At the end of June this year, I upgraded from a HTC Desire HD to a Samsung Galaxy S3, so I thought after a couple of months of having my new phone I should write up a (really long) post on what stood out for me.
The positive
The screen and form factor is awesome! Due to the plastic body and the thin shape, this phone is really light and slips into your pocket nicely. The massive 4.8" screen really shines when watching videos and browsing the web. I regularly watch screencasts on my phone and the 1280x720 resolution gives me plenty of detail. The colour contrast is a lot higher than my previous phone, which makes the blacks look really deep and videos stand out nicely. The marketing video that the phone comes with does demo it off quite well!
The battery is fairly good. My requirement for battery life is that I can use it all day and by the time I get home / go to bed, it hasn't died. Not a high expectation, I know, but these days its hard to expect more. This phone meets that requirement quite easily. On the days I don't use my phone much, I get home after a days work with more than 50% remaining (which is huge compared to my last phone!) and on the days I use it quite heavily, I get home to about 30%-40% which easily lasts me the rest of the night. My usage generally includes syncing gmail, facebook, twitter, weather, RSS reader, work email (during peak hours), I am generally connected to wifi most of the time and I regularly browse the web and watch videos / listen to podcasts during my commute.
The general responsiveness is miles ahead of my last phone too! Day-to-day usage is smooth and rarely experience any lag. This will be improved even more when Jellybean is released (rumoured to be soon!).
"Smart Stay" is a new innovative feature from Samsung where just before the screen is about to timeout and turn off, the phone will take a photo of you with the front-facing camera and use face (or eye) detection to work out if you're still looking at it. If you are, it will keep it on for another minute or so, if you're not, then it will dim the screen and check again soon after, which then will actually turn it off.
This is to avoid that randomly-scrolling-to-avoid-the-screen-turning-off trick that most people will do when reading a long article. Thankfully, this feature is quite effective and I haven't needed to do that for a while, although it doesn't work very well in the dark!
In the settings, there is a section called "Motion". I won't go through all of the options, as there are about 10 different ones, but some are quite handy. By far the best one IMHO is "Direct call", which lets you directly call a contact whose call log details, contact details or message details are displayed on the screen by simply putting the phone to your ear from that screen. Feels very natural.
Another nice one is "Smart alert", which will give a little vibration when you pick it up from a stationary location if you have a missed call or sms.
The camera on this phone is not too bad either. Obviously it will never replace my dSLR, but it has some nice features that even my dSLR doesn't have. The burst fire mode is really quick, but Samsung have introduced a feature called "best shot", which will analyse each of the photos you took in the burst and pick the ones it thinks turned out the best, based on focus and face detection. You can adjust what was picked, and then the others are automatically discarded (saves you having to go through the 14 bad ones and delete them later).
The camera has a built-in HDR mode which works quite well too and the photo editor provides heaps of enhancements and corrections, including red-eye reduction, color balance, cropping, etc.
Another nice feature is found in the video player, it has a "pop-out" button! This means that if you're in the middle of a video and you wanted to quickly google something, or reply to an sms, you can just pop out the video, which turns the full screen player into a small, floating, always on top window that you can drag around, do what you need to do, and then make it full screen again. Not something that I've needed to use very often, but on the rare occasion I have, it's been quite nice.
I use my calendar religiously and on my older HTC, the default app looked nice, but didn't have many features. I ended up swapping it out for Business Calendar Free just so I could get a month view with text, instead of indicators.
The stock Samsung calendar, S Planner, however is not too bad! It integrates with their S Memo, which I don't use, but comes with a good number of viewing options, my favourites being their month view and analogue week view. It also has a nice "Quick add" feature that lets you enter "Dinner at Nandos tomorrow 7:30pm" and it does what you'd expect. This doesn't support anywhere near as much as Google Calendar does, but its better than nothing!
I lashed out and bought an official Samsung Desktop Dock, and comparing this to my cheap eBay special I bought for my HTC, not only does it look quite nice, but it automatically launches the desktop clock app when I dock it and after 5 minutes it dims the screen and hides the other UI elements other than the clock. I like this feature a lot because I otherwise don't have a clock in my room, so its really handy for me!
As with all things, there are pro's and con's. Here are some of the things I don't like.
The negative
Android have decided to remove USB Mass Storage mode (my biggest pet hate with Android right now!) This leaves you with 3 alternative options for copying files to and from the device: Media Transfer Protocol (MTP), Camera mode or using an app such as Kies Air or File Expert.
MTP and Camera mode both don't give you access to all the directories on the phone, but for just transferring media it should be ok. Note that MTP will work out of the box with Windows, but if you run Mac or Linux like me, you will need to install software to get it to work (and Linux is a pain for this!).
The reason for this change is because USB Mass Storage mode will mean you have to unmount the partition from the system in order to mount it to the computer, whereas MTP will allow you to access it in both places at once, but its slower and requires software.
For phones like the Galaxy Nexus, this makes sense as there is only one partition, but with the S3, I would like to see the option of just unmounting the memory card (with is separate from the system storage) and allow that to work with USB Mass Storage mode.
