| 00:00.03 | DocScrutinizer05 | when you're afraid of malware, I'm really pleased you think it's unlikely to find on my server but likely on a MITM attack |
| 00:01.22 | DocScrutinizer05 | well, I do NOT do automatic cert and script update from LE, so my server is prolly more safe against getting hijacked and malware infested than a lot of others ;-) |
| 00:03.02 | DocScrutinizer05 | I'm really not that convinced everybody and their dog on this planet downloading certs from one unique service automatically adds a lot of security in _any_ way |
| 00:03.28 | odb1 | KS? |
| 00:03.31 | odb1 | ah |
| 00:03.34 | odb1 | JS |
| 00:03.51 | fsmithred | kava script - read it and it puts you to sleep |
| 00:05.10 | odb1 | DocScrutinizer05, my spider senses once were firing about LE...i guess the browser whining when its not there but quiet when it is has pavlov'ed me |
| 00:08.56 | DocScrutinizer05 | btw LE clearly states that it's *only* about encryption and absolutely zilch about authentication |
| 00:09.52 | odb1 | i think you actually win, DocScrutinizer05 , maybe im safe from all except for whoever can secretly issue LE certs/parent certs |
| 00:10.00 | odb1 | and their allies... |
| 00:10.49 | odb1 | LE = Law Enforcement cert chain :) |
| 00:13.12 | *** join/#devuan Weeezy (~Weeezy@2604:6000:1503:3ac:3ea8:2aff:fec0:d826) |
| 00:14.53 | Weeezy | I get this dialog box when I first log in, I'm on 2.1 that gives me an option to log back out or rename my session. |
| 00:15.03 | Weeezy | I don't know how to get rid of it, any ideas on this? |
| 00:15.35 | Weeezy | so I just rename the session to my regular login name and hit enter again |
| 00:16.33 | DocScrutinizer05 | your spider senses prolly were correct. LE waters down and erodes HTTPS by establishing an ubiquitous false sense of security, by exactly this Pavlov-ish conditioning |
| 00:19.25 | DocScrutinizer05 | and, unlike other certs, I can't pin down a LE cert reasonably to detect when a domain got hijacked, since even the true domain server has new certs every 8 weeks or so |
| 00:21.24 | systemdlete | I want to add some bareos packages from the bareos.org repo; I do not want to pick up devuan/debian's repos for this one effort. The two repos have DIFFERENT bareos-* packages. I don't know how to specify the pinning for this. Thanks. |
| 00:21.39 | systemdlete | the deb line for bareos is: |
| 00:22.24 | systemdlete | deb https://download.bareos.org/bareos/release/18.2/Debian_9.0 ./ |
| 00:22.24 | odb1 | but dont you need some private key/cert to get new ones every 8 weeks? At least its less likely some random 3rd party hacker is mitm or got your cert... |
| 00:23.26 | odb1 | sometimes I wonder if its not simpler just no longer trying to defend against large govt/large corps mitm/hacking/surveilling you, and just focus on avoiding random hackers/criminals/sec failures |
| 00:23.32 | odb1 | that seems more feasible |
| 00:23.39 | DocScrutinizer05 | no, literally everybody can install LE package on literally every server they got root access to |
| 00:24.28 | odb1 | yes, but exactly, just dont get your LE login/password/privatekey/whatever stolen and the system works...nothing is perfect |
| 00:24.36 | odb1 | but this is better than http:// everywhere |
| 00:24.50 | odb1 | like ebay and amazon were http for the longest time |
| 00:25.40 | DocScrutinizer05 | sorry, but LE does _not_ provide _any_ level of authentication assertion |
| 00:26.27 | odb1 | maybe its useful to avoid deanon using vpn/tor or something... |
| 00:26.28 | DocScrutinizer05 | and the fact that you, like so many others, seem to think it does is exactly what I hate with LE |
| 00:27.00 | *** join/#devuan arnoldoree (~arnoldore@113.210.179.47) |
| 00:27.39 | odb1 | well how would regular certs do better...not ev certs where they ensure you control your business, but regular/cheap certs, where you just validate you control the domain name |
| 00:28.09 | *** join/#devuan Weeezy (~Weeezy@2604:6000:1503:3ac:3ea8:2aff:fec0:d826) |
| 00:30.35 | *** join/#devuan zatumil_ (~Administr@cgn-89-1-210-241.nc.de) |
| 00:30.42 | DocScrutinizer05 | they do better in just one way: they were not that ubiquitous since they still took time and/or some bucks to get |
| 00:30.55 | DocScrutinizer05 | and they lasted a year, not 8 weeks |
| 00:31.56 | DocScrutinizer05 | so once you checked and accepted such a cert, you could pin it on your machine for that URL/domain and stay rather sure you're talking to the right authentic server for a year |
