[Ann] CintaNotes 2.9 Beta 1!

[CintaNotes Developer]

Hi,

Well - finally!! we are ready to show something from the "yet unpublished"
The 2.9 release is a major one and contains two big new features - notebook encryption and
support for file attachments. Not everything is quite finished yet, but the main functionality
is already in place and can be tested and assessed. The things we are still planning to do
before the final 2.9 release will be mentioned separately.

Most of all, beside bug reports (which are to be expected, and a lot, just by the sheer volume of
changes), we are interested in your early feedback - what is not very convenient, which
obvious functions are missing etc.

Thanks a lot in advance for taking a look!

WARNING: Due to substantial changes to the DB, I don't recommend to use this beta as a
replacement for your current CN version. PLEASE ONLY USE ON A COPY OF YOUR NOTES.

Apr 14, 2015 - Version 2.9 Beta1

In this version:

Features:

• Notebook encryption and password protection
  - New menu item "File/Password protection"
  - Ability to re-ask password after a timeout
  - Automatic locking of notebook when PC is locked
  - WARNING: passwords are UNRECOVERABLE!!! If you forget your password, you lose your notes!
  (STILL NOT DONE, BUT PLANNED:
  - Make it a PRO feature)
  
  
• File and image attachments
  - New "Attach file" icon button in the note editor (to the right of the title)
  - Note attachments are displayed in the notes list on the right-hand side of the text
  - Search by attachment names is now possible
  - Files up to 1GB in size can be attached
  - Attachments are included into exported XML files and can be imported from them
  - Attachments are stored in compressed form in the notebook .db file itself
  - If you attach same file to different notes, it won't require extra storage space
  (STILL NOT DONE, BUT PLANNED:
  - Simplenote sync support for attachments
  - Thumbnail image previews
  - Search highlights in attachment previews
  - Copying and pasting of notes with attachments into other notebooks
  - Multi select when adding attachments
  - Multi select in attachment list control
  - Fix disabled look of attachment button in read-only editor
  - Make it a PRO feature)

Enhancements:

• Import dialog: add "Allow duplicates" checkbox
  
• Recycle bin: notes in recycle bin are now compressed, hence recycle bin takes much less space
  
• Added sqlite.pragma.locking_mode option to the settings file, with EXCLUSIVE becoming the default
  
• XML export: dropped support of old 1.5.4 XML format

Fixes:

• Window position not always restored correctly after restart
  
• Editor: internal note links can get corrupt
  
• Editor: on some computers note links are not copied when pasting notes as RTF
  
• Editor: ampersand (&) and apostrophe (') are not recognized as part of URL
  
• Editor: link editor doesn't resize after pressing enter
  
• Editor: removing list style should convert vertical tabs to CRLFs
  
• Editor: link field should be trimmed on exiting the edit mode

Download:
Installable: CintaNotes_2_9_Beta1_Setup.exe
Portable: CintaNotes_2_9_Beta1.zip

WARNING! BETA SOFTWARE! USE AT OWN RISK AND ALWAYS BACKUP YOUR DATA FIRST!

[usbpoweredfridge]

Awesome, thanks Have downloaded and setup a new portable install to try this out. Both new features interest me, the attachments probably moreso than the encryption (still hoping for inline attachments at some stage, images especially).

What encryption is used by the way? AES-128, AES-256?

Chris

PS: Debug logging is enabled by default, for anyone wondering why large log files start appearing in their CN install folder.

[CintaNotes Developer]

Hi Chris,
Thanks a lot for taking a look!

Yes, for all beta versions debug logging is enabled by default (for obvious reasons), but can be turned off.

The encryption is 256-bit AES encryption.

Could you please describe a bit more what you understand under "inline attachments"? Ability to open attachments
without having to open the editor? Ability to also add and remove attachments directly from the notes list?
Large image previews in the notes list?

[usbpoweredfridge]

Ok, first bit of feedback. Attachments in an encrypted notebook are decoded to disk - memory would be better if at all possible. Also, the decoded attachments are not deleted after use (eg after you close CN) - they are still stored in the system temp folder. If decoding to disk is not possible to avoid, the decoded files should be deleted after use - preferably securely (eg random overwrite). Having said that, secure deletion with SSD drives is really not possible due to the way SSD's work. So I guess the alternative would be a clear warning in the documentation that attachments are decoded to disk and may not be securely deleted afterwards - give people a note about potential privacy implications (I think the general user expectation would be that the encryption would prevent any privacy issues and they may be upset to find out - accidentally - otherwise).

Also, I think a small warning should be added on the password setting screen re: the password not being recoverable.

Chris

[CintaNotes Developer]

Attachments in an encrypted notebook are decoded to disk - memory would be better if at all possible. Also, the decoded attachments are not deleted after use (eg after you close CN) - they are still stored in the system temp folder. If decoding to disk is not possible to avoid, the decoded files should be deleted after use - preferably securely (eg random overwrite).

