| 00:21.23 | *** join/#maemo infobot (ibot@rikers.org) |
| 00:21.23 | *** topic/#maemo is Welcome to #maemo http://maemo.org/intro/ | N9/harmattan related questions please in #harmattan ! | "firmware" see ~lf (or ~tabletsdev ~combined ~emmc ~flasher) sdk: ~sb | http://wiki.maemo.org/Community_Council | Source: http://wiki.maemo.org/Sources | Chanlog: http://mg.pov.lt/maemo-irclog | #maemo-ssu is where the (few) devels and maintainers of the maemo-future meet |
| 00:21.23 | *** mode/#maemo [+v infobot] by ChanServ |
| 01:49.29 | *** join/#maemo Kilroo (~Kilroo@71.71.97.50) |
| 02:13.27 | jonwil | hmmm, getting newer OpenSSL to work on Maemo QT isn't as easy as I thought. There is a Debian patch for QT4 but that's for 4.8.7, we only have 4.7.4 |
| 02:49.26 | *** join/#maemo vahe (~vahe@unaffiliated/vahe) |
| 03:45.16 | *** join/#maemo LauRoman|Alt (~LauRoman@5-14-11-114.residential.rdsnet.ro) |
| 04:11.21 | jonwil | I think I got a solution now. |
| 04:30.55 | Oksana | Sounds nice. Will it help with getting MicroB to work with some of those stubborn websites? |
| 04:33.42 | jonwil | Nope, this is OpenSSL and QT, not microb-engine |
| 04:33.47 | jonwil | which uses NSS |
| 04:34.07 | jonwil | The work to get Firefox 24 going is a different project |
| 04:34.25 | KotCzarny | i wonder if there is a way to make nss use openssl |
| 04:34.31 | jonwil | Nope |
| 04:35.16 | jonwil | Getting FF24 to work is still the best option. |
| 04:35.26 | jonwil | I need to go back and see about grabbing debug symbols for Firefox 24 on Linux and see if those debug symbols contain any useful info about how FF24 was compiled. |
| 04:35.39 | jonwil | Official Mozilla FF24 that is |
| 04:36.24 | KotCzarny | https://rcritten.fedorapeople.org/nss_compat_ossl.html |
| 04:36.33 | KotCzarny | but thats backwards |
| 04:39.47 | jonwil | Getting FF24 going will give you more than just TLS 1.2 |
| 04:39.51 | KotCzarny | https://roumenpetrov.info/e_nss/ |
| 04:39.52 | KotCzarny | hmm |
| 04:40.58 | jonwil | That's an engine to allow OpenSSL to read NSS certificate databases and such |
| 04:41.02 | jonwil | So that doesn't do anything useful. |
| 04:41.15 | KotCzarny | uhhum |
| 04:42.01 | jonwil | trust me when I say getting FF24 going is the best hope for a browser that supports TLS 1.2 |
| 04:42.25 | jonwil | unless you find some weird hacky webkit fork that can be compiled properly on the ancient versions of the libraries the N900 is stuck at |
| 04:48.52 | Oksana | Firefox 24 does sound nice. |
| 04:57.55 | jonwil | Getting Fahrplan going again is important to me so I can do transport journey planning when I am out and about :) |
| 04:58.06 | jonwil | hence why I am putting the effort into OpenSSL and QT |
| 05:05.19 | Oksana | Nice :-) Would Gtk+ applications be able to use the OpenSSL? Or would it require specific adaptation, like Qt does? |
| 05:06.03 | KotCzarny | i dont think gtk is the same level of toolkitness as qt |
| 05:06.20 | KotCzarny | maybe glib has some connectivity functions |
| 05:21.45 | *** join/#maemo spiiroin (~spiiroin@2001:998:2a:dead:b9c3:8f04:329c:e2c7) |
| 05:46.50 | *** join/#maemo vahe (~vahe@unaffiliated/vahe) |
| 05:49.56 | ceene | jonwil: the QT thing, I did something to it to use openssl1.0 |
| 05:50.03 | ceene | you have that on my repos too |
| 05:51.12 | ceene | https://github.com/agamez/qt-x11-maemo/commits/RemoveSSL3 this branch should have been merged on maemo's n900, but i think nobody finally did it, even though it was approved |
| 05:51.23 | ceene | approved or whatever the process is to have patches applied to maemo repos |
| 05:51.29 | ceene | i don't remember the bureaucracy of that |
| 05:51.35 | parazyd | jonwil: You do realize FF24 has like, a hundred CVEs? |