Another annoying thing I have found with this phone is sometimes the home screen will randomly die. This causes lag while all the widgets reinitialise themselves. It doesn't happen often, but when it does, its annoying considering its a simple software issue. Hopefully this is fixed with Jellybean release!
On a related note, I find the random delay between pressing the unlock button and the screen actually turning on to be annoying too, considering my older HTC was basically instantaneous everytime, this phone seems to vary quite a lot. I find myself pressing the button while its still in my pocket, just so by the time I have it in front of me, the screen is ready.
A couple of other minor things include the notification LED being really bright, which is ok, but while the phone is docked my bedside, it will light up the entire room quite easily. This is kind of funny considering "smart stay" doesn't work well at night. Maybe instead of just green and red, the LED should have also included an IR LED for that.
Not only is the LED really bright, but when the battery becomes fully charged, it will turn on the screen and popup a notification, which is also not very nice when I'm trying to sleep.
I know most of you are probably thinking a solution would be to turn it off at night, but I scheduled my phone to download podcasts during these hours with BeyondPod - I think the pro's outweigh the con's in this situation.
Also minor, but there is no stock flashlight app, which I wanted to put in the lock screen shortcuts. It does come with a 2x1 widget, but to get a shortcut on the lock screen, I ended up downloading one of the million flashlight apps out there.
Speaking of widgets, the HTC widgets were really nice, but I find the widgets that came with the Samsung are not quite as useful, luckily they are in abundance on the play store too!
The other stuff
Here are some other noteworthy things which I haven't really made up my mind if I like yet or not.
The music player has a feature called "Music Square" and I love the idea of it, but I'm not sure how effective it is. Basically you index your music library and it categorises each of your songs into 2 scales: 'Exciting to Calm' and 'Passionate to Joyful'. These two scales make up the axes of the music square and by tapping where your mood is will play those types of songs. It's a great idea and I need to experiment with it more to see how effective it is.
A lot of the features in the phone are voice activated. For example, you can say 'answer' or 'reject' when it is ringing (as long as the ringtone isn't too loud); 'snooze' or 'stop' when the alarm is going off (as long as thats not too loud); 'smile', 'cheese', 'capture' or 'shoot' to take a photo (as long as your close enough for the phone to hear you); 'next', 'previous', 'pause', 'play', 'volume', etc. to control your music or the radio (as long as thats not too loud either).
As you can see, the usefulness of these features are dependant on the environment.
S Voice is Samsung's answer to Siri, and even the UI's look similar, but while its great in theory, I think the most useful thing about Siri on the iPhone or S Voice on the Galaxy would be SMS/email dictation, but that is the one thing these features don't work that well for, at least for me anyway - maybe its just my voice!
The conclusion
In the end I am very happy with my new phone, it is leaps and bounds above my old phone, its really responsive other than the random home screen lag and unlock button delay, it has some nice new innovative features and is a joy to use.
Also, with the Jellybean release (hopefully) around the corner, it can only get better.
Adding a network printer in Ubuntu 12.04
In the old days, printing was really hard in linux. It was one of the things that was a deal breaker when trying to switch from Windows for a lot of people, but when I first tried Ubuntu (probably around 2006-2007) it made all that pain go away! It was easy! A couple of clicks and you could set up a network printer and its been that easy ever since.
Recently Ubuntu have tried to make their settings screen a bit like a Mac, and to simplify everything they seem to be using a simplified user interface for the printer configuration too:
Well this new interface doesn't work for me, when I try to add a network printer, I get the error message:
Well no matter what I did, I couldn't add my printer. After some googling around, I found how to get to the old user interface... which actually works!
Just type this into a terminal:
And you will be given this old familiar screen:
Clicking the big "Add" button in this screen and following the steps worked great for me. Another alternative is to use the CUPS web interface on http://localhost:631 but that can be a little more complicated.
Recently Ubuntu have tried to make their settings screen a bit like a Mac, and to simplify everything they seem to be using a simplified user interface for the printer configuration too:
 | |
| New Setting user interface |
 |
| New Printing user interface |
Well this new interface doesn't work for me, when I try to add a network printer, I get the error message:
'FirewallD is not running. Network printer detection needs services mdns, ipp, ipp-client and samba-client enabled on firewall.'
 |
| The error that stops me from finding my network printer |
Well no matter what I did, I couldn't add my printer. After some googling around, I found how to get to the old user interface... which actually works!
Just type this into a terminal:
$> sudo system-config-printer
And you will be given this old familiar screen:
 |
| The classic printing user interface... the one that works! |
Clicking the big "Add" button in this screen and following the steps worked great for me. Another alternative is to use the CUPS web interface on http://localhost:631 but that can be a little more complicated.
Arduino Web Server with SD card reader
I've had an interest in electronics since a very young age, but I never really went further than building simple circuits as a kid and learning the theory and following diagrams through school.
There's always the odd repair job, and plenty of theoretical knowledge from family, friends and university, but I wouldn't be able to design the electronics of anything complex.
