Lee. Can you turn recording on IP the button? And nothing happened
hey? My team
what's up? Nice
Yeah, we're recording, just waiting for speaker
Yeah, I show recording Okay.
Yes, we'll have some dead air on the recording
Certainly
Well, I got a question for folks
I recently posted on discuss Is anybody from Has anybody ever looked at the on Google Chromium?
it's chromium with even less Google in it.
I have run that. But I've completely switched over to using brave instead, just because, and while I was, using it was working fine.
Romeo without Google. No, it's chrome. It's grown without Google probium, without Google
Yeah, I have. I have worked with it.
Can Anybody hear me? This is Stan: Okay, I okay. The the thing keeps.
Yeah, we're here.
Hmm! Turn it on my mute. I don't know what the hell's going on.
Hi! Hey! You fine
Okay, Well, I mean this, my last rent you heard, but before that I was asking Bob Levitt a Robert Lever a question, and I was muted but when I came in.
I know, but I was, and I rat along with a question directed at you.
No. I just was saying Hi
But some, for some reason the system muted me right. After I log in I mean and and when I logged in it was not muted.
Yeah, Tom Chapman, I have you showing is muted.
sure.
it's well it this thing is acting like I've got 2 or 3 sessions running on the laptop, and I don't
I don't know what I don't know what I've done.
and anyone is talking now.
Okay, I met, just came a chat from Tom Chapman there that he doesn't have a mic.
Okay, Tom.
Okay, Okay, which is fine.
Robert Levitt, you'd we had exchanged some emails and where'd it go?
how I wonder if I've got a bad mouse?
bad mouth.
It's costing M. M. M. O. Usc
Well, but the mouse is not talking
Here, let let me give you some facial expressions
Can you phonetically.
Yeah.
I won't Even I'm gonna I I give up. I'm not gonna try.
No Nicky, Hi Mickey Shesh
You, son of a
Oh, I've Yeah, I did have a question. I can remember what it was.
I can't
Yeah, he. He had said me some screenshots, and it was coming up a a It's C. A.
you're talking about. I'm glad it's computer problem
HP, errors, or something like that. I don't remember.
Yeah, I sent you the carbon of it, anyway.
I did a search engine thing, and I sent Robert Lovet the the the link for him to look at, and I suggested it could be one of 12 things.
yeah.
Okay. And the one I'm could be that the it could be a problem with the bios improperly set, or it could be a problem with the the hardware, fee go in bad the the
This is a relatively new laptop.
That all mean nothing? Is it still in warranty, anyway?
Okay. But one of the one of the things was that that it was suggested that on the page that I send you, that with that particular distribution, the Mx.
Whatever it was, that the kernel was too new. How how old is this this laptop that you got?
I think it may be
Oh, I'd say I bought this year so I mean, it's been now.
How is it?
Okay. But it may be that the kernel, if they're using an Mx is older.
So that doesn't have the device drivers in it, So that might be one issue or you know, that's the most likely thing, and I suggested to you that you get a live essentially.
You get a live, not boot up a different distro to see if you were still having the problem, because apparently it wasn't getting Apparently it wasn't getting to to grub.
Or if it if it was it, it just wasn't completing the The log.
On process? Are there lot whatever? And what your comment was that as you understood it, Mx.
Did not You did not use System D. I had one of my last possibilities that I reckon I suggested was that it could be a something screwed up with system B because it's such A menagerie and you said that it wasn't using you as you understood it it
wasn't using system D: Well, I'd say 90% of the distos out there are have system d installed.
They're just not using it to the to to its full extent.
So a lot of systems of distros now are running both the old and it's system 5, and and whatever the interrupt thing is, and and they're running that plus the system, D they're just not capturing the the journals, they're not capturing, the the system, d log
files, except in RAM, and you had what's what you may have been referring to, that You have to specifically turn on the journaling for system D.
To to persistently keep them Those log files from system d from one boot to another, otherwise it's it's doing it in RAM.
So essentially most all of the Distros out there are none are running 2 2 systems, to log stuff, and almost all of them are running System D.
In addition to whatever else they got
understand, it's typically a mutually exclusive one or the other, as it as it turns out.
Well, well, what? What? What? Whatever It's It's there
Mx. By default boots up with this 5 in it, as opposed to.
Yeah.
But you can, somehow and I've never done it. But supposedly you can go in and tell it to move to System D
Yeah, Yeah, I mean, you can turn it on. So you've got both of them run at the same time.
No, they don't really run at the same time, though it'll it'll either boot up and Sis V.
Or a system D, one or the other depending on how you set it up.
But it defaults to just me. System 5
But it has a stub, so that if you're running a application that requires system, SSD system, D.
I don't think you can do that.
And I do think that hey, Mick, as a like an updated colonel, or something to do with updated hardware.
It will, it will use it and run it
I can't recall exactly what it was. I remember reading something about that
Yeah, they have a version that with a suffix of ahs for advanced hardware support, and that, and that has the newer drivers and stuff like that and the the only problem with running that all the time is it may not be able to cover, Some of the older, hardware so if you are
yeah.
There you go. Yeah.
Do you want me to try the age this
I I'd like to say, an equivalent to the I like it when people correct me, because my pretty much of what goes on is not always true.
That's right.
But you know they do ship it with both of them. I guess it's I guess it's a matter of I guess.
I turned it on and thought I had both of them. On I don't know.
Hmm! The last couple of years has been a big, brutal about system.
D, while all of a sudden are they switching 2 way choice?
because because well, because spread hat is doing it because it it's it's actually that that's red hat is adopting.
It, and almost all of them, I think a boot to this adopted it.
So you know the thing is that the I don't think they've worked out the the recovery capturing the log files and storing them at a to our remote system properly yet.
Has anybody read about that good
Hi and Mike. Oh, go ahead!
it's it's open source. Everybody use it now.
It's my understanding that ours Log D will well export standard log files, in which case you can just direct them to another host.
oh, okay. Because if if you're Sis admin, and you're running a whole bunch of machines, you wanna export those log files.
You want to get them off of your active machine and put them on a a bastion server somewhere where they're they're highly protected.
Because You know what somebody on your system, deleting and or modifying your log files, so you don't know he's there.
Yeah.
Yeah. Why, I, Leonard Pottering no longer works in Redhead
Yeah, they also did pulse audio
It? Are he the guy that wrote this thing? Okay.
you know where he works now. Right pottering Microsoft
should get enough money can buy almost anybody. Yeah.
Yeah.
Hmm.
Yeah.
See Nelson Kim well, must be a new person.
Charles Wells.
Those are 2 new names, relatively new names. Okay.
I got a question, but don't know how well over it will go, Has anyone ever installed visual studio offline?
Go ahead!
I'm not talking about visual studio code. I'm talking about a full, fledged Microsoft for windows, visual studio
Yeah, trying to give a project the subcontractor sent us up and running, and they hard code the pack to the Ms.
you might heard from Steve
Hey, Mark, He's supposed to be
I just texted them. I haven't got a reply
I just talked to Gary, he said. He's gonna call Steve so
See what's going on. I got the Steve's number somewhere, but I'd have to dig through a whole pile of stuff if I find it.
Yeah, anyway?
Stan is Wayne here? I heard you ask how California was when I first came on, but I like I was fumbling around trying to get my microphone. Working.
California is fine, but we're we're getting ready to leave.
Okay.
We're movers are going to be here at the end of the month to pick up our stuff and bring it up to Portland in that area.
I've been reading a lot of people are are leaving California.
Yeah, they are a lot of them go to forward it. But we have grandkids up in Portland.
Is that true?
S. Ste Steve's fucked up his time change.
I have no idea what time change he's talking about.
Good. That would make sense
You, you.
But hopefully, you'll jump in soon.
daylight savings was what last month something, or is it next one
And now it's next next month, next month, and our our glorious Senate back in March.
Next month.
Unanimously voted to eliminate daylight, saving time.
Yep.
But the house that didn't
Oh!
Right.
Yeah, But as last I read, the House has done nothing with the with the bill, so it's just sitting there
I I would hope that they did
I don't know. Last I read, of course, that was 3 days ago, or 6 days ago, and you know I didn't go to the to Gov.
you know, we could all probably just agree during daylight savings or the other way around.
And look it up, thought about it
Well, I was reading something, said that there's no real adoption standards.
So every city in the damn country could do whatever they want
Oh, that'll be fun! For the first couple of years
Oh, boy, wouldn't it? Yeah.
Yeah. Or let's let's change it this week and go back to it.
And then oh, we didn't like that! Let's just go turn it off again.
that will be. That will be what happened Scheduling across time.
Yeah, I don't know. That would be great.
Yeah.
Well, we've got it easy all our time. Zones are on the hour.
yeah, what was that like? Small Pacific Island? That decided.
I think everyone wanted to do that. They wanted to do that.
So they were the first country to see daylight for the year.
my favorite ones, Australia, the whole continent got 3 time zones.
The east and west are 2 h apart, and the one in the middle is half an hour from one, an hour and a half from the other.
Well, you know all I can say is, the Australians drink a lot of good beer, hey?
And a lot of high alcohol content
Interesting.
Well, let's see any announcements. Anybody have anything to announce
Next Tuesday is going to be the next user group meeting, and I'll be there, and I might even be on time
people.
don't get people too excited
Left. So you hear this steam song
Is anybody using Mx. Linux
Yeah.
I use it. I've been used in about 6 years now.
Thank you. This is number one, and distro much but by 4,000 users and 4,000
It has been a couple of years now that, but it's been postulated that that was due to bots
Oh, was
But it is a good distro in my estimation.
What's it based on
it's it's per day
Yeah, be in stable
It's lineage started with napis
Who's at Zoom: Okay.
Correct. That's my other favorite disk row
Yeah.
Is, that is that one of those argument district distributions
No Debian based
Okay.
Designed for old computers around real fast on newer ones.
Does it have a 32 bit 4? It does.
yeah, Mx has a 32 bit also.
She was really
Yeah.
Yes, yeah.
Yeah.
And it runs well on runs well on older hardware
Yeah. That's how I've been running it the whole time.
real good. They're real good running off USB State
Really.
I've never installed on the machine. I just yeah, I run it on a high speed flash drive, and it's just as zippy as can be
it is you can run, Mx either persistent or non persistent.
You can run it from memory, or you can run it directly from the flash.
Drive There's all sorts of options, and how you can run out, which makes it this one of the reasons I like it so much when it's non persistent.
you literally can take the flat after booting. You could take the flash drive out of the machine, and but in the persistent mode, yeah, all the work that you do is obviously saved to the flash drive
and you can create a backup I'm like in high.
So image.
so, if I mute myself, you can hear me. Yeah, my fault, I added.
okay.
An hour and citizen practicing it. Let's see, I don't know if you guys can see me or not.
I I went through it. I wrote up something that was really descriptive about how the you 2 guys, the only ones left.
I'm sorry.
Oh, okay. Oh, okay. I always see 2. But what happened was was I went through
No, I have to fight off a cat. Hang on, hey?
You're not
Well, it's it's an important thing, you know.
Oh, it's one of those days, isn't it?
You're your office equipment has to be comfortable.
Maybe not for you, but at least yes, so
I can't. The cat started to sleep with you.
Oh, yeah, they always do that, but so does the dog that is in ours.
I forgot what month it was the last couple of months. There was a good New Yorker call it would cartoon.
It was 2 dogs sitting on a couch and 2 people sitting on the floor watching TV and the guys saying, When did the power get reversed?
Right away. So I was looking at it, and I realized everything It was just completely boring, because all it was was about the internals of how encryption works.
I'm probably already cares about that. So what I was gonna do.
Can you see my screen, hey? It's good work
we see, we see it a terminal
Bingo That's where it all starts. So what happens if you start?
Firefox, click.
Then
What I was gonna describe. There's a problem with
The thing I described the last time with fuse for encryption.
What's the thing called Inca Fs. E. And Cfs, And the problem with it is that the author no longer maintains it.
