The long awaited and much anticipated 4.0 release of KDE has arrived! Due to the KWin release notes - the COMPOSITE_HOWTO, to be precise - I got KWin OpenGL effects working! They're fairly smooth on my Nvidia card, although they don't seem quite as smooth as I remember Compiz being. Hopefully it, or X, or the Nvidia drivers, will improve to make KWin 4 w/composite snappy. (It's not really "snappy" at this point like KWin 3 is.) I haven't managed to install the KDE Edu or KDE Multimedia modules yet, and I am stuck with the Plasmoids that aren't in extragear, but hopefully Ubuntu will get those re-packaged for 4.0 soon. (The current packages for those things depend on RC2, I think.)
KDE 4.0 is not perfect. I wish I could put the panel at the top of the screen, for instance. But I could certainly live with it (although I probably won't). I may stick with KDE 3.8 for a few more months, until I start writing plasmoids, or some other killer feature drags me into the new millenium. By the time Amarok 2 is released, and Decibal is added, etc, I'll probably convert. At the moment, GTK apps look really bad, probably because I don't have the appropriate qt-theming-for-gtk-apps thing installed. I'm sure Kubuntu will figure that out for Hardy at the latest. I may insist on making it work sooner by doing the appropriate Google or IRC dance. We'll see. I'm proud to have helped the KDE project, albeit in very small ways. (One or two bug reports and a miniscule excursion in bug triage, which I plan to continue, time allowing.) Mostly, just because KDE is the darn best collection of applications for the free desktop. But also, because of the enormous vision of the project, encompassing everything from Windows and Mac ports to integrating Plasma with Linux MCE. It's a bright future. The present is bright too, obviously.
(If your wondering, why on earth I'm polluting the world with yet another random-user-posts-his-KDE4-experience, it's mostly because it's past midnight, and I get confused and ramble/waste time after 12:00.)
Jan 12, 2008
Aug 24, 2007
GPG vs. S/MIME
So, after learning how to send emails with Python, I discovered that anybody can impersonate any email address. This is rather dangerous. Consider some hypothetical situations: Someone sends a flaming email to your boss using your email address, and you get fired! Or someone could send an email to my girlfriend (these are hypothetical situations) saying I want to break up with her. I ask her what is wrong, but she refuses to talk to me for a week! Even if I eventually find out what happened and assure her the email wasn't sent my me, damage is still done in the mean time.
So I when I read that in the latest preview of Kubuntu (Gutsy Gibbon, Tribe 5) that Kmail would be installed with all the programs needed for GPG (GnuPrivacyGuard), I decided to try GPG. I followed these simple instructions on the Ubuntu community documentation page. It was as simple as "sudo apt-get install mozilla-thunderbird-enigmail". I then followed the commandline instructions to generate a key pair and import them into Enigmail. (Enigmail has a GUI to generate and manage keys, I later found out.) It was as simple as putting in my name and email address and then issuing a command to upload my public key to the Ubuntu keyserver. (Keys are propagated to all the keyservers after some time.) Then, I could compose an email in Thunderbird and digitally sign or encrypt it via the menu or toolbar buttons. I sent a few emails to myself to test. The signature would automatically be verified and little icons and status bars would indicate that emails were signed or encrypted.
With the default settings, in order to sign my message, all the HTML formatting would have to be removed, and ugly text was added to the body of the email. E.g.,
I surely wasn't going to send emails looking like that! Luckily, there is an option (called PGP/MIME) that makes the PGP signature an attachment and preserves the HTML formatting. However, unless the people receiving the emails have a PGP plugin installed, they would simply see normal emails with attachments called "signature.asc". Not only is that anoying, it defeats the purpose, which is for them to be able to know if the email really came from me.
