38[00:25:01] <hendursaga> Use SELinux to disable write and network access?
39[00:25:04] <f8e4> best do is: open in chromium native (which should have rensoble defualts)
40[00:25:11] <sney> afaik a lot of fancy pdf embeds are adobe-only, and if you try to open one in something like okular it'll give you a dialog saying the document has unsupported features
44[00:26:24] <sney> there's also the option to convert it to a different format, which would easily scrape off any weirdness, (like opening it in gimp) or extract pages with pdftk
45[00:27:11] <ratrace> f8e4: selinux, apparmor, or even firejail or similar containers
46[00:27:11] <f8e4> the convert option come to mind: but some conveneint pipe in.pdf ... out.pdf with rebuild ensured + bookmarkes_maybe
47[00:27:19] <mason> Something I quite like from a semi-recent sarnold talk is using AppArmor to prohibit a process from writing to disk or using the network. Think about what a process can do with these two restrictions.
55[00:35:31] <f8e4> 'evince can play embedded video' urgs
56[00:35:50] <mason> f8e4: watch that video clip
57[00:36:03] <jhutchins> f8e4: Security like that is not something you should take from an anonymous IRC message. You should know how it works and why you are doing what you do.
58[00:36:18] <mason> jhutchins: Did you watch the video?
59[00:36:36] <mason> jhutchins: Do you use an OS that ships AppArmor turned on by default now? :P
60[00:36:56] <jhutchins> mason: Not into apparmor or selinux. My skills lie elsewhere.
61[00:37:18] <mason> jhutchins: Then you should watch the video, because it's a tailor-made solution to the issue f8e4 raised.
62[00:37:23] <jhutchins> mason: No, I don't and I wouldn't.
63[00:37:34] <mason> jhutchins: You don't use Debian?
64[00:37:35] *** Quits: tagomago (~tagomago@replaced-ip) (Remote host closed the connection)
65[00:37:36] <jhutchins> mason: Yes, but I don't have that issue.
68[00:38:15] <mason> Well, there's the water, horse. Drink or not, as you wish!
69[00:38:40] <jhutchins> Not my first rodeo.
70[00:39:13] <mason> It's a new tool for us, it's available now, it's compellingly neat. I can't see not wanting to learn about it, but it's not the end of the world.
71[00:39:20] <jhutchins> Oh, and my horse is a mare from Secretariat's bloodline.
77[00:41:53] <jhutchins> I guess since I'm at the end of a long upgrade chain I don't have it enabled. I'm afraid selinux discourages it's use by breaking so many things by default. I know how to make it work, but I prefer other methods.
78[00:42:10] <f8e4> tell me tell me
79[00:42:23] <jhutchins> I've only seen problems with apparmor - which means I don't know how it works when it works.
80[00:42:32] <ratrace> AA is not really new in Debian, just enabled by default on Buster
81[00:42:46] <mason> SELinux wants things to be prepared and despite working with it a fair amount, it seems way less straightforward than it ought to be. Analyzing it is painful.
82[00:42:55] <ratrace> I wrote AA profiles for many public facing programns. It's very valuable tool
92[00:45:22] <jhutchins> I see a lot of people with single-user computers defending against risks that you would only have with a large population of uncontrolled users (like college students).
93[00:45:29] <ratrace> they're equal foot-shooty. SELinux is just more verbose with the policies
96[00:45:42] <mason> jhutchins: In this case, all you have to do is be unlucky and download the wrong PDF.
97[00:45:44] <ratrace> jhutchins: though this is not the case here
98[00:46:01] <ratrace> AA profiles are very valuable even on single use computers
99[00:46:10] <jhutchins> mason: Yes, and if you're running Adobe on Windows you have a problem.
100[00:46:31] <ratrace> for example, without an AA profile I wrote for firefox, a rogue website could exploit FF and see if I'm a linux admin with some nifty ssh keys in ~/.ssh
137[01:15:40] <mason> f8e4: If you use mksh, don't use this to test, but here's an example of that set from the video applied to /bin/mksh: replaced-url
138[01:15:48] <mason> Note that it's a bit cargo cult as I'm still learning.
202[02:20:21] <rr123> is there a way to bind a program/process to an IP address, e.g. I have two NICs and I want to have chrome use one of them while the rest of processes use another
203[02:20:57] *** Quits: kn0rki (~Kn0rki@replaced-ip) (Disconnected by services)
237[02:54:37] <GnuLinuxCat> Btw Debian has a security advisory, DSA-4808-1, for apt. replaced-url
238[02:54:37] <GnuLinuxCat> It is my impression that the security advisory only applies to malformed deb files, so if you update apt the usual way "sudo apt-get update" and "sudo apt-get upgrade," it would be safe to fix the security issue that way. Is this impression correct?
239[02:54:37] <GnuLinuxCat> I just want to check before I updated apt that way.
240[02:55:07] <GnuLinuxCat> *update
241[02:55:11] <sney> yes
242[02:55:38] <Unit193> ...So I should stop adding 13 3rd party repos!? :o
243[02:56:04] <sponix> Unit193: no ... its perfectly fine for YOU
244[02:56:08] <sponix> ;)
245[02:56:15] <Unit193> Oh good. Whew.
246[02:56:31] <GnuLinuxCat> ok great thanks
247[02:56:54] <sney> also, see how it says "resulting in denial of service"? on your local system that would manifest as apt getting stuck, and you can ctrl+c it
248[02:57:27] <sney> this would be more of a practical concern for e.g. headless vms that upgrade automatically
284[03:25:01] <zuckerbug> I was considering ubuntu for my workstation/servers, but it seems that Debian stable might be a better choice
285[03:27:17] <sney> dpkg: centos->debian
286[03:27:18] <dpkg> Each debian stable release is supported for at least 5 years, see replaced-url
287[03:29:00] <sney> for general purpose linux stuff like hosting a website, it doesn't make a big difference what distro you use. but if you want something with stable, frozen software versions, security support, and doesn't need to be rebooted more than once a year, debian is your friend
288[03:29:20] *** Quits: short-bike (~short-bik@replaced-ip) (Quit: And, on that note....)
289[03:29:36] <sney> centos used to have that market locked up. their loss
290[03:30:14] <zuckerbug> I find that the older I get the more stability I require.
