Yubikey, PGP and SSH and Chromebooks

https://pgp.mit.edu/pks/lookup?op=get&search=0x9A043EF5DC61A9D5 is where my PGP public key can be found.

Why the sudden interest in PGP?

Basically it enables me to put my secret key on a Yubikey instead of a computer. They secret key is secured by a PIN which can only guessed x times (3 is default), then you have to use a PUK (3 times again), and then it's locked. Only a full reset will get it out of this and that will erase the private key too. That's way better than a passphrase secured private key file on a computer which can be cracked over time, though it might take a long time if the passphrase is a good one.

And the best: It works out-of-the-box with my Chromebook and the Secure Shell App via the Smart Card Connector! It also works on my Linux desktop with Chrome. Windows does not work though as the Smart Card Connector does not work as expected as the Chrome Smart Card Connector does not work on non-Linux.

The links to read (not in any particular order):

  1. https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on-yubikey-neo/
  2. https://chromium.googlesource.com/apps/libapps/+/HEAD/nassh/doc/hardware-keys.md
  3. http://deferred.io/2017/08/03/yubikey4-gpg-ssh-u2f.html
  4. http://www.engineerbetter.com/blog/yubikey-ssh/

While not trivial to set up, it's very rewarding to know to not have a private ssh key on an inherently insecure computer.


High Speed Oven

At Subway (the sandwich company) they got high speed ovens which toast bread in like 20 seconds. I always wondered what magic is inside to be that quick.Today I found out that you can even buy those ovens if you have a need for them. Like this one: https://www.turbochef.com/product/bullet/

And the magic they use: hot air as well as microwaves.

Before you think about buying one: it'll cost you about US$10k, and the Japanese version uses 200V and 30A (resp. 400V/16A for those in 230V countries).


OTC Medicine in Japan

OTC medicine is plenty available in Japan, but it's hard to match it to what you know in your home country. Reading Katakana helps a lot and having studied Chemistry too, but it would be so nice to get a nice English overview of various  Japanese OTC medicine.

Luckily someone did that: https://lifeabroad.jp/html/medical_health/otc.html

Of course do not take that web page as the definite truth and cross-check the ingredients and dosage.


Japanese Epson Printers and Linux

Got a new printer. The previous one (Brother) was good, but the drawback of all ink-jet printers is that after years of use, print quality drops with noozles not working anymore despite extensive cleaning.

So it was time for a new one. This time it's an Epson again: Epson PX-M780F, which looks like the US model Epson WorkForce Pro WF-4730. This is important for several reasons:

  1. The Japanese and US/EU models usually have different names
  2. There are no Japanese drivers findable by me on the Japanese web page. Drivers are usually limited to Windows or MacOS
  3. The US site does have Linux listed
  4. The US drivers work fine on Japanese printers from experience

This time again I could install the US drivers from here. A simple and good and working instructions are here.

Interestingly the CUPS driver does list the Japanese printer names. And needless to say: it works and the printer is incredibly fast (compared to the previous one).

Update: Turns out that the Japanese page after all shows the Linux drivers here, which points to the same download page as above, except in Japanese. And you can find the Japanese printer name too. As expected, it's a single driver which covers a lot of Epson printers and a lot of languages.


CloudFormation - A Sample

I'm not sure I like AWS CloudFormation (CF). Beside the obvious lock-in I currently would rather use TerraForm or similar to describe what infrastructure I want. However CF will always have the most complete features especially for new AWS services, so it's probably good to know. And one day you'd possibly have to modify a CF configuration file, so it's a really good thing to know if you work with AWS.

Anyway, my observations:

  1. I do not recommend to use JSON for CF. Use YAML. It's much shorter and much easier to read. I usually like JSON, but here it's outclassed by YAML.
  2. As a PowerUser, to use CF you need some extra permissions:
    1. iam:CreateInstanceProfile
    2. iam:DeleteInstanceProfile
    3. iam:PassRole
    4. iam:DeleteRole
    5. iam:AddRoleToInstanceProfile
    6. iam:RemoveRoleFromInstanceProfile

Here are the command lines to use:

aws cloudformation create-stack --template-body file://OneEC2AndDNS.yaml --stack-name OneEC2 \
--parameters ParameterKey=InstanceType,ParameterValue=t2.nano --capabilities CAPABILITY_IAM

To see what was created (takes about 4 min 20 sec):

aws cloudformation describe-stacks --stack-name=OneEC2-6

gives you this output (some data replaced by X):

aws cloudformation describe-stacks --stack-name=OneEC2-6
    "Stacks": [
            "StackId": "arn:aws:cloudformation:ap-northeast-1:XXXXXXXXXXXX:stack/OneEC2-6/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX", 
            "Description": "Build EC2 instance with current AWS Linux and create a DNS entry in aws.qw2.org", 
            "Parameters": [
                    "ParameterValue": "aws.qw2.org", 
                    "ParameterKey": "HostedZone"
                    "ParameterValue": "t2.nano", 
                    "ParameterKey": "InstanceType"
            "Tags": [], 
            "Outputs": [
                    "Description": "Fully qualified domain name", 
                    "OutputKey": "DomainName", 
                    "OutputValue": "i-034dcbb1c60d1e062.ap-northeast-1.aws.qw2.org"
            "CreationTime": "2018-03-11T12:57:50.851Z", 
            "Capabilities": [
            "StackName": "OneEC2-6", 
            "NotificationARNs": [], 
            "StackStatus": "CREATE_COMPLETE", 
            "DisableRollback": false, 
            "RollbackConfiguration": {}

And to delete it all (takes about 3 min 30 sec):

aws cloudformation delete-stack --stack-name=OneEC2-6