I learned that a different type of security, called S/MIME, is built into most email clients, including Microsoft Outlook and Mozilla Thunderbird. It uses the same encryption technology, but instead of using self-generated keys that are uploaded to public servers, it requires getting a key pair from a "certificate authority". In essence, instead of a community based "web of trust", it is a corporate based "buy a certificate and trust us, the corporation". Obviously, S/MIME has caught on, because companies like VeriSign make money off of it. ;-)
Fortunately, at least one certificate authority, Thawte, will give you a free "certificate" (read "private/public key pair") for personal email use. (These certificates, by the way, are the same technology used in SSL and HTTPS secure websites.) Therefore, I decided I would get a free "certificate" and and try S/MIME.
EASIER SAID THAN DONE!!!
I had to register with Thawte by giving them my name, email, date of birth, nationality, prefered currency and (because they need five security questions in case I ever forget my account password) the name of my first goldfish, first crush, favorite band, birth location, and the year I started homeschooling. The had to send me an email to verify my address. The first email didn't come, so I had to do the whole registration process over again. I got the email, followed the link to put in some codes they gave me in the email. Finally, I was allowed to request a certificate. I could get either:
Because I currently use Mozilla Thunderbird, I asked for a Mozilla Firefox/Thunderbird, Netscape Communicator/Messenger certificate. It complained because I was using the Opera web browser! So I tried getting the certificate with Firefox, but Firefox would not accept it. (I got the impression that Firefox would only accept PKCS 12 files, and apparently this was a PKCS 7 certificate?) I went to the support page, and found instructions on how to export a certificate from IE to Thunderbird. So I booted Vista and requested a certificate for IE (remember, these certificates work for Internet browsing too, although I have no idea why one would need one). It would not work on IE7 in Vista. (VBScript error.) So I went downstairs to an XP computer and requested a certificate for IE on it. Still using IE7, but on XP, it worked. I then exported the certificate from IE with the "export private key" option, and imported it into Thunderbird. But when I tried to send a signed message, I got an error! So I exported the certificate from IE again, with both the "private key" and "Include all certificates in certification path if possible" options, and imported into Thunderbird again. At long last, voilà! It worked! About time! Creating a GPG key pair and configuring Enigmail took about an hour of my morning. Getting a S/MIME certificate and importing it into Thunderbird took the whole afternoon!
The advantage of S/MIME, of course, is that I can sign all my messages, and other people will see it and think "Hey! That's like, secured or something," instead of "What's with the weird attachment?" They don't have to install extra plugins. (And there may be no good GPG plugins for Outlook. The Gpg4win project is doing it's best to make GPG easy on Windows, but they say Outlook doesn't allow the kind of functionality needed for PGP/MIME encryption or automatic decryption.)
So what can I say? I like GPG better. It's open-source, easy to set up, and is more than secure enough to verify that this email came from the real owner of this email address. S/MIME is less transparent, is designed to benefit corporations like Thawte and VeriSign, and the setup process - which could have been made very easy! - is a terrible user experience, at least with Thawte. (However, Thawte may be the only company that issues free email certificates that don't expire.) With GPG, I know that the only copy of my private key in the world is on my computer: you would have to hack into my computer to steal it. Thawte, on the other hand, generated the keypair for me, and they have a copy of my private key that I can redownload at any time. I'm trusting the employees of Thawte not to steal my key, AND I'm trusting that their servers can withstand attacks from hackers. Thawte harvested a lot of personal information in the registration process, which makes the possibility of identity theft even worse. However, I can't revoke the certificate. So which will I use: GPG or S/MIME? S/MIME, because it works with the leading email clients without my friends having to install extra software. However, I will keep my GPG signature and Enigmail around, because it might come in handy someday.
So I when I read that in the latest preview of Kubuntu (Gutsy Gibbon, Tribe 5) that Kmail would be installed with all the programs needed for GPG (GnuPrivacyGuard), I decided to try GPG. I followed these simple instructions on the Ubuntu community documentation page. It was as simple as "sudo apt-get install mozilla-thunderbird-enigmail". I then followed the commandline instructions to generate a key pair and import them into Enigmail. (Enigmail has a GUI to generate and manage keys, I later found out.) It was as simple as putting in my name and email address and then issuing a command to upload my public key to the Ubuntu keyserver. (Keys are propagated to all the keyservers after some time.) Then, I could compose an email in Thunderbird and digitally sign or encrypt it via the menu or toolbar buttons. I sent a few emails to myself to test. The signature would automatically be verified and little icons and status bars would indicate that emails were signed or encrypted.
