| 01:09.05 | *** join/#utah medium_cool (~medium_co@67-2-182-216.slkc.qwest.net) |
| 01:20.08 | *** join/#utah infobot (ibot@rikers.org) |
| 01:20.08 | *** topic/#utah is Utah related discussion including user groups | logs @ http://infobot.rikers.org/%23utah/ | See also ##lds |
| 01:20.08 | *** mode/#utah [+o infobot] by ChanServ |
| 04:57.13 | *** join/#utah tiwula (~lane@174-23-49-84.slkc.qwest.net) |
| 08:46.49 | *** join/#utah emcnabb (emcnabb@nat/redhat/x-sqbcwefqedzdlmbn) |
| 15:03.07 | *** join/#utah josephscott (~josephsco@c-174-52-11-31.hsd1.ut.comcast.net) |
| 15:04.50 | *** join/#utah aeryndunham (~aeryndunh@170.250.131.39) |
| 15:12.53 | *** join/#utah emcnabb (~emcnabb@85.93.125.228) |
| 16:25.40 | *** join/#utah tiwula (~lane@70.89.246.241-Busname-UT.hfc.comcastbusiness.net) |
| 16:49.23 | *** join/#utah SunSparc (~jonathan@45.56.57.85) |
| 17:42.29 | *** join/#utah josephscott (~josephsco@c-174-52-11-31.hsd1.ut.comcast.net) |
| 17:52.03 | SunSparc | ~welcome Monday |
| 17:52.03 | infobot | Monday, Sup yo? |
| 17:54.52 | aeryndunham | has zero motivation to do anything today |
| 17:58.32 | jima | same |
| 18:01.07 | spangborn | starts distribution list on fire |
| 18:05.54 | frostyfrog | ditto |
| 18:12.01 | frostyfrog | Aaah, much better. food :3 |
| 18:35.47 | romanovic | likes Monday. |
| 18:44.41 | jlp_znc | https://youtu.be/TXfltmzRG-g <- they drop a couple of f-bombs... you might want headphones if watching it at work, but it's really really good. |
| 18:49.21 | jlp_znc | https://biggeekdad.com/2017/12/hiring-a-millennial/#.WmI4R7BsbSw.aolmail <- hiring a millennial |
| 19:36.06 | youtah | Huh |
| 19:36.09 | youtah | well, this isn't good |
| 19:36.23 | youtah | sudo apt-get update and only half of the requests go through |
| 19:36.28 | youtah | and the other half are 404s |
| 19:38.11 | spangborn | Time to upgrade from Ubuntu 12.04, youtah |
| 19:41.05 | youtah | wait, they're to 12 now? |
| 19:42.45 | spangborn | My old VPS provider still only provides 13 |
| 19:42.46 | spangborn | lol |
| 19:43.04 | spangborn | Because they haven't bothered to upgrade the VM system they're using to use newer kernels |
| 19:53.39 | youtah | I'm on 16.10 btw |
| 20:27.24 | frostyfrog | Looks like the latest will come in april as 17.10 |
| 20:28.12 | frostyfrog | Then they contradictorily put it up for download >_> |
| 20:28.16 | aeryndunham | Wouldn't April be 18.04? |
| 20:28.28 | aeryndunham | 17.10 was out in October |
| 20:28.34 | aeryndunham | or maybe I'm not following the conversation properly :p |
| 20:37.51 | spangborn | Ubuntu pulled 17.10 |
| 20:38.03 | frostyfrog | "In April 2018, the next long-term support (LTS) release of Ubuntu will come with GNOME Shell as default. Ubuntu 17.10 is the first release to include the new shell, so itâs a great way to preview the future of Ubuntu." |
| 20:38.10 | frostyfrog | source: https://www.ubuntu.com/desktop/1710 |
| 20:38.31 | frostyfrog | Then they have a download link for 17.10 on https://www.ubuntu.com/download/desktop |
| 20:39.44 | aeryndunham | Yeah, there was an issue with 17.10 but it was re-released on January 11 |
| 20:39.54 | frostyfrog | That wording keeps making me think that 17.10 is going to be released in april |
| 20:39.59 | spangborn | ah, so their website is just poorly worded |
| 20:40.10 | spangborn | I was running 17.10 before they pulled it, heh |
| 20:40.10 | aeryndunham | Yeah the one in April will be 18.04 LTS |
| 20:40.19 | spangborn | But I was also just running it on a server so idgaf |
| 20:40.26 | frostyfrog | xD |
| 20:40.41 | aeryndunham | I had it on a VM at some point I think but on nothing that would matter |
| 20:40.51 | spangborn | I'll update it to the LTS as soon as it's released |
| 20:41.00 | spangborn | It's a home server, so I don't really care that much if I break it |
| 20:41.16 | aeryndunham | I don't remember what my server is running |
| 20:41.22 | aeryndunham | checks |
| 20:41.29 | spangborn | I should probably update my Raspbian installs though |