| 05:51.38 | ceene | and also you have https://github.com/agamez/qt-x11-maemo/commits/UpgradeSSL |
| 05:51.51 | ceene | which does compile against newer openssl |
| 05:52.09 | ceene | and backports support for new protocols: tlsv1_1, tlsv1_2 |
| 05:56.50 | Maxdamantus | Could always just write some tun-based proxy that everything is routed to. |
| 05:58.54 | Maxdamantus | Browser just has some self-signed certificate that matches every host, gets routed through the tun proxy, using its old version of OpenSSL, tun proxy then connects to the actual IP address using its newer version of OpenSSL, doing host verification, etc |
| 06:03.57 | jonwil | GTK doesn't have any networking code at all |
| 06:04.03 | jonwil | Its just a UI toolkit |
| 06:04.19 | jonwil | Any GTK app can use OpenSSL 1.1.0h no problems |
| 06:05.55 | jonwil | The removessl thing is already on the cssu version of QT and already in CSSU |
| 06:06.00 | jonwil | So nothing needs to happen there |
| 06:08.28 | jonwil | The upgradessl stuff is for 1.0.x, the debian patch makes everything work for 1.1.0h (much better to use 1.1.0 with less bugs etc than 1.0.x) |
| 06:08.38 | jonwil | And I see nothing specific that makes it hard to get that going |
| 06:09.38 | jonwil | As for FF24, I bet the 1.9.2 based microb-engine has a lot of security flaws as well |
| 06:10.01 | jonwil | I doubt upgrading to FF24 is going to make things any LESS secure |
| 06:10.39 | parazyd | ¯\_(ã)_/¯ |
| 06:10.45 | KotCzarny | i just hope it will be usable |
| 06:10.58 | KotCzarny | not that many exploits would work on n900 |
| 06:11.01 | KotCzarny | ';) |
| 06:13.24 | ceene | ah, so debian already has patches for qt4+openssl1.1? |
| 06:13.27 | ceene | didn't know that |
| 06:13.30 | jonwil | Yes they do |
| 06:14.10 | ceene | well, so much better then |
| 06:14.29 | jonwil | They have a patch for OpenSSL 1.1 support on QT 4.8.7 which I need to get going on the QT 4.7.4 we have |
| 06:14.43 | jonwil | No-one is going to write something that targets an exploit in an ancient version of Firefox that has been fixed for years now, let alone one running on a linux armel target (as opposed to android) |
| 06:15.07 | jonwil | Not when they can write an exploit for Windoze and get far more machines infected |
| 06:15.27 | KotCzarny | i suspect even static arm binaries might fail because of old kernel |
| 06:16.28 | jonwil | I already have the results of compiling the FF24 tree running on my device (so libxul.so etc) with http://conkeror.org/ as the front end. |
| 06:16.39 | jonwil | So its definitely working. |
| 06:16.55 | jonwil | A long way from where I need it to be but its definitely at least working. |
| 06:17.12 | jonwil | So we know its ok in regards to dependencies, kernel, libc, gtk etc |
| 06:17.14 | ceene | not to be confused with https://konqueror.org/ |
| 06:18.10 | jonwil | I did have to turn off a bunch of stuff though including gstreamer, WebRTC, WebM and a bunch of audio stuff like ogg. |
| 06:18.19 | jonwil | But other than that its definitely usable and working :) |
| 06:18.31 | ceene | i don't think i've ever run any of those things on my pc |
| 06:18.47 | jonwil | You will have if you are running a recent browser and e.g. accessed YouTube |
| 06:18.52 | KotCzarny | jonwil, most people need functionality for utility sites |
| 06:19.03 | KotCzarny | so audio isnt on top of the needed features |
| 06:19.09 | *** join/#maemo xy2_ (~xy2_@94.239.177.175) |
| 06:19.22 | KotCzarny | and might even be good because it will use fewer resources |
| 06:20.05 | Maxdamantus | but not in microb/rtcom-messaging-ui, right? |
| 06:20.51 | KotCzarny | i would like functioning browser, no need for device wide engine |
| 06:22.05 | Maxdamantus | Can already do that with a debian root (oldstable's xulrunner is also version 24 iirc) |
