Hi, I'm Leonard Pottering, and I'm going to take away your home directories now. I'm a bit sick, so I hope I'm not going to lose my voice in the middle of this talk, but I'm talking about something that has not been versioned to system.ly yet, but hopefully will, and it's about reinventing home directories as the title says, because I mean, reinvention is what we do with system.ly, right? Anyway, I think I have good reasons for this stuff, and I hope to explain why, and I hope to also explain what precisely I have in mind that we do. So, what am I talking about? I'm talking really about your home directories, right? Dollar Home or Tilda, whatever you want to call it. It's that stuff that is paired with an entry in Etsy PassWD, and makes up your user record and your user dataset, if you so will. After working with Linux and Unix for a long time, I came to see quite a few problems with the approach we so far had. I'm pretty sure everyone of you knows how this works, right? I saw a couple of problems with this. First of all, the way we currently manage user directories in Linux is basically it requires a writable Etsy to create a user, right? So far, we always have this goal that if a system's configuration is not supposed to change, Etsy should be immutable ideally even, and hence the requirement that if a user is created, removed, or modified, or whatever, you need a writable Etsy kind of sucks, because a user's existence is not really configuration, at least in my view, right? So, the concept that mixes state, I believe that the user record is state, it's not configuration, and the rest in Etsy is generally understood to be configuration in this way. So there's this semantical, this philosophical problem already that, yeah, Etsy makes a state in configuration, and then this propagates into the problem that Etsy needs to be writable. There's also this problem with Etsy PassWD and home management, that user ID assignments on Unix need to be propagated between systems, right? There is a lot of infrastructure in this world for LDAP databases, how user records are distributed among many systems, how NFS has user ID translation, diamonds, and whatnot, because, yeah, everything is bound to user IDs, like numeric Unix user IDs, like these 32-bit values where zero means root, and the meanings of those in context of Unix network file systems always need to be propagated between systems, and that to me sounds so backward, because it basically means that every system you have only exists within a very specific institution, like organization, because only within that very specific institution and organization you can say that user Leonard has numeric user ID 555556 or something, right? So, yeah, I think the classic model worked as long as you had few systems, right? And created, like as soon as people tried to scale it to more systems, they came up with this massive complexity that is LDAP and things like that, and they end up managing this user ID that nobody actually really cares about, which is just an artifact of the implementation, and there's nothing something people should really care about. And in a world of today where we scale to the Internet, right, user IDs are complete in artifact of the 1970s, right? Like if I have a Google account or Facebook account or whatever account on the Internet, there's no user ID assigned to it because it makes no sense, nobody wants that, right? I mean, there are reasons why user accounts have user names, there are reasons why they have passwords, but the reasons for them having a numeric user ID on a specific system are a little bit weird. So, yeah, I see that as a problem. There's another problem. This model means the way we deploy it right now, no encryption, right? Home is generally not encrypted by anything that is directly related to the user, right? Slash home, like you might have full disk encryption, right? You might have encryption of slash home as a whole, right? But this is system-wide, if you will. It's not specific to the user, and that's weird, right? Like, because right now, like at least on my laptop, the way I installed it in Fedora, like a couple of years ago, I got the full disk encryption, so I boot up, I type in a password. That is my password, but also it's not my password because it's actually my laptop's password, right? Then I authenticate against my system. That decrypts the hard disk. Now, this is the password that actually matters, right? And after it booted up, I have to re-authenticate a second time into my actual user account, and that password doesn't really matter that much because at that point, all the data of the home directory is already fully available to anything on the system that ever wants to see this. So, I see there is this really weird discrepancy, like this mismatching encryption that we protect, like the stuff that's actually associated with user account is not what protects your data. It's the other stuff that protects your data that is system-wide, that if we actually had multiple user systems, like where multiple users use the same machine, where they would have to share that password, that makes no sense. The only way why we so far got away with this is because most laptops are single user systems, effectively, even though Unix and Concept can support more. So, I think this is the stems from... Yeah, nobody wanted to touch the way how Unix user management worked, and so we came to the discrepancy and we got away with it because we effectively are single user systems. I also see the problem... Yeah, Etsy, past WD only knows Unix passwords, right? Passwords, as you know them, it doesn't know anything else, right? Everything else how you might want to authenticate these days, whatever else, cannot be an Etsy past WD because it's not extensible, right? So anything more modern, anything... If you even want to authenticate with a pattern, right, like which is what phones do and which you might want to do on your laptop too if you have a touchscreen, it doesn't really fit into that model because, yeah, there's no way how that's available there. It's not extensible. This is actually a massive problem, right? Like, Etsy past WD, this database was designed in 1985 or something like this, has not been modified once since then. There has been this extension, like the shadow database, which added, like, five more fields or something like this, but everybody wants to add their own fields.  These databases that extend the user record, but they're not actually stored in Etsy past WD in the user database itself, but at some other place. And that other place means something very different regarding where you're looking. So, for example, Etsy shadow was the first sidecar database that was introduced, and it contains information about the actual password used and, like, account, like, validity restrictions, things like that. But then accounts demo is like this gnome thing. They wanted to add a picture for each user, so they have a sidecar database for that and a couple of other things. Samba has one because they wanted to have a GUID, so they created their own one. It's also somewhere in VAR. There's SSH, which wanted to have the authentication key, right? Like, the authorized keys thing in your home directory, right? Which is part of the user identity. It's how you authenticate. It's like your password in many ways. But, no, we can't put it in the password file because it's not extensible, so we put it in the home directory. And then, yeah, SSR tries to read from that, and it's highly problematic because, yeah, you have a privileged demo that goes into the unproved user directory and it's dangerous as shit. So then we have PAM limits, which is about resource management, right? Like, people want to be able to set limits on specific users. They want to make sure that some users can have more presence than others. The way they do it is they came up with their own configuration file, which is not even a database, but a configuration file in EtsySecurityLimits.com for something like this. So, yeah, we ended up with this... Yeah, simply because it's not extensible, we ended up with a distributed thing that you can't even manage centrally. Like, even if you use LDAP and try to manage this centrally, it usually covers, like, a fraction of this. Usually, the Unix records, maybe the Shadow stuff. But then as soon as you go into, like, sharing pictures of users with LDAP, that's, yeah, that's strange territory. Yeah, this is kind of the same thing. There's no resource management doable with EtsyPastWD. And I think resource management matters a lot, right? Like, because not all users are equal. So, you want to be able to assign specific resources, memory, disk space, whatever else to users. And, yeah, EtsyPastWD can't explain this. Then they create another secondary database for this, which is a quoted database on disk. But, yeah. So, resource management is, as soon as you think about multiple users, you also want to think about the differences between multiple users and how many resources you assign to each. But we can't really do this with EtsyPastWD, except through this mess of sidecar databases. So, this is, yeah, so far, like, a number of the problem. They think they're a lot more. This is kind of the problems that I saw that I wanted to fix with what I'm talking about here. So, let's talk a little bit about the focus of what I'm suggesting here. First of all, it's only about human users, right? I don't care about system users in this context, right? Like, system users being the stuff that demons run under. This is about human users, like me and you, right? The stuff that you have on a laptop. It's not the stuff that you have on a server so much. The goals that I want to be able to deliver with what I'm talking about here is, first of all, migratable home directories, right? Migratable home directories means that you can take a home directory, add one unit from this laptop to your new laptop or to your third laptop, and it will always work and be self-consistent in itself and comprehensive and hence migratable, right? So, this basically means that as little as necessary should leak into the system surrounding it, and particularly when it comes to configuration, which is very different from what was there before, right? Like, before home directories' user accounts were not migratable, right? Because, as mentioned, we have all these sidecar databases and there's no way you can sensibly migrate all that metadata that is distributed in all these configuration files in Etsy with the sidecar database and VAR and whatnot from one system to another. I want to go to this way where home directories are... Yeah, somebody didn't turn off his phone. I wanted to go... I want this to go to the way where they're truly migratable, right? Like, all the way to the point where you have a USB stick like this one and that this can be a home directory and you plug it into my laptop and then kind of work there and I can take it out and put it into another laptop and work there, but that this USB stick actually is my user account, that it is my home directory and it's truly and natively migratable without any magic bullshit of propagating configuration into the system, right? So it's about isolation. It's about unification, everything into the home directory itself and cleaning this up. I already mentioned this a bit. It's about self-contained home directories, right? So right now, as mentioned, if you want to have a user account, you have files everywhere. You have files in Etsy PassWD in entry. You have an entry in Etsy Shadow. You probably also have an entry in Etsy Group and Etsy G Shadow. You have the home directory itself. You have all the SideCore databases. The