de suite trop important), mais pour le coup, le ravissement est là … et m’impose d’y retourner ASAP ! Après tout, c’est du Tim Burton, et il ne déçoit jamais (précision : sur un film de son cru … suivez mon regard …). Pour terminer, en se faisant plaisir avec un Alice Cooper de 1972, ca sera le petit cadeau du matin :

A se demander si ce n’est pas un vampire immortel d’ailleurs …

Petit réveil en douceur

2012-05-09T07:42:01+02:00

Ce matin, c’est Luke Greenwald qui se charge de votre réveil avec Tired and Wasted.

Comme à l’habitude, si vous appréciez, soutenez le sur MyMajorCompany.

Journée du souvenir en musique

2012-05-08T10:47:14+02:00

C’est une journée du souvenir pour pas mal d’entre vous. Autant le faire avec un bon son pop-rock de chez nous. Voici donc Mathyl avec Rappelle-toi.

Si ses chansons vous plaisent, produisez-la sur MyMajorCompany. NB: j’ai profité dans la semaine pour rajouter l’authentification via Facebook et Twitter pour ceux qui veulent commenter le blog.

American Pie 4 : j'ai trop mangé de tartes

2012-05-07T21:03:37+02:00

Ceux qui me connaissent vont se dire qu’il y a un énorme soucis : comme ai-je pu trop mangé de tartes, moi, l’estomac sur pattes, l’héritier de Gargantua ?! La faute aux American Pies. Tout le monde connait les trois premiers volets sortis au cinéma entre 1999 et 2003. Entre 2005 et 2009, quatre autres nous ont nourris directement en vidéo, pour notre plus grand damne, pour ceux qui ont voulus garder un esprit adolescent. Et bien cette année, 13 ans après le premier, l’équipe d’ados en rute revient sévire, à croire que leurs comptes en banque sont vide.

Impossible de se mettre dans le même état d’esprit qu’à l’époque. Le film reprend pourtant la même sauce, un peu plus osé (plus de nudité), un peu plus adultes (ils ont tous une vie maintenant) pour autant, la tarte ne cuit pas correctement. Je ne dis pas que je n’ai pas laissé échappé quelques pouffements… C’est sûr, je ne m’égosillait pas comme le mec à deux places de moi. Mes neurones ne doivent pas se percuter de la même manière, je crois. Quoi qu’il en soit, on est à une époque où la créativité d’Hollywood se borne à beaucoup de suite, remake, … mais là c’est trop. La nostalgie n’opère pas, le charme est absent, le déluré, lui, est radin. Un Projet X proposera bien meilleur spectacle. Même les trois premiers que je me suis refais avant la séance m’apporte plus de plaisir. Donc non clairement le film de trop et une tarte mal préparée. Même le ton moralisateur des jeunes gens maintenant mûrs qui aurait pu ressortir est partie voir un autre film.

Sauvons le jour

2012-05-07T15:01:08+02:00

Journée plaisante pour certains. Journée morne pour d’autres. Journée vivante pour les uns. Journée soporifique pour les autres. Dans tous les cas, un peu de bon rock fait du bien, donc place à Ann’So M avec Save the Day.

Vous aimez ? Parrainez-la sur MyMajorCompany !

Et une deuxième brochette

2012-05-05T12:56:52+02:00

Hier je vous ai présenté mes petites perles :

Ann’So M (pop/rock)
Luke Greenwald (reggae/rock)
**Devon Graves (pop/folk) - Morphé à la guitare

Aujourd’hui je vous présente la légion :

**Ash of Sound (pop/rock)

Mathyl (pop/rock)

Vers Noomiz

Jessie Ryan (pop/rock)

Maryjane (pop/folk)

Barbara Green (pop/rock)

Monsieur Plume (chanson française)

Vers Zic Me Up (écoutez “Le Sage”)

Mon premier, une petite brochette de chanteurs dont j'espère beaucoup

2012-05-04T16:54:41+02:00

Plutôt que de rédiger un long billet, je vous laisse apprécier les chanteurs (pas la qualité de l’enregistrement, bande de râleurs).

Ann’So M (pop/rock)

** Devon Graves** (pop/folk) - Morphé à la guitare

** Luke Greenwald** (reggae/rock)

Etre Parisien, c'est être un éternel incompris

2012-05-03T01:05:11+02:00

Ce soir, pour changer, direction le théatre (de la Main d’Or). Au programme, un cours pour anglophone (ou pas) pour devenir parisien.

Bon, ok la représentation est entièrement en anglais et ce qui rébutera plus d’une personne (j’en ai une en tête, tiens, mais je n’ai pas dit mon dernier mot) sous le prétexte de la barrière de la langue : et bien c’est une erreur magistrale car Olivier Giraud est tellement vivant sur scène, que tout se comprend, peu importe la langue. Alors, oui, tout de suite, vous allez me rétorquer, que nous, pauvres Parisiens que nous sommes (enfin pour ceux qui le sont, pour les autres, désolé mais tout le monde ne peut pas être parfait et on l’est déjà pour vous) allons être stéréotypés à outrance et dénigrés au possible … Et bien, oui nous sommes stéréotypés de nos caractères véridiques. A aucun moment, je n’ai pu réfuter que nous étions tel que présentés. Mais c’est tellement bon de rire de soit même et Olivier (bien que Bordelais, lui aussi ne peut pas être parfait…) gère ca avec brio. On se délecte de notre mauvais caractère ou nos mauvaises habitudes. Mais bon, le Parisien est un être à part et il n’y a pas meilleur spectacle pour le décrire. Un cours magistral en huit chapitre, une interro à la fin, un plaisir sans fin et oui, je te confirme Olivier, je vais me souvenir encore de ton spectacle un moment. Par contre, au moment du sexe, là, désolé pour ton égo, mais je penserais à quelqu’un d’autre, car t’es trop peu mon genre. Bon, je profite pour tirer mon chapeau :

un soir de débat électoral, alors que les cafés/restos se plaignent de la faible clientèle, le théatre fait le plein
Olivier a cru en son projet et l’a mené au bout … et c’est un succès

