| 00:00.43 | *** join/#utah blunaxela (~blunaxela@li591-129.members.linode.com) |
| 01:21.16 | *** join/#utah infobot (ibot@rikers.org) |
| 01:21.16 | *** topic/#utah is Utah related discussion including user groups | logs @ http://infobot.rikers.org/%23utah/ | See also ##lds |
| 01:21.16 | *** mode/#utah [+o infobot] by ChanServ |
| 03:32.16 | *** join/#utah jnbek (~jnbek@pdpc/supporter/active/jnbek) |
| 04:26.41 | klys | ~slashdot |
| 14:01.29 | *** join/#utah jnbek (~jnbek@198.98.48.34) |
| 14:01.29 | *** join/#utah jnbek (~jnbek@pdpc/supporter/active/jnbek) |
| 14:11.44 | *** join/#utah jnbek (~jnbek@pdpc/supporter/active/jnbek) |
| 14:17.59 | *** join/#utah jnbek (~jnbek@pdpc/supporter/active/jnbek) |
| 15:29.12 | TodPunk | Let us talk briefly of authentication via third parties (paging eightyeight, as I think he'll have opinions worth pondering here). |
| 15:30.35 | TodPunk | One can use OAuth2 for web stuff if the mood suits you, of course. Lately JWT has made a name for itself as well for APIs, and you can do it with a browser as a normal user too if you care to. |
| 15:30.55 | TodPunk | Kerberos is a thing for systems, too. |
| 15:31.25 | TodPunk | But could one make a service that allowed all of these different styles with one login, much like a Microsoft Account does about half of? |
| 15:31.55 | TodPunk | What would one expect from such a service if this identity management thing was all it did? Would you hope to invalidate tokens perhaps? |
| 15:32.40 | TodPunk | What about privacy? What keeps your email or phone number out of the hands of one and not the other? In OAuth2 that's pretty straightforward, but Kerberos? |
| 15:33.14 | TodPunk | One login to rule them all seems to be rather difficult with these things. |
| 15:33.17 | TodPunk | Thoughts? |
| 16:02.22 | *** join/#utah tristanrhodes (~tristanrh@2001:1948:212:1030:9c24:349b:3c92:da8f) |
| 16:02.51 | *** join/#utah SunSparc (~jonathan@45.56.57.85) |
| 16:25.41 | *** join/#utah tiwula (~lane@70.89.246.241-Busname-UT.hfc.comcastbusiness.net) |
| 17:09.02 | *** join/#utah SunSparc (~jonathan@45.56.57.85) |
| 17:18.15 | spangborn | TodPunk: I like the idea in theory |
| 17:18.20 | spangborn | I'd like to see where it leads in practice |
| 17:18.34 | TodPunk | That's what I'm thinking about. Can it even be lead into practice. |
| 17:19.18 | spangborn | I mean, we use oauth for services |
| 17:19.24 | spangborn | server to server |
| 17:19.49 | TodPunk | Well, yes, one does. |
| 17:24.17 | *** join/#utah josephscott (~josephsco@2601:681:8001:c340:bda2:61de:923d:546) |
| 17:27.22 | TodPunk | I think my goal would be that I'd want one login for all my info that's just basic stuff (address, email, name, display name, screenname, phone number) and that's purely free-form stuff except the email. Then sites or services that I log into I can authorize for pieces of that info, and I'm identified as me (my name @ nameofservice.tld) |
| 17:28.20 | TodPunk | but that's really just OAuth, though I would be hard pressed to log into my OS with OAuth, so my mind went to Kerberos |
| 17:28.58 | spangborn | Well, there's no reason you couldn't write some sort of plugin that could use OAuth to login to your OS |
| 17:28.59 | TodPunk | OAuth you can avoid putting credentials into a website, but Kerberos you can't, so it's different risk factors entirely |
| 17:29.15 | TodPunk | spangborn: unless you're offline. |
| 17:29.16 | spangborn | Apple will let you use your Apple ID now, I think? |
| 17:29.21 | spangborn | That's true |
| 17:30.09 | *** join/#utah Bloodythorn (~Bloodytho@c-76-27-46-75.hsd1.ut.comcast.net) |
| 17:30.10 | TodPunk | I'm pretty sure OSX uses Kerberos too for AppleID |
| 17:31.16 | TodPunk | Apparently LOTS ot services in OSX do: https://developer.apple.com/library/content/documentation/Security/Conceptual/AuthenticationAndAuthorizationGuide/Authentication/Authentication.html |
| 17:58.17 | *** join/#utah keldwud (ae34be84@gateway/web/freenode/ip.174.52.190.132) |
| 17:59.51 | *** join/#utah medium_cool (~medium_co@67-2-198-235.slkc.qwest.net) |
| 18:10.32 | *** join/#utah joshh (josh@2600:3c00::f03c:91ff:fedf:c9dd) |
| 18:17.14 | *** join/#utah SunSparc (~jonathan@45.56.57.85) |
| 18:29.41 | *** join/#utah tiwula (~lane@67.214.231.36) |
| 18:36.10 | *** join/#utah youtah (~youtah@67.139.187.132) |
| 18:56.37 | *** join/#utah aeryndunham (~aeryndunh@170.250.131.39) |
| 19:13.49 | youtah | https://imgur.com/gallery/NRYdOSn |
