The Everdragons2 project has evolved significantly over time, transitioning from its association with the original Everdragons project to the current V2 iteration. Our primary goal is to create utility-driven NFTs that offer value beyond collectibility or in-game utility. This article will introduce the key differences between the original Everdragons project, Everdragons2 V1, and Everdragons2 V2, the reasons behind these changes, and our vision for the future of Everdragons2.

The Evolution of Everdragons

The original Everdragons project, launched in the summer of 2018 on Ethereum, was among the earliest NFT initiatives. We introduced the smart-contract platform on Tron on October 5th, and a few weeks later, the first NFT landed on Tron as an Everdragons. Sykori, the company behind the project, later built one of the first bridge technologies, allowing Everdragons to travel freely between Ethereum, POA Network, and Tron. It was an exciting time. However, the project eventually ran out of cash and went silent.

I always thought Everdragons was a fantastic project and tried to push the team to do something new. In the summer of 2021, we designed Everdragons2 with many new ideas and a new game, Origins. Unfortunately, the market slowed down that year and crashed in 2022. In the spring we minted the Everdragons2 Genesis tokens, but later people gradually departed from the project, and Everdragons V1 was nearly dying. I remained the only one who didn’t want to let it go.

Just before giving up, I discovered some fantastic MidJourney-generated images by Andy Craven, a very active member of the Everdragons2 community. After contacting him, we discussed AI and, eventually, dragons. I shared my ideas for a new kind of NFT, which he liked, and we started investigating the concept. We soon realized there was enough substance to create a new phase for Everdragons2. The Round Table then stepped in to help with organization, community, and marketing, leading us to where we are now.

Introducing Everdragons2 V2

The new Everdragons2 V2 project focuses on utility-driven NFTs, transcending mere collectibles or in-game utility. We focus on delivering innovative applications and tools that provide tangible benefits to token holders.

A new team has taken the helm of the project, bringing an abundance of experience and expertise to steer the development and expansion of Everdragons2. The unwavering support of our community is crucial to the project’s success, and we are profoundly grateful for your patience and understanding during this transition.

I am very excited about the future of Everdragons2 and look forward to sharing more updates and developments with our community! Thank you for your support, and let’s embark on this wonderful new journey together.

Notice that in the future we will no longer refer to Everdragons2 as V1 or V2 but simply as Everdragons2.

Please, 👏 and share this article to help spread the word 😃

🐦 Follow us on Twitter: https://twitter.com/everdragons2
💬 Join our Discord: https://discord.gg/ed2

Thank MidJourney for the illustrations and the TRT Team for reviewing a draft of this article.

Everdragons2: A New Chapter in the Dragon House was originally published in Everdragons2 on Medium, where people are continuing the conversation by highlighting and responding to this story.

I work a lot with blockchain, and my favorite framework to manage smart contracts in Solidity is Hardhat. To deploy a smart contract to an EVM blockchain, people put their private key in a .env file. The file is git-ignored, of course; still, mistakes are behind the corner and the approach is very risky.

A few weekends ago, on a quiet Sunday, I got scared because I risked to share on GitHub a private key by mistake, because of a typo in .gitignore and, then, I decided to solve the problem once and for all.

That Sunday, I built two tools…

Initially, I thought of a wrapper around Hardhat. A plugin would have been much better, but I hate Typescript and that’s it :-(

I called it Hardhood and it encrypts keys in a hidden folder inside the user’s home. However, Hardhat launches many processes and the captured shell output loses part of what is happening. I am sure I can fix it, but I wanted something that day. So, I took a break of a few hours, and when I went back to my laptop, I decided to embrace the way people does it — putting keys in .env — improving that process, encrypting those keys.

CryptoEnv is the result of that effort. Let’s see how to use it.

In the shell

To set up your encrypted variables, you must install CryptoEnv globally

npm i -g cryptoenv

Then, to create a new encrypted env variable for OWNER_KEY move in the folder where your app is, and run

cryptoenv -n OWNER_KEY

CryptoEnv will ask for

1. the data to be encrypted
2. the password to encrypt it

Then, it will save the encrypted private key in .env, creating the file if it does not exist.

In the case above, in your .env file you will have something like

cryptoEnv_OWNER_KEY=vnJSFJ5E4ZHT1hd8tmMduc1HbQqmkXE/dReUmjHFvud5DsquU6VrOZ+1K3wFj2wYIc8KaClbZWlAtG5HuE2QfE1hx3snHBpz0sqkhfM2v8gTTR77RnLZ23GcKYTGa2G5frcuECngSpE=

In your node app

Install it as usual

npm i -D cryptoenv

Let’s do the case of Hardhat.