A little while back, a friend of mine got an email from meetup.com with suggested meetups. One of them was the Melbourne Hackduino meetup.
So he forwarded it on to our group of friends and a few of us went along to check it out. I've always wanted to play with a microprocessor, but never really put the time aside for it. Being a software developer there was always this barrier between the programs I write and making them do something in the real world.
Well, in the last week that barrier has been lifted! The meetup was great and hearing about other people's hobbies and projects provides plenty of motivation! We heard stories about everything from people trying to optimize solar hot water systems to building full size mechanical avatars. It was a lot of fun!
Mark Butt, the organiser of the event gave us a presentation of some of the cool things he has done in the past, such as an arduino powered bar counter top that detects what drink you put on it and a run down of some of the things he plans on doing in the future, all very cool!
One really nice bonus was the generous offering from Freetronics. There were a few people from Freetronics at the event and other than being very knowledgeable, they brought a big bunch of assorted hardware to give away! They had everything from RGB LEDs to full blown Arduino boards. I was lucky enough to score an EtherMega 2650, which from what I can tell is a beefed up Arduino with an Ethernet port (with power over Ethernet) and a MicroSD card reader. Some of my friends got a LCD shield that can display 2 rows of 16 characters and has a few buttons on board. For those that aren't up with the lingo, a shield is an attachment for a standard Arduino board to add functionality.
Together we had enough hardware to be able to make something cool! :-)
Needless to say after some great conversations about hardware hacking and being given some gear to get going, we were all pretty keen to get started hacking, so on the following Saturday three of us got together for a hack night.
The guys came around that night, we ordered pizzas and worked through the night till about 5:30 AM! We had one experienced hardware guy, Anthony, but the other two of us, Michael and I, were completely new to this, but between Anthony, the sample code that comes with the IDE and the Internet we picked it up pretty fast!
By the end of the night we had the first version of CarDuino!
CarDuino is a simple game where you hold the screen in portrait orientation and move your car from side to side to avoid obstacles. It's a very simple game, and we have plenty more features in mind for the future, but it was a great first project!
After sleeping in till about lunch time there next day, I wanted to put my EtherMega to use, so I spent the rest of the day fiddling with that. With network access, power over Ethernet and a card reader, this is a perfect platform for controlling things via a web interface. As my background is web development, this was right up my alley! Using various sample code, I put together a really basic web server that can respond to different requests and serve files from its built in memory card reader.
In just a few days, we went from no Arduino experience to a working project (or two). Especially with basic programming experience, the entry level for getting into Arduino is really low. When you buy (or build) a board and download the software, you have enough sample code with the IDE to make things happen, and you can get a lot done by simply copying and pasting!
I recommend having a play with this stuff, its really fun and more than likely, one day you will come across a problem that you will be able to solve with an Arduino!
There's always the odd repair job, and plenty of theoretical knowledge from family, friends and university, but I wouldn't be able to design the electronics of anything complex.
A little while back, a friend of mine got an email from meetup.com with suggested meetups. One of them was the Melbourne Hackduino meetup.
So he forwarded it on to our group of friends and a few of us went along to check it out. I've always wanted to play with a microprocessor, but never really put the time aside for it. Being a software developer there was always this barrier between the programs I write and making them do something in the real world.
Well, in the last week that barrier has been lifted! The meetup was great and hearing about other people's hobbies and projects provides plenty of motivation! We heard stories about everything from people trying to optimize solar hot water systems to building full size mechanical avatars. It was a lot of fun!
Mark Butt, the organiser of the event gave us a presentation of some of the cool things he has done in the past, such as an arduino powered bar counter top that detects what drink you put on it and a run down of some of the things he plans on doing in the future, all very cool!
One really nice bonus was the generous offering from Freetronics. There were a few people from Freetronics at the event and other than being very knowledgeable, they brought a big bunch of assorted hardware to give away! They had everything from RGB LEDs to full blown Arduino boards. I was lucky enough to score an EtherMega 2650, which from what I can tell is a beefed up Arduino with an Ethernet port (with power over Ethernet) and a MicroSD card reader. Some of my friends got a LCD shield that can display 2 rows of 16 characters and has a few buttons on board. For those that aren't up with the lingo, a shield is an attachment for a standard Arduino board to add functionality.
Together we had enough hardware to be able to make something cool! :-)
Needless to say after some great conversations about hardware hacking and being given some gear to get going, we were all pretty keen to get started hacking, so on the following Saturday three of us got together for a hack night.
The guys came around that night, we ordered pizzas and worked through the night till about 5:30 AM! We had one experienced hardware guy, Anthony, but the other two of us, Michael and I, were completely new to this, but between Anthony, the sample code that comes with the IDE and the Internet we picked it up pretty fast!
By the end of the night we had the first version of CarDuino!
CarDuino is a simple game where you hold the screen in portrait orientation and move your car from side to side to avoid obstacles. It's a very simple game, and we have plenty more features in mind for the future, but it was a great first project!