| 19:29.19 | keldwud | let's say I want to take an application and put it into a container. and the application is tied to a mac address. well, I can set mac addresses at run time, but I can't set mac addresses at build time. docker containers don't have NET_ADMIN capabilities or privileged whatever so I can't run ip link during build. One workaround I've thought about implementing is maybe installing the app onto a volume after I've run the container with |
| 19:29.40 | keldwud | and then have any new instances of hte container just connect to the volume where the app is installed |
| 19:30.05 | keldwud | are there better ways to do this maybe? |
| 19:34.00 | joshh | you build on same host as run? |
| 19:34.20 | joshh | how is the app tied to a mac? |
| 19:35.56 | keldwud | through a license file |
| 19:37.51 | joshh | can the file be bindmounted? |
| 19:39.48 | keldwud | what is bindmounted? |
| 19:40.25 | *** join/#utah BLZbubba (~mark@knm.org) |
| 19:40.45 | joshh | when your container mounts a file that's outside of it |
| 19:41.11 | joshh | which could be edited or deployed separately from the container, then container restarted |
| 19:46.14 | *** join/#utah testicon (~testicon@cpe-74-135-40-196.columbus.res.rr.com) |
| 20:32.45 | *** join/#utah tiwula (~lane@70.89.246.241-Busname-UT.hfc.comcastbusiness.net) |
| 20:33.11 | youtah | throws subprocess.Popen through a window |
| 20:33.43 | spangborn | raise Exception("No") |
| 20:33.46 | jsmith | youtah: What are you using that for?!? |
| 20:34.15 | spangborn | The backdoor he's putting in his code |
| 20:49.27 | *** join/#utah youtah (~youtah@67.139.187.132) |
| 20:49.57 | keldwud | https://www.youtube.com/watch?v=KvAk9718Jo8 |
| 20:52.10 | spangborn | slaps keldwud |
| 20:52.28 | keldwud | lol sorry. I didn't see your request until after I posted it |
| 20:55.51 | spangborn | lol you're good |
| 20:55.54 | spangborn | I was just being funny ;p |
| 20:56.13 | keldwud | spangborn: it's because you hate straw-men isn't it? what do you have against straw men, huh? :) |
| 20:56.21 | spangborn | lol |
| 21:08.31 | youtah | Huh |
| 21:08.44 | youtah | looks like I will be going away from Western Digital for my NAS drives |
| 21:09.07 | youtah | I'm going to move to https://smile.amazon.com/HGST-DeskStar-High-Performance-Packaging-0S04005/dp/B01N7YOH4P/ref=sr_1_1 |
| 21:09.24 | youtah | They had a 0.11% Failure Rate (7073 drives) |
| 21:09.45 | youtah | Compared to my older 3TB WD with a 4.53% Failure Rate (1074 drives) |
| 21:10.17 | youtah | so 4.4% less failure rate, $20 more, 128mb cache instead of 64, and 1TB more of storage |
| 21:11.50 | youtah | just had a HDD fail on my NAS |
| 21:12.01 | youtah | and my Synology just informed me |
| 21:31.05 | jlp_znc | keldwud: can you bring up an extra interface inside the container (not connected to anything on the outside) and set the mac on that interface? I've done this at the VM level for lmgrd. it was originally installed (by someone else) on dedicated hardware, but they thought ahead and put a second PCI ethernet card in and used the mac of that card for the licenses. when I virtualized it, I just added an |
| 21:31.11 | jlp_znc | extra interface to the VM with that mac that wasn't actually connected to any networks. |
| 21:31.32 | jlp_znc | I don't know enough about docker to know if you can do something like that in a container. |
| 21:33.17 | jlp_znc | oh, I just reread what you said. at build time, put the mac address you want in a file that is inside the container, along with a script that configures the network with that mac (that it gets from the file). that script can then start up the license manager (or whatever other software cares about it). combine that with an auxiliary interface that isn't actually connected to anything and you should be |
| 21:33.23 | jlp_znc | goo. |
| 21:33.26 | jlp_znc | good |
| 21:48.33 | keldwud | lol |
| 21:49.11 | keldwud | yeah, one of the issues is that I can't set up networking stuff in a container because docker containers don't have permissions to stuff like NET_ADMIN capabilities |
| 21:49.19 | keldwud | but I think I got it figured out finally |
| 21:49.39 | keldwud | I can use docker run statements to run my commands and then commit each change to my build |
| 21:49.55 | keldwud | and since I'm using docker run to run the command, docker run has a --mac-address option |
| 21:50.12 | keldwud | nachos for programmerq for helping me out with the solution |
| 22:21.20 | keldwud | does docker ps -a always list the most recently access container first? |
| 23:33.16 | *** join/#utah peter1 (~peter@149-210-222-26.colo.transip.net) |
| 23:50.42 | *** join/#utah youtah_ (~youtah@67.139.187.132) |
| 23:51.54 | *** join/#utah peter1 (~peter@149-210-222-26.colo.transip.net) |