With the default settings, in order to sign my message, all the HTML formatting would have to be removed, and ugly text was added to the body of the email. E.g.,
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This is a sample text.
This is more sample text.
The End
Love,
William
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFGzvFPhnWcV3yyfeERAsnFAKCUHyC5AZuI7jDAxhDI6DUfm6wN2gCgpbJw
vQXQ9cbH1TirrA4ppa6QYKg=
=SQbg
-----END PGP SIGNATURE-----
I surely wasn't going to send emails looking like that! Luckily, there is an option (called PGP/MIME) that makes the PGP signature an attachment and preserves the HTML formatting. However, unless the people receiving the emails have a PGP plugin installed, they would simply see normal emails with attachments called "signature.asc". Not only is that anoying, it defeats the purpose, which is for them to be able to know if the email really came from me.
I learned that a different type of security, called S/MIME, is built into most email clients, including Microsoft Outlook and Mozilla Thunderbird. It uses the same encryption technology, but instead of using self-generated keys that are uploaded to public servers, it requires getting a key pair from a "certificate authority". In essence, instead of a community based "web of trust", it is a corporate based "buy a certificate and trust us, the corporation". Obviously, S/MIME has caught on, because companies like VeriSign make money off of it. ;-)
Fortunately, at least one certificate authority, Thawte, will give you a free "certificate" (read "private/public key pair") for personal email use. (These certificates, by the way, are the same technology used in SSL and HTTPS secure websites.) Therefore, I decided I would get a free "certificate" and and try S/MIME.
EASIER SAID THAN DONE!!!
I had to register with Thawte by giving them my name, email, date of birth, nationality, prefered currency and (because they need five security questions in case I ever forget my account password) the name of my first goldfish, first crush, favorite band, birth location, and the year I started homeschooling. The had to send me an email to verify my address. The first email didn't come, so I had to do the whole registration process over again. I got the email, followed the link to put in some codes they gave me in the email. Finally, I was allowed to request a certificate. I could get either:
- a Mozilla Firefox/Thunderbird, Netscape Communicator/Messenger certificate
- a Microsoft Internet Explorer, Outlook and Outlook Express certificate
- a Lotus Notes R5 certificate
- an OperaSoftware Browser certificate
- or a C2Net SafePassage Web Proxy certificate
certificate.
Because I currently use Mozilla Thunderbird, I asked for a Mozilla Firefox/Thunderbird, Netscape Communicator/Messenger certificate. It complained because I was using the Opera web browser! So I tried getting the certificate with Firefox, but Firefox would not accept it. (I got the impression that Firefox would only accept PKCS 12 files, and apparently this was a PKCS 7 certificate?) I went to the support page, and found instructions on how to export a certificate from IE to Thunderbird. So I booted Vista and requested a certificate for IE (remember, these certificates work for Internet browsing too, although I have no idea why one would need one). It would not work on IE7 in Vista. (VBScript error.) So I went downstairs to an XP computer and requested a certificate for IE on it. Still using IE7, but on XP, it worked. I then exported the certificate from IE with the "export private key" option, and imported it into Thunderbird. But when I tried to send a signed message, I got an error! So I exported the certificate from IE again, with both the "private key" and "Include all certificates in certification path if possible" options, and imported into Thunderbird again. At long last, voilà! It worked! About time! Creating a GPG key pair and configuring Enigmail took about an hour of my morning. Getting a S/MIME certificate and importing it into Thunderbird took the whole afternoon!
