Yaron's Tech Notes

[y-tech]

My personalized setup: 50 MBit/s

Internet - Default - Smart Queues: on, 200/30

Firewall & Security - Threat Management: Detect/Medium

Traffic Management - Traffic Identification: enabled

Smart Queues - off: 140 MBit/s

Threat Management - off: 220 MBit/s

Traffic Identification - off: 220 MBit/s

[y-tech]

Check SSL certificate lifetime

# openssl s_client -connect tumblr.com:443 -showcerts \ 2>/dev/null /null \ | openssl x509 -text -noout \ | grep -F "Not " Not Before: Aug 21 00:00:00 2019 GMT Not After : Feb 17 12:00:00 2020 GMT

[y-tech]

Using ffmpeg to reverse a video

Reverse video w/o reversing audio:

ffmpeg -i original.mov \ -vf reverse \ reversed.mov

Reverse both, video and audio:

ffmpeg -i original.mov \ -vf reverse \ -af areverse \ reversed.mov

[y-tech]

Using ffmpeg to lossless-y rotate a video

ffmpeg -i original.mov \ -map_metadata 0 \ -metadata:s:v rotate="90" \ -codec copy \ rotated.mov

[y-tech]

Using ffmpeg to combine (multi-languange) audio tracks into a single video

Assuming you have two versions of one and the same video: a german version and a french one. The video content is identical, but audio is in the respective language. This is how you can combine the two files into one file with two audio tracks:

Splitting off the video and the two audio streams

ffmpeg -i input_fr.mp4 -c:v copy -an split.m4v ffmpeg -i input_fr.mp4 -c:a copy -vn split-fr.m4a ffmpeg -i input_de.mp4 -c:a copy -vn split-de.m4a

Combining the parts and setting their names

ffmpeg -i split.m4v -i split-de.m4a -i split-fr.m4a \ -map 0 -map 1 -map 2 \ -metadata:s:a:0 language=deu -metadata:s:a:0 title=deutsch \ -metadata:s:a:1 language=fra -metadata:s:a:1 title=français \ -metadata title="My combined video with two audio tracks" \ -c copy combined.mp4

Doing it all in one step

ffmpeg -i input_de.mp4 -i input_fr.mp4 \ -map 0 -map 1:a:0 \ -metadata:s:a:0 language=deu -metadata:s:a:0 title=deutsch -metadata:s:a:0 handler=deutsch \ -metadata:s:a:1 language=fre -metadata:s:a:1 title=français -metadata:s:a:1 handler=français \ -metadata title="My combined video with two audio tracks" \ -c copy combined.mp4

[y-tech]

Spotify stopping and rebuffering when running in background?

Spotify stopping and rebuffering when running in background? Disable AppNap for Spotify:

defaults write com.spotify.client NSAppSleepDisabled -bool YES

[y-tech]

Creating SSL certificates for S/MIME email encryption with OpenSSL

Email encryption certificates need a few special extensions to be recognized as such by email programs. This guide helps you create certificates that are recognized by Mac OS X Mail and iOS Mail.

If you use Mac OS X you can just follow my earlier post about creating a certificate with the OS X Keychain Access tool.

For this guide you need to have openssl installed. OS X has it already installed and most Linux distributions have it as well. On Windows you might want to install openssl via Cygwin.

Create an openssl configuration file. To add the required extensions to your certificate you need to create an openssl configuration file. Create a file called smime.cnf with the following contents:

[smime] keyUsage = critical, digitalSignature, keyEncipherment extendedKeyUsage = critical, emailProtection subjectAltName = email:copy

Generate your key pair:

openssl genrsa -out email.key 2048

Generate a certificate request:

openssl req -new -key email.key -out email.csr \ -subj '/CN=John Appleseed/[email protected]'

Create your self-signed certificate. The -days option sets the validity of the certificate:

openssl x509 -req -days 1500 \ -in email.csr -signkey email.key -out email.crt \ -setalias "[email protected] self-signed S/MIME" \ -extfile smime.cnf -extensions smime

Combine secret key and self-signed certificate into a single PKCS12 file for use with Keychain Access and iOS:

openssl pkcs12 -export \ -in email.crt -inkey email.key -out email.p12 \ -name "[email protected] self-signed S/MIME"

Finally, import it into your keychain so that OS X Mail will be able to use it. Open the file email.p12. Keychain Access will start and ask you for your trust settings: Click "Always Trust".

In Keychain Access double-click the certificate to open it, then open the "Trust" section and set "Secure Email (S/MIME)" to "Always Trust".

With the following command you can check if your certificate is ready for use:

security find-identity -p smime -s [email protected]

This command should show you one entry under "Valid identities only".

[y-tech]

Creating SSL certificates for S/MIME email encryption with Mac OS X and iOS

The easiest way to get a free SSL certificate for email encryption is to create a self-signed certificate with OS X Keychain Access.

Open Keychain Access (cmd-space to open Spotlight, type "keychain"). In the menu bar go to "Keychain Access" → "Certificate Assistent" → "Create a Certificate..."

Enter your name and select "Let me override defaults".

In the next step set the validity of your certificate. The default is 365 days, i.e. one year. I like to set it to a little more than four years so that I do not have to update my certificate too often.

Enter your email address next. Your name should already be set. The country is also already set. Clearing this field did not work for me: My certificate had my country set.

In the next step make sure the algorithm is set to RSA. RFC 5750 defines that S/MIME software must support RSA. DSA is just optional and may not work everywhere.

In the key usage extension select "Signature" and "Key Encipherment".

The extended key usage extension setting should already be correct: "This extension is critical" and "Email Protection" should be selected.

Do not include the basic constraints extension. You would only need to enable it to create your own certificate authority.

In the subject alternate name extension make sure your email address is set in the field "rfc822Name". RFC5750 defines that this field is the preferred way for email software to associate a certificate to an email address.

Finally save the certificate to your login keychain.

Even if you did not enter a country in step 4, you will notice that the certificate summary will still show a country for your certificate. This, most probably, is a bug in Keychain Access.

Enable your certificate for use in Mac OS X Mail

To be able to use your certificate in Mac OS X Mail you will have to edit the certificate's trust settings.

In Keychain Access look for your certificate and double-click it or select "Get Info" in the context menu.

Set "Always Trust" for "Secure Mail (S/MIME)" and "X.509 Basic Policy".

That's it!

Now you should be able to send signed emails. A recipient of a signed email can decide to trust your certificate and send you encrypted email.

To encrypt your outgoing email you need to have the certificates of all recipients of that mail. Ask them to send you a signed email so you can add their certificates to your Keychain.