How to install DOD Common Access Card Reader under SuSE 12.1

There are numerous sites addressing the problem in general.
    https://help.ubuntu.com/community/CommonAccessCard
    http://symbolik.wordpress.com/2007/02/25/using-dod-cac-and-smartcard-readers-on-linux/
    http://ubuntuforums.org/showthread.php?t=1221961
    http://pcsclite.alioth.debian.org/
    http://zxq9.com/dodcac/

This summarizes my experience.

Step 1: Install the middleware
The Linux CAC Reader stack is based on a set of middleware called PCSC (Personal Computer Smart Card), written by the MUSCLE (Movement for the Use of Smart Cards in a Linux Environment) project:
    http://pcsclite.alioth.debian.org/
    http://ludovic.rousseau.free.fr/softwares/index.html

Part of the stack is pscs-tools, not available in the SuSE 12.1 repositories. You can find an RPM at:
    http://ludovic.rousseau.free.fr/softwares/pcsc-tools/index.html

In particular, this is needed to provide pcsc_scan, which is a tool to detect and interpret the reader parameters.

The rest of the stack is available in the repositories, in particular:
    http://download.opensuse.org/repositories/security:/chipcard/openSUSE_12.1/
where it appears as pcsc-lite.rpm.

Step 2: Add the correct plugin module
In addition to the core pcscd daemon pcsc-lite contains a long list of pcsc-xxxxx modules for different types of card readers. The correct one for most modern readers is the pcsc-ccid module.

Step 3: Add the correct PKCS #11 module
The original module to read PKCS #11 keys was coolkeys. Allegedly (I haven't tried) it no longer works, you need cackeys, available from DISA's Linux development site:
    http://militarycac.com/files/Ubuntu11_04cacsetup.pdf
    http://www.forge.mil/Community.html?uri=/sf/go/projects.community_cac/frs.cackey

From the first reference at the top of the page:

Forge.mil hosts both cackey and the DoD Configuration extension, but it presents a chicken and egg problem: you need CAC authentication to get the packages. The easiest thing to do is just download them all at work and figure out how to get them to your {Linux} machine(thumb drive, dropbox, etc). Here's your forge.mil shopping list:

• the latest version of cackey
• the latest version of the DoD Configuration extension for Firefox

I recommend stashing these two on Dropbox somewhere, just to make sure you have access to them later, when that thumb drive gets lost in your car seat and you want to set this up for your buddy on a Saturday, or something like that. Trust me. Just do it.

We address the second item later, but like he says, "just do it."

Step 4: Get the correct CAC reader
The next step is the driver. There seems not to be a Linux one anywhere for the ActivCard. You might be able to use a Windows driver with ndiswrapper but that is an act of self-flagellation most would prefer to avoid. Better to get a supported reader. Lists of readers and their support status are here:
    http://pcsclite.alioth.debian.org/ccid/section.html
    http://pcsclite.alioth.debian.org/ccid/unsupported.html

The latter confirms that ActivCard is a problem child.

Step 5: Get and install the driver
I traded in the (unsupported) ActivCard for an SCM SCR-3310, for which there are Linux drivers here:
    https://alioth.debian.org/frs/?group_id=30105

Additionally you can download the "Latest SCR" Linux driver from
    http://www.identive-infrastructure.com/en/products-solutions/smart-card-readers-a-terminals/smart-card-readers/scr3310


Step 6: Test it
Run pcsc_scan.  You should see something like the output shown in:
    http://militarycac.com/files/Ubuntu11_04cacsetup.pdf
    ~ # pcsc_scan
        PC/SC device scanner
    V 1.4.18 (c) 2001-2011, Ludovic Rousseau
    Compiled with PC/SC lite version: 1.8.3
    Using reader plug'n play mechanism
    Scanning present readers...
    0: SCR3310 Smart Card Reader [CCID Interface] 00 00
    ...
    Possibly identified card (using /usr/share/pcsc/smartcard_list.txt):
    3B DB 96 00 80 1F 03 00 31 C0 64 B0 F3 10 00 07 90 00 80
            DoD CAC, Oberthur ID One 128 v5.5 Dual 

If your output stops at "Scanning present readers..." then you've got it wrong.

