31[00:48:12] <short-bike> oxek: Thank you. What I am looking
for are walk-through documents on completely re-imaging an android
tablet with debian. It's not a new device but I have not
attempted this before so risk factor is zero.
32[00:48:48] *** Quits: genr8_ (~genr8_@replaced-ip) (Remote host closed the connection)
37[00:49:38] <short-bike> Google hits on the subject produce a
bunch of ubuntu / ubuntu touch youtube's
38[00:49:48] <oxek> ubuntu is going to be pretty similar
39[00:50:12] <oxek> in general, if ubuntu can run on something,
then so can debian
40[00:51:09] <short-bike> makes sense. I'll scan the ^^
wiki and thanks again.
41[00:55:46] <sney> specificity is important when researching
if a device is compatible.
42[00:56:39] <short-bike> The wiki trail led to here (which is
perfect) ->
replaced-url
43[00:56:40] <sney> rather than saying, "can I put debian
on this tablet/computer", try "does debian (or mainline
linux) support this nic/gpu/input device" etc
44[00:57:14] <sney> booting is usually a concern too
45[00:58:02] *** debhelper sets mode: +l 1028
46[00:58:36] *** Seto_Kaiba is now known as Hunterkll
49[01:00:43] *** Quits: Newami (~Newami@replaced-ip) (Remote host closed the connection)
50[01:01:08] <silent-failure> Debian is the
"universal" operating system, so it better run on
everything ubuntu can.
51[01:01:20] <short-bike> sney: understood and agree. The
'lildebi' installer looks like a god fit but I need to
read up on the whole process.
52[01:02:05] <sney> at a glance, this lildebi thing looks like
a chroot running on top of android, rather than a baremetal OS. that
reduces a lot of the complexity but also doesn't sound like
what you want.
53[01:04:08] <short-bike> It's not. I would like to
completely re-image to device but a parallel install might be a good
start.
66[01:13:18] <sney> you may also want to get another arm device
(like a rpi or similar) in order to improve familiarity with using
debian on arm, plus you'd able to compile binaries and packages
for the tablet
91[01:45:56] <dannylee> i reinstall my debian 9.13 os...and it
went ok...the first installation was not that Good..this time i
installed KDE and Gnome and LXDE to...now konqueror is working
better,,i'm on Gnome..its the best...i install the firewall
too...the first installation was my fist time with debian...
111[01:53:30] <dannylee> my installation took me all night...it
Burn me out...fedora is easier to config...but Debian is really
Good...
112[01:53:32] <ryouma> t know firewalls could make the machine
slower
113[01:54:13] <dannylee> web browser just run slower...i just
don't why..
114[01:54:21] <ryouma> unless they are the fancy type which idk
if debian has
115[01:54:52] <ryouma> which one are you using?
116[01:55:18] <dannylee> i now i do make allot of miss sta..ke
117[01:55:25] <petn-randall> dannylee: Why would we fight with
your firewall?
118[01:55:43] <mrjpaxton[m]> I don't recall if Debian
Stable comes with iptables or nftables (with a wrapper for the
`iptables` command) by default. But I know it's some form of
netfilter.
120[01:55:59] <dannylee> some of you guys are hackers...ill do
the same..
121[01:56:09] <ryouma> ufw and arno are pretty straightforward.
of course you can also do raw.
122[01:56:11] <mrjpaxton[m]> And I think if you run `iptables
-L` it will show you if you have any rules enabled, or not. I think
the default is not to set up any rules.
123[01:56:43] <ryouma> arno-iptables-firewall *
124[01:56:45] <petn-randall> dannylee: Are you conflating
hackers and script kiddies?
125[01:56:57] <mrjpaxton[m]> dannylee: Well, I've set up my
own custom router before, so I just like to tinker and build with
computers, more than "hack" on them. But I can't
speak for everyone here! Lol.
126[01:57:11] <dannylee> ok i just a bit new with Debian ill
check...thanks..
127[01:59:07] <mrjpaxton[m]> After playing with Ubuntu 20.04, I
can confirm that it really is a good, solid OS, and definitely
easier to use out of the box than Debian. Since it's based on
Debian, you still use a lot of the same packages and utilities on
it. Just something to consider.