goal with this is, yeah, self-contained home directories. Everything that is on the stick comprehensively describes the home directory. By the way, I'm putting this stick here because it's not supposed to be just about the stick, right? The fact that we can have home directors on the stick is kind of a nice side effect of what I'm doing. But my main focus is actually not that. Most people probably want to have the home directory on the laptop. I know this and that's what I want myself. I just want to make the point that it should be that migratable that you can have it on a stick and it kind of makes sense. So yeah, self-contained home directories, right? The metadata about the user should not be distributed information about the user itself with all the resource management and stuff. It should be part of the home directory itself. This then means that the mere existence of the home directories file where everything is stored should synthesize the user account in full, right? It should make sure that if you call getPWNAM or something like this, like the classic UNIX APIs to query user, the mere existence of the user file store should synthesize everything else, right? In a way, you could say I want that, yeah, you know, UNIX, everything's a file, that, yeah, users should be a file too, right? Like where you just have one concept in the file system and that everything else comes from there during runtime and is not propagated persistently anywhere else. One of the goals that I also have is UID assignments should be a local artifact, right? I want that if I stick this USB stick into this laptop that I might get a UID and stick it to another one and that UID is already used by another account there, they get a different one and it shouldn't matter, right? This is a hard problem. We have to cut some corners to implement this, but, yeah, I want that in a way, in fact, it's when this home directory is bound to this specific laptop, it gets a user ID assigned and that's how it is, but if it's bound to a different laptop as well, it might get a different one there, so that the propagation of the actual UID numeric value is not necessary and all this infrastructure having centralized databases like LDAP and stuff to stabilize this are not necessary. I also wanted a unification of the user password encryption key. This is what I already mentioned earlier. So far, we had the encrypted password in EtsyShadow like this Unix password string, $1 $6 something and we have usually the hardest encryption like the blocks password. I don't want this to be two different things. I want this just to be the same thing. If you're capable of decrypting a home directory, that's good enough as authentication that you're also allowed to and also the reverse should be true, right? If you're allowed to log in, only then there should be any chance for you to access the home directory. So, yeah, I want these two concepts to just be merged and be the same thing. Also, and this is really important, we should have like in 2019 extensible user records, right, so that people can put in these user records whatever they want, right, and we propagate that through our APIs to have a wants to know this and, yeah, so that we are not stuck to struck past WD, right, this five field structure defined in 1985 or something but people can stick in there whatever they want, like if they have some weird requirement for their own company they can put something there and if other people have different requirements they can put something else there, but we agree on a common basic vocabulary but are highly extensible. Also, one of my really important goal actually is to lock locks on system suspend.  But this systematically, I mean it kind of defeats the encryption, like the encryption that you have there because basically the way it's currently implemented you use heartless like full disk encryption so while the system is up, suspended or running we are up in that context the decryption key is in memory, right, so if I go through customs to a country that I don't trust and I have the laptop with me and it's suspended and they pick up the laptop in that memory you'll find the decryption key from a heartless and that's something I think we should not do, right, we should and this is something that people might not find important but I think it's actually one of the most important things in this entire approach at all is yeah, when you suspend the system the decryption keys need to be removed from memory, right so that I know for sure that if somebody steals my laptop in suspended state because that is the most common state that they will probably steal my laptop in they should not be capable of getting any access to my hard disks, right again, this is something you really really should care about because it basically so far defeated all kind of encryption that you had because yeah as long as you did system suspend and everybody of you does that if somebody steals your laptop they can get everything they want so doing this is actually much harder than it sounds at first like because we, the reason why we're not doing this on general systems right now is because yeah if you use full disk encryption and the operating system itself is encrypted right so if you come back like if you actually flush out the cryptographic keys when you go down for a suspend and then you need to require them from the suspend who's going to ask the question if it can't even be loaded into memory because it itself resides on that encrypted petition that you want the password for, right so there's a bit of a chicken act problem and nobody solves this so far with this I want to solve this right so that when I suspend my machine the operating system itself is independent of the individual home directory so that we can suspend the home directories independently of the system itself and hence solve the problem also I kind of indicated this already I think we need to move to more modern ways of authenticating yourself to the system passwords great but also maybe we should do something better so yeah one thing I want to be able to deliver from day one of this system home this thing is UB key support I mean UB key I put in the sense of how you would use the word Google for search engine it's not just about UB keys it's about anything that is like an authentication token that implements PKCS 11 and I think we should do it properly meaning that we actually use the cryptographic properties that a UB key provides and hence yeah if you don't have the UB key that there's no way in the world the cryptographic key for unlocking your account and for accessing the data on disk can even be retrieved so that's the goal goals that I have there's some complications with all of this SSH logins I mentioned that I wanted that user authentication and decryption of the hard disk is the same thing this is inherently incompatible with how SSH traditionally works because as mentioned if you authenticate via SSH it goes via the authorized keys file in the home directory so if you want to authenticate something that is inside of the home directory so that you can access the home directory where does the decryption key come from to access the home directory you follow what I mean there's a chicken neck problem you're reading out the key that allows you access from the encrypted thing which you only can after you authenticate it so my answer to that is we don't allow SSH logins as long as you have not locked in first locally because I mean allowing SSH logins the way that traditionally done means that inherently the home directory of the user needs to be accessible before the user locks in and I think that's something I really don't want to have I really want that when I'm locked out here that not me but not also anything else in the system can even access my home directory that includes open SSH to read the keys from that so my answer to this is SSH logins into systems that use this can only be done after I logged in locally which decrypts the hard disk makes it accessible and then SSH can access and everything's fine also by the way actually the authorized keys files something I I think I already implemented even should be part of the user record so that you can actually yeah it's just there and yeah this already actually works this space assignments are a bit of a problem right we probably should come back to this one later a little bit when I talked about how the storage of what I'm doing is actually done another problem is UID assignments I kind of already indicated that so the problem is if we want the UID to be specifically local to the system right it might happen because the range of user ID is very small like it's just 32 bit that there will be collisions right like that if I have my home directory on this laptop and then take out the USB stick put in another laptop that somebody else might have already used the UID that I used here yeah this is very likely because the space is so small ideally the kernel would help us with this right because we had something like shift of S so that it doesn't matter what's actually on disk that as the moment where I log in I get assigned the UID and then I mount virtually all the files to the right user ID we can't do this so we go for the next best thing which is churning recursively if we have to and try to avoid really hard having to do this if we can thankfully churning recursively surprisingly fast actually if we actually have to do this and I'm kind of okay with the behavior of this because I mean we tried very hard to make the UID assignment stable so for example we hash it from the username but that's never going to be enough because the name space is so small but this basically means that probably in in real life if it's just Leonard and I have like three machines and I take this one out and move between them I will probably never need the churning but it's there to make this safe and ideally and sooner or later we don't have to do the churning anymore yeah looks locking I already mentioned that that this is kind of complicated but there's also a couple of other complications if we do the looks locking on suspend right like where we remove the cryptographic keys from memory as we go into suspend mode we need something that queries for the password again when the machine resumes because until that happens the home directories are locked completely locked and cannot be accessed because there's no cryptographic key known for them so we actually need cooperation for this from the UI like everything else that I'm doing here I can do without any UI involvement but in this case we need some some cooperation from the UI specifically meaning that when the system comes back from from looks your display manager like gdm whatever use will have to reassent the user because I mean mostly effectively they already do this but they do it the wrong way right now because mostly the way that they do it is that the screen lock that is turned on on suspend actually runs under the user identity of the user itself this doesn't work if we suspended the home directory of the user because we can't run code until under the user's own identity until the home directories resumed again so what we need here is that gdm for example is patched that when it comes when the system comes back from resume it asks the password again so that we can unlock the home directory and we can switch back to the user login session so I know this is a lot of material so far let's now actually have a look in the actual stuff I did on the actual code concepts yeah there are two new concepts like one of them is I want to go for jason user records like everybody knows jason jason is like what the internet people all