
I Wear Pants
Now with Stuff and Things!
A blog by Peter Fein.
Follow @wearpants
The views expressed here do not represent my past, present or future employers, collectives, family, nation-state or houseplants. They are mine alone. Who's else would they be?
Twiggy Now Supports Python 2.6
July 12, 2011 at 06:40 PM | Tags: python, twiggy, loggingJust pushed out version 0.4.4 of Twiggy, a more Pythonic logger. This release adds support for Python 2.6. Get it from the usual place. Please let me know if you have any problems. I'll be giving an invited talk at the 2011 Scipy Conference as part of the Core Python track. Hope to see you there!
Note: for my readers more interested in activism than code, I'll be creating separate channels real soon now.
Daily Python Zen
April 13, 2011 at 11:20 AM | Tags: python, twitter, dailypyzenThis post was import from an earlier version of this blog. Original here.
The awesome, hilarious, mysterious @1990sPythonUser has got me nostalgic for the defunct Daily Python-URL, a much missed daily dose of the best/worst/weirdest of the Python world. Seeing as we're well out of the 90s, I'm gonna shoulder the burden using twitter and summarize here once a week.
Follow @dailypyzen for your daily dose of Python goodness. I'll feature tips for the new user, moments of wisdom for the old and some of my favorite tools.
Introducing Petapass
March 27, 2011 at 12:41 PM | Tags: password, python, gui, pygtk, release, security, petapassThis post was import from an earlier version of this blog. Original here.
A few weeks ago, I wrote about a scheme for better passwords. Building on that idea, I'm pleased to announce Petapass, a stateless password generator. The name is a play on my first name as well as the very large number of passwords you can create.
The traditional approach to password management is to store passwords in an encrypted file (various password managers use this approach). Petapass instead implements a stateless password management scheme - all the necessary state resides in your head. It hashes a master password and a per-login descriptive token to generate unique 10-character passwords. The token is merely something you will remember when you need to log in (such as "myblog"). Portable across OSes, nothing to steal, lose or synchronize. I like to think of it as RESTful password management.
Petapass implements a simple GUI. It provides a "daemon mode", where it will remember your master password for a configurable timeout. After entering the token, the generated password is copied to the clipboard, allowing you to easily paste it to a login form or ssh prompt. Binding the command to show the window to a global hotkey makes Petapass unobtrusive and easy to use.Full details at PYPI. Linux only for now - a windows version should be trivial, while OS X requires a Cocoa GUI.
Note: I couldn't get the window to always raise to the foreground the way I wanted - if you've got PyGTK skills and a few minutes, please ping me.
Hacking for Freedom - Pycon
March 18, 2011 at 06:30 PM | Tags: pycon2011, egypt, freedom, hacktivism, python, anonymous, telecomix, pyconNewer version of this talk
This post was import from an earlier version of this blog. Original here.
I gave this lightning talk (five minute presentation) at the Pycon programming conference last week; in it I discuss my efforts as a hacktivist working with Telecomix and Anonymous in support of free communication in Egypt and elsewhere.
I use the term hacking in its original sense: a clever technical trick, and not to mean breaking websites or stealing data, as is common in the popular media (I don't do such things, as I say in the video). In this presentation, I speak only for myself and from my own experiences. The actions described were the result of the efforts of many people (from a handful to a few thousand) - I neither claim nor care about credit.
I hosted a 2-hour Birds-of-a-Feather session Friday night and had some great conversations during the hallway track and sprints. Many folks asked how they could get involved, which is what I hoped for when I set out to give this talk. There is a tremendous amount of work to be done here, and not all of it technical. The cause of freedom calls not only programmers, but also writers, artists, hardware hackers, philosophers, punks, data anlysts and dreamers. If you can use a computer, you can help.
Join Us
Anonymous and Telecomix operate in the open; you just need to know where to look. Remeber, these groups operate as voluntary do-ocracies. No one is going to tell you what to do or give you orders. Instead, join IRC or the forums and if something strikes your fancy, help out. Once you've been around long enough to get a sense of what's appropriate, start your own project (called an "op"); find some collaborators and get doing. Yup, it's really that simple.
Telecomix
Telecomix is a loose association of Internauts who support free communication for everyone, regardless of political affiliation. Most of the work for Egypt discussed in the video was done with Telecomix. Typical projects include mirrors of censored sites, encryption and dialup modem pools. We mantain sites at:
- www.telecomix.org - landing page. Now with jellyfish!
- werebuild.eu - wiki, with info on country-specific operations, including legal threats to Internet freedom in the West
- interfax.werebuild.eu - press releases
- cryptoanarchy.org - collection of privacy and security tools & HOWTOs
- streisand.me - mirroring project
- datalove.me - I still don't understand this
You can join IRC at irc.telecomix.org or via web chat.
