Reviews here, reviews elsewhere...

[daal]

A hopefully brief crash course:

Very interesting, thanks. Can you explain the steps I need to take to verify that you are the author?

[rubin427]

A hopefully brief crash course:

Very interesting, thanks. Can you explain the steps I need to take to verify that you are the author?

Sure.

Part one: Tools

First, you need to have a command line tool on your computer called openssl. If you are running a recent linux or mac OS X, then you already have it. On windows, I suspect you may not have it. The first thing I would try is the instructions on this page.

http://www.openssl.org/related/binaries.html

Second, you will also need a hex-editor. If you aren't fimiliar with hex-editors, look at the picture on the wikipedia article. The left-most column shows the line offset, you can ignore it. The right most column is an attempt to render the data as ASCII text. Everything in between these two is where you can actually type in data, byte by byte. Data is represented using numbers 0-9 and letters A-F (i.e. Hexadecimal).

On dos/windows of long ago, there was a hex-editor called hexedit.exe. It may still be distributed with windows, but it must be launched from the command line. Hex editors are a favorite first project for many Computer Science students. So, generally speaking you can find one for free.

Part two: Gathering the files

We need to put together three files from the post. There will be files for: 1) the message data, 2) the public key, and 3) the digital signature.

For the message data, open a text editor (notepad on windows, nano on linux/OS X). Copy the message text of my post beginning at "It’s true that" and ending at "geek/openssl/#key-rsa". Paste this into the file and save the file as "message.txt".

For the public key, open your text editor again, Copy the public key from my post starting at "-----BEGIN PUBLIC KEY-----" and ending at "-----END PUBLIC KEY-----". Save the file as "test_public.pem".

Finally, for the digital signature, we have to use the hex editor. Open the Hex editor and copy from my post start at "1b 31" and endting at "04 9c". Paste it in and save the file as "message.txt.sha1".

For your reference, I have provided a copy of the three files. You can use them to compare to your files if something goes wrong. Any time you edit the a "sha1", you should use the hex editor.

message.txt
test_public.pem
message.txt.sha1

Part Three: Command to verify the signature

Code: Select all

  openssl dgst -sha1 -verify test_public.pem -signature message.txt.sha1 message.txt

  Verified OK

That's it.

Closing thoughts

If you visit the site I mentioned before, (http://www.madboa.com/geek/openssl/#key-rsa) there are four entries of particular interest.

"How do I generate an RSA key?" shows the steps I used to generate a private key for this example.
"How do I generate a public RSA key?" shows the steps I used to generate the public key - given the private key as input.
"How do I sign a digest?" show how to make a new digital signature.
"How do I verify a signed digest?" shows how to verify a digital signature.

So, my purpose here is to demonstrate the concept. People get really geeky about public/private key encryption, and I really am a novice. For example, I know that there is a whole network of servers on the internet whose whole purpose is to associate a person's e-mail with their public key. I know that lots of people chose to use either "pgp" or "gpg" for the encryption rather than openssl as I have in this example. Also, people really get picky about what algorithm they like. I just picked any old thing (sha1). Finally - and probably most important - If you decide to dive in and start using public-private key encryption, make an effort to understand how secure the private key you've generated is. There are so many options you can tweak when you make a new private key, and they each can have a big effect on the overall security.

[jdl]

Requiring a hex editor to check a signed message seems wrong, both technically and in the sense that no one is ever going to do that. There are easier tools that get the job done. I'll explain briefly with GnuPG, which is roughly the free version of PGP.

1. Install GnuPG. I use OS X and homebrew for a package manager, but you can substitute the appropriate commands for your system.

$ brew install gnupg


2. You need the user's public key. This is a topic unto its own, but for the sake of this demo, here's my public key.

$ gpg --armor --export my_key_name

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.11 (Darwin)