do I think we should just start using that for our user records yeah the reason why jason is because it's just the most basic thing it's supposed to be machine readable it's not supposed to be so much something you write it's something the computers write for you and things like that and it's also what probably most of the internet facing user database is probably used anyway when they exchange information about users across the network so that's the first thing jason user records it's supposed to be a super set of the nss, nss is the name switch of glipsy it's like a generic term glipsy uses for struct past wd instruct group which for the ones who don't know unix so much that's how user records are done by glipsy since then 1985 these jason user records are supposed to be curable via vialing for those who don't know is a very simple IPC system it's just uses jason and it's supposed to be the most trivial IPC in the world so that as long as you have your own jason parser you don't actually need any kind of other code base I have a slide later why vialing is the right answer here and not debuts there are good reasons for this yeah the idea is also that from these jason user records that are curable via vialing interface we can convert forth and back between this and the classic ones in one direction of course it's lossy because jason stuff can have any kind of metadata while struct past wd instruct group cannot how does this specifically look like this is an example now if I had a laser pointer I could show you I think some of them this is pretty much self-explanatory like username you guessed it is username this position is just yeah ignore that nice level for example configures that when this user called groby logs in that all his processes get nice level 5 right it's pretty self-explanatory member of means this user is supposed to be member of the group wheel I think yeah what's interesting here is the binding thing binding is supposed to bind a specific user record onto a specific system the reason why this is a sub-object and not part of the main thing because depending on specific systems resource management is probably going to be different right like if I have a user record for you Leonard on my desktop my super beefy desktop and I want to put a size limit on it it should be specific to that desktop because it has so much more memory than my laptop might have right so the binding concept here basically you see that hack string that's actually the Etsy machine idea basically just says yeah the following properties apply only if this is bound to a specific system and then yeah GID is the GID UID is the UID what you see there is like meta information about how the actual storage is done we'll talk about this a little bit later this continues privileged is a special section that contains a privilege information basically what Etsy shadow is the reason why it's a sub-object is so that we can strip it if somebody is not supposed right so the idea basically is that all the information that is an Etsy shadow traditionally plus all the new stuff that people want to come up with should be in a specific sub-object so that whenever somebody who shouldn't see this information wants to see the record we can automatically remove it anyway I don't want to go too much detail about the structure of these records there's documentation plenty about this what's also interesting is you can sign these we'll talk about this later why that's interesting so that was concept A extensible, JSON, user records plus an API how to query them kind of replacing getPWN but also compatible concept B is I want that home directories are encrypted lux loopback files in slash home right so that you know if I have a user called foobar in slash home traditionally there was slash home slash foobar I want that there now is slash home slash foobar dot home and it's a file and it's actually a lux loopback image and then when the user logs in what do we do we set it up via lux stuff as a loopback file and then we finally mount it after validating that everything's okay these extensible user records are supposed to be stored inside of that image inside a file dot identity that's nothing magic about that this stuff is supposed to be managed by a tiny diamond and it's actually not, it's really small because it doesn't do much that is called system.homed.service what does that thing do it's okay I have not much time left there's so much more awesome stuff in this but let's let me finish this quickly so system.homed what it actually does is it just the thing that sets up these home directories as you log in right and it also provides NSS interfaces so that the old APIs all work right so that you can do get to end on the shell for example to get the user database and find then automatically all these user records and everything works this concept B like this encrypted lux stuff can be used like it relies on concept A but concept A you can actually use without it right so if you just care about the extensible user records that's totally fine and you should by the way because like even if you have the LDAP classic user databases you might want to be able to hook up hook into system.d resource management because all this new stuff is hooked into system.d's user management like for example there's PAM system.d that has been around for a while but what it does actually takes the JSON record pulls all the resource control that makes sense like from from the nice level as you have already seen the classic resource limit but also environment variables and that kind of stuff sets it for all the pros that log in there is also support in system.d login.service which kind of does the same thing when you log in but it applies it to the C group stuff right like so that it applies to the user as a whole right so if you are into LDAP and provide these extensive user records just by doing that you get this integration to get all the fancy resource management you ever dreamt of yeah so I think this I kind of already explained this but yeah I care about encrypted home directories and loopback files I care about encrypted home directories on block devices like this USB stick for example so that we have something truly migratable there while this is what I tell people I'm going for right like encrypted look stuff actually the system.d home.d component does not just support that as a back end it actually has four more back ends like classic plain directories for compatibility but our SAP volumes FS crypts and looks but again looks that back end is the one I want to push those tools towards because it's the only thing that's actually fully secure because not just the payload of the user but also the metadata is encrypted and it's fully featured and all these kind of things industry standard and stuff like that I mean this is after all an exercise and not coming up too much new stuff but just taking what's already there and that is looks for example but anyway my time over I'm fully aware that I totally did not finish all the beautiful slides I have there these slides have been online for a while but I probably should take some questions at least yeah somebody has a question there can you like there's a mic thanks so in the user the JSON structure there was a list of groups for the user so that needs to be somehow verified by the system right so how do you approach that because user can change like whatever groups he is and then it will ultimately gain access on whatever systems they look in right I mean the explanation isn't this thing in the signature so basically the user records are supposed to be changeable by only privileged like the administrator or whoever manages user record and each system will only accept the user records that are signed by the right people where the key where the signature can be verified and the key is known for this right and this is actually it's not an option like in at least if you manage stuff with system D Home D it will insist that everything is signed like we live in a world where cryptography is everything right so yeah this stuff will refuse allowing you to log in on a random use B-Stick it will only allow you to log in with random use B-Sticks that have a user record on it that is signed by some key that is recognized by your specific laptop and you can recognize as many as you want so you can change that file as much as you want but if you do you just lock yourself out because you can't sign it because you don't know the private key being used yeah so the question was whether you need privileges to change the SSH key of your own user account yes you do it's the same way as it always was for changing your password that also requires privileges this is hidden from you usually by suing suit and it's the same way we can hide this through policy kit but yes I mean there's no way that your code pass that run until your user identity can make these changes and I'm pretty sure that's how it should be if there is desire to allow unprovided users to change some artifacts of the user records it always needs to go through privileged component that's policy kit whatever else to allow this so if I got you correctly you said before that you need to login first in your account before being able to do an SSH login to that let's say I'm a university student and I have an account on the university lab and I'm at home and I want to access my account on the university lab computer but of course the system was rebooted overnight so I cannot travel 200 kilometers to how would we handle that use case would it be possible for instance to store the SSH key as a looks key and to change open SSH to unlock my home I mean SSH doesn't deal on passwords it gives you a challenge and you're supposed to respond to that and if that kind of stuff means that the only way you can do things if the other side you're syndicating against is an active program that's not how looks works looks you authenticate against a disk image so this is inherently incompatible you cannot use at least I don't see how you could use SSH authentication to decrypt a home directory that is semantically incompatible so my answer to this is if you really want that the system can come up on its own and decrypt your data don't use the stuff this is about security this is not about giving up any kind of access to your data this is about supposed to protect the system to protect your data from the system as much as possible so that when you're not locked in it's really cut off mathematically cut off and regarding to SSH what about having SSHFS reverse so that your local home folder you already decrypted and opened is used over there and then the credentials inside of that is somehow unlocking over there the homes you know what I mean this of course always works like I mean yeah if you so you know for the UB key support I'm not sure if you know UB key stuff there's this general accepted API for accessing security tokens it's called PKCS11 and there is a project inside of Red Hat and it's actually I think including Fedora and everything which allows you to propagate PKCS11 devices across the network through SSH for example and that kind of stuff you can make all the security encryption keys and all that stuff that is available locally also available on a remote system to do that kind of propagation I was interested in this because I wanted to make it possible like I have a UB key in this device and I would ideally would like to just use that to authenticate through SSH onto another system that runs system be home D and so that yeah the crypto key is sanely encrypted through that right through this PKCS11 forwarding I'm not sure how realistic that is in the short term but I'm kind of yeah well