There were security holes in it, their problems with it, and he went out, wrote a new thing call.
that's written in. Go
There's another thing that actually, I think, is a little. The idea is a lot better, and it works fine for me, is called Cry Fs.
And
This is how you can find it so you can do that.
You can do this. There are all these different cute tricks for it.
You can compile it from scratch. What's important about it is, if you look at the way Inc Fs and cryptomator, and just about everything else on the market, and the way they encrypt your your contact is by file So if someone steals your encrypted contact.
They can use content analysis to look down the file and figure out what's in it, because if they find out that it's mostly text, they can use the word done and look for the they look for aids it looks like ease, whatever is because it's an entire file, in one place it's actually pretty
crackable cry Fs uses a really neat technique, or and my hope was that if I had learned how to tell time properly, I would have had this up on the screen. Github shows come up with it
You see, I I noticed I was getting all the there it is.
I was getting all my images from him, anyway. So the trick was that if you look at the way he does it, it's right here
And this is what makes this one different than every other encryption tool, that's floating around.
Because what you what it does is it breaks your data into same size trunks.
You can see down here
So, if somebody anyone here old enough to remember Ds
Okay, Well, if I know if I don't make yeah, I don't greet too many bad memories.
Everyone remember what happened when you deleted a file by mistake, Eddie, how to go to use the disc editor, and you'd find the first block of the file by looking at all the unused Blocks and you'd find a block that looked like your first one and then you have to search down and find a block that look just
like your second one, and we get that Well, imagine all those blacks were encrypted, What would be your odds of putting them together in the right order?
Neil, and that's what these guys do. This guy does, and you can set the block size if you're encrypting.
Port is probably 1 MB If you're encrypting tax records, it might be sixty-fourk.
If you're encrypting your email it might be fourk pages, and what you do is it breaks your content into all of these same size.
Little blocks.
Each of which is encrypted independently, and then scattered all over the files
What's cute about that is, if someone ever gets your content down here in the cloud, all they've got is a bunch of 4 K.
Blocks full of gibberish. They can't even do statistical analysis, because they don't know what it is.
One block might be a jpeg. The block next to it might be part of a text file.
Am I making any sense to people
So this is the best technique I've seen He doesn't call it one, because there is one problem with it is you can't have multiple processes writing to it at the same time.
And obviously you've got the problem that if you corrupt the metadata that defines where the blocks live, you got to recover from backup
But the good side is, it's pretty safe to back this stuff up, because all it is is a bunch of encrypted blocks.
You guys. Anyone looking at this has no bloody idea what 1 4 K.
Is, and another 4 K is and even the metadata is encrypted in a block. So you don't know.
You know which one you the metadata is, cause you've got.
You've got no way to identify any of this stuff
how are you?
hmm, yeah.
Is everyone awake.
Okay, well, but does this picture make sense to everyone? My talk was mostly showing how this picture worked, and I I couldn't work around the fact that that's what makes this interesting.
So What I was gonna do is show everyone. Ha! A couple of techniques I've got for you.
You can build it. You can grab this a half a dozen ways from the Internet.
We people are already Debbie, and there's a Debian package for our Pmo.
Files. There's our Ipm there's I think, a suzy package.
You can get the source code. I want Jen, too, and it it compiles easily.
I didn't have any trouble at all with it. Once you've got it all you really have to do, and They actually, oops zoom and what to be, or not to be Oh, I don't know if anyone's seen this just a total Aside I was setting this to someone I know do you
realize, and Hamlet has been translated into Klingon
It is there
Oh, my God!
It was originally in Klingon
That was these Shakespeare stole it. That was the problem
But yes, there are. You can look this up on no less than Wikipedia.
There is a Klingon, Hamlet.
The software, this guy
I sent it to Daniel Conway, who is, we all know, wrote the click on Mac Module for Pearl. But I'll luckily do cling on math
gosh!
What number of system do they use? What number system do they use?
Bye oh.
64,
Look it up. I've never Well, you ask the question
on recode, and we're going on words.
3 different encodings; and then, if you look carefully in Utf.
8 there, along with Elvis. There is a cling on.
If you got, if you use utf 8. Oh, give me if you use utf 32.
There is more than enough space for every imaginary alphabet.
That people have concocted
There's the date time event. Klingon
Oh, my God!
Dates of cling on cultural significance
I'm I'm trying to find it. You asked.
Oh, my!
Hmm.
I'm finding it. Man.
Hi!
This is the stuff that Damian Conway is written. You notice something
If we go up to 500 per page, it gives you an idea.
Of how many modules these, but clang on Matt.
Hang on!
There we go, the clinical language, hey? Your program in it.
This is a lingua. The core, the clang on equivalent of Lingra.
God
Bye.
Romana Pearly got up, That's quite that.
That's pearl in
Hmm.
yeah, Well, come on, Hey, man.
in line.
I guess that was it. That was the one he did was allows you to write Pearl in the in the original Klingon
I subscribe in 1984, no less. By Dr.
Mark, orprint
You ever need. You could write prolonging
What's the first rule of pearl people
There's more than one way to do it, but that includes Latin and includes playing out anyway.
So cry at best, takes your files, breaks them into chunks, and then those are stored.
Now they don't have to be stored in the cloud.
You can store them locally. So, for example, Oops I'm on the wrong computer.
well, no way. The process is here.
Yeah, there we go, so I can take
I could take cry Fs
And it's if I do a cry Fs. To keep it in the foreground, I can make her
Rfs minus f dot Crypt: Correct So that's what you're used to.
It. What this does, crypt is a virtual mount point in views.
Sorry I asked. Gosh
So we're looking into this mount point, and we're going to see the d enciphered copy of whatever lives there does that make sense so far
Yeah, the well, if it's binary now, I'll choose.
No here. So the people can see what the choices are.
You've got more than a few ways to encrypt stuff.
let's just use Aes, cause. It's probably the best way if you have any reason to like any one of these any better.
Pick it. It'll work now. The block size is important.
If you are encrypting, let's say email and you have a lot of documents that are smaller than 4. K.
You might want to choose that smaller block size. There's a higher overhead in encryption, cause you got more chunks to encrypt, but you waste less space.
Let's say you got a 1,000 email messages, and most of them are between 4 and Ak.
If you choose, a 1, MB Chunk.
Every one of those is going to take up 1 MB in the in the encrypted file system.
Because you're taking every chunk of input and breaking it into one block the size.
Mean the plain text.
got it? Is it essentially encrypting a a container?
Stanley. I hope I'm not hurting your head, man
Or is it encrypting individual files alright
It takes an individual file, it brings it into chunks of this side.
Oh, okay.
It then takes each of the chunks and separately encrypts each of the chunks and stores them separately.
In a metadata file that says, Oh, if you want document X, you'd better look at chunks.
1, 2, 3, 4, 5, 2732, 87, and 16.
Okay.
In that order. If they pay it, then decipers them. Paste them together, and you have your original
So it it it builds a a chain of that you have to follow in order to encrypt and decrypt right it well, it follows it.
Well, it follows it not you, from your point of view, it's just a file it.
You look at it now so again if you're crippling something like, email or a lot of things that are texty kind of documents where they might between you know, you you want to pick the block size that's not a lot bigger then the things then most of the things you're
encrypting, Because, let's say, you pick 1 MB right?
Yes, yeah.
If I'm here, nothing is gonna take up less than one.
Right, right.
Meg, even if it's a 2 kB file
Bingo. Well, and the other thing that's gonna do
Sorry, I got to pay attention to my phone. My wife. I left her at the restaurant.
When I ran home to get here. So
What happens is if you choose a 1. Megabyte Chunk.
No file you encrypt is gonna take up less than one Mega on the desk.
That is not only inefficient on file space, I mean, forget that.
Let's just say you're using aws to back this up and aws is how many pennies per gigabyte per month You don't care about space.
What do you care about is time? Because if this is a networked file system, you're gonna have to You're gonna have to move.
Which would waste a lot of space alright
And you're also encrypting and decrypting the wasted space.
That much crap over the Internet back to where you are in order to paste it back together in order to decipher it, in order to see your original
Right, with most modern process processors, you know, if you're using a a risk, 32 or an 88.
Yeah, it's gonna take a while. Modern processors are going to decide for this in left time.
Then you can blink, but the network overhead is going to kill you.
I mean, if you've got a direct fiber channel, whatever you're doing, and it's your home, Nas, who cares but one of the neat things about this is being able to store this in a file, system like Amazon?
Drive or Google drive or dropbox and at that point wasted space kills you on network over it, and obviously, if you're getting charged for the network space I get in charge for the storage space we I I live in New York I New York times you people are in midwest time, I accidentally moved
the time and hour in the wrong direction. I'm sorry. So, anyway.
So it's gonna take more time and effort
Does does this idea of the chunk size make sense
So if you're if you're encrypting a whole bunch of DVD backups, and they're all you know, a few, Meg each go for a one man or a 4 maybe chunk, size, because then it'll be more efficient on the encryption and decryption
side because you'll have fewer chunks to work with if you're encrypting mostly text 4 K.
Or 8 K. Might be nice, because then again, you're not going to waste a lot of space.
So let's I'm gonna choose. I don't know.
64 K, I think, is the default. There's some integrity checks.
there are times when a missing block now, because these are enciphered and deciphered separately.
A missing block might give you a corrupt file, but then, at least, you know, lose everything, so you might want to say if a block is missing, we don't want to reject the entire file as being unusable now you could adjust these, at the let's just say you've got
some a file system, and for some reason one chunk of a file got deleting.
There are 14 chunks in the twelfth. One didn't transmit properly.
You could say this file is unusable. Remove it from the file system, or you can say, you know what you had a corrupt file.
Let's deal with it later. Normally, you're gonna want to say Yes, for this again.
These are defaults. If you go back up here at the top.
Yes, I think so.
When I said, Use the default settings you wouldn't have to I just want to show people what the options are.
Now you got a password. One way to do the password, and I use I don't like passwords, because other than antiis establishmentarianism.
There Probably isn't a word that's long enough to confuse people these days, so you can have a password again.
My my favorite are brands of booze. So a really nice password might be.
Walker Black
Oh!
You might go for that
But it wouldn't be that hard to change that to an app. That's maybe a bang 3
So let's say I use that
Well, let's face it. Everyone's been so drunk that you couldn't hit the phone without hanging on, cause you know what you drink
That makes a really nice pass for me
So let's say I use. I use this. I hate the fact that I can't see what I type the passwords, so I'll almost invariably echo them or something else, and then cut and paste them because then I can I know I can get it right.
yeah.
Twice in a row. Is anyone here ever miss type something? Oh, okay.
Well, then, you don't care. So now this takes a little bit of time This is one annoyance with this thing.
it has to derive its internal pass phrase, There you go.
The file system is starting. So now
You'll see crypt. Well, you'll see Dot crypt, and you'll see crypt
And this has got the configuration file
at least once
Which is really descriptive, Right?
So otherwise, I got this. And again this is encrypted when I'm looking at it.
So there really isn't much to see. If you wanted to ask, What does the configuration file look like?
Oh, yeah, I love it
My answer is, I got a bloody idea, but now I can say date greater than crypt, who are well
Okay.
Hey? God! Right
And that looks like a reasonable estimate of today's date.
But now I'm just saying this script
Oh, yeah, really, descriptive.
And what do you notice about the file? It's one chunk in size.
Nope.
I forgot how to do this. Hang on
So now
This is the current contents
Of the file system. I got this file, and I got this file.
Anyone want to guess what's what?
Oh, hmm! If you could read this config file, you know, but you can.
What did you have to know how to decrypt it?
The only way to know what those are realistically is to look in the memory of the running process.
And if you're good, if you know internal data structures when you're good enough with Gdb.
And you could attack to the running process. You could figure out where the encryption key lived in memory in the running process, and then you could figure out What those. Were anyone else It's gonna have a lot of problems
And again, alright.