Step 7: Set up the browser
Now, this depends on the browser. You wouldn't be here unless you hate Microsoft, so if not figure out IE on your own... That leaves Firefox and Chrome.

I am using Firefox.

Firefox requires a plugin and some tweaking.

The plugin is the aforementioned DOD Configuration addon obtained from DISA in Step 3. 

Once installed it may have to be configured:

• Go to Tools > Add-ons > DOD Configuration x.y.z (x.y.z is the version you have installed) and click Preferences. 
• Click the certificate buttons to update your certificate cache with the necessary DOD certificates (yes, it's that easy), then the acid test: Redetect Smart Card Reader. 
• If it fails to find the reader all is not lost. First, just for grins, go to email.usnwc.edu or some other CAC-requiring site. It may just fly anyhow.
• If not then the following:

    https://help.ubuntu.com/community/CommonAccessCard#Gemplus_GemPC_Card_.28PCMCIA.29
    http://symbolik.wordpress.com/2007/02/25/using-dod-cac-and-smartcard-readers-on-linux/
give the answer: 

• Do Edit > Preferences > Advanced > Encryption > Security Devices
• Check the left column. It should show an entry for CAC Module or some such term with your certificate(s) as a subitem. If it doesn't work then these entries are wrong. 
• Select them and click Unload to remove them. 
• Use locate from a terminal to find the location of the libcackey.so drivers and then use Load to specify their location. Mine are at

    /usr/lib/libcackey.so
    /usr/lib/libcackey_g.so

Now try the CAC-requiring site again. This time it should request a Master Password. Enter your CAC Personal Identification Number (PIN). It then will provide a dialog box with a list of your certificates. As always, choose the email certificate for accessing email, the DOD certificate for accessing DOD web sites.

Done. Enjoy.

KDE 4.7 Window Rules are ignored: Gotcha!

The following applies under KDE 4.7.2, possibly other versions:

KStart > Favorites > Configure Desktop > Window Behavior >
renders a number of options for
    Task Switcher
    Windows Behavior
    Window Rules
If you right click the title bar of a KDE window, e.g., Konsole then select
    Advanced > Special Window Settings
you end up at the same place.

If from the latter you then change something this automatically creates a Window Rule with which you can set all manner of things.

Similarly, from the former, choosing Window Rules gives you a screen where you see a list of your existing Window rules and options
    New …
    Import
    Modify …
    Export
    Delete …

Unfortunately, you can configure away happily and KDE will just as happily ignore your settings until you middle click the maximize button!!!

Now... that is intuitive... NOT.

How to save YouTube video and audio under Linux - BASH script

As promised:

A script to save video and audio from a YouTube URL:

===============================================

#! /bin/bash
#
#    License: LGPL v3+ (see the file LICENSE)
#    (c)2001-2012 C. Andrews Lavarre
#    email : alavarre@gmail.com
#
########################################################################
# This program is free software; you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
# the Free Software Foundation; either version 3 of the License, or    #
# (at your option) any later version.                                  #
#                                                                      #
# This program is distributed in the hope that it will be useful,      #
# but WITHOUT ANY WARRANTY; without even the implied warranty of       #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the        #
# GNU General Public License for more details.                         #
#                                                                      #
# The GNU General Public License is posted at                          #
#    http://www.gnu.org/licenses/gpl.txt                               #
# You may also write to the Free Software Foundation, Inc.,            #
# 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA             #
########################################################################

