Keybase updated their verification methods to include a command line method that relies on echo, gpg, perl, and curl. I really like this so-called "hardcore mode" because it uses only tools I already trust - I don't have to install anything from Keybase. The process involves running a script they provide, and you get to read through it and see exactly what it will do.
This actually happened a few months ago, but I just used it to verify my Keybase identity. I'm excited to see Keybase improve the web of trust.
I sit down in my premium economy seat, the abbreviated way of saying "economy as it was fifteen years ago, but at a higher premium", and deeply internalize my physical constraints for the next six hours. A small box outlined by my seat, the side of the plane with its tiny window, the seat in front of me, and a precise, though invisible, boundary between myself and 19B. I grab a thin paperback out of my bag before sliding it underneath the seat in front of me.
It's just barely light out, and I won't be turning on the light above my seat. I have less than an hour to spend peeling through my book's pages before the night will fall, the plane's lights will dim, and a redeye passenger such as myself should fall asleep. I think to myself that I should have packed a hardcover instead - this paperback will certainly bend and fold on its way to wherever it ends up between me and my seat - but a hardcover wouldn't have packed well.
It doesn't matter. Black inks on bound textured pages with their soft scents are familiar feelings. I can read them on planes, on trains, in cafes, or between the sheets of my hotel bed and feel at home in their arms.
I was afforded a recommendation for a book I do not own and another recommendation for a place to find it. I make my way to what is apparently their new store, just one address over from its predecessor, south of the Tottenham Court Road station. It's a bright white all over, like at the start of a new lease where the owners kindly paid for a new coat of sterile paint for the apartment walls. There are many books on many warm wood shelves on many open floors, and each book knows precisely where to reside and how far apart from every other book it should be. Well, they know those details until someone like me comes along and plucks them from their shelves. Gives them new life outside the store. Or instead confuses them just enough that they can't find their way home on their own and end up on a mobile, metal shelf for refiling.
But it's the twenty-first century and we have a mobile app. Just type in some information about a book, and receive where it can be found and how many copies are available. Drat, the recommendation would usually be in Fiction W, but it's currently out of stock. Pop over to searching a few book sites back in the States and no dice to find it directly. I didn't actually want to purchase it from either of the two giants, but if at least one of them had it, my local bookstore could order a copy with some luck.
Off to the poetry section - I find staff picks the most useful here because while I like poetry, I am not a good judge of the genre. I pull the top copy of a staff recommendation off a stack, lift open its cover, and am taken by the boldness of this paperback's particularly stiff cover as my fingers grace it. Maybe this is why the store's walls are so coldly white, to contrast how much life resides within its books.
I read a few lines, smile, and remember how much I love the escape of poetry and how grateful I am that someone more well-versed than I will curate it for me. I read a few more lines, glance up, read another, and am reminded about how this process causes me to tie together poems and the places I am when I read them. I pop in and out of the fragmented world of the poems and the one around me such that they begin to quickly meld into one. And they are. I am there, in those pages, in the moment, in that place. Poetic Scientifica still feels like Portland, and Bright Travellers has already begun to feel like London between my hands.
These thoughts pass. I read the next page, put the book down, and remember I still need to purchase it. And I do.
I know I've already made the one purchase I allotted for this trip, but I can't help myself from browsing more. I'm a bouncy, smiling cliché just shy of twirling through the stacks. So many more books to buy - there are always more books I desire to read - but especially on vacation, especially now with a suitcase already overflowing with tea, I cannot.
So I jot down titles, authors, notes within my graph paper notebook to take advantage of this store's curation. I know that this store's arrangement - the way it highlights some stories and relegates others to distant corners - must be studied carefully before I leave it behind. I turn careful placements in the reality that surrounds me into two-dimensional scratches in hopes that I can remember enough of the feelings that prompted me to want the books I note.
Curating a list for my future self through the curation of another. Touching the pages and reading early excerpts to see what sticks. Seeing another's nose in a novel you were considering and the smile across his face as he closes it.
The art of the physical bookstore that I hear is dying. Today, for me, it is very much alive.
Keybase seeks to be a "public directory of publicly auditable public keys" with simpler usernames than PGP and verified account linking to popular sites such as Twitter and GitHub. This is awesome because "PGP for humans" is long overdue and because I snatched up the namespace liz.