You have a conf file called hardhat.config.js. At the beginning of that file you can read the environmental variables with, for example, Dotenv and require CryptoEnv, like

require("dotenv").config();
require("cryptoenv").parse();

Later in the file, when you configure Hardhat to use your private keys, you can have something like

...
    ropsten: {
      url: `https://ropsten.infura.io/v3/${process.env.INFURA_API_KEY}`,
      accounts: [
        process.env.OWNER_KEY
      ],
      chainId: 3
    },
    ...

Then, when you run, for example, a script to deploy to Ropsten, Hardhat will show the prompt:

CryptoEnv > Type your password to decrypt the env, or press enter to skip it

Note: To avoid that Hardhat gives you an error when you skip the decryption, you can set up a variable OWNER_KEY in the .env file, with a fake key. When you input the password, CryptoEnv will overwrite the variable.

What if the app tries to decrypt more than one time?

Some apps launch child processes. If they run more than one, the environment does not look decrypted and CryptoEnv makes a new request.

For example, when you run a script with Hardhat, it often runs a first process to compile the smart contracts, then runs a second process to execute the script. In that case, you can press enter at the first request, and input the password only at the second.

Filtering for multiple apps

Sometimes you have in a repo multiple apps and it is possible that you do not want to share data with them. You can filter your variables using RegExp like here:

require("cryptoenv").parse(/^hardhat/);

and take only the variables that start with “hardhat”. You can also pass a function that returns a boolean

const words = ["home", "office", "street"];
require("cryptoenv").parse((e) => words.includes(e));

You can also use a function for more general cases.
For example, if you want to skip the decryption when testing the contracts with Hardhat, you could require it as:

require("cryptoenv").parse(() => {
  return NODE_ENV !== "test";
});

(notice that Hardhat does not set the NODE_ENV variable during tests)

Security

CryptoEnv uses the package @secrez/crypto from Secrez https://github.com/secrez/secrez

What’s next?

There are many ways to improve CryptoEnv.
Here a few ideas:

• Support Hardhood’s approach with a global conf file instead of a local .env for better security and to avoid involuntary shares.
• Encrypt keys with different passwords (useful, for example, if the .env file is shared with a team). The easiest way to do it is to ignore wrong decryptions (instead of throwing an error).
• Make plugins for Dotenv, Hardhat, Truffle, etc. to simplify the usage. But I leave this to the community :-)
• Support an explicit destination file instead of forcing an .env. For example, the target could beenv.json. In this case, CryptoEnv should save the data respecting the JSON format.

Probably, I will also add an env command in Secrez to export encrypted keys directly from it (which would add more security).

CryptoEnv is open source. Feel free to fork it.

If you like this post, please 👏 and share it!

UPDATE April 2023

The package has been moved from cryptoenv to @secrez/cryptoenv and many features have been added since this post has been written. Look at the History section in the README for more details.

When the original Everdragons started their adventure, users were minting eggs. Any dragon could have a unique DNA composed of seven body parts plus color. Users had to wait for the egg to hatch in order to see which dragon they had purchased. In other words, the sale was blind like most non-fungible token (NFT) drops nowadays.

Everdragons2 will use the same flow.

Problems of a Blind Sale

We can cheat and distribute them unfairly if we know which dragons are the rarest (and potentially most valuable).

The solution is cryptography — of course 😃

People are OK with not knowing which dragon they will have, but they want to know the dragons on the table. We will showcase an ordered list of dragons, describing their rarity to the community before the sale, to address that desire. Later, we will shuffle the list to get the final order with a semi-random approach.

Let us explain it in detail, step by step:

• Hash all the dragons’ images.
• Create a list of metadata objects with the usual fields plus DNA, a list of traits, and the hash of the image.
• Validate the list using OpenTimestamp.org (which works on Bitcoin and is bulletproof).
• Wait for the sale to end and take the hash of the block containing the latest transaction that bought dragon(s).
• Take the list and hash any element of the list with:

hash(element, blockHash)

• Sort the new list of hashes.
• Use the order of the list of hashes to reorder the original list.
• Assign metadata and image to every dragon, according to the semi-randomly ordered list.

In simpler words…we get a list of all dragons, write it on a rock, and later shuffle the list using an unpredictable but provable factor.