What do you notice about these? They're the same size.
So you've got no clue. Which one of those is my date file, and which one's the metadata file, because they're both the same size.
And if you look at
Not really because you, if you looked at the time stamps you'd be, you might be able to see which files are older, and which files are newer and maybe what's something? About what date?
They were created. But that might not tell you that much about the blocks
But yes, you could use the the time stamps on the files to know something about it.
Another thing is both of these files
Are equally full of gibberish
What's important about that is
You can't. Oh, which one of those things is a 30 somewhat character string
So Well, what are the other cute things about this I've shown people this before.
if if I open up well, actually this phone, if I open up other window
Oops wrong machine. Sorry about that. This will take a sec
Now rude can find whatever's in here. But if I try to Ls script I can't access it
I'm super user the Colonel. Let me see it.
Yeah, I'm me in another process. I can see it.
So basically, my user, Id has access to the contents of this
That's one that's any other user. Id on the system completely locked out
Did that make sense?
The cute thing about that. It's a good and bad thing Normally, when you mount these file systems and you'll see up here.
I did this minus F and that mounts this in the portrait.
If you have a special purpose user Id
You could have something wrong, Let's say, out of that user.
Ids, crime, tab, or something that was going to do.
Your backups, and that chronic tab doesn't have to log in. As the user just is the user at that point, you could have something wake up back your stuff up, stick it on the net And anyone else logged in on the on the system
Can't see what's going on. So your data is pretty damn secure.
Obviously, if I'm over here I can doing as you
And I can see it so someone can become super user. They can always switch to the user that owns this
And then they can see the context. So it's not complete like.
So long as no one has super year, or if they have super user access, if they don't know the other user ids of it, which can happen, it's it's recently hard for somebody else to see what's going on here
Now a lot of you. We're awake might be thinking.
But how the hell does this help me in the cloud? Because a lot of people want to use network storage these days.
The cute thing is let if you look here.
I've got this directory dot correct. That's the directory that's going to be deciphered.
So that I can see it. What I look in here right
this directory was the Mount point for S. 3 Fs.
Because remember, when you use S 3 Fs. You amount an S.
3 storage bucket as if it were a directory on your local system.
Right That's what I showed you in the last talk.
I can create an S. 3 bucket. I can mount. It as S.
3 Fs. And now any file I save is going to be stopped in the pocket
Did that make sense?
Tell me somebody's pull away
Well, S. 3 is very, very, very cheap, and they don't count the number of files. They discount the number of blocks right
So let's say you wanted to store something in S.
3. That was sensitive data. You wanted to be able to get it back using S.
3 You'll like S. 3 Fs. Because it. It allows you to access that really cheap storage in Amazon
What I could do. I could mount a directory on my local file system, using S.
3 fs. What if I mounted? Dot crypt
I look here and see today's date
It really gets stored here in dot crypt
But what's underneath.com It could be anything that could be a logical volume.
So I have an encrypted logical volume.
It could be S. 3 Fs: so I'm storing in an Amazon that could be dropbox, or I mount a remote volume of dropbox on my local system that could be my family.
Now server that could be an Nfs. Mount
The beautiful thing is, Thank you. The ink fs, or or cry Fs: They don't know what the underlying storage is.
It could be another mouthpoint.
So one of the problems you have, for example, a lot of people don't like storing things in network storage cause.
They say you know what? What if somebody gets into the network They're just see everything I've got.
That's true. What if Dot crypt? What if the network, if this directory, full of gibberish?
What is it is nothing, is you're you're just thinking of.
This is the local storage. If you've got a Wi-fi network storage in your house, you've got a wi-fi router you've got a disk somewhere.
Everything that goes, Your whole family can see it. Let's see, you've got your tax documents and maybe you don't want everything that's a bug in or a malware in every computer in the house to be able to see what's in there maybe you don't want You next
door neighbor to be able to see it if they access your natural story.
Come on, Stan. It's not that bad. If I scared you that much
Well, if you try and visualize, what happens when you use any room, remote file system, what's the first thing you do?
I'm just trying to visualize it, that's all.
You mount it
Right.
Yeah, yeah.
Let's just say I mounted it on a directory called Dot Crick.
I'll show you right here
Go back to the original command line
Anything. Dot crypt is storage. It's a directory that's all I know about it.
It's a directory
Whatever's in there is going to be decrypted by cry Fs.
When I look to see it incorrect.
What happens when you amount to DVD
You stick the DVD. Into the machine, you click the little button that says Mount.
It's sucks it in it spins for a sec, and you mount it on.
Let's say slash Mnt. Now, when you do, Ls and mnt a little light on the DVD thing lights up and you see the content.
So what's on that device?
How do you declare that it's it's a crypt file system.
Right, Let's say I have a USB disc. I plug the USB Port.
Let's say I have a thumb drive, and I want an encrypted thumb. Drive.
I stick with thumb, drive into my machine. I get a little nasty gram in in d message that says, Slash!
Dev slash. Sdg just got mounted, So what do I do next?
I do mount Dev. Sdg: one slash. Mt: Let's say right
Let me reach for the Bum Rock. I've got 300 of them here.
One of them should be usable up my sleeves.
Hey, thumb drive, Oops! A machine with no USB ports left my microphones on this one.
the keyboard.
My keyboard. I have to type on this thing. Okay, let me try something here
So let's give up on this thing
I'm gonna plug a DVD in. This is how to create an encrypted thumb drive.
So what happens is.
So sda, one and sda 2
Yeah, that's empty. Oh, this, Okay.
Oh, come on, damn it
1 1,002, 1,003 1,000. Okay.
Of course I picked the one. Okay, So there we go. So I do amount.
Let's say it'll make a fast dot f 2 fs dev sda, one
So what I've done now is, I've taken a thumb drive, and I created a new empty file system on it right?
So I'm mount that
Right.
Oh, cool!
Oh, it's designed for flash systems, It's designed for things like thumb drives.
I'm not familiar with F, 2 Fs.
It rotates the blocks. It does a lot of things that make it writes, and larger chunks.
Okay.
It's designed to be more efficient on thumb drives
Okay, Thank you. I I I can understand that. Okay, Yeah.
The other thing you don't want to put on. A flash drive is something like exfs where it's got to write twice to the thing to write any blocks
Well, think about if you put Xfs on a thumb drive, you've phone drives are gonna be absolutely miserable at light writing anything less than one may So you've just got a 15 K system.
They're gonna be pounding on just to get everything that's written pre-written so that it's recorded you're gonna wear out, the drive faster because it's got a finite number of right cycles on And You're gonna slow.
The hell out of yourself, because you got to write something to a device.
It's really not designed to handle 15 K: It does all these little tiny rights that get spread all over the place.
So it. The the performance of Xfs on Flash Drive is miserable.
I'm unless you use an external well at that point it's not bad.
Hmm.
Oh, come on, dammit, somebody I learned how to type, I promise
Thank you.
so what you'll see here. There's a there's a mount Flash Directory out here right It's a mount point.
It's a directory, So now I can go to temp
I can do a cry. Fs
I can say. Let's take Mount Flash, is the encrypted side, and call it crypt.
On this end, whatever I want to call it, I can call it my mother the car.
It doesn't matter what this is, call it just has to be
And let's just choose the default this time.
right, right.
And I pick a short password that I can remember
Now it's deriving the encryption key. That is one annoyance to this.
It will take about 20 s each time you mount the file system to come up with a it has to get enough entropy I don't know what it gets.
It, but it has to accumulate enough entropy to get some random numbers to use for insighting it.
So now I can look here at Crypt and it's a big, empty file system.
If I do date greater than crypto Bar
Okay.
That's familiar It's today's date, right?
Right.
What about seeing Mount Flash? What do you think
Gibberish, So now let's just say somebody gets this.
Somebody picks my pocket, and they get this thumb drive.
What do they know about it? Pretty much? Not like
Anytime I want to mount it. I stick it in now.
You can use auto Fs with this
Auto mounted. You're gonna have to type in the password, but
That means anytime I stick stick this in no but thumb dry.
Doesn't know anything with F, 2 Fs. It just knows the standard file system.
If I go to the unit command, so I can do a find amount Flash Ls: minus Rl Mount Flash as far as unix is concerned.
This flash drive is a standard file system that has a bunch of files in it.
And now it's interesting. They all have 16 kB files, but so far as the thumb drive is concerned, it's not doing anything exotic It's storing a bunch of 16.
Okay, a binary gibberish
Kilobyte Files
If if you drop a file into that flash, flash, drive it
It's encrypted. So let's say I go to Kara.
Etsy password greater than crypt password, let's say.
Just just
Well, I want to back up my password file
And I'll say I want to. I mean, if I were super user.
I could cat se shadow here, all right, You'd notice all I did this copy this
Right.
In my grip. Right
There you go! That's everybody here. What's on my plash?
Drive.
Right.
Gibberish.
I mount it. Well, how do I mind it? I'll show you
If you do cry Fs minus Help!
Oops, and you buy it to less
2 greater than 8%, one the last
You will find
The first one. God damn it.
There is a cry, Oh, probably At this you mount my mistake.
And I unmount. Chris
Crypt is empty
Well how do you find it
It's no longer there, right
My flash drive. It's still mounted
It just says you were showing it. Now I can unmount the drive
Okay, this is a thumb Drive not on my slaves.
I can stick that back in the machine
And I find out that Sda is back here again right nothing.
In Mount Flash, now
should be in my mount, Flash with users the default users no auto.
Yeah.
There you go!
Kind of my stupid
Right.
Where are you saying? My thumb drive is remounted
My thumb drive is still full of gibberish.
If anyone stole this and they mounted it at home.
All they'd see. Now let's say I want to know what's on it right eventually.
Yeah.
You're gonna say I want my port. So I cry Fs.
Slash, mount, flash, drive, now correct.
Right.
I've got to remember the pass phrase
Yeah, 10 to 20 s. I don't know where it gets the entropy, so it There may be a way to accept that.
And there's your 10 s, or whatever
I don't know. But now what happens is, what do you think?
I'm going to see what I look in, Tempric, right?
I'd heard
And in 10. Rip right now.
Hi!
I'll see you. Today's date.
I see my password file
So this is a really nice way. I mean, other than having to type in a pass phrase, as long as the past race is very easy to remember.
It's gonna be really bloody, difficult for anyone else to find out what's on that.
That thumb, drive.
No one thing I can do
Well, then, I use Laura to type. Block size equals one Meg.
Let's say, count equal. One o 2, 4,
Writing, 1 GB
Will come on down. Oh, alright! So this is gonna Sit here making the drive fly.
Now it's going to take a fair amount of time to encrypt stuff, but I'm The drive is is flashing right now.
So other than zoom, eating one processor for breakfast.
Well. The Chinese check all my content. You notice that cry Fs really isn't up here.
It's not eating that much CPU: Most of what you find is I'll wait trying to write to the thumb drive
You should say, file names, right? 2: Okay.
Does that make sense?
Oh, what was that last statement
So you up here and top all these I/O wait numbers.
Yeah, yes.
That's all the the way time writing content onto a thumb drive
that's because of the speed of a thunder right
Yeah, tha throat is slower than out. So.
But you notice here zoom isolated web content That's that's Firefox Zoom are getting the more more, if anything, USB storage is eating a paramount.
Okay.
here's cry Fs: It's down here.
So if you look at it, the amount of CPU, it's really using Isn't that much?
The overhead of performing encryption on modern chips, and this is a 10 year old.
Computer is is negligible compared to the speed of getting into storage.
Yeah.
Even if this were, I think it's done. Yeah.
That's a few. Choose a Yes, and you have hardware support for that which is most processors do.
Call it, and they're well, and there are faster ones.
If you look at the one when I when I initialize the file system, I could choose which one to use.
And there's some to trade speed for for crackability.
There are some the trade speed, or how you know you can get slower, less crackable.
You can get multi pass. You can get all kinds of fun things. But right now whoops oh.
Zoom is eating my bloody machine for breakfast.
