A number of weeks ago someone pointed me to darkmail which was started by the same people who ran Lavabit before it shutdown.

I thought “this sounds great!… if it works”

Sadly I do not know how it works without reading the specification. The website is pretty bare, as is the wikipedia article (at the time of this writing). But I have used, and have a general understanding of, PGP and S/MIME. Both of which have not seen really great adoption, and remain pretty niche products.

There was an interesting post on the planet Mozilla by Joshua Cranmer, who works on various parts of the Mozilla Mail module, gave his opinion on why e-mail security failed. While I have not come across many of the problems (which I probably would if more people used it) he points out, one issue he does point that I think is pretty major is the fact that you cannot do server-side searching and SPAM filtering on a pure end-to-end encryption model.

So it would be interesting to see whether and how Darkmail solves this issue. Or whether we would have to accept sacrifices in security for more usability.

It is often wise advice in the Software Development world to avoid rolling out your own thing and re-use what other people have done. While maybe I don’t always agree with that, I certainly always agree with it when it comes to security!

So I hit a problem where I needed to encrypt something based on a password. After some research, the correct way to solve this problem is using PKCS #5. It basically salts and applied a hash many hundreds (or thousands) of times to produce a derived key.

The best solution I found was py-bcrypt, but unfortunately was lacking in the documenation department. I had to check the source code but eventually found my solution in the README of their code.

import bcrypt

salt = bcrypt.gensalt()

# apply the hash function 100 times and generate a 256-bit key
key = bcrypt.kdf(password, salt, 100, 256/8)

One caveat: py-bcrypt does require you to compile the module before you can install it. So pip install py-bcrypt doesn’t cut it. But I found this to be true of every python-based cryptography library because they wrap C libraries… with the exception of python-bcrypt. Leave it to Wenzel to be that exception to the rule.

A number of weeksmonths ago I tried Ghost Blog to possibly replace my WordPress blog. That experiment was done for a number of reasons that I won’t outline here. I will say that Ghost is pretty good for a minimal blogging solution. It is much more narrow in scope than WordPress is, which is something that I was looking for at the time.

However Ghost’s minimalism had a cost as well. Some pain points were:

• No plugins. Every update required me to re-install Disqus to the proper template. This is planned AFAIK
• Constant updates (at ~2 weeks at the time of writing) but no automatic updates.

Now for a fair price you can pay Ghost to automatically update your blog. But at $10/month, it costs more than hosting and for a infrequent blogger such as myself, it doesn’t make sense. I’m lucky to hit 10 blog views a month.

Due to those pain points, I’ve decided to jump ship and try Jekyll. It’s not perfect (I miss my Markdown WYSIWTF editor). But it has some nice benefits. Fairly simple, lightweight, and I feel less guilty for avoiding the updates!

PS. I hate updates. But that’s another post.