The Un-shuffled Elements of the List

Some dragons won’t take part in the shuffle because they are pre-minted including Agdaroth, the team’s avatars (some nice common dragons, no rare ones 😉), and gifts to the community — four baby dragons, and a dozen of dragons with at least one rare trait. Since we will reveal them before the sale and some people will win those specific dragons, they will be pre-minted and stay out of the shuffle.

The Final Verification

We will create a GitHub repo with the metadata metafile, the proof by OpenTimestamp, the hash of the block with the latest transaction buying Everdragons2, and the code to generate the final list starting from the metafile.

We will use it to do the job; you will use it to verify that we did the job as promised 🤝

ADDENDUM (Dec 11th)

Here there is a tool I wrote for the shuffle:
https://github.com/ndujaLabs/metadata-shuffler

We will soon introduce our first initiative to reward early ED2 community members. Stay in touch on our Discord server!

If you like this post, please 👏 and share it!

Join Us

Discord

Twitter

Medium

Website

EverDragons2: Fair Token Distribution was originally published in Everdragons2 on Medium, where people are continuing the conversation by highlighting and responding to this story.

Everdragons2 is a collection of 10,001 non-fungible token (NFT) assets — some rarer than others. Each NFT is created in the form of a mystery egg, which you can hatch in order to get your dragon. In this post, you will learn the story of how I got involved in this NFT project and why it is so exciting!

(Technical) Background Story

First of all, sorry for all the jargon and tech names! They are necessary to keep this article short.

In September of 2018, I joined Tron Foundation to work on their developer tools. The plan was to release the smart contract platform in early October. Tools like Web3, Truffle, and Ganache were needed. It was hard for me to start because I worked remotely from Italy and knew very little about Tron. Still, I forked Truffle and created Tronbox. I also collaborated with Kondax to build Tronweb.

Trongrid was not reliable at that time so using Shasta (Tron TestNet) was not ideal. Therefore, I set up Tron-Quickstart, a developer environment based on Docker to allow developers to test their apps locally without spending money on the blockchain. I moved back to San Francisco on October 2. On October 5, we launched the smart contract platform as planned.

Later, in the middle of December, I realized that Trongrid needed a complete rewrite and therefore wrote Trongrid 2. My intention was to provide a fast and highly scalable service, similar to Infura. My team presented it in time for niTROn 2019, the first Tron summit in San Francisco.

I remember these months with warm feelings. Everything was new, exciting, and challenging.

Then I met Patrick and Jacqueline — cofounders of Everdragons.

Everdragons: One of the Earliest NFT Projects

For the niTROn conference, our marketing team launched a contest to reward the best decentralized applications (dApps) built on Tron. My favorite finalist was Everdragons so I approached Patrick Rieger and Jacqueline Hardy, two of the three founders. I brought them to Tron’s offices where we had lunch and talked a lot. The same day, I met other great people from around the world.

Patrick, Jacqueline, and Marc Scherer launched their non-fungible token (NFT) platform on Ethereum in the summer of 2018, creating a bridge to move dragons from Ethereum to POA Network and back. Later that year, they deployed the first NFT ever on Tron and added Tron to their bridge.

It was magical that people could move dragons among Ethereum, POA Network, and Tron to play games that make sense only on these specific networks.

You may not know that Tron uses a Delegated Proof-of-Work consensus mechanism to validate the veracity of the network. The primary advantage of this is, every three seconds, a new block is mined. To be 100% positive that a transaction is safe, you have to wait one minute. Generally, developers would trust the first confirmation due to low risk. They would move minimal amounts of coins, supporting compelling games on blockchain technology, creating fantastic things as a result.

Sadly, I believe a different approach to the community would have made Tron one of the most important chains out there. Instead, Tron preferred to reward games that winked to a popular audience instead of celebrating technologies that many others could have used. As you can guess, I did not have a voice in high level decisions, but that is another story.

In the end, the Everdragons team did not receive the award they deserved.

Everdragons2: The Following Years

This period of time, called Crypto Winter, was very dark. The Everdragons team could not raise funding to survive and their marvelous project started dying slowly.

I stayed in touch and tried to help, but I could not do much. I tried to buy as many dragons as I could on OpenSea to attract attention to the project. It somehow worked because the floor passed from 0.07 ETH to 0.5 ETH, and a few dragons sold for 1 ETH. It made me happy but it was not enough.

Recently, I developed an idea to relaunch the project and tried to engage friends. I spoke with them for weeks and checked in with Patrick many times to convince him that Everdragons 2 can come to life.

Finally, a group of Italian friends between San Francisco and Menlo Park decided to invest time and money to work on it. Although I have been working on a new decentralized finance (DeFi) technology since July, I could not resist and happily joined the team 😅

The result is Everdragons2, the first decentralized project by ‘ndujaLabs.