292[03:30:21] <dvs> Well, I can't say I didn't see that coming.
293[03:30:34] <sponix> Interesting world we live in when Red Hat looks like the Bad Guys
294[03:32:38] <sponix> zuckerbug: actually out of the RHEL clones Oracle's "Unbreakable Linux" is likely the best contender, if you can get past the Oracle branding
295[03:32:41] <sney> IBM couldn't make money off CentOS directly, and were unable/unwilling to see the bigger picture, is what I've heard as the root cause of this. but anyway, former centos users will find plenty to like about debian stable
296[03:32:49] <dvs> Well, not the bad guy, just greedy
297[03:32:52] <dvs> er
298[03:33:47] <sponix> I've never been a RHEL/CentOS Fan anyway. last time I did that in a VM the install process was very tedious
300[03:34:28] * dvs should have known it was an IBM decision
301[03:34:35] <sney> rocky linux is a bit fly-by-night and afaict doesn't have a real relationship with their upstream, they wouldn't be able to forward bugs with any particular traction, etc. debian doesn't have an upstream. we'll see how it shakes out over the next year+ anyway
302[03:34:48] <sponix> Think Debian does better in that regard with doing just a pretty bare install, and you build from there. Instead of trying to determine roles and stuff inside the initial install
304[03:36:23] <wrycode> Hi, I have an issue that I have read up on a decent amount but I'm not really sure how to proceed. From a specific user on my Debian 10 server, any systemctl --user commands give me the following error: Failed to read server status: Process org.freedesktop.systemd1 exited with status 1. I had this issue on another user but the following lines in my .bashrc fixed it:
315[03:41:54] <wrycode> I have found several places with this bug documented but the only fix given is the XDG_RUNTIME_DIR thing. It is strange that it works fine on other users but not this user.
319[03:43:51] <wrycode> I just tried it with a new user and it still does not work. I'm wondering if something about the way I'm launching dbus only works for one user or something
366[04:43:01] <sney> packages in buster-backports are intended to work with buster, so broadly, it's probably safe... except you're already seeing anomalous behavior with just the buster packages, so you might want to fix that first
367[04:44:18] <wrycode> hah yeah okay. A small part of me hopes that it's a systemd bug that's been fixed in the next version.
368[04:45:52] <pfred1> using systemd is a bug
369[04:46:15] *** Quits: magic_ninja (~sparkie1@replaced-ip) (Remote host closed the connection)
522[09:12:55] <shtrb> Does anyone have a clue what tool I can use to control /disable MyAnalytics from Kmail or any sane mail client (without using a browser) ?
525[09:20:36] <nkuttler> thunderbird works fine for me
526[09:21:27] <trui> I'd guess it's just a good default behavior. ctrl+d sends end of file, and i think it's often been used in that fashion, no_gravity
642[11:26:41] <unixbsd> is there a bug fix to KDE for getting Wireless? megabug, it asks for getting root passwrd, and no wireless is setup. you can do this endlessly, infinite.
643[11:26:42] *** Guest82824 is now known as S3xyL1nux
644[11:28:40] <mrkramps> Fromhell, which browser you're using for accessing cockpit?
645[11:28:51] <Fromhell> chrome
646[11:29:01] <mrkramps> Fromhell, same issue with firefox?
647[11:29:28] <mrkramps> Fromhell, asking this because there seem to be browser related issues with cockpit
648[11:29:33] <Fromhell> i never use firefox
649[11:30:26] <Fromhell> try to uze it from firefox
650[11:30:43] <shtrb> unixbsd, that sound as if the wallet or dbus services not running
651[11:31:34] <shtrb> unixbsd, are you running a full plasma session , or you are using just a subset of kde apps ? do you use plasma-nm or some other widget ?
652[11:31:41] <Fromhell> shtr crom server it works
669[11:37:08] <shtrb> unixbsd, it is VERY important after kde installation to perform sddm restart after an installation to let the session be properly started
670[11:37:31] <shtrb> unixbsd, that is a search report on who knows what
671[11:37:33] <unixbsd> it is everyhwere.: replaced-url
690[11:40:20] <ratrace> unixbsd: 1) isolate what the actual bug is, which component is actually failing and how, 2) make sure you can reproduce under same conditions, 3) file a bug report
691[11:40:21] <shtrb> unixbsd, wallet should be configured , so does dbus and running
692[11:40:36] <unixbsd> I have tried on suse, devuan and debian, the settings ... thing to try as they indicated on the forums, but it did work still.
694[11:41:02] <shtrb> I think I'm in the ignore list of unixbsd :-(
695[11:41:56] <mrkramps> unixbsd, but your wifi is wokring outside of kde?
696[11:42:19] <unixbsd> hi, well, I know to setup wireless without kde. of course.
697[11:42:32] <unixbsd> interfaces is clean as kde recommends
698[11:42:43] <ratrace> unixbsd: you "know" ... but did you actually try?
699[11:42:53] <unixbsd> the workaround to fix it would be into : kde-standard
700[11:42:59] <ratrace> do you "know" which component _exactly_ is failing here? there are several components working together
701[11:43:33] <unixbsd> but this is definitely not the possible way to fix a kde issue, it is beyond debian. I would say. it would bring more difficulties.
702[11:43:37] <shtrb> ratrace, there is a common trope about some users would try to disable the wallet and remove it from running , and then be surprised that kde request a password instead of using the existing config
703[11:43:54] <mrkramps> wallet is keyring manager in kde?
704[11:44:02] <shtrb> yes
705[11:44:02] <unixbsd> ah... which component...? let me install kde-standard, I will check with ps aux. maybe dbus... I need to boot the partition
708[11:44:06] <ratrace> shtrb: that's why I want them to point point, surgical precision, WHICH component is failing
709[11:44:15] <ratrace> *pin point
710[11:44:19] <ratrace> is wpa_supplicant failing? is network manager failing? is the wallet failing? is some UI component failing?
711[11:44:29] <mrkramps> is firmware installed?