Thanks for raising this issue! You're right, this is a concern. I don't see how it could be possible not to decode attachments if we want to open them in an application associated with their extension.
However deleting temp files after use is possible to do - but only if the user doesn't close CN before closing the extracted attachment in other application.
(Actually it could be even possible to update the attachments in the DB if the temp files change, creating an illusion of editing the attached file directly.)

Also, I think a small warning should be added on the password setting screen re: the password not being recoverable.

Yes, we will certainly add it.

[usbpoweredfridge]

Could you please describe a bit more what you understand under "inline attachments"? Ability to open attachments
without having to open the editor? Ability to also add and remove attachments directly from the notes list?
Large image previews in the notes list?

Attachments inside the note text itself (really images). Here is my (not very nice) mock-up:
http://i.imgur.com/H51UQoB.png

Chris

[usbpoweredfridge]

Thanks for raising this issue! You're right, this is a concern. I don't see how it could be possible not to decode attachments if we want to open them in an application associated with their extension.

Good point - yes, with that thought in mind, I guess that they do have to be decoded to disk somewhere. I had in mind KeePass (the Windows password manager) when I suggested this - it supports attachments, and I had a thought that they weren't decoded to disk (I am quite possibly wrong about that, I thought I read it on the KeePass forums somewhere).

However deleting temp files after use is possible to do - but only if the user doesn't close CN before closing the extracted attachment in other application.

Yes, that is a fair enough limitation.

Yes, we will certainly add it.

Great Encryption is working well so far - I have thrown some tests at it. Deliberately mistyping the password at various stages (all tests passed so far), testing what happens if you have one DB encrypted and one not encrypted and you open CN (again, all tests passed) - and various other tests. One test I found interesting was to decrypt the database inside CN, leave it open (and decrypted) and then check the DB file on disk. I am happy to report the DB was only decrypted in memory, and not on disk - very good

Chris

[usbpoweredfridge]

Encryption is looking really solid. Tested password changing and removal in various ways with the intent of breaking something, and it has passed all tests so far. Only thing I haven't really tested is the inactivity timer (hopefully get a chance to look at that tomorrow).

Are there any practical limits on the passwords? As in a maximum amount of characters (doesn't appear to be a minimum, as 1 character passwords work), or restrictions on the types of characters entered (such as cannot use particular special characters)?

Chris

[Thomas Lohrum]

Hi Alex,

congratulations to finally release this new major (beta) version of CintaNotes!

I did some intensive tests on the beta. Here are my results. I will try to keep things as short as possible though.

• trimming of the title is not yet implemented
• the attachment icon is in a somewhat strange placement, but it is a very clever space usage
• there is no shortcut available for the file attachment icon yet, at least none is mentioned in the context menu
• there is no shortcut available to focus the attachments list in the editor yet
• bug: the min preview lines settings is ignored on new notes containing less lines than min preview
• importing of duplicate notes worked fine
• translation of "BkSp" in German should be "Rücktaste"
• the watchdog is implemented, but not mentioned yet? I found this setting "editor.linkswatchdog.enabled" and did set the value to 1. Imo, it should be auto-enabled when debug.log is enabled, so it will have more people using it.
• (double) Ctrl+Pos1 works awesome
• (double) Ctrl+End should be complemented
• confirm: fix on problem with € symbol and internal links
• converting vertical tabs to CRLF works very nice - thanks

More to come in another post.

Thomas

[Thomas Lohrum]

continued...

• exclusive lock works a lot faster on large imports
• please, can you explain what mode was used previously and what are the advantages and disadvantages of exclusive lock (besides faster writes)
• the drawing of the notes attachments list does not look well on the bottom in the editor; maybe a divider can be added
• having the list of notes attachments beneath the editor (rather than on the right side) would allow to show filenames without word wrap
• there is no warning when adding the same attachment twice; but that's probably ok. On the other hand a dialog can be helpful. "The file is attached already. Replace it with the file from the external disk?"
• dragging to resize the notes attachment area is nice However, the value is not saved in the settings file yet. Probably because it depends on the window (size) which was used at edit time.
• a file size of 3.38184 Mb should be shown with two digits only, e.g. 3.38 Mb
• a file size of less than 1 Kb should be shown in bytes (right now zero is displayed which is not helpful)
• When minimizing the attachments list area, so that only the icons will be visible, a hint should be available with the attachment's filename.
• Maybe showing only icons (and hints) should be the default, thus minimizing space requirements. It also looks quite nice. The only drawback i can think of is, when there are many attachments. Personally i expect many people to have one attachment per note. But as the feature is implemented nicely, people might use it with many attachments per note.
• Removing (deleting) an attachment should require a confirmation, which can be turned off optionally.

to be continued...

[Thomas Lohrum]

continued.....

• docs: search in attachment's filename is exclusive (search in all text fields is not supported)
• docs: opening attachments from the main window of notes list is not supported
• The feature here http://roadmap.cintanotes.com/topic/102220-show-size-of-note-when-sorting-for-size/ should be implemented now, showing the total size (text and all attachments) of the note.
• i second: "Search highlights in attachment previews" is what i wanted to ask for already
• bug: when starting minimized to the tray and i press the main shortcut for the notes list, the main window is hidden behind the current application. CN does not get shown in the foreground.

to be continued....

