I originally started this here separately to have a Mozilla hosted blog for only my Mozilla stuff but it is too cumbersome to try to blog in multiple places and I wind up duplicating some content. It just feels very awkward.

I blog about a pretty wide range of things, often really of interest only to me and a few friends. I didn’t want to feel constrained about what I blog about but I now realize that this probably isn’t really an issue.

I have a Mozilla category at the site and will post Mozilla related items within that. I’ve created a feedburner feed for just that category as well. I’ll have that added to planet.mozilla.org to replace the feed for this blog. In that regard, things should look the same and my non-Mozilla posts won’t show up on Planet in order to keep things clean and orderly (not to mention on topic).

I apologize for any confusion.

The article caused me to reflect on the difference in meeting culture at Mozilla and Microsoft. In both instances, pretty much everyone who has a laptop brings it to meetings. Of course, at Microsoft, there were a LOT more meetings than Mozilla forces anyone but key management to enjoy.

I recall a number of instances on the IE Team during the daily war meeting or the like in which people got so exasperated with the lack of attention caused by people focusing on their laptops that people really did try to close laptops on people or make everyone in the room close. Eventually, there was a (short lived) rule that unless you needed your laptop open to take the official notes or to look up data for something of yours in the meeting agenda, the laptops had to be closed.

In comparison, most Mozilla meetings have people lounging about with laptops wide open. People are often checking bugs, logged into IRC (where we live, really) or otherwise multitasking during meetings. It’s all very casual and no one seems to make a major issue out of it. Of course, that isn’t an excuse to just goof off or not pay attention but I think that people don’t really expect everyone to drop all other tasks to sit around a table for an hour, waiting for their turn to speak. We have a lot to do and software to ship!

The overall atmosphere is just a bit more relaxed around the laptop issue and, because people are neither rude in their use nor make a big deal about it, things manage to work out. Of course, this might not be the case if we spent hours and hours in meetings every day but, like I said, we have things to get done and software to ship.

This is probably not the most insightful post in the world but the article did cause me to compare and contrast things. I certainly don’t miss the hundreds of my hours lost, never to return, every year to meetings either.

A number of us at Mozilla will be attending BarCampBlock this weekend.

BarCampBlock is an example of the BarCamp series of unconferences. You can find information on a number of these occurring all over the world on the BarCamp website.

The session list is looking pretty interesting so far. So far I’m planning on attending the following ones for sure:

• Online communities, open source and the gift economy
• A web app for the whole family — How to legally engage kids and youths (under the age of 13).
• Dialogue TV — How to bring “Conversation Cafe” style dialogues to the web (podcast or video)

Mozilla is also proud to be one of the sponsors of BarCampBlock as well. Personally, I think these kinds of events are where a lot of the interesting ideas people have in their heads around the web, open source, and communication percolate out.

I hope to see at least a few members of the Mozilla community there. I’ve heard that the event is expecting at least 400 people and that it may go as high as 800. Not bad for a very loosely configured event on relatively short notice (at least for most of us).

I promised a few people the other day that I would write a post on securing your e-mail communications. This post won’t be applicable to everyone, especially webmail users. I’m going to focus on a few tools that can be used locally on machines.

These tools are:

• Thunderbird
• The Enigmail extension for Thunderbird
• GNU Privacy Guard (GnuPG)

I actually use the Mac version of GnuPG available at http://macgpg.sourceforge.net/.

Thunderbird is the free e-mail program created by Mozilla, where I work. It is cross-platform and based on the same technologies as the Firefox web browser. It can connect to the IMAP and POP3 mail servers used by most providers. It can also connect with Gmail accounts but my knowledge of that is pretty weak (my gmail account forwards to my arcanology.com account).

The Enigmail extension was developed as an add-on for Thunderbird that would allow seamless integration of cryptography functionality into Thunderbird. This piece has actually been the one that was missing in years past, making the use of cryptography with e-mail a serious pain in the ass. The is under active development and the last update was just a few days ago on August 4, 2007.