128[01:59:31] <ryouma> some folk will say you should do your own
firewall using raw. but the syntax sometimes changes and semantics
too and it can get tricky. this description kind of motivates the
idea of using a front end:
replaced-url
132[02:01:14] <ryouma> especially "First, the "Sanity
checks", then it modprobes all the necessary kernel modules
(again, some of which I'd never heard of). Arno's doing
all the obscure: echo ${some_integer} > /proc/sys/net/blah/blah
that I've never managed to either take the time to understand
or find a decent reference for."
133[02:01:19] <mrjpaxton[m]> I love using a raw nftables config
though. After learning for a month how to use it when setting up my
router, it feels better to use. There's also `ufw` which is a
bit easier. Most likely though, having your router manage the
firewall is enough. You probably don't even need a firewall on
any of your other LAN machines.
134[02:01:45] <dannylee> i got set -o emacs as my default
terminal editor...debian is allot of work...ok ubuntu is ok for
most....but i went for Debian...i;; just buy buster on my next
credit card...
135[02:01:58] *** cluelessperson_ is now known as cluelessperson
147[02:04:51] <mrjpaxton[m]> dannylee: SSH is called
"secure shell" for a reason. No one can log in with a
shell on your system without a password, and most `sshd` programs
have root disabled by default, anyway.
148[02:04:52] <oxek> hence firewalld, with its integration into
NetworkManager
149[02:05:03] <petn-randall> dannylee: Most consumer routers do
NAT to allow multiple devices to access the internet. NAT however
prevents any connection attempts from the internet to local devices,
unless you explicitely set up port forwarding.
150[02:05:07] <oxek> mrjpaxton[m]: I login without a password ;P
151[02:05:23] <petn-randall> dannylee: And even then an
accessible service doesn't equal "being hacked".
152[02:05:34] <mrjpaxton[m]> oxek: I mean, is it a saved
password on your display manager? Because that's different.
153[02:05:35] <dannylee> ok that is rite...
154[02:05:51] <oxek> mrjpaxton[m]: no passwords anywhere
155[02:05:58] <petn-randall> mrjpaxton[m]: I'm guessing
login via ssh key.
156[02:06:00] <mrjpaxton[m]> Well, at least a root password
would be a good idea. sweat
157[02:06:02] <oxek> only keys
158[02:06:03] <dannylee> my password is hello...
159[02:06:15] <mrjpaxton[m]> Oh, keys are good, too.
160[02:06:17] <ryouma> dannylee: i suspect of the most popular
distros debian is one of the more secure if kept up to date. i
don't know this though.
161[02:06:29] <oxek> mrjpaxton[m]: not just good, they should be
used everywhere where possible
164[02:07:23] <mrjpaxton[m]> Keys are good, until they get
stolen. You can always set up "poor man's" 2FA by
either putting a password on the key, or setting up both a key and a
passphrase.
165[02:07:35] <dannylee> ok my new installation i enable
update...this time...my machine will do update auto madic
166[02:07:43] <mrjpaxton[m]> But that's too inconvenient, I
guess. haha.
167[02:07:52] <oxek> keys getting stolen is no worse than
passwords getting stolen. Meanwhile you have full protection against
brute-force attacks.
168[02:08:32] <oxek> imagine a world where nobody bothers with
brute-force attacks because they know it's impossible. Unless
the keys were generated on debian :p
170[02:08:38] <oxek> (a bad joke about that openssl time)
171[02:08:49] <petn-randall> oxek: I remember the old times ;)
172[02:08:58] <mrjpaxton[m]> Well, it's not like SSH
enables weak ciphers with no salt+hash. I bet even a 12 or 16
character password can protect you for many years.
173[02:09:29] <mrjpaxton[m]> But yeah, I really should set up my
SSH keys sometime. It's just laziness at this point.
174[02:09:42] <oxek> mrjpaxton[m]: the difference is that
hackers don't know your password is at least 12 chars, might be
6 chars hence worth a try. Whereas if they know that a key is being
used, then they know it's pointless to bruteforce.
175[02:10:00] <dannylee> i use Gnome 10 years with
fedora...debian is a bit better for hacking...IBM just don;t like
hackers.
177[02:10:23] <oxek> it's like my freenode SASL account -
people try bruteforcing the password from time to time, even though
I don't use it at all.
178[02:10:44] <oxek> so if SASL plain went away, nobody would
bruteforce anymore
179[02:10:54] <mrjpaxton[m]> I mean both can be used for
hacking. It's not like Kali Linux had to be based off of
Debian, for example. The just chose it because Debian is probably
really easy to make into a custom OS.