| 06:26.08 | jonwil | My end goal is to hopefully replace microb-engine without breaking anything (except possibly support for the piece of garbage known as Flash) |
| 06:29.13 | jonwil | Although given how slow conkeror was when I tried it, I think I need to see if there are more optimization flags I can turn on (either mozilla config options or compiler/linker flags) |
| 06:29.26 | KotCzarny | thumb? |
| 06:29.27 | KotCzarny | ;) |
| 06:29.50 | jonwil | Anything that doesn't require a new kernel is an option I will consider :) |
| 06:30.20 | KotCzarny | i think all kernels in any cssu support thumb binaries |
| 06:30.33 | jonwil | Except that CSSU doesn't install a new kernel |
| 06:31.09 | jonwil | I have everything from CSSU-testing running on my phone right now and I am still running the stock Nokia kernel |
| 06:31.10 | Maxdamantus | Nothing should install a new kernel except the user. |
| 06:31.16 | KotCzarny | ho hum |
| 06:31.35 | Maxdamantus | but cssu does have custom kernels. |
| 06:32.28 | jonwil | CSSU-thumb does |
| 06:32.32 | jonwil | CSSU-devel does |
| 06:32.43 | jonwil | But cssu-testing and cssu-stable do not |
| 06:33.46 | jonwil | I know for sure cssu-devel has a custom kernel since I accidentally screwed up my phone by installing the modules for it by mistake without installing the kernel itself (thankfully I ended up finding a solution) |
| 06:55.03 | *** join/#maemo spiiroin (~spiiroin@2001:998:2a:dead:5911:f130:3b12:ee11) |
| 07:35.35 | *** join/#maemo geaaru (~geaaru@host170-152-static.43-88-b.business.telecomitalia.it) |
| 07:35.54 | *** join/#maemo ruskie (~ruskie@sourcemage/mage/ruskie) |
| 07:40.48 | sixwheeledbeast^ | CSSU -devel is just a repo of random devel packages, it's not a "standard" repo to pull everything from. |
| 07:43.08 | sixwheeledbeast^ | You can install KP or "kernel-cssu" from thumb repo for thumb support. |
| 07:57.36 | *** join/#maemo Kabouik (~kabouik@158.38.1.70) |
| 08:07.30 | *** join/#maemo xy2_ (~xy2_@90.115.4.65) |
| 08:08.53 | *** join/#maemo jskarvad (jskarvad@redhat/jskarvad) |
| 08:31.38 | jonwil | Yeah I learned from that mistake pretty quickly and now I know to be more careful in what I install from cssu-devel |
| 08:35.47 | *** join/#maemo M4rtinK (~M4rtinK@ip-78-45-137-21.net.upcbroadband.cz) |
| 08:48.09 | *** join/#maemo xorly (~xorly@ip-86-49-24-93.net.upcbroadband.cz) |
| 09:17.10 | *** join/#maemo how900 (~Neo900@chat.dyne.org) |
| 09:17.10 | *** join/#maemo how900 (~Neo900@neo900/coreteam/communications/how) |
| 09:17.55 | *** join/#maemo parazyd (~parazyd@chat.dyne.org) |
| 09:17.55 | *** join/#maemo parazyd (~parazyd@devuan/developer/parazyd) |
| 09:57.11 | *** join/#maemo Venemo (~venemo@fedora/Venemo) |
| 10:20.05 | *** join/#maemo xy2_ (~xy2_@94.239.253.5) |
| 10:21.18 | *** join/#maemo jon_y (~enforcer@2001:e68:4074:ab4b:f64d:30ff:fe63:5a5a) |
| 10:26.55 | *** join/#maemo jon_y (~enforcer@2001:e68:4074:ab4b:f64d:30ff:fe63:5a5a) |
| 10:29.40 | *** join/#maemo jon_y (~enforcer@2001:e68:4074:ab4b:f64d:30ff:fe63:5a5a) |
| 11:11.37 | *** join/#maemo sunshavi (~user@181.64.192.137) |
| 12:23.40 | *** join/#maemo APic (apic@apic.name) |
| 12:53.14 | *** join/#maemo kalin (~kalin@128.140.177.180) |
| 13:04.12 | *** join/#maemo xy2_ (~xy2_@94.239.177.175) |
| 13:46.50 | DocScrutinizer05 | wrap the damn browser into a chroot |
| 13:51.51 | DocScrutinizer05 | for messing with repos: http://maemo.cloud-7.de/maemo5/usr/local/sbin/enable-catalogs |
| 13:52.44 | DocScrutinizer05 | even speedyham is a PITA to enable/disable repos |
| 13:54.51 | DocScrutinizer05 | enable-catalogs all&&apt-get update&&apt-get install foobar-devel;enable-catalogs standard at very least runs unattended, though also several minutes |