Reste à trouver ceux que j’emmènera et je fais le serment qu’ils y seront et que je les accompagnerais avec le même plaisir. Encore plus fier d’être Parisien après ce soir. Merci Olivier !

Je me vengerais !

2012-04-29T01:08:27+02:00

Ce soir, le film, parce que c’est le week, parce que c’est du Marvel, parce que c’est du super Box Office américain, parce que j’aime, parce que c’était avec des fanas de comics … c’était ca :

Bon ok, celui là je l’ai vu un paquet de fois sur la 6 et il était à Panic Cinéma il y a deux semaines. J’étais voir le survitaminé, le génétiquement modifié, le body buildé, le déique, le sexy, le comique, le précis, l’amateur The Avengers, lancé par les Studios Marvel :

Bon, on reprend certains personnages sous des traits connus (Iron Man, Captain America, Thor, Loki) et quelques nouveaux ou certains qui change à chaque nouvelle affiche cinématographique (suivez mon regard vers le géant vert). Pour autant, j’ai l’impression depuis l’été dernier, que personne n’a remarqué que Captain America est aussi la Torche Humaine (un des 4 Fantastiques) ou que l’Agent Hill est canadienne à ses heures perdues. Bon le premier me choque le plus vu que c’est la même license (Marvel). C’est un peu comme Ryan Reynolds qui campe Green Lantern chez DC et Deadpool chez Marvel… Mais bon, ca ne change pas grand chose au spectacle. Pour en revenir à nos vengeurs, il est de ces films qui nous rappellent pourquoi on aime aller au cinéma : pour y voir du spectacle, rire, frissoner, dévorer le popcorn trop vite tellement on est plongé dans l’action à tendre la main mécaniquement entre le paquet et la bouche … Et clairement, Avengers est de ce genre de film. Oui, bien sûr, comme tout film où la 3D a été rajoutée en post-prod, on rumine de gâcher une part du plaisir là dedans. Reste que c’est beau, l’action claire en permanence, dynamique, un ton comique lié aux relations entre les différents protagoniste (que ca soir Tony Stark qui passe ton temps à titiller Bruce Banner, Captain America qui veut jouer son rôle de capitaine, Black Widow qui est une faible femme aussi mortelle que sexy et bien sûr le tandem entre le Viking et le Troll à savoir Thor/Hulk). En résumé, un régal de divertissement, car il ne se raconte pas mais se vit … Pour terminer, je résume pourquoi vous aller foncer au ciné :

une phrase : “Hulk … Smash !”

une vidéo (ATTENTION : énorme spoil donc cliquez à vos risques et péril) :

Bons crus

2012-04-27T01:41:31+02:00

Pour une fois, ce soir, je parle de vins. J’ai passé ma deuxième soirée découverte d’une cave très agréable sur Paris :

C’est dans le 1er arrondissement à proximité de Châtelet. Un cadre plein de charme, un patron passionné et très agréable, une experte en vins passionnée et charmante, une plétore de bouteilles, un ravissement pour les papilles, un cours permanent pour les curieux, … Au delà de la vente au détail, ils se font aussi grossistes mais également meneurs de soirées découvertes (publiques ou privées) : l’occasion de (re)découvrir les vins, de manière générale ou d’un producteur (ce soir, du Chablis). On déguste, on s’instruit … Un vrai plaisir sans nom ou se mélange les adjectifs et les plaisirs olfactifs et gustatifs tels un torrent d’émotions … le tout accompagné de plateaux de charcuteries et fromages aussi raffinés que les boissons servies. A découvrir, à recommander, à partager et à profiter. Au passage, mon côté nerd adore le moteur de recherche “logique” de leur site, assez rare pour le remarquer. Pour le plaisir :

A la vôtre !

2 days in New York : perdu dans la traduction

2012-04-25T22:23:05+02:00

{.left} Mieux vaut tard que jamais comme on dit ? Cela fait un mois que 2 days in New York est sorti dans les salles obscures françaises, deux semaines que je soutiens que j’irais le voir mais que mon planning est sans cesse modifié mais cette fois c’est fait ! J’ai fui lâchement l’inactivité lassive du soir pour me réfugier au chaud de la salle de projection pour le voir.

