| 00:04.49 | *** join/#devuan ukine (~ukine@70.127.83.50) |
| 00:34.57 | *** join/#devuan infobot (ibot@c-174-52-60-165.hsd1.ut.comcast.net) |
| 00:34.57 | *** topic/#devuan is This is the Devuan https://devuan.org/ discussion channel | D1conf: #devuan-conf https://devuan.org/d1conf | Latest (2018-06-09): ASCII 2.0.0 https://devuan.org/os/debian-fork/ascii-stable-announce-060818 || Stable (2017-05-25): Jessie 1.0.0 LTS release | Devuan Forum: https://dev1galaxy.org/ | Chanlogs http://maemo.cloud-7.de/irclogs/freenode/_devuan/ | You may need to auth to NickServ |
| 00:34.58 | *** mode/#devuan [+v infobot] by ChanServ |
| 00:35.13 | *** join/#devuan g4570n (~g4570n@unaffiliated/g4570n) |
| 00:42.14 | *** join/#devuan fleeky (~fleeky@2601:241:8001:2e3a:8d7e:ca95:336c:7e1d) |
| 01:07.26 | *** join/#devuan tuxd3v (~tuxd3v@78.130.55.150.rev.optimus.pt) |
| 01:25.34 | agris | https://preview.redd.it/6qf8vjmv06u31.jpg?width=500&auto=webp&s=336618a3bd00e5b3af713f6f2b13dca6940289e1 |
| 01:26.20 | agris | how do you run a desktop with 30mb of ram |
| 01:26.34 | agris | assuming your using s custom kernel config right? |
| 01:27.30 | DonkeyHotei | unless you're trying win95, you don't |
| 01:28.11 | agris | I've run OpenBSD with those specs |
| 01:28.14 | agris | but not Linux |
| 01:28.20 | agris | actually no |
| 01:28.31 | agris | I'm using a Linux system with 8 megs of ram |
| 01:28.36 | agris | but not for a desktop |
| 01:55.35 | *** join/#devuan g4570n (~g4570n@unaffiliated/g4570n) |
| 01:55.55 | *** join/#devuan tuxd3v (~tuxd3v@78.130.55.150.rev.optimus.pt) |
| 02:17.43 | *** join/#devuan xcm (~xcm@ipa210.225.tellas.gr) |
| 02:26.16 | *** join/#devuan Guest27082 (nemo@hedgewars/dev/nemo) |
| 02:47.15 | *** join/#devuan xes (~xes@unaffiliated/xes) |
| 02:47.33 | gnarface | agris: these days you'd need a heavily customized kernel to pull it off, but it might still be possible, if uncomfortable. you'd definitely want some swap. |
| 02:48.04 | agris | gnarface, Linux 1 sure |
| 02:48.34 | gnarface | but the fresh image i just made for my pinebook is only using 41MB at boot, so i think 30MB is still in range if you strip out a ton of features |
| 02:49.00 | gnarface | i think last time i checked, a stock debian kernel weighs in somewhere above 64MB |
| 02:49.26 | agris | my Gentoo desktop runs at 2mb |
| 02:49.35 | gnarface | hah, nice |
| 02:49.36 | agris | most of that's Nvidia drivers though |
| 02:49.47 | gnarface | really? 2MB??? |
| 02:49.49 | agris | annoying as hell |
| 02:49.53 | gnarface | i mean... where's the rest of it? |
| 02:50.05 | gnarface | i know the nvidia drivers are huge but i'd still expect the kernel to weigh more |
| 02:50.13 | agris | no |
| 02:50.39 | *** join/#devuan ukine1 (~ukine@70.127.83.50) |
| 02:50.42 | gnarface | eh, maybe all that extra weight can still be stripped out then |
| 02:51.07 | gnarface | but i think it's been since kernel 2.4 or early 2.6.x versions since you could boot a stock linux in 8MB |
| 02:51.44 | gnarface | debian used to only need 8MB for the floppy installation but they cancelled that, i think the new installer needs 128MB or 256MB, so in your 30MB you'd definitely also be bootstrapping |
| 02:52.15 | agris | the kernel (linux4) really starts slowing down with 128m |
| 02:52.45 | gnarface | yea, if you try to do a big "apt-get upgrade" with only 128MB and no swap it will choke out |
| 02:52.45 | agris | but stock beowulf is bootable with 128m |
| 02:52.49 | agris | with x as well |
| 02:52.54 | onefang | Is that "size of kernel on disk" or "memory used"? |
| 02:53.05 | gnarface | oh, yea i was assuming this was memory used |
| 02:53.14 | gnarface | the pinebook image in question was 22MB on disk |
| 02:53.24 | gnarface | er, "Image" as in linux kernel binary |
| 02:53.32 | agris | that's a HUGE kernel |
| 02:54.12 | gnarface | yea, i know. that's 5.3... my 4.16 build was only 12MB, i'm still trying to figure out where all the extra weight is coming from |
| 02:55.04 | gnarface | i think the 12MB one actually used *more* RAM at boot time though, so it's clearly multiple issues |