712[11:44:37] <shtrb> mrkramps, if wallet is not configured or not running (because it was manually disabled) stuff will not be working
713[11:44:38] <ratrace> even that
714[11:45:42] <ratrace> unixbsd: "let me install kde-standard" ... then WHAT are you running there? sounds like you have an incomplete, broken system and are complaining something is not working right
715[11:45:50] <mrkramps> shtrb, yeah if you disable the central service to manage authentication ... you know, not good ^^
716[11:48:46] <unixbsd> ratrace: I install on full disk or on partition. anyhow a partition is the very same. installer debian and put / on part2. done.
745[12:19:05] <dob1> I don't thin it's spam, but how this channel it's different from the one on otc.net ?
746[12:19:24] <dob1> oftc.net
747[12:20:02] <mrkramps> it's on a different irc network?
748[12:20:23] <dob1> it's mentioned in topic too
749[12:20:48] <mrkramps> afaik #debian@otfc is debian's official irc channel
750[12:21:08] <dob1> I was thinking this one is the official
751[12:22:13] <dob1> !oftc
752[12:22:13] <dpkg> OFTC is the Open and Free Technology Community, a support/collaboration service. They have an IRC network: irc.oftc.net. You may (or may not) be connected to OFTC's network. replaced-url
753[12:22:27] <dob1> !oftc move
754[12:22:28] <dpkg> irc.debian.org moved to OFTC on June 4th 2006, see replaced-url
755[12:22:37] *** Quits: _aeris_ (~aeris@replaced-ip) (Remote host closed the connection)
756[12:23:13] <dob1> !fact sharing
757[12:23:13] <dpkg> I show the same facts on both <freenode> and <OFTC>. If you update a fact on one network, it will show up on the other network.
804[13:33:32] <short-bike> New to debian - how can I verify that update/upgrade has upgraded this install from 10.6 to 10.7 ? A cat of /etc/os-release and uname -r (or -a) are not revealing this.
881[14:35:07] <oops> yes , the usb is installer iso , i have just installed debian on my pc , but my pc is obsolute , the gnome can't display , so i need to re-install xfsc from usb
884[14:35:38] <dpkg> apt-zip has been removed post-wheezy (replaced-url
885[14:35:42] <abrotman> aww
886[14:35:43] <mrkramps> a) use apt-cdrom to add it to your sources.lst
887[14:36:07] <mrkramps> b) is the firmware for your graphics card installed?
888[14:37:21] <mrkramps> !apt-cdrom
889[14:37:22] <dpkg> somebody said apt-cdrom was used to add a new CDROM to APT's list of available sources: man apt-cdrom. See also <apt-cdrom_external>.
890[14:37:45] <abrotman> oops: was this for stable/buster?
891[14:37:55] <mrkramps> i hope so?!
892[14:38:30] <oops> mrkramps: i have remove the gnome desktop , when the desktop begin , it prompt iwiw3945 firmware missing ,
946[15:04:08] <ov3rmind> anyone use firejail and can help with one single doubt? if setup with cfg is applyed all users runs the same setting or it needs be per user?
947[15:05:53] <mrkramps> ov3rmind, if config is systemwide in /etc it is applied for all users but can be overwritten by user configuration in ~/.config
948[15:06:18] <oops> mrkramps: i still don't know how to do , the bootable usb is like this "/dev/sdb1 3.7G 3.7G 0 100% /run/media/oops/Debian 10.7.0 i386 1
949[15:06:20] <oops> ", but on another pc which will using it as source like this "sdc1 3.7G 0 part",
975[15:15:56] <oops> mrkramps: my english is not good , take it easy
976[15:16:24] <mrkramps> oops, it's all cool
977[15:16:41] <unborn> no irritation on my end - just don't pick debian supporters to solve non debian issues - basically - you have no issue with your debian install - what I mean its off topic.
978[15:16:50] *** ted6480 is now known as S3xyL1nux
1009[15:26:54] <oops> the pc has two os , one is ubuntu 18.0 lts and the other is debian which are all 32 bit
1010[15:27:16] <unborn> ah i see oops so you wifi is dropping out or whats the issue - I am sorry i just joint the channel and I did not seen all your messages about your issue.. I guess you cannot join to wifi - is that right?
1011[15:27:55] <unborn> oops: no luck from ubuntu? nor from debian?
1018[15:31:01] <mrkramps> unborn, oops has installed debian on a second offline pc and wifi firmware is missing for sure, probably also graphics firmware
1019[15:31:03] <unborn> can you please reply - what is the problem? cannot you connect to wifi on one or both oses? I was ubuntu user long time ago but I know os very well.
1020[15:31:17] <short-bike> oops: run this -> 'nmcli connection show configured' and paste results here please -> replaced-url
1028[15:33:49] <mrkramps> unborn, that's the summary of oops problem(s) for now
1029[15:34:19] <unborn> oops: you want xfce? as de? or you want gnome or something else?
1030[15:34:34] <short-bike> mrkramps: so he has no DE right now - is that correct ?
1031[15:34:42] <mrkramps> short-bike, afaik yes
1032[15:34:52] *** urban7015 is now known as S3xyL1nux
1033[15:34:58] <unborn> mrkramps: Im really really sorry for my earlier rampage.. Im just smelly old git what else I can say :D
1034[15:35:20] <oops> the gnome only display a mouse cursor with a black background on debian
1035[15:35:25] <unborn> short-bike: and no drivers... tooo
1036[15:35:32] <short-bike> nice !
1037[15:35:38] <unborn> yeah
1038[15:35:40] <mrkramps> short-bike, also no internet connection on this system, as well as no reliable connection at all (daily payed stuffed only on mobile)
1039[15:36:00] <unborn> oops: you want xfce? as de? or you want gnome or something else?? what would you like to have?
1052[15:39:04] <short-bike> Has anyone suggested to him to simply re-install ? Of course, that assumes he knows what a backup is.
1053[15:39:31] * unborn oh that's why I had those issues with locales... fudas :)
1054[15:40:33] <unborn> short-bike: it was me. I was about to ask, but he did not mention anything except dual boot so I assume it was indeed clean install..
1055[15:40:34] <mrkramps> short-bike, nope not yet
1056[15:40:52] <unborn> it was just an suggestion***
1057[15:41:02] <mrkramps> or at least not in all emphasis
1059[15:41:16] <oops> sorry , i need to left now , it's very late on my here , it's too hard , i communicate with you with my small phone screen, let me think over what you said , thanks of all
1070[15:42:42] <rupicapra> Oh I did install steam, so I did add the I368 arch? Could it ve that?
