Showing posts with label Security. Show all posts
Showing posts with label Security. Show all posts

Sunday, February 9, 2025

What Now?

 I find myself in a quandry. 




I have two series of posts which are on a collision course.
There were three, somewhat rant-y posts regarding the current state of affairs, particularly in relation to big government and big corporate overreach, culminating with a question regarding the viability of "Kalostopia"

And there were a series of posts chronicling my attempt to disengage from at least some of these forces (beginning with Microsoft), with hopes of constructing a strategy which could be used by anyone (including those who are not technically minded) to do the same.

My rather grand (wishful thinking perhaps) vision was to perhaps help build some tools that could be used by those with the means, talents and will, to create a modern day, praetorian revolt of sorts, on a global scale, or perhaps, even better, a Kalostopia.

My objectives could, I suppose be defined as:

1. Reduce, and if possible, eliminate my dependence on the large corporate and governmental entities whose behavior erodes the pillars I concluded were necessary for such a civilization to succeed.
2. Reduce and where possible, eliminate the flow of my resources/revenue to aforementioned corporate and governmental organizations. I am not invoking or implying any sort of cancel culture with this. I made no call for others to boycott anyone. I am simply tired of my efforts and energy participating in the culture of fear and control. No I don't necessarily think there is any overt attempt to control simply for the sake of power (though that can't be ruled out altogether). Most of it, I believe comes from a much more natural, biological, fear-driven impulse.
3. Reduce any and (if possible) all contributions (direct or indirect) I am making to any individuals or organizations who foster, capitalize on, or profit from fear culture.



But it seems my effort may have been in vain. It appears the world of Linux has been overrun by madness as well.

It appears that Debian - my First choice of distribution - has been engaging in discrimination, giving preferential treatment to some groups, while de-prioritizing or eliminating others, based on race, gender, and sexual preference. Furthermore they recently posted a public announcement regarding their intention to discontinue use of x as a communications platform.

Now, I don't use x, nor do I care if Debian uses it. The problem I have is the public announcement of their intent boycott x, based on a purely political motivation, to silence and/or isolate a particular set of social and political opinions, rather then seek compromise or understanding.

Not Long ago, NixOS lost a large number of key contributors in a "nazi Purge". In this instance it seems that "nazi" was defined as anyone who was not far-left-leaning. Being middle of road, or slightly left-leaning qualified you as a "nazi". They were banned en-masse, so I am not inclined to pivot to NixOS, in spite of the promising technical ideas they are fostering.

There is some rumbling of similar activity occurring in Arch as well. though it is not clear in this instance if it was official Arch activity, or activity of a group running an unofficial communications channel. Bans were implemented, and death-threats were made. But as I noted, I am thus far unable to determine if Arch moderators were involved, or if it was moderators of an unofficial discord channel, with no relation to the actual Arch team.

So, of the three options I was considering, only one might not be engaging in authoritarian activities.

I did come across a new option to consider (OpenMandriva), who recently declared themselves the "unwoke distribution", but it is unclear if that means they are not engaging in extremist politics, or if they are extreme in the opposite  to the others, which  is no better.

I am really not sure what to do now. I still have the desire to do whatever is in my power to facilitate a kinder, more honest, and enabling society. But, is it even possible at this point? Each path seems as treacherous and  obscured by uncertainty as the next.


Thursday, September 26, 2024

Infotopia - A Rant

 Warning, incoming rant...


Picture this, if you will - 

 

It is 100 years after a massive, global, data-gathering and analysis system, linked to a network of sensors, cameras and geo-location systems begin tracking everything.

In the background, with  no effort on your part, they record your blood samples, urine samples,hair samples, skin cell samples, what you eat, drink, where you go, what activities you participate in, everything.

Now consider the following short story of a woman we will call Jenna:

Jenna awakens slowly, pleasantly, to the soothing sounds of ocean waves, played through the speakers in her bedroom. The room grows brighter as the LED wall simulates a beautiful sunrise. She yawns and stretches, smiling as she is bathed in the sensory simulation.

Hopping out of bed, she begins the day with her usual routine; water, toothbrush, toilet, and a light workout and invigorating cool shower.

"Good morning Jenna," the voice of her AI personal assistant greets her as she stands in front of the LED wall, now serving as a mirror as she applies the finishing touches to her outfit and makeup.

"I have observed an anomaly in your urine sample this morning. Nothing serious, but I would recommend a blood sample, if you have time."

"Okay," Jenna returns to the bathroom and places her finger against a small receptacle which has extended from the wall, a slight poke and a drop of blood is extracted.

She returns to the LED wall and reviews her schedule for the day,  instructing her assistant to reschedule her hair appointment to the day following, to make additional time for a lunch date with a dear friend who is in town for the day.

"I have completed analysis of the blood sample," the assistant reports as Jenna sits down to eat breakfast. "There appears to be a higher than normal level of adenosine, and a reduced level of bromine. Specifically in this region of the country, this combination has shown a high correlation to adrenal-cortical carcinoma in people of your age and genetic profile, at a probability of 65%."

"I have found three strategies which show a high probability of reducing this risk to less than 2%. Would you like to review them?"

"Yes, please." It always seemed a bit silly to Jenna that the assistant asked that question. Who wouldn't want to? She glanced to the small display next to the dining table, as it populated with information"
 

-
1. Reduce intake of Meats (to lower adenosine intake)
2. Increase grains (to increase bromelain intake)
3. Add a bromelain supplement for 30 days.

Recommendation to follow one ore more of the above alternatives for thirty days and re-assess.

-


"Please adjust my meal plan to accommodate recommendations one and two, and add 'get bromelain' to my todo list." Might was well try them all.

Jenna finishes breakfast, reviews and approves the newly recommended menu and sends off the grocery order, then heads out the door to her first appointment of the day.

-----



How cool would that be?!!

Can you imagine how many problems might be preventable with information that deep and broad? Analyzed and correlated for the many thousands of variables contained therein - far more than any human or group of humans could digest. Can you imagine the potential leap in quality of life?


But, we can't have that.

Why? you ask.

<begin rant>

Because anytime anybody starts collecting data, somebody finds a way to abuse it.

Creeps use gps data from fitness-gadgets and smart-watches and phones to stalk people.

Marketing agencies use all kinds of data to discover your interests, obsessions, guilty pleasures, and the most effective ways to manipulate you into buy garbage you don't really need.

Governments use any and all data to identify potential threats -  which could range anywhere from legitimate terrorist to 'political enemy', depending on who is in charge at the time. In some countries now, you can face prison time if you say the wrong things on social media. What constitutes 'wrong things'? Depends entirely on who is interpreting the law at any time.

Sleazy, money-grubbing scammers will use that data to find ways to steal your retirement funds, and your personal savings.