In a future post, I will give details about the project and introduce our first initiative to award the early ED2 community on Discord. Stay in touch!

If you like this post, please 👏 and share it!

PS: In the banner picture up top, some of the beautiful original Everdragons in my personal collection.

Welcome to EverDragons2 was originally published in Everdragons2 on Medium, where people are continuing the conversation by highlighting and responding to this story.

If you don’t know what Secrez is, please read my previous post:
https://medium.com/@sullof/secrez-a-secrets-manager-in-time-of-cryptocurrencies-b15120c5aa14

How it works

Supposing that you are using Secrez locally, the communication between accounts is possible thanks to two external components: a courier and a hub.

The courier must run on your machine. It works as a post office, sending and receiving letters — ignoring the content.

The hub must be accessible from anywhere. It is used by couriers to publish themselves and talk to other couriers. The hub does only one thing: generate SSL tunnels towards the couriers (by default, they use https://secrez.cc).

Any message moving around is composed of a payload and a signature. Hub and courier verify the signature and accept or reject the message, only the Secrez account can generate the payload with the encrypted message, and decrypt others’ messages.

The algorithm used for the exchange is x25519-xsalsa20-poly1305 — more info at https://github.com/dchest/tweetnacl-js/blob/master/README.md#public-key-authenticated-encryption-box.

The flow

How to chat

If you haven’t yet, update Secrez to a version >= 0.8.0:

$ npm i -g secrez@latest

Install the Courier:

$ npm i -g @secrez/courier

Run the courier

$ secrez-courier

If you don’t specify the hub you like to use, it will use the default hub on secrez.cc.
If there are no issues, it will show something like:

In Secrez, execute courier. It will ask you the port where the courier is listening to. If the courier is listening, Secrez connects to the courier and take ownership of it. Now, you are ready to chat with someone. First, look at your own data running whoami. It will show your public key and, most relevantly, your url on the hub that you must pass to your friend.

The method used in Secrez is experimental and is far from perfect. So, sometimes the connection to the hub gets lost — some other time you have to update the contact (using contacts -u …). I am working on it. However, in most cases, just repeat the process and the courier will reset the connection.

A quick video

Your own hub

I have set up a hub on secrez.cc to simplify people’s life. But in many case, it would be better if you use your own hub. For example, a company could set up the hub that its employees will use.

The simplest way to go is to install the Secrez Hub on a remote server:

npm i -g @secrez/hub

and run it:

secrez-hub

If you don’t specify otherwise, it will start listening on port 8433.

A more reliable way is to use a process manager. If you clone the Secrez monorepo. You can run the script in the folder packages/hub/bin/pm2. It will use Pm2 and will keep the hub up.

Despite your preference, you should use a proxy, like Nginx, to expose it to HTTPS. You can generate free certificates using Let’s Encrypt.

Since the hub generates subdomains for any courier, it is essential that you set up the DNS for the domain to handle *.yourdomain.ltd. Also, the firewall must allow access at ports higher than 32k on TCP.

Feedback, requests, suggestions

If you have suggestions, requests, etc. please open an issue at:
https://github.com/secrez/secrez/issues

You can also join the Discord group. It is very silent, right now, but hopefully, sooner or later, it will become active:
https://discord.gg/2A3nSA

🙏 Acknowledgments

Secrez Hub is based on Localtunnel Server, which has been created by Roman Shtylman (zombie). I forked it and added some restrictions to make it suitable for Secrez (and only for it). I want to publicly thank Roman to allow the world to use his brilliant code.

If you like this post, please 👏 and share it!

This post has been also published at https://room29.art/secrez-for-messaging/.

Secrez is a CLI secret manager written in Node, which manages an encrypted file system and speeds up operations that are slow, or impossible, with traditional password managers.

I built Secrez during the quarantine, those days when I was not feeling inspired enough to either write my novel or work on some music. But I had the initial idea in 2017, and I wrote a first, rudimental version then. Let me tell you why and how.

In 2017 I was very active in the cryptocurrency world. As a consequence, I had tons of private keys, passwords, and mnemonic seeds. At that time, I was using a modified version of Passpack desktop, which was inadequate to manage this kind of data, like any other standard password manager.

If you use, for example, MyEtherWallet to create a new Ethereum wallet, before using it, it is imperative to back up the private key.