Quelques uns me parlaient d’un bon film, sans plus, on rigole “mais” … mais quoi ? Je ne sais pas. A force, j’ai cru finir devant un Lost in Translation familial et français. Mais ces critiques ne m’atteignent pas : j’adore la productive et vivante Julie Delpy et la piplette déconcertante qu’est Chris Rock … Ah … les français, leurs râleries, leurs hypocrisies, leurs ignorances … c’est ainsi que la famille de Marion (Julie Delpy) nous représente, comme les américains comme Mingus (Chris Rock) nous dépeindraient avec nos saucissons et reblochons à faire passer tels de la contrebande. Mais au delà, sont surtout mis en exergue les a prioris, le brassage culturel, la vie de chacun, l’effet de la loi de Murphy et bien sûr … l’inexistence même des coïncidences ! Une nana disjonctée, un vrai new yorker, une soeur psychotique/nympho/exhib, un boulet de service, un père qui ne débite pas un mot d’anglais, un fils un peu perdu et une fille qui finira comme la première Goth Black … Un bon groupe comme on les aime. Tout est raconté à la légère, tel les mensonges que l’on raconte à un voisin chiant dans l’ascenceur pour s’en débarasser. Rien n’est pris au sérieux si ce n’est notre propre désespoir et justement que chacun se retrouve à un moment … perdu dans sa propre réalité. Chaque drame a son happy end. Après tout, nous français, nous délectons avec plaisir et humour du malheur de nos congénaires, alors faisons-le avec panache et légèreté ! Julie Delpy nous offre une comédie à déguster à n’importe quelle heure. Je cherche encore à comprendre la tentative de comparaison de certains avec du Woody Allen, à croire qu’il faut toujours comparé à certains dinosaures américains pour apprécier la fraicheur et légèreté de la nouvelle vague francaise…

Ian égorge la magie

2012-04-24T08:29:34+02:00

Roh c’est mal … je deviens un poisson rouge (et non un poisson clown, bande de mauvaises langues) : je vais voir un spectacle et j’oublie d’en parler. Pour le coup, c’est tout les lundis (me concernant c’était la semaine dernière), à la Cantada, c’est gratuit et c’est :

Bon, tant qu’à faire, on est à la Cantada, donc on profite de la carte : absinthes, hypocras, charcuterie … Ca c’est moins gratuit mais pas trop cher et c’est bon ! Puis on descend voir le spectacle à la cave, on s’installe et on attend. Ian aussi attend : “parce que c’est à 20h30”. Pas 20h28. Pas 20h31. Non … 20h30 … faut pas louper l’heure de début ! Alors Ian et sa magie gore c’est quoi ? Voici son résumé sur Billetreduc :

Vous ne connaissez pas le cinema gore ? Vous ne comprenez rien à la prestidigitation ? Vous croyez que le mentaliste est un blondinet rebelle qui joue avec le cerveau des gens ? Vous imaginez qu’un blockbuster est un film de chasseur de fantômes ? Les tours de magies ne dérapent jamais ? Je vous expliquerez tout pour devenir de vrais geeks ! Une soirée sang pour sang interactive!

Le ton ? la déconnade, le foirage, le kitch … puis viendra les eurk, les aie, les ouch, les oups … Quelques suprises qui ne sont ni de la magie ni du gore mais qui a priori donnent plus de frissons aux demoiselles à rassurer après coup ! Bref, une heure de show mélangeant tous les styles : ça tâche, c’est drôle, ça donne des frissons, ça titille la curiosité … A faire (et à refaire). Bon petite astuce pour ceux qui ne s’encombrent pas de choses inutiles : il faut emmener un magnétoscope VHS Pal/Secam, une péritel, une multi-prise et une petite TV compatible. Là, votre soirée sera unique ! Accessoirement, un guest permanent : Cloclo était, est et sera là ! Si Nils m’envoie enfin des photos, je les publierais ;)

Ne paniquez pas au cinéma !

2012-04-22T01:33:29+02:00

Ce soir, j’ai découvert Panic! Cinema : c’est un rendez-vous hebdomadaire pour les cinéphiles et les non-cinéphiles, pour voir des films de genre. Le rendez-vous se passe à la Nouvelle Latina, rue du Temple, cadre extrêmement sympa. Quand on voit la liste des films, on se dit que ca peut être sympa. Quand on voit que c’est 5€ en tarif unique, on se dit que ca devient intéressant. Quand on apprend que c’est compatible avec les cartes illmités UGC et Pass, on sait qu’on va sûrement y aller. Et là, on nous souffle que la bière est offre dans ce cadre super agréable avec des gens plus que sympas : plus aucune raison de fuir ! On arrive, on papote, on lève le coude … Puis on descend voir la pré-séance. La semaine passé, le film aurait du être La revanche de Hulk : les organisateurs s’excusent d’avoir présenté son mariage et se propose de corriger le tir en diffusant le bon film … en une minute. C’est … suffisant. S’ensuit une chanson de vampire “First Date”, la bande annonce d’un nouveau film sur les vampires, “Jesus VS les vampires”, Blade Trinity en 5 secondes, puis bien sûr une fin alternative en dessin animé pour … Twilight … Comment dire … On est lancé ! J’ai eu le plaisir d’y faire mon baptême avec le film Higanjima, film de vampires japonais, tiré d’un manga éponyme.

Pour avoir déjà goûter aux vampires sauce Yakitori avec Blood (version anime), je n’ai pas franchement été dépaysé sur l’ambiance et le style graphique. Le film respecte les règles du genre : un lieu reclu (une des 7000 îles japonaises), un vampire libéré de sa prison, un héros torturé, des gamins pleins d’espoirs désillusionés, du sang en surdosage, une nana sexy, … Le film est rythmé, comique, sanglant, … parfois aberrant. Et c’est là que son charme s’opère. On apprécie son côté décallé qui reste sur les rails de son genre. Bref, une soirée parisienne gratuite et super plaisante, à refaire régulièrement : ca tombe bien, c’est toutes les semaines !