Political idealists/activists will use that data to dox, swat, or otherwise terrorize those they see as enemies to their cause. They will manipulate and misrepresent that data to justify unwarranted and abusive actions on the part of governments to enforce their 'utopian' vision, a the expense of those who don't share their particular views.

We can't have that because a small handful of the population value personal wealth, personal fears, personal power, or a personal vision of the future more than they value their 'neighbor'.

And so, all the decent folk (who I still believe make up the majority), wind up going into "hiding" (The dark forest), to protect ourselves from the minority of predators.

So a hearty "Thank-you" to all the Kochs,Soros,Gates,Musks, and many other well-known, lesser-known, and unknown, political and corporate 'luminaries', groups of deranged lunatics, and individual, self-serving scum-buckets (and by 'thank-you' I mean 'no-thank-you').

You're the reason we can't have nice things.

<end rant>

 


A few headlines supporting above rant:

[Microsoft is scanning the inside of password-protected zip files for malware | Ars Technica]

[Former cop abused unrevoked system access to extort women (malwarebytes.com)]

[Saudi arabia woman jailed for 11 years for online expression supporting womens-rights]

[Death penalty for hate speech?]

[German woman given harsher sentence than-rapist for defamation]


[UK warns of stalking risks from connected devices]



Some discussions on the "dark forest" concept (focused specifically on the exponential growth of this phenomenon due to  generative AI):

https://www.youtube.com/watch?v=VXkDaDDJjoA&t=21s

https://www.youtube.com/watch?v=JrcbH0ge2WE

Wednesday, September 18, 2024

Leaving Microsoft: Taking the Plunge

 Well, I did it.



I started out with the best of intentions to thoroughly and carefully plan, test and then install. To be fair I did do SOME planning and testing. Just not thorough.

A few weeks back, I took a Saturday, copied all my documents, pictures etc... to an external hard drive. Then I rebooted, and installed Debian version 12.

The first week was a bit problematic. The computer would occasionally freeze. I didn't get to the root cause, but I did resolve the problem.

When I installed, I did not use the default, Gnome windows environment. Instead I switched to KDE Plasma. I am more comfortable with it, as it is more similar to Microsoft Windows in look and feel. It is also more configurable, allowing me to more easily tailor it to my specific needs.

The freezing problem appeared to be related - not to KDE specifically, but to a subsystem used to translate between KDE and the video drivers.

Switching to Gnome removed that subsystem, and the problem went away. There is probably a way to fix it, but again, I'm trying to avoid digging in the guts too much.

So really. Where I have ended up is essentially the default install, which would be fairly trivial for anybody to do. I've made a few minor changes after the fact, but nothing that would be difficult for anyone to do, given instructions. I might try putting together some how-to videos to post on YouTube.

Gnome is taking a little getting used to. I have had to change the way I do a few things. I would say it is neither better nor worse, just different.

All of my critical applications (or their replacements) are working just fine, and I have even managed to move a few of them to more updated versions than what is part of the Debian 12 ecosystem by using an application ecosystem called flathub. It has worked out nicely.

So, all in all, happy with my decision to pivot and revert to Debian. What they lack in "up-to-date-ness" of applications, they make up for in ease and stability.

I did have one totally geek-out moment yesterday. A small detail I suppose, but totally made my day.

I was watching a youtube video when my cell phone rang. I was closer to my phone than the computer, so I grabbed it and answer the call, while racing to pause the video.

But I didn't haven't to. The Linux phone integration automatically paused the video for me the moment I answered the call! It was the coolest thing ever! It was technology as technology should be! Technology working for me, making my life more convenient and enabling me to be more productive and effective.

That moment alone made the switch worthwhile.

So I am now operating Microsoft free, with respect to operating system on computers.

I still need to move to a new email provider. That will be a painful process, as I need to:
1. Find a privacy respecting email provider
2. Set up the new email address
3. Change the email address on all services I use

I might not be fully Microsoft-free until next year, but I am happy with my progress thus far.

Tuesday, July 30, 2024

Leaving Microsoft: A quick dip in the deep end

 I had a chance to do my first trial run "without the training wheels" (in a manner of speaking). I had a two-week trip to the UK, and I took the Linux laptop, instead of my Windows laptop. (I was going to post something before I left, but for reasons I may rant about later, I didn't).

It went well, no hiccups during the trip.

But then, another glitch when I ran updates after returning home.


Most Linux systems use one or more repositories - which are essentially the same as the Apple Store, or Google Play, or Microsoft Store - as the primary means to obtain, install and update applications.


Arch has primarily two repositories. They have a reasonably large set of applications in their main  repository, managed by a command called "pacman".  To update any and all software you have installed form this repository, you simply run the command "pacman -Syu". It then takes care of everything. It does a pretty good job too.


For everything else they have a repository known as AUR. AUR is a user generated repository. The stuff in there isn't quite so simple to maintain. For each individual application, you have to check for an update, pull the update, run a command to rebuild a new install package, then apply the new package. Of course, someone built an application (called "YAY") which attempts to handle AUR packages with the same ease as pacman does for the main packages. I decided to give it a go to simplify managing the half-dozen AUR-based applications I installed. 

But, it (YAY) has its own list of dependencies, and it installs a bunch of other stuff in the background.

One of these appears to be broken, preventing YAY from updating the system. It looks to be something similar to the prior issue - a library listed as a dependency, which is a different version than the one installed.


Now, I don't doubt I could spend some time in their forums and sort it out. However, as I noted in my first post. I don't want to have to spend a bunch of time under the hood of the operating system. And this is twice in as many months.


The best way to clean it up will be to do a fresh install and stay away from YAY. I might still be able to simplify management of the AUR packages using either a script, or better still, something like ansible.


That is going to take time to sort out, however, and I don't want to drag out my migration of my main system.

So, I believe I will press forward using Debian on my main system for now. I will continue to experiment with Arch on the test laptop. But for the present, Debian's build philosophy focusing on stability and security will be the safe route forward.


I may take the plunge before this weekend, we'll see.


I did prepare for that possibility this evening. I copied all of the data from my main computer to external hard drives, in preparing to erase windows.


 Most of my data, I keep on a separate drive (D:), which I copied that whole drive.

The C: drive is the operating system, most of which is pointless to copy. I did copy the following folders from my user folder (C:\users\<whatever your login name is usually, or some derivative thereof>):

Documents - Any files I don't have in one drive.

Desktop - I usually keep this pretty bare, just a couple files on here.

Downloads - Probably not much I really need to keep in here, but... just to be safe.

Favorites - A few useful bookmarks.

Music - I didn't actually grab this one as it is empty. I keep my music files on a network share. I am mentioning it, in case others use this as a reference.