1071[15:43:03] <rupicapra> No, I don't
1072[15:43:03] <unborn> meeeh
1073[15:43:19] <mrkramps> phew, plasma crashing with steam install - dunno
1074[15:43:31] <unborn> that's why I have ps :D
1075[15:43:34] <freem> hi. I've read that the kernel have a "file" name /proc/sys/kernel/hotplug (which seems to be how udev is informed about new events), but I can't find it in the systems I run. Is that info still true?
1096[15:50:34] <unborn> oh poops it does not detect I am running quatro gf - possibly I put my old hdd into new machine - Im on some kind nvidia and intel crap now.. it calls something like optimus - worst thing you can get on linux..
1183[16:17:11] <freem> AFAIK... it's just that if X crash/exit, then you're back the the shell which summoned startx, but that can even be done willingfully
1184[16:17:12] <ratrace> much, much harder, or for th emost cases impossible, with a DM
1185[16:17:16] <nevivurn> Didn't consider the screen lock use-case
1186[16:17:17] <mrkramps> that's the wqhole point why it is not safe in critical environment
1187[16:17:34] <freem> ratrace: but DM crashes more often XD
1188[16:17:43] <ratrace> freem: doesn't land you onto a shell tho
1207[16:21:41] <freem> turning off is not always an option, for example when you go toilet or brew some cofee. Restarting computer for that is a bit... extreme
1208[16:21:52] <infosec_yo> KDE on DEBIAN is bloated.
1209[16:21:59] <freem> only on debian?
1210[16:22:06] <infosec_yo> mainly on debian
1211[16:22:11] <mrkramps> where is the friggin session log for KDE?
1212[16:22:11] <ratrace> le sigh.... can anyone put a cork in this one, like other chans did?
1213[16:22:51] <infosec_yo> in /var/temp
1214[16:23:04] <nevivurn> freem: yup, which is what the "pray" mitigation is for.
1215[16:23:10] <mrkramps> !admin
1216[16:23:10] <dpkg> [admin] like a omnipresent god, or replaced-url
1219[16:24:20] <infosec_yo> ratrace is spamming me in pm.
1220[16:25:08] <unborn> infosec_yo: i do not believe your claims
1221[16:25:13] <rupicapra> When going with the startx route, I get the same dialog box "plasma cannot start" "all shell packages missing. This is an I.stallation issue please contact your distribution "
1229[16:27:25] <Emil> Hey, I have an issue with wifi and authentication. On logging in my laptop attempts to connect to the wifi automatically, as it should. However it seems that there's some issue and it fails after a couple of minutes and then successfully connects. However if I immediately select disconnect (ie stop attempting to connect) and immediately press connect, it successfully connects immediately. I think it might
1230[16:27:31] <Emil> have something to do with some internal keyring/authentication service not being up fast enough to provide the wifi keys to the daemon, but of course I don't know that Any help? It's just your bog standard Debian with KDE
1231[16:28:02] <ratrace> 16:23 -!- infosec_yo sid476935@gateway/web/irccloud.com/x-ezccxoibyygulirl is messaging you, and you have umode +g.
1242[16:35:08] <mrkramps> rupicapra, I am lost here … you'd still try reinstalling plasma-desktop including all its dependencies, but otherwise I've no idea what's causing this issue
1281[16:58:13] <Ede|Popede> problem is when it gets the timing bad. freeze right before upstream is releasing a new version can lead to unwanted effects years later when this new stable becomes unstable
1282[16:58:57] <Ede|Popede> iirc it happened with PHP last year. old version EOL and new version not available for stable.
1283[16:59:01] *** debhelper sets mode: +l 1172
1284[16:59:24] <infosec_yo> debian is EOL as well.
1315[17:23:55] <epitamizor> will it screw up the files if a usb is connected, then root user mounts it in another folder location, but then the user unplugs the usb after unmounting from /media?
1363[17:43:09] <unixbsd> Hello how to open libreoffice without that it popups whatever, recovery ... from the linux command line?
1364[17:43:16] <hejux> see the big 'L' after root?
1365[17:43:43] <alexrelis[m]> hejux: okay. I tried to login as root in a tty session and it looks like it is locked because it asks for a password. Thank you.
1376[17:48:27] <unixbsd> Is there maybe something faster, than libreoffice? I see that libreoffice does not handle odt or docx well. it crashes with odt saving. docx format is messing up all formating.
1392[17:55:52] <mrkramps> you can argue with me in #debian-offtopic
1393[17:56:07] <jhutchins> unixbsd: I think you have problems with your install. odt is libreaoffice's native format.
1394[17:56:19] <jhutchins> unixbsd: What release are you on?
1395[17:56:54] <hejux> debian i guess
1396[17:57:09] <hejux> debian always has the oldest software
1397[17:57:22] <alexrelis[m]> How do I change my username and home directory username? I tried `sudo usermod -l newname -d newname -m oldname` but it says I can't do it because the user session I'm trying to change is already running.
1464[18:22:33] <Rodon> i dont get "dunstify" command available despite dunst installed and working properly .. is there any other package i need to install ?
1465[18:23:17] <Ede|Popede> ,file bin/dunstify
1466[18:23:22] <judd> No packages in buster/amd64 were found with that file.
1467[18:23:25] <zaratustra> so you have xp with that I assume... from 0 to 10 how hard would it be to do it
1468[18:23:49] <mrkramps> Rodon, dunst 1.5.0-1 in bullseye has this command
1469[18:24:06] <mrkramps> earlier verion in buster not
1470[18:24:20] <jelly> zaratustra: read our guides, then draw your own conclusion
1471[18:24:21] <Rodon> oh.thats why i dont find it in buster
1482[18:26:30] <zaratustra> well sorry if I'm bothering you with this. its a legit concern I have... godspeed
1483[18:26:41] <jelly> zaratustra: if you can't even be bothered to read NMG, then the answer is "too hard for you"
1484[18:26:42] <mason> zaratustra: Yeah, this is a different persona. Slightly different language patterns. Not hard to do if one cares to make the effort. Just commenting on the possibility. It's really somewhat in line with what you were asking about.
