- WLUG - wlug.mailman3.com

Reminder: No meeting tonight, next is tomorrow Thu 1/9
by Chris Thompson Jan. 8, 2014

Jan. 8, 2014

Fortunately, I visited the WLUG site tonight and noticed the change of day (yeah, I missed the mailing list mention of it). Just hoping to make sure others notice too! See you all tomorrow! Did I also miss confirmation on use of the same room? Thanks, --Chris

1 0

[Super] 8mm Film to Video
by Larry Camilli Jan. 3, 2014

Jan. 3, 2014

When I looked into this several months ago (because I, too, have a pile of old home movies), I discovered: The frame rates of film and video do not divide evenly. So, to get the video to flow at the same rate as the film, extra copies of frames are inserted here and there - at regular, but odd intervals. [I wonder if, on a computer, you could set the video refresh rate and video frame rate to something that would work for the original film frame rate.] There are some relatively cheap set-ups available to project a film on a small screen and video-record it. I can't imagine that the quality would be better than horrible. With the incompatible frame rates, how bad would the flicker be? I vaguely recall that you have to provide the projector and camera. Those once ubiquitous Kodak Instamatic projectors are famous for having brittle plastic gears. I have two such projectors; both broken. [They worked when stored 30 years ago. When I fired each up, little bits of plastic gear went flying.] There is a company I found on the web that provides instructions and parts to restore these things, but... I would think that trying to run an old film through a projector - with the jerky motion necessary to get each frame stationary in the gate when the shutter opens - risks shredding the film. Non-linear scanning at low speed sounds safer. Googling, I found a web site by some guy who was working on his own transfer mechanism. He was using a scanner with fine-enough resolution that he thought it would be OK for such tiny pictures. And, he rigged up some mechanical device to automatically advance the film some number of frames at a time and scan a group of frames. -And, he was working on some software to separate the frames and adjust them so that they're aligned (based on the sprocket holes) because the mechanism couldn't possibly align the frames on the scanner well enough. I'll see if I can find the site again. I wonder if there's pent-up demand for transfer services because the prices are so high. I had hoped to find a co-op or non-profit. But, commercial transfer equipment is so expensive, even a non-profit would have to charge a lot to break even. -Maybe a charitable organization interested in preserving old film and Americana would do it on the cheap? Or, a small number of people buying a (used) $1000 telecine machine could split the cost and take turns... ...and sell it when done? I would think that it'll be worth looking over the films carefully and deciding which are really worth transferring. [I used a microfiche reader to look at a few of mine. It was extremely awkward.] Some of the the companies in/near Boston allow you to use their equipment for free to view your movies. And, there are old viewers (hand-cranked, for editing) around... http://www.thebattles.net/video/8mm_restoration.html http://photo.net/video-forum/003WXX http://vimeo.com/22015773

1 0

creating digital files from super 8 films
by The Hammer Dec. 27, 2013

Dec. 27, 2013

I have a bunch of old Super 8 movie films from family in years gone by. Can any one recommend an efficient and economical way to convert them to digital files? I see online services available, but they are very costly. Thanks, Ron PS as a last resort I may experiment with using a projector to play the reels and try to record the projected image with a cam corder. My fear is that there will be too much quality loss this way.

5 5

WLUG meetings in 2014 on Thursdays
by Chuck Anderson Dec. 20, 2013

Dec. 20, 2013

For 2014, I may have conflicts on most Wednesdays. I just scheduled the next batch of meeting space for 2nd Thursdays of each month, with our next one on Thursday, January 9, 7:00 PM. I'm still waiting for confirmation on the meeting location, but I did request the same room we've been meeting in, Campus Center Mid-Century room 331. Happy Holidays, Chuck

1 0

Meeting tonight at 7pm in Mid Century room (rm. 331)
by Tim Keller Dec. 11, 2013

Dec. 11, 2013

Hey Gang, Tonight we've got a meeting at the mid century room (rm. 331) at 7pm. No topic, no speaker so it'll just be an open forum... I figure we can talk about linux current events, any interesting linux stuff people are working on and talk about what we want to do for demos/etc. for next year. If nobody objects, I'd like to sign myself up for the talk for next month. Thanks, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

