Sparkleshare is a file sharing utility that keeps folders in sync on multiple computers in a similar fashion to the commercial and proprietary Dropbox. Sparkleshare recently released a Windows client, finally allowing me to start switching my co-workers at the
Progressive Technology Project away from Dropbox.
Overall, I'm very impressed. In particular, I appreciate the Sparkleshare authors' decision to build on top of existing tools (git for storage and revision control, ssh for transport, and ssh public key infrastructure for authorization and authentication). That means I don't have to learn new tools and protocols to debug and it means Sparkleshare can focus on the file sharing pieces.
Despite my overall enthusiasm, I do have some serious concerns.
Protecting your credentials
A researcher found a
startling security flaw in Dropbox - if you can copy a particular file from a user's computer to your own computer, you can impersonate them flawlessly, accessing all their Dropbox files without having to know the user's password. Unfortunately, Sparkleshare suffers from this same vulnerability if you use the default configuration.
When you first install Sparkleshare, it creates a password-less ssh private/public key pair and then makes the public part easily accessible to you so you can add it to your server (or gitorious account, etc). Very convenient. But it also means that all an attacker needs to do is copy your private key (and your Sparkleshare configuration file) and they get complete control over your files.
This problem is easily avoided. If you are running Linux or Mac OS X and you have your own key loaded in your ssh agent, Sparkleshare will happily use that key. So - simply by using your existing (presumably password-protected key) on your remote Sparkleshare servers, you can mitigate this problem. Sparkleshare will still load your Sparkleshare generated key, but if you don't provide that key with access to anything, no harm is done.
Confirming each use of your key
However... that leads to a new problem. If you are like me, your ssh agent is configured to ask for a confirmation every time your key is used. And, Sparkleshare regularly polls the remote git repository for changes. At best repeatedly clicking to confirm is tedious. At worst, it prevents you from intelligently rejecting malicious requests, thus defeating the whole purpose of the check.
It is possible to launch Sparkleshare via ssh-agent in an environment in which you are not requiring the confirmation when Sparkleshare uses your key, but still requiring it for all other uses. However, given the trade offs, I've decided to add a password to my Sparkleshare provided ssh key rather than using my existing key:
ssh-keygen -p -f ~/.config/sparkleshare/sparkleshare.jamie@progressivetech.org.key
Now, I am prompted to enter my passphrase when I start Sparkleshare and don't have to confirm every use of the key. And, I continue to confirm each use of my main key.
git was designed to store code, not documents
Just because something is designed for one purpose doesn't mean it can't be used for another. However, there are a few limitations.
Large files are one. git can handle files over 100MB, but may run into memory problems. I had to alter the
git windowMemory setting, raising it higher than the size of the largest file.
Another problem is disk space. Since git keeps full revision history on every machine, you have to download more data than just the files that are checked out. The more edits you make to a repository, the more disk space beyond what is checked out is needed (and deleting files won't help).
Lastly, you can't use file modification times. With git, the file modification time will depend on when you checkout the files. With some fancy hook writing, you could tweak things so that the file modification date is the same as the commit date, but that still won't help you if you add an existing directory to Sparkleshare because all the files will have the same commit time.
This "bug" has been reported to git and it has been rejected because mucking with the modification time of files can have bad results when you are using make to compile code. As Linus
colorfully put it:
I'm sorry. If you don't see how it's WRONG to set a datestamp back to something that will make a simple "make" miscompile your source tree,
I don't know what definition of "wrong" you are talking about.
It's WRONG.
It's STUPID.
And it's totally INFEASIBLE to implement.
Well, did I mention that git was designed for source code?
No server validation
Of all the problems I encountered, this one is by far the most serious.
Perusing ~/.config/sparkleshare/debug.log is very informative. On a default installation, after you have added a project, you'll see:
19:32:27 [Fetcher][/home/jamie/SparkleShare/.tmp/bar] Fetching folder: ssh://foo@bar.org/foo/bar
19:32:27 [Fetcher] Disabled host key checking for bar.org
Wah.
Once the project is added, whatever key fingerprint is given is stuffed into your ~/.ssh/known_hosts file. Host key checking is only disabled when you initially create the project, so
if you connect to the proper server the first time, you are protected from subsequent man-in-the-middle attacks. However... if the initial fingerprint is wrong, your personal ssh configuration is now poisoned. This seems like a very bad idea. I've opened a
debian bug to address it.
This year, the annual Debian conference will be held in Managua, Nicaragua. And I'll
be lucky enough to spend two weeks visiting the country after Debconf,
along with Elisabeth.