Yeah.
Takes a long time to send all that junk to the Chinese.
Well, no, they just have to decide. If I'm saying, Tian and square or not, I'm not joking this.
This this is running. But oh, I don't like God.
I'm an idiot. I was typing on my regular keyboard, which is a USB.
Which I am plugged to get the day. Okay, forget it.
I'm stupid
And if you look the big file is a whole lot of no bytes Right is it was Deb.
0
Okay, it's got to translate the English to Chinese mandarin
That makes sense right? Everybody agrees.
okay. But now, if I look at
This is looking on the flash drive that's being increased right
If you look at any of the any 2 of these files.
E 2 that are adjacent. They're different
And then you 2 different directories. They're different
So if you were looking at this carefully, you notice something.
This thing created. How many files? Let's see.
Oh, mount! Flash!
right.
You start to see why I failed at typing in high school.
So creating one gig created about 64 k files, which is right because they're 32, K.
Each, but they're all different. If somebody wanted to try and figure out what was on this thumb drive, they wouldn't have much to go on to try and analyze, because you don't even know what order.
These, and all of this gibberish
I mean that always take it out of dev 0.
I mean the Is it really much in there? You can tell?
But this, all this is all the encrypted gods is 1 GB.
Of of no bytes, and it doesn't really give you much to go on
That's why I think this is a better encryption system. Because if somebody did get this, drive they've got no idea whether it's one file or 300, because they're all the same chunks what does it look like, when I mount it
It looks like big file and flu bar and password
Hmm.
Does it make more sense now? Stand
Now this thumb drive is one way to do it. What if this were dropbox?
What would you do? You'd Mount Dropbox on slash, mount, slash, dropbox, and you type crypt.
Mount dropbox, tap, foo bar. How can we call it anytime?
You look in Foo Bar, you're gonna be looking at the decipher content that was put out into dropbox
The machine doesn't know or care what's in Mount Flash right mouth flash could be. It just right.
It could be a thumb drive. It could be a DVD.
It could be another feature system that's mounted on a 3.
It could be dropbox. It could be Amazon, Brian, maybe Google drive
It's a directory, mount points, and unix, or directories.
Quite a bit. Yes.
Everything's a file, right?
So once I've mounted one of these things
I could.
I could mount a dropbox on Mount Flash type, crypto at Cryfs Mount Flash!
Right.
Correct that I look in crypt, and I'm gonna now what's gonna happen is, I look at this, and every one of these files is gonna have to get pulled across the Internet for me to see it But here's a cute thing a classic problem with a lot of encryption systems.
Is your deciphered file Is cat. So anyone could get into the memory, can see the whole file because it's in a standard location, or it might be actually being in temp or in our school.
Something the way this thing works, You only get cashes or the encrypted blocks.
At that point. Even if someone breaks into the memory on your machine, all they're going to see is a bunch of blocks of jibberish
Yeah. Now again, part of the tuning issue. If the blocks are too big, you waste space, and if the blocks are too big you can't see the first part of a file until you've moved.
Let's say I'm a megabyte of data over the Internet.
Okay.
If you're on a slow connection that could be painful.
Do do you
If you got 4 k chunks, you're moving smaller pieces to see the next piece of the file.
Stan
Do you have Do you have to pull the entire file system over in order to to deal with these?
I haven't played with it enough to know yet. Honest Answer.
We could find out. Well, I don't. I don't have any, Nick I don't have access to any network file system right now.
I gave up using them dropbox and the rest, but I believe it decipher's them in the order.
It finds them, and presents them to you as they come.
Just my recollection from reading the documentation
If you've got a truly huge file
I believe it. The cypress it has arrived
But again, one of the uses one of the intended uses for this. Is it byferring things that are on the net
Because you can incite for a directory, and if that directory is the Mount point for your dropbox space, even let's say you've got dropbox and it uses their folder, system.
They look like directories on unix. You could have Mount Dropbox Slash and krypti.
Whatever you want to call it, and you could encrypt a subdirectory of your Dropbox Mount point.
You could be as deep into the file system as you want.
All it has to be is a unix directory that's empty when you start that a unix directory that's empty for the deciphered place
So you could encrypt pretty much anything. A thumb drive, you know.
You could have an external If let's say, this thumb drive we're a plugin drive bay.
This could be an SSD drive. This could be, you know, a a big scuzzy drive that's in a with a USB. Connection.
On it. This could be your local household band system, Crypt.
Fs doesn't know where it's storing things.
It just knows it's writing them into a directory.
It's the unix file system. It's writing a bunch of files in addressory.
What's underneath that directory? What you've chosen to mount under that directory is entirely up to you.
It could be a thumb drive. It could be anything
Or does it
You look unhappy, Stan. You're the only person I can see on the screen.
No, I'm I'm
No, I know, I know I'm not unhappy.
It's got amount of what just just use. So I I I'm sorry
I'm I'm just trying to, you know. Add 2 and 2 and get 5, you know.
See what comes next, you know in in
Well, what happens when you mount something when you mount anybody, when you mount something under directory, what happens doesn't hide it.
Well it hides what's below there
It shows it to you as a directory. Very. That's it.
Right, right? But it it hides with Yeah, Okay.
It's once you have a directory mounted, you have a collection of files, because everything on unix is a file, right?
All the Directory has is a bunch of files in it where those files are physically stored.
You have to check the Mount command to find out the physical storage is in the mount.
Command the Ls. Or Find, or Df or anything else.
They don't know anything about where the storage is located.
Right.
They just know about files
Under that directory you look in the directory. You see the files, Harry.
At that point that Directory what storage is mounted.
There is entirely up to you. Cry Fs has no way of knowing from its point of view.
Where the physical storage you're pointing things on would be located.
Who's that? That's a directory
All that happens is, I take the physical storage, and I represent it There's a bunch of files to the operating system period, that's all.
Mount does. If it's a local disk, ride every time you do a list, and ls of it.
They? They know it's in that mounted point under that directory
The only deflects. If it's a remote disk drive, if it's in Fs, you mount nfs under under Directory right
So, if my directory melt, flash, is an Nfs.
Yeah.
On my my family dance system. I can keep my board secret from everyone in the family.
the so you you you got a a shared mount point across across across systems, Good.
Right.
You can't both be encrypting both sides.
Can't have it open for right. And the problem there is the names of the files are randomized, and it's too easy to get to collision.
Someone on one system decrypt and another personal. A different system. Also use that Cripp Fs
Anything you can do that will prevent collisions will make the file system easier to decipher, because it will make the file names predictable.
Now that said, If I have one of these mounted for right, I can have it mounted, for read is often as I want
Okay.
Okay, okay, okay, yeah.
You have all the problems, the synchronization problems with somebody reading a file that's half written.
Okay, That's
But if I have it open for right, let's say we're trying to share data.
And let's say I'll give you. This is a real example.
We're a university. We're trying to share data and we don't want other people looking at our data because we don't want people stealing.
It so I can have the thing open on one machine on nfs per right, mounted.
You could mount the same file system for Reed with the same password, and you can use cry Fs to read it all.
Cry Fs doesn't get upset about the file system being mounted.
Read only until you try to write something to it. It says, I'm sorry I can't write you, but if all you're doing is reading from the file system, you can have that mounted, for.
Read, and you could do whatever you want. Another thing you could do if you wanted to have encrypted data.
Because let's say you're using something like Amazon.
S. 3 for storage. I can have 2 sides of an Etl process one.
Doing the intake. It could be pulling stuff in from the net as fast as it could, Writing to an S.
3 file, system. I could have something on the other side consuming that file system again.
Bye.
Yes, that that's a the solution. I was trying.
As long as it's read. Only on on 2 or 3 or 10 of them can all read from it at the same time. But only one person can be writing did that make sense
I I couldn't describe how. But you you did a better job of of explaining it, So it it it.
Okay, yeah, thank you. But that's yeah. You could well, and another thing.
You could have. Let's say you've got one Nfs device, and 3 people haven't mounted at the same time.
It answers what I wanted to know. Yes.
Remember also you are encrypting a directory. So let's say, everybody in the family mounts this system in Slash Mount Slash, Nashville.
I don't care. I don't care Mountain, as drive.
Everyone's got mountain as drive mounted. You can create a subdirectory called Mount Nas.
Drive, stand, and if you encrypt that nobody it's all gibberish to everyone but you.
Now you'll someone else has that mounted. They can create Mount Nas drive Foo Bar.
You can't read their food bar. They can't read your stand directory because we're encrypting a directory.
The map, you can create a directory below the mount point.
You could have one flash drive with 3 different encrypted file systems on it, with different passwords, because I could have mount.
I'll show you. Let's just say let's see.
I had this thing did. I met that before around Nope.
So I can do fry fest
I can type on the correct keyboard. Priests.
Dash you may unmount. Slash, count, slash, crypt, doing
And it's gone
Read.
Mount Flash is still gibberish. Right? So let's say unmount flash
Yeah, become as you minus. And that takes a while
Sorry higher authority. So we've unmounted that
Right.
There we go.
Is it F. 2 S. Or F 2 Fs.
Yes, too, and Fs. I failed at typing. Su me
Well, I I thought it was just a matter of memory. I have sometimes don't remember what I'm typing
Well, I can't remember anything either, so I It's good even wanna Remember, I can't type it.
Okay. So now I can mount
Part of it is, I learned to type on a Vt keyboard. Vt.
Keyboards don't have an escape. You learn to type control left square bracket, and I did that for control.
I as a tab control J is, the return is is a return control.
J. Is a new line control left square Bracket is in a escape, and so I still use control list.
Square bracket, because I learned I spent so many years on Dt.
And it became reflex. And it's just an it it's anyway.
so if I mount mount flat Oops
Now have sda one
So I could create a directory. Now, Flash, Steve, or that this
Cool.
Oh!
Hmm.
I'm not gonna figure out why I didn't like me this time.
Oh, that's why
Yes, you do. I'm not at work. I'm at home
So I can do Maketer Mount Flash, who and bar
So I can have 2 different projects. I can have 2 different people.
If this were a network, storage drive, I can have 2 different teams using their own sub directories on the Mount Point.
I could have 2 different home directories mounted on the drive.
Right, Let's say I've got home mounted on a from it, and Fs.
There's nothing with this to keep me from having 2 different users, and have them each encrypt their own home directory.
Okay. Now I can do a cry. Fs.
Hmm.
slash, mount, slash, flash, cool Ted crypt
Well, now I wait 20 s. I do. The Dd.
With a Mega data
You obviously haven't. You obviously have not read much of the new documentation.
Bam bam, bam, bletch floor, Who bar problem?
Kate is, is one of the the originals. If you read the original documentation that Stolen Mcgraw wrote, for Make good new make from the 1,900 and Ninetys.
Ledge
It was full of provocates.
But
Well, but notice something here
Okay, I yeah, I've got the book somewhere. I know I've read it, but I forgot.
Not
Crypt has one file flash, right
Mount, who is mounted under crypt. So if I do, an Ls.
Of mount flash, Bar. It's empty, because that's not what's being mounted on the flash drive.
Right.
It's a directory, right?
Hey, Fuzzy, what you expect? Gibberish
10 MB of gibberish
Right.
If if the
Can Can you expand that once you've created this, can you expand it?
Yup
I think because it's using blocks. If I extended, it would work the way to check.
That would be to Yes, I know it would work for the simple reason it's using the name of file system to store the blocks.
Or do you have to recreate it, or or how do you deal with that
So let's say I used the logical volume for this right.
I could do an Lv. Extend, and it grow Fs and there will just be more free space for cry Fs to start using.
Right.
Cry fs is not encrypting the bare file system cry Fs is storing files in a directory, so cry Fs.
As long as there are 0 Byte free it doesn't know or care how much more free spaces, and it doesn't know or care what the file system is doing with them it just has to be able to create files and a directory so Yes, if I extended.
The free space cry Fs would just use it without caring.
Yes.