mQENBE1gO5MBCADsfoO+hRsmkEo7+e4QrX7IYLJ7+rcHx6/aMpkKLou0Tj8ynniE
ytBI/i7Vb75yTHwK9XEhzqzs+YpQ9pucDqDAXbJl4eT3Q04lriDEccr4qvHirQyd
LebI+70zPjN+wmCK4aR7pErN6jsGb9JgwVOG4ia8xUkU2lp+ZgUYMQGg2foOPIOx
cSQDKLFiI6TuTlUD3PPD220+DfdYt18X/gTYgX2CpqVY9kI61ECax3ObSIe4aQ0t
sUEfRA2UIBdKbXiW/XYESWN6uXD10PvEGXkfL2F9pDWyhd877panLJEEfT4G2tD6
Qx2kSWr2AL3EUqyW2TejYAVvZpU1KaS5SjYrABEBAAG0KkphbWVzIEx1ZGxvdyAo
SkRMKSA8amFtZXNsdWRsb3dAZ21haWwuY29tPokBOAQTAQIAIgUCTWA7kwIbAwYL
CQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQwQXJ+wNqtP44fwf/a/8ZKeilPL7m
FUKo6flf5Z4tUY0JVEa6czGcPEZyBTd7sK7CB/Q4bnD+ZDhEOyh7jgOCQAdEFd/F
gN8Msd5H3Ao4cPJaQFUntS2RI5rm4b3fV4VyZDhvYU9ODBjqedZcPRELnJ3HzPlV
mDovlUe92gOu+2CdgbLVXK5c9EP0f0ld52vX5bjfZ2P+6b9+ml41WuZiKFf07abL
74kM0gExl4j/oHsQmJVO8j2SpH5sCjdkHFApsnkNlbTZd2wPiHV9KIJhcsT0kwO4
WUwvSVMeTDCuAEwpjZ3FGgzKc+ixVldfRu/CvwcJ0qXKWSoThxtNswu7ZEVdto0s
+qEr6xk3vbkBDQRNYDuTAQgAujwNTTvAE5aqwW/E9zebJWnBs9BNo11uHd1HgvWO
oErVlde6ZTi2Eeb8kbIAxBPSqCuSWR6Syszgt8SAdLHmMFMQSY4P3X4g0wGvn3vl
lwWG3bc43c1gug3DUWKkt2uy9lvBdjMHJkSn3mo5H505ievTgw8tks/8mYyEVgfd
yBT2V5OW2Owjs/yGlQqgY/EUfYRrVvH/Sd3uGgWIKbKOohpt/1jFwdzAb9bz0atM
FzRL0Xlmz7y1OG4EbTsSdOI+dq8vXiKDYh549O38zbsX+nJieRV7R6JW/B9xWNXD
ihc5vSO3sA9Bwazm7yEvM/UsijaEeR7D4/u57Uy/cfxElwARAQABiQEeBBgBAgAJ
BQJNYDuTAhsMAAoJEMEFyfsDarT+AyUH+Ibayk5kyhfzqfMGLh5A1O9LIbzOzuJN
8WR4uLx4iytMacnyEy5fLv949sOO482X6iNLrVdGFZb6mo5mOTTju7IbCCbawnUq
AyNUH5LVv01YgXh4+vwmGV+M/04LL79AHKZ+HY38DlLIEmSsBtD/uytm1+2o6wGY
z+4Fk8OJjUtqqMCAGH6J8wER0O5UOdlXi2EKXCr2FUx2+sZQiQwxmZ1RjQgslWQm
TuPzAJR/9Bc89xfbwQcIuIvqF8JieQgWPQJgRa/nTmKEfNaqqvGuHGf0lht8HDKj
52VsszO37X8Y5G8fvbGW6lhEGrF2RmDb/7f2sn+smuxD1Scyl2oCZg==
=Z3FQ
-----END PGP PUBLIC KEY BLOCK-----

You save that to a file, like "bray.gpg" and then import the key to your local gpg.

$ gpg --import bray.gpg


2. Copy my signed message into a file. Example: Save the following (including the BEGIN and END lines) as "msg.txt.asc".

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hai there.
Bray really wrote this.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (Darwin)

iQEcBAEBAgAGBQJNYU9cAAoJEMEFyfsDarT+87EH/ih6IVlBCKZ5m+OYbM0mA31I
xfqouEozLCBm5ikR83B91KawwCg1j8FbJcVSSS3nmClHu4GphKHErBxjHUMuHJjG
jLNr8otG4cNnhQU8K/5R5J3F9ZyZQ2FQ5NntwI9bqUtpJLUMDR3qgryogFCmVZWc
QRPHZpRFGLaupI1c+Vx6T0Z9KjDn35UsDvwrxvIKomq5LkoMmBs/MVOEembJY3Rx
8medCsjeH91sADcTQ9F8MSIYscBl5kEs9PfA4W82l0PibCcn1BufHbjSOyasR4tw
qu8UMenTEVOGCHuK84GTLZyi5PlxEZnEDdrhva4nEA0Am00mkglGcyPWh4Wo5O8=
=ca8g
-----END PGP SIGNATURE-----


3. Verify.

$ gpg --verify msg.txt.asc
gpg: Signature made Sun Feb 20 11:29:00 2011 CST using RSA key ID 036AB4FE
gpg: Good signature from "James Ludlow (JDL) <email>"

[nemir]

Wow, funny Nemir/varios names ending with hippo...
I'm pretty sure I know this guy, I'll ask.