The advantage of S/MIME, of course, is that I can sign all my messages, and other people will see it and think "Hey! That's like, secured or something," instead of "What's with the weird attachment?" They don't have to install extra plugins. (And there may be no good GPG plugins for Outlook. The Gpg4win project is doing it's best to make GPG easy on Windows, but they say Outlook doesn't allow the kind of functionality needed for PGP/MIME encryption or automatic decryption.)
So what can I say? I like GPG better. It's open-source, easy to set up, and is more than secure enough to verify that this email came from the real owner of this email address. S/MIME is less transparent, is designed to benefit corporations like Thawte and VeriSign, and the setup process - which could have been made very easy! - is a terrible user experience, at least with Thawte. (However, Thawte may be the only company that issues free email certificates that don't expire.) With GPG, I know that the only copy of my private key in the world is on my computer: you would have to hack into my computer to steal it. Thawte, on the other hand, generated the keypair for me, and they have a copy of my private key that I can redownload at any time. I'm trusting the employees of Thawte not to steal my key, AND I'm trusting that their servers can withstand attacks from hackers. Thawte harvested a lot of personal information in the registration process, which makes the possibility of identity theft even worse. However, I can't revoke the certificate. So which will I use: GPG or S/MIME? S/MIME, because it works with the leading email clients without my friends having to install extra software. However, I will keep my GPG signature and Enigmail around, because it might come in handy someday.
Aug 21, 2007
GNU/Linux
Someone else's blog post on why he uses the name Linux instead of GNU/Linux inspired me to write my own opinion of the matter. I too, choose to say "Linux", although if I was actually talking to someone who was interested, I'd probably say I use "Kubuntu Linux", because that is more accurate.
Here's what I think:
Arguing about the name is stupid. You might as well argue that America should be renamed America/Columbus. All Amerigo Vespucci did was recognized the land as a new continent; he couldn't have done that without the help of Columbus, who discovered the land. (True history buffs would insist it should be called America/Ericson, because Leif Ericson discovered America long before Christopher Columbus did.)
Only a small few think "Linux" refers only to a kernel. To the rest of us, "Linux" is the catch-all posterchild word for "open source operating system and software."
Arguing over the name is looking backwards instead of forwards. It is fighting over recognition instead of cooperating towards real recognition... by the world.
Here's what I think:
Arguing about the name is stupid. You might as well argue that America should be renamed America/Columbus. All Amerigo Vespucci did was recognized the land as a new continent; he couldn't have done that without the help of Columbus, who discovered the land. (True history buffs would insist it should be called America/Ericson, because Leif Ericson discovered America long before Christopher Columbus did.)
Only a small few think "Linux" refers only to a kernel. To the rest of us, "Linux" is the catch-all posterchild word for "open source operating system and software."
Arguing over the name is looking backwards instead of forwards. It is fighting over recognition instead of cooperating towards real recognition... by the world.
Subscribe to:
Posts (Atom)
![[ONE.ORG: The Campaign to Make Poverty History]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vk_KX3t0so4WnDHow4o5JA2AuR7h5J7GKOVy4b3ZjdWI2BPdlVkOOoGuBvaRmUKG3JT-rk2KYTVmBohO2QcR5XUc7oSZVK1d1jOoJ6lKuRlXTeNyjcyZpryo9VnELIM3bhJmyi=s0-d "ONE.ORG: The Campaign to Make Poverty History")
![[Foundation For A Better Life]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sgSi_bziO-nUZK7VxrHjYVz7k7X19cNB-X9b5SmJ-0mUDrV42EbO7F3RM3HV5yJD9sUputw9qOpy0pCEC26-zUmjwGKqQePTcEHuHTci6mPHDNEA=s0-d "Foundation For A Better Life")
![[Try Kubuntu Linux!]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uOTk1ogKEfawcCgECRQgkwMV6pHGAg0zVUGs-XuJjB3v_odPKSvP8P49xcP14K5hBQrxtiDRj29Pet4FhCnBZCt0zpYEAVhEM8=s0-d "Try Kubuntu Linux!")