180[02:11:41] <oxek> I don't even know my freenode
password, don't have it stored anywhere
181[02:11:59] <oxek> hence fully resistant to rubber hose
attacks
188[02:13:36] <oxek> if you're using pidgin still, then
you're just asking for trouble anyway
189[02:14:10] <mrjpaxton[m]> SASL Plain reminds me of STARTTLS,
where you had to send your password over IMAP before actually
sending the E-mail. It's so backwards. Lol.
190[02:15:07] <oxek> I think that was something else. Having to
do POP auth before SMTP (IMAP).
191[02:15:12] <mrjpaxton[m]> And now... introducing Darkmail
with Lavabit. ;)
192[02:15:27] <mrjpaxton[m]> I still can't believe
they're around, too.
205[02:41:20] <mrjpaxton[m]> Peasant65: Did you download the
installer called "standard", or one with a desktop,like
"gnome", "kde" or something like that? I
can't remember exactly, but I'm not sure if the
"standard" one even has a GUI installer. Also, is it the
net install, the hybrid ISO, or something else?
209[02:42:26] <Peasant65> hm, it's bunsenlab linux. But
from what I gathered it's basically debian 10 with some
configuration tweaks and openbox out of the box.
210[02:43:27] <mrjpaxton[m]> Oh, well you probably want to ask
specifically on the Bunsenlab channel then. As far as I know, almost
all of the Debian installers (not sure about "standard")
have a GUI installer.
211[02:43:35] <Peasant65> How would you start the graphic
installer from a debian gnome live installer?
212[02:43:41] <Peasant65> What would be the command?
213[02:45:35] <mrjpaxton[m]> If it was Debian's installer,
there would just be a GRUB menu entry called something like
"Install with Graphical installer", or something like
that. But yeah, sorry. I'm not sure how else to start it.
229[02:56:02] *** Quits: Lupricon (~Lupricon@replaced-ip) (Remote host closed the connection)
230[02:56:24] <oxek> !bunsenlabs
231[02:56:24] <dpkg> BunsenLabs Linux is a community
continuation of <crunchbang> that features the <Openbox>
window manager. It is not supported in #debian.
replaced-url
268[03:47:39] *** Quits: Cypher100 (~Cypher100@replaced-ip) (Remote host closed the connection)
269[03:48:49] <rangergord> Hi. How easy is it to get a
self-compiled from source Debian working (minimal install + a few
chosen packages by me)? I want it to be identical to the official
master. Is it just a matter of running a single build script on a
Debian build VM?
274[03:53:30] <mrjpaxton[m]> rangergord: You might be interested
in Debian's "live-build" project. It allows you to
make custom Debian live images and installers. But in terms of
building everything with, say "deb-src" repos, I have no
idea. Haven't needed to do it yet. There's better OSes for
building from source, namely Gentoo.
277[03:55:44] <rangergord> thanks, I'll look into it
278[03:56:14] <mrjpaxton[m]> Debian is also pretty good about
doing reproducible builds, though not perfect by any means. I'm
guessing you want to build from source because you want custom
program features, or is it for security as well?
459[08:47:08] <jelly> seems to download _something_
460[08:48:17] <jelly> but funny thing is, it doesn't
contain libpepflashplayer.so either
461[08:49:38] <jelly> I do seem to have a -rw------- 1 jelly
users 19509216 Dec 9 20:42
/home/jelly/.config/google-chrome/PepperFlash/32.0.0.465/libpepflashplayer.so
on a machine that hasn't been updated in a while, but I do not
know exactly where it came from
463[08:50:25] <mrjpaxton[m]> If it's possible that Adobe
Connect can be downloaded and used as a SWF file, then hopefully the
standalone Adobe Flash player I linked at Flathub will work.
464[08:50:45] <mrjpaxton[m]> But yeah, that's a tricky one
to solve.