| 00:35.05 | odb1 | DocScrutinizer05, with all due respect...there are browser extensions (at least for the old firefox) that would verify certs on alternate dbs to see if others were seeing the same cert for the same hostname |
| 00:36.17 | odb1 | whether the cert last 1 full yr or 2 sec, whether you pin in or not, why wouldnt the cert end up in wrong hands or be reissued to wrong person if privatekey/id/email of rightful owner got stolen |
| 00:36.44 | odb1 | there is revoc list, but that can be activated during the 8 weeks as well of LE |
| 00:36.52 | *** join/#devuan bsd4me (~bsd@181-107-74-65.gci.net) |
| 00:37.18 | odb1 | maybe LE can be improved...or forked if the governance for that project doesnt want to improve authentication |
| 00:38.29 | *** join/#devuan Acacia (~Acacia@unaffiliated/acacia) |
| 00:38.57 | DocScrutinizer05 | odb1: that's zilch security improvement |
| 00:39.05 | odb1 | i mean it would be simple to ensure that the cert shipped is shipped to someone controlling a domain name, perhaps also to a email encrypted with a person's public gpg key. |
| 00:39.47 | odb1 | what would you add for authentication then? |
| 00:39.50 | odb1 | or for secu |
| 00:41.37 | DocScrutinizer05 | the same that been used for this very purpose since umphty years. See common public documentation about how certs work |
| 00:43.01 | DocScrutinizer05 | when even LE themselves clearly state they do encryption but NOT authentication, there's hardly a way you could establish authentication in this existing scheme by strong wishful thinking |
| 00:44.05 | DocScrutinizer05 | heck, not even a MITM attack gets _really_ defeated by LE |
| 00:48.08 | DocScrutinizer05 | LE is about using SSL encryption, NOT about authentication |
| 00:48.36 | DocScrutinizer05 | it's unfortunate that HTTPS implies both |
| 00:48.44 | MinceR | would a plain self-signed certificate not do that? |
| 00:48.52 | DocScrutinizer05 | yep |
| 00:49.20 | DocScrutinizer05 | and honestly I prefer a self signed cert over an LE cert |
| 00:51.32 | odb1 | how could one mitm and use an le cert looking like its legit from the site? |
| 00:51.34 | DocScrutinizer05 | basically what LE provides are "class self-signed" certs which do not trigger the usual warnings on your browser. But the don't yield any better higher authentication features than a selfsigned |
| 00:51.39 | systemdlete | has figured out a way around on he/him/his/hey you 's own |
| 00:57.15 | systemdlete | Now I see, that in the last few minutes, there are updates to linux-headers-amd64 and linux-image-amd64, which are both meta-packages. Did this just happen? |
| 00:57.32 | systemdlete | Or did I have my repos messed up somehow, and these got overlooked? |
| 01:01.08 | fsmithred | last kernel and headers were in early june (in beowulf) |
| 01:02.19 | fsmithred | same for ascii |
| 01:03.00 | *** join/#devuan arnoldoree (~arnoldore@2001:d08:1816:58b7:3067:a952:14ef:753b) |
| 01:07.12 | *** join/#devuan bean (~bean@193.32.249.169) |
| 01:08.27 | systemdlete | wonder why I didn't get them then. |
| 01:08.39 | systemdlete | I've done update/upgrades since then. Did one just a while ago, in fact. |
| 01:17.55 | *** join/#devuan filipdevuan_ (~filipdevu@gateway/tor-sasl/filipdevuan/x-84149061) |
| 01:25.46 | systemdlete | ok, I just did an update on my host machine (the other was a VM). apt update |
| 01:25.59 | systemdlete | then I list the packages that are upgradeable: apt list upgradeable |
| 01:26.26 | systemdlete | but when I ls /boot, I don't see the *-4.9.0-13-* files, just 9, 11, and 12 |
| 01:26.32 | systemdlete | (it's ascii) |
| 01:27.03 | systemdlete | oh wait! |
| 01:27.23 | systemdlete | "48 packages can be upgraded. Run 'apt list --upgradeable' to see them. |
| 01:27.40 | systemdlete | it's --upgradeable, not upgradeable. Doh! |
| 01:27.44 | systemdlete | smacks himself |
| 01:29.17 | odb1 | systemdlete, i rarely misstype because i always prefer pressing tab to complete to the right spelling... |
| 01:29.45 | odb1 | you can also just sudo apt upgrade and see whats about to upgrade before writing Y |
| 01:29.47 | systemdlete | odb1: In this case, though, it thought I was trying to list the package called "upgradeable" |
| 01:30.06 | systemdlete | nah, I'm going to get new eyeglasses. |
| 01:30.13 | systemdlete | and slow down and READ more. |
| 01:30.27 | systemdlete | I do this in every project. I don't want to become a pariah. |
| 01:31.02 | systemdlete | trouble is, with the lockdown and all, it may be hard to get in to an eye doctor |
| 01:31.10 | odb1 | to the guillotine! lol |
| 01:31.14 | systemdlete | and, besides, I'm afraid of going out these days |