1485[18:27:06] <n4dir> no one knows you are a dog on the internet
1486[18:27:09] <dob1> dd if=/dev/urandon of=somefile bs=1M count=10 -> it gives me a 9MB file
1489[18:27:43] <jelly> dob1: given that typo of urandom I'm surprised you get anything :-)
1490[18:27:51] <mason> jelly: FWIW, if you look at the logs, the infosec_yo account was abusive earlier, and trolls various channels. Seems banworthy to me, but =shrug=
1492[18:28:36] <dob1> jelly, I wrote it wrong here, it's a typo because I didn't copy the command
1493[18:29:01] *** debhelper sets mode: +l 1179
1494[18:29:18] *** Quits: blackstar (~olivier@replaced-ip) (Remote host closed the connection)
1495[18:29:31] <ratrace> jelly: that nick, btw, is already banned in multiple channels, and annoys people via PM.
1496[18:29:46] <ratrace> pre-emptive measures are highly adviseable.
1497[18:29:48] <mason> ratrace: Yar, it was the interaction with you that jumped out at me.
1498[18:30:56] <dob1> it's the same if I do bs=10M count=1
1499[18:31:28] <ratrace> mason: and not me tho, he's been pestering people in other chans. I have +g, he can't PM me
1500[18:31:31] <ratrace> tried, tho
1501[18:31:47] <jelly> dob1: that can happen if the destination filesystem is filled up, ie. there's not enough space for a 10MiB file. Show the complete output.
1502[18:32:25] <mason> I don't end up getting enough spam for +g. The PMs I get tend to be things I want to read.
1512[18:36:41] <alexrelis[m]> It looks like after changing the name of my home folder, I don't have permission to remove or edit any of my files, even though it says my user and user group owns the files.
1513[18:36:44] <jelly> dob1: I see possible options: a) the host system might be oversubscribed and out of space or b) bug in filesystem
1514[18:37:20] <jelly> alexrelis[m]: your user has to also own the folder itself
1515[18:37:57] <jelly> and it might help to log off and on again if you haven't already
1516[18:38:27] <mrkramps> !chown
1517[18:38:27] <dpkg> methinks chown is CHange OWNer, its part of the fileutils package, try 'man chown' at the prompt
1546[18:49:50] <jelly> I confess I power cycled or rebooted the wrong machine only three times thus far
1547[18:49:50] <dob1> well the dir I was trying to create the file was this one (created by me for the purpose to limit the space) (dev/loop0 19M 8.5M 9.0M 49% /home/user/somedir
1548[18:50:10] <dob1> I forget this dir was limited in space...
1563[18:54:13] <alexrelis[m]> I'll just reboot then. There also have been a couple of small problems, but most have to do with the paths being set to /home/olduser/path/to/file instead of ~/path/to/file.
1586[18:58:26] <alexrelis[m]> mrkramps: the problem with doing this is that there's a file in the ISO that's greater than 4 Gigs which cannot copy because of fat32's limitations.
1589[18:59:06] <mrkramps> sig_9, dd is not working
1590[18:59:11] <alexrelis[m]> sig_9: for some reason dd doesn't work for Windows.
1591[18:59:13] <mrkramps> afaik at least
1592[18:59:14] <sig_9> how is it not working
1593[18:59:18] *** Quits: somazero (~somazero@replaced-ip) (Remote host closed the connection)
1594[18:59:21] <Kali_Yuga> sig_9: that didn't work for me
1595[18:59:22] <sig_9> are you in windows?
1596[18:59:22] <sney> not every windows iso is hybrid
1597[18:59:28] <mrkramps> exactly
1598[18:59:29] <alexrelis[m]> sig_9: idk but it doesn't work for windows ISO.
1599[18:59:39] <sig_9> alexrelis[m]: of course it does
1600[18:59:59] <sig_9> I've made many windows 10 iso's
1601[19:00:11] <sig_9> what is your dd output
1602[19:00:31] <alexrelis[m]> It will run fine for me but it won't boot.
1603[19:00:36] <Kali_Yuga> mrkramps: what did you say I just need to copy the Windows iso onto a Fat32 formatted USB stick? is that even bootable after that?
1604[19:00:39] <sig_9> uefi?
1605[19:00:53] <alexrelis[m]> Kali_Yuga: trust me when I say to try ventoy.
1606[19:00:56] <sig_9> go into bios and choose usb
1636[19:11:40] <Kali_Yuga> I hate all these 3rd party software stuff
1637[19:11:53] <unixbsd> "cal -h" does not work on debian, but it works on BSD.
1638[19:12:36] <mrkramps> unixbsd, what is "cal -h" supposed to do?
1639[19:12:37] <alexrelis[m]> Kali_Yuga: yes. Ventoy is basically a custom boot loader that you install to your flash drive that will automatically search for ISOs within it and create boot entries.
1640[19:13:10] <alexrelis[m]> It allows you to boot from multiple ISOs from one image and use your drive for storage while also using it as a bootable install media.
1641[19:13:29] <Kali_Yuga> alexrelis[m]: I will try
1642[19:13:38] <Kali_Yuga> alexrelis[m]: thanks for the help
1643[19:13:50] <alexrelis[m]> Kali_Yuga: no prob. If you need any more help feel free to ask.
1644[19:14:00] <mrkramps> unixbsd, or you just want to install the bsdutils / bsdmainutils
1645[19:14:18] <unixbsd> well manpages tells something else... see: man cal
1661[19:22:35] <unixbsd> is there a little workaround for it?
1662[19:22:53] <hudo> is there a binary for rizin ?
1663[19:23:02] <unixbsd> ncal is another thing, and not reliable to port on other platforms.
1664[19:23:07] <mrkramps> unixbsd, i am just guessing, but cal is probably around for compatibility reasons while in bsd was already replaced with ncal
1665[19:23:20] <unixbsd> cal is unmaintained since years and ages.
1666[19:24:02] <Kali_Yuga> alexrelis[m]: okay, moment of truth
1667[19:24:18] <Kali_Yuga> alexrelis[m]: be right back
1668[19:24:42] *** Quits: Kali_Yuga (~dustin@replaced-ip) (Quit: Lost terminal)
1669[19:25:24] <mason> unixbsd: Interesting. That's a docbug, with the -h.