GNU Privacy Guard (called “GnuPG” from here on) is an open source cryptography program made available by…you guessed it… the GNU Project. For those without a deep history on the net or open source, GNU is one of the main providers of open source tools and philosophy, historically. You may have heard of its seeming insane head, Richard Stallman, who regularly froths at the mouth on a variety of technical topics and points of law. GnuPG is an implementation of OpenPGP, which is an open standard for public/private key crypto communication.

I’m not going to give much more than a quick glossing over on cryptography here. Basically, with public/private key crypto, you generate a pair of cryptographic keys for yourself, a public one and a private one. The public ones is…shared with the public. You give it away to your friends and family. The private key (also called the “secret key”) is kept secure on your machine and shown to no one.

Messages or files can be encrypted using GnuPG or other implementations of OpenPGP using your public key. At that point, the only way to extract the original contents is to use the private key associated with the public key. So, if you lose your private key, all previous encrypted data is inaccessible to you. Likewise, if someone gets your private key, they can extract data encrypted with your private key. The only speed bump in that process is that your private key also has a passphrase (like a password but hopefully much longer) associated with it. To decrypt data, this passphrase must also be entered when the private key is used. This acts as some security but anyone having a copy of your private key has a huge leg up on cracking your data. Keep that in mind (and don’t lose your key either).

Other than actual encryption of data, the other use of a public/private key pair is that you can use your private key to “sign” data, such as files or e-mail. This allows anyone with access to your public key to verify that the source of the data, the signer, is the holder of the private key associated with the public key. This acts as an excellent way (better than a physical signature, actually) to prove that the person sending a file, for example, really is you. You can also sign the keys belonging to other people, if you can verify that it is really that person, and send it to a keyserver on the Internet that holds public keys for people to see. This allows people to validate that other people are who they say they are, helping create a network of trust (so to speak).

Enigmail adds a bunch of user interface (buttons and menus) that allows Thunderbird to easily interact with keys that you have stored on your system. It will prompt you to enter your passphrase to decrypt data e-mailed to you or to encrypt or sign data going out.

Here are some sample screenshots of Thunderbird and Enigmail in action. You can click on these for a larger version.

This is the UI on an e-mail message when composing after Enigmail is installed. Notice the “OpenPGP” button.

If you click on theOpenPGP button, you have options to sign or encrypt a message with a secret key that you have generated.

If you receive a signed message from someone with Enigmail installed, a pen icon appears in the message and a notice of the signature is shown above the message headers.

Clicking on the green bar of the notice above the message will show you details concerning the signature.

This is what a signed message looks like to email programs that do not have Enigmail installed.

If you choose to encrypt a message from the OpenPGP menu above, you are prompted for which public key to use to encrypt the message. If you don’t have a public key for someone, you won’t be able to encrypt mail to them. I chose myself, obviously.

This is what an undecoded, encrypted message looks like to someone who receives it.

If the user can decode it (they have the appropriate private key), this is how enigmail within Thunderbird will display the message. Notice that a key has been added to the icons on the right, to show it is encrypted. The normal message text will be displayed below this.

Clicking on the key icon will display more data concerning the message encryption.

The Enigmail team does have a help page up on their site at http://enigmail.mozdev.org/help.html. There are also other resources available to help get people going. I’m joining the e-mail list for it as well.

My own public key is:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.7 (Darwin)