| 01:31.41 | systemdlete | don't joke about guillotines... there is a movement on to bring them back! |
| 01:31.52 | systemdlete | (and I think some of them may be serious, too) |
| 01:31.53 | odb1 | fair enough... |
| 01:37.03 | golinux | Please take to #debianfork. You're off-topic. |
| 01:42.42 | DeeEff | Is there a any part of the devuan community that uses docker? I've run into a couple snafus with docker while trying to develop apps for my Pinephone with Ubuntu Touch, and I'm wondering if there's any kind of resources for that. |
| 01:43.26 | DeeEff | the first issue I ran into was not having an `/etc/machine-id`, which supposedly is created when systemd is installed. A lot of docker configs seem to rely on this, so that was annoying. |
| 01:44.04 | DeeEff | beyond that I've had a heck of a time ensuring nvidia / graphics passthrough work well |
| 01:44.16 | DeeEff | I end up with a lot of libGL errors in the container â¹ï¸ |
| 01:45.53 | odb1 | ty DeeEff for avoiding me all those hassles myself |
| 01:46.31 | odb1 | didnt realize lacking machine-id could create so many issues...perhaps a constant id randomizer is better golinux ? |
| 01:47.11 | DeeEff | ¯\_(ã)_/¯ honestly I didn't even know that machine-id was a thing |
| 01:47.22 | DeeEff | until it started mounting as a directory because lol docker |
| 01:52.15 | golinux | odb: Very long discussions about machine-id on the mail list: https://lists.dyne.org/lurker/search/20191125.181001.1bdff22f@ml:dng,machine-id.en.html |
| 01:52.41 | golinux | odb1: ^^^ |
| 01:53.15 | golinux | Sorry about that. Those posts might be useful to you. |
| 01:55.19 | golinux | One of the features of ascii 2.1 was a dbus patch to generate new dbus machine-id on boot. This behavior is configurable in /etc/default/dbus |
| 02:00.52 | odb1 | if this is the main/only thread on machine-id, I had already read some of it, the point though is DeeEff seems to say that m-id is missing...so i thought maybe it could randomly be reassigned after ever x minutes without requiring a reboot |
| 02:01.06 | odb1 | or maybe you have a specific post in ml addressing why this isnt possible |
| 02:01.27 | *** join/#devuan maggotbrain (~maggotbra@c-73-254-248-250.hsd1.wa.comcast.net) |
| 02:01.28 | odb1 | or no one volunteered to implement..or |
| 02:02.25 | DeeEff | I think having a new machine-id each boot is fine. The problem is this machine-id is in /var/lib/dbus/machine-id, not /etc/machine-id |
| 02:02.40 | DeeEff | but now, rather than faking it with a single constant machine-id, I can symlink the two |
| 02:02.48 | DeeEff | that should probably help wherever machine-id is needed. |
| 02:05.03 | *** join/#devuan systemdlete (~systemdle@c-174-50-188-41.hsd1.ca.comcast.net) |
| 02:10.01 | odb1 | if you've lived through reading that entire ml thread, is there a tldr (or specific reply) on why cycling machine-ids every x minutes without rebooting isnt feasible? |
| 02:10.12 | odb1 | or implemented |
| 02:14.23 | DeeEff | Sounds like it's feasible according to: https://lists.dyne.org/lurker/message/20190312.202658.d725f0af.en.html |
| 02:14.23 | DeeEff | From this it sounds like you could do this yourself |
| 02:15.18 | DeeEff | just punch in `head -c 4 /dev/random | md5sum | cut -d " " -f 1 > /etc/machine-id` into a cron.hourly and it should work? I suspect there's no need to make a daemon or any other service handle this either, but it seems like it would be okay (aside from you know, google chrome maybe thinking that you're on a different device all the time) |
| 02:19.55 | odb1 | DeeEff, that post only seems to show him overwriting machine-id once...and it made chromium stopped working |
| 02:22.30 | DeeEff | hmm that seems different from this message: https://lists.dyne.org/lurker/message/20190312.160305.cffca933.en.html |
| 02:26.43 | *** join/#devuan sunshavi (~user@190.236.255.122) |
| 02:27.52 | odb1 | yes...DeeEff that looks like a one-line in cli-now just to cron that and we have a rapid cycling machine-id |
| 02:29.17 | brocashelm | i see it was libpam-tmpdir that affected my problem from earlier. removed and works again |
| 02:43.53 | *** join/#devuan bean (~bean@193.32.249.169) |
| 02:44.22 | *** join/#devuan beany (~bean@193.32.249.160) |
| 02:51.14 | *** join/#devuan bean (~bean@s17612523582.blix.com) |
| 03:08.35 | *** join/#devuan beany (~bean@s17612523594.blix.com) |
| 03:35.24 | *** join/#devuan odb1 (~odb4@104.221.66.247) |
| 03:36.54 | *** join/#devuan odb1 (~odb4@104.221.66.247) |
| 03:41.51 | *** join/#devuan furrywolf (~furrywolf@172.58.95.84) |