| 02:55.34 | gnarface | actually, the difference could just be explained by one being compiled with -Os and the other O2 |
| 02:55.37 | onefang | The kernel I build for embedded work is 2.6 MB on disk image. 2.7 if I add extra modules for supporting more hardware. That's stripped to the bone though. |
| 02:55.39 | agris | memory mangement models |
| 02:55.52 | agris | drivers (most of those can be modular though) |
| 02:56.10 | agris | enterprise HA features for hardware your not using |
| 02:56.28 | agris | suppting 4096 sound cards |
| 02:56.34 | agris | *supporting |
| 03:00.10 | agris | having a whole 802.11 stack on a hardwired desktop |
| 03:06.00 | *** join/#devuan TheCreeper (~TheCreepe@unaffiliated/thecreeper) |
| 03:18.12 | gnarface | well, in this case it's a pinebook so i'll have to keep that |
| 03:30.38 | Xenguy | stabs nvidia, but only in #debianfork ... |
| 03:34.18 | onefang | Stabbed it with a fork. lol |
| 03:40.06 | *** join/#devuan D-HUND (~debdog@2a00:79c0:67e:5b00:7a24:afff:fe8a:d04d) |
| 03:50.44 | *** join/#devuan ar3itrary (~hacker@2a03:4000:6:8177:2::1) |
| 03:58.36 | *** join/#devuan sb35 (~sb35@23.111.78.44) |
| 04:18.01 | agris | basiclly just go through the kernel config and unselect anything you know your not going to use |
| 04:36.36 | systemdlete | how to find out the reason for the latest linux image (4.9.0-11)? |
| 04:37.45 | systemdlete | is it in a file included with the package for the update? |
| 04:41.00 | agris | Linus ran out of fingers |
| 04:41.17 | agris | oh nvm that's linux 5 |
| 04:47.08 | onefang | https://www.debian.org/security/2019/dsa-4564 might be useful. apt-listchanges might be useful in the more general case of "reason for this update". It'll show you the relevant changelog for things apt is about to update, then ask you if you want to actually update. |
| 04:50.38 | systemdlete | Thanks onefang, agris. It looks like a lot of Intel issues. Only my laptop is at issue then (my other machines are AMD) |
| 04:51.14 | agris | again!? |
| 04:51.42 | onefang | That'll be this months Intel issues. |
| 04:52.50 | agris | intel issues pertaining the memory mangement |
| 04:52.59 | agris | and lack of security |
| 05:15.46 | *** join/#devuan systemdlete (~systemdle@c-73-116-51-231.hsd1.ca.comcast.net) |
| 05:26.49 | onefang | I should update my kernel to. |
| 05:33.32 | *** join/#devuan systemdlete (~systemdle@c-73-116-51-231.hsd1.ca.comcast.net) |
| 05:36.16 | *** join/#devuan halbeno (~halbeno@d50-93-37-115.abhsia.telus.net) |
| 05:40.29 | onefang | Time to reboot this kernel. BRB |
| 05:40.55 | *** part/#devuan onefang (~onefang@devuan/developer/onefang) |
| 05:51.59 | *** join/#devuan DocScrutinizer05 (~saturn@openmoko/engineers/joerg) |
| 05:53.34 | *** join/#devuan onefang (~onefang@devuan/developer/onefang) |
| 06:21.20 | onefang | Ah, seems this kernel doesn't fix this months Intel issues, it re-fixes the ones from May. |
| 06:22.35 | *** join/#devuan engidea (~damiano@ip-46-141-11-154.rev.wolnext.com) |
| 06:23.04 | *** join/#devuan omnio (~omnio@82.137.10.238) |
| 06:24.52 | onefang | Ah, and not a full fix either, more fixes coming later. ZombieLoad is what this bug is called, ironically enough, it keeps coming back from the dead. lol |
| 06:25.52 | *** join/#devuan Centurion_Dan (~Thunderbi@devuan/developer/centuriondan) |
| 06:36.27 | *** join/#devuan knidos (~knidos@85.98.23.152) |
| 07:09.42 | *** join/#devuan tierce (~raoulzeca@2a02:a03f:3ec5:d300:d493:be8e:5080:5ac8) |
| 07:16.24 | *** join/#devuan sb35 (~sb35@23.111.78.46) |
| 07:24.06 | *** join/#devuan cocoadaemon (~foo@2a01:e35:8a99:e90:1202:b5ff:fe91:e4ca) |
| 07:30.37 | *** join/#devuan xcm (~xcm@ipa210.225.tellas.gr) |
| 07:33.22 | *** join/#devuan systemdlete2 (~systemdle@c-73-116-51-231.hsd1.ca.comcast.net) |
| 07:35.48 | systemdlete2 | grub-mkconfig correctly detects other OS's on my hard drive. I save that to /boot/grub/grub.cfg |