Yes, I'll arrive in Nicarague on July 2nd, spend nearly the entire
Debcamp, then Debconf, then we'll spend 16 days around the western
part of Nicaragua, trying to discover the magic of this country.
So, this post is about sharing our plans with my readers. Of course, I
do not know the country so we may have made mistakes and bad choices.
We'll see.
Immediately after Debconf, Elisabeth will join in Managua. She'll be
landing on July 15th. We'll then spend a night in an hotel near the
airport and immediately leave the day after for Matagalpa, in North
Nicaragua. We rented a car for the entire trip indeed, and will be on our own on
wild Nicaragua roads..:-)
We'll spend two nights in Matagalpa. We plan to
visit some coffee or cigar plants, probably have a trip to Lake Apanas
and Jinotega.
Then, we'll have a short road trip to Esteli where we spend again two
nights. We'll be visiting a coffee growing place (beneficio seco de
caf ). A full day visit is planned at Miraflor natural reserve to enjoy te
beauties of hundreds orchids and some local natural marvels.
The next move will be to Leon, where we'll spend 4 nights, visiting a
cigar factory (tabacaleras de puros?) on the way, as well as San
Jacinto, a place with hydrothermal sources and "Hervideros" (geysers).
Four nights in Leon leaves
plenty of time for several activities *and* enjoying the colonial
city. We'll have a full day at Juan Venado Island reserve with boat
trip from Las Penitas (on a fisherman's boat from what the travel agency mentioned),
then another full day climbing on the Cerro Negro volcano. Indeed, I
was originally considering climbing the Momotombo, but our travel
agency warned about the high difficulty. I would have loved that
myself but maybe not the two of us...and this is a trip for
both of us! So, we played the safe option..:-)
After these 4 nights in Leon, we'll move to Granada for 3 nights,
through Leon Viejo (the former site of Leon).
From Granada, one
day will there be used for a visit in the Masaya National Park and see
the beauties of Masaya volcano (this is indeed something that could be
done for Debconf day trip, IMHO, as it doesn't seem that far from
Managua). Another day will be spent to Las
Isletas on lake Nicaragua and others visiting the colonial city of
Granada. Or, of course, whatever things we don't even known about
now..:-)
Then we'll move to what I personnally consider the peak of the trip: 3
nights on Ometepe island on lake Nicaragua. Just check Wikipedia to
see why Ometepe is, in my opinion, THE place to go in Nicaragua. Here, I'll have
my volcano..:-). Indeed, Elizabeth "authorized" me to book a local
guide and then climb Concepcion Volcan, if the weather allows for it.
1600m height, that doesn' seem to be a big issue....except when
starting from a little bit above sea level and are climbing a volcano
that looks like s postcard volcano : nearly a perfect cone shape.
So, let's cross fingers for having good weather that day. I promise
myself I'll record the GPS track of that one and, even if I'll
probably be walking most of the climbing (except if I have a very
trained guide...), I'll add it to my run tracks!
We might also be going to climb Ometepe's other volcano (Maderas) the day after
so that Elizabeth also enjoys these beauties. There also seems to be
great places around Maderas such as San Ramon Cascade, Finca el
Porvenir, etc.
Then, at the end of all this, it will be time to come back to Managua
in the final day and fly back to Paris in the early morning of July 31st.
All over, I'll be in Nicaragua from July 2nd until July 31st! Full
month away, yay! Hurrah for the crazy number of holidays those lazy
French people have..:-)
During this trip, we might find it interesting some local geeks (not
too many as Elizabeth is not that deeply interested in beersigning!)
and share a few nice things in local places which are only known by
locals.
In case you're interested, out (very clever) travel agency is named
Nicaragua Adventures and they're definitely worth contacting if you
want to travel around .ni, particularly if we prefer booking things in
advance as we do. They speak Spanish (of course!), English and French.
They're very responsive to e-mail as well.
The first Beta of the upcoming PostgreSQL 9.2 was released yesterday (see 
For years, no decades, I've typed 
In this age of 3d accelerated desktops and all that fancy stuff, one does not expect practical innovation happening in the remote terminal emulation area. But it has just happened. It is called 
When I set an alarm, my clock, now running on 
like in the last two weeks, this week's bug squashing was mostly related to
the gcc 4.7 FTBFS bugs:
When I wrote 
I ve send a mail today with a summary of some of my experiences in Managua and tiny
bits of Nicaragua late April / early May 2012. If you are considering going to
DebConf12 (which you obviously should do as you are reading this!) go and read this mail,
as it includes a 
Last year I was able to switch tasksel to using metapackages,
instead of the weird non-package task things that had been used
before Debian supported Recommends fields well.
An unanticipated result of the new task packages is that I have this nice
popcon data available for them, so can get graphs like these.