I am not using it now, and I don’t know if anything has changed, but in 2017 MyEtherWallet allowed you to export a Keystore/JSON file containing the private key. Since it was encrypted, you could have saved it as is, but for privacy reasons you would put it in your password manager anyway.

Assuming that you created a new entry in your password manager, to add the Keystore/JSON file, you had to:

1. download the file
2. open it with an editor
3. copy the content
4. paste it in the notes
5. open the ~/Downloads folder
6. delete the file

To restore an account, you had to:

1. copy the JSON from the notes
2. open a folder
3. create a temporary file
4. paste the JSON in the new file
5. save the file as <something>.json
6. import it in MyEtherWallet
7. delete the temporary file

It doesn’t look very smart, does it?

A secrets manager for geeks?

Maybe. Let me talk a bit about the design choices.

The first design choice was about the type of app

Secrez was initially just for me. Since I love command-line tools, it was natural to go for a CLI application. As a consequence, it made sense to use commands that resemble Unix commands. For example, to list all the secrets in the current folder, you can run

ls

You will see an output identical to the one returned by ls in a Unix environment. To create a new file with a single line content, you can run

touch new-file -c "Some secret content"

But you can also use your default text editor running:

edit new-file -c

where the -c is the alias for --create. In general, you can see all the options of a command running

edit -h

and all the commands running

help

Here a screenshot, with some examples:

The second design choice was the structure:

an encrypted file system for the secrets, with the ability to move files between the standard OS and the encrypted OS. In the example above, I can import the Keystore/JSON file with a command like

import ~/Downloads/mew-export-2020–06–22T20_10_15.789Z.json -m

and export it with

export mew-export-2020–06–22T20_10_15.789Z.json -d 30

The first command would import the file, deleting the original one.
The second one would export the file, deleting it after 30 seconds.

One step instead of six or seven. Not bad 😉

The third design choice was about the data

There are two primary approaches to secret/password management:

1. SaaS apps that save the data online (like LastPass)
2. Desktop tools who keep data in the computer (like KeyPass)

An Online Password Manager requires that you trust the remote server. I founded Passpack in 2006, and I know very well how, at any moment, you can add a backdoor, and most likely, nobody will notice it. You can even set a backdoor for a specific user. If the FBI commands LastPass or 1Password to do it, they could be forced by law to do it.

You don’t believe so… Look at this:

US Senators Introduce 'Lawful Access to Encrypted Data Act' - With Backdoor Mandate | News Bitcoin News

A desktop tool is intrinsically more secure, but it is hard to use on more than one computer. The standard solution is to back up the database on Dropbox or Google Drive. Still, before using it, you must download the backup locally. This approach is prone to produce unfixable problems and cause data loss.

Secrez’s goal was to be as safe as KeyPass but available everywhere, like Lastpass.

To obtain this goal, Secrez assembles a few strategies:

• Any secret is a local file
• Any file is immutable
• Any change can be pulled/pushed to a remote repository

This way, you can distribute your data using Git and avoid conflicts because secret files are never modified. There are some exceptions, but they are related to rare actions (like adding a 2FA); in that case, you can be careful.

You can either create a private repo on GitHub, BitBucket, etc. or — much better — setting your own, self-hosted git server, as I do.

In the beginning I tried to use pass (which adopts a similar approach) but I hated its UX, and I uninstalled it after a few days of frustrations. If you like pass, you could give Secrez a try and let me know what do you think 🙃

Another choice to own your data, while having them available online, is to use Bitwarden. It is open-source, and you can install your own server. Still, it does not solve the issues with managing files.

The last one was about the algorithm

After many tests and an extended analysis of the alternatives, I decided to use TweetNaCl for the encryption because it manages symmetric and asymmetric encryption, and prepares a future where it will be possible to share data among users.

The structure

Secrez simulates a file system. The data is organized in datasets. Think of them as separate disks, similarly to /dev/disk1 and /dev/disk2.

By default, Secrez generates two datasets: main and trash, but you can create more. The advantage of multiple datasets is mostly for people who have a lot of secrets to manage. If you have 2,000 (like me) and you put them all in the primary dataset, the system will probably become quite slow. The solution is to move data to separate datasets.

Never lose secrets

One of the primary goals of a secrets manager is to never lose any data. However, since in Secrez, only the most recent tree is read, some secrets could be in the folder and not been loaded. If this happens, Secrez decrypts the missing secrets, reads their positions from previous trees, and puts them back in the tree. If they are not in an older tree, it creates special folders starting from REC_ and puts the recovered files in there.