| 07:36.33 | systemdlete2 | but when I reboot, the grub menu has NOT changed. devuan should be first choice followed by others, but it looks like the other OS's grub.cfg in its own /boot partition |
| 07:36.56 | systemdlete2 | I'm missing a step I think. Keep in mind this is EFI, not BIOS. |
| 07:37.15 | systemdlete2 | (this is my ASUS transformer laptop 2-in-one |
| 07:37.55 | systemdlete2 | efibootmgr looks correct. shows the boot order choosing devuan first |
| 07:38.44 | systemdlete2 | devuan does boot, but it is coming from the menu entry in the other OS's menu.cfg |
| 07:42.24 | systemdlete2 | I have run grub-install several times. I've even tried explicitly specifying the --boot-directory option but to no avail. |
| 07:50.13 | systemdlete2 | and /boot/efi IS mounted during this process |
| 07:58.05 | *** join/#devuan Pali (~pali@Maemo/community/contributor/Pali) |
| 08:09.06 | *** join/#devuan systemdlete2 (~systemdle@c-73-116-51-231.hsd1.ca.comcast.net) |
| 08:12.04 | *** join/#devuan unixman_home (~unixman2@unaffiliated/eracc) |
| 08:21.13 | ErRandir | i've seen cases where the wrong grub.cfg is updated. check if you have both /boot/grub and /boot/grub2 directories. |
| 08:29.34 | *** join/#devuan sardonico (ale@freeshell.de) |
| 08:30.57 | *** join/#devuan mn3m (~mn3m@unaffiliated/mn3m) |
| 08:36.53 | *** join/#devuan proteus-guy (~proteus-l@203.117.110.10) |
| 08:39.14 | *** join/#devuan xcm (~xcm@ipa210.225.tellas.gr) |
| 08:49.21 | *** join/#devuan avbox (d5a03e0d@static-c-213-160-62-13.customer.ggaweb.ch) |
| 08:50.48 | avbox | AVMultimedia with ZSTD compression (20% smaller, 20% faster), Kernel 5.3.11 and brand new initrd (only 2.5 MB), a supersmall init file (100 lines) and superfast setup (<10 seconds) is here. Any questions are welcomed, Enjoy! |
| 09:34.01 | gnarface | are beowulf-updates and beowulf-security up and running? |
| 09:35.12 | yeti | Get:5 http://deb.devuan.org/merged beowulf-security/main armhf linux-image-4.19.0-6-armmp-lpae armhf 4.19.67-2+deb10u2 [34.1 MB] |
| 09:35.20 | yeti | just coming in herew |
| 09:35.26 | yeti | -w |
| 09:36.00 | yeti | not using backports yet... it's said to appear when beowulf gets stable |
| 09:39.35 | *** join/#devuan sb35 (~sb35@23.111.78.45) |
| 09:45.10 | *** join/#devuan yeti (~username@p57BDF493.dip0.t-ipconnect.de) |
| 09:59.24 | dejdo | Hi! Can you help me find the missing library? openvpn : Depends: libssl1.0.2 (>= 1.0.2d) but it is not installable |
| 09:59.46 | dejdo | I had it a hour ago, but after an apt purge libssl1.0.2 my system can't find it. |
| 10:00.18 | dejdo | ceres, fwiw |
| 10:06.03 | gnarface | ceres tends to be a moving target |
| 10:06.32 | gnarface | it just disappeared from pkginfo.devuan.org too... but i still get it from searches on deb.devuan.org... |
| 10:07.22 | dejdo | with bringing in ascii it's installing |
| 10:07.50 | gnarface | i see it in beowulf too still |
| 10:07.51 | *** join/#devuan hkramer_ (~hkramer@2003:a:1319:f500:400b:bb4b:380c:6d1d) |
| 10:07.53 | gnarface | on pkginfo |
| 10:07.58 | gnarface | but ceres lost all libssl* |
| 10:08.06 | gnarface | ... which is weird, but probably not permanent, i'd assume |
| 10:08.14 | gnarface | unless they're planning on ditching it for libressl or something... |
| 10:08.44 | gnarface | but usually they wouldn't just drop something like that, they'd change the default, at least historically before systemd anyway |
| 10:19.36 | gnarface | yeti: yea, but the question is, is it safe to use yet? |
| 10:19.55 | gnarface | yeti: or am i gonna accidentally apt-get upgrade myself into debian |
| 10:29.04 | yeti | ecxept for nostalgy in 2 VMs, I'm using beowulf |
| 10:29.13 | yeti | for months now... |
| 10:29.38 | yeti | but I dont care about occasionally cant reboot by click hiccups |
| 10:29.49 | yeti | I'm happy with sudo poweroff and friends |
| 10:30.52 | yeti | if you want a system that does suicide by update, try debian's PI1 image |
| 10:30.54 | yeti | :-Ã |
| 10:33.54 | *** join/#devuan _abc_ (~usre@unaffiliated/ccbbaa) |
| 10:34.40 | *** join/#devuan TheCreeper (~TheCreepe@unaffiliated/thecreeper) |