| 20:41.41 | spangborn | I have two rPis that I haven't logged into in a while |
| 20:41.42 | aeryndunham | ah it's 16.04 |
| 20:41.55 | aeryndunham | but mine is VPS, I don't own a physical server |
| 20:42.20 | spangborn | Which host? |
| 20:42.31 | spangborn | I'm looking at migrating to VULTR https://www.vultr.com/ |
| 20:42.41 | frostyfrog | TBH, I'm really tempted http://bitscope.com/product/blade/?p=about |
| 20:42.51 | aeryndunham | Digital Ocean. I've had it for a long time and it has always been fine for my needs so I've never bothered changing |
| 20:42.56 | spangborn | lol a pi blade |
| 20:42.59 | spangborn | That's hysterical |
| 20:43.01 | frostyfrog | yup xD |
| 20:43.03 | spangborn | DO isn't bad :) |
| 20:43.15 | frostyfrog | is currently sticking with Linode |
| 20:43.22 | aeryndunham | Oh, good. I had someone get oddly upset with me somewhere once for using a "noob" VPS |
| 20:43.28 | aeryndunham | and I was like... it works? |
| 20:43.29 | spangborn | Vultr is stupid cheap |
| 20:43.34 | spangborn | Nothing wrong with DO |
| 20:43.42 | spangborn | They have a good UI, good support, good uptime |
| 20:43.51 | frostyfrog | ^ |
| 20:43.53 | Migs | I can vouch for Vultr. Had a good experience with it. |
| 20:44.00 | spangborn | Migs: Glad to hear it :) |
| 20:44.03 | frostyfrog | They just don't support Arch and Gentoo anymore :p |
| 20:44.23 | spangborn | My current VPS host pulled down my box to patch Meltdown/Spectre without any prior notice and it miffed me |
| 20:44.29 | Migs | I did feel like they might have slightly oversold their VPSs more than DO...seemed slower for the same specs. But I didn't do any thorough tests. |
| 20:44.37 | spangborn | Gentoo in 2018? pffffbbbt |
| 20:44.46 | frostyfrog | also has one node with Vultr, yeah. They're pretty good to. They give you quite a bit of control, IIRC. |
| 20:44.51 | spangborn | checks frostyfrog for a neckbeard |
| 20:45.09 | frostyfrog | lol |
| 20:45.27 | aeryndunham | I even find Arch too much of a pain; I can't even imaging hating myself enough to go through a Gentoo install :p |
| 20:45.52 | frostyfrog | spangborn: I wanted to play with the install, in all honesty. Then I found and fell in love with grSecurity. I've got two gentoo boxes and that's it. |
| 20:46.03 | frostyfrog | Arch? a pain? |
| 20:46.28 | frostyfrog | I find CentOS a pain because when something goes wrong, I'm at a loss as to how I can fix it. |
| 20:46.47 | aeryndunham | Once it's running Arch is fine I guess |
| 20:46.50 | aeryndunham | I just hate the install process |
| 20:47.53 | frostyfrog | aeryndunham: I was like that until I got the hang of it... Then this happened: https://github.com/frostyfrog/dotfiles/blob/master/fresharch |
| 20:49.02 | aeryndunham | Is that... did you write a script to install Arch for you? |
| 20:49.53 | spangborn | It's almost like something like Chef might be better ;p |
| 20:59.50 | frostyfrog | aeryndunham: Yes. I wget that file and run it straight from the install CD after I partition my disk. |
| 21:00.32 | frostyfrog | spangborn: Except it's not installed on the Archlinux install CD and might not fit into the resulting ramdisk that's created. ;) |
| 21:03.33 | aeryndunham | I've been using the same install for like... 10 months now. I occasionally distro hop on my laptop (and with VMs obsessively) but my desktop is unchanged |
| 21:05.31 | frostyfrog | I was given the requirement at work that if my hard drives die on me, I need to be up and running again in less than a day. That's why I wrote that script in the first place. |
| 21:07.09 | frostyfrog | I only make minor tweaks at this point. I'm a huge fan of my setup (because it works for my workflow and is easy for me to tweak) |
| 21:08.02 | aeryndunham | Hmm, I need to go to grocery store |
| 21:12.50 | frostyfrog | \o/ I found a debian box that I can run commands on! :D |
| 21:13.14 | frostyfrog | Now, to build a renzoku package for Jessie.... |
| 21:42.59 | romanovic | anyone else's samsung have fingerprint amnesia every 2 months? |
