PGP For Mortal Developers

Why do I need it?

PGP has two main purposes — signing and encryption. When you sign a document (letter or file), you let the recipient know who is the origin and be sure the document wasn’t altered on its way.

Encryption doesn’t let anyone except the recipient to see the contents of the document.

We, programmers, can use this feature in many practical cases. Here is just a couple of them:

• Store a secret file with passwords and configuration details that’s intended for your development team only in the open (version control repository)
• Exchange sensitive messages with clients (invoices, server account passwords, confidential information)

How does it work?

Everyone has two keys — public and secret. Public keys you give away to people you want to be able to send you encrypted documents. In return, if they want you to send them encrypted documents, they give their public keys to you. This is important concept to understand — you can encrypt documents with public keys of recipients. In other words, you can send documents only to the people in your “PGP address book”.

Secret keys are kept in secret (read-only media stashed somewhere secretly comes to mind). You use them to open encrypted documents that are addressed to you by others. Under no condition do you hand it over to anyone.

Usually, to share public keys, (a) you send them directly via e-mail, (b) publish on your web site, or (c) publish them on key servers (for example, pgp.mit.edu). Think of the key server as a directory of keys. You can find people you know there if they use PGP. Some well-known key servers synchronize their records, some not.

Once you have your own key, you may want to start exchanging it for keys of the members of your team, family, friends and clients. When you get a key from the person you trust, you can sign it thus building the trusted web of keys. It starts to really work when some friend of a friend sends you his key, and you see that Gus trusts him while you trust Gus, so that’s probably OK to trust and sign. Note, that it’s not about the trust between people, as you might think, it’s the trust in that the key you’ve been given does really belong to that person (not forged).

When you have a directory of keys, you can now start signing documents (again, letters, files) and sending them over to your contacts. They will be able to open them.

How to configure?

First, you need a key if you don’t have one:

… is what you do. Answer the questions and wait while the key-pair is generated. The common choice is 1024-bit “DSA and ElGamal”, but you may choose more bits. The encryption will be slower, but you won’t notice it on modern hardware unless you are encrypting wikipedia. DSA lets you sign your documents, and ElGammal give the encryption. Usually people don’t use expiration at all if it’s not a mission critical temporary key. Don’t forget the passphrase. It’s important to protect your keys.

Manuals recommend creating a revocation key to be able to revoke your keys in case of theft or bad pass phrase memory:

Now you can see your key in the list:

To export the key in binary form and give it to someone use:

To get the same key in plain text, add the ‘–armor’ key:

(you can omit ‘-o …’ to get it all in stdout)

When someone sends you a key, you can import it with:

If you trust the key, sign it:

When you are ready to send your key, find the server (i.e. pgp.mit.edu) and submit your key either through the web interface or using the gpg command again:

How to sign?

Now that you have your key, keys of your recipients and documents to protect, here’s what you do.

To sign a document there are two ways — clear text and binary with optional compression.

When you have a plain text document that you want to sign leaving it legible, you choose clear text signing. It will add the plain text block with your signature to the bottom of your document. If anyone touches the document, the signature won’t match the content and it won’t be your authentic copy any more.

When you have a binary document or want to compress along with signing and additionally protect from change:

To verify the signature of the document that’s sent to you:

To get the original (doc.txt):

How to encrypt and decrypt?

When you need to encrypt a document, you choose the recipients first and then use their public keys from your “keychain” (gpg -k) to create the encrypted version.

NOTE: You won’t be able to open the file if you don’t include yourself into the recipients list.

To decrypt the file:

What else?

Once you are familiar with these simple tools, you may want to start exchanging protected e-mails with your co-workers, clients and friends. Many e-mail client support PGP these days.

Today, as we store our mail on the servers of giant Internet companies, it’s a norm to feel uncomfortable knowing that anyone can read your correspondence. Let’s make it a little bit harder.

That’s all folks. If you notice any inaccuracies, or have any suggestions, please let me know. I’m not an expert in this area at any stretch of imagination. This is just a quick summary for those who want to start quickly. You can find more info on official web site: http://www.gnupg.org.

PayPal Scam

As you know, we are heading back home from Australia soon and selling our stuff. We advertise it in multiple places, but mainly on Gumtree. It’s been mainly pleasant experience so far, and I’ve got a couple of good leads from this site.

What I would like to share with you is one PayPal scam that we almost fell victims of today. It all started in the morning when I got this mail from someone who supposedly wanted to buy our bedroom set. He asked for the lowest possible price and then came back with an interesting message where offered slightly more than I asked and told that he just moved to UK. He wanted to pay immediately and instruct his shipping agent to pick up the furniture. He offered to pay full price via PayPal and (politely) asked if I had more pictures since he’s unable to inspect the stuff himself.