Anonymous
Anonymous is an even looser disorganization of chaotic-neutral basement-dwelling trolls who self-describe as an "Internet hate machine". Most widely known for the real-life Project Chanology protests against the Church of Scientology, they've done everything from track down pedophiles to post seizure-inducing images on epilepsy forums. An attempt to summarize or explain Anonymous would be even crazier than they are, so I'm not gonna try. Instead, a small and incompelete roadmap (you're still gonna get lost):
If you like to wear a Guy Fawkes mask and yell at buildings, try Why We Protest. This is the part of Anonymous that did Chanology and executed real-life protests in support of Wikileaks and freedom of information:
- Forums and upcoming events
- irc.anonnet.org - IRC (webchat)
Anonops conducts DDOS (we prefer "digital sit-in"), spams fax machines, defaces websites, writes propaganda and otherwise causes a ruckus. There's a wide variety of activities that take place, not all of them legal, and not all of them destructive. Make sure you understand what you're doing before getting involved with ops.
- irc.anonops.ru - main IRC (webchat). Try the #opnewblood channel to get oriented.
- Anonnews - press releases and news links
No discusssion of Anonymous would be complete without a mention of 4chan, the Internet's largest imageboard and the birthplace of Anonymous. Forget not safe for work, 4chan's not safe for earth.
- /b/ - random board. I warned you.
- Encyclopedia Dramatica - a wiki for Anonymous/4chan/Internet culture. If you need to figure out what "I doxed some moralfags and got 'em v&d by the feds. lulz ftw" means, try here.
A Word on Safety
The best way not to get arrested is not to do anything illegal in the first place. But some some activists have been harrassed, so you may want to take steps to protect yourself. Many people at Telecomix, and a few at Anonymous, use their real names. If you choose to participate, consider going through TOR, I2P, a public Net cafe or a reliable VPN provider. You may also opt to use a Live CD instead of your main desktop OS. Avoid giving out unnecessary personal information, including your location. I'll try to write a more comprehensive how-to in the next few days.
These comments were imported from an earlier version of this blog.
awesome and inspirational, I'm going to be interviewd tomorrow at a conference about the hacking for freedom we've been doing lately. :) So I thank you for this! :)
Sprint on Twiggy at Pycon
March 11, 2011 at 09:26 AM | Tags: python, twiggy, sprint, pycon2011, pyconThis post was import from an earlier version of this blog. Original here.
Just a heads up to anyone looking to sprint at Pycon - I'll be hacking with some others on Twiggy, a more Pythonic logger (see this introduction).This is great project for new sprinters. We'll be working on some new features:
- Thread/process context support
- New backends (mail, syslog, http)
- Stdlib logging compatability layer
- Perhaps port to Python 3
- Full bug list
Also note that project hosting for twiggy has moved from Google Code to Bitbucket: http://hg.wearpants.org/twiggy
Hope to see you!
These comments were imported from an earlier version of this blog.
Jeff Barea 2011/03/27 19:56:41 -0700
I like the concept. One thing I've noticed is by introducing third party programs it makes it less secure than would seem.
Mostly talking about the clipboard copying. A whole host of other security issues, but some of them are simply out of anyone's control really.
ncoghlan_dev 2011/03/27 20:23:36 -0700
I believe Brett Cannon did something along these lines with OpLop (only web based). I've never quite seen the point of stateless generators: yes, it provides substantially improved resistance to dictionary attacks against the sites themselves, but it doesn't help much with remembering your tokens for rarely used sites.
And if you decide to save the tokens somewhere... you're back to needing an encrypted password store. And once you're using one of those *anyway* why not just generate the passwords directly and not bother with the tokens?
None 2011/03/28 08:49:41 -0700
Peter Fein said...
@ncoghlan: yeah, it's similar to OpLop (which does have Python implementation btw). Doing this in a browser at all feels risky, and doing it on a third party webpage is *insane* - you're implicitly trusting all of the code loaded by Oplop every time you use it. While I might trust Brett, I'm relying on his & google's security.
As for remembering tokens, that doesn't seem to be a problem in practice - the tokens themselves don't need to be hard to guess - the domain name (perhaps without TLD) is fine: http://updates.oplop.mobi/2010/12/tips-and-tricks-for-using-oplop.html
@Jeff Barea: The clipboard aspect could be improved (by being eliminated entirely). It's particularly a problem when you're using a clipboard history manager, like parcellite. Perhaps I can add another command to "paste" directly to the current X11 window. See this bug: http://hg.wearpants.org/petapass/issue/7/avoid-use-of-clipboard-entirely
Eric 2011/03/28 13:21:09 -0700
I keep wishing that something like this would work for me, but the passwords I'm required to create are full of incompatible restrictions. Some sites are restricted to ten characters, others require at least twelve. Some sites prohibit special characters, others require them. I use an encrypted password store partly to avoid manipulating the result of such a stateless system to fit the need.