| 21:43.28 | romanovic | I have to keep retraining it with my fingerprints. I'm pretty sure my fingerprints aren't changing |
| 21:44.02 | romanovic | retraining fixes it and it usually recognises my prints the first time... for a couple of weeks |
| 21:44.12 | romanovic | then it takes a couple of attempts to unlock |
| 21:44.22 | romanovic | then a month later it takes 3 or 4 attempts to unlock |
| 21:44.43 | romanovic | and 2 months later it just doesn't recognise at all until I remove and re-add my fingerprints |
| 21:56.35 | jima | mine just sucks at reading my prints |
| 21:56.56 | spangborn | unlocks iPhone several times with thumbprint |
| 22:00.06 | jima | yeah, iphones' reader seems to be vastly superior to the reader on, say, the S7 |
| 22:00.29 | jima | and you can trust me when i say that because i hate acknowledging anything apple as superior ;-) |
| 22:00.47 | spangborn | I'm still not sold on FaceID |
| 22:00.52 | spangborn | shrugs |
| 22:00.56 | jima | nooooo, me either |
| 22:01.15 | aeryndunham | I like the FaceID |
| 22:01.45 | *** join/#utah keldwud (adf4304e@gateway/web/freenode/ip.173.244.48.78) |
| 22:01.58 | klys | ~slashdot |
| 22:02.23 | frostyfrog | I find the face id to be insecure >_> |
| 22:02.30 | jima | same |
| 22:02.46 | *** join/#utah medium_cool (~medium_co@67-2-182-216.slkc.qwest.net) |
| 22:06.09 | *** join/#utah BattZ (~BattZ@unaffiliated/battz) |
| 22:06.14 | jfindlay | anyone here familiar with windows networking? |
| 22:06.39 | keldwud | you mean like windows DNS servers and DHCP servers and stuff? |
| 22:06.46 | jfindlay | every time I setup a VPN, it drops my RDP session |
| 22:07.01 | jfindlay | s/setup/start/ |
| 22:07.12 | jima | uhm...does the vpn include the route that would be needed to keep the rdp up? |
| 22:07.28 | jima | (seems like the obvious guess) |
| 22:07.39 | jima | jfindlay: ^ |
| 22:07.50 | jfindlay | jima: I guess so, but the UI doesn't make you think about such details |
| 22:08.06 | jima | oh, my sweet summer child |
| 22:08.22 | jima | (i have to think about stuff like that ALL THE TIME) |
| 22:08.54 | jfindlay | you mean this is NOT GOING TO BE EASY?? |
| 22:09.14 | jfindlay | in my defense, the UI lied to me about that |
| 22:09.30 | jfindlay | also, when I did this a month ago, this did not happen |
| 22:09.42 | jima | jfindlay: `route print` while on vpn and off vpn |
| 22:09.47 | jima | compare and contrast |
| 22:10.07 | jima | net-net, you probably need to add a persistent route for a more-specific destination |
| 22:10.27 | jima | so that when the vpn comes up, it doesn't impact the routing for the other end of your rdp |
| 22:10.28 | jfindlay | I would, but the win server is remote, and I'm only in through rdp |
| 22:10.37 | jfindlay | good suggestion |
| 22:10.48 | jima | ok, take the output for that |
| 22:11.12 | jima | take the output from `netstat -ano | findstr 3389` |
| 22:11.32 | jima | (which should identify the remote windows box's interpretation of your ip, in the event of nat) |
| 22:12.07 | jima | do `route add -p <ip>/32 <gw>` (where <gw> = whatever 0.0.0.0/0.0.0.0 is routed to) |
| 22:12.43 | jima | then your rdp should stay up, unless the vpn SOMEHOW has a /32 route for that ip, in which case you have to muck with the route metric |
| 22:18.09 | jima | (hope that helps) |
| 22:20.41 | jfindlay | thanks jima |
| 22:20.49 | jfindlay | still working on it |
| 22:23.25 | jima | i had to do similar with ipv6 not long ago |
| 22:23.42 | jima | i wanted my route for one host to use the internet no matter what |
| 22:30.08 | jfindlay | regarding the earlier discussion on bio credentials: I don't think we've invented anything better than a good xkcd-style pass phrase, like eightyeight's https://ae7.st/g/ for examples |
| 22:31.05 | jfindlay | easy to remember, hard to guess, precise, hard to gain unauthorized access if you've implemented simple precautions |
| 22:31.34 | spangborn | heh my name was in one of the ones generated by eightyeight's tool when I loaded it |
| 22:31.43 | spangborn | "sawyer kiev karp cove est reub" |