mQGiBEa3v14RBACZ35+2tHUxkTQBkPhq/syCQrhiZAPv8Y7ZC45o4ThZ45rc67vG
v2SuaD1rTXlBK0m2hXTsoG3iZTWdkN86EjX5cEQZjj8MCv6ifN7Dk2XtziU6kEep
szELVCpO1XsMLBWSGbP/EStyLW64vKZWMvL0kckxc1PmXm2dzX40sc5XhwCghctS
bVoKKoISggMCfz2T97N5LN0D/RjPnI6jvtc0UKahGaidCm7Cn79NNWkyIyoO3eFs
quikh6Oqdps3fETofl6/rf78ewyZsfIH1Nzy6NS2xVcxij5A9unc13a9ODIKfVms
WSPJBtuAI7ISiDcNPZao9/AvcoRSj4pZ3RqZYIdB6VFLNMW5+++RQ3aNY/WS20FD
+au1A/4ynZClGlFgCrbSUyl/t9WZV8XePxrBNw11iCe0bKaheGAKoBz183dPwHu0
XaMp/9AWF7I/j6xBn4rdgF7ultQQecw1kuzboyFVTdxutz5wqlA22C6OkEbNHfIG
mZIW7nKHtZqBB365pWJUOvhGgWphDiudPe5QObEHQaBJ1j0DDrQtTG91aXMgQWxi
ZXJ0IEJpbGxpbmdzIDxhbGJpbGxAYXJjYW5vbG9neS5jb20+iGAEExECACAFAka3
v14CGyMGCwkIBwMCBBUCCAMEFgIDAQIeAQIXgAAKCRC0jS7Esmam/PxFAJ9M45J1
4g+doZXQqRv4utMehWPkXQCfdlzotNjsp6bEwrbasVHvJclTSHm5BA0ERre/XhAQ
ANuUYFV6ODxdXxu+qSmwQf5cHgPFKPBXFm0VK8I2OexZNOz150Cgf1ZKD1/Aqhcj
v733TfagQ4Tk4v5jwOU0kya/rMqg/QwKGwKqP6b5tupPCNvGmnxXrTmP+aotRgsz
KO0fRAaD8xzI1GABqrQ7DpD5OIa72YLFAp602eXhcuMEL53VR03DxP+pVMm74h5Y
sk6JrCQk3DjCtHLen63RxxIrpKvYx1dj1e1IObZ9NeC+AsxcEK6fokvlIft/SgEE
yA+xDtjUFMIo29X9TlYcXfkuo6uBL/IT1XLJuNkDqlQFpAC+bHqoi8C/w79zMVPu
DvWciFsea4ym5MSGRI73hBwFAVs8LnknXwkckaL/3lwy1PnyDZGyCjFDVTR2RlSC
Ies8Zog9+UErRkIA9EutgXsQjLgkqx0pUYNWPHrhI2k5Oi8KmVY9nuBt4i8Lt6Ef
0b0N6V34OGNGg9Z6RFF+0egK4gtrNyyZkZSTqbhDmYMwQZkAzX6C7tl9uNUldwLv
EuS9oyOdV7Qo2MUtuG31smLsd63x+SMU1YfZq7syMFg6PKWVwZDSMqWBFZPcRPQL
uj/9PXsW/av6QVjtAFzjfq34xBmcU2H2cMsuKY/NOmFwrf4eGUPbfz65CnPmA0Q1
ZBeb2xkz8bgjWluaY1qIefITJUde/XWsiExUrD2iGhBTAAMGD/9JV1BXRppe3Inq
559iqwj/vW2kqGhKzEAfwnkiC5mOXRCy5dQUtZ+TVpK7Tt+Am/yQFEd2URy8wypm
UorOcz431CPx+0B7EwTPSiB8XRfwtNiZpQLqGpy68vxeGC+y3rBOXfUwp+wtLUTu
I4LdrG3/pCAVF+Lr/rRgcpYHlYXY3/cqFH+pFFmLwFWzz7lP/f7xtzSFLT3FfwQ8
MnpHyxXTwt+MmAduQELMrX+mpQxLlXtrPLueaos2npnbKXKHSkNlowXb5vd88HYW
2SnELcf9sb0eXouCNA0uy1qmYhVqIceSG8nfUaqyuSclhMbkVM2FCMBfwQggTRnE
CdTw/3InYV9gnFxX8T4mgbUNk7rQK0mqQm902FoE9EDyqV0ZuxsbIRz/E4acyKVR
Q8fOl03DQGXp+Rs+rH3OsBndZilf/XWN0MdZ/7JOewc2iAktxmt/RLGpL31/P9Pq
FzZSJNfHdNehQQyztRncQ8mUmSPiswfga0uYrCIlbmpdCYMVpCIkJs2IlL2ut4EG
tgRh+xmgPuAQ6geCo9S++sWiHoydou5CX29Jvi2qgvw8Iz0RYmkkYyZwFNL/6R91
C2TwS1zJoWJzrZRuUhTT2oGz+ho1ZwIA7zw/jMqaWZNCajGbCTv6Vd+CUd8q49hs
yDiBMXaonPEfeHtJ5B/jlCYR9GVBg4hJBBgRAgAJBQJGt79eAhsMAAoJELSNLsSy
Zqb8jtMAn0bRVwnIVUUDVVeZ3EQA8apPGHwUAJ94bUsaSUIuBh8Mhm9WUFe/1y5q
pw==
=CZn8
-----END PGP PUBLIC KEY BLOCK-----