After sleeping in till about lunch time there next day, I wanted to put my EtherMega to use, so I spent the rest of the day fiddling with that. With network access, power over Ethernet and a card reader, this is a perfect platform for controlling things via a web interface. As my background is web development, this was right up my alley! Using various sample code, I put together a really basic web server that can respond to different requests and serve files from its built in memory card reader.
 |
| My Freetronics EtherMega 2560 serving files from the memory card on a webserver! |
In just a few days, we went from no Arduino experience to a working project (or two). Especially with basic programming experience, the entry level for getting into Arduino is really low. When you buy (or build) a board and download the software, you have enough sample code with the IDE to make things happen, and you can get a lot done by simply copying and pasting!
I recommend having a play with this stuff, its really fun and more than likely, one day you will come across a problem that you will be able to solve with an Arduino!
Google Calendar - Repeating an event on the last <weekday> of the month
I regularly attend RORO - The Ruby on Rails Oceania meetups.
They currently occur on the last Thursday of every month and so naturally I put the event in my calendar. I added the usual details and then selected the "repeat" option and set it to repeat monthly by the day of the week.
This worked well for a while, until one day when I rocked up and it wasn't on.
A later realised that in that particular month there were 5 Thursdays instead of 4 and my calendar event was actually set to repeat "Monthly on the fourth Thursday".
It turns out that the interface Google provide to set recurring events does not allow you to change this.. or at least not intuitively.
After some searching around I found a few solutions:
Use English!
The simplest way is to just write out the event in plain English. For example:
Start repeating from an appropriate month
Another fairly easy way is to find a month that actually has 5 Thursdays and make the event start from there. This will set the recurrence to repeat "Monthly on the last Thursday", instead of "Monthly on the fourth Thursday".
Hack the ICS
This solution is probably the hardest, but because the iCalendar format does support this, you could write the code manually. To do this you would have to export the calendar to a file, hack it and import it back.
While it's nice to know this, seems like more effort that just typing what you want in English!
A better solution
.. would be if Google provided an additional option in the little "repeat" popup to allow this!
Or maybe the RORO organiser should maintain there own calendar feed that we could all subscribe to. This would also mean that if a particular meetup was moved or cancelled, all the subscribers calendars would automatically be updated!
They currently occur on the last Thursday of every month and so naturally I put the event in my calendar. I added the usual details and then selected the "repeat" option and set it to repeat monthly by the day of the week.
This worked well for a while, until one day when I rocked up and it wasn't on.
A later realised that in that particular month there were 5 Thursdays instead of 4 and my calendar event was actually set to repeat "Monthly on the fourth Thursday".
It turns out that the interface Google provide to set recurring events does not allow you to change this.. or at least not intuitively.
After some searching around I found a few solutions:
Use English!
The simplest way is to just write out the event in plain English. For example:
This will create an event called "RORO at Inspire9, Richmond", with the location field set to "Inspire9, Richmond" and the repetition set to "Monthly on the last Thursday".RORO at Inspire9, Richmond on the last Thursday of every month
Start repeating from an appropriate month
Another fairly easy way is to find a month that actually has 5 Thursdays and make the event start from there. This will set the recurrence to repeat "Monthly on the last Thursday", instead of "Monthly on the fourth Thursday".
Hack the ICS
This solution is probably the hardest, but because the iCalendar format does support this, you could write the code manually. To do this you would have to export the calendar to a file, hack it and import it back.
While it's nice to know this, seems like more effort that just typing what you want in English!
A better solution
.. would be if Google provided an additional option in the little "repeat" popup to allow this!
Or maybe the RORO organiser should maintain there own calendar feed that we could all subscribe to. This would also mean that if a particular meetup was moved or cancelled, all the subscribers calendars would automatically be updated!
Password management
Password management is one of those things that can always be improved. If anyone is using a single password for all their accounts in this day and age they are most likely going to experience trouble at some stage! This post is to outline my progression through some approaches I've tried starting from a very young age to present day.
Attempt #1: A tiered approach
For me, the natural progression from a single password (back in primary school) was to go with a tiered approach. I used one password for for the basic sites, spam, etc. - the stuff I don't really care about very much. I used another password for the important stuff, like Facebook, Twitter, etc. and this password was a lot stronger than the last. I had a unique and strong password for my email, as someone with access to that would most likely have the power to reset any of my other passwords. And finally I had a completely separate password for banking.
While this system is ok, it's not the best! Once upon a time, way back before I could touch type, I came to a password prompt, so I looked down at the keyboard, typed out my password, pressed enter and looked back up at the screen. In that time a friend had sent me an IM on MSN messenger (I know, old school!) and the chat window had stolen focus, so I sent my password to him. While I (mostly) trust my friend, in a panic, I frantically raced around to as many sites as I could to change the password to something else.