| 13:55.00 | DocScrutinizer05 | or |
| 13:56.07 | DocScrutinizer05 | enable-catalogs save tmp&&enable-catalogs all&&apt-get update&&apt-get install foobar-devel;enable-catalogs tmp&&enable-catalogs delete tmp |
| 13:57.17 | DocScrutinizer05 | might make a wrapper out of this, s/foobar-devel/\$1/ |
| 14:00.11 | DocScrutinizer05 | install_X_with(){ enable-catalogs save tmp&&enable-catalogs ${2:-all}&&apt-get update&&apt-get install $1;enable-catalogs tmp&&enable-catalogs delete tmp } |
| 14:01.13 | DocScrutinizer05 | install_X_with foobar-devel allPlusThumb |
| 14:10.52 | *** join/#maemo jonwil (~jonwil@27-33-80-219.tpgi.com.au) |
| 14:19.35 | *** join/#maemo till (~till@vispillo.org) |
| 14:23.47 | *** join/#maemo spiiroin (~spiiroin@82-203-189-197.bb.dnainternet.fi) |
| 14:54.57 | *** join/#maemo trx (ns-team@cable-188-2-25-100.dynamic.sbb.rs) |
| 14:54.57 | *** join/#maemo trx (ns-team@devbin/founder/trx) |
| 15:14.42 | *** join/#maemo xy2_ (~xy2_@94.239.177.175) |
| 15:17.18 | *** join/#maemo xy2_ (~xy2_@94.239.177.175) |
| 15:23.35 | *** join/#maemo ravelo (uid244116@neo900/community/supporter/ravelo) |
| 15:24.21 | *** join/#maemo vahe (~vahe@unaffiliated/vahe) |
| 15:52.16 | *** join/#maemo Pali (~pali@Maemo/community/contributor/Pali) |
| 15:52.44 | *** join/#maemo LauRoman|Alt (~LauRoman@5-14-11-114.residential.rdsnet.ro) |
| 16:58.33 | *** join/#maemo Kabouik- (~kabouik@236.34.200.37.customer.cdi.no) |
| 17:38.00 | *** join/#maemo M4rtinK (M4rtinK@nat/redhat/x-nuprojljligrjhfa) |
| 17:50.34 | *** join/#maemo LauRoman (~LauRoman@5-14-11-114.residential.rdsnet.ro) |
| 17:50.56 | *** join/#maemo xorly (~xorly@wced-197-219-32-147.feld.cvut.cz) |
| 17:51.34 | *** join/#maemo florian (~florian_k@Maemo/community/contributor/florian) |
| 17:54.23 | *** join/#maemo Kabouik (~kabouik@176.67.168.147) |
| 18:20.03 | *** join/#maemo vahe (~vahe@unaffiliated/vahe) |
| 18:33.51 | *** join/#maemo drrty (drrty@gateway/vpn/privateinternetaccess/drrty) |
| 19:19.59 | *** join/#maemo florian (~florian_k@Maemo/community/contributor/florian) |
| 19:33.05 | *** join/#maemo louisdk (~louisdk@static-5-103-138-205.ip.fibianet.dk) |
| 19:53.41 | *** join/#maemo LauRoman|Alt (~LauRoman@5-14-11-114.residential.rdsnet.ro) |
| 20:17.34 | *** join/#maemo kalin (~kalin@128.140.177.180) |
| 20:59.37 | *** join/#maemo xorly (~xorly@wced-145-218-32-147.feld.cvut.cz) |
| 21:11.08 | *** join/#maemo Oxyd76 (~quassel@5.18.99.0) |
| 22:03.40 | *** join/#maemo Kilroo (~Kilroo@71.71.97.50) |
| 22:04.23 | *** join/#maemo spiiroin (~spiiroin@82-203-188-96.bb.dnainternet.fi) |
| 22:04.48 | *** join/#maemo M4rtinK (~M4rtinK@ip-78-45-137-21.net.upcbroadband.cz) |
| 22:05.22 | *** join/#maemo jonwil (~jonwil@27-33-80-219.tpgi.com.au) |
| 22:14.08 | jonwil | Finally getting somewhere with QT |
| 22:15.24 | jonwil | I found 3 changes to the SSL code in upstream QT 4.7.4 that we dont have in our copy so I will apply those and then after that I will start looking at and applying patches going forward until we hit 4.8.7 and then after that I can apply the OpenSSL 1.1 patch from Debian |
| 22:22.33 | DocScrutinizer05 | great! |
| 23:06.09 | jonwil | ok, new plan: Grab a "git log" of the ssl code from our QT tree and one from qt 4.8.7 then compare the 2. Any patches we have in our tree that aren't in 4.8.7 (i.e. backports for SNI and blacklisted certificates and etc) remove those since they will be comming back later. Then once we have something with no local patches to the ssl directory, start applying patches one by one to get to 4.8.7... |
| 23:06.11 | jonwil | ...followed by the OpenSSL 1.1 patch. |
| 23:25.54 | *** join/#maemo Natch (~Natch@h-112-130.A444.priv.bahnhof.se) |
| 23:32.33 | *** join/#maemo Natch (~Natch@h-112-130.A444.priv.bahnhof.se) |