Make hard to perform brute-force attacks

Secrez uses crypto.pbkdf2 to iterate the password you choose when you initialize the system and generate a derived key, which is used to encrypt a random master key.

The number of iterations is your choice, and it is significant because you keep it for yourself. On my Macbook, a million iterations require less than a second. But if I forget that number, it would require ~100 hours to recover my own account, despite that I know the password, because the number of iterations modifies the salt used during the derivation process.

Let’s say that you set it to 638,276. What if someone who ignores the number of iterations wants to discover your password? The hacker could

1. choose a phrase from a dictionary
2. iterate the phrase between, let’s say, 1 and 1,000,000 times
3. repeat the process for any new phrase

There are many ways to optimize this process, but, even if the hacker uses a high-speed computer that requires only 1 hour to verify the single word, testing 1000 words could take more than one month. If your choice is just a bit uncommon, discovering it could require years.

And, of course, if you had chosen 2,013,900 iterations, the attack above would be a full waste of time.

BTW, your password must be a good one. But you get the point.

To simplify our lives, Secrez can save the number of iterations locally, in a git-ignored file. This is acceptable because the primary goal was to block whoever gets access to the private repo where you back up the data. If you decide to set up a private repo on GitHub, how can you be sure that some employee does not clone it? With a secret iteration number, you can sleep like a baby.

Getting started with Secrez

Secrez is an open-source application built in Node. You can install it with

npm i -g secrez

In the future, I plan to add binaries that you could install with brew or apt-get.

To run secrez, in the terminal, run

secrez

By default, Secrez puts the data in ~/.secrez. If you prefer to use a different folder, and save locally the number of the iterations, you can call something like

secrez -sc ~/Documents/personal/secrez

Importing from other secrets managers

If you already use a password manager, you can import that data.

Suppose you have exported your password in a CSV file name export.csv like this:

Path,Username,Email,Password,Website,Notes,Tags
twitter/nick1,nick1,nick1@example.com,938eyehddu373,,,twitter
facebook/me,,fb@example.com,926734YYY,,"Some note",facebook facebook/second,jerry,jerry@example.com,s8s8s87e78ew,,,,facebook

A field named path is mandatory because Secrez needs to know where to put the file. The path is supposed to be relative, allowing you to import it in your favorite folder. Let’s say you like to expand the imported data in the current folder (that you can check with pwd), and like to preserve the tags as actual tags, you could call

import export.csv -e / -t

If your password manager does not export in CSV format, you have to reformat your data. In the future, I hope that there will be scripts to pre-format the data to import them in Secrez.

Two-factor Authentication

Secrez uses external scripts in Python, based on Python-Fido2 by Yubiko, to support 2FA. It's compatible with any Fido2 authenticator device implementing the hmac-secret extension.

To register my Solo — by Solokeys — I can call:

conf - fido2 -r solo

When you activate the first fido2 key, Secrez asks if you also want to generate an emergency recovery code, which lets you to recover the account if all the registered keys are lost.

Aliases — where the fun comes 🤪

Suppose that you have a card for your bank and want to log into it. You could copy email and password to the clipboard to paste them in the browser. Suppose that you expect to be able in 4 seconds to move from the terminal to the browser, you could run the command:

copy bank.yml -f email password -d 4 2

This will copy the email field and give you 4 seconds to paste it in the browser. After it will emit a beep and you have 2 seconds to paste the password. It sounds quite useful, but it can be better.

If you use that login often, you could like to create an alias for it with:

alias b -c "copy bank.yml -f email password -d 4 2

Next time, you can just type

b

and press enter to execute that command.
It looks great, right? Well, it can be even better.

Let’s say that you are using a 2FA app (like Google Authenticator) to connect to a website, for example, GitHub. Suppose that you have a file github.yml with a field totp which is the secret that GitHub gave you when you activated the 2FA. You could execute

totp github.yml

to generate a TOTP token for GitHub. The token will be shown and copied in the clipboard. Now, you can create an alias like this

alias G -c "copy github.yml -f username password -d 4 2 --wait && totp github.yml"

Can you guess what this will do?

• It copies the username in the clipboard;
• it waits 5 seconds, emits a beep and copies the password;
• it waits 3 seconds, emits a beep and copies the TOTP token and keep it in the clipboard.

You can also use parameters in aliases and create a macro like

alias M -c "copy $1 -f username password -d 4 2 --wait && totp $1"

and call it with

M github.yml

It is fantastic, isn’t it?

BTW, using a TOTP factor in Secrez is a bit of a contradiction because you are converting a second factor (something that you have) in a first factor (something that you know). So, use this feature only when it makes sense.