# This routine was modified 120211 by C. A. Lavarre (Andy).
# It captures a YouTube stream, saves the clip, and then rips the audio
#    to an MP3 file
# Arguments:
#    $1 The YouTube URL
#    $2 The basename
#    $3 [Optional] The destination path
# Usage
#    getUT http://www.youtube.com/watch?v=abcdefg myyoutubefile
# Trap errors
  if [ "$1" == "" ]; then
    # Give instructions
      echo "Usage: getUT http://www.youtube.com/watch?v=abcdefg myyoutubefile"
    # Quit
      exit 0
    # Finish
  fi
# Set the variables
  sourceurl=$1
  base_name=$2
  destdir=$3
  destfile=$3/$2
  if [ "$3" == "" ]; then
    # Change the destination
      destfile=$2
    # Finish
  fi

  destflv=$destfile.flv
  destmp3=$destfile.mp3
# Declare intentions
  echo "Copying "$sourceurl" to "$destflv
# Get the full video
  youtube-dl -o $destflv $sourceurl
# Declare intentions
  echo "Copying audio from "$sourceurl" to "$destmp3
# Rip the audio
ffmpeg -i $destflv -vn -acodec libmp3lame -ac 2 -ab 128k $destmp3

===============================================
I get a weird "unsupported sampling rate" warning, but the output sound ($destmp3) is beautiful nevertheless.


If you have comments or tips please submit. We all win or we all lose. It is not a contest.

Easy when you know how: Saving YouTube Video and Audio

So as usual, the answer isn't simple, but easy when you know how.

    http://linux.seindal.dk/2005/09/12/converting-aac-audio-files-to-mp3/
gives the basics:
    youtube-dl    lets you capture the entire video
    ffprobe          examines the contents of the video
    ffmpeg          strips out the audio and also converts it to a 
                           more favorable format
 
But as always there are gotchas: under linux the mp3 codec doesn't exist, rather there is a libmp3lame library.

So, step by step:

1. Install youtube-dl, ffprobe, ffmeg, and libmp3lame using your usual process, repositories, whatever.
 
2. Given a YouTube URL of
    http://www.youtube.com/watch?v=abcdefg
    at a terminal issue the command (under Linux, do whatever equivalent elsewhere):
    cd "directory I want it to be in"
    The quote marks protect the path from embedded spaces... Then issue
    youtube-dl -o "myyoutubefile.flv" http://www.youtube.com/watch?v=abcdefg
    This will save (output: -o) the YouTube video clip as a Flash video (.flv) file containing both the video and the audio.  Kaffeine will quite happily play both.
 
3. Check the audio and video channel formats with
    ffprobe "myyoutubefile.flv"
    The output of this will contain a string
        Stream #0:1(und): Audio: aac (mp4a / 0x6134706D), 44100 Hz, stereo, s16, 147 kb/s
    or something similar, indicating that the audio format is aac.
 
4. Strip out the audio to another format  (e.g., here we go to mp3) with
    ffmpeg -i myyoutubefile.flv -vn -acodec libmp3lame -ac 2 -ab 128k myyoutubeaudio.mp3
 
You can do this all in one step with a handy script. Watch this space.

Easy when you know how...

GnuCash 2.4.9 Workaround

The upgrade of openSUSE to version 12.1 results in an upgrade of the guile library from version 1.8 to version 2.0.

Unfortunately GnuCash (versions 2.4.7 and 2.4.9)  still depend on guile 1.8. As a result GnuCash crashes on start with 

     ERROR: In procedure debug-options-interface: Unknown option name: maxdepth

See

     https://bugzilla.novell.com/show_bug.cgi?id=724917

for the gory details.

Fortunately, there is a workaround until the openSUSE folks sort this out.

The workaround is to use YaST (yast2 sw_single) to DELETE guile 2.0. This will result in an offer to roll back gnucash to version 2.4.7 and to roll back guile to version 1.8.

Which is fine by me.

Solution: Displaying KTimeTracker results chronologically

KTimeTracker is very cool. It automatically adds events to an .ics file for events on the computer.

But it has no way to display the record in a chronological fashion.

The solution is a bit of a hack, but after several hours of googling about it seems to be the only way:

1. Load the .ics file as a new calendar in Thunderbird's Lightning calendar application (Sunbird is defunct, Evolution does not offer the conversion).
   File > Open > Calendar File > (Navigate to the .ics file)
  
   This will display most of the events as "Tasks" but not to worry, we are just using the file conversion feature of Lightning.
  