1 0

Announce: WLUG Meeting tonight
by Chuck Anderson Dec. 11, 2013

Dec. 11, 2013

Yes, there is a WLUG meeting tonight, 7PM, WPI Campus Center Mid-Century room 331. On Wed, Dec 04, 2013 at 04:35:56PM -0500, Henrique wrote: > Hey Linux Enthusiasts, > > Are we having a meeting next week? > > There are plenty of interesting stuff going on lately: > > Valve, one of the major distributors of games for PC is moving towards > Linux, and just joined the Linux Foundation - > http://thenextweb.com/insider/2013/12/04/valve-joins-linux-foundation-prepa… > - > This is also pushing AMD/Nvidia to push for better graphics drivers. > > > Interesting bits from Kernel 3.13 - > http://www.phoronix.com/scan.php?page=news_item&px=MTUxNTk > -F2FS a filesystem made only for Flash file systems. > - I am particularly skeptical about the "There's now NFTables as the > eventual replacement to IPTables." > > Some filesystems benchmarks: > http://www.phoronix.com/scan.php?page=article&item=linux_btrfs_311&num=3 > http://www.phoronix.com/scan.php?page=article&item=linux_312_fs&num=3 > I just find interesting that compression can actually increase your > performance. > > Google's Go Lang 1.2 is released: http://blog.golang.org/go12 > > Cheers, > Henrique.

1 0

Fwd: Open Position @ Brown
by Phillip Deneault Dec. 5, 2013

Dec. 5, 2013

Brown University is looking for a security-centric Windows/Linux admin for a special environment they are building to process health care records. If you have experience with security regulations and technologies and like the straight-shot commute to Brown via 146 rather than commute to Boston on the Pike, this might be for you. Please respond to the position description and not to me. I do not represent Brown or know anything about the job beyond what is here, I'm just posting for a friend. Thanks, Phil

1 0

Meeting next week ?
by Henrique Dec. 4, 2013

Dec. 4, 2013

Hey Linux Enthusiasts, Are we having a meeting next week? There are plenty of interesting stuff going on lately: Valve, one of the major distributors of games for PC is moving towards Linux, and just joined the Linux Foundation - http://thenextweb.com/insider/2013/12/04/valve-joins-linux-foundation-prepa… - This is also pushing AMD/Nvidia to push for better graphics drivers. Interesting bits from Kernel 3.13 - http://www.phoronix.com/scan.php?page=news_item&px=MTUxNTk -F2FS a filesystem made only for Flash file systems. - I am particularly skeptical about the "There's now NFTables as the eventual replacement to IPTables." Some filesystems benchmarks: http://www.phoronix.com/scan.php?page=article&item=linux_btrfs_311&num=3 http://www.phoronix.com/scan.php?page=article&item=linux_312_fs&num=3 I just find interesting that compression can actually increase your performance. Google's Go Lang 1.2 is released: http://blog.golang.org/go12 Cheers, Henrique.

1 0

Free Non-working Older Dell Server - For parts
by joel d Nov. 22, 2013

Nov. 22, 2013

Please contact me direct (off list) if you would like this for parts. Non working server is a Dell 1600SC Problem with server's motherboard giving boot eror "No timer tick interrupt" also beeps 4-2-1 pattern. Server has no hard disks, and motherboard not working/booting. Offered for it's likely good parts (case, power supply, some ECC RAM, etc.). Contact me joelgroup(a)gmail.com if you have any interest. (If not it goes to elect recycling in a few days.) Thank you, Joel

1 0

Upgrade
by Clint Moyer Nov. 11, 2013

Nov. 11, 2013

My main PC is long overdue for an update. I dual boot Win7 and Linux Mint. Light use, no gaming or heavy graphics. A few questions: Are there any gotchas using a CPU with integrated GPU? Not talking about mobo chipset graphic, but something like an AMD CPU with embedded ATI graphic. I haven't yet dealt with any motherboard with UEFI bios. I know there was a big uproar over Secure Boot. Is this going to give me any headache installing Linux? Is there any specific manufacturer that implements it more properly than others? Asus has been my goto brand. I'll retain my current HDDs for storage but would like to use an SSD for the OSes. I'd assume that's pretty transparent as far as installing Linux goes? Anything I need to worry about here? Any specific advice or recommendations will be appreciated. Thanks. Clint