Twixt, deux doigts coupent fin ...

2012-04-12T21:52:25+02:00

{.left} Le dernier Coppola que je me suis fait au ciné, c’était un film de la fille du Maître Lost in Translation - Sofia Coppola, 2003). Le sentiment qui me revient à chaque fois que je pense à ce film ? “Hein ? Quoi ? Je suis où ? Il s’est passé quoi ?” … Bref, perdu … Je crois qu’en fait, c’est génétique chez eux. En tout cas, je suis dans le même état après Twixt.

On suit donc un écrivain raté, un Stephen King de seconde classe, dominé par la mort de sa fille, guidé par Edgar Allan Poe, dans un univers présentant les traits d’un livre d’Alan Wake en plus … épuisé par l’alcool. Tous les clichés sont donc réunis : un écrivain atteind du mal de la page blanche, à qui l’ont colle une étiquette de genre qu’il n’aime pas, torturé par la mort de sa fille dont il se culpabilisé, agressé en permanence par sa ~~sorcière~~ femme, défoncé au mauvais alcool (et parfois un bon whisky onirique) et aux somnifères ; un bled paumé dans l’amérique profonde, traumatisé par un massacre ; des ~~bouseux~~ autochtones rares et … bizarres ; un shérif qui rêve de son quart d’heure américain ; un agent qui ne pense qu’à son argent ; … Bon c’est sûr, avec un environnement pareil, un synopsis qui tiens sur une carte de visite et un Val Kilmer toujours plus gros (il continue d’imiter son mentor, Marlon Brando), on part tout de suite sur de mauvaises bases avec ce film. Puis, on se rappelle que c’est le Maître à la baguette, que tous les détails comptent.

Twixt ? selon le wikipedia, c’est de l’anglais archaïque pour dire “entre (deux choses)” ; on passe notre temps à hésiter : entre deux émotions (mal-être et agacement), entre deux mondes (monde vivant et monde onirique), entre deux films (un thriller et un film d’horreur)
Val Kilmer ? Un acteur qui avait un potentiel et qui l’a gâché (comme son personnage)
Le beffroi ? Sept cadrans, sept heures différentes, sept séquences, sept coups de cloche à sept reprise, sept cadavre d’enfants alors qu’il devrait y en avoir douze, on ne connait qu’un seul jour, le dimanche, le 7e … sept … toujours sept … à la manière du “Nevermore” du corbeau d’Egdar Poe … (au passage, le budget est de … 7 millions de dollars)
tout est intemporel : on ne sait plus l’heure à cause du beffroi, on ne sait plus la date avec les personnages qui sont présents à toutes les époques et dans les deux univers, …

Au final, l’impression d’être perdu est clairement une manipulation voulue. On nous perd dans le fouilli ambiant, pour nous rattraper par des messages chocs, des images plus qu’expressive et toujours d’actualité, peu importe le pays. Assez perturbant car on ne sait jamais sur quel pied danser avec le film, et encore moins quoi ressentir après coup.

Par contre, je n’avais pas vu autant de sang (dans la scène finale) depuis que Freddy Krueger avait tué Johnny Depp.

Bon allez, pour la route, je ne pouvais pas ne pas la sortir :

Perturbé, je suis incapable, même après ce billet, de dire si j’ai apprécié ou non ce film ; je suis clairement perdu avec … Mais Coppola reste le Maître. A voir si vous voulez arrêter l’alcool ou la drogue.

La croisière s'amuse ...

2012-04-11T22:57:59+02:00

Ce soir j’ai redécouvert un monument de l’art audiovisuel cinématographique :

Bon alors attention, le cast est super long, super non exhaustif et super pas dans l’ordre :

Olive et Tom
John Carter quand il s’est pas vu quand il a bu
Mr Bean qui se la joue Panthère Rose
les Cowboys de l’espace revus par les Village People
un réal qui croit être le fils de Rolland Emmerich
une BO bien rock’n’roll avec un magistral Thunderstruck
un Qui Gon Jinn au regard de feu mais je me demande s’il ne porte pas déjà des couches
des jouets
une chanteuse ~~pulpeuse mais fragile~~ sur-tatouée, comme un vrai marines !
une Barbie
une bataille navale pour de faux parce que sinon ca fait bobo
des aliens sortis de Mass Effect armés par Lost Planet
le tout à bord du Pacific Princess
pour mettre en valeur le patriotisme et le sacrifice de Pearl Harbor
sans oublié, la référence à Touche pas mon périscope
un survivor qui n’a pas oublié ses classes de Foot US
un intello, ca a des lunettes, les chocottes et c’est pas doué
du Fast and Furious ~~Hawaï~~ Tokyo Drift à la mer
la séquence émotion des Rasta Rocket
l’autre séquence émotion perdue entre l’entraide et la douleur
‘Ti Biscuit en patron de la Défense US
un burrito au poulet
c’est l’histoire de Dumb and Dumber qui ont un fils, comme s’appelle-t-il ?
l’armée ca vous forme votre jeunesse dépravée
de beaux dialogues parce que ca motive (réf à un certain Mr J.)
au moins autant d’invités, de clins d’oeils involontaires (ou pas ?), de référence qu’il y a de séquences …

Ca donne

D’ailleurs, UGC le résume tout aussi bien en une image dans son mensuel :