If I had a different password for each site, this wouldn't have been a problem. Now obviously most people wouldn't IM their passwords to their friends, but there are lots of other ways for your passwords to get out. A few simple examples are the "Anonymous" attacks on large systems like the PSN, keyloggers, people looking over your shoulder, phishing attacks and even stupid websites making dumb mistakes! Of course, this isn't even thinking about what would happen if you were the target of a good hacker! ... but that'll never happen right? ;)
Attempt #2: Patterned alterations
Ok, so if I want a different password for every site I will ever use, how will I ever remember all of them. Well one simple way would be to make careful alterations to the password based on a pattern. This pattern should not be obvious by looking at a given password, but it should be reproducible based on whatever site you are trying to log in to. For example, if your normal password is 'P@$sW0rd', one pattern could produce 'T@$sW#Er' for when you're trying to log in to Twitter and "F@$sW#Ok" for when you're trying to log in to Facebook.
I'm sure you can guess the pattern here. Everyone will have their own unique twist on patterns and this can be quite successful if executed correctly, but of course if your pattern is weak and a real person gets your Facebook password of "P@sS-facebook", they can probably guess your twitter password would be "P@sS-twitter".
Attempt #3: Stored, centralised and synchronised passwords
Alot of people think that letting your browser remember passwords is a bad thing, and while it does have particular cons, there are some pros to it too.
For one, you can have completely random passwords and not have to remember them. Also, two of the methods of disclosing a password that I mentioned earlier were keyloggers and someone looking over your shoulder. Both of these scenarios are a lot less likely if your browser does the typing for you (but of course there are other considerations with this approach). The obvious con would be that if someone gets a hold of what the browser knows, they have all your passwords!
Firefox provides a "master password" facility to encrypt all your passwords (one of my pet hates is that Chrome lacks this) so when a password is needed, you type in your master password once, and it will then autofill any field after that. (Just remember to lock your screen if you leave your pc unattended).
Special consideration to make this password super strong should obviously be taken to avoid any brute force possibilities and of course a master password can be stolen just the same, but this password is useless online and it reduces the probability of others being stolen. (1 chance to steal the master password, as opposed to many chances to steal individual passwords).
Now throw Firefox Sync into the mix. Now all your encrypted passwords are in the cloud and available on any machine running Firefox. I found this to be really handy, but it represents its own risks. This is also just limited to Firefox, what about mobile browsers? What about Chrome or your friends computer?
Again, not a perfect solution, but not too bad either.
Attempt #4: Personal vault
Some really paranoid people will say "But what if Mozilla aren't encrypting your passwords properly?", or "I don't trust other people to store my passwords regardless of encryption". Well, in that case, if you want to store all your random passwords, and ensure they are encrypted, you could always do it yourself.
I played with a nifty command line tool called "PWS" and its open source so you can see exactly how they secure your passwords. The beauty about this method is that you are in complete control. For example, I could use a central repo to store my encrypted passwords and keep this synchronised across all machines, and if I don't want to check out the repo (say, on a friends computer), I could just SSH to my VPS where I could get the password. It doesn't fill forms in browsers, but it will copy the password to the clipboard for 10 seconds so you can just paste it in the browser (which is vulnerable to clipboard monitoring software/viruses).
It even has a random password generator for new sites.
While this method is great for paranoid people, its lacking a lot of features I would expect.
Attempt #5: Hosted password services
If you were to combine the best parts of the previous methods, you would get a hosted service that provides browser plugins for form filling on any browser, is centralised and synchronised across all machines, is encrypted with a master password, has an easy way to pull out any existing passwords from a "vault" and makes it simple to sign up for new sites with a unique random password.
As it turns out there are quite a few of these services available, such as 1Password and LastPass.
Attempt #1: A tiered approach
For me, the natural progression from a single password (back in primary school) was to go with a tiered approach. I used one password for for the basic sites, spam, etc. - the stuff I don't really care about very much. I used another password for the important stuff, like Facebook, Twitter, etc. and this password was a lot stronger than the last. I had a unique and strong password for my email, as someone with access to that would most likely have the power to reset any of my other passwords. And finally I had a completely separate password for banking.
While this system is ok, it's not the best! Once upon a time, way back before I could touch type, I came to a password prompt, so I looked down at the keyboard, typed out my password, pressed enter and looked back up at the screen. In that time a friend had sent me an IM on MSN messenger (I know, old school!) and the chat window had stolen focus, so I sent my password to him. While I (mostly) trust my friend, in a panic, I frantically raced around to as many sites as I could to change the password to something else.
If I had a different password for each site, this wouldn't have been a problem. Now obviously most people wouldn't IM their passwords to their friends, but there are lots of other ways for your passwords to get out. A few simple examples are the "Anonymous" attacks on large systems like the PSN, keyloggers, people looking over your shoulder, phishing attacks and even stupid websites making dumb mistakes! Of course, this isn't even thinking about what would happen if you were the target of a good hacker! ... but that'll never happen right? ;)
Attempt #2: Patterned alterations
Ok, so if I want a different password for every site I will ever use, how will I ever remember all of them. Well one simple way would be to make careful alterations to the password based on a pattern. This pattern should not be obvious by looking at a given password, but it should be reproducible based on whatever site you are trying to log in to. For example, if your normal password is 'P@$sW0rd', one pattern could produce 'T@$sW#Er' for when you're trying to log in to Twitter and "F@$sW#Ok" for when you're trying to log in to Facebook.