Pictures - Not much in here either as most are in One drive.

Videos - Same story as Music.


Oh, and one more (which is hidden):

AppData - Mostly this is garbage, but there are a few applications which store data in here, which I will want to recover. The one I can think of right off is Thunderbird. My Archived email, and contacts are in AppData. There may be others, so I grabbed the whole thing (some files failed to copy, as Windows has them locked, but they were all executables or libraries, nothing I need bad enough to go to the trouble to circumvent windows and copy.)


I believe that is everything of importance.

I will need to take care to copy anything I change between now and when I pull the trigger on the Debian install, so the sooner I get to it now, the better.



Wednesday, June 5, 2024

Leaving Microsoft: Applications

 


This is the continuation of my posts journaling my effort to disconnect from Microsoft. The initial posts focused on the operating system itself, but the operating system is really just the skeleton. It is the framing in the house, so to speak. If it is doing its job properly, you should largely forget it is there. It is the applications that actually matter.

I have been taking inventory of the applications I currently rely on or am tinkering with. I have created a quick list below (Alphabetical). Below that, list each application is presented with some additional detail, including:

  • What the application is used for
  • Is there a version which runs on Linux
  • What reasonable alternative applications have I found
  • Any notes regarding the status of testing, findings, etc...


This would probably be better residing in a wiki or something similar, as it will go through a few changes as I progress, but... here it is for what it is worth. Let me know  if you think I am missing something.


7-Zip

Audacity

Calibre

Draw.IO

Edge

GIMP

Git

Gnu Cash

GnuPG

Handbrake

KDEnlive

KeePassXC

Kleopatra

Minecraft

MP3Diags

MP3Tag

MS Office (Word, Excel, Powerpoint)

MS OneDrive

MS OneNote

MS Outlook

Notepad++

OBS Studio

Outlook.com

Phone Link

Putty

Steam

Visual Studio

Vmware Workstation

WinSCP

Yubico - Yubikey Key Manager

Zoom





7-Zip

What? File/Folder compression/decompression

Linux Version? Yes

Alternative? NA

Notes:


Audacity

What? Audio Editing 

Linux Version? Yes

Alternative? NA

Notes:


Calibre

What?  eBook Management

Linux Version? Yes

Alternative? NA

Notes: I have just started playing with this, to see if It can be useful in my authoring endeavors.



Edge

What?  Web Browser

Linux Version? NA (Microsoft)

Alternative? Chrome (Google), Firefox, Falkon, Brave

Notes: Google is on my list of companies to detangle from in the future. I stopped using Firefox after they forced out one of the directors for his personal donation to a political cause (which, shouldn't have even been public knowledge). I am reluctant to go back, as I have no indication their culture has changed. Playing  with Falkon at present, as it was bundled with Arch/KDE. It is built on Chrome source, but with Google stripped out. So far so good. Brave is popular with priacy experts, but I haven't tried it out yet.


GIMP

What?  Graphics editing

Linux Version? Yes

Alternative? NA

Notes:


Git

What?  Version Control (software, documents, etc...)

Linux Version? Yes

Alternative? NA

Notes:


Gnu Cash

What?  Person(/Business) Finance (Like Quicken or Quickbooks)

Linux Version? Yes

Alternative?  NA

Notes:


GnuPG

What?  Cryptography Platform (encryption and digital signatures)

Linux Version? Yes

Alternative? NA

Notes: I've only just started playing with this., for privacy and authenticity puproses.


Handbrake

What?  Video Conversion tool

Linux Version? Yes

Alternative? NA

Notes: I used this to make backups of my DVD's (No, I don't pirate them. I am strictly in compliance with copyright fair-use). I have also used it a few times to convert old video files to more modern (supported) formats.


KDEnlive

What?  Video Editing

Linux Version? Yes

Alternative? NA

Notes: Another one I have just recentlty started tinkering with, so I don't know much about it yet.


KeePassXC

What?  Password Management

Linux Version? Yes

Alternative? BitWarden

Notes: I am happy with KeePassCX, but have been keeping an eye on BitWarden as an alternative option.


Kleopatra

What?  Digital Certificate Management (Front end for GnuPG)

Linux Version? Yes

Alternative? NA

Notes:


Minecraft

What?  Entertainment

Linux Version? Yes (But Microsoft Owned)

Alternative? 

Notes: I like this game as a diversion, and have even been recording my game sessions, which I have just started posting to YouTube as an educational experience. I am aware of a few alternatives people are building, but nothing which looks like a viable alternative for me at present. I am willing to give it up. 


MP3Diags

What?  MP3 Repair tool (Fixes audio and metadata issues in  mp3 audio files.)

Linux Version? ???

Alternative? 

Notes: There used to be a Linux version, but it appears it is no longer supported except on windows. I still need to find an alternative. I can move forward without it, however, as need is very low, and I could probably accomplish the same things in Audacity, albeit with a learning curve.


MP3Tag

What?  MP3 metadata editor 

Linux Version? No

Alternative? Tagger, EasyTag, Kid3, Amarok

Notes: Haven't evaluated these yet. I use this to fix MP3 metadata (i.e. add Genre, which is often missing from purchased MP3 files.) Need is low.


MS Office (Word, Excel, Powerpoint)

What?  Staple Office applications

Linux Version? NA (Microsoft)

Alternative? Libre Office

Notes: I have already converted to Libre office. Interestingly, It did a better job of converting my old office files than MS Office could.


MS OneDrive

What?  Cloud Storage, file syncing, DR

Linux Version? NA (Microsoft)

Alternative? DropBox, Sync, ProtonDrive, SynchThing, NextCloud

Notes: There are tons of options for this out there. Trick is finding the right mix of convenience and privacy. Currently playing with syncthing, which is self-hosted. Probably more work than most want to do. ProtonDrive seems to be very strong on privacy, with end-to-end encryption. I still need to work on this one.


MS OneNote

What?  "Second Brain" Note-taking and management platform

Linux Version? NA (Microsoft)

Alternative? Obsidian, Notion, Logseq

Notes: I have been using Obsidian for the past year and a half, after OneNote corrupted a bunch of my data. OneNote appears to store files in a proprietary, binary format, which puts the data at risk. Obsidian, on the other hand, uses plain text files with Markdown. It is incredibly powerful - much more so then OneNote as a personal knowledge management tool. You can build in capabilities to allow project and task management, calendaring, habit tracking, data library management, and so much more. They also provide built-in syncing of data, for a subscription. They are closed source, so it is difficult to gauge how they are with respect to privacy. They seem to be good. Logseq looks interesting as well, so I may explore it, but at present, Obsidian is the clear winner for me.