| 10:34.50 | _abc_ | I see ubuntu has ways to generate signed secure boot acceptable modules. Is this a kernel feature? I know nothing about it. Is it also usable on devuan releases? I'm still on ascii but will upgrade soon. references: https://ubuntu.com/blog/how-to-sign-things-for-secure-boot |
| 10:35.04 | _abc_ | I do not see specific ubuntu references there apart from moko |
| 10:47.08 | *** join/#devuan systemdlete2 (~systemdle@c-73-116-51-231.hsd1.ca.comcast.net) |
| 10:49.07 | gnarface | _abc_: i dunno if it's kernel or boot loader features or what, but yea, i think devuan should work too if you make your own key. i can't tell you how but there should be a way to do it documented somewhere... |
| 10:49.43 | gnarface | key or signature or whatever it's called |
| 10:50.45 | gnarface | i thought it's more about the bios/efi thing in the motherboard really |
| 10:50.54 | gnarface | than the kernel |
| 10:59.50 | _abc_ | gnarface: I understand the kernel needs to diddle the right registers in the SoC to enable and then enforce sceure boot. |
| 10:59.58 | _abc_ | This after BIOS has it turned on. |
| 11:21.59 | *** join/#devuan arnoldoree (~arnoldore@ranoldoree.plus.com) |
| 11:27.38 | *** join/#devuan jelly-home (jelly@pdpc/supporter/active/jelly) |
| 11:31.12 | *** join/#devuan xcm (~xcm@ipa210.225.tellas.gr) |
| 11:43.58 | *** join/#devuan Digit (~user@fsf/member/digit) |
| 11:51.24 | *** join/#devuan TheCreeper (~TheCreepe@unaffiliated/thecreeper) |
| 11:53.03 | *** join/#devuan zeden (~user@unaffiliated/zeden) |
| 12:02.40 | *** join/#devuan Kruppt (~Kruppt@50.111.55.255) |
| 12:07.24 | *** join/#devuan zeden (~user@unaffiliated/zeden) |
| 12:20.15 | *** join/#devuan puria (~puria@194.244.26.116) |
| 12:26.30 | errandir1 | there is a long chain of trust from the BIOS to other hardware and software. Different bits will use different keys. |
| 12:34.38 | *** join/#devuan KnoP (~chatzilla@b2b-78-94-129-218.unitymedia.biz) |
| 12:53.53 | *** join/#devuan Digit (~user@fsf/member/digit) |
| 12:53.53 | *** join/#devuan cocoadaemon (~foo@2a01:e35:8a99:e90:1202:b5ff:fe91:e4ca) |
| 12:53.53 | *** join/#devuan ar3itrary (~hacker@2a03:4000:6:8177:2::1) |
| 12:53.53 | *** join/#devuan xrogaan (~xrogaan@unaffiliated/xrogaan) |
| 12:53.53 | *** join/#devuan petzi (~petzi@p578b3438.dip0.t-ipconnect.de) |
| 12:53.54 | *** join/#devuan Besnik_b (~Besnik@ppp-2-86-189-18.home.otenet.gr) |
| 12:53.54 | *** join/#devuan rypervenche (~rypervenc@unaffiliated/rypervenche) |
| 12:53.54 | *** join/#devuan errandir1 (~mh@uk.solarflare.com) |
| 12:53.54 | *** join/#devuan n0a110w (~n0a110w@unaffiliated/n0a110w) |
| 12:53.54 | *** join/#devuan danyspin97 (~danyspin9@liveunix.org) |
| 12:53.54 | *** join/#devuan kelsoo (~kelsoo@dragora/developer/kelsoo) |
| 12:53.54 | *** join/#devuan cyteen_ (~cyteen@31.125.12.7) |
| 12:53.54 | *** join/#devuan tse_ (~tse@static.240.142.216.95.clients.your-server.de) |
| 12:53.54 | *** join/#devuan humma (gun@gateway/shell/blinkenshell.org/x-otkrqwyolfozdqgq) |
| 12:53.54 | *** join/#devuan Nukien (~Nukien@162.250.233.55) |
| 12:53.54 | *** join/#devuan odinfinch (~odinfinch@www3.odinfinch.xyz) |
| 12:53.54 | *** join/#devuan chr[] (~chr@2a03:4000:2b:1648::42) |
| 12:53.54 | *** join/#devuan specing (~specing@unaffiliated/specing) |
| 12:53.54 | *** join/#devuan krayon_ (~Krayon@pdpc/supporter/28for7/krayon) |
| 12:53.54 | *** join/#devuan DarkUranium (~DarkUrani@stdrand.com) |
| 12:53.54 | *** join/#devuan georg-gast-2 (~georg@nebka.physik.tu-chemnitz.de) |
| 12:53.54 | *** join/#devuan muep (~quassel@muep.iki.fi) |
| 12:53.54 | *** join/#devuan koollman (samson_t@sp1.kooll.org) |
| 12:53.54 | *** join/#devuan zama (~zama@unaffiliated/stryx/x-3871776) |
| 12:53.54 | *** join/#devuan Infiltrator (~Infiltrat@unaffiliated/infiltrator) |
| 12:53.54 | *** join/#devuan gnarf_08 (~ck@gollum.pgxml.net) |
| 12:53.54 | *** join/#devuan Kobaz (~kobaz@its.kobaz.net) |
| 13:24.37 | *** join/#devuan fgdg (d5594abb@c213-89-74-187.bredband.comhem.se) |