465[08:52:34] <jelly> sabasedigh, if you trust binaries from
random people on irc, I can put it somewhere
466[08:52:45] <sabasedigh> jellyI trust U
467[08:52:47] <jelly> (you really shouldn't)
468[08:52:48] <sabasedigh> plz
469[08:52:53] <sabasedigh> Version 79.0.3945.88 (Official Build)
unknown (64-bit)
470[08:53:00] <sabasedigh> from slimjet didn't work
500[09:02:44] <jelly> hey you people using The Lounge irc
client, you should probably be aware your real IP address is exposed
any time anyone posts a link in channel
501[09:03:21] <jelly> very nice feature... if I want to figure
out where people live
502[09:04:14] <mrjpaxton[m]> Phf. Well... I at least used WHOIS
to find out that you prefer Namecheap. ;)
503[09:05:07] <jelly> 20 thelounges, 1 irssi, 1
synapse/matrix.org, and a curious - [06/Mar/2021:08:57:28 +0100]
"GET /other/pepperflash.tar.gz HTTP/1.1" 200 47135
"-" "Links (2.1pre37; Linux
2.6.9-023stab048.6-enterprise i686; 125x40)"
528[09:16:58] <arwn> I'm trying to install
cataclysm-dda-sdl 0.E in debian buster using backports but running
`sudo apt -t buster-backports install cataclysm-dda-sdl` installs
version 0.C instead. my apt/sources has buster-backports in it. What
am I doing wrong?
554[09:27:45] <jelly> it's a warm standby system in case I
manage to ruin my current workhorse
555[09:30:09] <arwn> ok sorry for the ignorance but if i need a
testing version of a package that isn't in backports, what are
my options other than upgrading to testing.
556[09:30:25] <mrjpaxton[m]> For a minute I thought `apt -t
buster-backports show <package>` would work, but I guess
not....
557[09:30:39] <mrjpaxton[m]> I keep forgetting about `apt
policy` for some silly reason.
558[09:31:08] <mrjpaxton[m]> So thanks craigevil for saving me
(from my own stupidity).
563[09:32:36] <arwn> i assume i can follow
SimpleBackportCreation on the wiki to do that?
564[09:33:04] <craigevil> yes
565[09:33:14] <mrjpaxton[m]> Some options for getting and using
newer programs in Debian: Flatpak, Docker, other containers, VMs,
debootstrap chroot, and the Nix package manager.
566[09:33:41] <mrjpaxton[m]> But it's good to keep your
system stable.
567[09:34:02] <arwn> i've looked at nix and docker. but
it's a lot of extra confusion and skill just to install a game
:p
568[09:34:30] <craigevil> you could check flathub or snap for it
569[09:35:06] <mrjpaxton[m]> It can be, yeah. But you really
don't want to mix Testing with Stable.
576[09:40:35] <mrjpaxton[m]> Those are just some ideas. I think
the chroot, Flatpak, Snap (as mentioned) methods might be the
easiest. Docker is only harder if you are running a graphical
application. And setting up a VM and Nix is more intermediary. :)
577[09:41:22] <mrjpaxton[m]> So you could have a chroot with
Debian Testing. I think some people do that??
582[09:44:01] <mrjpaxton[m]> The reason why I say chroot is
easier is simply because it's less restrictive, and not
sandboxed. The hardest part is setting it up, but it's really
easy to use once it is set up.
584[09:44:56] <arwn> oh that's not a bad idea, just chroot
a debian testing
585[09:45:15] <ratrace> nspawn it
586[09:45:27] <arwn> yeah that
587[09:45:43] <mrjpaxton[m]> I think nspawn is different.
588[09:45:55] <arwn> it's sandboxed from what I remeber
589[09:46:07] <ratrace> yes. it prepares the environment
properly and securely
590[09:46:20] <mrjpaxton[m]> I've never done that method
successfully before. It might be a good project for me to try again,
as well.
591[09:46:26] <ratrace> you can still (bind)mount (read-only)
parts into therwise private /dev and things like that
592[09:46:38] *** Quits: hisacro (~OBSD@replaced-ip) (Remote host closed the connection)
593[09:47:21] <ratrace> and it's all contained in the
single command. otherwis mounting, chrooting, etc... you'll
have issues with tearing down the container with umounting all that
737[12:30:41] <ratrace> dob1: simplest check would be if you
have any lines starting with anything other than . but note there
may be changes that are done that aren't uploads. so it depends
on what kind of change you're looking for, and parse that out
of the list
738[12:31:11] <dob1> ratrace, if at least a file was transfered
745[12:41:20] <ratrace> damned rsyslog documentation is
terrible. trying to find out what the $variables for use in
conditional expressions are, and/or whether it's just
"properties" prefixed with $ . eg, if :programname can be
if $programname == '...' ...