| 22:32.05 | jfindlay | also multifactor isn't really much of a solution inasmuch as it introduces new attack vectors |
| 22:32.45 | jima | MFA for password reset or for MULTI FACTOR AUTHENTICATION? :-P |
| 22:32.45 | jfindlay | could introduce new attack vectors, I guess |
| 22:32.55 | spangborn | Could, yes |
| 22:32.57 | spangborn | Doesn't necessarily |
| 22:33.05 | jima | MFA for password reset seems pretty derpy |
| 22:33.21 | jima | MFA for an additional layer of auth seems ok to me |
| 22:33.23 | jfindlay | don't let UX get their hands on MFA |
| 22:33.27 | jima | well...not via sms. |
| 22:33.31 | spangborn | We use MFA for password reset because users are old and stupid |
| 22:33.38 | jima | spangborn: sigh |
| 22:33.40 | spangborn | and pick bad secret question/answers |
| 22:33.46 | jima | double sigh |
| 22:33.54 | spangborn | So we've forced them into 2FA via SMS/Rep |
| 22:34.01 | spangborn | jima: Well it could be worse |
| 22:34.07 | spangborn | 2 years ago we had users with 4-digit numerical pins |
| 22:34.11 | jfindlay | it's a choice between security and theater |
| 22:34.23 | jima | jfindlay: <3 schneier |
| 22:34.28 | spangborn | Old people who want to authenticate on a automated phone call system |
| 22:34.37 | spangborn | with millions of dollars |
| 22:34.42 | spangborn | threatening to go elsewhere |
| 22:35.10 | spangborn | We're in a tough spot because the people with lots of money are the ones that hate anything more difficult than a 4-digit pin |
| 22:35.39 | jima | well, that seems like a problem that can solve itself. |
| 22:35.47 | jfindlay | lol |
| 22:36.10 | jima | millionaires have crap security = people steal their money = they're no longer millionaires |
| 22:36.23 | jima | win-win-win |
| 22:36.23 | jfindlay | jima: how about: "one person's security is another person's theater" |
| 22:36.29 | jima | jfindlay: :-\ |
| 22:38.40 | jfindlay | how many sites resist the temptation to overload MFA with additional recovery vectors? |
| 22:39.33 | jfindlay | as much as I hate goog, I think whatever team is in charge of account security is making some good example on that |
| 22:39.34 | RyanE | problem with your theory, jima is that if someone steals the millionaire's money, it's usually the fault of the institution, and they don't lose the money. |
| 22:39.45 | RyanE | 'fault' |
| 22:39.51 | spangborn | We've been moving to an adaptive authentication approach |
| 22:39.58 | spangborn | with risk calculations |
| 22:40.21 | spangborn | Google-style push is the new thing |
| 22:40.39 | spangborn | I'm curious as to what the attack vectors become there |
| 22:40.40 | jfindlay | more sites now seem to be relying on the session history auth model |
| 22:40.55 | spangborn | jfindlay: Yep, RSA adaptive auth |
| 22:41.08 | spangborn | We've had it turned on in a quiet mode for a while, learning |
| 22:41.19 | spangborn | and if we detect an anomaly, you get challenged |
| 22:41.25 | jfindlay | it's a clever approach |
| 22:41.41 | *** join/#utah aeryndunham (~quassel@170.250.131.39) |
| 22:41.58 | spangborn | We also use it for legally required blocking of certain countries |
| 22:42.10 | eightyeight | jfindlay: "I don't think we've invented anything better than a good xkcd-style pass phrase, like eightyeight's https://ae7.st/g/ for examples" |
| 22:42.11 | eightyeight | thx! |
| 22:43.00 | frostyfrog | particularly likes the emoji passwords |
| 22:43.09 | spangborn | I've been using his node one https://github.com/atoponce/nodepassgen |
| 22:43.31 | jfindlay | eightyeight: it's a great tool |
| 22:43.42 | eightyeight | <3 |
| 22:44.43 | jfindlay | eightyeight: you're always motivating me to have more awesome free time projects |
| 22:45.04 | eightyeight | i just updated nodepassgen last night, then noticed a small bug, that i pushed today |
| 22:46.05 | eightyeight | i have a twitter bot 80% written that i just need to finish |
| 22:46.44 | spangborn | Twitter bot? |
| 22:47.04 | jfindlay | spangborn: a bot written in twitter |