| 13:33.19 | *** join/#devuan tierce (~raoulzeca@2a02:a03f:3ec5:d300:d493:be8e:5080:5ac8) |
| 13:49.45 | *** join/#devuan Xenguy (~Xenguy@devuan/community/Xenguy) |
| 14:00.08 | *** join/#devuan g4570n (~g4570n@unaffiliated/g4570n) |
| 14:05.19 | *** join/#devuan xinomilo (xinomilo@gateway/vpn/privateinternetaccess/xinomilo) |
| 14:06.58 | *** join/#devuan targz (~Thunderbi@unaffiliated/targz) |
| 14:07.09 | *** join/#devuan TheCreeper (~TheCreepe@unaffiliated/thecreeper) |
| 14:16.17 | nemo | sooo I ran https://raw.githubusercontent.com/speed47/spectre-meltdown-checker/master/spectre-meltdown-checker.sh on the work laptop which irritatingly is Intel so has way more CVEs |
| 14:16.21 | nemo | and is also Devuan Ascii |
| 14:16.43 | nemo | I was kinda disappointed by the amount of red "mitigated by CPU microcode" |
| 14:16.50 | nemo | I'm guessing devuan is not pushing these fixes to me? |
| 14:17.06 | nemo | or really, upstream debian |
| 14:20.25 | nemo | hm... I do have a kernel update unapplied. guess I should do that and see if the red goes down |
| 14:24.04 | onefang | That kernel update includes more Intel microcode fixes. |
| 14:24.26 | onefang | There's more to come though. intel is still working on it. |
| 14:27.00 | Wonka | well, the kernel packages don't contain microcode fixes; the microcode packages do. |
| 14:27.02 | nemo | onefang: this is the only laptop in my house that is Intel. which is all the fault of my workplace where 99% of their hardware is intel |
| 14:27.31 | Wonka | https://packages.debian.org/sid/intel-microcode |
| 14:27.34 | nemo | hm... I do have one intel mini-server but it is an Intel Atom which has almost none of the optimisations that bit intel so hard |
| 14:27.58 | onefang | The kernel updates came along with the microcode update. |
| 14:28.24 | *** join/#devuan poontangmessiah (~poontangm@unaffiliated/poontangmessiah) |
| 14:28.33 | GyrosGeier | mmh |
| 14:28.38 | GyrosGeier | I have a TalosII |
| 14:28.39 | Wonka | nemo: if you don't run other people's code, those fixes do not matter much to you anyway - they'd only matter after someone gained RCE on your machine. |
| 14:28.48 | GyrosGeier | but Devuan doesn't have PPC ports yet |
| 14:29.04 | onefang | My desktop that I have applied them to is AMD, I still have a couple of Intel machines to apply them to. |
| 14:29.08 | nemo | Wonka: erm. AFAIK a ton of them can happen through JS execution. I run noscript aggressively the time. but occasionally I whitelist |
| 14:29.11 | GyrosGeier | my main Intel boxes are VM hosts, so those patches are of interest to me |
| 14:29.12 | nemo | Wonka: JS/WASM |
| 14:29.27 | Wonka | nemo: JS execution on a "mini-server"? |
| 14:29.28 | nemo | Wonka: and since I do like to surf the web and occasionally run web apps, I'd rather be safe |
| 14:29.33 | nemo | Wonka: no. that one is totally safe |
| 14:29.35 | GyrosGeier | and I run libvirt without systemd, so having them in Devuan is also of interest to me |
| 14:29.40 | nemo | Wonka: I was just qualifying |
| 14:29.57 | nemo | Wonka: the laptop that is annoying me, the work laptop, I use extensively. and occasionally in dubious places (starbucks) |
| 14:29.59 | Wonka | nemo: yep. the mini-server should be safe is what I meant. |
| 14:30.01 | GyrosGeier | there is a JS version of rowhammer that works |
| 14:30.08 | Wonka | GyrosGeier: ack... |
| 14:30.10 | nemo | GyrosGeier: yeah, I know. |
| 14:30.26 | nemo | GyrosGeier: but the information leaks are easier to execute and a lot more worrying |
| 14:30.29 | Wonka | well, my i7-2720QM is quite safe from quite a lot of stuff too |
| 14:30.53 | onefang | There are proofs of concept for some of the Meltdown / Spectre issues in JavaScript. |
| 14:30.58 | nemo | yep |
| 14:31.41 | nemo | onefang: well, since almost everything at home is AMD, it's just Meltdown that's the concern not Spectre, as I understand it |
| 14:31.48 | nemo | onefang: and all the ones since have been Intel-only |
| 14:31.51 | nemo | like the batch this month |