779[13:13:54] <guyru> Hi, I'm trying to replace PulseAudio
with Pipewire and use a Bluetooth headset. I successfully replaced
PulseAudio with PipeWire and now `pactl info` reports `PulseAudio
(on PipeWire 0.3.23)`. However, bluetooth is not working. Whenever,
I try to connect to my headset it fails and the following error is
reported in `journalctl` by bluetoothd:
780[13:13:54] <guyru> "a2dp-sink profile connect failed for
94:...:52: Protocol not available". Any ideas? (running on
Unstable with PipeWire from experimental)
826[14:33:42] *** Quits: XsiSec (~xsisec@replaced-ip) (Remote host closed the connection)
827[14:34:16] <vincent-> Hello. I'm trying to automate the
installation using a preseed. I'm booting from PXE and I manage
to get the Debian installer on the screen. However, I think the
problem I'm having is that the preseed file is not being
downloaded (I'm using preseed/url). If I go to a console
(ctrl-alt-F2) I can see I don't have any network connectivity.
However, if I type "udhcpc" in that console my network
card gets an IP address and I have network
828[14:34:16] <vincent-> connectivity, and I'm even able to
download the preseed file using wget from the URL I provided via
"preseed/url". I don't know what I'm doing
wrong. This is the kernel command line that I'm using:
"auto url=replaced-url
907[16:19:09] <ratrace> bleb: why you ask here after you got the
help and answered for that in #zfslinux full two minutes before?
908[16:19:26] <bleb> loaded question whose premise i don't
agree with
909[16:19:31] <cybercrypto> ratrace: good question...
910[16:19:48] <ratrace> !cross post
911[16:19:48] <dpkg> Posting the same question in several places
at the same time (IRC channels, news groups, mailing lists, forums)
is impolite; your time is NOT more valuable than everyone
else's. Your question might be answered elsewhere, meanwhile we
are wasting our time doing research for a problem you've
already solved. Cross-posting can also make you look like a spammer
and get you k:lined. See also <multiple ask> <hurry>.
917[16:30:57] <vincent-> ratrace, regarding that "cross
post" message, is it OK asking for help in this channel about a
question made in the forums? Not repeating the question here, but
point to the post URL in the forums.
918[16:32:11] <ratrace> sure. the issue is when multiple
channels on irc are asked in, then teh support is split among them
and same people are usually in all of them. 'tis 2021. the few
of us on irc are probably all over it :)
919[16:32:55] <ratrace> in this case, the question was asked
here even after it was answered and the poster engaged in another so
I was really confused why would they repost like that.
920[16:34:36] <vincent-> Thanks. In that case, could anyone have
a look at this forum post I just made? It's regarding an
automated installation booting from PXE and using
"preseed/url" ->
replaced-url
943[17:11:34] <unixbsd_> vincent-: I have a little own custom
app, I press 'e' and It opens a vim editor, I can modify
it. Then, I press 'c' and it refresh teh PDF after running
pdflatex. Sort of lightweight tex editor.
944[17:11:55] <unixbsd_> vincent-: here the source code: git
clone
replaced-url
945[17:12:01] *** Quits: paulgrmn (~paulgrmn@replaced-ip) (Remote host closed the connection)
987[18:01:47] <miguel_clean> I have an old laptop with 3gb ram,
but without a hdd and wonder how to boot it from network only and
use as X-server, launching apps and everything else on a remote
desk.
1011[18:29:37] <jhutchins> Understood. I built my wife a diskless
workstation back when Etch was current. The Debian Educational
project had several packages and documentation for pxeboot which
were very helpful. I never did manage to get a boot menu to work.
1012[18:30:13] <miguel_clean> jhutchins: yeah similar story.
wanted to reuse it for my kid
1013[18:31:20] <miguel_clean> but just realized it will not work
over WIFI anyway.. so will go for smallest/cheapesst SSD available
1014[18:33:14] *** Quits: dreamon (~dreamon@replaced-ip) (Remote host closed the connection)
1044[18:55:36] <jelly> miguel_clean, is it able to boot from usb?
Plugging in a tiny low profile 32GB usb stick might be an option.
Not a large one that sticks out because kids.