| 03:49.24 | *** join/#devuan pekman (~pekman@unaffiliated/pekman) |
| 04:20.47 | *** join/#devuan DocScrutinizer05 (~saturn@openmoko/engineers/joerg) |
| 05:14.45 | *** join/#devuan sunshavi (~user@190.236.255.122) |
| 05:16.01 | *** join/#devuan Unit193 (ukikie@freenode/staff/ubuntu.member.unit193) |
| 05:51.44 | *** join/#devuan chimay (~chimay@unaffiliated/chimay) |
| 05:51.59 | *** join/#devuan proteus-guy (~proteus-l@cm-58-10-208-180.revip7.asianet.co.th) |
| 05:54.18 | *** join/#devuan proteus-guy (~proteus-l@cm-58-10-208-180.revip7.asianet.co.th) |
| 05:55.46 | *** join/#devuan proteusguy (~proteusgu@cm-58-10-208-180.revip7.asianet.co.th) |
| 06:11.35 | *** join/#devuan Inepu (~Mithrandi@37.160.193.116) |
| 06:38.10 | *** join/#devuan kreyren (~kreyren@fsf/member/kreyren) |
| 07:06.23 | *** join/#devuan silentjet (~jet@staticline-31-182-193-145.toya.net.pl) |
| 07:10.04 | *** join/#devuan chimay (~chimay@unaffiliated/chimay) |
| 07:48.34 | *** join/#devuan Ryushin (~Ryushin@2001:470:4b:38f:777::8751) |
| 08:21.47 | *** join/#devuan cyteen_ (~cyteen@static-84-9-179-245.vodafonexdsl.co.uk) |
| 08:24.37 | *** join/#devuan cyteen_ (~cyteen@static-84-9-179-245.vodafonexdsl.co.uk) |
| 08:26.00 | *** join/#devuan fylgje (~fylgje@129.red-79-153-15.dynamicip.rima-tde.net) |
| 08:44.48 | *** join/#devuan silentjet (~jet@staticline-31-182-193-145.toya.net.pl) |
| 08:51.17 | *** join/#devuan fylgje (~fylgje@129.red-79-153-15.dynamicip.rima-tde.net) |
| 08:53.45 | *** join/#devuan Pali (~pali@Maemo/community/contributor/Pali) |
| 09:00.11 | *** join/#devuan HumanG33k (~HumanG33k@apoitiers-657-1-183-118.w92-134.abo.wanadoo.fr) |
| 09:17.22 | *** join/#devuan rsx (~rsx@ppp-188-174-140-54.dynamic.mnet-online.de) |
| 09:27.02 | *** join/#devuan cyteen_ (~cyteen@static-84-9-179-245.vodafonexdsl.co.uk) |
| 09:43.11 | *** join/#devuan luna_is_here (~quassel@port-92-196-241-124.dynamic.as20676.net) |
| 09:47.11 | *** join/#devuan bnjf (~bnjf@unaffiliated/bnjf) |
| 09:58.27 | *** join/#devuan cyteen_ (~cyteen@static-84-9-179-245.vodafonexdsl.co.uk) |
| 10:21.16 | *** join/#devuan cyteen_ (~cyteen@static-84-9-179-245.vodafonexdsl.co.uk) |
| 10:24.22 | *** join/#devuan markoong (~mark2@88.202.177.243) |
| 10:29.47 | *** join/#devuan markong (~mark2@173.254.222.154) |
| 11:12.10 | *** join/#devuan silentjet (~jet@staticline-31-182-193-145.toya.net.pl) |
| 11:13.16 | *** join/#devuan fylgje (~fylgje@241.red-79-148-22.dynamicip.rima-tde.net) |
| 11:52.16 | *** join/#devuan ac_laptop (~ac_laptop@186.2.247.129) |
| 12:03.19 | *** join/#devuan AndyGB (79b0175b3b@cappuccino.street.me.uk) |
| 12:04.01 | *** join/#devuan cyteen_ (~cyteen@static-84-9-179-245.vodafonexdsl.co.uk) |
| 12:23.59 | *** join/#devuan zatumil (~Administr@cgn-89-1-210-241.nc.de) |
| 12:24.09 | *** join/#devuan georg-gast-2 (~georg@nebka.physik.tu-chemnitz.de) |
| 12:24.46 | *** join/#devuan Centurion-Dan2 (~Thunderbi@devuan/developer/centuriondan) |
| 12:25.37 | *** join/#devuan DarkPlutonium (~DarkUrani@stdrand.com) |
| 12:26.44 | *** join/#devuan MasterdonX (~masterdon@194.150.167.55) |
| 12:27.37 | *** join/#devuan bufzi_ (~root@185.117.72.168) |
| 12:27.52 | *** join/#devuan bjb_ (~bjb@sourcerer.ca) |
| 12:28.03 | *** join/#devuan Jay_ (~jay@unaffiliated/jay) |
| 12:28.40 | *** join/#devuan zama_ (~zama@unaffiliated/stryx/x-3871776) |
| 12:29.55 | *** join/#devuan onefang (~onefang@infinitegrid.org) |
| 12:29.55 | *** join/#devuan onefang (~onefang@devuan/developer/onefang) |
| 12:30.37 | *** join/#devuan Thaolia- (~thaolia@80.90.61.92) |
| 12:33.03 | *** join/#devuan getha (~thijs@198-30-132-5.ftth.glasoperator.nl) |
| 12:34.30 | *** join/#devuan yeti (~username@p2e517be4.dip0.t-ipconnect.de) |
| 12:35.20 | *** join/#devuan buZz (~buzz@joint.ro.lt) |
| 12:36.24 | *** join/#devuan gattuso (~gattuso@pompel.me) |
| 12:39.25 | *** join/#devuan gnarface (~gnarface@108-227-52-42.lightspeed.irvnca.sbcglobal.net) |
| 12:39.44 | *** join/#devuan APic (apic@apic.name) |
| 12:40.05 | *** join/#devuan cyteen_ (~cyteen@static-84-9-179-245.vodafonexdsl.co.uk) |
| 12:40.46 | *** join/#devuan HackphiL (~HackphiL@unaffiliated/hackphil) |
| 12:41.27 | *** join/#devuan chr[] (~chr@rudorff.com) |
| 13:14.34 | *** join/#devuan pekman (~pekman@unaffiliated/pekman) |
| 13:16.43 | *** join/#devuan Guest58317 (~buzz@unaffiliated/buzz) |
| 13:18.36 | *** join/#devuan filipdevuan_ (~filipdevu@gateway/tor-sasl/filipdevuan/x-84149061) |
| 13:24.26 | *** join/#devuan chimay (~chimay@unaffiliated/chimay) |
| 13:33.46 | *** join/#devuan fylgje (~fylgje@241.red-79-148-22.dynamicip.rima-tde.net) |