MS Outlook

What?  Email client

Linux Version? NA (Microsoft)

Alternative? Thunderbird

Notes: I don't entirely love Thunderbird. It is a bit slow and clunky, and it is owned by Mozilla (Firefox). I've not yet found any other viable alternative, however.


MS Visio

What?  Diagraming software (flowcharts, network diagrams, etc...)

Linux Version? NA (Micorosoft product)

Alternative? Draw.io

Notes: Still new to this one. Need to play with it more to come to a conclusion, but thus far it seems okay.


Notepad++

What?  Text file editor.

Linux Version? Yes

Alternative? NA

Notes:


OBS Studio

What?  Video recording.

Linux Version? Yes

Alternative? NA

Notes:


Outlook.com

What?  email hosting.

Linux Version? NA (Microsoft)

Alternative? Protonmail

Notes: My primary email address is an outlook.com email. This will be a pain in the backside to detangle. I may opt to break it out: one for family/friends, hosted at proton (better privacy, though less convenient), and one for bills, etc. hosted... somewhere else. Still not sure about this one.


Phone Link

What?  Enables interaction between my phone and my computer, such as being able to see and respond to text messages from my computer. My primary use is to copy one time passcodes sent by SMS, to the requesting website on my PC.

Linux Version? NA (Microsoft)

Alternative? KDE Connect, GSConnect

Notes: I have just started playing with KDE Connect on my test system (Broke my connection to my computer in the process. Presumably I can connect to only one system at a time.). So far so good. Not quite a polished or convenient, but sufficient for my needs.


Putty

What?  Terminal software. Used for connecting to (via SSH, or Telnet) the management interface of devices (network switches, wireless access points, Linux servers, etc...)

Linux Version? Yes

Alternative? NA

Notes:


Steam

What?  Entertainment (Video Games)

Linux Version? Yes

Alternative? 

Notes: I only have a couple of games on Steam (Half Life 2, Skyrim). I haven't played them in ages. There is a Steam client for Linux, though I don't know if that means my games will "just run" (i.e. are they emulating windows, so you can play windows games?), Or if I would be given access to Linux versions of the games, assuming they exist. I may or may not take the time to investigate this. I can live without it, at any rate.


Visual Studio

What?  Software development environment.

Linux Version? NA (Microsoft)

Alternative? Eclipse, VSCodium (Visual Studio Source code, but with Microsoft removed)

Notes: I don't do much coding, so this hasn't been a priority. I have used eclipse before, and it works well enough. VSCodium should work fine too.


VMware Workstation

What?  Virtualization Platform

Linux Version? Yes (But Broadcom?)

Alternative? VirtualBox (Oracle? Not any better), (QEmu)

Notes: I have mostly used VMWare workstation to demo Linux systems. I may be able to get by using Docker once I am moved to Linux as the underlying OS. For now, I will probably continue to use VMWare, but Broadcom is making me nervous.


WinSCP

What?  File transfer utility

Linux Version? Yes 

Alternative? NA

Notes:


Yubico - Yubikey Key Manager

What?  Hardware Security (Physical key with digital certificates, to enhance secure access)

Linux Version? Yes

Alternative? 

Notes: I've just started using this for privacy/security (might do a post about it- how i use it, best practices, what safeguards I use, etc...). Basically, it is a physical key, which you can bind to password managers, such as KeePassXC, and to Financial and other critical websites. In addition to entering your username and password. the site will require the key to be present (connected to your pc via a USB port, or you can 'tap it' to your phone, just like you do with newer credit cards) in order to allow you to log on.


Zoom

What?  Video conferencing.

Linux Version? Yes

Alternative? 

Notes: I still need to test this. I really only use it to chat with family at present, so usage it fairly rare, (more so than it should be).


Thursday, April 25, 2024

Leaving Microsoft


 This is arguably out of order. I have one or two posts which should probably go before this (namely, why I am starting with Microsoft, why it isn't JUST Microsoft, and what brought me to this point), but I am feeling a bit cowardly about posting them. Perhaps later. We'll see.

But I have reached a threshold of tolerance for poor social, political, and economic behavior, from certain organizations, and the social and political structures they are building, and I have decided to do something, even if it is only removing myself, my labor, and my personal information from the equation (a drop in the ocean, admittedly).

I recognize a certain amount of inconvenience will come from this effort. But as a wise farm-boy-turned-pirate once said, "Life is pain...".

Weak humor aside, life is often difficult, and sometimes you have to "Choose your hard." Switching away from all Microsoft products will be hard, but I feel it a better choice than remaining under their thumb.

But as I noted at the start, this post isn't intended to enumerate my grievances, rather it is to work through the technicals.

There are three (four, technically) facets to this endeavor, which must each be considered.

1. Operating System - Currently running a mix of Windows 10 and Windows 11 in my home. Microsoft allegedly plans to bully people into moving off 10 (not practical for a couple of my systems which are too old to run 11). And I have mostly regretted upgrading to 11 on the systems where I did. More clicks to get the same work done, and I am no longer able to organize resources in a way which is practical for me.

This will be the focus of this post.


2. Applications - This is a big topic and may be a couple of posts. From a Microsoft perspective. I have already moved off MS Office (to LibreOffice) and OneNote (to Obsidian - I did this after OneNote unrecoverably corrupted a large number of documents roughly a year ago. Obsidian works in plain text files, with Markdown, so eliminates that likelihood as well as dependence on a single, proprietary application).


3. Data - This is heavily tied to applications - for my purposes, it is a factor to consider from the perspective of file formats (mostly Office files - Word, Excel, etc... Which Ironically, LibreOffice was able to recover legacy versions of MSOffice files, that Office could not), to make sure my data is accessible and protected.


4. Configurations - This is very heavily tied to applications. Often Configurations are splattered across various files and/or scattered throughout the Microsoft Registry. This is a significant frustration for me. Application configurations should be kept in a file, or a specific folder structure of files, and preferably in a plain text format (YAML, or similar). This way you can move to a new computer, reinstall the application, copy the configs, and voila! All are personal tweaks and preferences are 'magically' there. It is absurd to me that this isn't the default way of doing things.


I will only be focusing on the first item in this post. I may address the others in later posts, depending on interest, personal momentum etc...


So, Operating System.


There are a few key requirements for this:

Price - It needs to be affordable. As I have limited budget. but I also don't want "free". "Free" tends to come with strings. Price also includes cost of hardware, I want something that runs on my existing hardware, so I don't have to spend a fortune on new gear.

Stability and Ease-of-use - I own a car to get me from point A to point B, not to work on the engine. I respect people who do that, and am not disparaging them, but for me, the operating system is just the platform for running applications, which are used to get stuff done. I am reasonably competent, technically, and can dig into the code a bit if needed, but I don't want to spend all my time fiddling with the operating system.