Linking my verified public PGP key with Keybase was easy enough by using
gpg on a trusted machine and copying into their web client. I associated my PGP key with fingerprint
89CB 0766 5EB4 2515 EE7F 3FAA E0B9 3B4A 4E8E A664 to the username "liz", but this doesn't establish much in the way of my identity.
PGP's standard for establishing identity, the web of trust, is complicated and non-intuitive - I trust my friend Nelson's key, Nelson trusts Anders's key, Anders trusts Alex's key, and Alex trusts Ceres's key, so naturally, I should believe
9D06 536F FD85 F747 8846 CAAD 7688 4EEA 6E6D 80F4 is Ceres. Instead of relying on trusting a chain of signatures, the bread and butter of Keybase's directory is using accounts on popular and personal sites to establish identity. While this is arguably insecure because such accounts can be compromised (though so can PGP keys), I already have mappings from people to those accounts and am inclined to believe that their keys belong to them after they've established those accounts on Keybase.
Unfortunately, I couldn't find a way to securely establish @redroselet, lizdenys on GitHub, or lizdenys.com as "liz". Uploading a client-encrypted copy of my private key was right out - if a malicious attacker compromises Keybase's software, they'll have access to my key and could get my passphrase the next time I type it. The only other option is the Keybase command line client, which is already more appealing to me because I love living my life inside a terminal (really).
The Keybase command line client installer depends on
npm. The machine I trust with my PGP keys is running Ubuntu 12.04.4 LTS (Precise Pangolin), which is supported until October 2017. The version of
apt is 0.6.12, which is older than the minimum required version to install
keybase. This is unfortunate because
apt-get authenticates packages as an entity I trust because I trust my operating system. If I install a later version of
node, I either need to trust another party, whom I may not be able to easily verify as trustworthy, or build
npm from source myself, which requires that I understand how the
node source code and a packaging system I've never seen before works to my satisfaction. Beyond that, I couldn't easily figure out if
npm authenticates packages. It doesn't seem particularly safe for me to trust my valuable PGP keys to this system.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 So I'm liz on Keybase.io, and I'm refusing to verify myself. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQIcBAEBAgAGBQJTOYAgAAoJEOC5O0pOjqZkiK8QAIhBS85fxa/W3q9yQUEKCuMy sWwWSaSEDDj494p86Rh6IvBMJfNxkkCLrW8RJr03Y4v2mCkCQ/n6i03ro2AvKZbt bHoDPL+dfqA5DVU7LOmy6WNXkX77eXGYkOAkWeWt/VLE9ZRmuGJJYXlvs04mgU1k hj1eN7eBP5VR6+Q4kse6o8+a/Yr71YE4w/4BWQbnL3vgqGnrmP836rbx1RnoEI5t 2+yYX++piIasbT1RJtbetJwcR2SBBpFlll9B1QFAIqxxJE+ccBzxXnwyW7OTQsFf ykMl0v2REFjCGaxyrluuVz6ZiXEu1FYYuO6TdJGUN3s3loRZ6a4MaF6u0l3qtNDi uVAQm5RK5lS6nt5W+cWkIZNtTewFItX8IvTx7MOpE5hdB+Qvj6IKQqkEYyrY+r43 drR3gYklQUAAoZwWlnjdkUSxYEM9/SO/AW6c5awJUXB1mcn5qCDXjsVioLWYtKDo fraKvZc0xMUktRBVG7e/8t1zu1O/ixvOo6aLMyuVIfsspy5XhXbR4STHBJzFOMoK 3AMpPIATdWFJOn35tZXWgjd7QFE46nTqZgK0co2QY60aWO2oI8lI9YLVMwHm6vyJ vhEZGyaJ9MPN5vbWc4tdjCNzU7tv1zUyUJNLtBQ1yWUaCJldQYW8AO1wUNpzbk79 RYEUUgRtrPKkb4Cdh/09 =s/8d -----END PGP SIGNATURE-----
My blog has a tendency to cover topics that run all over the place. It's come to my attention that it's currently reaching at least two completely different audiences. One of them is almost exclusively interested in my food posts.
To handle this, I've created a separate food blog, My Quaint Dutch Oven Family, and moved the food posts from this blog to that one. The name pays homage to my favorite kitchen helpers. Links to food posts at this address now redirect to their new locations on the new blog. I also get to better categorize my food entries on the new site.
I hope the split will encourage me to blog more. I'm exactly the kind of person who will become frustrated as their latest post dates get stale, and I'm excited about how that will make me want to write more.