I'm sure you can guess the pattern here. Everyone will have their own unique twist on patterns and this can be quite successful if executed correctly, but of course if your pattern is weak and a real person gets your Facebook password of "P@sS-facebook", they can probably guess your twitter password would be "P@sS-twitter".
Attempt #3: Stored, centralised and synchronised passwords
Alot of people think that letting your browser remember passwords is a bad thing, and while it does have particular cons, there are some pros to it too.
For one, you can have completely random passwords and not have to remember them. Also, two of the methods of disclosing a password that I mentioned earlier were keyloggers and someone looking over your shoulder. Both of these scenarios are a lot less likely if your browser does the typing for you (but of course there are other considerations with this approach). The obvious con would be that if someone gets a hold of what the browser knows, they have all your passwords!
Firefox provides a "master password" facility to encrypt all your passwords (one of my pet hates is that Chrome lacks this) so when a password is needed, you type in your master password once, and it will then autofill any field after that. (Just remember to lock your screen if you leave your pc unattended).
Special consideration to make this password super strong should obviously be taken to avoid any brute force possibilities and of course a master password can be stolen just the same, but this password is useless online and it reduces the probability of others being stolen. (1 chance to steal the master password, as opposed to many chances to steal individual passwords).
Now throw Firefox Sync into the mix. Now all your encrypted passwords are in the cloud and available on any machine running Firefox. I found this to be really handy, but it represents its own risks. This is also just limited to Firefox, what about mobile browsers? What about Chrome or your friends computer?
Again, not a perfect solution, but not too bad either.
Attempt #4: Personal vault
Some really paranoid people will say "But what if Mozilla aren't encrypting your passwords properly?", or "I don't trust other people to store my passwords regardless of encryption". Well, in that case, if you want to store all your random passwords, and ensure they are encrypted, you could always do it yourself.
I played with a nifty command line tool called "PWS" and its open source so you can see exactly how they secure your passwords. The beauty about this method is that you are in complete control. For example, I could use a central repo to store my encrypted passwords and keep this synchronised across all machines, and if I don't want to check out the repo (say, on a friends computer), I could just SSH to my VPS where I could get the password. It doesn't fill forms in browsers, but it will copy the password to the clipboard for 10 seconds so you can just paste it in the browser (which is vulnerable to clipboard monitoring software/viruses).
It even has a random password generator for new sites.
While this method is great for paranoid people, its lacking a lot of features I would expect.
Attempt #5: Hosted password services
If you were to combine the best parts of the previous methods, you would get a hosted service that provides browser plugins for form filling on any browser, is centralised and synchronised across all machines, is encrypted with a master password, has an easy way to pull out any existing passwords from a "vault" and makes it simple to sign up for new sites with a unique random password.
As it turns out there are quite a few of these services available, such as 1Password and LastPass.
1Password is quite popular, especially among Mac users and provides clients for Mac, Windows, iPhones, Androids, etc. The interface is quite polished (as you could have guessed) but it costs about $50 for a Mac licence (or $70 if you want to use it on Windows and Mac). One feature that a lot people like is that you can choose where you would like to store the passwords, for example using dropbox to synchronise across machines, but personally I don't think that provides any real advantage.
LastPass is very similar in terms of features, but they host your encrypted passwords for you and it is free! They have plugins and clients for almost every conceivable device, but the only catch is that if you want to use the mobile browser plugins, you need a premium account, which costs $12 per year.
I've been using LastPass for a little while now and one thing I like the configurable random password generator. You can choose just how complex the generated passwords are by configuring length and character set. When you sign up for a new site, you can generate a ramdom password with one click and it will get entered into the site's form and saved in your vault for future. It can fill in standard forms with your personal details (name, email address, etc.) It is accessible anyway by logging into the web interface and its all secured using a master password, which I recommend using a super strong passphrase for, something in the order of 20-30 characters would be good. Remember if someone can log in here, they can get everything!
Another layer of protection is using 2 factor authentication. They have a few varieties for this, but the one I like is the Google Authenticator method. Basically when ever a new device is used to attempt to log in with your account, either using a plugin, app or just the website, they will need to provide the email address, the password and a token. To get this token I configured the Google Authenticator app on my Android, which means that even if someone was to somehow get my super strong master password, they would also need my phone before they can do anything.
I use this approach on my Gmail account too, but Gmail's 2 factor authentication uses SMS's instead of the Google Authenticator app.
Conclusion
So far I am pretty happy with LastPass. I now type in my super strong master password once a day and the rest is filled automatically. Signing up to new sites is a breeze and uses a completely random and unique password per site. My passwords are available in Firefox and Chrome; in Linux, Mac or Windows and potentially for my mobile browsers too (if I decide to pay $1 per month). Not only is my master password really strong, but it is backed up with 2 factor authentication using my phone. I can even get to my passwords from a public computer via the web interface and my phone (without needing to go via dropbox or anything). Best of all, I get all this security and convenience with minimal effort and without paying a cent!