Applications - I need to be able to run my applications, or an alternative application which meets my needs. For the most part, I have been preparing for this for the past couple years. Most of the applications I use are cross-platform (i.e. have versions for other operations systems), the rest, I believe I can live without.


There are really only a handful of options for operating system.




Windows - Which is what I am seeking to leave. So, obviously it's out.








Apple (MacOS) - I have ruled it out based on cost, proprietary hardware requirements, and the closed ecosystem - which I do recognize is a plus for the fiddling, however they have taken it a step too far - I don't want to spend all my time tinkering with the engine, but I also don't want a car with the hood welded shut, so to speak. Also, I have a long-standing beef with Apple, due to their founder's poor behavior, and concerns they are still supporting slavery (specifically Uighurs, and political dissidents in China).





Linux - This seems to be the winner. There are of course, thousands of Linux distributions, and this is really the meat of this post, evaluating the myriad options. Though most can be discarded as too niche.

Linux is not without flaws of course. The thousands of different distributions for example. Linux tends to be very fragmented. It is open source, which means anyone can look at - and work on - the code. This has some benefits.

1. It likely won't disappear onto a shelf somewhere. Since anyone can pick it up and start working on it.

2. There is the potential for better security, based on the principle of "many eyes". With more people looking at the code, it is less likely a security flaw (intentional or unintentional) will stay in the code for long. I emphasize potentially however, as this only is the case if skilled people are actually looking at the code. This may or may not actually be happening, which can lead to a false sense of security.

But there are flaws as well - 

1. The people working on it are often... strong personalities. This leads to fragmentation as individuals split over differences of opinion on design and structure.

2. It is difficult to effectively monetize, when anyone can pick up your work and use it for their own distribution. So projects are often the result of someone following a passion. Passion doesn't put food on the table. This means some projects just... die. Projects often lack good documentation as well, as the people working on them are interested in solving a specific problem for themselves. (In an ideal world, people would acknowledge the work of individuals and make micropayments to them, which would add up to a reasonable living. I use the example of music artists. If there was an easy way for everyone to identify the artist who produced a specific song, and then pay the artist... say... 25 cents for the song - A million people doing that, and the artist just made a quarter of a million dollars!)


Still, given the tradeoffs I believe Linux is the best option. Now, which one... 




Redhat (/Fedora) - One of the oldest and most established distributions, with a solid company behind it. However, their pricing tends to be business-centric (i.e. too expensive for home users). They have free offerings, but they have been doing some weird stuff with those of late. Redhat is now a subsidiary of IBM, and while far from the worst, they are on my list of organizations to avoid, due to bad behavior.





Debian (/Ubuntu/Mint/)... - Debian is another old-guard. They are unique in that they are a non-profit, all-volunteer organization. Debian itself is very stable, albeit lags behind other distributions. It has become the foundation for numerous other distributions, Ubuntu being perhaps the most well-known.

Ubuntu has a for-profit model, though a home user can obtain it for free. They essentially take Debian's work and put their own polish on it (which in theory makes it more user friendly. This was most notable with respect to hardware support, as Debian had a strict policy of not allowing proprietary code, which meant some fiddly technical work during installation. As of version 12, they have relaxed this somewhat, allowing proprietary firmware.). 

Ubuntu and Mint (and other derivatives) will often fast-track key applications, making their distribution slightly more 'up-to-date' as well.

My general leaning is to go to the source, rather than a derivative work. So, Debian is my preference here, even if it lags behind a bit. They are well established, they have a solid governance model, and they are committed to openness and accountability.

It is not a purchased product, but as a non-profit, they aren't using me as a product, and perhaps there will be an opportunity for me to contribute to the community in time.







Arch - A (relatively) new distribution, Arch has one unique feature in that they don't release 'versions' of the operating system. It is always "Arch".

The benefit of this is you don't have that occasional, massive and painful upgrade. (Like going from Windows XP to Windows 8, or Windows 10 to 11, etc...).

The downside- it is constantly being updated. there is a greater risk of instability, and more fiddling is likely necessary to keep things working as you like. I have been testing it for a few months now, and thus far I have had no difficulties.

Arch has a reputation for being snobbish and "elitist". I can't say if this is true, as I have had almost no interaction with other arch users (again, no problems so far). They do seem to have very good documentation, should it be necessary.





NixOS - an even newer distribution. I know very little about this one, and what i have read suggest it is (at present at least) too fiddly to meet my ease-of-use requirement. I mention it because it is definitely on my "to keep an eye on" list - possibly for future consideration. The reason being their immutability design principle.

As I understand it, NixOS has a single YAML config file (though I believe it can be broken out into sub-files - a single file would be cumbersome), which has all of the system configuration information.  This means you can grab the installer, feed it this file, and rebuild your system from scratch at will, with all your tweaks and preferences intact. I would consider that ideal.

But, it sounds like, at the moment, it takes quite a bit of fiddling to get this working how you want. So, I will keep it in mind, but wait for now.


It is possible I can achieve the same result with Debian or Arch, using a tool such as Ansible, which allows you to build YAML documents to define your system, and then it idempotently applies the necessary changes to the system to achieve that state.

Again, this is fiddly, and Ansible is a RedHat product, so... We'll see.



Based on this analysis, my inclination is to Use Debian for my home server needs - and probably the family computers as well, and use Arch for my main workstation, where I will need to be a bit more cutting edge.

I also have a Microsoft Surface pro, which is my portable computer, and that one may be a particular challenge. Looking at online resources, it doesn't appear there is presently a "plug-and-play" solution to move off of Windows there. (Microsoft hardware, so I suppose that is to be expected). Still not sure how I will tackle that.


That is where I am at this point. The idea is not fully baked, but I intend to make significant progress in May and June to eliminate Microsoft products and services from my life.


Why am I even posting this? Partly for accountability. Now that I have said it out loud, I am less likely to chicken out. Also partly, in case others have gone down this path, or are considering it, this provides a chance to connect and share knowledge.


Wish me luck...

Sunday, July 10, 2016

Stop Depending on Cops

Let's face it. cops are human, just like the rest of us. There are going to be good cops, and there are going to be bad cops. Good cops are going to have bad days, Good cops are going to make mistakes.

And there simply aren't enough cops to handle every problem, nor is there enough money to hire, screen, and properly train a sufficiently large police force.

So, stop depending on cops. Stop being mad when you get pulled over for speeding, after reading about a drunk driver who killed someone (BTW, did it ever occur to you, that had he not been sent to run a speed trap in an area where there were complaints of speeding problems, he might have had more time to hunt for drunk drivers?).

It is time for us to stand up and pull our weight. Here is what I recommend.