2 1

Re: [Wlug] Wlug Digest, Vol 121, Issue 5
by David Hardy Nov. 10, 2013

Nov. 10, 2013

When I got three new machines over this past year, they all came with Windows 8 (HP Pavilions) and Atheros ethernet controllers. I had to disable Secure Boot on the machines where I installed Linux and it was also a royal PITA dealing with the Atheros drivers. Ubuntu and Mint did not want to work with Atheros, and the one machine I finally put Linux on ended up working nicely with Fedora 19. One machine remains Windows 8 (and I had gotten stung pretty badly doing the Beta 8.1 "upgrade" so am keeping it at the 8 level.) Because of pending job stuff I have to, for now, keep a second machine running Windows Server 2012R2, which works fine with the Atheros (Windows 2008R2 did not). And my remaining machine runs Fedora 19 with a hardened Virtual Box running a Whonix vm running Tor and an offshore mail client. Good luck; YMMV, obviously, but I think the disabling of Secure Boot may be your first order of business. Regards from northern Vermont (and 1980s denizen of Woostah) Dave On Sun, Nov 10, 2013 at 12:00 PM, <wlug-request(a)mail.wlug.org> wrote: > Send Wlug mailing list submissions to > wlug(a)mail.wlug.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://mail.wlug.org/mailman/listinfo/wlug > or, via email, send a message with subject or body 'help' to > wlug-request(a)mail.wlug.org > > You can reach the person managing the list at > wlug-owner(a)mail.wlug.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Wlug digest..." > > > Today's Topics: > > 1. Upgrade (Clint Moyer) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 10 Nov 2013 10:57:22 -0500 > From: Clint Moyer <cdmoyer(a)charter.net> > Subject: [Wlug] Upgrade > To: Worcester Linux Users Group <wlug(a)mail.wlug.org> > Message-ID: <C42E30DF-37B2-4081-B5F9-946E50BC2D71(a)charter.net> > Content-Type: text/plain; charset="us-ascii" > > My main PC is long overdue for an update. I dual boot Win7 and Linux Mint. > Light use, no gaming or heavy graphics. A few questions: > > Are there any gotchas using a CPU with integrated GPU? Not talking about > mobo chipset graphic, but something like an AMD CPU with embedded ATI > graphic. > > I haven't yet dealt with any motherboard with UEFI bios. I know there was > a big uproar over Secure Boot. Is this going to give me any headache > installing Linux? Is there any specific manufacturer that implements it > more properly than others? Asus has been my goto brand. > > I'll retain my current HDDs for storage but would like to use an SSD for > the OSes. I'd assume that's pretty transparent as far as installing Linux > goes? Anything I need to worry about here? > > Any specific advice or recommendations will be appreciated. Thanks. > > Clint > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: > http://mail.wlug.org/pipermail/wlug/attachments/20131110/7acc8a8c/attachmen… > > ------------------------------ > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > > > End of Wlug Digest, Vol 121, Issue 5 > ************************************ >

1 0

OPENING - Embedded Linux, Open WRT contract in northern MA
by John Spencer Nov. 6, 2013

Nov. 6, 2013

We have a client in northern MA looking for a Sr or Prin level consultant for a new project They are looking for experience with embedded Linux and OpenWRT. If you or anyone you know may be qualified and interested, please let me know. I would be happy to share additional details. Please send a Word version of your resume with any questions. Please Note, your resume will not be sent anywhere without your prior approval. Regards, John Spencer Connected Systems Partners Connecting Top Talent with Top Companies 978-455-5550 x208 978-621-9743 cell jspencer(a)connectedsp.com www.connectedsp.com<www.connectedsp.com%20> GET CONNECTED! Unless otherwise explicitly instructed by sender, all information in this email is considered confidential and intended for the view and use of the recipient(s) only.

1 0

Announce: WLUG Meeting Wed 11/13 7PM: OpenWRT
by Chuck Anderson Nov. 6, 2013

Nov. 6, 2013

Hi folks, The next Worcester Linux Users' Group (WLUG) meeting will be held NEXT Wednesday, November 13 at 7PM. The location will be the WPI Campus Center, Mid-Centry Room 331. We will have a discussion of people's experiences with OpenWRT, and perhaps a demo of how to load OpenWRT on a Netgear home wireless router and configure it for Bufferbloat avoidance/improvement. Wednesday, November 13, 7:00 - 9:00 PM WPI Campus Center, Mid-Centry Room 331 Afterwards, we will go out for pizza. See you there, Chuck President, Worcester Linux Users' Group http://www.wlug.org/