I've been using LastPass for a little while now and one thing I like the configurable random password generator. You can choose just how complex the generated passwords are by configuring length and character set. When you sign up for a new site, you can generate a ramdom password with one click and it will get entered into the site's form and saved in your vault for future. It can fill in standard forms with your personal details (name, email address, etc.) It is accessible anyway by logging into the web interface and its all secured using a master password, which I recommend using a super strong passphrase for, something in the order of 20-30 characters would be good. Remember if someone can log in here, they can get everything!
Another layer of protection is using 2 factor authentication. They have a few varieties for this, but the one I like is the Google Authenticator method. Basically when ever a new device is used to attempt to log in with your account, either using a plugin, app or just the website, they will need to provide the email address, the password and a token. To get this token I configured the Google Authenticator app on my Android, which means that even if someone was to somehow get my super strong master password, they would also need my phone before they can do anything.
I use this approach on my Gmail account too, but Gmail's 2 factor authentication uses SMS's instead of the Google Authenticator app.
Conclusion
So far I am pretty happy with LastPass. I now type in my super strong master password once a day and the rest is filled automatically. Signing up to new sites is a breeze and uses a completely random and unique password per site. My passwords are available in Firefox and Chrome; in Linux, Mac or Windows and potentially for my mobile browsers too (if I decide to pay $1 per month). Not only is my master password really strong, but it is backed up with 2 factor authentication using my phone. I can even get to my passwords from a public computer via the web interface and my phone (without needing to go via dropbox or anything). Best of all, I get all this security and convenience with minimal effort and without paying a cent!
1 year and 40 posts!
Today marks 1 year since my first blog post.
In that time I have written 40 posts and this site has received over 7000 views from all over the world!
I've had some great feedback (even from total strangers), which has been fantastic - It's a good feeling to know that my ramblings can actually be useful for others too.
I started this blog because as a fairly technical person, I am constantly learning, but one of the caveats of this constant learning culture is that some people (such as myself) find it quite hard to remember all the cool stuff we pick up over the years, so this blog's primary purpose was to act as a "memory supplement".
The idea being that when you read something new, it will only stay in your head if you keep using it (or, unlike me, if you have a really good memory), but sometimes what ever it is that we just learned won't be totally relevant or useful until much later.
One of the best ways that I have found to retain this knowledge is to use it! For example, if you are reading up on a new programming language, use it! Write little scripts, re-write other existing programs in this new language and just get used to using it regularly.
If this isn't available (or suitable) I find talking about it with other like-minded people will reinforce the knowledge too. Alot of the time, you can really reinforce your knowledge of a topic by teaching it to someone else. Meetups and groups of like minded friends are great for this.
This is part of the reason I started this blog. Once I learn something new (that I have a desire to remember) I try to write up a quick blog post as soon as I can.
Not only does this reinforce my knowledge, but if I do happen to forget, instead of using Google to re-learn it, I can simply use my blog's search to find my own post on the topic and has the convenience of being written in my own way of thinking/writing.
Even if my post is out-of-date, or not complete enough, it will still refresh my memory and give me a better foundation to start learning up on that particular topic once again.
This blog has served its purpose well and will continue to do so. If you have a similar way of thinking (or a similar memory) as me, I highly recommend starting a blog!
Thanks to everyone that has been reading so far! :-)
XBMC Eden + Ubuntu
Back when I started uni, I bought a new Asus A6J laptop. It was one of the first laptops available with a dual core CPU (Core Duo, not Core 2 Duo) and decently powerful graphics (ATI X1600).
The A6J is very dated now and weighing in at 2.85kg, its not very portable by today's standard (considering my Toshiba Portege weighs just 1.13kg).
A couple of years after I bought it, I got sick of carrying it around, so I bought an Asus EeePc as a replacement for uni, so the A6J stayed at home and was rarely used - it was just a spare for a long time.
Up until recently, I was using I used it as a (stationary) desktop replacement at work but I now have a new job where I am provided a Macbook Pro so this old machine is now spare once again. This with the recent release of XBMC 11 Eden, I thought I may as well re-purpose it as a permanent HTPC.
I considered quite a few options, such as running Arch Linux, OpenElec or Ubuntu with XBMC installed, or going with the recently improved XBMCbuntu (formerly known as XBMC Live).
Once it had booted, it behaved so slow! I figured it mustn't have the correct drivers installed, so I tried to use the restricted drivers from the repo and after hitting quite a few problems I consulted the AMD site.
The AMD site explains that my ATI X1600 is now "legacy" and is supported by the ATI Catalyst 9.3 proprietary linux driver.
So I downloaded that and yet again hit a bunch of other issues.
I spent a fair portion of the day battling with this and couldn't help but think back to how easy Ubuntu Desktop handled all this, so I thought I'd just give that another go.
I then followed the instructions to install XBMC from their PPA. I did a quick update, installed SSH, reconfigured grub to auto-boot in 1 second (instead of 10) and rebooted the machine.
When I launched XBMC, it was perfect! It was very snappy and there was no lag whatsoever.