1670[19:26:04] <unixbsd> there is here a bug fix that can be helping : replaced-url
1671[19:26:05] <mason> Ooh, ncal is a little unnatural-feeling, but I can see what they're going for. Interesting.
1703[19:50:41] <hansol> guys, we have given the root password to somebody to fix somethening to our site, they have fixed our case, but they got changed the root password, we hack the root password and changed but now they are login in into our machine and they starting a miner. Our question is how we can find from where and how they are starting this miners and fix
1704[19:50:42] <hansol> everything?
1705[19:51:32] <unixbsd> mount with a live cdrom, like slackware iso for instance
1706[19:51:45] <hansol> its a deiab
1707[19:51:46] <unixbsd> mount /dev/sda1 /mnt ; vi /etc/shadow and
1708[19:52:00] <sney> hansol: restore from backup prior to the other person getting access
1709[19:52:03] <unixbsd> then replace root:: blabla to get :: no pass on root.
1710[19:52:31] <hansol> we have changed password but he is login agian and starting miner script
1711[19:52:48] <hansol> but theroot password is changed
1712[19:52:55] <sney> hansol: exactly, you'll never find every backdoor. RESTORE FROM BACKUP.
1713[19:53:18] <hansol> you thing its a php script ?
1734[20:07:35] <alexrelis[m]> Better to just make a user account for them, and give them sudo privileges for the specific thing that are tasked to configured.
1738[20:09:34] *** Quits: mrbirkov (uid453780@replaced-ip) (Quit: Connection closed for inactivity)
1739[20:10:11] *** Quits: tagomago (~tagomago@replaced-ip) (Remote host closed the connection)
1740[20:10:22] <ratrace> hansol: as someone who has server security as its $daily_job ..... I agree with sney. burn it. scatter the ashes. rebuild from known good backups.
1746[20:13:01] <ratrace> and if you can isolate "external jobs", then do it in VMs, let them build ansible/saltstack/whatever recipes for the job, you review them and execute
1748[20:14:10] <ratrace> hell, we have some external "consultants" do some work for us. they're given VMs that are purged daily, on physically separate machines... in fact, the whole datacenter even is separate from our production capacities.
1749[20:14:24] <ratrace> (and they're not even roots, just unpriv user work)
1770[20:22:41] <ixil> sney: I tried making an equivs that lists a *Provides that conflicts with the it's *Depends
1771[20:22:55] <sney> if you can't make your package cooperate with apt, then it may be best to install it a different way, like straight into /usr/local
1786[20:28:01] <sney> any time you override apt's dependency resolution, you're only setting yourself up for more headaches later. going that way isn't a solution to anything.
1787[20:28:11] <mrkramps> ixil, depackage it and rebuild proper package?
1792[20:29:02] <ixil> I don't have too much experience with debian/ubuntu - I am using a ubuntu vm :'(
1793[20:29:02] <mrkramps> probably even better
1794[20:29:20] <ixil> although I'm doing that through LXD so maybe I went wrong there too
1795[20:29:24] *** Quits: Deknos (~deknos@replaced-ip) (Remote host closed the connection)
1796[20:29:44] <mrkramps> ixil, so the problem is in your ubuntu VM then?
1797[20:29:48] <ixil> mrkamps: I was thinking about it, but then I think I also have to repackage it from ros and it's several 'distribution'
1798[20:30:07] <ixil> mrkramps - could be, but shouldn't be - it's a clean install
1799[20:30:19] <sney> !ubuntuirc
1800[20:30:19] <dpkg> This is not the Ubuntu help channel. Please do /server chat.freenode.net and then /join #ubuntu. If you are using HexChat, you can right-click the following link and choose connect. irc://chat.freenode.net/ubuntu
1801[20:30:21] *** Quits: tagomago (~tagomago@replaced-ip) (Remote host closed the connection)
1802[20:30:38] *** Quits: bertbob (~bertbob@replaced-ip) (Remote host closed the connection)
1828[21:09:15] <bitdefect> I get a segfault via suricatasc -c shutdown when using the backported version from bullseye in buster.
1829[21:09:21] <bitdefect> I wondered if someone can confirm that.
1830[21:11:16] <drl> Is this the same kernel as Debian Buster: Linux mx 5.6.0-2-amd64 #1 SMP Debian 5.6.14-2~mx19+1 (2020-06-14) x86_64 GNU/Linux
1831[21:11:34] <sney> drl: no, buster has 4.19 and buster-backports has 5.8 or 5.9
1832[21:11:37] <mrkramps> drl, nope
1833[21:12:02] <alex11> that also says 'mx'
1834[21:12:07] <alex11> which probably means mx linux
1835[21:12:52] <sney> bitdefect: I don't see any reports of similar issues, but it looks like there were significant changes between the buster and bpo versions, so there might be some regression caused by older config options? I'm not familiar with that package, but maybe start clean and see if the segv goes away
1836[21:13:47] <bitdefect> sney: I actually did. I want to set this up on a new firewall hardware I got recently (Protectli).
1837[21:14:19] <sney> bitdefect: in that case I would consult with suricata upstream
1838[21:14:25] <bitdefect> sney: I only got suricata and suricata-update from bullseye, the rest is a fresh netinstall with only system tools installed.
1839[21:14:40] <bitdefect> sney: Will do
1840[21:15:16] <bitdefect> sney: I actually loaded the core dump in gdb, but that's not helpful, due to missing debugging symbols.
1842[21:15:33] <drl> I'm needing libx11.so.6 to work with Linux mx 5.6.0-2-amd64 #1 SMP Debian 5.6.14-2~mx19+1 (2020-06-14) x86_64 GNU/Linux. How can I get it?
1843[21:16:47] *** Quits: Gobo (~user@replaced-ip) (Remote host closed the connection)
1844[21:19:06] *** Quits: tagomago (~tagomago@replaced-ip) (Remote host closed the connection)
1845[21:19:19] <sney> drl: mxlinux is not supported here. ask on their forums.
