J'annonce le lancement officiel de Drycat.net !

Je me suis rendu compte à posteriori, que ce nom était utilisé par une marque d'aspirateurs industriels... Il est d'ailleurs assez peu parlant quant à sa finalité (du moins au premier abord). En effet, Drycat est site web permettant le partage de secret entre plusieurs personnes. Un secret (une phrase ou un fichier) va être découpé en plusieurs parties et, selon la configuration, il faudra réunir plus ou moins de parties pour arriver à reconstituer le secret original.

Exemple, avec un secret que l'on découpe en 4 parties, mais dont 3 seulement sont nécessaires pour le recomposer :

Ainsi, le partage de "pouvoir" est assez souple en fonction du nombre de parties générées et à qui on les affecte. Dans notre exemple, il faudra absolument que la première personne soit présente, mais elle ne pourra pas seule reconstituer le secret.

La théorie mathématique derrière Drycat fut décrite par Adi Shamir. Elle se base sur la reconstruction d'un polynôme d'ordre k (k étant le seuil) par interpolation. Bien qu'ancienne, elle reste pour autant très peu répandue, alors que je la trouve particulièrement intéressante. D'autant plus qu'Adi Shamir n'est autre qu'un des co créateurs du système RSA (système cryptographique asymétrique), utilisé un peu partout en informatique, notamment pour la couche de sécurité HTTPS.

Drycat se base sur l'implémentation JavaScript ouverte Amper5and, dont un site de démonstration est disponible ici. Alors, pourquoi avoir crée un site tiers supplémentaire ? Pour une question d'ergonomie et de facilité d'utilisation.

En effet, je voulais réaliser un site facile à utiliser par tout le monde, et surtout les personnes qui ne sont pas très techniques. La configuration nécessite de connaître quelque bases, mais avec Drycat, la récupération du secret est quasi automatique. Ainsi, les points forts sont :

• Ergonomie qui va à l'essentiel
• Utilisation des QRCode et de l'envoie par mail
• Recombinaison automatique du secret une fois que toutes les parties sont rentrées
• Chiffrement des fichiers réalisé directement depuis l'interface (mais en local sur l'ordinateur de l'utilisateur)
• Hébergement des fichiers sur le serveur

En ce qui concerne le dernier point, les fichiers envoyés sur le serveur sont forcément chiffrés, de sorte que personne ne pourra les lire sans la clé de déchiffrement. Clé connue uniquement en réunissant les différentes parties.

Un autre ajout majeur (et inédit) de Drycat est la possibilité, pour le chiffrement d'un fichier, de rendre une partie obligatoire. Ainsi, si le seuil est atteint sans que toutes les parties obligatoires ne soient rentrées, le déchiffrement sera invalide.

Pour le moment, il faut simplement être enregistré sur le serveur pour pouvoir y téléverser des fichiers, avec certaines restrictions (taille du fichier, durée de vie du fichier). La fonctionnalité d'envoi par mail étant réservé à des comptes payants. Cette partie payante sera mis en œuvre selon la demande des utilisateurs car cela nécessite la création d'une société. Mais le but premier est que les gens puissent s'amuser en toute autonomie.

Some days ago was the 80th anniversary of the d-day landings. Thousands of soldiers at the same place, the same day to flood nazi's defenses. Probability to die far away from home was huge, but they didn't escape. In the east part of Europe, URSS did the same. But, 80 years later, russia seems to have forgot what means war, nazi and dictator... Vladimir Poutine sends, for 2 years now, people to death without any concern.

This is why I first decided to redirect all people visiting my website to this thread if they're coming from an russian website. Some weeks ago, I finally decided to block every connexion that comes from russia because my website contains some computer stuff that can helps industry. I know, it's not fair for all people that just want to live normally and being informed or just want to see different things. But, even if filtering can be bypassed using a VPN, this is what I can do to help a bit Ukraine.

The script output commands for nftables (Linux kernel firewall). It reads data from one of ripe.net database (filled by AFRINIC, ARIN, APNIC, LACNIC and RIPENCC organisations) which contains allocated IP ranges for all countries. These databases are updated everyday. For an easier databases retrieval, you can look at my own project iptogeo or directly on ripe.net.