Je suis à jeun. Par contre, avec un budget annoncé de 200 millions de dollars pour transformé le jeu de la bataille navale en film, je pense que la Prod et la Réa ont bien profité pour se démonter le cerveau. J’ai rarement vu une salle aussi hilare du début à la fin. C’est gros. C’est baveux. C’est énorme. C’est LA référence des super-grosses productions américaines pour les décennies à venir. C’est LE nanard du siècle. Ok je partais avec l’idée d’aller voir un navet vu que le ruhbe m’empêche de connecter tous les neurones. Au final, j’en sors, je suis soigné, et me souviens de tout … Ils mettent des choses dans les clim’ des UGC ? Bref, c’est tout simplement énorme dans le n’importe quoi. Pas une séquence sans me rappeler un film, une série, un DA, un personnage, une chanson, … Et dès la première séquence, on vous fait comprendre que ce n’est pas votre cerveau qui déraille mais bien le film qui sera comme ca. C’est Battlleship. C’est inclassable. C’est sorti aujourd’hui. C’est sain pour votre santé. Et moi, je pars me chercher un burrito au Jumbo … pardon, au poulet.

A l'oeil d'aucun

2012-04-04T21:07:29+02:00

{.left} Alors ce soir au dîner, je vous propose la recette suivante :

une base de 24H Chrono
une bidasse bien française
un soupçon d’Anonymous pour être à la mode
de la crème électorale
saupoudré d’un enregistrement rappelant par moment du Saw …

Et on obtient … Aux yeux de tous. Bon, c’est sûr, j’y suis allé avec un méchant a priori sur le film et principalement la partie “hacking”. Faut être réaliste, nous remettre un coup d’Anonymous pour faire passer la pillule c’était un peu trop à mon goût (mais c’est un autre débat).

Le film démarre et je subis clairement les premières minutes, tant que notre cher Martin, le pirate, ne fait qu’être spectateur. Entre l’environnement permettant tout et n’importe quoi, la beauté dans la bascule des écrans, le tout accessoirisé par Microsoft … et j’en passe des meilleurs … Quoi que non je ne passe pas … La caméra passera rapidement et furtivement sur les écrans pour nous montrer des pseudos lignes de commande ou de code … et s’attardera parfois sur des écrans de toute beauté pour les connaisseurs. Un exemple ? Dans le film :

~~~~ {.shell .numberLines startFrom=1} $ pstree -l 13278

(on s'en fout du nombre ...) donne en résultat ... une recherche sur la présence d'une nana dans tous les hopitaux parisiens ... C'est magique.
Dans la réalité, [pstree](http://manpagesfr.free.fr/man/man1/pstree.1.html) affiche un arbre des processus d'un système Linux (un arbre permettant de savoir de quel programme un autre programme dérive, pour faire simple).