1 0

OpenWRT on WNDR3800 home router - my install thoughts
by joel d Nov. 4, 2013

Nov. 4, 2013

Decided to try OpenWRT after Jim Getty's talk and strong recommendation last month for improved security and reduced local buffer bloat. What follows is my experience / thoughts from this process. I would happily bring the hardware to demo at a future meeting if there is interest. Likely wouldn't be a full meeting but a 10-15 minute filler. More likely Q&A than anything else. I decided to go with different router/firewall hardware so I bought a Netgear WNDR3800 which Jim mentioned and is also a favorite of the OpenWRT crowd. Mine was used and $50 shipped from e-bay. This model is one model old and no longer available new. FYI: Netgear website lists it as "out of support". My WNDR3800 was used prior, so I needed to do a hard firmware reset on the bottom of router with a paperclip (didn't know the prior IP used or the admin password). Once reset and rebooted, router worked fine and could login to the "default" Netgear firmware and configuration. Default username & password is printed under the router. Downloaded the recommended OpenWRT firmware for this model. Needs to be full "factory" (instead of partial upgrade) and squashfs is recommended. Netgear WNDR3800 Firmware download link gets you OpenWRT version 10.X version which is not latest OpenWRT. Web browser login to Netgear webpage/firmware and followed "upgrade firmware" link while pointing to OpenWRT download file on local disk. The upgrade/re-flash took around 4 minutes and after a reboot worked fine. Set password and reconfigured router and WIFI with my specifics. Was up and working on OpenWRT v 10.x. Next day realized I had OpenWRT, but not latest stable version. Upgrade firmware link does not go to Internet directly, so first download OpenWRT v 12.4 with "upgrade" and "squashfs" and save to local disk. Second apply this via upgrade button in OpenWRT web link. I could likely have saved a step by grabbing the OpenWRT v12.4 for WNDR3800 with factory and squashfs. I bet this would have worked had I tried it (and saved a step). General thoughts after use for a week: OpenWRT does not have an "update direct to mother ship" feature best I can tell that downloads file and updates it from web interface. Not a show stopper for me. Instead need to know your version of OpenWRT and download an "upgrade" file and apply as two steps. This would only matter if router was used/maintained by a non-geek. Prior problem occurred with similar hardware WNDR3700 with latest Netgear firmware (happened with prior Linksys also). A few embedded WIFI devices in home would disconnect and fail randomly and at least weekly. Thus far these device annoyances have not occured since swap to WNDR3800 and OpenWRT. No idea why, but definitely A win! OpenWRT has transmit power level settings for the WIFI radio transmit. Can decide to bump up the WIFI radio settings if user chooses. Even if you melt/destroy them, a cool option if needed & tested. Firmware update for OpenWRT works from a laptop on WIFI, which in my experience Netgear & Linksys and other vendors do not support flash without a cabled ethernet port. So the OpenWRT update scripts the 1) copy file 2) apply file 3) reboot device. My Next Steps: In another week will likely repurpose the WNDR3700 likely as a WIFI gateway for the "cheap WIFI radio" devices, (mainly TV, roku, DVD, etc.). Not yet sure if I will use OpenWRT for this. Look into the option of external antennas for the WNDR3800. I live out in the country and have few neighbors to notice/know/care. If I can get there... improved & reliable WIFI signal at my mailbox would rock.

3 2

Idiot Service Providers
by Keith Wright Oct. 23, 2013

Oct. 23, 2013

On recomendation from someone on this list, I signed up for Speakeasy DSL. The helped me set up a primary name server (DNS) and they ran a secondary name server for a few extra dollars per month. This has been working well for about a decade. Speakeasy was sold to MegaPath, who yesterday sent me a message that included this: > Dear MegaPath Customer, > > This email is to advise you that MegaPath is > migrating its legacy Speakeasy ISP, web hosting, > webmail and DNS services to a more advanced platform. > > <Braindead "customer-experience" > happy market-talk deleted> > > Going forward, we will no longer support secondary > DNS services. If your domain is set up in this > manner, please be sure to make the proper changes to > avoid a post-migration service disruption. This all happens next Tuesday. I read this is "We are breaking what has worked for a decade, there is nothing you can do, have fun finding a new ISP in two days." I was wall-punching cursing mad. When I calmed down a bit I began to think, if they don't break anything else, maybe it's not so bad. The system was designed to tolerate failure. _I_ was not designed to tolerate _intentional_ failure, but everything should still work if the secondary name server is broken. Since I have only one IP address on one DSL line, I never really saw the need for a secondary server in the first place. I run a primary server because (A) I like to think of myself as a programmer, and it is self education to figure out how to do it. (B) Sometimes I create subdomains and run test program servers in them. The RFC's require a second name server, and the registrar asks for it, but who's going to care really? If the primary name server goes out, so do all other servers in the domain, since it's all really just one computer. What would you recommend? If anyone else has the same problem, I could be your secondary, and you could be mine. -- Keith