[Thomas Lohrum]

---------------------------
Exportfehler
---------------------------
Beim Export ist ein Fehler aufgetreten.
Precondition failed:
tools::ThreadsafeCounter::step
stepWeight > 0
---------------------------
OK
---------------------------

The export file won't be created.

I did send the logs via E-Mail.

[Thomas Lohrum]

Test case:

start CN with an encrypted database active
start CN with minimize to tray
on the password dialog press ESC

Now a dialog appears:

Fehler
The notebook file
<filename>
is encrypted.
[Neu anlegen] [Bereits Vorhandenes Öffnen] [Beenden]

This does not make sense. CN should just close itself.

[Thomas Lohrum]

continued...

• suggestion: show password strength when entering a new password
• select/open another db file works fine
• i confirm Chris' results on encryption testing
• I suggest to use an edit box allowing values from 1 to 60 for the "minutes of inactivity". This is more flexible.
• The password is not stored in the settings file nor in the database file itself, right? Respectively sqlite3 itself is aware of the password. The password is used as an access key when opening the file itself?!

Thomas

[Thomas Lohrum]

Hi Alex,

for now i will close my tests on 2.9 beta 1. As you did suggest not to use the release in production i uninstalled, restored my database and installed 2.8.5 again. This is the first time i am not using a beta for production. Please give advice when you think the version is stable, so it can be used on production data.

Thomas

[CintaNotes Developer]

Good point - yes, with that thought in mind, I guess that they do have to be decoded to disk somewhere. I had in mind KeePass (the Windows password manager) when I suggested this - it supports attachments, and I had a thought that they weren't decoded to disk (I am quite possibly wrong about that, I thought I read it on the KeePass forums somewhere).

I did a bit of research, and the result is: simple formats aren't decoded to disk and KeePass displays them from memory using own viewer, more complex formats are decoded to disk and securely deleted after that. I think we can do the latter, as implementing a built-in viewer isn't worth the effort IMO.

Encryption is working well so far - I have thrown some tests at it.

Thank you so much for this effort!

[CintaNotes Developer]

Attachments inside the note text itself (really images). Here is my (not very nice) mock-up: http://i.imgur.com/H51UQoB.png

Oh, that's quite a different story. I guess it will be difficult to do using RichEdit, altough possible. It is present on the roadmap however: http://roadmap.cintanotes.com/topic/185 ... ide-notes/

[CintaNotes Developer]

Encryption is looking really solid. Tested password changing and removal in various ways with the intent of breaking something, and it has passed all tests so far. Only thing I haven't really tested is the inactivity timer (hopefully get a chance to look at that tomorrow).

Thanks. The inactivity timer can very well have some bugs in it. BTW the timeout can be reduced beyond the limit of 5 mins via editing the settings file.

Are there any practical limits on the passwords? As in a maximum amount of characters (doesn't appear to be a minimum, as 1 character passwords work), or restrictions on the types of characters entered (such as cannot use particular special characters)?

Passwords can be of any length, since for encryption we use not the entered password per se, but its 256-bit long hash. I guess the password control will limit the length though, but I don't know the exact number. Since you can't paste text there, it is quite tedious. Passwords up to 100 chars work.

[Thomas Lohrum]

A warning can be implemented when opening an attachment.

For example:

"Warning: The attachment will be temporarily saved to disk in decrypted mode, to be able to open it with its associated application.

[ ] don't show this message again"


Thomas

[CintaNotes Developer]

Hi Thomas,
thanks a lot for helping with the tests!

trimming of the title is not yet implemented

Yes, will be in Beta 2.

the attachment icon is in a somewhat strange placement, but it is a very clever space usage

I considered a lot of different options, and finally selected this one as one of the best. But if you think there might be problems with this design, please let me know.

there is no shortcut available for the file attachment icon yet, at least none is mentioned in the context menu

Yes, will be added in Beta 2. I think it will be simply F12.

there is no shortcut available to focus the attachments list in the editor yet

Do we need one? You can navigate there using Tab.

bug: the min preview lines settings is ignored on new notes containing less lines than min preview

I confirm. Will be fixed in Beta2.

importing of duplicate notes worked fine

Great!

translation of "BkSp" in German should be "Rücktaste"

Even in menus? E.g. "Vorwaerts/ Shift+Ruecktaste oder Alt+Rechts"?

the watchdog is implemented, but not mentioned yet? I found this setting "editor.linkswatchdog.enabled" and did set the value to 1. Imo, it should be auto-enabled when debug.log is enabled, so it will have more people using it.

Yes, Denis has implemented the watchdog, but disabled it by default since it has impact on performance. I agree that it should be enabled when debug logging is enabled.

(double) Ctrl+Pos1 works awesome

Nice

(double) Ctrl+End should be complemented

Will be in Beta 2

confirm: fix on problem with € symbol and internal links

Cool

converting vertical tabs to CRLF works very nice - thanks

Welcome!