1045[18:56:45] *** Quits: Jerrynicki (~niklas@replaced-ip) (Remote host closed the connection)
1049[18:57:09] <locrian9> 'Wine' is giving me an error
when I try to install it. I've tried 'apt-get install
--install-recommends winehq-stable', and it returns 'The
following packages have unmet dependencies : Depends: wine-stable (=
6.0.0~focal-1) but it is not going to be installed'. Trying to
install 'wine' so I can revamp a laptop with Debian (2GB
RAM) w/ Centrino CPU to run 'Roblox' (not supported on
Linux).
1050[18:59:34] <ratrace> focal? winehq? I think you have the
wrong repo there, winehq's for ubuntu and not for debian
1065[19:10:59] <jelly> locrian9, if you don't have other
choice but to try packages built against ubuntu, try picking a repo
for "bionic" not "focal" to use on buster,
that's a more similar vintage
1066[19:11:22] <jelly> the best thing to do would be to use the
correct distro
1067[19:11:32] <ratrace> jelly: winehq has a repo for debian tho
1068[19:11:39] <jelly> does it
1069[19:11:43] <ratrace> yes. see link milkt posted
1070[19:12:10] <ratrace> I've used it myself in the past.
for steam. stopped when proton became a thing.
1071[19:14:10] <jelly> what's proton
1072[19:15:08] <beelzebuzz> steam's version of wine
basically
1073[19:15:28] <jelly> would it help this user run
"Roblox"
1074[19:15:29] <beelzebuzz> lutris is a thing too
1075[19:15:30] <ratrace> wh.... it's Steam's built-in
wine with lotsa custom patches made to run windows games on linux
transparently, one-click, no installation required (xce3pt the game)
1076[19:16:59] <ratrace> < jelly> would it help this user
run "Roblox" :: probably not as Roblox is not a steam
game.... HOWEVER.... Proton can be installed and used separately so
..... "Maybe"?
1077[19:17:40] <beelzebuzz> it might have a playonlinux install
script
1078[19:17:52] <beelzebuzz> lutris might also have support for it
1081[19:18:16] <beelzebuzz> proton has worked for my un-ported
games so far
1082[19:18:57] <ratrace> Proton is surprisingly good. Played Doom
(2016) literally without a single glitch. I was floored with how
well it worked. fasterr than doom on same machien booted from
windows10 disk
1083[19:19:05] <beelzebuzz> yeah
1084[19:19:40] <ratrace> not to say it's not glitchless for
some games. Evin Within is atrocious under Proton but that may
change, there's open bug reports.
1085[19:20:18] <ratrace> Borderlands 3 wouldn't work at all
as Proton is missing some video decoding component vital for story
progression triggers (there's a custom proton mod tho, but that
never worked for me properly)
1115[20:05:24] <ratrace> Borley: dhclient is not doing any
resolving, so what are you asking exactly? Can you configure a
static nameserver that's lower in priority than the nameserver
obtained via dhcp?
1116[20:09:37] <Borley> What I'm doing with dhclient is out
of the ordinary as I've found
1117[20:09:57] <ratrace> and what are you doing with dhclient?
1118[20:09:58] <Borley> I have the first address set to resolve
using Tor
1125[20:11:21] <Borley> I only want the second name server to be
queried just that once, in order to bring up tor
1126[20:11:22] <ratrace> so back to square one: are you asking
how to set up a static nameserver entry that's lower in
priority than the one obtained via DHCP?
1127[20:11:34] <Borley> and then never talk to it again once the
tor nameserver is available
1128[20:11:36] *** Quits: magic_ninja (~sparkie1@replaced-ip) (Remote host closed the connection)
1129[20:11:50] <ratrace> Borley: that's not possible with
default configuration options.
1142[20:14:45] <KOLANICH> Is there anyone here that can answer it
just now?
1143[20:14:50] <KOLANICH> *who
1144[20:14:52] <ratrace> !anyone
1145[20:14:52] <dpkg> Please do not ask if anyone can help you,
knows 'something' or uses 'some_program'.
Instead, ask your real question. (If the real question _was_
"does anyone use 'some_program'?" ask me about
<popcon> instead.) See <ask> <ask to ask>
<polls> <search> <sicco> <smart questions>.
1146[20:15:20] <ratrace> this is not your first rodeo so
c'mon.... you know the drill.
1147[20:17:41] <Borley> Thanks, ratrace, I just used append
domain-name-server for the fallback option.