Is it intermixing all these little bitty blocks?
It wouldn't know the difference.
Please, or or
Each each block on here belongs to exactly one file. This is one file that has been chunked up into fixed size. Pieces.
Each piece is encrypted. If you have you, let's say you had something that isn't even multiple of the the block size.
Okay.
The right block at the end is going to be just as much gibberish as as any of the ones in the middle.
Right, right.
You saw what happened, what I mean. If you look at these files, if I look in, you know if I do a less of crypt Blch, it's zeros right.
It's yes, zeros upon zeros, upon Zeros.
Right.
It's no, it's dead 0. It's just a whole bunch of 0 Byte, right?
If I do a find mount, Flash.
Bar.
Right.
Oops, who
And I spell it right. It's gibberish.
You have a hard time figuring out that that was 10.
Meg of 0 Byte
Got files? Okay?
Do you see my point now? If I had done 4 kB blocks, and I picked an odd number of them, there would be A Runt Block at the end
These are 16 K. Chunks, and I I would have a 4 kB chunk at the end of it.
Well, at that point there's going to be 12 K.
Of nothing that gets converted to gibberish, and it's up to cry Fs to know this file.
The real data in it is only that much of it So when you're done deciphering it, ignore everything.
After that chunk you're ignoring, after every this offset, in the very last file.
I actually believe the the enciphering can cause the total space to grow.
I've forgotten. You know the details of all the different methods you could look those up bye.
There's a certain amount of encryption metadata that gets written along with the original data so encrypted, data tends to be larger.
Then the the actual data. If you really want to drive the CIA crazy, you g zip it on the way down.
Because then the the data has got all the redundancy taken out of it, and it's faster to store because you're not encrypting as much
So I could take
Well, let's see I don't. I don't have any really big files on here
there is a
Okay, here's a file that's reasonably large.
So this. Is that's big enough. That's the the answer for Jen, too, so I can copy
This thing.
To crypt. Now, yeah, Correct: Oh, I'm sorry to correct.
Now you can't see this, but my drive isn't flashing yet until I hit Sync.
Now it's flashing. If I look
Yes.
Encrypt. I've got an iso file right
Okay, if I look in Mount Flash, who
You know
There really isn't much you could tell me. Yeah, no.
Yeah, it's it's all gibberish.
It's all random blocks if we look in the Ff.
6 Directory.
It. It's all gibberish. You couldn't tell me if those blocks came from Dev 0 or the iso file
Now the great thing is
If this is again this is a thumb drive. But what if this was an Nfs storage system?
And I had 15 directories owned by different people
Who's got his data unless you know the password.
and they could all be using, or most of me using, different encryption.
You've got no idea what food's got. This can be on the Nas drive in the middle of a university with 50 people looking at it
eat LED csa, or Rsa, or whatever.
Whatever everyone can use their own met method. Everyone picks their own password.
Yeah.
All of us are storing everything in the same place, and none of us can read each other's data unless we rip off the baskets
Right.
Did that make sense? And then you know whatever Yeah, this is, Bar, you know, if if I have a different encryption.
I can do a cry. Fs
Of Mount Flash Bar, and I could mount that on on crypt 2
And crypt is kind of nice. It'll it'll create the Directory for you.
Now again you ask the question. These are all of the different encryption.
Does anybody know about? I mean, I don't know the trade offs between all of these between 2 fish and serpent and Aes and Mars.
Yes, yeah.
Does anyone play with these things? They know the difference.
Anybody
no, I mean
Everyone with a heartbeat. Say, Hi, Steve!
Okay, that's at least 2 of you awake.
okay, No, I don't know the difference between the the name titles.
But you see, the anyone that wants to research these, there's always some kind of trade off between size and speed, and decipherability.
I don't know
I don't know the difference in the main titles that I'm intrigued by the suffix.
But I don't know what it is
Right. If you want to. You can look them up
Greatest common, multiplier, common something by. There are different ways of taking the data and chunking it.
But anyway, anyone that wants to, you can look these up and pick the one you like
And again I could, if I'm storing things like Cds.
Hi might go for 7, because I know these are all bigger than a megabyte.
But now what we're going to see this guy here
Now I'm logged in this myself in 2 places.
But if I copy this thing
Correct, 2,
Alright. Anyone looking at this from the outside
Yeah, these are 2 home directories for the who in the bar users
Nobody else looking at this, can see what these mean unless they happen to know the passwords
I might have one directory for my backups. It has one password and another one for financial data.
That has a longer different password, and I can put the 2 of these things on the same flash drive and that way.
If somebody, if some kind of malware sex tries to set the machine dry, it won't get all of it in one pass, because both of them, if both of them are mounted, they're gibberish and they have different passwords.
So you can have again the main use for this would be if you're using dropbox and 5 people share the dropbox location.
You can each have your own subdirectory, and each of the subdirectories can have its own encryption.
Key, and none of you step on each other
no, no, no, no! I'm I'm just wondering if you could use it with sync thing.
What's wrong, Stan? I look like I gave you a headache, man.
You could use it with anything, anything that you can mount on Linux.
I imagine you could. Yeah, I imagine you could? Yeah.
Once you've mounted it, What does the mountboy look like? Hi!
Directory. That's why unix is the way it is because everything's just a file, And once you mount a device under a directory, it's a directory it's full of files.
That's what these are. If I took this encrypted data, and I I was running out of space and I mounted it, and I copied it to a bigger thumb drive cry fs wouldn't care.
It's not and it's it's not like, Yeah, What are the problems managing oracle databases And they still claim you have to use raw physical volumes for the storage.
Because it's so damn slow. They can't handle the file system, but that means you can never increase the storage on any one volume, because Oracle doesn't know how to understand that the file system grew
This is different. It is using the unix file system to store individual files in subdirectories.
So if I take this flash drive and I copy it to a bigger flash drive, and I mount that bigger flash drive.
All I've got is a cry Fs system with more free space.
Pry Fs doesn't know work here, because I'll cry. F.
Sees it. How unix file system and all that is is directories and files period and cry Fs doesn't care if it's A subdirectory cause I Can look in mount flash
Now I can have bar and food, and they look normal, right?
They're just ordinary directories, and through is one of these
And bar is another
Those are 2 completely different files systems. They have different passwords.
If you speak my thumb drive, you might guess the password to one, and not guess the password to the other.
Who knows? Again, if 2 separate people wanted to have their own private data on the same well, not a fun drive, but on a large network file system like S.
3, or or company Nas. You could protect people's data from each other by giving each person their own directory, and having each person encrypted separately, and unless they can get you guess each other's encryption keys hey?
A directory or file
Can't see each other's directories, even though it's on the same file system.
Right it. The way it works your file is first broken into little chunks, then each of the chunks is encrypted in memory, and then the encrypted content is written to the disk ride so the decipher comes is never written to the disk
And at that point, if you look at one of these files when you read it, it starts reading chunks and deciphering them.
That's it. That's how it works. And I think it does work in more like a streaming mode because as long as it can get them in order, it decipher them in order, and spits them out in order.
if you have something like a a document or Pdf.
Or something that has to be pulled into memory. All at once.
You're just gonna get all of it. Memory, if you have something that's yeah, if you're playing DVD: and you've encrypted your movies, for whatever reason, you want the Chinese to steal them as you play them.
On zoom, the
The the content is gonna be chunked. It's going to be pulled off the DVD.
In fixed blocks. The blocks are going to be deciphered, and the blocks are going to be shift off, shipped it off to whatever you're using to play.
It.
Oh, your porn experience won't suffer
And they could encrypt it locally and then transfer it up, and you would still work, cause it's a file
Come on, Stan. You're supposed to laugh at that one
Always I was thinking about it. No, no, no, no, no, no!
What's wrong. It's just keeps looking like I'm giving you a headache, man.
Okay, well, I mean, does this make sense to most people? I stand the only one I can see on the screen.
That's why I keep picking on him. But does.
I'm thinking about different pathways, like the
does does this make sense to most people
Have I scared everyone off
No, yeah, I'm very muted. But but yeah, I think, yeah, it's making sense.
Oh!
You don't have to all mute. E your site, everyone can say, but wait and or feel free to ask questions. It gets boring.
Listen to me for an hour
yeah.
Yeah, thank you. But again, the point of this is that it does not encrypt physical volumes.
I didn't encrypt my thumb drive. I use the thumb drive to store, encrypted files.
That's important. Again I I could take this thumb drive.
I could copy it to a bigger thumb drive, and I could use it just fine.
I could take the thumb, drive, and if I'm using it a lot right now, I could copy the entire contents.
The thumb, drive into a temp. Fs: I could do whatever I wanted on the 10 Fs and copy it back to the thumb drive.
When I was done, our sinking
Yup, if you lose, if you lose one of these small blocks, how many of them?
The
Well, you're gonna have a file with a whole waiting, depending on what you're doing.
Okay.
If the original content was a huge, huge Ascii file, you might be able to work around that.
Yeah, right?
If it's a Pdf. You've got a, you've got a problem.
If it's gzipped and cipher data that's stored second and cipher, You gotta even, you know one thing you could do if you really want to drive the CIA, crazy.
I could take one of these volumes and mounted, and then mount another one, and I could, double and cipher it all with different block sizes.
Okay.
You know anyone looking at this is gonna be looking at the encyclopedia version of encyclopedia, And there are times when you double inside for data.
If your story nuclear launch codes and things like that.
So there's nothing to keep me from having to, from using cry Fs.
I could mount, mount, flash, foo on mount, slash, bar, and then cry, Fs!
Mount bar on tech cry fs and everything. I would be stored would be passed through.
Cry Fs. Twice with 2 different passwords So if you really want to be paranoid, that the CIA is watching you, you, you can multiply encrypt things and break them into different size.
Chunks, and nobody's pretty much gonna guess at that point
It's like one time at the Pearl Boot Camp.
People were wondering about using Vmware, so we installed a copy of Red Hat in my copy of Susie on my notebook and then wondering how far I could go, so we copy We installed a copy vmware inside the virtual machine and installed a copy of I forgot what else
inside of a copy of Red Hat, inside of a copy of Jin to running on.
Eventually it gets slower. But you see the point. You can nest these systems, and the nesting is important, because the thing underneath again could be network storage.
It could be another fuse system. So, for example, S. 3 Fs.
Is a pretty simple way to store your data on S. 3.
You Mountain S. 3 volume and each file in S. 3 is a file on your local file system.
Okay, But maybe you don't wanna store all your data in S 3, where other people can steal it.
So after I've done mounting the S. 3 volume, I can cry a asset just like I did the thumb drive.
And now, if somebody breaks into your bucket on S.
3, all they're gonna see is a twisty little passages, all the like to see a bazillion.
Tiny files that are gibberish, and you're done.
You could even take that cry. Fs: Config file, that you could.
You can tell it. You can actually take the cry Fs.
Config and move it out of this area because one of the command line options for cry Fs: You could put the cry Fs config, file on a different volume, and at that point anybody who steals this has got pretty much 0.
x e z y
Chance knowing what it means, because there's nothing. Yeah, I mean, even the question is, config file is boss
So yeah, I mean, you can. You can separate them, And mainly, you do.
You could do that either for performance reasons. You could store the metadata locally, and then the enciphered stuff off site which makes it more secure. Does the metadata have to have access to the metadata to put the files back in order
So it's an enormously flexible system.
And again, because it uses the unix file system and unix files to do its storage.
It's easy to manage if you use logical volumes, you're running out of space.
You do an Lv. Expand you grow, fs it and bang you got more support.
Cry. Fs has no idea how the blocks are being managed.
I'm sorry. Higher authority. Yeah, it's I thought I left it a lot.
Oh, shit! Hi! All
We're getting feedback of some kind
we were wondering where that buzzing noise was from.
command.
Oh, yeah.
didn't you say? Left her at a restaurant
Yeah, that's what he said. Yes.
Hmm.
Yup
I can't wait. Hmm!