Final thoughts

Secrez does not want to compete with standard password managers. So, don’t expect in the future to have “form filling” and stuff like that. However, it is open-source and it’d be awesome if you’d like to add a GUI or a mobile app.

The best way to know more about Secrez is to follow its GitHub repo at

https://github.com/secrez/secrez

starting from reading the README, which is updated anytime there is something new.

Back up, back up, back up

An invisible bug can be somewhere, and you could lose some data.

A back up is a lifesaver!

My suggestion is to use Git (or Mercurial, CVS, whatever).
It will allow you to reverse to previous commits in case you lose any data. If you don’t want to use a versioning system, at least do a local backup every time that everything looks fine. You could use rsync for it. If you create a backup folder called ~/.secrez-bak, to sync the data between the two folders, just run:

rsync -avh ~/.secrez/ ~/.secrez-bak/ - delete

A quick demo?

If you like this post, please 👏 and share it!

This post has been also published at https://room29.art/secrez-a-secrets-manager-in-time-of-cryptocurrencies/.

Nel 2006 la mia carriera musicale sembrava andare dritta verso un qualche successo, quando l’ennesima ricaduta mi forzò ad abbandonare il campo per la terza volta. Prima che la voce crollasse del tutto decisi di produrre un EP.

Paolo Grillo è un produttore e geniale youtuber. Quando gli dissi dell’idea di registrare un EP, mi suggerì di farlo allo Studio Compresso del mitico Francesco Albanese.

Francesco era in una fase di trasformazione che lo avrebbe portato a fondare la Makofi Guest House a Zanzibar. Mi ci trovai bene immediatamente.

Registrammo in un paio di giorni. Le canzoni le avevamo suonate molte volte dal vivo, anche se mai col gruppo al completo. Mi limitai a scrivere qualche parte per il flicorno e dare indicazioni su passaggi che non avevamo provato. Tutto andò liscio come l’olio.

A parte me alla chitarra e Paolo al contrabbasso, c’erano Giulio Caneponi alla batteria e percussioni e Gianpaolo Casella al flicorno.

Al piano Giuliano Valori, amico e persona eccezionale che se ne è andata qualche anno fa, improvvisamente, lasciando un vuoto incolmabile.

In un paio di pezzi, compare all’armonica Fabio Mantegna che in quei giorni stava registrando un disco con i suoi Italo & the Ronny Boy Band.

Quando il master fu pronto, ascoltandolo, ebbi la certezza che la mia carriera stesse volgendo al termine. Per quel motivo, fra le varie alternative a cui stavo lavorando, scelsi la copertina con le foto sfocate.

Quando fu tutto pronto e dovevo solo mettere le voci, le mie corde vocali non volevano saperne. Attesi quasi una settimana per vedere se la situazione migliorasse. Poi Francesco mi disse che doveva ristrutturare e che o registravamo adesso oppure se ne parlava fra qualche mese. Allora mi feci coraggio e andai. Potevo permettermi un take a canzone, non di più, e doveva essere per forza buona la prima.

Con le corde ingrossate, stavo almeno due toni sotto. Si sente soprattutto nelle canzoni che vanno più in alto, come Il Lampo nel Temporale, dove la voce è storpiata. A parziale consolazione, potei aggiungere a La Cantina una seconda voce l’ottava sotto, prendendo senza problemi dei bassi pieni che di norma sarebbero suonati male.

In generale, il problema principale fu tenere la nota, col risultato che la voce è tremolante. Quando, di rado, mi capita di riascoltare l’EP, mi rode il fegato. Ma poi penso che se non lo avessi registrato, quel periodo si sarebbe perso e sono contento di averlo fatto.

In seguito, decisi che era meglio dedicarsi ad altro e fondai Passpack con Tara Kelly e Nicola Mattina. Quella nuova avventura mi portò in California. Come si dice? Ogni porta che si chiude ne apre un’altra. L’importante è andare avanti e non fermarsi mai 😉

Le tracce

Qualche spartito?

Anna Mia usa tempi dispari intervallati con tempi pari in una maniera non comune nella musica leggera.
Spero troviate interessante lo spartito qui sotto.

If you like this post, please 👏 and share it!

I lived in Oakland from June 2014 to July 2018, in Adam’s Point, a few minutes away from Lake Merritt.

The Northern side of the lake hosts a bird sanctuary giving refuge to many species of ducks, Canadian geese, Black-crowned Night-Herons, cormorants, pelicans, egrets, coots, and many others.