| 13:43.17 | *** join/#devuan cyteen_ (~cyteen@static-84-9-179-245.vodafonexdsl.co.uk) |
| 13:57.54 | *** join/#devuan scaniatrucker (~user@78-56-98-5.static.zebra.lt) |
| 14:09.08 | *** join/#devuan g4570n (~g4570n@unaffiliated/g4570n) |
| 14:11.29 | *** join/#devuan g4570n (~g4570n@unaffiliated/g4570n) |
| 14:19.19 | *** join/#devuan Akuli (~akuli@mobile-access-b0480e-247.dhcp.inet.fi) |
| 14:28.33 | Weeezy | <PROTECTED> |
| 14:29.10 | gnarface | shell scripts rule |
| 14:31.46 | Weeezy | is there such a tool that can be run that looks for vulnerabilities |
| 14:32.31 | gnarface | nmap |
| 14:34.51 | Weeezy | I've read some bits on it, i understood nmap to be something that is run from another machine to look for open ports, is that right? |
| 14:35.52 | gnarface | nmap will work from the inside too, but obviously you should test it from both sides to be scientific. here's a example firewall in a single shell script: https://paste.debian.net/1157026/ (i promise it doesn't have any vulnerabilities) |
| 14:37.02 | Weeezy | ok, awesome, I'll take a look at it. |
| 14:37.53 | Weeezy | a lot of the web pages I was seeing were directed towards people running servers and having to worry about all types of threats. |
| 14:43.49 | *** join/#devuan chimay (~chimay@unaffiliated/chimay) |
| 14:46.43 | gnarface | well that firewall script i gave you basically refuses all inbound and applies basic acceleration to your own outbound connections, no ports are open, it should be suitable for desktops or laptops with the exception of a handful of games' multiplayer modes |
| 14:47.12 | gnarface | or like, file sharing |
| 14:47.18 | gnarface | it would sabotage peer to peer file sharing too |
| 14:47.35 | gnarface | if you aren't running a server, this task is very simple and doesn't require any fancy tools |
| 14:47.40 | gnarface | that's why you aren't finding any |
| 14:54.47 | *** join/#devuan bpmedley (~bpm@2601:246:8201:8e0:4c5b:22b4:9cfb:f6c1) |
| 14:56.00 | gnarface | not that i use any fundamentally different method for my servers, their scripts just have a few more lines |
| 14:56.07 | gnarface | so maybe i'm the wrong person to ask |
| 14:56.14 | gnarface | i hear pfsense is good, but i think it's still not in debian |
| 14:56.44 | gnarface | alot of the good, better known ones are more commercially oriented, and aren't necessarily in any distro |
| 15:17.40 | Weeezy | this is meant to be run at startup I presume gnarface |
| 15:18.10 | Weeezy | I just got it activated, I'm chasing dogs and listening to cackling women the last half hour |
| 15:19.26 | *** join/#devuan odbw (~odb4@104.221.66.247) |
| 15:21.16 | *** join/#devuan odbw (~odb4@104.221.66.247) |
| 15:22.18 | Weeezy | sorry for my dumb questions, I see it's not a loop so it terminates |
| 15:23.22 | gnarface | Weeezy: yea, run it at startup |
| 15:25.02 | gnarface | Weeezy: after you run that script you can get the status with these commands: iptables -L -v; iptables -L -v -t nat |
| 15:25.17 | gnarface | Weeezy: you should read the iptables man page though, it's a good read |
| 15:26.32 | gnarface | Weeezy: (should basically tell you everything is closed and state tracking is on) |
| 15:31.06 | Weeezy | excellent advice. thank you. |
| 15:33.59 | *** join/#devuan zatumil (~Administr@cgn-89-1-211-31.nc.de) |
| 15:34.01 | *** join/#devuan ar3itrary (~hacker@v22016101923038440.bestsrv.de) |
| 15:34.09 | *** join/#devuan targz (~Thunderbi@unaffiliated/targz) |
| 15:35.38 | *** join/#devuan onefang (~onefang@infinitegrid.org) |
| 15:35.39 | *** join/#devuan onefang (~onefang@devuan/developer/onefang) |
| 15:43.02 | *** join/#devuan AntoFox (~Thunderbi@net-2-39-203-214.cust.vodafonedsl.it) |
| 15:43.26 | *** join/#devuan cyteen_ (~cyteen@static-84-9-179-245.vodafonexdsl.co.uk) |
| 15:50.57 | Weeezy | here is my output from iptables -L -v gnarface |
| 15:51.04 | Weeezy | https://pastebin.com/qAsJgC3W |
| 15:51.20 | Weeezy | I turned off ufw, idk if that should be left running or not |
| 15:54.25 | gnarface | Weeezy: i don't know anything about ufw, but i would assume it would interfere |
| 15:54.46 | gnarface | Weeezy: paste looks right |
| 15:54.57 | Weeezy | ok, that's great. |
| 15:55.38 | Weeezy | I'll have to work on getting this script into my boot up procedure |
| 15:55.38 | gnarface | Weeezy: you can easily see the difference between that and the output of "iptables -L -v; iptables -L -v -t nat" if run before hand |
| 15:56.03 | gnarface | you can just add it to rc.local |
| 15:56.28 | gnarface | if you want to be fancy and get it earlier in the init process you have to create or modify a init script |