let's see how that works but again I mean the other way right that we were just talking about like logging over SSH into my laptop I'm not so sure that's that much of a common case because my laptop is a client it's not a server right like you usually lock from it into other systems you usually don't lock so much into your laptop from the outside it's like philosophically yeah sorry having oh on the other system I mean sure yeah I mean there's the solutions like I mean one thing that is actually kind of nice is like you could even share these locks files via NBD and then they show up on other systems and then you can log in there and it will just work because yeah a USB stick is not very different from NBD or something like that but that's out of focus for everything I mean my main focus really I want my own laptop finally secure that I can suspend about this I mean this is kind of like the this is a summary after all right I want these problems to be solved finally because we never could solve them and I want to solve for my own machine because I care about the security and these kind of things right so if you remove the lux encryption key on suspend does that mean that you have to log out so are all processes terminated? no and then follow up question if the process are not terminated will there still be some private data in the memory in running applications right? sure so yeah I mean there's data and there's data there's crypto keys and there's your private data yes if like I mean if I would if I steal your laptop and try to extract the memory the first thing I'm looking for is having the crypto keys that's the one we definitely should kick out people using crypto swap and these kind of things I don't know maybe there's something more to solve there so that as much as possible the kernel flushes out all the memory onto disk into swap or something and then it's encrypted and stuff like that but that's outside of my area of expertise and what I can solve I just want to solve like the really obvious stuff yeah but anyway when the system goes down we will suspend the lux device and that basically means that any process accessing it at the time will hang while it does that until we resume it again this sounds ugly and is ugly but also it's not much of a problem because we go down anyway into system suspend there's not going to be any process that might hang because the CPU holds it anyway so so if I want to have my home directory migratable but also as a backup let's say I back this up to a separate disk then I also need to back up the signing key of the signature file the key that was used to sign there so I can log back into the system if I have to restore it this stuff ultimately it's just the lux file system you can use the classic lux like crypt it up to look into this and do whatever you want and lux of course has no understanding of user records for a backup it really doesn't matter that you retain the original signing key or signing keys controls who can log in it does not control who can access the data if he knows the password so for backup it's totally sufficient to just take that one file and back that up by the way it's, I mean this is something people should never forget because this says that the user record and the home directory all become one file you can just take that file from one laptop to another laptop and you don't need to do anything at all anymore for the backup case I think it would even make a ton of sense that if the backing file system or slash home is something like XFS or ButterFest or something you can do a raffling copy every day of something of that one file and there you go you have perfect time machine kind of stuff I mean this opens up really nice possibilities as soon as we unify everything into one file because yeah in Unix most things are focused on one file anyway I think my time is mostly over but maybe one more question there okay how do you plan to deal with different distributions and versions of distributions because we have different versions of software and even if you use common home directory you will it would be not working configuration so I mean system.ly is a part of system.ly that's kind of the goal right like and unless people patch around this heavily in the distribution it's kind of going to be the same thing in all the distributions all the stuff that I'm explaining here is not supposed to replace or modify the existing users that you might have right this is an add-on right so that if you have a home directory like this great it will show up in your user database and everything's great and because it's in this version it's going to be compatible but if you're talking about the software that is inside the home directory people kind of solve this because NFS shared home directories always work like this already right and it's a mess and I don't care so much it's a problem I'm not going to solve for you right I'm not going to make sure that every version of Emacs packaged by any version of any distribution can read the same configuration files that's something other people have to solve but I at least want to make it possible that the home directories are truly migratable and yeah how migratable then they are between the distributions that's not my problem to solve I just want to make sure that the lower levels they will be perfectly migratable because I mean Lux if I compile if I format the Lux volume on Fedora and then run it on Sue it just works they did not break compatibility and since this is really just Lux yeah any very last question or are we done if you


Okay, welcome everybody. The number one question I get on my YouTube channel is why doesn't my code work? The answer to that question is I don't know. I Haven't seen your code. I don't know why it's not working, but Here is one of the most common types of errors that I see once people do share their code and do share the error message with me Indentation errors Python Indentation counts so that's called white space and it has to be aligned correctly for it to work So the first type of error we get is Called tab error inconsistent use of tabs and spaces in indentation. So I'm gonna go ahead and run this You'll see it tells you tab error inconsistent use of tabs and spaces in indentation. Oh my gosh It tells you the line number. Oh my gosh. It tells you the actual line So this is not a mystery and this is telling you exactly what the problem is So if I go and I look at this, I know this is a bit of a wide tab, but that's okay. It doesn't matter So I can see here I'm using the left arrow and the right arrow and my little cursor is moving left and right one space at a time So that tells me these are spaces if I go down a line 15 where the error is I push right it jumped Because this is a tab tabs spaces Okay, to fix this we just make it spaces Okay, and I run that again and There is the expected outputs so you cannot mix tabs and spaces that's that's indents a little bit too far doesn't need to be that far but Still the principle is the same again. I put this here This is a syntax error syntax error means the program doesn't even run You have done something against the Python rules the Python gods are not happy Python doesn't know what to do with your code. Let's take a look at number two This is another syntax error indentation Expected and indented blocks. Let me go ahead and run this Okay There's the error indentation error expected an indented block. There's the line number number 14 There's the line. Oh my gosh. It's all laid out for you So I'm gonna go take a look at line 14 and you can see here I've got a for loop and you've got a colon here at the end. That's a big clue What that tells me is the next line must be indented So now this line is inside the for loop This line is Outside the loop so inside a loop outside a loop inside a loop outside of loop I'm gonna keep it inside. I don't keep this outside of loop. So we go ahead and fix that And run it and we get the expected output Okay, moving on Number three the last one wasn't I'm gonna put it. How did I put it and you expected an indent and didn't get it and then in number three You got an indent, but you didn't expect it. So we go ahead and run this I've seen a pattern here Indentation error unexpected indent. There's the line number. There's a line Okay, so let's take a look at that Okay line 11. So I look at this statement and I look before it. There's no while loop. There's no for loop There's no if statement. There's no Defining of a function. So this should not be indented so we go ahead and Run it again And we're getting the expected output Okay, now those were syntax errors. So those are errors that Again, the program just doesn't run at all You've got to fix those before you can even run the program. The next two errors are what we call logic errors So in this case the program actually runs, but the output or it just doesn't do what you expected So for example in English if I say the bone ate the dog Grammatically, it's correct. It doesn't break any English rules of grammar. It just doesn't make sense That's not what we mean. Of course, we mean the dog ate the bone So same thing here In this program, I want the output to be exactly the same as it was for the other three programs But when I equals five, I want to print the word five Kind of great example fantastic stuff. So I'm gonna run it And you can see now it's not printing I Equals one or I equals two or I equals three Okay, the reason is that we over indented So this line here Should not be indented. It was accidentally indented. So that's causing a problem. So let's run that And now you can see I get the output that I expected I see this this a lot of times with with Viewers on my YouTube channel where they'll do something like this define move left There's a function and I'll have some code and then they'll put define move right And then I'll have some you know code here again Oops, I've got the colon and the problem is because this is indented It doesn't get registered into You know and this usually it's the global space that needs to be registered in at least in the basic tutorials I've been doing so this needs to be pulled over so that these are lined up correctly Generally speaking, you don't define something inside of something else or you don't find a function side of a function Generally speaking. Okay, so let me delete that and The last one is basically the opposite. So in this case, this was indented, but it shouldn't have been in the last case We're gonna have something that is Indented that shouldn't have been it's made the same case.  Okay, so you can see here We've got the end the end the end the end the end the end Again, that is clearly not what we wanted to happen So the reason that's happening is because this was indented and it shouldn't be so I'm gonna go ahead and run that and You can see now it functions as we want it. Okay Syntax errors are very very or should be very easy to figure out for the most part Again, you'll see an error message pretty pretty detailed. You'll see a line Usually the line It's pretty accurate. Okay, there are some there's some times when it isn't quite accurate. It's off by one or two That's probably for another video So you can't run the program at all And it basically tells you what the problem is where it is and which line it is Logic errors are a lot harder because you have to figure out. Oh my gosh. It's it's not doing what I want to do So what's happening and what isn't happening? What is happening? You have to look through the code and figure out where that problem is coming in again If you're not getting a syntax error Check your indentation a lot of times that is where the problem comes in. Okay, again, it's an art It's not necessarily a science. You do get a feel for these things and once you start coding a lot more you will Learn to debug your code a lot faster. So if you have these types of errors I hope this video is helpful to you. Good luck. Keep on coding subscribe for more. Thanks