| 22:47.10 | jfindlay | by twitter? |
| 22:47.18 | spangborn | lol |
| 22:47.22 | jfindlay | s/twitter/twitters/ |
| 22:47.23 | eightyeight | yeah. python script to post on some predictable schedule, like every 4 hours, or some such |
| 22:47.38 | spangborn | What's it posting? |
| 22:47.56 | eightyeight | you'll have to wait and see |
| 22:47.58 | eightyeight | ( ͡° ÍÊ Í¡Â°) |
| 22:48.00 | spangborn | you tease |
| 22:48.50 | RyanE | Google is conspiring to make me go home early again... 22 minutes to home, no delays"... |
| 22:51.23 | spangborn | lol |
| 22:51.27 | spangborn | Good Google |
| 22:51.35 | spangborn | pats AI on its head |
| 22:52.17 | RyanE | I think it moves the notification time up 3-4 minutes every day. |
| 22:52.29 | RyanE | "let's see if we can get him to leave at 2:45!!!" |
| 22:52.49 | eightyeight | i only mention it, because it's an unfinished "free time project" and jfindlay mentioned |
| 22:53.21 | spangborn | eightyeight: I'm just curious |
| 22:57.32 | jfindlay | jima: it works |
| 22:57.46 | jfindlay | you just gave me like $500 worth of tech support |
| 22:58.00 | frostyfrog | heh |
| 22:58.14 | keldwud | hey so what's the protocol for reporting a potentially serious breach without getting myself screwed in the process? |
| 22:58.16 | jfindlay | or Seattle has inflated my perspective on the value of ordinary things |
| 22:58.32 | spangborn | keldwud: Security contact? |
| 22:58.34 | frostyfrog | I see that I'm at the bottom of interesting/more obvious when it comes to free time projects :p |
| 22:58.48 | spangborn | security@<?> |
| 22:58.50 | keldwud | I'm unsure if it's a design issue on Microsoft's end between federating AD and Azure AD or if it's the ORG in question who set it up this way |
| 22:58.55 | keldwud | but I suspect it's at the microsoft level |
| 22:59.13 | keldwud | or maybe a combination of both |
| 22:59.14 | spangborn | Does MS have a bug bounty? |
| 22:59.19 | keldwud | I dunno |
| 22:59.20 | spangborn | You could start there, and see what they say |
| 22:59.32 | spangborn | Surely MSFT has some sort of responsible disclosure system |
| 22:59.43 | keldwud | whatever it is I've found, I can view the personal information of every single AD user of an ORG that I'm not an admin at |
| 23:00.10 | keldwud | I'm just a regular Azure user but it enables me to view the AD profiles of ALL AD users |
| 23:00.27 | keldwud | including phone numbers, addresses, names, email addresses, job titles, departments, etc |
| 23:00.50 | keldwud | and this ORG has probably dozens of thousands of users |
| 23:00.58 | keldwud | so I want to tread lightly |
| 23:01.12 | keldwud | in case somebody gets defensive and comes after me to make themselves look good |
| 23:01.16 | spangborn | I'd try a MSFT security contact first |
| 23:01.53 | spangborn | Looks like they have a bounty program |
| 23:01.54 | spangborn | https://technet.microsoft.com/en-us/library/dn425036.aspx |
| 23:08.04 | jfindlay | the MS internal AD is like that |
| 23:08.17 | jfindlay | I used it when I was there to look up hiring managers |
| 23:08.52 | jfindlay | there's even an internal site that gives you a dynamic org chart |
| 23:13.37 | jfindlay | I don't think I ever saw personal data, just 'corporate' data |
| 23:26.43 | frostyfrog | I think it's just the nature of directory systems to list the directory, so long as you have an account at least. |
| 23:26.59 | frostyfrog | I don't think there's any limitations on what you can or cannot see. |
| 23:27.29 | *** join/#utah gtmanfred (~root@archlinux/fellow/gtmanfred) |
| 23:27.40 | frostyfrog | Besides the password field, maybe? |
| 23:28.18 | frostyfrog | I'm very inexperienced when it comes to directory systems, however. So I'm not certain if that's the case or not. |
| 23:55.14 | jfindlay | normal people: every day fight to string together a set of workarounds for bugs preventing them from doing their jobs |
| 23:55.35 | jfindlay | black hat hackers: every day find bugs to string together to do their 'jobs' |