I guess you all just heard. My dog his his happiest moment in the evening is before he goes after A.
The
Walk we all have a group. How Hello, Benny! You may not be able to see my cat in part of the camera, but yeah.
we miss that
Hey!
So the dog gets his group. How every evening that's his, the self realization moment
Oh, I thought the sound carried better than that. Well.
But yeah, that's so. What you've seen is cry Fs: and again the main, the important point about all of this at all.
A few, is, that it's all just directories and and and files.
If I'm using S. 3 Fs. Then your files are getting stubbed into S.
3, and there's a bucket. What you mount under a local directory with S.
3 Fs. Is an Amazon, S. 3 bucket, and then I store the file names inside the bucket, and I may have to translate the file names so that they're storable in S. 3.
Format, But you, looking at from the top dell, I have no way of seeing that.
All you see. Is it directory where it files any?
It's not up to you to know where the files are being stored.
That's the whole point of unix, and V Nodes, and mounting something.
What's that thing is mounted? What is it? It's in the unix file system.
It's directories and files. Where are you that that's any kind of mount, use any anything is all?
It's just directories and files, that's all.
You're gonna see.
Does that make sense?
Well, and then the neat thing is, you can, Daisy chain them so I can take S.
3, and if I mount S. 3 under slash, flash, bar, I can have cry Fs.
And I tell us who Bar is on tent, crypt.
Pg. Ted Crypt looks at food, bar it cry.
Fs has no way of knowing that the blocks and the bytes and the encryption that it's writing into this Directory are being shipped over a network any more than it can know that they're being shipped over a fiber cable to a drive anymore.
That it can know that it's all on the Nas server anymore, that it can know that it's on the the boot drive of my notebook It has no way of finding out it's all just local stuff.
It's all just storage. It's directories with files in them period, and that's one of the biggest powers of fuse is like in day.
I can daisy chain these things I can have Dropbox mounted somewhere, and I could Take cry, Fs.
And if I take the dropbox Directory is the first one, and Mount Crypt is the second one.
I look in Mount Crypt pride. Fs has no idea that these bytes that it's writing are getting shipped over a network.
Get you sees directories and files great. Now part of it is, I can create a a file system a 150 like deep in cry Fs: It's gonna look like these flat fires with directories because the whole thing, is encrypted It gets converted to a flat file.
System on the storage, so I can have subdirecties and sub subdirecties, and sub subdirecties.
Anyone that looks at this is just gonna see one flat space of next 3 digit hexes and and sub directories with, you know, and files in them.
They're all the same size, and that's it.
That's the way that goes
So it's it's a pretty robust system, that is.
It's quite simple to use you. Take a directory that's going to be encrypted, and you mount it onto a play on onto another directory that you're gonna see, the encrypted content yet what's underneath the encrypted directory what are you put there a
disk anas a thumb drive. No idea, no one cares.
I if my thumb drive is getting old and I'm worried about it, I can copy all of that stuff to a directory on my the hard drive on my notebook, and I can mount.
It.
As long as it's a directory and as long as I didn't lose any files when I copied it, isn't gonna know the difference.
it does to me.
It doesn't care, it shouldn't. That's the whole point of unix
As far as you know, are there any security issues on this using this?
Any what
The main problem with it is, you can't have 2 people mounting the same thing for right at the same time, because there is a risk.
Not a guarantee, but a risk that the 2 we'll write the same thing at the same time, because the randomization, with a single thing writing it can make sure that it doesn't overwrite an existing file that's part of the problem when you write one of these things is that the
file names are going to be random. You have to figure out what to do about collisions, and you have to figure how how to store the metadata.
If you submit round, Robin it, somebody can go down to the the file system, and if they know how you do the round robin they can look around and find things.
If you use peer randomness, you get collisions, so you have to find a way of allocating unused files, and you cannot.
Have 2 separate processes doing that
Because the separate process that performs the mount, each of them is computing its own randomized places to put things and they're gonna collide period.
Any vulnerabilities, or anything like that, or
Eventually they'll collide. But again, if you mount it for right in one place, you can mount it in, read for another, and if you have it you, can mount it for read as many times as you like, and no one cares
Yes, and in fact, if I'm the same user id multiple user, ids can read and write, it can read the file system at the same time, it's just different user, ids, even if you're super user.
If you try and look in there. If Joe Idiot Re mounted it, nobody but the Joe Idiot user can rate it.
What that means is that I can have a I can, for example, have a restricted user with a hideously long password or a cron job where I don't even need to encode the crime job It It just if it's password I can hardwire the password into something that
Reading and writing, uses the same password
only that user can see. And unless you can crack that user Id, you can't see the contents in the file system, even if it's mounted all day long.
So it's Yeah, it's pretty good. I mean, fuse.
Is it perfect? If you want to say that anyone who cracks my user Id can't see it.
there There isn't a system yet that will mount things privately to an individual process, except for using something like temp effect and and bounding it in core.
And then someone has to hack the learning Linux kernel to see the content. For the most part, most people find that their own user Id is a sufficient protection
For example, if you've got a let's say you have legitimate pass phrase on your Ssh keys and you use a reasonable number of bits in the encryption at that point you could ssh into a box and 15 people can ssh in with a shared key.
Get in is the same user share the data. But now, because it's only mounted once, 6 of us can be writing into the directory because it's only mounted once, but anyone else who is logged in is us kids can't see?
The context.
So that works
You just have to have one mount point writing it 21 time.
If it's mounted, and 4 of us are logged in is the same user Id We can all see the contents. We can all right to it at the same time, because it's only one mouth point
if you read the website, the limitations on correctly detecting the fact that the file system was mounted for right multiple times and correctly detecting the fact that files are corrupt is one of the things they don't have perfected yet and the issue of what you do about lost blocks, you know if you can recover a file or
not again. If you're using a networked file system, you might get into a situation where one of these blocks doesn't arrive because of transmission problems.
So you can skip it, or not. You can do whatever if you skip it, you get the same effect as a scratch on a CD.
You have to go further ahead until you can read the metadata well enough.
So, for example, Cds. And Dvds are written in chunks with a new header every so often.
If you get a scratch on the CD, you'll get noise you'll get gibberish, but it'll skip over to find the next place that it can correctly detect the header then It'll start reading from the new the new block offset This will Give you the same effect there's a
scratch in A CD. Where you may be able to read past it.
Find a new chunk that has a correct metadata header, and say, I've located the correct metadata header and just keep going.
In that case, losing a block is, doesn't lose your whole file.
If it's a gzip, file, you're kind of up the creek, and again they're they're ways of dealing with that If you're gonna use a file system like this And the network.
Might be glitchy. You can take your Gzip file.
You could chunk it with split G. Set them all into one file, with separate Gzip Peters, append them all, and if you lose one chunk you won't lose the whole.
File You just have to skip to the start of the next trunk.
That's valid. You live with it if you make, if you g zip it with a chunk size, and you align the chunk size of
of cry Fs to the chunk size of your archive, you would lose one chunk, but you might be able to keep going, because they're aligned in the archive.
Says Oh, I drop one file, and it goes along with the archive things is the next file.
They're all kinds of ways to work around it.
You know, backing one great thing about this is because these files are stored as a normal file system.
It's trivial to back it up. If you have something that's really important, that you're storing off site.
And it's encrypted. Do a simple thing, store it locally, and our sync it into the net.
At that point you usually use the local copy, but the one out in the net is gibberish.
If anyone steals it, our sync will very happily duplicate and delete all the blocks to make it match.
So you are, sync it every so often, so that you've got a legit copy in the in the net as long as it doesn't blow up in the middle of your R.
Sync while the drive is failing, your backup will be a reasonable, but the fact that it's stored not as an encrypted volume, but is a bunch of encrypted, files in a normal file system means that You can back It up with our sake which you can't
do with a lot of the others because they're not using a file system.
They're using an encrypted volume, and you have to know the underlying binary.
To even read it. You can't. There's nothing to arson
10 min warning.
Does that make sense to people
Everyone. Get yourselves the hell off of them mute. This is I mean I'm getting scared here, man.
so do you have to
Good drifting to a a slightly different view of this.
So? Hey? How? What is the encryption look like on the inside?
yeah.
I mean, there has to be something the when files start getting encrypted that it can put together the the the file, names, and the structure, so that would be a clue.
Yes, that's he is
Sure there's always there are.
For somebody decrypting the file because
Okay, So this thing is these guys here, these 2 process, these 3 processes, those are all copies of things that are encrypting file systems
Period. I mean that that's just the way it is.
Yes, if you used the file system times, you could find out something about the files.
If you if you're really worried about that, do it.
Obviously what survey so often do a touch on the entire file system
If you want to. You could take the the config file and do a touch minus F, and take every file on the file system and make its timestamp exactly.
then you'll hear. All 80 is farting
Match, the timestamp for the configuration and there'd be no way to know what order the files were.
Written.
Depends on how paranoid you want to get, even if I know that files are more or less.
Now one of the things that happens, if you write the same file out, and only part of it has changed.
Okay.
You might get a piece of a file written, but it doesn't have to rewrite all the other blocks.
Yeah.
They're all ready encrypted where they belong.
So you might get a file if it's been alive for a while, and it's been updated more than once.
Hmm.
You might find that pieces of it have completely unrelated timestamps, so you can't just put them together in order of time, and find out what you have.
But if you really wanted to be paranoid every so often, you do a fine, and you do a touch minus F minus a minus M.
of the config file, and you reset the entire front and file system, so that every file in it matches the timestamp of the And And at that point there's no way to use time to estimate what's in
if you like, I said. If you really want to be paradigm, have a flash.
Okay.
Drive mounted on Mount Flash, and do a cry of fs of Mount Flash to crypt A and do a crypto fs encrypted, crypt B Everything You're right, gets turned on to crypt a everything there gets written onto the flash, drive in in mount flash, you have to
So I think here. So. Okay, let's say you've got you You got a device which is described by a 100.
do 2 unmounts to get your drive back, but I I dare anyone to figure out what the hell is in it, especially if they have different block sizes
What are they called segments, or the
Okay, So 100 chunks. So to to decrypt it.
Files. Chunks call them chunks, for now
I believe it's I I believe it's I believe the way it works, because I tried doing it where I I encrypted A CD.
It has to go in and decrypt each of the 100 chunks, and then
And I was able to read the CD. Without having the whole thing in core.
So I believe the ciphers it. It's more of a streaming approach.
If if you're reading the file as it's being deciphered and discarding the blocks, it's just gonna decide for the block by block and hand it back.
You because that's if you think about it. If you read the unix file system, you would get the content in pages, and if the file is fragmented, remember that the unix file at least the Bsd file system, could have you know first and second and third indirect file storage because
it's got to read a block to get a block of blocks to read a block.
Remember that stuff. Does anyone else here? Remember how the file system works?
The page table, or the first indirect, or the second indirect, and the third indirect.
So what ends up happening the unix file system really is only capable of delivering you blocks in order as they are read
Yeah.
Yeah, but you you you you wouldn't know how to reconstruct any particular file until it's deciphered.
This is just gonna give them in chunk-sized, deciphered pieces as you read them back
Every chunk.
yes, you would. Once I remember these these. The chunks are individually in cipher Once i' the first chunk.
Right.
I have that much data I can hand you deciphered.
Right.
Okay. But how do I know? How do I know what file that jump goes in?
Hi! It's
I I would imagine.
I then read the second chunk. Right? What Let's just say what map is what is
Oh, there's a metadata file that's also in cipher.
That's a bunch of random gibberish on the disk that this uses to say it.
How do I know what file that chunk belongs to?
It's a map of your file path to the list of chunks that make up that file in order.
the disk. You get the deciphered pads in order
Okay, the root of all evil. I see we're getting that the root of all evil is the file system.
Okay. But until I until I find that chunk right, But until it finds that chunk, how it would have to read through roughly half of the jumps to find that junk
Yeah.