Ranger Bill, Warrior of the Woodland, struggling against extreme odds, traveling dangerous trails, fighting the many enemies of nature. This is the job of the Guardian of the Forest, Ranger Bill, pouring rain, freezing cold, blistering heat, snow, floods, bears, rattlesnakes, mountain lions. Yes, all this in exchange for the satisfaction and pride of a job well done. You know, there are very few men who make good housekeepers. A man can be neat and clean, keeping his own house, but it just isn't the same as when a woman's around to do it. Let's face it, fellas, they have that certain knack. Now take for instance myself. I can keep my workshop looking like it's been polished every day and it looks good. But in the house? Well, that's a different story. It's not only polishing and scrubbing that counts, but it's a woman's touch. I like to call this one the Battle at Jenkins Manor. Hey, Stockbreak, come on. I've got to drop you off at headquarters on my way to school. All right, all right. Keep your pajamas on, sonny.  Yeah, you would too if you lived in this house. I can never find anything. That's for sure. You never put anything back where it belongs. Listen, I am so busy finding stuff, ain't got time to put it back. What are you looking for? Have you tried your dresser? What's the matter with you, Stumpy? You sound like a bear with lockjaw. I've been wondering that too, Grey Wolf. We call him Grumble Junkie. What's wrong now? Roof falling? No, it's just that I can never find anything. I'm so busy looking, ain't got time to be...  Pilot here and pilot there? Cut it off your chest. Because ain't no good at it. Well, that's strange. You need as a pin with trail cabins and packs and tools. That's different. Well, friend, I know you don't like to talk about your wife brings back too many wonderful memories and tragic ones too. Ah, I not know you have a wife all the time. Yep, I did. And Marthi and me was married for ten years. She died of typhoid fever. Maybe that's what set me off this morning. What do you mean? Something stirred up sacred memories? Yep. They would have been married fifty years today if she had lived, Grey Wolf. She was a wonderful woman. Marthi never had an unkind word for anybody or anything. In those days I wasn't a Christian. I was a real ripsnorter. Yes, sir, she kept a perfect house. It was homey and comfortable. Yes, sir, it's been forty years, but I can remember like it was yesterday. Have you thought about getting a housekeeper? I'll answer twice, but nobody could keep house like Marthi. They know you. She spoiled me from bad. Oh, I'll be all right in a few days as soon as I get over feeling sorry for myself. That's something. You got different colored boots on.  I'm surprised you haven't got a butt cross-footed, Stumpy. I almost did. Marthi, see you come to work with those unmatched boots on? Your headquarter is Bill Jefferson speaking. Oh, hello, Pat. What's the matter with Stumpy? Barefooted. Without my shoes on! What's that, Pat? You hurt him? Okay, so long. The last art or long rip, sir. Better take Bill's advice and get a housekeeper. No, Paul! I got coming and clean house. Then I should be able to get organized.  No, Pat. He'll growl and growl, but he won't get angry. I've sure got a feast me o' noise in this house-cleaning effort of his. So have I. As I live and breathe. Hey, I wonder what he's up to? Bless me a confit if I know. Hey, Stumpy, don't jump out of the window. It's not rotten. I'm going to wash it. I thought for the minute this house-cleaner had got the best of you. Stop wagging Blackfeet inside.  There's as fine an idea as ever I've heard. Come on, Bill. Boy, me poor old Blackfeet appreciate having the Lord left it from them. There it is. Coffee's fine me, boy.  It does look pretty good if I say so myself. How long will it stay this way, Stumpy? You see, if I have to recall the appreciation I get. I sure know, ain't you the limit? You've done a fine job, old Timer. I can even see the top of the dining room table now. Hey, what do you know? It's walnut. Well, thanks for the coffee, boys. I've got to get back and pound me beat. There are citizens of this town are paying me to do me duty and not to lollygag around. Well, keep up the good work, old Timer. Some help you are. I'm trying to keep the work down. Oh, you sure do a plenty good job on house-cleans, Stumpy. Why do you not get house-keeper now? Or keep it nice? Nope. Can't see it, Sonny. Now don't. Okay. I think maybe you like to take it easy now. Ha! I think you changed mind about house-keeper plenty soon. Hell if I do! Oh, forget it, Stumpy. You're welcome any time, you know. Sure I... Good night, old Timer. See you in the morning. Henry must be in trouble. Supposed to be picking up the old Timer and the way to school. Ranger one to Henry. Ranger one to Henry. What's wrong, pal? I can't rouse Stumpy. What? You can't? Not only. And how? We'll be right there. He's lying on a chair. His hands, old bandy stuff. I hear some trouble last night. I'll say. Let's wake him up and find out. Stumpy, stop. It's morning.  What happened to you?  Why are you sleeping in the chair? You'll never believe me. Well, try us out. I got to sleep and the alarm went off pretty quick. You cut hand fixing radiator? Nope. Making breakfast. Oh, no. Yep. I was squeezing oranges. And the squeezer broke and cut my hand. Oh, Stumpy. Now, that time the toast started burning so I took it out and got blood on my cereal after I wrapped my hand and I found out after the first mouthful it was... Leave until noon, Stumpy. Then come to work. You had a rough time. Yeah, that's right. Yeah, they can talk. And I... Okay, shoot. Hey, now you're talking. Ah, so you finally gave in. Sure. I know of a fine housekeeper, Stumpy. And if she'd be only too happy to have the job, Mrs. Murphy. Make it, Murphy! The same. And a fine lady. What do you say, old timer? Call her up right now. See, talking with the lady's young fella? How about you asking her? Sure. I'll do anything to make sure you're not going to keep on living alone. It's too dangerous. Are you still looking for a housekeeping job? Sure as a duck likes to swim. And who may I ask if you got in mind? Stumpy Jenkins. That old wiretog! Oh, come on now, Maggie. He's not as bad as all that, I'm sure. Oh, I think not, Billy. Bye. Well, let's see. I'll come about noon each day and keep house and I'll fix his supper. And then I'll come home to my own brood. Ask him how that sounds. I'm sure it'll be very satisfactory. When can you start? In the Maranan. Good. Thanks a lot. Thank you, Bill. The good lord has answered my prayers for a part-time job. Part-time job? You have another one? What do you think keeping house for a man and five boys is?   You'll find out, Henry, right? You'll like it, fine. Henry's speak truth. And nothing like woman touch around house. Hard! We agree, Stumpy. Thank you, Stumpy. It's probably been a blue moon since you had a home-cooked mare. Heckish. Well, dig in. I'll eat with you tonight and clean up afterwards. But I'll not spoil you this way every night, Stumpy Jenkins. None of the dishes are washed and put away. So I'll be running along home to my own brood. Thank you, Maggie. In the morning, I want things spick and spun when I get here. No leave on the breakfast dishes and bed on maid. I'll pull the mattress and air it once a week and change the bed clothes. What's so funny? I was thinking about the mattress. What about it? I want fresh air once a week. Oh, Stumpy. It'll probably catch its death a cold. Oh, good night. I keep eating like this. I'll have to have my britches let out. What are you looking for? The socks. What's that on the dining room table? It works like she mended them. Don't tell me all your socks had holes in them. What's the difference? Long as they don't show? I tucked your other uniforms to the cleaners this afternoon and two pairs of boots to the shoemaker. So you don't wash your ears neither, eh? Who cleaners? They did. I like to be clean. Oh! They weren't. They're so spotted they look like leopard skins. And as for your boots, you old buffalo, I don't see how you can stand the walk on your bare feet. It is. Excuse me, fellows. I thought it was top brass from Washington by the cut of that uniform. Wow. Don't get close to those craces or they'll cut you. Look at that. Look at those boots. Why, but shine like brand new. Yeah. What about that hat? It's the first time I haven't seen rain spots on it in a year. Pretty sharp-looking ranger, I'd say. It's about time you had new curtains. What was wrong? I went to wash them and they thought I brought over what I had extra around home and put them up. All right. Did you get a new rug, too? Of course I didn't. I just turned it so the worn part would be under the furniture. Nothing of the sorts, don't be Jenkins. You hired me to keep house and that's just what I'm doing. And believe me, this house needed plenty of keeping. Don't be Jenkins. Clean your feet when you come up from the basement. The next thing in the basement. Land 6, why do you save all these empty cans and clutter up the kitchen? I need them to put worms in when I go fishing. Can't you wipe your hands on these old towels when you're rooting in the garden? Next thing you'll what?  Are you afraid I'll bite you? We're late. I'll catch it from the teacher. Where did you use to keep them? Hang it on the front door knob. Where? Here at the limit. What's that you've got under your coat? The Lost Metrolipole. Don't be hasty, old friend. I know it's a change, but you can make the adjustment, I'm sure. Is everything in it? Come on now. You have your evenings free since you don't have to clean house. I'm sure she's changed things and cleaned up, but that's what a good woman would do. She's done things you never had time to do, Stumpy. You can't fight fires and keep house and do both well. Maybe you're right. Maybe you're not.  I'm gonna fire her. You aren't serious. I ain't laughing, am I? What's the matter with you? Are you sick? I'm aspirin or two. Don't dilly-dally know. Your toes will get cold and hot food ain't worth eating when it's cold. It's your supper. You talk sick now. Yeah, sure. I think I'll lay on the sofa for a shower. Just sit there for a minute and I'll get some blankets and a pillow. I don't need that stomach pump anymore, Bill. He's coming around. He must have poisoned himself accidentally. It looks that way, Maggie. It's a good thing you were here. Yeah, I took a strong dose of sleeping pills and painkillers. Well, I was right, youngster. This is Murphy and I've been here for a whole stumpy to die. The question is, what did you do?  I did what? Easy, easy now, stumpy. You just lay back and rest a while. Doc's right, old timer. Maggie saved your life. That's sick, Bill. Did you ever see such a collection of bottles? Why, there's enough here to start a drugstore. Too bad you didn't clean this out first, Maggie. I would have gotten to it directly.  Yep. Yeah, that's it. When I had the tablets, I had left over the time the buffalo banged me up. Much obliged to you for saving my life. Ah, sure, and I'm glad I was here to help. If you don't mind, I hope you'll keep house for me for a long time to come. Like Bill says, it's getting dangerous around here without a woman to look after things. Well, it was a hard, long battle, but Maggie won, didn't she? Well, that's the way it should be around Jenkins Manor.  Well, see you next week for more adventure with...