~~~~ {.shell .numberLines startFrom=1}
$ pstree

renvoie par exemple

~~~~ {.shell .numberLines startFrom=1} init─┬─atop ├─cron ├─6[getty] ├─master─┬─anvil │ ├─pickup │ └─qmgr ├─mysqld_safe─┬─logger │ └─mysqld───19[{mysqld}] ├─openvpn ├─pdns_server─┬─pdns_server───11[{pdns_server}] │ └─{pdns_server} ├─postgrey ├─snmpd ├─sshd───sshd───sshd───bash───sudo───su───bash───pstree ├─syslog-ng───syslog-ng └─udevd───2[udevd] ~~~~

Le “-l” ? Il permet un affichage dit “long” donc avec plus d’infos. Le nombre ? De démarrer à un certain niveau directement.

Bref on est à des années lumières d’une recherche sur des bases d’hôpitaux. On continue ? Les caméras : peu importe que cela soit des caméras de sécurités, des globes de banque, de boutiques, etc etc … Toutes ont du son : c’est tout simplement parfait pour espionner. On pourrait continuer longtemps sur les incohérences … Donc autant en faire abstraction sinon on sort direct de la salle de cinéma. Passé un bon gros 20/30 minutes, le film se dynamise un peu et nous rappelle qu’on est au cinéma pour se divertir … L’histoire sur l’attentat suit son cours puis vient nous rappeler que n’importe quel média peut être manipuler … parfois (?) par les politiques. On pourrait se dire que le film tombe bien ? Peut être trop … Quoi qu’il en soit, le film me laisse un goût amer, mélangeant les questions qu’on est en droit de se poser sur l’actualité de ces dernières semaines, à une mauvaise réalisation qui rend l’ensemble assez indigeste. Pour faire simple : le potentiel du film est clairement gâcher. Ok le budget du film minime, sa sortie en salle assez confidentielle, mais bon :

la réalisation ferait échouer le candidat aux épreuves universitaires
le hacking nous rappelle à quel point notre “science” ressemble à du chinois (d’ailleurs ils auraient mis des caractères à la Matrix j’aurais préféré …)
les effets visuels (l’explosion de l’attentat en tête de file) ne sont même pas au niveau des Gobelins

Dommage : le synopsis était sympa, le parti pris de n’avoir que des images “de webcam/cam de sécurité/…” audacieux … mais le reste échoue lamentablement. Bref, à voir si vous vous posez encore des questions sur ce que vous voyez dans les médias ou que vous voulez rire des Script Kiddies membre des Anonymous et dans tous les autres cas … A FUIR !

Hop hop on garde le rythme

2012-03-29T21:26:16+02:00

Bon aujourd’hui c’est un billet “Fellings” car je ne sais pas trop de quoi parler … Ah si, on peut lister ces deux derniers jours !

Cinéma : Chronicle & the Wrath of the Titans

Alors Chronicle on va le résumé ainsi : un mix entre du Projet Blairwitch pour l’ambiance visuel et le concept et du Akira pour les mecs qui gagnent des pouvoirs et potentiellement pêtent un câble.

On passe un bon moment même si l’on se doute dès le début de comment tout ca va finir … Mais on regarde … On regarde la nature humaine s’exprimer de deux manières différentes. Après tout : à de grands pouvoirs, de grandes responsabilités. On apprécie que la vidéo ne soit pas fouillie (ni trop quand elle doit l’être) contrairement à certains films à effets spéciaux récents… Pas grand chose à dire : juste à le prendre pour ce qu’il est : une vue de la nature humaine, une bonne ambiance, un bon trip, un bon moment.

Par contre, la Colère des Titans… Alors ok, on fait tout de suite abstraction de la mythologie (de ce qu’on s’en souvient ou non) et on reste focalisée sur l’adaptation plus que libre faite par le Choc des Titans version 2010 …

Bon dès lors, on s’attend simplement à un gros spectacle en 3D … On en a presque pour son argent : l’action est là, les graphismes sont propres, la 3D … absente … Bon, si vous avez conservé vos lunettes UGC … on s’en fout presque … Ce que je regrette ? La BO présente du Marilyn Manson en bande son … Et bah non, on reste sur de la pure musique de film presque sans vie … Dommage, ca aurait pu donner un énorme plus d’avoir une OST avec ce genre de dynamisme … Mais bon … Après, on rigolera clairement du jeu de certains acteurs vraiment pas convaincant (Liam Neeson & Ralph Fiennes en tête …) surtout que ce ne sont plus de jeunes premiers. Bref, gros spectacle mais qui loupe clairement le coche de se démarquer sur “le reste” (3D, bande originale, jeu des acteurs…) puisqu’il est très clairement annoncé pour nous en mettre plein la vue … Dommage, il y avait de quoi en faire un vrai blockbuster avec ces petits plus … A ranger en nanard à gros budget qui se fera vite oublier … Jusqu’à la prochaine suite …

Au taff : le salon Cloud

Plus petit que par le passé. Moins animé que par le passé. Plus de presta (SSII et VRP) que par le passé (qui viennent vous démarcher, sans stand). Plus fouilli. Plus éreintant. Et juste “Cloud”… Dommage, la partie Datacenter est presque oubliée, et le Green IT, passé de mode. Pourtant, cela ramenait du meilleur monde et donnait beaucoup plus de matière à parler … Du coup, tout le monde vend la même chose, de la même manière, … Après, il y a quelques exceptions :

nous déjà : normal j’y suis … je ne suis pas objectif (mais si on a quelque chose en plus quand même)
Outscale : qui a choisit un mode de fonctionnement très différent de la concurrence, des outils différents, puis bon, l’affectif joue puisque j’ai fait mes classes en infogérance avec ses fondateurs (David Gillard et Laurent Seror) et certains membres (Fred Jolliton en tête)
CloudBees : même si je suis allergique au Java, leur approche et leur produit m’a interpelé au milieu du reste

Bon prochain coup, faut prévoir les masseuses par contre (pour moi) et mes pitbulls pour qu’on n’est pas à jeter le “spam” humain comme on finit par le faire à la fin de la journée …

Feelings ?