1849[21:19:44] <dpkg> antiX is a fast, lightweight and easy to install systemd-free linux live CD distribution based on Debian Stable for Intel-AMD x86 compatible systems ( replaced-url
1882[21:42:21] <f8e4> i tinker aa, now: replaced-url
1883[21:43:19] <f8e4> it can read all, why it want write mask! : apparmor="DENIED" operation="open" profile="// many of those on syscalls i guess; why?
1884[21:44:04] <f8e4> try to confine pdf viewer that all
1915[22:02:48] <Razathorn> I'm trying to apt-get dist-upgrade from buster to testing and I'm encountering "Breaks" errors, but I can't figure out why it is the case The newer version of the needed package to "not break" is available but for some reason is not being upgraded, so I am really just trying to determine how to figure out WHAT depends on this old version of a package and is holding me up. Can an APT/DPKG ninja help me?
1916[22:04:02] <freem> Razathorn: I would advise you to use aptitude's ncurses interface, it makes it easier to debug that sort of problems
1917[22:04:04] <sig_9> have you changed your sources.list to testing?
1918[22:05:08] <mrkramps> apt rdepends package
1919[22:05:11] <sig_9> you've changed in sources.list 'stable' to 'testing' or bullseye
1920[22:05:19] <Razathorn> Yes, I have, to testing sig_9
1921[22:05:53] <Razathorn> What is aptitude's ncurses interface? I have not experienced this. I'm honestly switching back to debian from ubuntu, so I'm a bit out of practice.
1939[22:08:22] <Razathorn> Folks, let me be 100% honest in this that I'm looking for apt/dpkg help here, but this is the beta "raspberry pi os" 64 bit which, unlike the 32 bit, is actually directly using buster apt sources and adding a 3rd party raspi apt source, so this may not work AT ALL when I'm done, but by god, I hope you can help me prove one way or the other ;)
1949[22:10:51] <Razathorn> my GOAL in the end is to run debian testing with raspi kernel and hw support that hasn't made it upstream yet.
1950[22:11:27] <sig_9> Razathorn: you grab your iso from here: replaced-url
1951[22:11:29] <sig_9> ?
1952[22:11:38] <Razathorn> since raspi essentially moved to "extending" real debian rather than repackaging and porting it, it appears. 32bit os has raspbian sources, 64bit literally has debian urls and the raspi stuff is extra
1953[22:12:30] <Razathorn> No sig_9, this is the raspi beta 64 that I'm going to "SEE" if I can upgrade to testing. This is in no way expected to be supported or work. I'm just out there I suppose.
1954[22:12:48] <sig_9> heh
1955[22:12:53] *** Quits: Jerrynicki (~niklas@replaced-ip) (Remote host closed the connection)
1956[22:13:12] <sig_9> this is my "one" line in my rasppi 4 sources.list
1957[22:13:14] <Razathorn> The reasoning is I want to have all the raspi custom stuff for gpio dev and all that working but still use the newer testing userland like kde
1959[22:13:26] <mrkramps> Razathorn, i'd guess you have more luck at #raspbian
1960[22:13:41] <Razathorn> nah you guys pointed me in the right direction ;)
1961[22:13:46] <Razathorn> sorry, you folks.
1962[22:15:07] <bitdefect> sney: I just saw the latest old stable for suricata is 5.0.5, while the one in Bullseye is 5.0.3. Would it not be better to issue a bug report for Bullseye/Backports rather than upstream?
1963[22:15:28] <freem> hum... any idea how I could have debootstrap giving some progress information, but *not* spamming stdout ?
1964[22:15:34] *** Quits: el (~el@replaced-ip) (Quit: q u i t)
1970[22:16:40] <bitdefect> mrkramps: I tried, at least on their website I have a hard time for 5.0.4 and 5.0.5 while they have a nice list for 5.0.3. Will check the tar.gz.
1971[22:16:51] <sney> bitdefect: bullseye has 6.0.1, but before filing a bug report, you should still confer with upstream to make sure it isn't user error on your part.
1972[22:17:09] <sney> bug reports are for when you're *sure* it's a problem with the application itself, not for support requests
1973[22:17:22] <bitdefect> sney: User error is impossible. Just kidding ;)
1980[22:21:18] <bitdefect> sney: Though, I must say, a segfault should never be a configuration issue. If it is a configuration issue, you still have a severe bug ;)
1997[22:33:39] <Aristide> I have a small problem with incrontab (0.5.12-1+deb10u1) on Debian Buster. I get a memory leak, and incrontab crash. I get lot of « cannot create watch for user root: (16) Device or resource busy » too
1998[22:33:46] <Razathorn> mrkramps / sig_9: Looks like something is depending on the buster gcc version directly. rdepends was the answer btw, I can walk backwards and identify.
1999[22:34:02] <Aristide> no problems when I use inotifywait in same directory, I get all FS events
2019[22:44:06] <Razathorn> mrkramps / sig_9: Found it. It's libgcc1. There's no new "testing" version for arm64 in testing. It's a buster package that has no arm64 version in testing.
2021[22:45:36] <sney> Razathorn: there is a known issue upgrading from buster to bullseye in some cases, where libc6-dev and libgcc-8-dev get stuck due to libgcc1. if you 'apt full-upgrade libgcc1-' it will proceed, on a debian system
2023[22:46:46] <sney> libgcc1 from gcc-8 is supposed to be replaced by libgcc-s1 from gcc-10 but it doesn't always go as planned. the gcc team is working on it.
2027[22:49:09] <Razathorn> sney: That seems like what is happening here
2028[22:50:11] <sney> Razathorn: see in the channel topic, where it says "testing/unstable: #debian-next @ irc.oftc.net"? if you had followed that when you got here, you would have found the answer much more quickly, because the testing channel is v familiar with this issue
2029[22:50:53] <Razathorn> Joining now! I did not see it.
2030[22:51:23] <Razathorn> well I need an invite, doh.
2031[22:51:24] <sney> !invite only
2032[22:51:25] <dpkg> Many debian channels are on the OFTC network (irc.oftc.net), *not* on freenode. If you try to join one and you see "Cannot join (Channel is invite only)." it means you did not read it's on irc.oftc.net. See also replaced-url
2033[22:52:34] <Razathorn> I didn't realize that was a different network, I just thought it was adovcating another freenode server. Got it now, thx.