It'll also get you 10% off today. So that's our big news right there, Santa Ana. Pronounce the T, but you can, Santa Ana. That's fun too. Never knew why they were called that, so I looked it up and it was in the 1800s that I think it became a popular name for it somewhere in Orange County because the winds seemed to be coming from the Santa Ana Valley. So there you go. That's why we call them that. I don't think they actually come from the Santa Ana Valley but we call them the Santa Wins. They are hot winds often. Bad thing about them is they are a contributor to forest fires, which is another problem here. But enough of that, again, the reason I bring that up is you can go right over there to the Adafruit shop and look, happy pie day. We're celebrating pie day with this fantastic tinsely, glittery, confetti, sparkly, party-favorite pie banner there because today is pie day and if you want to buy a raspberry pie, do it and you'll get yourself 10% off by using that coupon code right there, that Santa Ana coupon code, which you can't read that well when this is on the screen, so I'll get rid of that. Yeah, that's the coupon code. Use that, buy some cool stuff. Hello to our chats. We've got some people over in the YouTube chat. Hello to Pie Hates Bad Guys, Gary T, Davidesa, BattleGraph of Dalhagen, Johnny Bergdahl, welcome one and all. Also, if you're wondering where the chat's at, if you're over in Facebook or Twitch or some funny place like that and no one is chatting, that's probably because they're over here on our Discord, so you can head over to adafruit.it slash discord, jump into our live broadcast chat channel, which you see right there and we've got some nice Paul Cutler, Mike0451, Todd Bot, BlitzCityDIY, and Johnny is there again. Hello, JP Sands, suspiciously close to JB, trying to steal my brand, could be. Could be there's enough to go around, I don't know. We'll find out when the reckoning comes on the two initial nicknames. Anyway, that was weird enough right there. Also, hello, C Grover. Nice to see you over there in the chat. So, what's up? I was away last week finishing up some filming and also headed out of town for a little bit, but I'm back. There was no product pick of the week earlier this week but there will be one on Tuesday. And guess what? We have a Adabox unboxing coming up. So if you head over to adabox.com, that link right there is actually, I think it's not live for me right now. But I think if you click that or get started, you'll see another link. I'm not gonna click through. There will be a link to the unboxing. We already have the event sort of scheduled. So you can sit there, you can wait. It's gonna be about six days. But on next Wednesday at 8 p.m. Eastern time, that's the 20th of March, I will be doing an unboxing for the latest Adabox. Hopefully you got yours. We have shipped them all out. Most of them have probably arrived. Some of them are winding their way through the various mail systems. And you can go ahead and open it and jump right in and have fun or wait for the unboxing. We'll do it together. That's a possibility. If you wanna sign up, go over to that site. That is live now. If you click on getting started and click through, you can subscribe. And that's not gonna get you this one. That won't get you the Adabox 21 but it will get you in line for Adabox 22 which we should be coming out with this summer. We are already working on that. Lady Aida and others are already wrapping up the Adabox 21 and moving into Adabox 22 mode. But I, not me, I'm still gearing up for that unboxing. So I'm excited about that. So please come on by for that. I mentioned my product pick show. I think I had, yeah, I had one last week and didn't do the workshop show. So I never showed this recap but if you're not familiar with it, the product pick of the week show is on Tuesdays at this very time. One o'clock Pacific, four o'clock Eastern and I will offer you a huge, deep, deep discount. We at Adabox will offer you a huge, deep, deep discount. This week is 50% off on the product pick and go over some features of it, do some demos. And here is a little one minute recap of the one from last Tuesday. It is the 3.5 inch TFT Capacitive Touch Feather Wing. You can plug nearly any feather into, there it is just running really quickly through some images there. I am reading one finger X and Y, here's two, three, four, five fingers. It's really happy to report all that data. We're lucky enough to have a guest on the show and that is Liz Clark. RP2040 plugged into the back and what you see on the front here are four buttons. There is a touch button library that works with display IO. So you can add these buttons to the screen and when I press the buttons you'll see that they register touch but because this is multi-touch I can press all four buttons at once and it sees that they've been touched. And this has been my product pick this week. It is the 3.5 inch TFT Feather Wing with Capacitive Touch. By the way, a couple of things. The problem I was having with mine, remember I said I could show you the cap touch, I could show you the display but I couldn't really do both at once. That problem has cropped up for some people not all people who have this display. We've seen some people asking about it in the forums so we will look into it and if you have an issue head on over to the Adafruit forum and let us know so we can try to figure out what the issues are there. You'll either see great touch coordinates coming up with the display lit up with images or you'll see multiple odd hits going on. So not sure yet what's going on there but we will always take care of you. So if you head to the forums, you can get a bit of more info into our system and then we will either figure out a software solution or a hardware solution. We're always good about returns if you wanna exchange it for something or return it. We'll, excuse me, we'll take care of support stuff over in the forums, so let us know. Ty had said any chance you can get advance notice of product pick of the week and can start dropping cryptic clues on Thursday shows? Well I do know in advance, quite a few weeks in advance we work out what products we'll be doing so we know we have enough in stock and I can start prepping demos so I'll consider ways that I can drop hints for you. That sounds fun, I like the idea, thank you. Answering another question that I saw in the chat over in our Discord, Jenny Bergdahl said or not a question of statement in a sad face, emoji, can't get Etabox in Sweden. Sorry about that, I do know that the Etabox that we have will, that's out right now, there will be a product in the store that is roughly not all the same stuff but roughly the same stuff. And thanks, someone said the microphone volume is low. I'm gonna goose that up a little bit more than usual. I think I just have it underneath a couple of layers of clothing there. Let me know if that is better. Yeah, I see it, let me kick the main and check, check, testing, testing. Oh that's weird, it is not, hang on a second. I think it's not the right mic. Hold on, what is going on here? This claims to be, hold on. Hold on, I don't think it's using my real mic. I think it's using my computer mic. How about, check, check, test, okay. And did that change anything for that? I'm gonna test by just walking over here and seeing if I keep talking, is that dying? Oh no, it is this mic, okay. I will kick the gain up even higher. Testing, hey, okay, good. We're getting close to 3 dB when I yell like that. Thank you, no it is not on your end, Abadus. Thanks everyone for piping up. It's always helpful, particularly with audio stuff. I have a couple meters flashing but the difference between the level that I'm usually at and when it's a little bit quiet it doesn't register for me visually too much. Did that change? Is it better now? Oh, much better DJ Devon, yeah, wow, okay. I don't know where it was, I should, wow that loud. Is it too loud? Back off of it, good for Starman. Okay, we're gonna leave it right there. Thank you. So yeah, like I think I was saying, the Etabox that's out, we will have an item in the store that's kind of like a package that covers much of, not all of it, but much of it.  So that unfortunately I think is just a result of international shipping being way more expensive than it was a few years ago and trickier with duties and import taxes and things like that. Apologies to people who can't get that. But if you can, if you're particularly in the continental United States or anywhere in the US I suppose, think Canada, I think we've got Canadians doing it. In fact, I was just visiting a friend who I hadn't seen in a while and he said, hey, I just suddenly got an Etabox in the mail. I forgot, I was subscribed to that, which I think we sent out emails to everyone to confirm their credit cards were, they still wanted it and their credit cards were the proper ones, they could change them out. But my buddy said that, yeah, I probably got that email and ignored it. Okay, good. So what else is happening here? Let's, now that we've got mic issues solved, I think. Shouldn't get too cocky. Let's dive into a circuit Python parsec. The circuit parsec. Okay, for the circuit Python parsec today, I wanted to show you how you can decode JPEG images using JPEG IO. So this is a specific library that's used to take on disk JPEGs, which can be compressed and nice and small, one of the benefits of JPEGs. And you may have other reasons for connected devices for downloading JPEGs from the web and then wanting to display them on your display in circuit Python. So the way this works, you can see here, I have a nice little slideshow, it's just running through some JPEG images that are sitting on the circuit Python drive. I have import JPEG IO listed up here. I've given it a set of JPEG image names that are sitting on the circuit Python drive, doing some of the usual display setup for this SPI display here. I am setting up some sort of placeholder, blank bitmap that we will then cast our pixels into. And then the key thing here is this function right here, which came from Todd Bot, he has some cool JPEG code and I grabbed this from there. So what this does, it sets up a decoder object with JPEG IO.JPEG decoder. So that instantiates the JPEG decoder. Then we grab the width and height values when we are opening the JPEG. So decoder.open and then the name of the file for whichever one we're looking at from that list. Then we create an object called bitmap, which is the same size as that JPEG and we're telling it the bit depth that we're gonna use for color. And then we use decoder.decode bitmap. This takes that JPEG and it basically decodes the compression, turns it into a bitmap file that can be more easily displayed on the screen. Then the rest of this is a nice little neat slide show that's just grabbing that returned bitmap from the load JPEG to bitmap function. And then my main loop is just calling that slide show so that every three seconds it updates. And so that is how you can use JPEG images in Circuit Python using JPEG IO. And that is your Circuit Python Parsec. Yes, Circuit Python. Ah, and Todd just said over in our Discord chat, I think I stole the JPEG loading code from the PyCamera library. That's the first place I think I've seen it. I think Jeff Epler created the library, did a lot of the work there at least to be able to do some JPEG image reading for displaying slideshows on the PyCamera. After you've taken pictures you can look at images using that. I believe Liz has some code for this as well in the AI image descriptor project, also a Memento PyCamera project. So this is some of the first uses I've seen of it and it works nicely. You can see it's pretty snappy. And of course the benefit is that you can load a whole slew of JPEG files because they can be compressed down nice and small but still get nice 16-bit color out of it when it gets unpacked essentially into the bitmap to put on screen and then we replace it with the next one and the next one as we pull those out. So I'm nice as I have to check out JPEG IO.  