/Mats

It is kind of sad how many individual initiatives go nowhere because of a lack of collaboration in the go scene. Gobooks really looks like the work of a single enthusiast with not much people joining in for the project to take off.

Any other places where worthwile go book reviews linger? Nexik's blog has some, but I am usually not following the other blogs. Any takers?

Thanks for the honest critique of my site.

You've fairly accurately surmised the basic tale of it.

One thing I have noticed from reading through this thread is that I need to make sure that I update the front page's datestamp whenever I update any page within the site, rather than just when I update the front page. The last update on the site was last midwinter, so around a year back.

I started the project in a blaze of enthusiasm and energy when I noticed that David Carlton wasn't doing anything with his page anymore.

As seems to be the case with these ideas, it took literally ten times longer than I thought it would to get everything together, from the layout, the underlying engine, the search applet, et. al. One thing that I really really underestimated was just how long it takes to extract all the information I put up about each title from each book. The wraparound cover scans have to be done by hand, and then manually straightened and edited. Then I actually physically measure each book for dimensions, transcribe the blurb and all other data.

Once I'd done that, I contacted David Carlton seeking permission to use his reviews. I was hoping that he'd be okay with the idea of someone picking up his baton, so to speak. At first he was reluctant but after some consideration granted me permission to publish his reviews, for which I was very very grateful. A bit of discussion with the AGA secured permission to republish their reviews as well.

From there, things started to get a little deflating. I still think that the site has the most book reviews in one place on the net, but no other site administrator I approached gave permission for me to republish their reviews. Sometimes the responses I got from requests that I felt were very open and friendly and clearly in the spirit of creating something that is for the benefit of the go community were quite abrupt. I do have a reasonably think skin and I understand that there are some funny fellows in the go community so such communications were never taken personally, but it did make me question whether the go community at large was even interested in the site, or if they'd rather just get whatever they could from SL and that was good enough. And the cost of this site is not insignificant when you add up the time and lucre tracking down and acquiring all the titles, and then the hours upon hours processing them...

There were other little things that all added up to being increasingly demoralising. I've received only 2 unsolicited reviews in the 5 years since the site went live. Anywhere I'd mention it people would just seem to talk louder about David's site. Or places like GD or SL. Mentioning it in KGS would get me spanked for advertising, despite the fact that I don't sell anything or in any way make money from this site. I don't even have banner ads. Keeping up with titles can be difficult.

Then real life also got complicated and time consuming. Who'd have guessed that might happen??

A couple of times recently I've been come across complete strangers recommending my site, which makes me feel better about it. I have a stack of titles that I was going to process and add to the site over christmas, but personal issues and the deflation of motivation combined to see that it did not come to pass. Perhaps this thread might be the kick in the proverbial I need to get them processed, and then to order in the next stack.

As to the transparency... I am Nemir. Just some schmo who discovered the game too late in life to become a significantly strong player, so I chose this as my contribution to the community. What sort of validation do you want? Whatever it is, I am certain I can't provide it. Sorry. That's prt of the reason I've not personally reviewed many books; I am not sure I can do a great job at that. Reviews are all published with the author's byline, including as much personal info as said author is willing to publish on the internet in the google age. Is that not enough?

I still think it's the best go books site on the net. I am under no illusion that it could be better, but not sure how to get it to the next level. I love that Mats from mohsart finds it very useful for him as vendor, for example.

A question for anyone, but especially directed at John Fairburn who is asking for Kirby to step into this breach (and Kirby himself, I guess!):

What is missing from http://gobooks.nemir.org to make it work better as a resource for the go community?


What can I do to make it better?

In an ideal world, what do you want?

And on a different tack... who do I contact here to obtain permission to republish reviews here? Who can I contact to try to arrange for permission to republish the BGA reviews?

Cheers!

Nemir

[rubin427]

There are easier tools that get the job done.

Useful, thank you.

[daal]

...
What can I do to make it better?

In an ideal world, what do you want?

And on a different tack... who do I contact here to obtain permission to republish reviews here? ...
Cheers!

Nemir

Nemir, welcome to L19! Posting here and making yourself and your website visible in the go community is an excellent step that hopefully will lead to more input and perhaps even some collaboration. For a start, I have posted two reviews here (Winning Go and Catching Scent of Victory), and you are welcome to add them to your attractive site. As to republishing reviews that have appeared on L19, maybe you can contact the authors, or better yet, maybe they can contact you.