| 14:32.03 | nemo | but, since I have to use the work laptop, I do need to try to make it as safe as possible |
| 14:32.27 | nemo | the starbucks scenario that worries me is the 1% of my traffic that isn't over HTTPS these days |
| 14:32.52 | onefang | The AMD desktop I built myself, deliberately choosing AMD. The Intel boxes I didn't get a choice. |
| 14:32.58 | nemo | just need need *one* HTTP request to allow an attacker to redirect to malicious stuff |
| 14:33.00 | *** join/#devuan poontangmessiah (~poontangm@unaffiliated/poontangmessiah) |
| 14:34.43 | Wonka | nemo: you know the "HTTPS Everywhere" plugin? |
| 14:35.00 | Wonka | https://www.eff.org/https-everywhere |
| 14:35.20 | nemo | yeah |
| 14:35.25 | nemo | it's unfortunately not *everywhere* though |
| 14:35.29 | Wonka | nemo: also, you could packetfilter tcp/80 |
| 14:35.35 | nemo | it's only "if-explicitly-supported" |
| 14:35.36 | nemo | hmmm |
| 14:35.37 | onefang | Doesn't work if the web server you are connecting to doesn't do HTTPS. |
| 14:35.38 | nemo | that's a good idea! |
| 14:35.58 | nemo | I wonder if HTTPS Everywhere has a "block no matter what even if it breaks stuff" mode |
| 14:36.05 | nemo | but packetfiltering. I like that one |
| 14:38.14 | nemo | nice. |
| 14:38.23 | nemo | I'm going to leave that on for a bit just to see what it impacts |
| 14:38.47 | Wonka | nemo: it has. there's a switch setting that explains itself as "Unencrypted requests are currently blocked" |
| 14:38.55 | nemo | ahh |
| 14:39.00 | nemo | cool |
| 14:40.08 | nemo | hm... I should just rewrite all port 80 to 255.255.255.255 |
| 14:40.16 | nemo | it's more efficient |
| 14:40.26 | nemo | (the drop was causing lag in experiments) |
| 14:44.01 | *** join/#devuan sixwheeledbeast (~zem@2a01:4f8:c17:101::2) |
| 14:44.43 | *** join/#devuan DocScrutinizer51 (~lagrange@openmoko/engineers/joerg) |
| 14:46.12 | *** join/#devuan onefang (~onefang@devuan/developer/onefang) |
| 14:46.37 | *** join/#devuan tobypus (~jr-logbot@neo900/bot/jr-logbot) |
| 14:46.38 | *** mode/#devuan [+v tobypus] by ChanServ |
| 14:49.21 | nemo | Wonka: hm. I guess the downside to blocking all HTTP is by default Devuan uses HTTP for packages ⺠|
| 14:49.30 | nemo | Wonka: so I have to remember to disable it to run updates |
| 14:49.33 | nemo | not a huge problem ofc |
| 14:49.46 | nemo | little wrapper script |
| 14:50.51 | Wonka | uid based? |
| 14:51.19 | nemo | another good idea! |
| 14:51.24 | onefang | apt-transport-https, and some of our mirrors use HTTPS. |
| 14:51.28 | nemo | true. why would I ever run a browser as root |
| 14:52.02 | onefang | https://pkgmaster.devuan.org/mirror_list.txt will help you pick a HTTPS mirror. |
| 14:52.31 | nemo | onefang: ah. that is helpful anyway. due to stoooopid work filter that occasionally randomly blocks packages as malicious |
| 14:55.00 | *** join/#devuan sunshavi (~user@190.239.244.220) |
| 15:00.46 | *** join/#devuan proteus-guy (~proteus-l@203.117.110.10) |
| 15:02.35 | nemo | hm... DNAT to 255.255.255.255 still hangs I guess 'cause the client doesn't know it's invalid. REJECT rule has noticeable lag |
| 15:02.42 | nemo | oh well. REJECT it is |
| 15:02.56 | nemo | iptables -A OUTPUT -p tcp --dport 80 -m owner --uid-owner root -j ACCEPT |
| 15:03.03 | nemo | iptables -A OUTPUT -p tcp --dport 80 -j REJECT |
| 15:04.36 | nemo | huh. weird |
| 15:05.06 | nemo | apt-get update drops root privs? |
| 15:05.13 | nemo | getting network unreachable |
| 15:05.19 | nemo | even though a wget as root works |
| 15:07.19 | nemo | ah. indeed it does. let's see what the user is |
| 15:17.42 | *** join/#devuan poontangmessiah (~poontangm@unaffiliated/poontangmessiah) |
| 15:21.58 | *** join/#devuan omnio_ (~omnio@82.137.9.209) |
| 15:25.49 | *** join/#devuan omnio (~omnio@82.137.13.94) |
| 15:33.37 | *** join/#devuan IoFran (~Thunderbi@189.237.240.124) |
| 15:41.26 | *** join/#devuan furrywolf (~furrywolf@172.58.92.107) |
| 15:42.04 | *** join/#devuan hkramer (~hkramer@2003:a:1319:f500:400b:bb4b:380c:6d1d) |
| 15:51.25 | *** join/#devuan xinomilo (xinomilo@gateway/vpn/privateinternetaccess/xinomilo) |