Bon si je ne dis rien sur ce point, on va me dire que je ne communique pas, que je garde trop pour moi, que j’inquiète les gens, etc etc … Donc je me retrouve, je suis positif … Juste que tout ces chamboulements dans ma vie perso font que j’ai envie d’autre chose niveau pro … Recommencer, pour tourner totalement la page sur ce passé. Et quelque part, revoir d’anciens patrons/collègues chez qui j’ai fait mes classes d’infogérant et pour qui j’ai énormément de respect … fait que le côté nostalgie rappuie sur ce point … Rajouté aux rêves et souvenirs que j’ai en ce moment … Enfin bon, maître-mot du moment PO-SI-TIF !

Bon et la vidéo qui me donne le sourire aujourd’hui ?

Ce matin, revue de films

2012-03-27T09:11:09+02:00

Vu que je dois m’occuper au maximum l’esprit et me forcer à sortir, ma solution de facilité : profiter de ma carte UGC. Du coup, en quatre jours, quatre films : John Carter, Target, la Dame en Noir et Hunger Games. Allons-y dans l’ordre.

John Carter

On est vendredi soir, je déprime un peu beaucoup, je dois me changer FORTEMENT les idées : direction le ciné avec un film que je crois être un super nanard : John Carter. Pour ceux qui auraient la flemme de cliquer, il s’agit d’un film mélangeant action, aventure et science fiction, produit par Disney, réalisé par Andrew Stanton (un habitué de chez Pixar ayant déjà réalisé Toy Story 3, Là-Haut, Wall-E et Ratatouille) basé sur le premier volume du Cycle de Mars d’Edgar Rice Burroughs (1917). On résume ? une maison de production avec des moyens assez énorme, pour rester gentil, un réalisateur de films magnifiques, et un livre des premières heures de la SF donc avec la naïveté et les bases de l’époque (la rédaction du livre a commencé a priori en 1911 donc l’histoire est centenaire !). A la base, il y a de quoi promettre. Puis on se souvient que Disney commet souvent des impairs : où sera-t-il aujourd’hui ? Dans toute la promo …

Résultat, le film est prometteur, mais la promo a tout gâché et donc pas assez d’entrée … Qu’en est-il vraiment ? Et bien il en ressort un excellent divertissement à la qualité graphique Pixar ! Action rapide (et nette), un peu de romance légère façon macho début du XXe siècle, une épopée de gladiateur, … J’ai vu un mélange de Star Wars - la Menace Fantôme (pour les graphismes), de Flash Gordon (pour l’ambiance mélangeant les style et d’une autre époque) et tous les bons vieux péplum avec Charlton Heston ou Kirk Douglas ! Et pour ceux comme Odieux Connard, qui vont voir le film sous LSD en s’arrêtant à la promo faite (oui je sais, faut le prendre au 50.000e degré son blog) : allez voir les Chroniques de Mars et on reparle de John Carter ! Bref, faites abstraction de la partie “Disney”, de toutes les affiches sur les abri-bus et dans le métro et profitez de ce film pour ce qu’il est : un énorme spectacle pour toute la famille reposant sur les origines de la SF un chevalier sans maître, une princesse, une guerre, un dragon/sorcier) avec de faux airs de nanard. Perso, je suis fan.

Target

Samedi je me suis dit, tant qu’à faire, autant prendre le rythme d’un film quotidien. Cogitant pas mal sur les histoires de triangle amoureux, je me rabas sur celui que je ne devrais pas : Target. Réalisé par McG, j’ai confiance pour un bon spectacle. J’ai découvert McG via des séries et quelques adaptations : Chuck, Supernatural, Human Target ou encore Terminator Renaissance et les deux Charlie’s Angels.

C’est rythmé. C’est explosif. C’est sur-joué. C’est une relation amoureuse sous testostérone. Une fois qu’on a dit ca, le film est résumé. Une pointe d’humour quand même sinon ca serait fade… Mais oui, voilà tout le film. C’est le genre qu’on regarde et qu’on oublie quelques minutes après, même en ayant passé un bon moment. Je ne regrette pas, mais je n’irais pas le revoir volontairement. L’histoire tient du sitcom. Le naturel des espions est artificiel. L’action présente est télescopée. Reste Reese que j’adore et la réalisation dynamique de McG pour sauver le film. J’en suis sorti avec un avis mitigé : peu digeste du fait des à peu près, diverti quand même, mais déçu de l’histoire et de la manière de la mener. Dommage.

La Dame en noir

Dimanche midi, il fait beau, on peut aller se cacher dans une salle obscure pour se faire peur : ca sera la Dame en noir. Bon on connait Daniel Radcliffe pour l’avoir vu grandir à travers son rôle d’Harry Potter. Peut-être trop d’ailleurs ce qui fait que toute la promo a tourné autour de lui en nous laissant parfois apercevir un lien non désiré entre tout ca …

Heureusement, aucun lien si ce n’est l’étiquette collée au visage de Daniel. Il va vraiment avoir du mal à s’en défaire. Pour autant, le film, adapation du livre éponyme est vraiment agréable a regarder. Tant qu’on n’a pas des wanabe-racaillettes en train de piailler à la moindre image … Bref … Mon premier sentiment pendant le film : le même sentiment que lorsque j’ai vu Shining pour la première fois : curieux, en attente, sursautant sur mon siège même lorsque c’est prévisible … Le jeu des acteurs est convaincant, la réalisation propre, la photo un peu trop flou sur certaines scène, mais l’ambiance est clairement là et on apprécie le film. Oui l’histoire est plus que prévisible, et on en arrive vite à se poser deux fins possibles et, comme tout impatient, attendre la fin pour savoir si l’on s’est trompé ou non. Mais on nous la fait déguster, apprécier, morceau par morceau, et on finit plus horrifié par la cause que par les conséquences. Pour ceux qui cherche une autre vision de l’épouvante, celle qui fait cogiter et non celle qui cherche à nous faire boire des litres de sang accompagnés de lambeaux de chair humaine.

Hunger Games

Alors là, j’étais le voir par curiosité avec un avis très mitigé. On est lundi soir, je suis crevé après une journée assez bizarre et j’ai lu deux/trois choses sur Hunger Games mais surtout vu l’affiche. Pour la petite histoire, Hunger Games, c’est avant tout une trilogie littéraire récente, primée, vendue à foison… On se dit tout de suite : il y a matière, surtout après avoir lu le synopsis ! Puis c’est un film. La première approche d’un film ? Son affiche et là, je remarque le détail, qui personnellement me refroidit : la position de la main de Katniss pour tenir son arc : elle va avoir sacrément mal en décochant sa flèche ; donc soit ils ont oublié les conseillers dans la partie budget de la super production, soit il y a quelque chose. Réponse ? Il y a quelque chose et ca s’appelle l’incompétence de celui qui a sélectionner la photo car le conseiller ou la formation à l’archerie est bien présent.