[rubin427]

nemir,

you could take out a "community advertisement" for your book review site at sensei's library. I believe it's free if you provide the graphic.

http://senseis.xmp.net/?CommunityAdvertisementsOnSL
http://senseis.xmp.net/?listads=1

[tapir]

What is missing from http://gobooks.nemir.org to make it work better as a resource for the go community?

* Add links to the original reviews, even when taken with permission this is helpful. This gives some perspective and also reveals which reviews are genuinely contributed on gobooks.nemir.org (that is merit to be linked to from elsewhere, gobooks is not the only aggregating site after all).
* Write at least once "Nemir" in the introduction instead of only I.
* Some indication for which books you have reviews for which you have not - given before you click your way through to the review section of the individual book.

[topazg]

What is missing from http://gobooks.nemir.org to make it work better as a resource for the go community?

I have used this site twice now to extend my Go book wishlist (i.e. I already feel this site offers a lot, it's great ). If I was to offer constructive feedback, it would be to:

a) Have keywords of the sorts of topics each book looks at (including multiple keywords for books with overlap).
b) Have an ability to sort by strength (aimed at), reviews, alphabet etc.

Sometimes I'd really like to be able to say "give me a list of Sabaki books, ordered with the highest level at the top, with unknown level in their own little group" (at the bottom is fine, but divided is important to not imply they are aimed at beginners), and then browse through the returns. At the moment I'm having to go through every title in no clear order. That's fine, as I'm beginning to own a decent amount of books I can skip over, and there aren't that many Go books, but is strikes me as a tool that would make it even more useful to me

[John Fairbairn]

A question for anyone, but especially directed at John Fairburn who is asking for Kirby to step into this breach (and Kirby himself, I guess!):

What is missing from http://gobooks.nemir.org to make it work better as a resource for the go community?

I'm not sure anything is missing from the site, although paying attention to spelling names right can help with searches

This site does all that's needed so Kirby can stop hiding under the bed.

Costs can be alleviated by contacting publishers. Free copies are usually available to reviewers. Contacting publishers as a one-stop shop for various permissions also saves time - they rather than the author usually have the say over advertising.

I'm willing for my reviews here to be posted there (I object to SL on the grounds it removes copyright and allows outside interference), but do note that some reviews depend on a context here (e.g. my Cho Chikun one).

The only major extra needed is something outside the site: a higher profile. I had never heard of the site before, and I'm fairly plugged in to the go scene. The mountain will not come to you, so you have to get your Alpenstock and go prodding the mountain. Don't be shy of regular posting here. Get a page on SL. A couple of minor items to add may be a box listing the latest reviews added, and a note on which books are lacking reviews.

SITE MANAGERS ELSEWHERE - PLEASE TAKE NOTE OF THIS RESOURCE AND ADD IT TO YOUR LINKS

[tapir]

--> http://senseis.xmp.net/?GobooksNemirOrg

The community advertisement on SL is a good idea as well. Raises general awareness.

[hyperpape]

I think there are a few things that could make the front page more engaging.

* Make the first paragraph a little more punchy.
* Something to engage people who are visiting the site without knowing what they want to see. John's suggestion of a new books or new reviews display seems good.

P.S. The date your review site was founded would be nice to have for SL, nemir.

[mohsart]

Glad to see you here, Nemir :-)

What I miss with the website is mainly information, such as missing titles, rank rekommendations, and of course reviews.
It would be nice to also have some fiction included (Hikaru no Go, The Girl Who Played Go, etc), but this is perhaps outside your intentions with the site...

I'm sure there are some people here who would be willing to help with the above; I'll start with a offer to scan some covers for you. I guess I have access to some titles that you don't own, yet. ;-)
A small, but still, way of "paying you back" for all the work you've put into the website. :-)

/Mats

[Stable]

For the BGA reviews the president Jon Diamond seems to be coordinating their online review section, you can find his email here.
Having said that, they have just started an online review section of their own, so may be less enthusiastic - I have no idea. (They can only say no, right? And you are non-profit.)

[tapir]

For the BGA reviews the president Jon Diamond seems to be coordinating their online review section, you can find his email here.
Having said that, they have just started an online review section of their own, so may be less enthusiastic - I have no idea. (They can only say no, right? And you are non-profit.)

On SL we, actually it was PeterHB, added links to the BGA reviews already. Aggregating must not necessarily happen by incorporation in a single place, we have hypertext, after all. (And to repeat, I would really encourage nemir to add a link to the original source, even where a complete reproduction is given.)