Page map. That's the same thing Berkeley does until you can read the page map You've got no idea where a file is, because all the file is is a bunch of chunks that have been spread out.
All of that, and drive Well, what happens? The file system says, Oh, you're trying to read this file.
Right, right.
It uses. Whatever mechanism that file systems internals do to convert your path into the first end of the block that makes up the first block of the file.
First page 15 times until it hits the first direct page
Right good in the scripted file system. Alright. The in the unencrypted file system. They deliberately make that obvious and known at the beginning that it starts here
Okay, right, But if but all if let's just say you're trying to read one file, right?
I'm going to go to the metadata.
I'm gonna say metadata, what is the first chunk of this path?
Okay.
I'm gonna find that first trump, because I know where it is I'm going to decipher it.
I'm gonna hand it to you. Then I'm gonna look in the metadata, and I'm gonna ask, where is the second chunk for this file?
Good.
I'm gonna go to the desk and I'm gonna read it.
I'm gonna decipher it, and I'm gonna hand it to you.
out!
What are they gonna do for the third chunk
Well, it's the metadata that describes the mapping between the uninscipered file path and the gibberish.
In the encyclopedia system is stored in a metadata file that is itself inside.
So the first, the the the the starting, point of all of this.
Once you give
Once you give cry Fs. The password. Is, it has to go out to the volume with its with that password, and go to the the metadata table and decipher.
That then when you do an Ls. On the file system, it can show you what paths are in the file system.
After that you're just going back to the metadata to get a list of file chunks in order.
It's exactly the same principle, but Unix uses to break your file up into first and second and third order.
Indirect files. It's just find me a page.
Store the thing there. Find me a page. Store the thing there
It's encrypted, and it's in a known loc It's an it's in a location.
so is that metadata not encrypted
okay.
The cryfs can figure out once it has the key, because, the as phrase tells, that process, how to decipher the volume
Okay.
Then it goes in, and it decipher's the first piece of metadata which tells it. Where is the table that maps the outside to the inside then it. Deciphers that table
Without that pass phrase, even cry Fs. Cannot tell you where the metadata table is, because it can't read the contents of the encrypted file system.
Oh, okay.
To read the map of how the files are broken down.
After that it's exactly the same technology that maps directories to blocks on a standard file system.
Yeah, Okay, that that makes sense. And that's what we
If you tried to read the disk, drive in block order.
Okay.
It's gibberish, because the files are scattered all over the freaking place.
But yeah, there's a metadata table again.
It's like a lot of high speed backup software.
Alright.
They take blocks as they comm as fast as they come, and stream them out to the table, and they store a Oh, shoot!
A scared stand up. They score the the block, order, it says, which file what block is.
Hmm.
Take Block X, and they they don't want to slow the tape down, so they just scream the tape by taking whatever block they can. It is recording This block X of file Y is block Z on the tape and if you want to ask for your file back It has to read down its Metadata and figure out what blocks
make up that file at or same technology. It's just a mapping
Okay.
Do that. Make sense
got an easy question for easy question for you.
Where do you? Where you start reading to figure it out? This stuff?
No such thing. Go on!
Hey? I say, that's I don't care. Let me just get this thing.
Where's the You know the beginner's guide to this stuff
There we go now. I can amount that now. I can plug my keyboard back in so it goes crazy, typing the place to start
You throw a page out
Pull that drive out correct. Her 2 is empty. If I Rmd.
There they're both gone because there's nothing in them.
There really was never anything stored in those directories. They were mounted from the the encrypted file system Once they're mounted, what do they look like?
Class files and directories. Once you unmount it, it's empty space, just like any other file system
But I would say, if you care that's new Dpm.
Said yet
There we go, there we go.
That's not worth it. Here we go, if you oh, too great fs.org
We explain how it, works, and why this is secure. There's a tutorial.
This explains the encryption. Key the root block, Id, that the the first block that makes up the start of the entire file system is stored in that config file and cipher.
Okay.
Once you decipher that with the key, you know where to start reading to find the rest of it.
you got some caption over the the URL. I can't can't see what the URL is
Remember. Just remember that the file system is cry Fs, and it's cry, fs.org
there's how it works. There's a tutorial that shows you how to install it, how to set it up.
They give you examples of using
And this this example here shows you. Okay. So we you look at your dropbox base, and you have what the Directory you're going to see.
And then dropbox has encrypted data. Why?
Because cry Fs has no idea where it's storing things It might be on the local drive.
It might be on a phone drive. It might be on a laser talking to the Klingons That's what you need to do.
You use Damian technique, you translate everything you've got into cling on.
Then you've been ciphering. If somebody decipher's it, they're gonna have to figure out what Klingon means.
That's it. We we need. We need to come up with the Klingon and ciphering system
Then actually better than that you g zip it and cling onify it.
So what happens is somebody goes through from the Cra. They use the supercomputer from hell.
They figure out what your password is. They get in there, and all it is is a bunch of client on gibberish.
And what do you want to bet? They've got no idea what Klingon really is?
Oh, my God!
Well, that that's another one. That was used in World War 2.
Or was that in a way? No, it's an avoided Yeah, they use the Navajo, and they could talk to each other on the radios, and nobody else do the damn language
But there's a tutorial. There is comparisons between using 2 cripp vera crypt, crypt, go crypt fs go crypt fs.
Is the thing. The guy who wrote ink Fs wrote after he gave up on.
Thank you. Fs: It had too many holes and he rewrote it in.
Golang, one downside you point see, that doesn't support windows, which you know again for thumb drives.
It's kinda nice. You can plug the thumb drive in anywhere just as long as you know the passwords you can get back
A lot of the other systems like vera crypt, they create a single and cipherd container.
So let's you can't expand the space without copying it all to a new container with cry, Fs: Yeah, I have a disk drive, and let's say I've got lvm with xfs on.
It and that's how I'm storing the stuff.
If I run out of space I can do an Lv. Extend.
I can do a grow Fs. And without even dismounting, the file system, I can have more space and cry.
Fest will say, Goody, I've got more space, but it doesn't know how or where the space came from.
It doesn't give a damn about the space until it runs out, so as long as you expand it faster than you use it right?
I won't know the difference. One thing about crypto ink f go crypt Fs: This guy's thing.
It encrypts files. So what I have is a gibberish name for a fully encrypted file.
That's that file beginning to end, which is a lot easier to crack, because I can tell from the file sizes and other things where the approach of chunking the file and separating the encryption unless you're the CIA with some serious curious computing power you are not gonna figure out
what these things mean. And again he points out here, if if only a small piece of your chain file changes, he only has to read the the party of it.
That doesn't change, can sit there back home and happy.
So there's 2 things about that. The idea of Well, I'm just gonna look at the the the the timestamps on the files on the disk and order it that way.
Doesn't work, because the newest parts of one file might be older.
Then the newest part of another file that might be new newer than the oldest parts of that same file So you don't know what order they end by date, because you might have written different pieces of it at different times so there's a pretty good comparison.
Of Why? Why the different systems, Why, he doesn't think they are as good as the way he did this and it's an explanation.
Oh, of what he was trying to achieve with this particular system, and and why he thinks he achieved it So it's it's worth reading the downloads, a bunch of Debian neither of which I use other.
Is a course source Code Mac OS Windows You could go to get Lab and get it.
I think the package for Gen. 2 is built off of the get.
Lab source will always take your money
and the how it works does a pretty good job of describing what happens again.
Your files up here. Get metadataified into a bunch of same size blocks.
Think of it as pretty much what happens when we story file on the unix file system using Bsd file.
Cisco, I guess. Working
did you, Steve? There was a question. This is open source, free software
It It's on. Get Lab. You can have it. I think he uses a I have forgotten which license he uses.
I believe it might be the Berkeley license, you know.
Pretty much do whatever the hell you want with it. Kind of license he somewhere in here he described, which license it is, as a matter of fact.
lpgl, 3 and mit
Good.
yeah, I and you know I I I was reading through after I did the last talk, and I I Everyone's been using Ink fs since the donna use not the don of, time perhaps, but for a long time.
And It works, and everyone's got it and set up.
But it does have some serious security, holds these days. And so I started looking around after.
You know, once I did the talk, I thought to myself, Yeah, I okay.
It's not maintained, so the the holes aren't going to get fixed, and I was something like cry Fs.
It's bloody easy to move something between it cause you mount one with one password, you mount one with a new password, and do a Cp. Minus R.
Okay, you Cpio minus P using our thing, whatever you have, whatever makes you happy.
You're just copy one. You're you're copying one unix file system, onto another unix file system, and you copy from one mount point to the other Mount point.
And when you're done you've got a newly and cipher copy of the old stuff you do.
You just Rm: minus Rf: the old encrypted directory.
It goes away.
So transferring from ink Fs, where I was using it to to cry Fs: Yeah, it took me not a lot of copying time.
I mean all the storage is on Nvme.
Now it is so. You know it. It. Even the the I/O wasn't bad, and the encryption is is pretty quick, even on the ancient equipment I've got here
But like I said, if you can remember, cryfs.org.
Don't cry Yeah, anyway. Don't cry if you look here.
How it works is a pretty good description of how and the default is.
Aes, 256. Get them standard cipher, very secure.
Don't trust it. You want to use whatever Bingo
Yeah, again. You can store your configuration file, And this is important, because one of the things that configuration file has in It is the root block Id: That's the first block that you have to read in order to know what the Metadata is if you, store this encryption.
On your local. If you store the config on your local file system in a different place.
Even if someone, as the phone drive in their hand, they don't even know where to start deciphering it to get the metadata to decipher the rest of it.
So you You can make this arbitrarily secure if you want to
Yeah, and there's some descriptions here about why the the ode one dot o deals with There's a type of man in the middle where They can.
They can roll back your file system by replacing blocks with an earlier version of a valid version of the same block, and he might not know the difference version 10 because it it stores additional metadata about the blocks if somebody tries to hack you by flipping the blocks
around it. It'll actually memorize that I forgot how it does, but it.
I ran through it once again. There's a nice tutorial that shows you how to go about mounting the things with dropbox with local if you care, you can learn a fair amount about Why, he wrote it the way. He wrote it.
And what he thinks. Some of the shortcomings of the other encryption things are that are why he does wait.
Did it. The one comparison, if you like. Freeware would be to go crypt Fs, which again is written in Golang by the guy who wrote ink Fs was everybody's tool of choice.
but it's got holes in it now, and found vulnerabilities, and that was in 2,014.
So it People have had a long enough. Thank you. Fest 2 is probably never going to be released.
Is the guys working on this thing. It's called go crypt Fs.
This is not going to go back to the other one, so we've got cry Fs: I like this one again, if you like.
It It works out in the box on Linux and Max, which means it'll work on Bsd and he's trying with windows support because he uses the native file system rather than a container it's a bit easier to port this because all he has to do is is right
files and the files are all in hexadecimal so here they fit any files.
The trick is is getting the block level, operations correct, and and trying to figure out how to just avoid the blue screen at death.
Cause you. You use too much memory memory management on windows is living.
Help, somebody actually wrote: If you want to read this thing, if you're really into pain, you can go to this guy's master's thesis
And again the the the consistent breakdown in the in a standard size blocks both the directory structure and the file contents. Makes It exceedingly hard to use any kind of external analysis to figure out what was on here
And you can do arbitrary things to make it harder and harder.
Somebody with enough supercomputing power is eventually going to just brute force the past rates.
one way. I found it doing. I wrote it. I wrote a little pro utility that if I give you a I give it a pass phrase, and it runs it through a an sha, 256 it then takes that runs it again it it base 64 encodes it
yeah.
and then runs it through again, And what you get is the base 64 encoded.
You get a 32 character base, 64 result that you can Then, at all you type.
I type, you know. Pathways, space, and I type something I can remember like the website, and I get out of it a 32 digit hexadecimal number, or I get a base 64 encoded version, on it which is going to be long enough and weird enough that nobody's going to
guess it's got no relation to anything, but I can always remember the guy and passwords just half the time I I just paste the the website domain into the system generates passwords, form and it means if i've got that I have access to it.