| 15:59.48 | fsmithred | what about iptable-save and iptables-restore? |
| 16:00.37 | fsmithred | those should both be plural (tables) |
| 16:02.01 | *** join/#devuan nckx (~nckx@tobias.gr) |
| 16:05.12 | gnarface | i dunno they seemed crappy and unnecessarily complicated to me |
| 16:05.25 | gnarface | they might be worthwhile checking out though now, it's been a long time |
| 16:05.47 | gnarface | their man pages are mentioned in the main iptables man page |
| 16:08.46 | *** join/#devuan nckx (~nckx@tobias.gr) |
| 16:17.23 | Weeezy | afk |
| 16:21.22 | fsmithred | I've only used them a couple of times, but they seemed easy enough to use. Assuming you knew some rules to use. |
| 16:21.31 | *** join/#devuan Weeezy (~Weeezy@2604:6000:1503:3ac:3ea8:2aff:fec0:d826) |
| 16:25.30 | fsmithred | yeah, ok. debian wiki shows about four more steps to make it all work. |
| 16:32.06 | *** join/#devuan silentjet (~jet@staticline-31-182-193-145.toya.net.pl) |
| 16:32.23 | mason | I'm a fan of running firewalls out of an "up" rule in /etc/network/interfaces. |
| 16:32.38 | *** join/#devuan bgustav (~bgustav@188.26.233.92) |
| 16:37.20 | *** join/#devuan odbw (~odb4@104.221.66.247) |
| 16:46.37 | *** join/#devuan Ryushin (~Ryushin@2001:470:4b:38f:777::8751) |
| 16:47.46 | *** join/#devuan chimay (~chimay@unaffiliated/chimay) |
| 16:53.54 | *** join/#devuan Weeezy (~Weeezy@2604:6000:1503:3ac:3ea8:2aff:fec0:d826) |
| 17:03.32 | *** join/#devuan cd (~cd@unaffiliated/cd) |
| 17:39.32 | *** join/#devuan Weeezy (~Weeezy@2604:6000:1503:3ac:3ea8:2aff:fec0:d826) |
| 17:41.03 | *** join/#devuan DonkeyHotei (vdJF@april-fools/2014/runnerup/danielg4) |
| 17:44.17 | *** join/#devuan vostro (~vernon@rrcs-72-43-221-6.nys.biz.rr.com) |
| 17:45.32 | *** join/#devuan xrogaan (~xrogaan@unaffiliated/xrogaan) |
| 17:48.56 | roo^y | ASCII didn't work back in the day on my mele pcg35 apo, so I've been on the derivative Refracta 9. Beowulf booted on USB, & now SSD :) |
| 17:49.53 | fsmithred | why didn't it work? Refracta 9 is ascii. |
| 17:51.48 | roo^y | yes, a derivative. I think it was you who helped me.. did a test on some test refracta successfully, so you hooked me up with a newer one |
| 17:55.19 | fsmithred | oh, with a backports kernel? |
| 17:55.54 | fsmithred | if so, it would make perfect sense that beowulf would work. |
| 17:56.05 | fsmithred | same kernel - 4.19 |
| 17:56.22 | roo^y | i'll guess yes, i just saw it/them earlier when i had a external hdd hooked up |
| 17:57.17 | fsmithred | you could just upgrade to beowulf. Don't need to reinstall. |
| 17:57.44 | *** join/#devuan KnoP (~KnoP@p5090627b.dip0.t-ipconnect.de) |
| 18:00.39 | roo^y | i should have asked! :D my refracta almost takes up the 1st half of SSD, about 220GB, & I just put devuan on the 3rd quarter about 110GB |
| 18:02.33 | roo^y | i didn't have success with sudo apt-get update && apt-get upgrade. Says something about repos changing & accepting changes |
| 18:03.12 | *** join/#devuan kreyren (~kreyren@fsf/member/kreyren) |
| 18:04.58 | fsmithred | say yes to that |
| 18:05.38 | fsmithred | ascii was stable and beowulf was testing. Now ascii is oldstable and beowulf is stable. |
| 18:05.57 | fsmithred | continue using the codenames |
| 18:07.06 | roo^y | for 3 changed repos: 'See apt-secure(8) manpage for details' |
| 18:07.32 | fsmithred | I guess. I didn't bother reading the manpage. |
| 18:08.37 | roo^y | it's just CLI updating, or does it do it GUI too? |
| 18:08.58 | fsmithred | what do you mean? |
| 18:09.45 | fsmithred | if you run 'apt update' and 'apt upgrade' it will upgrade whatever packages have newer versions in the repo. |
| 18:10.06 | roo^y | I see synaptic package manager. Was wondering if i could use it similarly to sudo apt-get update && apt-get upgrade |
| 18:10.09 | fsmithred | if you change sources.list from ascii to beowulf, that will be a lot of packages |
| 18:10.25 | fsmithred | I think you can, but I don't think it works as well. |
| 18:10.45 | fsmithred | and I'm sure there are fewer people around who could help you if you run into problems with that method. |
| 18:10.58 | fsmithred | been there, done that recently with someone. |
| 18:11.04 | fsmithred | on the forum, I think |
| 18:11.19 | fsmithred | best is to follow the upgrade guide on devuan.org |
| 18:11.27 | roo^y | thanks, i'll have a look at sources.list (i just downloaded Beowulf 3.0 & installed) |
| 18:12.09 | fsmithred | https://devuan.org/os/documentation/dev1fanboy/en/upgrade-to-beowulf |
| 18:12.38 | fsmithred | oh, are you talking about doing updates on beowulf? |