| 15:58.55 | *** join/#devuan unixman_home (~unixman2@216.137.200.114) |
| 15:58.55 | *** join/#devuan unixman_home (~unixman2@unaffiliated/eracc) |
| 16:05.26 | *** join/#devuan poontangmessiah (~poontangm@unaffiliated/poontangmessiah) |
| 16:10.02 | *** join/#devuan IoFran (~Thunderbi@200.68.140.10) |
| 16:11.58 | *** join/#devuan Colemak (~daniel@host86-129-193-30.range86-129.btcentralplus.com) |
| 16:13.14 | Leander | nemo: to avoid the "starbucks scenario" I always connect to my home VPN (I have a static IP address), it makes firewall rules much simpler to deal with |
| 16:22.54 | *** join/#devuan s4rd0n1c0 (ale@94.247.40.156) |
| 16:26.49 | *** join/#devuan byzandula (~byzandula@beerbq.net) |
| 16:26.57 | *** join/#devuan jathan (~jathan@200.39.241.171) |
| 16:28.23 | *** join/#devuan climbingturtle (~climbingt@c213-89-14-151.bredband.comhem.se) |
| 16:32.29 | *** join/#devuan puria (~puria@net-188-218-183-123.cust.vodafonedsl.it) |
| 16:37.01 | *** join/#devuan IoFran (~Thunderbi@200.68.140.10) |
| 16:38.31 | *** join/#devuan HumanG33k (~HumanG33k@62.147.242.8) |
| 16:40.01 | *** join/#devuan HumanG33k (~HumanG33k@62.147.242.8) |
| 16:43.04 | *** join/#devuan ymasson (~ymasson@lfbn-bor-1-147-114.w90-50.abo.wanadoo.fr) |
| 16:43.45 | *** join/#devuan klaus (~klaus@2a01:cb1c:661:9300:aebc:32ff:fec4:59c3) |
| 16:49.16 | *** join/#devuan Rick8024 (~chatzilla@31.173.84.0) |
| 16:50.31 | *** join/#devuan KnoP_ (~chatzilla@b2b-78-94-129-218.unitymedia.biz) |
| 16:50.55 | *** join/#devuan puria (~puria@net-188-218-183-123.cust.vodafonedsl.it) |
| 16:51.40 | *** join/#devuan Pali (~pali@Maemo/community/contributor/Pali) |
| 17:00.45 | *** join/#devuan Rick8024 (~chatzilla@31.173.86.59) |
| 17:11.16 | *** join/#devuan rsx (~rsx@ppp-188-174-156-72.dynamic.mnet-online.de) |
| 17:15.16 | *** join/#devuan KnoP (~chatzilla@b2b-78-94-129-218.unitymedia.biz) |
| 17:15.56 | *** join/#devuan guest29348769876 (~rsx@ppp-188-174-136-124.dynamic.mnet-online.de) |
| 17:18.34 | *** join/#devuan james1138 (~chatzilla@71-222-133-42.albq.qwest.net) |
| 17:22.31 | *** join/#devuan guest29348769876 (~rsx@ppp-188-174-136-133.dynamic.mnet-online.de) |
| 17:23.10 | *** join/#devuan earthnative (~nemo@119.18.37.212) |
| 17:24.15 | *** join/#devuan IoFran (~Thunderbi@200.68.140.10) |
| 17:27.45 | *** join/#devuan puria (~puria@net-188-218-183-123.cust.vodafonedsl.it) |
| 17:31.14 | *** join/#devuan agris (~agris@206-212-236-243.static.onlinenw.com) |
| 17:37.51 | nemo | Leander: hm. that's a good point |
| 17:38.01 | nemo | Leander: I should perhaps relay everything |
| 17:38.03 | *** join/#devuan poontangmessiah (~poontangm@unaffiliated/poontangmessiah) |
| 17:38.16 | nemo | Leander: I'm not a huge fan adding extra lag, but I'm also not a huge fan of exploits |
| 17:38.23 | nemo | *of adding |
| 17:38.52 | nemo | ofc HTTP also requires trusting the hops in between, but at least there the attacker is maybe a bit less likely... |
| 17:42.04 | *** join/#devuan IoFran2 (~Thunderbi@189.237.240.124) |
| 17:54.39 | *** join/#devuan OldMoss (~oldmoss@2001:67c:1350:105::14) |
| 18:22.01 | *** part/#devuan onefang (~onefang@devuan/developer/onefang) |
| 18:22.02 | *** join/#devuan onefang (~onefang@devuan/developer/onefang) |
| 18:33.45 | *** join/#devuan Human_G33k (~HumanG33k@62.147.242.8) |
| 18:35.04 | *** join/#devuan Human_G33k (~HumanG33k@62.147.242.8) |
| 18:40.48 | *** join/#devuan shibboleth (~shibbolet@gateway/tor-sasl/shibboleth) |
| 18:42.36 | *** join/#devuan st3ma (~st3ma@213.178.26.60) |
| 18:51.52 | *** join/#devuan Centurion_Dan (~Thunderbi@devuan/developer/centuriondan) |
| 18:54.16 | *** join/#devuan IoFran (~Thunderbi@189.237.240.124) |
| 18:56.29 | *** join/#devuan cd (~cd@unaffiliated/cd) |
| 18:57.32 | *** join/#devuan yae7nae4 (~yae7nae4@45.32.163.153) |
| 19:09.23 | *** join/#devuan IoFran2 (~Thunderbi@200.68.140.10) |
| 19:24.17 | *** join/#devuan jathan (~jathan@200.39.241.171) |
| 19:25.08 | *** join/#devuan Soo_Slow (Soo_Slow@gateway/vpn/privateinternetaccess/sooslow/x-31376162) |