On se retrouve donc dans un monde post-rebellion où les Etats Unis ne sont plus (ça nous change déjà) et remplacé par un Etat divisé en secteurs. L’ambiance qui ressort de la gouvernance telle qu’elle nous ait présentée ? un mélange de Running Man, New York 1997 (rah … Snake !) et d’Alice au Pays des Merveilles (j’hésite sur la version…). On se demande où on n’est au début … puis on commence à apprécier. A voir les volumes suivants. Mais avant de pouvoir apprécier l’ambiance, on doit déjà arriver à digérer la réalisation caméra au poing qui donne plus le mal au crâne qu’autre chose : l’action générale est floue, on est perdu … Vu le réalisateur, pas étonnant dans le rendu, mais plus étonnant dans le choix. A croire qu’il s’est fait un film de guerre juste avant et qu’il s’est dit que ca serait bon pour dynamiser l’action. Monumentale erreur ! On pourra cependant apprécié Lenny Kravitz même s’il a peu de scène. Remarque, on a toujours la sensatin qu’il a eu des coupures nets dans l’histoire et l’enchaînement des scènes, à croire que certains ont oublié qu’adaptation ne signifiait pas prendre un livre et sortir la hache … Mais bon, on reste assez, on ignore le mouvement de caméra et les coupures, puis on commence à apprécier le film pour son potentiel et non pour son rendu. Dommage. Autre point que je regrette ? la bande originale “The Hunger Games : songs from District 12 and beyond” n’inclut AUCUNE chanson de Lenny … Roh !!! Bon, vous allez vous dire que le film est nul, que je regrette … franchement, non. Oui je n’ai clairement pas apprécié la réalisation et certains choix fait, pour autant, le film me donne envie de découvrir les livres mais me fait aussi attendre avec impatience les deux prochains volets. J’ai passé deux très bonnes heures et si on me demandait d’accompagner quelqu’un et de me le refaire, j’accepterais.

Autoconfiguration des mails

2012-03-23T08:27:48+01:00

Aujourd’hui j’ai retrouvé une motivation longtemps disparue pour bosser. Je me suis intéressé à des histoires de DNS et d’emails. J’avais eu une remontée de quelques “soucis” lors de la configuration des comptes mails par certains hébergés (membres/clients) de l’association (Heimdall.net). Je viens de mettre différentes choses en place.

Mise à jour des entrées DNS

Il manquait quelques entrées DNS “classiques” : j’ai donc remis les CNAME correspondants pour les smtp., imap. et pop.*. De plus, leur absence pertubait certains hébergés donc d’une pierre deux coups. J’ai aussi corrigé l’accès au webmail pour qu’on puisse à nouveau l’utiliser en webmail.*.

Autoconfiguration globale

Il y a une RFC concernant l’utilisation des enregistrements DNS type SRV pour l’accès et l’envoi des emails. Les champs sont bien renseignés pour la zone heimdall.net :

$ for proto in smtp imap pop3 submission; do dig srv _$proto._tcp.heimdall.net | grep SRV | tail -1 ; done
_smtp._tcp.heimdall.net. 79 IN SRV 0 1 25 mail.heimdall.net.
_imap._tcp.heimdall.net. 151 IN SRV 0 1 143 mail.heimdall.net.
_pop3._tcp.heimdall.net. 300 IN SRV 0 1 110 mail.heimdall.net.
_submission._tcp.heimdall.net. 300 IN SRV 0 1 587 mail.heimdall.net.

Par contre pour tester plus, vu que ce qui suit est déjà en place …

Autoconfiguration pour Thunderbird

J’ai également trouvé un moyen qui permet à Thunderbird de se configuration automatiquement avec un simple fichier XML. A voir ce qu’on peut y rajouter, mais le résultat est assez bluffant déjà de base : on donne son adresse mail et son mot de passe à Thunderbird, il fait le reste … j’adore !

Autoconfiguration pour Outlook 2010

Dans le même esprit que pour Thunderbird, il existe un format XML pour la configuration automatique d’Outlook 2010. Plus qu’à trouver les outils MS pour tester …

Il faut bien un début !

2012-03-21T19:06:19+01:00

Un blog et tellement de questions. Pourquoi un blog ? Pourquoi maintenant ? Que pourrais-je y écrire ? J’ai ré-ouvert ce domaine il y a quelques jours, et installé le wordpress peu après … Puis plus rien. Pour une raison très simple : ma vie actuelle est compliquée et douloureuse. Ceci a eu pour effet un isolement de ma part avec des pensées bien trop noires. Mais bon, ma nature double fait que j’ai ouvert les yeux sur certaines choses ce matin. J’ai besoin de retrouver la solitude liée à mon côté loup pour pouvoir méditer, me retrouver avec moi-même et faire ce que j’ai à faire pour reprendre ma place en haut de la pyramide. Cela ne va pas se faire en quelques secondes, et contrairement à ce que beaucoup pensent, certains d’entre nous n’ont pas besoin de se faire entourer car justement, l’étouffement lié peut être bien plus destructeur qu’autre chose. Ce besoin de solitude vient aussi de mon sentiment de trahison d’une personne très proche, qui, même dans la situation actuelle, avec la guerre sans nom qu’elle m’a lancé avec son oubli volontaire, reste ma Lili. On pourrait considérer que c’est une énorme bétise de penser encore et toujours à elle mais bon, l’instinct est et restera supérieur ! Suffit de faire appel au reptilien pour éviter la souffrance. Tout ceci pour justifier le délais de réflexion avant de déposer mes premiers mots. Les autres questions ? Le temps y fournira les réponses, comme à toute chose. Mais je ne prévois pas de restreindre ce blog à un seul et unique type de messages. Aujourd’hui, j’entame un parcours initiatique pour parachever ma traversée du désert. Ma seule certitude ? Que je peux faire confiance à mon instinct, quoi qu’il arrive.