With getting 2.0.0.5 and then 2.0.0.6 out for Firefox and Thunderbird things have been a little… busy around here.

On the virtualization front, QA did decide to go with the solution based on VMware’s work. There were a number of reasons for this but the primary two are:

1. VMware virtual machines can run on any of the platforms we use in QA or Development (OS X, Windows, and Linux).
2. VMware is already supported for other systems in the company fore infrastructure.

It made sense to standardize around one set of tools.  The first reason is probably the most immediate since the different people in QA do their work in wildly different environments. We don’t mandate any single operating system, for example. Having virtual machines that everyone could use reduces a lot of redundancy (and redundancy means more work for yours truly).

We do still want to get the the point where we can have a pool of machines available that community members could connect to from remote and on which a QA supported virtual machine could be loaded. We don’t have an ETA for this but it is something that we are actively working on.

I still have no reliable solution for virtualizing OS X. This is one that could really bite us at some point as we can have a mix of “clean” and “dirty” environments for all of our other supported operating systems but not anything from Apple.

When we were doing 2.0.0.5 and 2.0.0.6 testing, have virtual machines available made working on update scenarios and localized installations a lot easier since we could switch operating systems very quickly in the same environment and restore them to a good state for the next set of tests.

Anyway, that’s all for now here. I’m hoping to post a bit more this month though.

I’m just starting on the Mozilla QA team in the next week (I actually don’t start for most of a week). A few people here and there might know my name from previous work. I worked on Internet Explorer at Microsoft starting in IE4 and 5, taking some time off for other projects, and then continuing in IE6sp2 and IE7. I ran the public Internet Explorer blog at http://blogs.msdn.com/ie for about a year and a half and also the aborted and much lamented public bug database that was put away after I left the company…

A bit over a year ago, I decided that I was tired of working at Microsoft and living in my birth city of Seattle so I upped and quit, moving to the Bay Area with my wife. I found a job working at MobiTV doing QA for PCTV, which is television on personal computers extending the products that MobiTV offers for cell phones.  This project was (and is) browser based and I spent much of the last year doing primary QA work in Firefox. Much of the PCTV project was done using open source development tools and using Linux as a primary piece of our infrastructure. Recently, members of the Mozilla team and I began talking and they convinced me to see the light and to come work on projects here.

Most of my geek time over the last 20 years has been spent on the Internet, especially the web once it was created. I’ve been on the Internet since 1989, back when we had to hack into the modem dial-in pools at my local university. I’m an ex-moderator of a couple of Usenet newsgroups (soc.religion.gnosis and soc.religion.shamanism) Since the mid-90’s, I’ve had a bunch of domains of my own on the net for various projects of mine, mostly spiritual stuff, and I’ve moderated a number of e-mail lists over the years as well. Before I worked at Microsoft, I was a webmaster at Spry, a Seattle-area startup that put out Internet in a Box, one of the first Windows Internet software suites with its own version of Mosaic.

I’ve been blogging for over five years with my primary blog currently being at arcanology.com. I have a podcast that I’ve begun doing recently called, “Ex Templo: Out of the Temple” that is over at extemplo.org that focuses on some of my non-tech interests.

I have a Bachelor’s degree in Cultural Anthropology from the early 1990’s and I’m currently finishing my Master’s degree at a California State University school. Much of what most people qualify as “free time” is currently being spent on writing my thesis, which is currently about half done at the 70 page mark.

Needless to say, I have a fairly diverse background and I’m really looking forward to working with the members of the Mozilla community on making the best software for the web.