On my phone and all my computers. If I forget. And I want my phone, and I want to access something I log in with with juice or something.
I go into my machine at home and i paste the same thing into the same program, and I can cut and paste the pass phrase and stick it back in so I can get pretty secure passwords that are longer than anything i'm willing to type as long as i'm willing to
cut, and paste them
And that works.
Hey!
I would say, Go here and read this It's it's actually it's pretty good reading, especially the part where he compares them, because it gives you some idea of what's good and bad.
Ratty She doesn't pretty nice. This is why I didn't like this, because it doesn't allow this or that, or the other, you could decide.
Whatever you say, is completely unimportant to you. Then maybe that other thing would be a Good.
Choice. But I would suggest not using eightfs and using at least one of these that's here on the compare site.
These are all pretty popular ones these days. Click, one machine.
I'm clicking. Oh, maybe I want it. Sorry these guys you know.
True, kip and vera crypt or proprietary.
You might not want that. But you can read down these and see what some of the choices are.
He's got this pretty little table here about what what works with what?
and he did a pretty good job of but checking all the boxes, so he'll show you what he thinks
Yeah, some are a little bit faster. Vera Krypt has unresolvable conflicts, Cryophys, you know, supports things.
The the 10 version that's out here now is, or 10 or later is pretty good.
And again you can mount something, for right on one end and read on others.
So if you're doing Etl. With this you can have in cyber.
Etl with multiple processes reading, they just can't modify the file system
I'm gonna jump in here, and I know we've got a a couple of people who've excuse themselves in chat and said they had the it also just to to kind of wrap some stuff. Up.
I got one question, but before I ask that, I'll just suggest, if anybody else has any questions for our speaker on the topic, this will give you a minute to just kinda formulate any final questions in your head.
And but my one question is, my one question is, What did you?
What brought you here tonight? Did you? Did you see this on meetup?
no.
Did you see it on our calendar, did you? That got you? Did you?
Just really think the topic looked into interesting tonight, or you know what what motivates to come tonight.
If you're somebody who's either never been here before or just hasn't been here in a while.
Just love to have some feedback. You can either board it out vocally, or you can send it to me in text, or you can send it to everybody and text.
But, however, you would care to communicate that love to note so
Told me you needed a speaker. Oh, no.
And if no one has anything they want to offer in that line immediately on voice, you can certainly do it when it comes to mind any final kind of wrap up questions for our speaker this evening.
Oh, oh, one thing! If anyone's anywhere near Pittsburgh there's a thing here.
the moonshot Museum. They're actually putting together the lunar Lander that they're gonna try and use for the the next move flight.
Yes, yes.
And you can walk from putting it together
You got the clean rooms and the ultra clean rooms, and all the rest of it.
Oh!
But you you can look through the glass and see the guys actually assembling a blue land. It's gonna land on the real room.
Oh, cool!
It's called the Moonshot Museum, and even if you never get there to get really cute pictures of it.
Bye, just bye, the I can't get back to the I hate zoom.
Okay, I don't know where it hid the little gizmo that I click so I can't show people.
But, seriously, I did people find this useful
The ice.
Okay, that's best I can do
Yeah.
True, crick and all the rest. So he he, I think he's I read through it I think he's pretty fair handed in.
I I did. Yeah, I I would, and especially the the website. And it talks about the other Yeah, encryption methods. And there are crypt and and through crept, and not
He at least says why he thinks the other ones are better or worse, a different way.
Some of them are slightly faster, but he goes through. You know the logic that he used to come up with this particular approach, which is different than everyone else's.
Some of them use containers where they basically create their own logical volume.
Right? Yeah.
So they're using an encrypted physical storage and a crummy thing about that is, you can't grow it.
You can't just grow it. You have to copy it.
And why he broke things in the same size chunks.
It makes it a little bit easier to stream them. In some ways it makes it easier if you're moving it over a network because you can stream chunks more easily, and you can entire file sometime he could deal with the loss of a block and still keep going so there's you know, He he described some of the trade
offs, but I I think it's it's a really nice organization the way he did it.
Sure.
Probably the best way to do that. Okay, if you really wanted to. You could just mirror the file system
if you know, if I were using this, and I were using it to store stuff on on the web somewhere like S.
3 or dropbox. What I would actually do is have an encrypted file system locally because it's going to be a hell of a lot faster.
Anyone, and what I want done using it, and I am mounted it.
I are, sync it to the remote system
That would be my vote. If you want to have something like a phone drive that you know you've got it with you, and it's got important sensitive information.
Or you've got a section of your computer that you want to store business data on.
If the machine is ripped off, people can't read it.
you're just as well off in 90% of those cases, just storing it on your local drive or storing it on the thumb.
Drive, and then just backing it up, back up the encrypted file system, because it's just directories and files. You could make a tarball of it. You know you could oursink it, you could do whatever you want and just back up the whole file system
Did that make sense the way I said it?
Yup
so that that's what I Any time I know a lot of people who use things like dropbox for their real storage, and I think they're nuts, because it's too, easy to lose data in transit and corrupt file and you you can never tell what they're doing, with it on the other
hand so my approach for this would be to use it to incite for local data, and then use my network storage availability to our sickness out there, or tarball and gzip it and stuff, it out.
There, and then nobody Guy has any idea where
If somebody gets it later, you know what are. They gonna know one cute thing you can do is you can do a loop back, mount.
You could actually store this as a flat file on your local file system, just create an empty bite file and mounted loop back.
Make it, Let's say Xfs, because then you can grow it and mount the local file with a loop back, and then put the cry Fs on the loop back, file system.
When you're done with it, gzip it and stuff it in the cloud to back it up.
If you want more space, you can, because of the way Xfs works, It can grow into unused space on the device.
So if you take the the file, you unmounted, and you do a Dd.
Minus, if double, greater than I. I have to 0 double greater than your file.
I believe at that point you can, Matt, remount the file, loop back the loop back, sees the bigger file and you can do an exit as grow Fs. And it'll it'll extend into the new file space, again when you unbound it g sip it and and stuff it wherever you
want anyone that sees it is gonna unzip it and have no idea what the hell it is.
It's a flat file and garbage It
So the way to deal with it is to just have more than one copy of the actual thing
If if you're really using it only on the neck, you know, make 2 copies or tar ballet or sinking, and and put that in a separate place just like you back up anything else.
Did that answer your question?
There. There isn't a way to say I mean, I guess, what you could do.
If you wanted to keep backups of your files, so that one block lost in the file system.
when Chunk lost wouldn't kill you. Just copy the file.
Take the do it the same thing you do on the just drive, take your file and copy it to Foo Bar, dot bk, and it'll create another bunch of blocks.
I hope so
Folks Excuse me and you get a whole number of months you've encrypted chunks, and every so often you just copy your file with the file name dot Bk.
You get a fully encrypted backup. If if the original file gets the same thing, what happened?
If you lose a block on the disk. You know everyone's seen a file with a disk page got corrupted, and you lost 4 K.
Of your file. Okay, what do you do? You want to Your nearest backup?
You could be a way to make an encrypted backup is you?
Either are sync. The whole file system where you take the files that are big, and you just make a copy, or you g zipping.
If you, Jesus, file into foo dot dot gz, it'll take as little space as it has to, and then if the original file gets corrupted in some way, you just unzip it
And then you only have to use one file system
Did that make sense?
Am I still
Could you do it?
Everyone with a heartbeat. Say good night, good night. I was!
If that was useful. Yeah, I started doing the slides and all the slides will just copies the stuff on the guys. Website So I figured, screw it.
Good night, good night.
I just show people what to look like
Yeah, very good.
And
That that seemed like a better way to to explain it. Oops, did I just cut everyone off?
Oh, hi! I have no idea where that got and zoom processes
No, no! You're still here
This is getting annoying to a minus term to get in zoom process
I I'm running Sdwm. I've got nothing like that.
Take your mouse at the bottom of the screen and over to the right, and your connection leave
Oh, Oh, boy!
All I have is a nice big blank screen. Any tiny desk manager in the quarter.
Ouch!
Ohio.
No, it's exactly what I want. I got none of that crap popping up in the middle of my code when I'm trying to write something for work totally I hate about windows it's they've got all the shit blowing up on the screen all over the time there I mean the bottom of the screen.
Out on. Ouch! Only because it's different. Ouch!
Is where they put all the notices. So every time I'm typing in the middle of what I'm typing something about a method I don't care about. In teams always pops up in a little while type at least put at the top of the screen where it's out of the way.
But yeah, I've got about zoom Zoom is created a whole bunch of process.
Oh, I and Gary and I were talking about this. People wanted to.
We should figure out we could use S. Trace. Remember that Zoom is owned by the Chinese Government.
If anyone wanted to, we could try using, say, S. Trace, or a few other tools.
Let's just try and see how much data Zoom is trying to steal from all of us
Hmm.
If anyone wanted to, I'd be hoping to go to to trying it
I think that'd be interesting
Yeah, I I think we'll find that it probably is is trying to hack a lot more than than than Uncle Ze wants us to believe.
yes, I mean in to me it's kind of scary.
Why?
Well, that's what happened. No wonder I couldn't hear, anyone.
Yeah.
The volume was turned all the way down.
Bye, Anyway, Yeah, I can't for the life Let me find where that the zoo, the zoom window, the thing that it pops up, that it says, Hi, you're running.
Alright.
Zoom is gone.
Hmm.
And don't forget you can read Hamlet in Klingon
Something like that.
Alright kara
Okay, anyway, Yeah, that would be fun. Actually, if somebody wants to.
We could write a fuse file system that translates everything stored in it.
Shutting down in 5 min
Do all the file names get transferred to cling on
Shutting down in 4 min
No! No! Well.
Okay.
Yeah, no one. No cling on. Okay, everyone. Well, thank you for showing up and staying awake through all of this, I hope, like I said, I hope it was useful, and the best place to go for information on cryfs is that
Well, thank you.
Well, that's neat. Well, have a pleasant night, everybody.
all of these dumbass processes. I'm not joking.
The the window that was supposed to be Zoom Meeting. Just be vanished.
yeah.
Okay, We'll get you shut down in a second. Here.
Yeah, we. Maybe I found it. Anyway.
You just got a thank you from Tom Chaplin on chat, and this has been the Thursday, October the twentieth, Saint Louis Linux Slug.
Welcome.
Meeting our speaker tonight has been Stephen Lombard.
fast
people at workhars consulting. So for all of your heavy duty, encryption, consulting needs, and a lot of other good consulting things go to work ours.
Yeah.
He's hanging a shingle in Pittsburgh, I believe right
Okay. So but we we still consider see, even one of our own is always welcome back here.
Sunny Pittsburgh
So
Or at least useful when you can't find anyone else, Don't have to do this
yeah, if anyone wants I could. I could show you at a right doing. That in Pearl is trivial.
Or or when we want to do something in Clinton
What Damon Conway wrote it. It allows you to put program Pearl in old Latin.
Hey? Do you
The interesting platinum is the word order doesn't matter.
Hey, Tom!
It's how you conjugate everything, whether it's done to or whatever.
So. And there was this one really sexy woman I met.
Who was She Was a a humanities major, who for the life of her couldn't understand how her program is.
The programming language is all look gibberish and I got to spend quite a while explain to her how it had an she could actually read the Latin that he wrote in his example.
So it's fun I spent I don't know how long, staring at it, and teaching you how to program and Pearl and girl was the only language he could ever understand.
But in one.
While. That's awesome, that's all, hey? There's a a note here from in chat from Tom Chaffin.
Little? Do you realize
Look me up! Here's how the how far is Harrisburg from here?
I don't think they're close. But yeah, most of the St.
He's moving to Harrisburg, Pennsylvania.
Louis, I guess Here is he you you you get on 70, and you exit on 81 mile a couple of miles out of town.
And you're here I mean, it's you as long as you can follow.
I I know