Alex Cabal

At Standard Ebooks we serve a respectable number of page views and ebooks each month - and have been on the front page of HN three or four times - all of it done with a single 4GB VPS. And the only reason we upgraded to 4GB from 2GB is because we needed more RAM for the server to build the extremely large Decline and Fall of the Roman Empire ebook - if it weren't for that, our 2GB server would still have been just fine for all that traffic. I wrote a blog post about how we do it here: https://alexcabal.com/posts/standard-ebooks-and-classic-web-tech

…I’ll just leave this [0] here. A perfect example which just popped up in my feed list of “simple but does this job” tech. No js, no database, a $10 a month vps. [0] https://alexcabal.com/posts/standard-ebooks-and-classic-web-tech

> I wish articles such as this one were more common: > https://alexcabal.com/posts/standard-ebooks-and-classic-web-tech > This is the web I want and love. Worth noting that according to their article, Standard EBooks does not use javascript on their page. This might work for them, and it might work for you, but in many cases users want SPAs and interactivity (Google Maps, Google Docs, etc)

What a sad state “modern” web dev is in. I’m glad that I’m living in a much faster and simpler world, but I fear, for end users and developers alike, that it is an ever shrinking one. I really can’t understand the appeal of what, to my eyes, amount to endless layers of needless complexity. I wish articles such as this one were more common: https://alexcabal.com/posts/standard-ebooks-and-classic-web-tech This is the web I want and love.

I've had good experiences with Yubikeys thus far. I still have two of the Symantec VIP tokens from years ago that I've never had issues with. I recently bought a Neo to test out NFC (NFC support on the HTC 10 seems deplorable for smart card reading btw). I also purchased a few 4c tokens and so far they've worked great although I haven't been using them for very long. The gotchas I've encountered while using them on OSX: - The pins for PIV and OpenPGP are separate as these are separate modules on the card. - You can't use the PIV or NEO GUI managers and gpg at the same time. You might have to unplug and plug the token back in when switching back and forth between GUI/cmdline Yubico tools and gpg. - Forgetting to change my environment to use gpg-agent instead of ssh-agent. - Typing in my local password instead of the PIV pin when logging into OSX while I have a token with PIV enabled plugged in. The "setup" instructions that are referenced in the packaging and on parts of the site are for basic use of OTP. Real documentation is here: https://www.yubico.com/support/knowledge-base/categories/guides/ For people asking about backing up material on OpenPGP modules: these are write only. Generate your material locally with gpg instead of generating them on the smart card itself and use the keytocard command to copy the keys to the card. You can backup your keyring prior to moving keys and restore it before copying keys to each card or ctrl c out of gpg without…

I have a 2015 Razer Blade Pro and it worked very well under Ubuntu 16.04. The touchpad, touch screen, wifi, etc. all worked well, at least on newer Linux kernels (the trackpad had issues on older kernels). I did some 3D graphics work, and the Nvidia drivers were much better than other drivers I've used on Linux. There wasn't really any "sorcery" involved from my experience; I just installed from the official iso. I followed this guy's blog for some further configuration: https://alexcabal.com/get-a-working-touchpad-on-a-14-razer-blade-runni… My main problem was that battery life was pretty abysmal under Linux. With Windows, I would get 4-5 hours under light usage, but under Ubuntu I would pretty much only get ~2-2.5 hours, even without doing much on it. Stressing the CPU/GPU made it die even faster. But that thing isn't really known for its battery life anyways. Unfortunately I don't have Ubuntu installed on it anymore because I couldn't get Windows and Ubuntu to happily coexist side-by-side. Windows (10) always gave me a boot failure when Ubuntu was installed next to it.

Yes, you can revoke the key and publish the revocation. This means that it will be flagged as revoked in the server keys and assuming that senders keep their GPG keybase up to date with server keys, they'll get a warning that this key is out of date. All e-mails already encrypted with the key can still be decrypted though. As for the second part of your post, you're probably asking about this: https://alexcabal.com/creating-the-perfect-gpg-keypair/

Encryption is also supported via a browser plugin, so it's not necessary to upload the private key to the server. Regarding your questions: 1) yes, you can revoke the key by generating a revocation certificate and publishing it on a public keyserver (of course, your correspondents would need to refresh the public key from the keyserver to know it was revoked, which is something they might not do); 2) sent and received messages from the past, unfortunately, are readable by the person who is in possession of the private key, if such key is not protected by a strong password; 3) yes, you still need the old private key to read the old messages; 4) you can generate a master key (to be kept strictly offline) and several, frequently rotating subkeys for encryption purposes. It's not a silver bullet solution (in the sense that a thief would still have access to all your subkeys, meaning he could read all your messages up to the point the keys are stolen, but it mitigates the damage somehow). See here: https://alexcabal.com/creating-the-perfect-gpg-keypair

Thank you, that was indeed a typo I wrote as I rushed to get out the door earlier. I obviously meant to write "if you're downloading the public key" (indeed, I referred to "download the public key of the signer" in two paragraphs up, so I suspect that was clear to most people reading). The hashes for each new version are what are signed, obviously (with the private key of the maintainer). My sentence about "trusted signature" could have been clearer, too. You have a public key that you trust, that you leverage to verify any new materials signed by the package/distro maintainer. So by extension, you can trust the signed hashes. I've been using PGP/GPG on a regular basis since 1998, so I'm pretty used to the workflow by now and not at all confused about key pairs and signatures (although I will admit that I sometimes got confused about the point of subkeys until I read this a few years ago: https://alexcabal.com/creating-the-perfect-gpg-keypair/)

The offline masterkey stored on an encrypted medium is the approach that makes most sense. This[1] guide is pretty decent, and somewhere on the Debian wiki is essentially the same information (but less nicely presented). The OP's complaints boil down to two IMO: 1) poor UX; 2) trust is difficult to manage. 1) Seems solvable to me again with subkeys for encryption and signing (which I believe are created by default for GPG2.0 anyway). 2) Asking technology to solve the problem which only each individual can answer ("do I trust this person to be evaluate other people's identities as carefully as me?") is not doable. The example of someone getting a journalist's pubkey and being stung by the (fixed) bug whereby the wrong key may be imported is again letting the user off the hook. If someone is not actually using GnuPG's abilities to examine the WoT and see who has signed the journalist's key etc then it's an example of magical thinking with "encryption" replacing any other nostrum. I don't believe that problem can be solved with technology. 1. https://alexcabal.com/creating-the-perfect-gpg-keypair/