I was used to walk along the water for hours, watching the birds while enjoying, sometimes, fantastic sunsets. I also took a lot of pictures and videos. On a small island close to the shore, there was a fascinating tree covered with cormorants’ nest.

The peculiarity of those birds is that their feces are toxic and kill the trees that host them. Even if the trees don’t decide to host the cormorants, I like to think that the trees sacrifice themselves to allow the birds to reproduce.

With the many clips I took in 2015 of the tree and the birds, I made a short movie.

Initially, I was thinking of writing a score for it, but I found a piece of music by Igor Khabarov — Try — that sounded perfect to me, and I went with it.

If you like this post, please 👏 and share it!

Originally, it has been published at https://room29.art/cormorants-tree-a-short-film/ on June 15th, 2020.

After the brutal killing of George Floyd, a lot has happened in the USA and in the world. During the protests, we have seen more and more confirmation of Police violence. In the following thread, Greg Doucette reports more than 400 episodes:

Is the situation going to change? I don’t know. I hope so, but politicians are very good at talking about change while also doing very little to reform the system.

In San Francisco, where I live, the major seems to go in the right direction, but one thing is to announce a change, one thing is to implement it. I will believe it when I see it.

I am Italian, and my father was a cop. There, Police can use guns only if there are particular conditions, and if the decision of using a weapon is proportionate to the case. In other words, if nobody shows up with a gun shooting someone, cops cannot shoot; if they do, they will be charged.

When I moved to the USA, I was shocked by discovering that Police can kill unarmed people without being even fired. Honestly, I was not surprised that black people were disproportionally hit because I use my eyes. I see how the city is. There were only a couple of black engineers at Yahoo in the San Francisco office in a few hundred. And I see the bars. In some, inside, you find only whites and Asians, in others only Hispanic, in other only blacks. I would call it segregation.

Socially, I loved Oakland because, as a black city, a generous one, was much more inclusive than San Francisco. I remember that in Room 389, there was always a great melting pot of races. But, even there, things were changing. My favorite coffee shop — Coffe With a Beat — , a fantastic place managed by an old black man, was forced to close because of a crazy rise in renting. Even from a business point-of-view, it didn’t make sense because, still now, after four years, the space is empty.

Where are we going? I don’t know. The Supreme Court just refused to discuss the abolishment of qualified immunity.

I think that a lot more has to change. I was tweeting about this a few days ago:

Instead, I am afraid that the change will be small. More killing will be allowed, more protests will happen, and, sooner or later, if still nothing really changes, the protests will become violent. If so, the powers will use it to reverse everything good has been done in the meantime.

Am I too pessimistic? I hope I am.

If you like this post, please 👏 and share it!

Originally, it has been published at https://room29.art/black-lives-matter/ on June 15th, 2020.

From 2014 to 2018, I lived in Oakland, near Lake Merritt. I was quite happy there because the lake was just a few minutes walking away. Then I had a car. In ~15 minutes, I was at my favorite park: the Huckleberry Botanic Regional Preserve.

Sometimes I was going there to breathe, some other time I brought with me my camera and shoot. As a result of that, I have a lot of footage. My laziness prevented me many times from putting some of the clips together to make a short movie.

A few days ago, I composed a tune that sounds, somehow, like classical music. Yesterday I decided to record it, and I did it. Posting it on SoundCloud, I called it Two AM, roundly the time at which the music started flying around my head. After, I shared it on Facebook, but the way that happens is not ideal. You can not just listen to the music, you must open a new tab and go to SoundCloud. The only way to let people listen to the tune on Facebook is by uploading a video. How to solve the issue?

Initially, I looked for some app to do that, but I didn’t find anything that I liked, and I thought I could maybe build something myself. But I discharged the idea, I am doing too many things these days. When I had almost given up, “Perhaps I can take a look at all the footage I have, maybe some idea will come up,” I thought. I connected my 2Tb backup drive, and a folder name Huckleberry said hello to me. Almost automatically, I launched DaVinci Resolve and started a new project. To align the footage with the mood of the music, I colored it like an old Fujifilm. Last night, around 1 am, the video was ready. This morning I watched it with fresh eyes, I fixed a couple of clips out of sync with the music, and I published it on Vimeo.

If you like to listen to Two AM without the ambient sound in the video, you could appreciate the audio file on SoundCloud.

Thanks for watching and listening to. Leave me your thoughts in the comments.

If you like this post, please 👏 and share it!

Originally, it has been published at https://room29.art/2-am-and-the-huckleberry-botanic-preserve/ on May 10th, 2020.