| 19:31.58 | nemo | hm. after reboot and upgrade my devuan ascii intel work laptop is still vulnerable to 6 CVEs |
| 19:32.01 | nemo | 5 from 2018 |
| 19:32.04 | nemo | and the most recent one |
| 19:34.19 | onefang | That most recent fix from Intel didn't fix everything, AND it's still fixing things from May. |
| 19:40.33 | nemo | onefang: but stuff from 2018? |
| 19:41.08 | *** join/#devuan xcm (~xcm@ipa210.225.tellas.gr) |
| 19:41.57 | nemo | CVE-2018-3640:KO CVE-2018-3639:KO CVE-2018-12126:KO CVE-2018-12130:KO CVE-2018-12127:KO CVE-2019-11091:KO |
| 19:42.03 | mason | nemo: Do you have microcode installed? Some things can't be fixed without it. |
| 19:42.36 | mason | nemo: https://github.com/speed47/spectre-meltdown-checker is useful |
| 19:53.25 | james1138 | https://packages.debian.org/search?keywords=intel-microcode |
| 19:53.39 | *** join/#devuan Inepu (~Mithrandi@host67-78-static.1-79-b.business.telecomitalia.it) |
| 19:53.54 | nemo | mason: the checker was what I was running |
| 19:54.05 | nemo | mason: I kinda assumed that patches would be pushed with the standard kernel updates |
| 19:54.11 | nemo | but ok. checking now |
| 19:54.18 | mason | Nah, it's the intel-microcode package. |
| 19:55.15 | nemo | so... most debian users are insecure by default? that's worrying |
| 19:55.40 | mason | Debian doesn't tend to ship nonfree software by default. |
| 19:56.35 | *** join/#devuan KnoP (~chatzilla@79.104.5.137) |
| 19:58.56 | *** join/#devuan KnoP (~chatzilla@b2b-78-94-129-218.unitymedia.biz) |
| 20:07.25 | furrywolf | most debian users are single-user systems, and thus not realisticly affected by any of the cpu-level vulnerabilities. |
| 20:07.32 | *** join/#devuan Centurion_Dan (~Thunderbi@devuan/developer/centuriondan) |
| 20:11.36 | cehteh | huh |
| 20:11.49 | cehteh | most debian systems are prolly servers in the internet |
| 20:12.00 | *** join/#devuan cocoadaemon (~foo@x53.octopuce.fr) |
| 20:14.11 | furrywolf | I'd figure most are desktops... and even for servers, most have only a single administrator, or otherwise have all users on the system expected to be non-evil. |
| 20:14.43 | furrywolf | most of those cpu bugs really only apply to systems where untrusted users can execute arbitrary code. |
| 20:16.38 | *** join/#devuan IoFran (~Thunderbi@200.68.140.10) |
| 20:21.22 | mason | furrywolf: I strongly suspect desktops are in the minority. |
| 20:22.23 | mason | furrywolf: And web services offer an opportunity for outsiders to get code executed, either by design or through flaws. |
| 20:22.43 | mason | furrywolf: The big bash vulnerability wasn't all that long ago. |
| 20:24.50 | *** join/#devuan DonkeyHotei (dGM@april-fools/2014/runnerup/danielg4) |
| 20:25.19 | cehteh | a webserver wtih PHP is an untrusted user |
| 20:41.25 | *** join/#devuan IoFran (~Thunderbi@200.68.140.25) |
| 20:42.21 | *** join/#devuan Centurion_Dan (~Thunderbi@devuan/developer/centuriondan) |
| 21:02.46 | *** join/#devuan poontangmessiah_ (~poontangm@unaffiliated/poontangmessiah) |
| 21:17.05 | *** join/#devuan LtWorf (~LtWorf@h-191-254.A890.priv.bahnhof.se) |
| 21:19.14 | *** join/#devuan rdav (~rdav@110.193.150.122.sta.dodo.net.au) |
| 21:44.08 | *** join/#devuan Centurion_Dan (~Thunderbi@devuan/developer/centuriondan) |
| 21:45.46 | *** join/#devuan Ryushin (~Ryushin@windwalker.chrisdos.com) |
| 22:31.32 | *** join/#devuan AntoFox (~AntoFox@mob-5-92-55-223.net.vodafone.it) |
| 22:35.25 | *** join/#devuan Centurion_Dan (~Thunderbi@devuan/developer/centuriondan) |
| 22:49.33 | *** join/#devuan LtWorf (~LtWorf@h-191-254.A890.priv.bahnhof.se) |
| 23:00.16 | *** join/#devuan sb35 (~sb35@67.231.16.205) |
| 23:31.31 | *** join/#devuan IoFran (~Thunderbi@189.237.240.124) |
| 23:36.39 | *** join/#devuan Xenguy (~Xenguy@devuan/community/Xenguy) |
| 23:44.38 | *** join/#devuan IoFran (~Thunderbi@189.237.240.124) |
| 23:51.59 | *** join/#devuan TheCreeper (~TheCreepe@unaffiliated/thecreeper) |
| 23:56.38 | *** join/#devuan IoFran2 (~Thunderbi@189.237.240.124) |