I like BMPs too, they're fine. But it's really nice to have options there just like we've got support for wave files and MPEGs. It's nice to, or MP3s, it's nice to be able to do both uncompressed and compressed image files I think. All right. So let's get on to the next stuff. So put this away right here. Oh, you're very welcome, Dread, Dragonfly, Dredgenfly, Dragonfly over in YouTube. So thanks for the workshops and all you do for the community. Very happy too and I appreciate you guys coming by so that I can show you this stuff that I'm interested in. Speaking of stuff I'm interested in, today is Pi Day, it's 314, March 14th. And to celebrate that a little bit, I decided to do a, more than a project, really just a kind of a tip, a general tip for Raspberry Pi single board computers. I thought about should I do something with a Pi Pico or a Pi Zero, but I figured go back old school to a traditional Pi. So let me grab one right here so I can point out a couple things on it. This one's connected to a bunch of stuff. So I'm gonna, let's see, can I pull this one apart easily? Ish, no I have it all bolted together, that's okay. Raspberry Pi here, I think this one's a Pi 4. And you'll see we got a bunch of ports on here, right? We're used to all the USB back here. We've got power over USB-C here. We've got a couple of little miniature HDMI outputs there.  Well, the cool thing about that little 3.5 millimeter headphone jack is as of I think the Pi 2 through the Pi 4, that wasn't just a headphone jack, it's also a video output. So if you remember the original Pi, and I wish I could find an original Pi here, I think it's probably gonna bend right up there, but I won't search right now. Original Raspberry Pi had a composite video output, a yellow RCA plug that you could plug it right into a TV with composite in, particularly your CRT TVs, like you see one back there. They always had HDMI, but then with the revision going into the two and the three and the four, the HDMI really was the prominent one, it was less common for people to need the composite out, but they kind of hid it away there in the 3.5 millimeter TRRS jack. So that's a tip ring, ring sleeve. It looks like a sort of normal stereo headphone thing, but it has that fourth output, more like ear buds, earphones, ear buds with wired, with a little microphone, a little clicker thing. So that style of four conductor 3.5 millimeter, the, I think it's the tip, the farthest one out, is a composite video signal.  So, excuse me, what I thought I'd do is first show you an example of this little PiCade here, excuse me, and I will, yeah, let me jump over there. I don't need, I think I need a down shooter right now for that either. So I'll show you what I've got. So this is a little PiCade that traditionally, the way it's set up at least, you'd be running to this little, in this case, eight inch TFT display, which has an HDMI input to it. It is, however, just, whoop, I'm gonna knock it over, knocked a whole Raspberry Pi over. It is, however, just a little Raspberry Pi right there. So that's what's running the display. There's a input for any HDMI or rather any USB peripherals, like game controllers or keyboards, which are helpful during setup, a mouse. And there is an HDMI out on here that is running to the little HDMI decoder for the screen there. And this has the input coming into it from all of these controls up front, which is using a little Pimeroni board that takes a bunch of GPIO pins and gives you a USB out. So what I've done here is I've reconfigured this to send out over the 3.5 millimeter jack there. And let me just see if I can zoom that camera in. It might be a little low, but let's see if I can, you know what, I'll do the overhead and I'll just tip that. So let me into help. Okay, so here we go. This is a better view of what's going on here. So here's our Raspberry Pi. This is a Pi 3B2, I think. And right there is that little 3.5 millimeter jack. I have a cable here that is, you can see, tip ring ring sleeve for conductors and that cable, it's an Adafruit cable actually, is a nice RCA cable that goes out to this right here, which is RCA video and audio. Now this isn't gonna do audio right now just because the configuration is using external codec and I don't have another cable readily available right now to get stereo sound into here. So you won't hear any sound at all now, but that's okay because the video is really what we care about. So I'm gonna go ahead and just turn on the TV. Let's see if this is still operating and I'm gonna, hey, there we go. Okay, so this is running emulation station retro arch, retro Pi sort of combination. And it is basically the exact setup as when I was running it on the little screen here, but you can see this screen is blank. And my video is coming through on the TV. So I can try to play it backwards in a monitor. Oh, get blown up, but it looks like you would expect, right? We have a nice looking, I'm gonna get captured, sure. Nice looking CRT at, I think this is doing 72480 or something like that. There are further measures you can go to. I'm just letting it do the pick best resolution for the monitor. This is what it decides to feed out to composite. There are ways, I think especially on the Pi 4 using some GL drivers to get closer to a 480P or 280 interlaced, 240 interlaced or 480P image, which will look even more sort of proper on this kind of display. Or maybe 640-480 at 60 Hertz, there are some options there. But this is the default and it looks pretty good. If you take a look, let me see if I can get this out of here. Okay, so if you, yeah, you can, that's a decent enough view, I think of that. If you take a look, I've basically got the whole, I'm gonna quit the whole Raspberry Pi, quit emulation station, yes. So here I am out to just the command line. So you can go in here and do all of your usual adjusting of values, here's sudo raspiconfig, go in here, so you can see I'm just running straight up. This is the Raspberry Pi, it's nothing special to the fact that the emulation station is right on there. But what I want it to do is take you through the process on another Pi, so this one's already set up and it'll be a little easier to show it on a different one.   Out of here, oh, now what have I done? Did I unplug something? What is it doing? I've ruined something, okay, I'm just gonna live, oh, I don't know what that was. I'm gonna live dangerously and simply unplug some things. The monitor, and I'll go ahead and power down this little cabinet and get it out of the way, and I'm gonna also grab my keyboard house out of there. And what this previously had was this little HDMI cable that I seem to have lost, it might be on the, oh, here it is, no, it might be on that side of the floor there, but this just ran the Pi to this display here. So it can be self-contained other than power. That's the only cable we'll need there. So I'll set this down to the side, and we won't need this connection for a moment. I'm gonna turn that monitor off, in fact. Let's go to this view here, back out a bit. Okay, so I've got a little HDMI monitor here. Looks like that is powered down to that HDMI cable. All right, so here is a different Pi. It's just in a fancy case, but there is that same port right there. That says AV on it, right? You can see next door there is the HDMI. So what we're gonna do is we're gonna boot this up with HDMI connected to this monitor. And I will show you how simple it is to get this set up for TV output. Okay, so HDMI, yes, monitor power, yes. I'm gonna plug in this little mouse and keyboard. This is a nice little setup, by the way. This is also a little, this is the official Raspberry Pi keyboard and mouse. We sell them in, I think just in black. It also comes in white with red accents, but Adafruit Store has those. And that's some power. Let's plug in this Raspberry Pi case. Okay, so this little Pi case has a snazzy power button. And we can see this is booting up. I think it's booting up in a sort of native HDMI resolution for the monitor, which is nice. Okay, so what I can do is from a command line, try to remember how to make that much, much bigger. Nope, I'll zoom in on that too. Sorry for the camera wobble. That's kind of an unstable pole there. Stop wiggling. All right, just let it do its thing. So what we're gonna do is look at the config.txt file that's in the boot directory of root. So if we do sudo nano boot config.txt, sudo is just because it doesn't want anyone but a root user to mess with this file for good reason. Nano is just a convenient text editor. So if I look at this file, you can see there's a bunch of things commented out. Typically if you're having issues with HDMI, like you have a display that isn't loving the defaults, if you have needs for certain over scan size or you don't want over scan, this is where you go. And so typically this HDMI mode can be used to force a particular resolution. Some monitors won't negotiate with the default output very nicely. So that's typically, you will very typically find yourself in this file doing HDMI noodling already. But you can see here I have also added, this is not normally in this file, but I've added this line right here. This is actually all we need. Enable TV out equals one. So enable underscore TV out equals one. And what that'll do is it will enable the composite video output over that plug to be an option during startup. So we can go ahead and save this file, I'll hit control X and I'll say yes, we'll save it and I'll say we'll save it with its default name. And then we need to restart. However, if we turn this on and we do a reboot, pseudo reboot, what you'll see is it just ignores the TV. What the heck's going on here? And this is one of the reasons I wanted to show this as a little thing on Pi Day is that the problem here is, and there may be ways to adjust this in Raspi config or the boot.config.txt, the issue here is that as long as this HDMI cable is plugged in to a monitor during startup, and I don't think it's the case if this is plugged in. I think it has to be plugged into a monitor very quickly after the reboot, just moments after it starts checking to see where its best option is for a display and it picks the HDMI output, it wins that negotiation. So what we'll do is same sort of thing, we'll do a reboot, we'll do shutdown, reboot, and then I'm gonna pull the HDMI cable and you'll see my monitor has now taken over and in fact at this point, if I plug in HDMI, I don't think it steals it, I think that the negotiations are over, at least on a Pi 3. Pi 4, there are provisions for multiple outputs, essentially can do two monitors at once, so there's a chance that one of the possibilities there is one of the HDMI outs and the composite out, but on a Pi 3 it's just picked during startup by having TV out enabled and the HDMI not even available, we're all set, I'll leave that unplugged just so I don't confuse myself later. And now you can see I've got a nice big, huge display here on a CRT monitor, I know it's a little blown out on that screen there, but we can go to, let's say, the internet. This one happens to have, I don't think it had Wi-Fi on that particular Pi, but I've got a little dongle in the back there for Wi-Fi. And now we should be able to go to visit the World Wide Web, there it is. Interface, you can see we got a whole ton of stuff here, we'd probably wanna get rid of it if we were using a monitor at this resolution. But I believe this is like 720, 46 or some resolution like that. You can try to either add other additional, you might have seen in my config text there, there were some other things to say what the frame buffer width and the frame buffer height should be. I didn't get that working in this case, but I think I'll try it with a Pi 4 because I think that most of the gaming uses with RetroPi and the different examples out there and tutorials out there are for people who are using a Pi 4. Pi 5 moved the output for composite video to a jumper pad on the board.  