That alone was suspicious enough, but at that moment we didn’t see how was it possible to scam us. I expressed how surprised I am to hear that he ships this furniture overseas, but told him my PayPal email address to transfer the payment to as agreed.

After this I get an email with the request to remove the ad and to provide my home address for pick up. At this point I started to feel something isn’t right…

I do a quick search and find that most online auctions and ad sites warn you about this scenario — someone offers you a great deal (that’s why they pay you more than you ask), they pay you straight away to your PayPal account, then you ship your stuff to an unverified location (or better yet, they pick it up locally and drive away in an unknown direction).

Now the fun part comes when PayPal figures that either the credit card was stollen, or they used the cheque that can’t be debited to your account and you lose your money. If you were lucky enough and withdrawn the cash from your PayPal account disconnecting your real account and CC from it, the worst that happens is that your PayPal balance goes negative and you are unable to use PayPal until you repay.

In my case, since I already sent them my PayPal email, I had to quickly disconnect it from my account. It would have been extremely unpleasant to find them sending me the payment. So I made everything possible not to receive it in the first place.

So how did I know it was the scam. I didn’t. At least not for sure, but there are some signs that made me suspicious:

1. They offered more than I asked. Looks like a lure. Have you ever seen anyone offering you more than you ask? I mean, Ever?

2. They agreed to any my conditions without any discussions. I wanted to keep furniture until the very date of departure. However…

3. They wanted to pay fast and take the ad off the site. In fact, they wanted to pay me NOW. In every letter I could see at least a couple “immediately”.

4. Is there any furniture in UK? What’s the point in purchasing it here and spend $2k on shipment? That’s stupid if nothing else. I’m not selling rarities after all.

My final response was the polite decline of the deal on the grounds that PayPal payments don’t look secure in this context and that I was advised not to accept them. Never heard from them before.

I hope this helps someone and saves from a lot of trouble. Trade safely!

Going home

We decided to head back home next month. Yeah, just like that.

It was a life-changing journey to Australia that we enjoyed greatly and that gave us so many insights and new angles that we couldn’t possibly have otherwise. Our decision is based on that living here doesn’t align with our personal plans very well. We figured that more than everything we love our families and immensely value their support network.

The other reason is that even though the life is more structured here, the financial well-being is way harder to achieve. Technically speaking, we had a serious downgrade on multiple fronts, and figured all the trouble of settling in a new world is not worth it. Don’t take me wrong, Australia is amazing. It’s that in our particular case we have some better options.

We have our tickets and depart on June 24. Now comes the time of selling our newly purchased stuff — furniture, kitchen and laundry equipment, the car. I will be posting listings shortly. Drop me a line if you are interested in seeing what’s on offer.

Wish us luck!

Rails: Creating associated objects in AR

Assuming that you have an object Account like below

and you want to create an Office record when you create an account, you could do it in the after_create filter and it would be my way of doing that also. But the funny thing is that if you name the filter create_office, you don’t need to define the method itself. It will create the Office and link it to your Account model automagically. So here’s how the final class definition looks like:

Amazing!

Design thoughts: Blank slates

Here’s an interesting article by 37Signals on blank slates. For those, who doesn’t know, blank slates are the pages you see in web applications when there’s nothing to display yet — no blog posts or projects or anything else to list on the page. This is an important concept as you don’t want the user to stare at the empty screen. These pages are used to provide guidance and give advice on how to proceed.

It was a great reminder to me, as a web developer. Moreover the speculations behind all this were also very insightful; especially the part when you have to give an impression that it’s all very simple. One thing I didn’t like about the final design though, is the unfinished look of the page — a gray background with some text, an icon and a button. I understand that simplicity is a key, but in this case it looks over-simplistic to the point when it verges on ugliness unprettiness.

In any case, it’s a very good read and highly recommended. Enjoy!

Financial Model Training

What’s Up

You might have been wondering what’s going on with that settler Aleks and his wife Kate. Well, a lot.

A week ago our friends showed us the oceanic surf beach where we spent a lovely Saturday. My boogie board and I didn’t get out of water for at least 4 hours. Later, two and a half friends joined us and we all enjoyed a lovely conversation with a mellon, grapes and fresh pine-apple (that I cut right there on the beach). Wonderful day. If you wonder, the beach was Gunnamatta (Photos, Forecast).

Last month I was busy looking for a team to join locally, but haven’t found anything suitable yet. Some offices are inconveniently far and some looking for people with different skills (mainly Java which I don’t want to touch as a little kid who ate candy before dinner; my dinner is spoiled by Ruby). So I decided to take a break and keep my independent contractor chair warm for a little longer. These days however, I focus more on contributing to OSS and working with different projects just for the benefit of all Earthlings. During the last week I contributed a patch to Cucumber, worked days a nights on adapting Cucumber Rails generators to Rails 3, added a nice feature to pass custom tags into assets URL and path to Thoughtbot’s Paperclip, created and deployed Family Hut application for photo-sharing and discussions inside the family (yes, I know about Picasa, Flickr and alike which come all with their downsides; mainly in the form of pricing pages). As you can see, it was a very fun week and my life hasn’t stopped here at all. Quite to the contrary, I’m building up steam.