3 4

Barbarians at the gates...
by Tim Keller Oct. 21, 2013

Oct. 21, 2013

This is a paper about High Frequency Trading, it's an interesting if not entirely terrifying read about what a crazy place the markets have become. http://queue.acm.org/detail.cfm?id=2536492 Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

1 0

Bufferbloat demonstrations w/water and funnels
by Chuck Anderson Oct. 14, 2013

Oct. 14, 2013

Here is a series of videos of a talk by Dave Täht where he uses water and funnels to demonstrate the concepts of bufferbloat: [1] Bufferbloat #1 - TCP 101 [2] Bufferbloat #2 - Tail drop queueing [3] Bufferbloat #3 - FIFO, RED, Blue, and Fair Queueing [4] Bufferbloat #4 - Wifi, Netalyzr, SFQ, SFQRED, and CoDel [5] Bufferbloat #5 - CoDel and Drop Head Queueing [6] Bufferbloat #6 - More on FQ_Codel [7] Bufferbloat #7 - Q&A [1] http://www.youtube.com/watch?v=KD5TwLQnq_8 [2] http://www.youtube.com/watch?v=PgFcqRMDqlk [3] http://www.youtube.com/watch?v=Y9xJbwb28Zc [4] http://www.youtube.com/watch?v=ol_BcKA9Ohg [5] http://www.youtube.com/watch?v=R8Esi0zjNdE [6] http://www.youtube.com/watch?v=bi-jumVNVGk [7] http://www.youtube.com/watch?v=JFH5fGNzBJU

1 0

Changing your network scheduler in ubuntu 13.04...
by Tim Keller Oct. 14, 2013

Oct. 14, 2013

Just so people know... this is how to change the scheduler on Ubuntu 13.04. tc qdisc replace dev eth0 root fq_codel limit 100 target 5ms interval 30ms ecn Obviously replace "eth0" with your appropriate network device... Enjoy, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

1 0

Reminder: WLUG Meeting Wed 10/9 7PM Jim Gettys on Internet buffer bloat
by Chuck Anderson Oct. 7, 2013

Oct. 7, 2013

Hi folks, The next Worcester Linux Users' Group (WLUG) meeting will be held this Wednesday. This month we will have Jim Gettys from Bell Labs talk about Internet buffer bloat. This is the talk that has been rescheduled from April. Note that there has been a room change to a larger room right down the hall from our regular location. Wednesday, October 9, 7:00 - 9:00 PM WPI Campus Center, Hagglund Room 301 The Campus Center is building #7 on the campus map [1], and the Hagglund Room is room 301 on the Campus Center building floorplan [2]. [1] http://www.wpi.edu/about/visitors/campusmap.html [2] http://www.wpi.edu/Admin/CC/Floorplans/37678.htm "Internet buffer bloat, by Jim Gettys (Bell Labs) VOIP and teleconferencing often perform much more poorly on today's Internet than the Internet of a decade ago, despite great gains in bandwidth. Lots of fiber, cheap memory, smart hardware, variability of wireless goodput, changes in web browser behaviour, changes in TCP implementations, and a focus on benchmarking Internet performance solely by bandwidth, and engineer's natural reluctance to drop packets have conspired to encourage papering over problems by adding buffers; each of which may introduce latency when filled. The mistaken quest to never drop packets has destroyed interactivity under load, and often results in actual higher packet loss, as TCP's congestion avoidance algorithms have been defeated by these buffers. The lessons of the "RED manifesto" of 1997 have been forgotten or never learned by a new generation of engineers." Wednesday, October 9, 7:00 - 9:00 PM WPI Campus Center, Hagglund Room 301 Afterwards, we will go out for pizza. See you there, Chuck President, Worcester Linux Users' Group http://www.wlug.org/

1 0

Announce: WLUG Meeting Wed 10/9 7PM Jim Gettys on Internet buffer bloat
by joel d Oct. 3, 2013

Oct. 3, 2013

I plan to attend Wednesday's meeting also (90% likely at this point). Joel

1 0

Announce: WLUG Meeting Wed 10/9 7PM Jim Gettys on Internet buffer bloat
by Chuck Anderson Oct. 3, 2013