1148[20:17:48] <Borley> It seems to be respecting the order so
far
1158[20:20:41] <ratrace> a mitm actor can alter http responses
any way they want. as long as the responded packages and metadata
passes signature validation, apt won't complain
1159[20:21:23] <ratrace> but sounds to me the "worst"
that can happen here is.... trolling the user by messing up
repositories or something... they can't mess signed content
without access to the private keys that signed it.
1160[20:21:44] <Borley> There is also apt-transport-https
available to consider
1164[20:23:13] <KOLANICH> ratrace: Just as I expected. Thank you.
So Debian's advice to pin only third-party repos to keys, not
all the repos, not doing it by default, and the mere possibility to
use repos not pinned to keys, can be considered a backdoor.
1165[20:23:34] *** Quits: magic_ninja (~sparkie1@replaced-ip) (Remote host closed the connection)
1166[20:24:25] <ratrace> KOLANICH: "backdoor"? to or
from what?
1173[20:29:33] <Borley> I am using the feature freeze period to
review my configs and make sure everything is working neat and clean
before Bullseye drops
1178[20:30:59] <ratrace> Borley: I'll start upgrading
machines to bullseye when the full freeze comes. but not main
productio ones, those will wait some period after release
1189[20:40:20] <KOLANICH> Borley: debsums are for already
installed packages. I am speaking about tampering with remote repo
metadata. I have just now looked for repo format docs. It seems that
the described attack can be prevemted, if the repo uses Signed-By in
its metadata on server side.
1190[20:40:30] <KOLANICH> *prevented
1191[20:41:20] <KOLANICH> Then in order to have the attack
succesful, 2 repos must share the same key.
1192[20:42:12] <ratrace> "attack" doing what exactly?
without the private keys they can't change the contents of
packages, so what would the attack... attack?
1193[20:43:04] <KOLANICH> ratrace: I mean a replay attack.
Replaying the original metadata, but from wrong place.
1194[20:44:19] <ratrace> that sounds made up. and what would it
do anyway, since the packages cannot be modified?
1195[20:45:41] <unixbsd_> vincent-: I finally managed to get the
latex live-view-pdf editor... it works very well. i use with two
large monitors (over ssh):
replaced-url
1196[20:46:19] <KOLANICH> ratrace: and non-expired, the actual
one, but from wrong place. Apt asked for repo a with packages A B C,
but adversary returns the metadata repo b with packages B C D. I.e.
A has a vulnr, A in the repo got a fix, adversary wants us not to
install the fix and not to notice that. So our computer asks for
repos a and b, but adversary intercepts and returns b and b
1197[20:46:27] <ratrace> jhutchins: the ttys stay connected so I
_think_ that yes, doing something like ssh remoteserver
'tmux' will launch tmux on the controlling tty
1205[20:49:00] <Borley> after adding a fallback nameserver on
resolv.conf, dns queries are getting resolved in ~20ms indicating
that Tor is being skipped somewhere along the way
1247[21:15:35] <Borley> I think for my use case, I should
probably just write a startup script which brings up my Tor
nameserver apparatus and then removes all other nameservers
1252[21:17:19] <Borley> without looking at docs, if dhclient
overwrites resolv.conf say every 5 minutes, appending a temporary
address should last long enough for it to do what I need it to do
1288[22:08:02] <Borley> jhutchins: while that is true, what I am
configuring is for a nameserver entry to be used only once after
boot then defer to a different nameserver
1289[22:10:22] <jhutchins> Borley: What I'm suggesting is
that you're probably going to get resolv.conf once, at boot,
and not every five minutes.
1385[23:26:33] <H-var> touch. I remember touch. Pictures came
with touch. A painter in my mind. Tell me what you see. A tourist in
a dream. A visitor it seems. A half forgotten song. Where do I
belong? Tell me what you see? I need something more.
1391[23:42:00] *** Joins: Chop (~email@replaced-ip)
1392[23:42:02] <Chop> halllo
1393[23:42:08] <Chop> can i have help
1394[23:42:09] <Chop> ?
1395[23:42:30] <Brigo> ask!
1396[23:42:38] <Brigo> !ask
1397[23:42:39] <dpkg> If you have a question, just ask! For
example: "I have a problem with ___; I'm running Debian
version ___. When I try to do ___ I get the following output ___. I
expected it to do ___." Don't ask if you can ask, if
anyone uses it, or pick one person to ask. We're all
volunteers; make it easy for us to help you. If you don't get
an answer try a few hours later or on
replaced-url