1) Obey the law. Cops who are having to deal with speeders, dogs off leash, loud music, etc... are cops not dealing with dangerous criminals.

2) Get to know the cops. I realize this isn't easy, but when an opportunity permits, go and introduce yourself. Get to know them. people who know each other tend to communicate better, treat each other better.

3) Don't waste their time. Don't call the cops because burger king won't give you fries an 9:58 am. Wait the 2-10 minutes until they start cooking fries. Don't call the cops because your neighbors dog got loose for the first or second time. Go help your neighbor round up their dog. Don't call the cops because you neighbors yard is a mess. Go help you neighbor clean up (but be nice about it).

4) Video the cops when they are dealing with a situation. This isn't about catching them doing something wrong. This is about providing unbiased documentation. Not all police forces have or can afford the new body cams. As a citizen, you can help the police by providing that unbiased documentation. And make sure it is just as readily available when the officer handles the situation well. Regardless of how the situation was handled, make the video available to the officers superior if they desire (i.e. volunteer it). If the officer did well, the superior can give positive feedback. If there were mistakes, the superior can provide positive correction. This is how you improve quality. It is why sports teams and athletes film and analyze their performance. It works.

5) If you are in a situation with an officer and he says something stupid, comply anyway (so long as doing so is not life threatening). It may be he is stressed out, or dealing with other problems which have clouded his judgement. When the event is over, notify his superior, who can then take action to correct for future incidents.

6) If you are in a situation and the officer handles it well, notify the superior officer. Positive reinforcement always works better than negative reinforcement. Make sure they get rewarded for doing well, which will encourage repetition of those behaviors.

Stop depending on cops. Start working with them.

Tuesday, February 23, 2016

Re-Thinking apple - oh yeah, one more thing...

A follow-up to my last post...

The recent news regarding apple is another thing for me to seriously consider (i.e. the government is trying to get them to break into a dead terrorists encrypted phone and they are refusing).

Once upon a time I had this dream, of a single card you could carry in your pocket, which could serve as your cash, your debit cards, all your credit cards, your insurance card, your drivers license, your passport. one card that would do it all, no more bulky wallets nor more hunting through piles of membership/rewards cards...

The smart phone is hovering near the edges of that dream. You can handle credit card pay through your phone now, some membership programs now send their special offers/rewards coupons directly to mobile phones....

Our phones are holding an increasing amount of extremely sensitive data: Financial data, health data. Friends' data...

A device with that much of my information NEEDS to be impregnable.

And the simple fact is - if the government has a back door, so does everybody else. So, I am watching this case to see whether technology will take a step forward, or backward. I am encouraged that Apple has said no, they won't decrypt it. I would feel much better if they said no, they CAN'T decrypt it.

But that being said, how this all shakes out could have a significant influence on my views on apple, in spite of my dislike for the 'cult of apple' and for the personal restrictions...

Tuesday, January 19, 2016

The Fourth Industrial Revolution: A few Musings.

I found this article today. I'd recommend taking the time to digest it...

The Fourth Industrial Revolution: what it means, how to respond



 A very well written article, which examines many facets and possibilities for the future due to advancing technology. Worth the time to read and consider.

The author doesn't go into it quite as much, but mentions 3D printing and the integration of Biology and Technology. One point I find myself considering in this area, which he comes to the edges of in this article...

What will happen to the large businesses and governments of the world? There are now 3D printers for Plastics, Metals, Fabrics and even some biologics. And some effort is being made to construct said printers in a way which allows the various printer parts to be replicated on the printers. Suddenly, not only can the digital world be copied, duplicated infinitely for virtual no cost, so can the physical world. Anyone, ANYONE, with a clever idea could have the potential to produce it.

Can't afford some new toy, some new tools, some new gadget? Design your own and print it yourself.

Much of the massive cost associated with medical devices and drugs is due to the heavy burden of government regulation. What if you are manufacturing your own device or drug for personal use?

But what then happens to big businesses? Will their revenue streams dry up? Will they be able to adapt to a new, decentralized economy? Or will they try desperately to protect themselves through government regulation?

What happens to the world of intellectual property? How will intellectual property be defined in this new world? Will Apple, for instance have to run around suing individual consumers for owning a home made rectangular device with rounded corners that is roughly the same size and shape as an i-something and runs similar programs? Would they be able to win those cases? Would they be able to be profitable?

The Music industry has been something of a precursor to this - Music is now mostly, and may one day soon become exclusively a digital medium. For the past decade or so, we have watched the music industry desperately cling to the good old days. Touting out Metallica to cry about how poor they are because everyone steals their music, Sending their army of lawyers out to sue twelve year old girls for sharing music. They even tried loading spyware on music CD's, and they continue to fiddle around with DRM, and protective legislation. They roam around issuing take-down orders to youtube in a last desperate effort to stem the flow. In a less stupid direction, they have begun to embrace cloud subscription services, making it so convenient to rent access to music, that it is frankly to inconvenient for many to "steal" it. Some artists have left the old music industry behind, acting as their own label, producer, and distributor. Cutting out all the middle men saves them a great deal. And so long as they have sufficiently rabid fans who will choose to willingly pay for their product, they can be very successful.

The final line of defense for most of these large, slow moving behemoths will likely be government regulation.They will try to turn to the Government to write better protection for intellectual property, perhaps event try to prohibit the self-production of certain items. But how can the government control and enforce this? Will the government recognize that there role is going to shrink, or will they too desperately cling to the old way, desperately try to hold on to illusory power?

There is a brave new world coming, one that will require a world of individuals to be alert, forgiving, kind, cooperative, engaged, charitable... willing to negotiate, seek compromise, and stand together. If we do, amazing things will happen. If we don't...

Wednesday, January 13, 2016

Random Thought: The Future of Artificial Intellligence - Is Skynet's Grandaddy What We Should Really Be Worried About?

I've had conversations with a number of people on this topic. What do I think of ever-improving AI, do I love it or fear it? Will it help humanity, or destroy us?

The Skynet reference in the title is specific to the Terminator universe, in which an AI becomes self-aware, then proceeds to exterminate the human race, going so far as to develop time travel in order to go back in time and eliminate its most troublesome foes before they become troublesome.

But it also tends to generically reference the idea - commonly used in Sci-Fi  - of an artificial intelligence which becomes sophisticated enough to think for itself, then determines that humans are the biggest threat to itself - or humanity, and then through various acts (or inactions) attempts to subjugate or exterminate humans. Terminator, The Matrix, I, Robot (The Movie), Eagle Eye... To name a few.

And this is a concept that worries many, including such "luminaries" as Stephen Hawking, Elon Musk, Steve Wozniak...

But here's a random thought... Is it really Skynet we have to worry about? Or is is his relatively dimwitted grandfather which will be our undoing?