I haven't tried it, I don't know what the settings if those differ from the usual settings are. So, but there we are, this is our Pi Day CRT. You can of course with a composite video output do a whole lot of interesting things with splitting the signal out to multiple monitors if you wanna just have mirror copies all over the place or use distributors and more sophisticated setups to do video walls, that sort of thing. But good old composites, nice to have. HDMI isn't always the right thing or a display like this maybe what you're looking for. So that's the tip I wanted to share on how you get that to output. If you, let me see, let's go back to, I'm gonna go back to the overhead and plug in HDMI and restart again just to get it back onto this monitor so I think you'll see this a little better. So let's go up here. Oh, where are you?  So now you can see I've plugged in HDMI even though composite is still plugged in there it's gonna favor this monitor right here. And since the Raspberry config display output is in just pick the best resolution for the monitor you can see it automatically now goes to a widescreen whereas there it was in a four by three it's a much higher resolution. And I can show you from here some of the options you get in Raspberry config that are where you should be able to adjust resolution but on this one I didn't get it working but I didn't have a ton of chance to experiment with that unfortunately. So let's see what did we find out? Control shift plus, make that nice and big. And so again pseudo and now Raspberry config and in here you'll look for advanced options.  And then if we go to the advanced options we can go down here to resolution. And this is where it says okay monitor preferred resolution and it's trying to just negotiate the best possible. If I do, let's see, let's try, I actually don't know why CEA mode and DMT mode are the same here. Let's try them both, these are both 64480 and we can hit finish, reboot. I'll leave it on here so this you'll see now we'll put a huge stretched 64480 image onto this screen. You can see our raspberries have gotten rather wide. You can also in this, in the config text actually you can set up PAL versus NTSC, which is nice. So 50 Hertz signal, I don't know if that would actually work if you're plugged into 60 cycle power or not, but there you can see I've got this 64480 image wildly stretched on here. I'll try, this was not working for me before, I'll try restarting that with HDMI unplugged to see if it'll send a 64480 to this monitor. For some reason didn't get that to work, sadly. That's gonna require more tinkering, but yeah, it should have flipped over by now. So I think if I plug in this HDMI, you'll see that it didn't make the decision to go to, yeah, that's not working. Don't know why. The other option for resolution that looked basically the same, I don't know if I've tried that one, let's do it resolution. Oops, advanced options, resolution. Why is it not? Hey weird, it won't let me. Let's restart with the HDMI plugged in from the beginning, what that was about. Some of those are all of those things you can pick and Raspi config you usually can then go find a text file to edit that'll give you the same result if the interface is doing something silly like that. Luckily this one's not trying to do a heck of a lot so it boots pretty quick. There aren't a lot of boot up scripts or things like that on this one. Okay, what's up Raspi config? Let's see, advanced options. Resolution, now it allows me, okay. So that was the CEA mode one. We'll try this DMT mode one. It looks the same, or rather mode four, DMT mode four. By the way, if anyone has expertise in this, I'll check the chat in a second just to see if anyone has ideas on getting that to accept the 64480 over here. In fact, let me check this in the chat from here. Mm, mm, mm, mm, mm. Nope. Yeah, this is, Todd says this little HDMI monitor is super cute next to this giant glowing tube, it's true. All right, yeah, so I don't know what's up with that but there are of course a million options and possibilities on here for setup with video stuff so there may just be other overlays and things that I have running that are taking precedence. And look, now there's fewer options available so we can go back up to monitor preferred resolution. There may also be settings where you can pick resolutions that aren't just the listed ones. And we can restart and this should now restart into here with a normal resolution or we can go back there with the TV selected resolution. It could be that it's grabbing 64480, I actually don't know. Let's see it, actually that'd be interesting if we can check that once it restarts on this monitor. So let's do that, let's just do this one more time. Just rebooting, pull the HDMI. Also don't know if I have a remote for this TV so I'd love to lower the brightness on it and noodle with some of the settings but I can't remember if I have a remote for that one. So let's see, display, is there display stuff? Is there display stuff? I thought there was. Preferences, appearance settings, system. No, these are all just fonts and colors. So here is the question for the chat. Does anyone know how you can ask the Pi what resolution it's actually currently set to? If you know the answer to that or can search it real quick, let me know. I'd love to try that. Let's see what it thinks it's sending out. I thought there was some, oh, is it a right click? Does desktop preferences? Or is that the same as what I just had? Four large screens for small screens. Let's set those to four. Nope, that's smalled the graphics a little bit. Load up Boeing, which does not want to be at this resolution, whatever this resolution is. Oh, Johnny Bergdahl had a Sony Trennitzer on. Unfortunately, it died after 18 years. That is, boy, that is the sad thing with CRTs is each one that dies off, it's a bit of a pain to repair and rejuvenate. That's what they tend to be done for. I'll put this set to medium system. Go to medium screens, I can't see those very well. It's actually flickering more in real life than it is on that screen, which is funny. I don't know why, but I've got a little bit of a flicker here, and it's just out of sync enough with my frame rate on the camera that you don't really see it there. I think that'll do it. Yeah, I don't know my way around anymore. I haven't been in Raspberry Pi land in a long time. But there we are. We have it on a big, huge CRT, and that's just fun on its own. Oh, let's see, DJ Devon 3 says, if you're using the Raspberry Pi desktop, resolution or rotation is most easily changed by selecting the screen configuration utility from the preferences menu. Screen configuration utility from the preferences menu. Preferences, maybe it's this configuration? Yeah, okay, there we go. Okay, resolution. Let's see, is it saying anything? I'm just gonna tilt this a little so I don't keep... Breaking my neck trying to see it. That's a little better. Okay, so display, set resolution. Okay, yeah, default 720, 480. So these are those same modes, or some of those same modes that we saw. Yeah, be curious. If I set the 64480, it's probably gonna ask for a restart. Do a restart. Reboot, yes. I suspect it's gonna do the same thing as before, which is not recognized that. This screen doesn't like that resolution, I think. But we've always got our HDMI friend here to fall back on. These are super handy, by the way. These are also little, little Adafruit HDMI outs. I had some DIY mounting situation back there since it's a little glopped up, but these are super useful for just plugging into a pie to service it or figure out what's wrong with your other outputs. So let's reset this resolution to default. Okay, okay. Reboot, yes. Unplug HDMI. Tyeth says there's some mention of turning off HDMI and setting S video mode. Oh, that's interesting. Okay, yeah, I'll look into that in my own time. That would be interesting to see. Can it send out an actual S video? Or is that standard video? I don't know if it can do a S video with like a separate luminance channel. Be neat if it could. All right, so that's that. That is my happy pie day. Shenanigans there, hope you enjoyed that. And let's see, I think that's gonna do it for us for today. So thanks everyone for coming to hang out. Be out of doll hug and says they still have some Raspberry Pi ones in the box. Excellent. You can fish those out. You can do some CRT stuff with them right there. Right there is a big yellow plug on it. You're a good friend of the composite video plug.  Also don't forget, we've got the Adabox unboxing happening on Wednesday, March 20th, that's in six days. It says right here, live in six days. And that'll be at eight o'clock Eastern time, same time we normally have Ask an Engineer. It will be an Ask an Engineer takeover. But I believe Lamor and Phil will be hanging out in the chats, hanging out and answering questions if you have any, as much as the Baby Aida will allow, Child Aida, I don't know if it's Baby Anymore officially. But come on by, I'm excited for it. It's the return of Adabox, can you believe it? It's been a while. Just working out the rusty joints and getting it already. So I think that's gonna do it. Thank you everyone for stopping by. I will see you on Tuesday for my next product pick of the week. I'll see you on Wednesday for Adabox unboxing. For Adafruit Industries, I'm John Park, this has been John Park, bye, bye, bye.


BE, BEING, or BEIN from espressoenglish.net BE is the base form of the verb. Use BE after TO. Here are some verbs in English that are often followed by TO. HOPE I hope to be as wise as my father someday. LEARN She's learning to be less concerned about other people's opinions. NEED You need to be ready to leave by 6.30. PLAN We're planning to be in London from the 18th to the 23rd. PROTEND My kids are pretending to be superheroes. PROMISE I promise to be on time for the meeting. TRY He said he'd try to be more patient. WANT I want to be fluent in English.  It seems like an exciting job. Also, use BE after SHOULD, COULD and WOULD. For example, you should be ashamed. This could be interesting. I would be happy to help. After SHOULD, COULD and WOULD always use the base form of the next verb. BEING is the continuous form of the verb. You can use it after AM is an R in the present continuous and WAS and WERE in the past continuous. We can't access the internet right now because the network is being restarted. We often see this structure is BEING in the passive voice. Someone is restarting the network. The network is BEING restarted. Here's an example in the past continuous. When I said that dress doesn't look good on you, I was just being honest. You can also use BEING after verbs that are followed by the ING form, like avoid, enjoy, can't stand, don't mind, look forward to, practice, spend time, and stop. Here are a couple examples. Stop being lazy and help me wash the dishes. I enjoy BEING in a position of leadership. She can't stand BEING lied to. Always use BEING and NOT BE or BEIN after prepositions. For example, I was in the hospital for a month after BEING in a car accident. That's the problem with BEING late all the time. People stop trusting you. The best part of BEING a teacher is interacting with the students. She got an award for BEING the best salesperson in the company. BEIN is the past participle. Use it after the verbs HAVE and HAS in the present perfect and HAD in the past perfect. For example, I've been busy lately. Have you ever been to London? My car has been stolen. Those three examples are in the present perfect, and here's one in the past perfect. By the time he showed up, we'd been waiting for an hour. You can also use BEIN after COULD HAVE, SHOULD HAVE, and WOULD HAVE. For example, you should have been on time for your job interview. The presentation would have been better if we'd done more preparation. He could have been injured badly when he fell off his motorcycle. If you'd like to clear up your doubts about confusing English words, check out my e-book, 600 Plus Confusing English Words Explained. It has more than 200 pages and over 5 hours of audio to help you master these words.