2. Export it as a .csv file:
       Right click on the calendar file in the left panel (e.g. chronology), select Export Calendar,
       select Outlook Comma Separated Values (.csv) as the output file format,
       and choose the filename (which in this case defaults to chronology)
       (Delete the calendar in Lightning: right click and choose Delete...)
   
4. Open the exportedfilename.csv in Excel or OpenOffice Calc. This will trigger the text-to-columns editor. Ensure you select Separated by: Commas and especially, Detect special numbers or else the times will be imported as text fields with a text delimiter I cannot figure out how to delete.
  
5.  Format the date and time columns as desired. I prefer 24 hour formats, which at a touch confirms that the times have been properly imported.
  
6. Sort the result as you wish.

Easy when you know how...

As I said, this is a hack. It only gives the result at a snapshot of time. I wish KTimeTracker would just offer a chronological sort presentation, which would show ongoing results. But it doesn't.

NDAA, SOPA, PIPA, MPAA, RIAA, and Life, Liberty, and the Pursuit of Happiness

18 January 2012 was an historic day, mark my words:

WE THE PEOPLE spoke with unequivocal clarity: 

     Yoh! Government! Butt Out!

There is a clear, dangerous, and hideous trend here:

• NDAA: Elimination of habeas corpus protection, after 900 years
  
• SOPA/PIPA: 
• Elimination of due process: arbitrary website shutdowns on suspicion of malfeasance broadly defined
• Redirection of web access ("DNS" filtering): effectively reporting you to authorities for even trying to access certain websites

I won't sea-lawyer the details here, there are plenty of other sites that explore all the niceties. If you don't know the acronyms then Google and Wiki-dive when you can. 

The point is that there is a collusion afoot between our elected representatives and big business "content vendors" (MPAA, RIAA) to restrict our historically defended (um, with blood, need I remind you) rights to freedom of body, speech, privacy, and spirit.

So what can you do?

MAKE A NOISE. Complain. Write. Join. Post. 

If you just let it happen, if you insist on being politically correct, you have no one to blame but yourself. That is what happened in Germany in the 1930s.

Anyone who is purposely trying to hurt you is NOT your friend. Not family, not associates, especially not politicians.

So, MAKE A NOISE.

As for the MPAA, RIAA, News of the World, all the "Times", and the newspaper industry in general, consider the following:

• Studies have shown that if someone likes a product they'll usually end up paying for it. That certainly goes for me.
• On the other hand, I don't pay for trash.
• Most of the movies out there are trash. Violence, foul language, stress... who needs it? 
• Packaging a ton of trash with the one good song is common recording industry practice. If you want the one good song you have to pay for all the trash you don't want.

London Times does the equivalent. You have to buy an entire week of papers to get Internet access to their site. I don't have time to read all that trash!! So I canceled my subscription, and haven't missed it a day.

I can go on and on. But the bottom line is that most people are decent. The people they are trying to get with these measures will find another way and most are just doing for fun or bragging rights anyhow. So they are cutting off their noses to spite their faces.

And when you do that at the expense of my freedom, liberty, and privacy, then I get mad.
Fighting mad.

And not just I.

LISTEN UP!! WE THE PEOPLE!!

As for actual measures to fix the problem:

Term Limits

We need to change the kind of people that are drawn to elected Government positions.  That means changing the system fundamentally from risk-averse to risk-prone people. People willing to stand up and strike out.

Like me.

But people like that will burn out. So they won't stand for the twenty or so years it takes to get into a position in which you can actually accomplish something.

So the system needs to change to let people like me get in, fix things, and get out.

And that means TERM LIMITS. Three strikes and you're out:

• First term to figure out what's happening
  
• Second term to actually try to do something
  
• Third term to start to become cynical and conniving.

And that's it, bubba, home for you.

It's no coincidence that that is why the military typically limits tours to three years. It works for action- and results-oriented people.

So:

Make a noise: write your representatives, post to your friends and the web. Do Something!

If not, you have only yourself to blame.