Currently, AI behavior is cropping up in internet search and content delivery. It is a convenience, and a money saver, If you search for Grills, you will suddenly find ad's popping up for grills, if you show an interest in gardening, ads for garden supplies will follow you around. This benefits the suppliers of products by targeting their ad's to interested audiences, rather than spamming the whole world, which theoretically saves advertising dollars. It benefits the customers by showing them things they are actually looking for, in theory reducing the number of pointless cold calls, and potentially putting exciting new products they might actually need in front of them saving them time searching.

But what about the dark side of this?
"I think therefore I am."
"As a man soweth, so shall he reap,"
String-button-mind-magic

See. the down side to this targeted media. Is that we see more of less, and consequently less of more...

I purchased a few "Epic Score" albums from Amazon a while back. Now when I visit amazon, I am flooded with music titles from that same genre. Social media is using this AI as well. I watched a video by some guy named Mat Larson once, years ago, now his tinfoil hat is taking up a whole row in my you-tube feed.

So here's my theory, this relatively dumb AI is helpfully feeding us more of what we like, what it thinks we want to see, what we agree with...  and showing us less in the way of new information, new ideas, alternative viewpoints... making us more insular, more isolated, more narrow of view, more ... radical... until we self-destruct... leaving dim-net to starve to death long long before skynet is ever born.

So. what do you think? Is it bad form to make fun of someone for wearing tinfoil whilst donning tinfoil yourself?

Saturday, January 18, 2014

Is meetme.com a playground for pedophiles?

Since I ended up with a meetme.com account, I decided to poke around a bit, and see what it was exactly. It was a rather educational journey. I was fairly careful not to monkey with the account too much, well, other than giving the kid a new profile pic.


But that is the extent of my vandalism of the account, and I mostly did that to see if I could get one of his friends to come out of the woodwork, so I could confirm his legitimacy.

Anyway, I did learn a few interesting things about meetme.com

It is populated primarily by 14-20 year olds, 15-17 being the most prevalent ages listed. It is less focused on communication and more focused on building connections.There are three main strategies I observed the accomplish this: Q&A, Blind Date, and Secret Admirers.

Q&A is fairly obvious. Someone asks you a question - any question, and you answer it. The questions I saw ran the gambit from "What is your favorite band?", to "You are cute!"(yeah, I know), to "Can I have your number?"(Danger Will Robinson! Danger!), to "........."(censored due to X-rated content).


Blind Date is a fun little game, which selects 4 random profiles, and asks you multiple choice) questions previously answered by them. Three questions for each "profile", if you get two right, you are considered a match, and and make a connection. If you get it wrong, you don't. Except, you can cheat. meetme.com has its own virtual currency, which you earn for correct answers, and which you can then spend in the blind date game to get extra guesses, or to peek at the answers. Oh, you can also by meetme.com currency with paypal....


Secret admirers is a simpler game, it starts by looking a profile pic's and "admiring" them. The admiree is notified that they have a secret admirer, and is then presented with a group of... I think it was 16 photos. They have five guesses to pick the one who admired them. If they get it right, they get to make a connection. If they get it wrong, they can spend meetme.com currency to get more guesses.

So a smart person with cash to blow through, can pretty much own the place...

Something to think about.


Thursday, January 16, 2014

Hacking Teen Sneaks and Questioning Google's Wisdom.

A few weeks ago, I started noticing weird messages in my inbox. First, there was a series of messages in french, which appeared to be coming from facebook. I don't speak french, and didn't feel motivated to do anything about it at the time. I just assumed it was a phishing scam. and ignored it. Then a few days ago, I started getting emails from meetme.com about admirers, and chat responses, and acceptances of friend requests... Somethings up.

So I pop into gmail on my computer. up in the header of the message is a spot that says "to me" with a little down arrow next to it.



Clicking on the arrow brings up some additional detail.

Interesting, the name is not mine (I have redacted it, because I don't know the individual or his/her motives, so for now I will try to respect their privacy).


The email is almost identical to mine. with one small difference. Mine has a '.' in it (instead of emailaddress@blah.com, mine is email.address@blah.com. (okay it isn't "blah.com" it's "gmail.com". I wonder how many other providers have the same issue though...

I found the following support doc from google here:
The interesting bit is under the heading
"Your address is similar but has more or fewer dots(.) or different capitalization."
Below are a few relevant snippets...
---------------------------------------------
Sometimes you may receive a message sent to an address that looks like yours but has a different number or arrangement of periods. ...  don't worry: both of these addresses are yours.
Gmail doesn't recognize dots as characters within usernames. ... In short:
  • homerjsimpson@gmail.com = hom.er.j.sim.ps.on@gmail.com
  • homerjsimpson@gmail.com = HOMERJSIMPSON@gmail.com
  • homerjsimpson@gmail.com = Homer.J.Simpson@gmail.com
All these addresses belong to the same person.
----------------------------------------------------------------

okay, first blush this sounds like a convenience, people can mispell your email address, and you will still get the email. How sweet of them.

In this case, a teenager (or two or...) is(/are) using this as a tool to create accounts on social sites, without tying a legitimate email address to it. For what purpose? To increase anonymity for nefarious purposes? To keep it hidden from  their parents?

It appears to the service be a legitimate email address, and if it had been a stale account (i.e. if I were not checking it  once in a while), or If I had just continued to ignore those messages as spam, it mostly would have worked. (The facebook account would probably have died, I think after awhile facebook prevent you from seeing your page unless you respond to an acknowledgement email.Though I can think of at least one way to get around that as well).

At any rate, Google really should have stopped to consider the potential abuse inherent in their email address helper. I wonder how many such fraudulent accounts are out there? And what all are they being used for? Some poor schmoe who hasn't used his email account for a few years could suddenly find himself getting busted for child-porn trafficking or terrorist activities (he might not be checking his email, but the NSA is). I'm thinking Google should probably reconsider this feature.

So now, what am I to do about this? Technically it is identity theft, they are using my email identity for their social activities. But since their is no money involved. I don't see any enforcement agency getting involved. I pursued a scam letter which specifically was a financial fraud not too long ago; I contacted the FBI, the Postal Service (it was a snail mail scam), the police, and the two banks which were listed. Nobody would give me the time of day.

Well, since I have the email account associated with them, I went to the sites, and activated their forgot password service, which sent me an email allowing me to reset the password. They are out, I am in. I poked around a bit, trying to identify "friends" who might be "In Real Life" (IRL) friends, and messaged them, to see if they are in fact friends. My goal with that is to determine if the person does in fact exist, and is in fact who they say they are. There are cases of people building fake profiles for various nefarious purposes. If it is fake I will report it, if it isn't... I  may report it anyway.