Also, I was thinking of starting another blog for purely coding topics on a different engine. Current best candidate is Enki but I haven’t reviewed it thoroughly enough. My main concerns with Wordpress are that (a) I still can’t make it show the source code beautifully, (b) I get a lot of spam, (c) I’m tired of PHP and (d) tired of WYSIWYG / plain HTML editor (where’s Textile or Markdown?).

That’s all, folks. If you have any comments / questions, welcome. I’ll let you know if I deploy another blog.

Coding news

Finally, I had some quality time with my laptop and got up to speed with recent developments in the Ruby / Rails world.

Many of you know how to use and do use several Ruby versions on the same machine, but for those who doesn’t, there are a couple of nice solutions. The first one is ruby_switcher and here’s a good post on how to install and use it. It’s really nice, easy to install and simple in use. The second (that I discovered) is RVM. It does all the same, but in a more organized and generalized way. The biggest advantage over the Ruby Switcher is that you can have multiple unconnected named Gem sets in every Ruby version. Say, you have several applications that you work on and to keep it all organized and to avoid Gem version collisions, you can use a named space for each of these projects. Very nice idea.

Last week I had an interview with one local agile team (you know I’m a freelancing type, but sometimes I feel we miss all the fun confining ourselves to home offices). The interview went well, in case you wonder, yet the office is inconveniently remote, so I back-pedaled a bit. During the meeting we accidentally taught one another a couple of tricks. I shared a thing or two about RSpec, and got some insights on HAML / SASS in return. It appears, there’s a project {less} which does what SASS does, but in a slightly different, more elegant fashion. It bases on top of the regular CSS and adds some cool new features, like variables, mix-ins, nested rules and operations. If you plan to use it, the first step would be the easiest. You grab your existing CSS files and start adding new features. It has a compiler to turn your files into legit CSS, and a plug-in that takes all the load for those who use Rails.

Yesterday I played with Rails 3 pre-release, but stumbled upon block after block. Partially, that’s because I used the all new Ruby 1.9.1, and partially because many plug-ins (especially for user authentication) still don’t work in Rails 3. Finally, I couldn’t make a single test run in Rails 3 + Ruby 1.9.1 combo due to TMail incompatibility with Ruby 1.9.1. Today I’m planning to try Ruby 1.8.7 and see how well that works. Rails 3 has so many great features and enhancements that it would be a shame to give up on them so quickly.

Until next time.

Our Toyota

Yee-hah, today we had our Toyota Yaris 5-door hatchback delivered! Here are just a couple of pictures of it in front of the house. (Click on the images to see a bigger version.)

Yokohama sport tires and the spare one from Dunlop. Dealers were awesome enough to replace old tires with this new set, even though they didn’t have to.

Here’s Kate behind the wheel.

And just another view from the front.

Love it!

By the way, the dealers were kind enough to replace the scratched mirror and paint up minor imperfections — everything on their own and free of charge. On top of that they filled the tank fully upon delivery. That’s what I call a New Year present! Thanks guys!

Updates on December 27

Christmas and Boxing Day went just fine. Yesterday we moved to our new house and purchased a ton of kitchen stuff (toaster, kettle, tableware …). Today new round is coming. We still need some essential furniture — a couple of bar stools, living room sofa, TV set table and a coffee table, folding chairs and a table for our veranda — don’t get me started.

On Thursday, we found a very nice place with quality and still affordable furniture (Snooze). Not only did we ordered a bed with all linen, but also the bedsides, a tallboy and a couple of stylish bedside lamps. Unfortunately they were able to deliver it in a week because of all the holidays, but after my explaining our situation with the move the manager generously offered a new queen-size luxury aerobed as a temporary solution free of charge. Now how’s that!?

In the house, we discovered that the window blinds aren’t yet installed. It’s Sunday today, so I’ll talk to our agent tomorrow. Here they fill the Condition Report on moving in to document all scratches, stains etc. If the condition is worse when we move out, the price of patching is subtracted from the bond (that’s usually one month’s payment being held by a third party).

Finally, we’ll start looking for a car next week. Originally we wanted something old and inexpensive, but slowly leaning towards newer models 2-3 year old or even brand new. Toyota Yaris 5-door hatchback, Mitsubishi Colt, Nissan Pulsar 5-door hatchback just to name a few. We need a compact (but not squashed), economical car for short-to-average distance trips. Since there’s no one around who could help inspecting older models, we aren’t sure we want to take risks purchasing them. Still considering options though …

OK folks, this is all news I had this morning. See you all soon!