I noticed that the power menu was missing the shutdown options that were in XBMCbuntu and that the suspend option did not work.
After a bit if research, I found a wiki page that explains how to modify policykit to allow xbmc access to all the power functions.
With this change, shutdown, suspend and hibernate were all working great.
I had already configured Wake-On-Lan in the past, so all that I needed to do was setup the Android XBMC remote app on my phone. After configuring the app with the laptops IP address, MAC address, etc. I was now able to use the "Turn your XBMC's Power On" button from the mobile app to fire up the laptop.
Of course to actually allow control of XBMC I needed to go into the settings screen and enable control via HTTP, etc.
So now I can power up the laptop and shut it down from my phone, but when it boots, I am brought into a Unity environment. In the past I would add XBMC to the startup applications, but with XBMC Eden, there is a better way.
XBMC Eden adds it self to the choice of desktop environments from the login screen (in other words, you get a choice: Unity or straight into XBMC like the live cd).
Unfortunately it doesn't remember the last choice with XBMC, so if I boot straight into it and then shut it down, next time it will still automatically boot in to Unity.
I then came across an Ubuntu community page that pointed in the direction the the LightDM config file. (LightDM is the thing that manages the login screen).
I opened '/etc/lightdm/lightdm.conf' and saw this line:
I replaced the 'ubuntu' part of this line with 'XBMC', rebooted and low and behold, it booted straight into XBMC!
I now have a fully functional HTPC that I can completely control from my phone.
The only things left to do now are configure my media sources, install some plugins and maybe play with some new skins.
The A6J is very dated now and weighing in at 2.85kg, its not very portable by today's standard (considering my Toshiba Portege weighs just 1.13kg).
A couple of years after I bought it, I got sick of carrying it around, so I bought an Asus EeePc as a replacement for uni, so the A6J stayed at home and was rarely used - it was just a spare for a long time.
Up until recently, I was using I used it as a (stationary) desktop replacement at work but I now have a new job where I am provided a Macbook Pro so this old machine is now spare once again. This with the recent release of XBMC 11 Eden, I thought I may as well re-purpose it as a permanent HTPC.
I considered quite a few options, such as running Arch Linux, OpenElec or Ubuntu with XBMC installed, or going with the recently improved XBMCbuntu (formerly known as XBMC Live).
XBMCbuntu
I downloaded the iso and had a bit of a play. I love how it boots directly into XBMC without the need to startup Unity or anything like that, although it does let you exit to the login screen and select either "XBMCbuntu" (LXDE) or "OpenBox" which is nice.Once it had booted, it behaved so slow! I figured it mustn't have the correct drivers installed, so I tried to use the restricted drivers from the repo and after hitting quite a few problems I consulted the AMD site.
The AMD site explains that my ATI X1600 is now "legacy" and is supported by the ATI Catalyst 9.3 proprietary linux driver.
So I downloaded that and yet again hit a bunch of other issues.
I spent a fair portion of the day battling with this and couldn't help but think back to how easy Ubuntu Desktop handled all this, so I thought I'd just give that another go.
Ubuntu Desktop + XBMC
I downloaded the Ubuntu 11.10 iso and installed that over the top of XBMCbuntu and configured the user account as 'xbmc' and to automatically login at startup.I then followed the instructions to install XBMC from their PPA. I did a quick update, installed SSH, reconfigured grub to auto-boot in 1 second (instead of 10) and rebooted the machine.
When I launched XBMC, it was perfect! It was very snappy and there was no lag whatsoever.
I noticed that the power menu was missing the shutdown options that were in XBMCbuntu and that the suspend option did not work.
After a bit if research, I found a wiki page that explains how to modify policykit to allow xbmc access to all the power functions.
With this change, shutdown, suspend and hibernate were all working great.
I had already configured Wake-On-Lan in the past, so all that I needed to do was setup the Android XBMC remote app on my phone. After configuring the app with the laptops IP address, MAC address, etc. I was now able to use the "Turn your XBMC's Power On" button from the mobile app to fire up the laptop.
Of course to actually allow control of XBMC I needed to go into the settings screen and enable control via HTTP, etc.
So now I can power up the laptop and shut it down from my phone, but when it boots, I am brought into a Unity environment. In the past I would add XBMC to the startup applications, but with XBMC Eden, there is a better way.
XBMC Eden adds it self to the choice of desktop environments from the login screen (in other words, you get a choice: Unity or straight into XBMC like the live cd).
Unfortunately it doesn't remember the last choice with XBMC, so if I boot straight into it and then shut it down, next time it will still automatically boot in to Unity.
I then came across an Ubuntu community page that pointed in the direction the the LightDM config file. (LightDM is the thing that manages the login screen).
I opened '/etc/lightdm/lightdm.conf' and saw this line:
user-session=ubuntu
I replaced the 'ubuntu' part of this line with 'XBMC', rebooted and low and behold, it booted straight into XBMC!
I now have a fully functional HTPC that I can completely control from my phone.
The only things left to do now are configure my media sources, install some plugins and maybe play with some new skins.