But I have learned a couple interesting things from this excursion.
First, I found a phone number of a 16 year old girl. She sent it to the doofus that created this account - he asked her for it in a chat, and she responded. What if I had been a pedophile or serial killer? Just a thought but perhaps teens should be a bit more careful with their phone #'s. Just because you know someone doesn't mean they aren't a doofus.

I also discovered a selfie of a 14 year old (in her "about me" section, or 15 year old (in her profile, directly above the "about me"), posing provocatively on a bed in her bra, with a poster on her main page saying "If you laugh at this I get to have Sex with you!". I won't quote the first conversation on the page, as it might get my blog banned.

Just a suggestion... but parents... might want to become more involved in their kids lives. It might be a good idea to make sure the computer is out in the open, and it might be worthwhile to reconsider the decision to allow a young child to have a personal smartphone.


Wednesday, December 4, 2013

Passwords on Paper

In a previous post, I said I would show you a way to safely write passwords down...

You should never write passwords down, right? There are few things worse than leaving your password on a sticky note attached to your monitor , or under your keyboard.

Let me show you a way around this....

First, you need to create one good password of length of 8-10 characters, which you will commit to memory. This needs to be a good password. It should not contain a dictionary word, it should ideally have letters, numbers, and symbols. But it needs to be easy to remember. Since it is the only one you are going to have to commit to memory, that shouldn't be too difficult.

For this example, I am going to use M2bh@fn4. 
I built that from the phrase "My bologna has a first name". Using the first letters of every word gives Mbhafn. I then counted the letters in the first and last word(My=2, Name=4), and put that number after the respective letter (M2bhafn4). Finally, to get a symbol in there I replace the 'a' with '@'.

Now, as a matter of good security practice, you would write this password down on a piece of paper, seal it in an envelope, and put it in a locked file. That way it is recoverable in the event of a tragedy (memory loss, or an incapacitating illness or accident, requiring a close relative or friend to access your systems for one reason or another). But apart from that, this password DOES NOT GET WRITTEN DOWN ANYWHERE!


Okay now we get to the individual systems. For each individual account, create a 8-10 character password, which you will write down on a slip of paper. You will keep this slip of paper in your purse, wallet, or planner...  Something that you already carry with you and protect because it contains credit cards, cash, and other important items which you don't want stolen. This slip of paper will look something like this...

Chase bank - 1whD6&fk
gmail - rej8(fhkl
facebook - weh903Ldm


Again, for reason of security, you should make a copy of this, and lock in in a file. Now here is the trick. What you have written down is only half of the password. The part you have memorized is the other half. SO your password for Chase bank would actually be:

M2bh@fn41whD6&fk

and gmail would be

M2bh@fn4rej8(fhkl

Those are 16-20 character random passwords. They are unique for each account due to the part you have written down, and easy to remember due to the part you have committed to memory.

What if someone steals your slip of paper? They will only have one half of your password. They will still have to brute-force guess the other half. And since you will quickly become aware that your password slip is missing, you will be able to go home, get your backup copy,  log in and change all your passwords within a day or so, rendering the old list useless.

Pretty cool huh? There is still one point of risk to consider. What if someone were to steal your password slip, copy it, and return it without your knowing? Then they gain more time to try cracking your password. The ways to reduce that risk are as follows:

1. Take extra special care of that piece of paper. Never let it out of your site.
2. Make the memorized part longer, say... twelve to twenty characters long (the longer the password, the longer it takes to guess).
3. Continue to follow the best practice of changing your passwords frequently (every 90 to 360 days. This isn't so painful, since little to no memorization is involved).

And there you have it, your passwords: unique, complex, safely written down... managed.

Friday, November 22, 2013

Managing Passwords

In a previous post, I gave some guidelines for creating good passwords (ie relatively long and random, and unique for at least sensitive accounts, if not all accounts).

So, how do you go about creating good passwords? and how do you manage them?

Well I can share one trick for creating them, though I don't use it. On trick is to use a phrase, line from a song, or quote, as your reference, and pick letters from it. An example. Say you are a big fan of Bon Jovi, so you pick the phrase "Whoa, we're halfway there whoa, livin' on a prayer". You could select first and last letter of each word, which would give you "WawehyteWal'onapr" as a password. That is 17 characters long, with a mix of upper and lower case letters, and since it had the word livin' in it, I also have the good fortune to be able to include a symbol. I could also easily add a number to the begining or end, by counting the number of words, or maybe the number of letters int he last word (WawehyteWal'onapr6). That is long, random, and fairly easy to remember... So long as you don't have too many different passwords.

I have over three hundred passwords. each one unique. I have a fairly untrustworthy memory also. So I don't use that technique.

I use a program to store my passwords in an encrypted database, and I let it generate random passwords for each account for me.

I have used two different password managers, and I like both of them. On is Password Agent, a closed-source Application by Moon Software. It is $25 for a single user license.

The other is KeepPass Password Safe.KeePass is open-source and free (Note there is a donation link. If you find the software useful. please consider donating. It is a good program, and people have invested considerable time to make it so).

I was going to link a howto for keepass, but so far, I am not satisfied with any that I have seen.
This youtube video is pretty good other than:

  • I would recommend going to keepass.info (the original source) to download it, rather than cnet (a third party repository). 
  •   
  • For the master password, His example password shows a good quality password. It is imoprtant that this password be hard to guess. This is the password that grants access to all your passwords. Another possibility is to use a phrase, instead of a password (like "I am a really big fan of tom8to spam sandwiches."). Whatever you use here, you MUST REMEMBER IT! If you forget this password, you have lost access to all your passwords!!!
  •  
  • As a matter of protecting your data, you must make sure you have a good backup of your password file. You can also print the password database, place the printout in a sealed envelope and store it in a fireproof safe. 

  • One other point he misses- in additon to the executable installer, there is also a zip file, which allows you to place the program on a thumbdrive that you can carry around with you, and use on any computer (make sure you have a copy of your password file on the thumb drive. There are also versions for iphone, android phones...
  •  


This video is another good one, that catches a few of the things the previous one misses, though he makes a few mistakes as well. Between the two, you should get a good idea how it works.


But both of these videos fail to actually show you what to do after you enter the username and password.

The short version, if you have populated the username and password fields, and the url, the easy way to use it, is to:

  • select the entry you wish to use and press ctrl+u to autolaunch the URL in your default web browser
  • make sure the cursor is in the username field on the web page
  • press ctrl+alt+k to return to keepass
  • press ctrl+u to have keepass transmit the username and password to the page.

Hopefully that is enough to get you started. Maybe if there is interest, I will put together a more complete tutorial.


So either of those is a good option. Next time I will show you an option for safely keeping your passwords on a piece of paper in your wallet.