| 18:12.48 | *** join/#devuan Weeezy (~Weeezy@2604:6000:1503:3ac:3ea8:2aff:fec0:d826) |
| 18:12.54 | fsmithred | that should be pretty close to current |
| 18:12.56 | roo^y | yes |
| 18:13.15 | fsmithred | that will probably work ok with synaptic |
| 18:13.32 | roo^y | i see :) |
| 18:13.34 | fsmithred | I wouldn't use it to go from ascii to beowulf. |
| 18:13.40 | fsmithred | that's more complicated |
| 18:13.57 | fsmithred | you'll probably have around 100 packages to upgrade |
| 18:17.52 | roo^y | i changed root PW before using refracta installer. At end of install, it asked to change root PW. I put in same one as before install. Then I made the mistake of assuming it wouldn't take the same root PW as i'd already changed to, as I wrongfully thought the same window popped up again *(Turns out it was a different window, asking for a User PW, so it's PW is the same as root!) |
| 18:18.54 | hemimaniac_ | quick question, is there any real downside to switching to chimaera for a sources.list? |
| 18:20.20 | fsmithred | hemimaniac_, other than the fact that it's not ready and not stable (i.e. bullseye isn't in freeze yet) then no |
| 18:20.39 | hemimaniac_ | OHH, SHINY |
| 18:20.46 | hemimaniac_ | thanks fsmithred |
| 18:20.50 | fsmithred | it runs, but I'm sure some stuff is broken and some stuff has yet to break |
| 18:21.38 | fsmithred | if you're using to running debian sid or testing, you could get away with chimaera or ceres or a combination with proper pinning |
| 18:21.49 | fsmithred | but please don't depend on it for anything critical |
| 18:22.11 | hemimaniac_ | well on an already installed beowulf would it to be safe to say that damage may be limited to just a few packages or dependencies? |
| 18:23.19 | fsmithred | I don't know. |
| 18:24.01 | fsmithred | I upgraded Refracta 10 (beowulf) to chimaera and it seems to work ok, but I haven't really tested much. |
| 18:24.13 | fsmithred | and I haven't heard of how upgrade goes with other desktops |
| 18:24.29 | fsmithred | window manager is probably safer than full desktop |
| 18:24.52 | fsmithred | and whatever it is now might be better or worse next week |
| 18:25.12 | hemimaniac_ | well I guess we about to, besides, it it breaks real bad I got net-reinstalls down to 20 min flat ;) |
| 18:25.28 | hemimaniac_ | about to find out* |
| 18:26.22 | fsmithred | https://devuan.org/os/documentation/dev1fanboy/en/upgrade-to-beowulf |
| 18:26.27 | fsmithred | hemimaniac_, ^^^ |
| 18:26.29 | fsmithred | oh |
| 18:27.50 | fsmithred | I had to remove build-essential and libc6-dev |
| 18:28.26 | fsmithred | and someone else had to also remove libgcc1 |
| 18:29.12 | fsmithred | and then I had to do: apt install libgcc-8-dev=8.4.0-4 |
| 18:34.14 | hemimaniac_ | well looks like it wants to pull in libgcc-9-dev on its own, and the only thing I can see directly DE related going away is cinnamon-screensaver-webkt |
| 18:35.35 | hemimaniac_ | well here it goes |
| 18:36.48 | fsmithred | good luck |
| 18:40.20 | hemimaniac_ | 1571 packages to be upgraded |
| 18:40.44 | fsmithred | all of them |
| 18:41.29 | hemimaniac_ | well some of the stuff from the debian multimedia stuff will be untouched but..... looks like fun |
| 18:41.47 | golinux | debian multimedia? YIKES! |
| 18:42.08 | golinux | That's the sure way to a frankendevuan |
| 18:42.15 | hemimaniac_ | i know, need it for a couple multimedia things |
| 18:45.30 | roo^y | so my refracta 9 ascii will upgrade to refracta 10 beowulf. Whereas I changed distro flavors, & fresh installed Devuan beowulf 3.0, not being able to previously install Devuan ascii 2.1, with it's kernel incompatible with my HW |
| 18:47.36 | fsmithred | the main difference between the upgraded refracta and the fresh install of beowulf would be the package selections |
| 18:47.49 | roo^y | i see |
| 18:47.52 | fsmithred | and the relative lack of metapackages in refracta |
| 18:48.13 | fsmithred | refracta uses only devuan repos. |
| 18:48.20 | fsmithred | so it's just a re-spin |
| 18:48.31 | roo^y | ok |
| 18:50.12 | roo^y | I might cut refracta's large partition in half, & give it a birthday, upgrading to Beowulf :) |
| 19:08.42 | fsmithred | depending on how much space you have, maybe upgrade before resize |
| 19:16.01 | roo^y | alright |
| 19:28.37 | *** join/#devuan Weeezy (~Weeezy@2604:6000:1503:3ac:3ea8:2aff:fec0:d826) |
| 19:34.27 | hemimaniac | well it seemed to go ok fsmithred >> Kernel: 5.7.0-1-amd64 x86_64 bits: 64 compiler: gcc v: 9.3.0 Desktop: Cinnamon 3.8.8 tk: GTK 3.24.5 wm: Muffin 3.8.2 dm: LightDM 1.26.0 Distro: Devuan GNU/Linux 4 (chimaera/ceres) |