#!/usr/bin/env python3                                                                                                                                                                                             

TABLE_NAME = 'BAN_RU'
COUNTRY = 'RU'
RIPE_FILE = 'ripencc'

# Create table and add an inet filter chain                                                                                                                                                                        

print(f'nft delete table inet {TABLE_NAME}')
print(f'nft create table inet {TABLE_NAME}')
print(f'nft add chain inet {TABLE_NAME} input "{{ type filter hook input priority filter; }}"')

# ripencc|RU|ipv4|2.56.88.0|1024|20190313|allocated|caa02a36-bb09-4e4f-a834-1038f57676c1                                                                                                                           
# ripencc|RU|ipv6|2001:640::|32|19991115|allocated|ea8bf0c4-24e1-4e58-8a09-cee9da9a38f5                                                                                                                            

with open(RIPE_FILE, 'r') as fd:
   for line in fd.readlines():
        parts = line.split('|')
        if parts[1] != COUNTRY: continue
        if parts[2] == 'ipv4':
            nb_ip = int(parts[4])
            bits = (~(nb_ip - 1)) & 0xffffffff
            mask = 0
            for i in range(31,-1,-1):
                if (bits & (1 << i)) == 0: break
                mask += 1
            print(f'nft add rule inet {TABLE_NAME} input ip saddr {parts[3]}/{mask} drop')
        elif parts[2] == 'ipv6':
            mask = int(parts[4])
            print(f'nft add rule inet {TABLE_NAME} input ip6 saddr {parts[3]}/{mask} drop')
        else:
            continue

Output must be redirected to a file, then you can source it. For russia, there is about 20 000 entries.

Here is the work done for version 0.7 of IWLA (Intelligent Web Log Analyzer witten in Python) since one year and a half :

Core

• Awstats data updated (7.9)
• Remove detection from awstats dataset for browser
• Don't analyze referer for non viewed hits/pages
• Remove all trailing slashs of URL before starting analyze
• Improve page/hit detection
• Main key for visits is now "remote_ip" and not "remote_addr"
• Add IP type plugin to support IPv4 and IPv6
• --display-only switch now takes an argument (month/year), analyze is not yet necessary
• Add --disable-display option

Plugins

• Geo IP plugin updated (use of ip-api.com)
• Update robot detection
• Display visitor IP is now a filter
• Add subdomains plugin

HTML

• Generate HTML part in dry run mode (but don't write it to disk)
• Set lang value in generated HTML page
• Bugfix: flags management for feeds display
• New way to display global statistics : with links in months names instead of "Details" button

Config

• Add no_referrer_domains list to defaut_conf for website that defines this policy
• Add excluded domain option
• Set count_hit_only_visitors to False by default

A demo instance (for forge.soutade.fr) is available here

Reminder : Libgourou is an open source ADEPT protocol implementation (ePub DRM management from Adobe) that helps download ACSM files on Linux system (and remove DRM).

Just two little fixes after a user reported an issue downloading his ebook from Kobo. Unfortunately it doesn't fix his issue as it's more a problem with new cloudflare firewall setup by Kobo.

Changes :

• Bugfix : Operator URL only written when the full certificate is retrieved
• Raise an error for HTTP request with status != 200
• Set up cookie jar file for each session
• Fix for compilation in Android (strptime() format)

You can find source code and binaries in my forge

And thanks for all ! This week, I decided to replace my old software forge inDefero by a Gitea instance. inDefero project was started in 2008 by Loïc d'Anterroches after Google decided to stop GoogleCode. Unfortunately, it was discontinued some years after because Loïc was almost alone to develop it and don't earn enough money with it (even with a SaaS/pay option). Plus, when you do the same things for a long time, and not necessary related to your core studies, you want to do something else. Written in PHP5, it has a lot of features :

• Multi CVS support : SVN, mercurial, git, monotone
• Tickets
• Code review
• Wiki
• Full Open Source
• Nice design

It's fast and extensible, can be run on a low power server. This is why I really, really thanks Loïc for his hard work. More than ten years after, I still can run it (with some patches) !

Nevertheless, web technologies evolve too fast and I don't want to run PHP5 anymore (nor create a container for it). I wanted something light & fast, something I can hack, something nice for the eyes. After looking on all available forges, I decided to test Gitea. I don't know Go programming language, so I can't patch it, but I was really impressed to see how fast it is (on a low power server). Concerning UI, it's a clone of Github, but it's almost the case for all competitors... Not really nice or innovative, but it's okay. The funny fact is that I can't compile it by myself because it take too much memory... Fortunately, the precompiled binary works like a charm !

Why not Github (or other online forge) ? More than code hosting, Github offers a community. It has become the reference for all developpers (you can even run your own company instance !). I'm pretty sure I would get more contributions to my projets if I put them on it. From a technical point of view, it works very well and offer all you need (except project management). So, the reason to not choose an external forge is more a philosophical decision : it's better to keep your projects/data in your own home more than elsewhere, to have a full control on it (ok, git is by design a distributed software). It's the same for the blog in comparison of Facebook/Instagram/Whatever... Sure, it's less fast, can have some downtime and I had to take care on backups and administration by myself. It's the price of freedom.

The new address for my projects is more generic : forge.soutade.fr. I tried to map old inDefero URLs to redirect in the new one, but didn't migrate tickets & user accounts (sorry everybody).