Oct. 3, 2013

Hi folks, The next Worcester Linux Users' Group (WLUG) meeting will be held at its regularly scheduled time: the 2nd Wednesday of the month, which is Wednesday, October 9, at 7PM. The location will be the WPI Campus Center, Mid-Centry Room 331. This month we will have Jim Gettys from Bell Labs talk about Internet buffer bloat. This is the talk that has been rescheduled from April. "Internet buffer bloat, by Jim Gettys (Bell Labs) VOIP and teleconferencing often perform much more poorly on today's Internet than the Internet of a decade ago, despite great gains in bandwidth. Lots of fiber, cheap memory, smart hardware, variability of wireless goodput, changes in web browser behaviour, changes in TCP implementations, and a focus on benchmarking Internet performance solely by bandwidth, and engineer's natural reluctance to drop packets have conspired to encourage papering over problems by adding buffers; each of which may introduce latency when filled. The mistaken quest to never drop packets has destroyed interactivity under load, and often results in actual higher packet loss, as TCP's congestion avoidance algorithms have been defeated by these buffers. The lessons of the "RED manifesto" of 1997 have been forgotten or never learned by a new generation of engineers." Wednesday, October 9, 7:00 - 9:00 PM WPI Campus Center, Mid-Centry Room 331 Afterwards, we will go out for pizza. See you there, Chuck President, Worcester Linux Users' Group http://www.wlug.org/

10 10

Keysigning Party -- what to do AFTER
by Chuck Anderson Sept. 19, 2013

Sept. 19, 2013

So you've attended a keysigning party and diligently checked people's key fingerprints & IDs. Now what should you do? Here is an overview of the process you should follow: 1. Sign: Look at the checklist you made at the Keysigning Party. For each user where you checked off that you verified their key information & ID, you need to import their key, verify the imported key's fingerprint matches the printout/notes that you verified at the party, sign their key(s), and send them back to them, preferrably signed+encrypted to their key. 2. Import: As you receive your signed key(s) from other people, import them to your keyring and then upload them to a keyserver. 3. Refresh: Periodically refresh your keyring from a keyserver so you get local copies of other people's keys with any additional signatures that were added since you last refreshed. Detailed instructions for each step: 1. Sign: Configure GPG to always ask for the certification level. Before signing keys, it is a good idea to set your GnuPG configuration to always ask you what certification level to assign to each key you sign. This indicates to others how carefully you verified the person's identity before you signed their key. If you don't do this, GnuPG will default to 0 which means you make no particular claim as to how careful you were. Edit $HOME/.gnupg/gpg.conf and add the following to the end: ask-cert-level You can also optionally change the default (in case you don't want to be asked every time): default-cert-level 2 1a. Sign: The CAFF Method. The easiest way to do this is to use CAFF (CA Fire & Forget) from the pgp-tools package on Fedora, or the signing-party package on Debian/Ubuntu. After installing the pgp-tools or signing-party package, you need to configure CAFF. In order to create your initial .caffrc, just run "caff" once. caff Then edit the .caffrc file in your home directory. The minimum settings you should set are: $CONFIG{'owner'} = 'YOUR FULL NAME'; $CONFIG{'email'} = 'YOUREMAIL@FOO'; $CONFIG{'bcc'} = 'YOUREMAIL@FOO'; $CONFIG{'keyid'} = [ qw{YOUR-KEY-ID YOUR-OTHER-KEY-ID-IF-YOU-HAVE-ANY} ]; $CONFIG{'local-user'} = [ qw{YOUR-KEY-ID YOUR-OTHER-KEY-ID-IF-YOU-HAVE-ANY} ]; $CONFIG{'also-encrypt-to'} = [ qw{YOUR-KEY-ID YOUR-OTHER-KEY-ID-IF-YOU-HAVE-ANY} ]; $CONFIG{'default-cert-level'} = '2'; # as above, but for CAFF specifically Note that the KEY-IDs CAFF wants are 8-byte ones rather than the usual 4-byte. Just use the last 16 digits of the fingerprint. You can also customize the email message body that CAFF will send out with each signed key. Then you just run CAFF like this: caff 0xKEY-ID1 0xKEY-ID2 0xKEY-ID3 ... ... etc to sign all those KEY-IDs. You can run it once for each person/key, or list every person's KEY-ID on a single run. CAFF will prompt you to sign people's keys one by one (which you should only do after you verify the fingerprint against your paper copy from the Keysigning Party), then it will email the signatures for each uid (email address) separately to that email address, signed+encrypted to that user. That proves that the user who can receive email at that email address, and who can decrypt the message, is the only user who can get the signature for that user/uid/email, and that is the only way they can get the signature for that uid/email (as long as you don't send your signed copy of their key to a keyserver or anywhere else--leave that to the recipient). 1b. Sign: The Manual Method. It is tricky to do the above manually without CAFF, but if you don't want to run CAFF or can't for some reason, you can sign the key and then export the signed key with gpg --export. Ideally, you should then encrypt that and send it to at least one of the email addresses listed in the uid(s) if not all of them. This is not as good as the CAFF method, because it only proves that at least ONE of the uids/email addresses is controlled by the user who has that key, and the person who controls that ONE email address can get your signature on ALL of the uids/email addresses. These commands should work for the manual method. First verify that the fingerprint matches your printout or notes from the Keysigning Party: gpg --fingerprint 0xRECIPIENT-KEY-ID Now sign the key: gpg --sign-key 0xRECIPIENT-KEY-ID Now export their key, signed+encrypted to both them and you. Store the result, ascii armoured, into a file: gpg --export 0xRECIPIENT-KEY-ID | gpg --encrypt --sign --armour --recipient 0xRECIPIENT-KEY-ID --recipient 0xYOUR-KEY-ID - > 0xRECIPIENT-KEY-ID-signed-key.asc You can verify that this came out right before emailing (since you signed/encrypted it ALSO to your own KEY-ID above) with the following: cat 0xRECIPIENT-KEY-ID-signed-key.asc | gpg -d | gpg --list-packets And you can import it to a test keyring to see the signatures like this: cat 0xRECIPIENT-KEY-ID-signed-key.asc | gpg --decrypt | gpg --import --keyring=testring.gpg --no-default-keyring gpg --list-sigs --fingerprint --keyring=testring.gpg --no-default-keyring Now that you've verified it is all correct, just attach the .asc file to an email and send it to the user's email address(es). 2. Import signed keys other people send you and then upload them. When you receive emails from other people with your signed key(s) (hopefully signed+encrypted in the email) you should import them as follows. If the sender used the CAFF Method, the entire email will be signed+encrypted and you can import the key like this: cat encrypted-email.asc | gpg --decrypt | gpg --import If the sender used the Manual Method, you will have a signed+encrypted attachment that you can import like so: cat 0xYOUR-KEY-ID-signed-key.asc | gpg --decrypt | gpg --import Now you should send your key back to a keyserver with the new signature(s) you just added: gpg --keyserver=subkeys.pgp.net --send-key 0xYOUR-KEY-ID 3. Refresh: Periodically refresh your keyring from a keyserver. In order to reap the benefits of the Web of Trust, you need to download other people's public keys so you can take advantage of the signatures on those keys to verify other people further out in the Web. As people upload their keys with additional signatures on them, your local copies become out of date so you need to refresh them to gain the additional signatures, any revocations, etc. To refresh a single key, just download that key from a keyserver: gpg --keyserver=subkeys.pgp.net --recv-key 0xKEY-ID To refresh your entire keyring (do this sparingly as it does place quite a load on the keyserver): gpg --keyserver=subkeys.pgp.net --refresh-keys That's it!