| 19:34.52 | fsmithred | cool |
| 19:35.13 | fsmithred | I'm curious - do you have consolekit or elogind? |
| 19:35.31 | hemimaniac | messed up a couple of custom lists and configs i had, but after a quick mv/cp seems happy and sane |
| 19:35.46 | hemimaniac | 1 sec |
| 19:37.13 | hemimaniac | elogind |
| 19:37.32 | hemimaniac | why? did i break it? |
| 19:40.37 | hemimaniac | looks like I can actually install console-kit and it will upgrade elogind |
| 19:41.47 | xrogaan | they are somewhat exclusive |
| 19:42.15 | hemimaniac | well second round of updates is now on the way |
| 19:42.46 | xrogaan | Serves the same purpose. Except that libelogind might be required by any odd software as a stand in for libsystemd |
| 19:43.08 | xrogaan | because debian loves to insert that in everything |
| 19:43.27 | xrogaan | even emacs, if you can believe that, |
| 19:46.27 | fsmithred | if everything is working with elogind, I would keep it |
| 19:46.58 | *** join/#devuan bpmedley (~bpm@2601:246:8201:8e0:4c5b:22b4:9cfb:f6c1) |
| 19:47.07 | fsmithred | everything = things like reboot/shutdown buttons, mounting removable media, running synaptic or gparted as root |
| 19:48.04 | fsmithred | xrogaan, you even get libsystemd0 in a debootstrap install |
| 19:53.50 | *** join/#devuan filipdevuan_ (~monsieur@cpc145856-warw18-2-0-cust934.3-2.cable.virginm.net) |
| 19:55.23 | *** join/#devuan ham5urg (~ham5urg@2a04:4540:680a:2700:6c5c:a163:e252:cea2) |
| 19:59.57 | *** part/#devuan nergal[m] (nergalmatr@gateway/shell/matrix.org/x-jslpwojvldfvjzbr) |
| 20:04.23 | hemimaniac | weather got bad, internet gonna go away, check back later |
| 20:16.19 | *** join/#devuan early (~early@static.38.6.217.95.clients.your-server.de) |
| 20:16.23 | *** join/#devuan DarkUranium (~DarkUrani@stdrand.com) |
| 20:33.58 | *** join/#devuan Acacia (~Acacia@unaffiliated/acacia) |
| 20:34.11 | *** join/#devuan bsd4me (~bsd@181-107-74-65.gci.net) |
| 20:43.03 | *** join/#devuan shibboleth (~shibbolet@gateway/tor-sasl/shibboleth) |
| 20:50.15 | *** join/#devuan Human_G33k (~HumanG33k@apoitiers-657-1-183-118.w92-134.abo.wanadoo.fr) |
| 21:32.35 | *** join/#devuan ham5urg (~ham5urg@149.233.218.59) |
| 21:35.30 | odbw | any link for dbus alternatives, and what works and doesnt with them? ive heard of kdbus and gdbus...i think some are just dbus wrappers |
| 21:36.29 | odbw | alternativeto.net lists 0MQ and ubus... |
| 21:39.23 | odbw | <PROTECTED> |
| 21:43.08 | *** join/#devuan Oksana (~Wikiwide@Maemo/community/ex-council/Wikiwide) |
| 21:43.19 | *** join/#devuan AntoFox (~Thunderbi@net-2-39-203-214.cust.vodafonedsl.it) |
| 21:43.23 | odbw | im slightly obsessing over dbus because its even more ubiquitous than systemd...its in ubports, most nosystemd distros and even bsd's when they run wm's/de's usually |
| 21:43.50 | odbw | i tend to dislike quasi-monopolies/single points of failure |
| 21:45.33 | odbw | i didnt find a #nodbus channel where this talk might be more ontopic |
| 21:51.46 | odbw | i just came across zbus in rust for embedded, though im focused on desktop/server first |
| 21:54.07 | odbw | there seems to be binder on android too |
| 21:55.04 | odbw | i know the friendsofdebian wiki page was mentioned yesterday, but theres no talk for what is running instead of dbus (or what COULD run) |
| 22:06.43 | *** join/#devuan markoong (~mark2@68.71.244.70) |
| 22:28.52 | systemdlete | laptop running ascii keeps connecting/disconnecting wireless -- log shows "Interface doesn't support scanning" yet iwlist shows plenty of neighbors nearby! |
| 22:29.07 | systemdlete | this was working until a day or so ago, and I have not updated/upgraded anything since. |
| 22:29.47 | systemdlete | the kernel is 4.19.0-0.bpo.5-amd64 |
| 22:33.52 | systemdlete | on july 15, I deleted popcon, but I've used the laptop since then. |
| 22:34.04 | systemdlete | and popcon certainly shouldn't be the issue... |
| 22:35.54 | *** join/#devuan shibboleth (~shibbolet@gateway/tor-sasl/shibboleth) |
| 22:36.33 | systemdlete | btw, my phone is connected over the same wireless net, so it is not likely a net problem. |
| 22:49.18 | *** join/#devuan markong (~mark2@68.71.244.46) |
| 23:18.01 | *** join/#devuan KnoP (~KnoP@p5090627b.dip0.t-ipconnect.de) |
| 23:37.39 | *** join/#devuan KnoP (~KnoP@p5090627b.dip0.t-ipconnect.de) |
| 23:38.27 | *** join/#devuan vernon (~quassel@rrcs-72-43-221-6.nys.biz.rr.com) |
| 23:39.44 | *** join/#devuan mtnman (~dbk@c-174-51-63-164.hsd1.co.comcast.net) |
| 23:46.06 | *** join/#devuan vernon (~quassel@rrcs-72-43-221-6.nys.biz.rr.com) |