2053[23:07:57] <sney> I don't know what you mean by "quick hop", but I have a znc instance that is connected to both freenode and oftc, and I connect to znc with hexchat. (and 5 other unrelated networks too)
2054[23:08:04] <f8e4> i postponed the aa; this is serious stuff, no idea; xdg-mime default chromium.desktop application/pdf will do i hope
2055[23:08:24] <ratrace> f8e4: are you using aa-genprof?
2056[23:09:10] <ratrace> f8e4: problem is, you'll need some abstractions there due to gnome ... :/ but ideally use genprof to create the initial profile, switch it to complain mode and then run aa-logprof as you use the program for a while.
2074[23:13:23] <mrkramps> H-var, you need to install third party app for gui
2075[23:13:25] <ratrace> f8e4: but you easily turn it into a blacklist.... deny first things you wanna deny, then do a blanket allow on /** mrwxk ---- and EEreplaced-url
2076[23:13:50] <f8e4> np yo ty
2077[23:14:07] <ratrace> f8e4: with AA profiles, things that are denied first, cannot be allowed later, thus a blanket allow on /**
2078[23:14:28] <f8e4> thats a good idea; i will give it a try with genprof
2080[23:14:55] <ratrace> f8e4: the power (and price in time taken) of AppArmor profiles is that you can finetune exactly what it's allowed to do
2081[23:15:24] <ratrace> and with upcoming versions, there will be much bigger dbus policy capabilities, and maybe even more network capabilities like ip matches etc...
2082[23:15:39] <f8e4> yes ip:port only specific
2083[23:15:41] <ratrace> f8e4: and you can also combine with systemd units for namespacing and seccomp filtering.
2084[23:15:49] <H-var> mrkramps razergenie? I installed it and there's literally only one option - to enable or disable the razer led logo :DDDDD
2085[23:15:52] <ratrace> f8e4: afaik, ip:port is not yet available in Buster's AA
2093[23:18:05] *** Quits: con_ (~con_@replaced-ip) (Remote host closed the connection)
2094[23:18:11] <Peyam> I have problems with black screen from resuming on my computer and I have to restart lightdm service and it closes all of my applications
2096[23:18:25] <ratrace> Peyam: the two are different programms, you don't replace one with another
2097[23:18:42] <c077ee> I have a debian /etc/apt/preferences file and I want to specify a single package to come from a custom repository: replaced-url
2098[23:18:45] *** Quits: coot (~coot@replaced-ip) (Remote host closed the connection)
2099[23:18:52] <c077ee> I am a little confused on how the syntax here would work.
2101[23:19:22] <ratrace> c077ee: you read that apt pinning wikis, manpages?
2102[23:19:26] <ratrace> *the
2103[23:19:45] <c077ee> Yeah I am reading through the wiki entry at the moment.
2104[23:19:59] <c077ee> My only concern here is I want to pin directly to this URL and not just the domain
2105[23:20:07] <Peyam> ratrace, so light-locker should be replaced with lightdm or lightdm+greeting with xscreensaver?
2106[23:20:08] <c077ee> Which the entries seem to specify, maybe I need to scan further through it.
2107[23:20:57] <ratrace> Peyam: lightdm is a display manager. xscreensaver is not. the two have similar APPARENT functionality in that at some point they require you to input your credentials to continue. that is all.
2156[23:29:32] <ratrace> Peyam: if it complains about specific firmware files it fails to load, you use apt-file to find the package that provides it, then install it, then reboot
2157[23:30:03] <c077ee> I managed to fiddle around with the pinning using a custom Pin: origin a=obs://build/... pin
2158[23:30:07] <c077ee> That ended up working out.
2159[23:30:26] <Peyam> and you saw it because it is right below the vgaarb right?
2160[23:30:43] <ratrace> c077ee: it's a slipper slope, apt pinning. guys here will be quick to slap a frankendebian factoid when someone mentions it :)
2162[23:30:56] <ratrace> Peyam: I saw it because I looked for the phrase "firmware"
2163[23:31:06] <Peyam> aah okey.
2164[23:31:11] <ratrace> i915 firmware is related to the intel GPU
2165[23:31:21] <Peyam> ahh
2166[23:31:24] <Peyam> awesome. thanks
2167[23:31:25] <mrkramps> c077ee, is it worth all the work? lutris already landed in testing
2168[23:31:31] <c077ee> Yeah I have been using debian for 16 years at the moment. I ended up just fiddling with it till it worked out. I don't come on the IRC that often because it has way too much chatter.
2169[23:31:38] <c077ee> Lutris is broken at the moment at least for my configuration
2170[23:31:58] <c077ee> I mentioned it directly to the lutris devs, they aren't respecting the config file and a lot of issues in the latest update seem to have borked things.
2171[23:32:01] <Peyam> so you use apt-file i915? I though you did apt+cache search
2193[23:40:04] <freem> I have used line-mode, make the sed expression easier
2194[23:40:29] <freem> pv have it's stdin block-buffered it seems
2195[23:40:50] <freem> even with the -l option
2196[23:41:02] <ratrace> I can't picture using debootstrap with pv ... how exactly are you doing that? and to what end? not as if you can know total size it'll output to have a meaningful progress bar
2197[23:41:17] <freem> but you can.
2198[23:41:40] <ratrace> what, you counted a typical deboostrap output and are using that?
2199[23:41:43] <mrkramps> hm, --no-splice might help
2200[23:41:48] <freem> requires summoning it multiple times, of course, and there is an initial step I have yet to avoid doing several times
2201[23:42:35] <freem> I'm working my way to have a better progression indicator in debootstrap yes
2219[23:48:45] <ratrace> freem: you can alter the buffer size. the manpage says it's quite a large default if it can't detect from the filesystem, which it can't if you pipe to it
2228[23:51:56] <ratrace> I keep auth on port 25 because it's a server and config and clients I drag since late 2010s... back then things were.... different.
2229[23:52:23] <ratrace> no, since _before_ 2010 ...
2230[23:52:33] <ratrace> late ... first decade ... gah... whatsitcalled...
2231[23:53:14] <freem> millenium?
2232[23:53:18] <sig_9> what version of Plasma will debian 11 stable have?
2233[23:53:38] <ratrace> meh wrong chan for what I posted.... damned alt-#