1 0

Follow up from key signing
by Eric Martin Sept. 19, 2013

Sept. 19, 2013

Hi WLUG and BLU, I have signed all of the keys I have access to. If you haven't received an email from me, it's because either a) I can't get your key, or b) the email with your signed key was lost. Please email me directly if you're expecting a signed key from me. A few people expressed interest in the suite of tools I'm using to make signing easier, and also some visualization tools I'm playing with. They're all based on Debian's pgp-tools which can be called keysigning-party on your distribution. Hands down, the most useful tool is CA Fire and Forget or caff. It's in most distributions, and if it's not in your distro (or you're on a Mac) it's pretty easy to build. Just checkout it out from svn://svn.debian.org/svn/pgp-tools/trunk, and do a make all && make install clean Now that you have caff installed on your machine, it's time for some tweaks. Go ahead and run caff by typing caff at the command prompt. This will setup the folders and files you need that we'll be tweaking. 1) I *highly* suggest making a symlink from ~/.gnupg/gpg.conf -> ~/.caff/gnupghome/ via ln -s ~/.gnupg/gpg.conf ~/.caff/gnupghome This will have caff use your preferences in gpg.conf and it makes it easier to configure / use the way you want to. 2) edit ~/.gnupg/gpg.conf and set your default key, default keyserver (most of them sync with each other so it's not a big deal, but I prefer pool.sks-keyservers.net since it handles subkeys very well.) Also to note, keys can prefer certain servers so don't worry if gpg is asking a few different servers where things are. Also, if you haven't already, set your preferences for algorithms, hashes, and compression. *NOTE* this only applies to making new keys. You should still set the proper preferences on your key via gpg --edit-key <KEYID>. Lastly, I like to add ask-cert-level so gpg (and therefore caff) ask me what certification level to give to each signature 3) edit your ~/.caffrc file to customize your name, email address, and email template / procedure for signing keys. Caff looks for 16 digit keyids, not 8 so punch in the last 16 of your fingerprint for you key. Also, I like to bcc myself on the emails in case a message gets bounced so I can resend it easily via Thunderbird 4) Once those are edited and saved, you're all set! Grab your trusted list, and feed caff one or more keyids to handle via caff <KEYID> <KEYID> <KEYID...> Don't forget to verify the fingerprint caff / gpg show you with your trusted list. I'm attaching my gpg.conf and .caffrc files for those of you who are interested. I should probably put this up as a wiki / blog post at some point in time to I can go back and update / clarify it. Also, check out: sig2dot (included in pgp-tools / keysigning-party) which is a visualizer for the Web of Trust http://pgp.cs.uu.nl/ for PGP trust paths Cheers!

