I submit final report of Exploratory Software Project 2004 2nd half to IPA.

Unfortunately, one developer in my managed projects has been busy to care for his father confined to bed so he failed to submit results by due date. As discussed with IPA, he was given an extension of time by next week. This means, my final report for him still is undone.

I've got an OSS award from Japan OSS promotion forum. There are ceremony of awarding an honor and social gathering at Akihabara Convention Hall. This is first OSS award, planned as part of North-East OSS forum (China, Korea and Japan). In Japan 4 developers receive this award:

• Fumitoshi Ukai - me, debian developer
• Hirokazu Takahashi - kernel developer, VA Linux Japan
• Satoru Takabayashi - author of Namazu, QuickML, Gonzui
• Yukihiro - Matz - Matsumoto - creator of Ruby programming language

As a prize, we got note PC from sponsor companies: NEC, IBM, Fujitsu and Hitachi. I got NEC's strong PC.

Today is 2nd day of final review meeting of 4 PMs (ichiji, ukai, kato and nakasima) of Exploratory Software Project 2004 2nd half, at Nagai Memorial Palace in Shibuya.

• proposal of 3D GUI style and consolidate development environment
• digital kaleidoscope
• PUI(Paper User Interface)
• groupware that integrates mail, web and meeting vertically
• agent-base social simulation language - SOARS
• MMOG infrastructure using ovarlay network
• extend memory using activity history on computer
• Winmostar: molecule computing support software

This afternoon, there are final review meeting of 4 PMs (ichiji, ukai, kato and nakasima) of Exploratory Software Project 2004 2nd half, at Nagai Memorial Palace in Shibuya.

• Hyper Estraier
• protocol program generator from simple specification description
• intelligent 3D shape browser
• knowledge information management base to extend human memories
• genome RNA database search system using probablistic context free grammer.
• next-generation operating system implemented by CLI.
• Web Database Server GWS

Today, I have a interim review meeting of my projects in Exploratory Software Project 2004 2nd half, at Bunkyo Green Court 18F.

Mikio Hirabayashi's project, Hyper Estraier: a full-text search system for communities. Core API and Thread API already implemented. Currently designing Node protocol and Node API so start implementing Node server, Node API and Node Farm. Progress 50%. About 1 hour for presentation and Q&A.

Kouichirou Eto's project, qwikWeb - integration of mail, web and meeting. Time series view of page modification was implemented. This idea will be extended as past and future event view so that we can use it as historical view and/or as planning view (scheduler). It would be nice if it can be used to coordinate meeting schedule and records easily. About 1 hour for presentation and Q&A.

Unfortunately, Kazuhisa Takei can't attend today's review meeting because his father is in critically ill.

After that, we discuss more.

someone implements postgresql module using hyper estraier APIs pgestraier , so that we can query to postgresql by using SQL for text indexed by hyper estraier.

Apache module mod_estraier that registers index of contents handled by Apache and provides search web page would be killer application of hyper estraier. It would be easily integrated with Apache and if configured with apache proxy, we can index all contents through the proxy, that is, user can search any browsed contents. apache2-mpm-prefork would be problem, because hyper estraier could be used in single writer and multi reader.

qwik.jp currently broken, it says unregistered FQDN in HELO, so some SMTP, at least debian.or.jp, refuses the connection. It is fixed.

Today, I have a meeting with IPA to hear explanation of 2004 Open Source Software Base Consolidation Project, in an hour.

Result of 2004 activities:

• Enrich OSS assets
  • public offering: 13 projects (6+7)
    • http://www.ipa.go.jp/software/open/2004/result.html
  • priority theme
    • OSS performance/reliability evaluation and development of problem analysis tool
  • misc
    • IPA fonts
• Promotion of OSS usage
  • OSS performance/reliability evaluation and development of problem analysis tool
  • Publicity
  • Evidence Expreiment at School
• Forum
  • Japan OSS Promotion Forum
• International Cooperation
  • Northeast Asia OSS Promotion Forum
• Misc
  • OSS Room at IPA; for committee meetings, Working Groups

I claimed that IPA fonts would not be so good for OSS community, because IPA fonts itself were not considered as open source (in debian term, "non-free") and very ambigous about its license statements, thus we're trouble in adoption of IPA fonts in free distribution such as Debian.

I found some uncertain graphs in some reports in OSS performance/reliability evaluation and development of problem analysis tool, that is, no measure on axis, no explanation of the measure or so. It is not scientific graph, but would be marketic graph. I doubt these graphs are meaningful...

Anyway, most activities are focus on industry and/or government not on OSS community. I agree that OSS promotion to industry and/or government would be good, because it would be a way for free software community to get some power. However, I'm not sure that these activities are really effective for us. Based on IPA's explanation, I have to write evaluation summary report of the project by June 3rd.

Today, I attend study committee run by Information technology Promotion Agency. The objective of the committee is to propose the way to establish good method to evaluate security quality by reading source code.

We discuss how let good code reader work for security quality evaluation, what should be minimum requirements on criteria of security quality evaluation, what environments would be required for establish good method to evaluate security quality by reading source code and so on.

Several topics in this discussion are:

• Expensive software products are not so much used, so that potential bugs may not be appeared.
• what should we do to let expert read the code for auditing security.
• case study? e.g. similar bugs to issues in security advisory.
• `refactoring'. in software science, it is called as `programming transformation'. technique would be the same but the purpose is different?
• programmers may be fundamentally good, so that they would try to write better code?
• some programmers write code without enough understanding of specifications
• automatic test-case generator is wanted.
• it would be nice if various (minor) architecture platforms are available to try/debug the programs.
• some software analysis tools are introduced.
  • purify http://www.sra.co.jp/Rational/purify/
  • Coverity http://www.coverity.com/
  • splint http://www.splint.org/
• what source code should be targeted to audit the source code? stable version of distribution, or unstable? most developers will review current code, but won't review old one? current code will be changed rapidly?
• who should we invite this code reading activity? how motivate?
• when/how can we disclose the knowledge from this code reading? This kind of knowledge would be useful for crackers.

What is the good plan for FLOSS developers community?