1 0

Ubuntu usb/bluetooth/android
by Bill Mills-Curran Sept. 15, 2013

Sept. 15, 2013

I've had my shiny new HTC One for a while, and I've found that the USB-connected file mount/transfer/etc speed with my Ubuntu (Precious) is atrocious. I've tried both the nautilus (automount) interface and the mtp-mount: both are bad. I'm wondering whether a usb-bluetooth adapter (my laptop does not have bluetooth) would allow me to mount the smartphone filesystem and get decent performance. TIA, Bill

2 1

Next WLUG Meeting: Keysigning Party 9/11/2013
by Eric Martin Sept. 12, 2013

Sept. 12, 2013

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On Wednesday, September 11th 2013 I'll be running a PGP Key Signing party. PGP stands for Pretty Good Privacy and was developed by Phil Zimmerman in 1991 for secure communications. Signing keys allows you to say that you trust somebody's key, and extends the Web of Trust which helps everybody. To participate, please bring your public key's fingerprint, and at least (2) forms of ID (Government issued photo ID is the best way to go). If you don't yet have a public key, follow the directions for 'Preparing for the Party' from this [1] Key Signing Party HOWTO. Additionally, please upload your public key to our keyring for this event here [2]. I'll give a brief talk on PGP, and then we'll go through everybody's keys. What not to bring: A computer. Keys are signed at home, we just verify them at the Key Signing. [1] http://www.cryptnet.net/fdp/crypto/keysigning_party/en/keysigning_party.htm… [2] http://biglumber.com/x/web?keyring=4480 - -- Eric Martin Key Fingerprint = C74F 1EBF 2E80 7984 8CB5 064E BF17 D34C C704 B30F -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (Darwin) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBCAAGBQJSIBdBAAoJEL8X00zHBLMPIP8P/AmMZiaHpVo3Mq72yOXONUbX bUUFKtK2qCFw0g8uAJ63D5hL7kDTbWXlTWsm+73jvkaofsKyTP8hNR0ulr5ni7dw X7EEQYSpK0MufQzEqUpfEoIa6I8Pjfa5qIWNOAuJDJpAwR8+0S2urGcQML0YarFG fys0HHWW69kYG8CTGZw/0ATmBdVZFiZEjXFk6R5wIB33SvXtzuPTLltoded5bpwK svtZf4Fa3QlaEBlg25AKWFpa6OOTt3eUBQU/KNGjhfIrLkhpsbuhcbAD6C6DPtzk 25P/9TWCSaRAcyT29amGG5qLrFEHklAic6UcOjIJtlN6ywcHSbVtHOcxIA4OmBLy e0HeskGlqu/qhqgZxDQMWbvMUdzIRqCa+pMzxGI40+w6tHnlTGPW1MZbZJxhfStW AC720w6U+q/b9iCiZHF634gbvIL6Da3G2G20Vhr4h6s1rOX53sfgIqmoB66A6SPC P6MUkO42oPdEQ7WE+69f7VHGyXgkEnJUaEXGYoBdILV3qyHyNJNKF/X7o0Vtf+xn rJTokOgCEyg5xRtzQFlYpdiIoR/BMHTteKsyki6px2hn4bCsNItOJNhG8IutVo/o qofPVIyJaiA5o7G7z8QNeppy4NBq0h752T0lU/gSs9ojhBzQ9kVuhR4PNL6QcZ98 +rLxS3s1fEsTmakIpo2G =lNN3 -----END PGP SIGNATURE-----

4 7