31[00:48:12] <short-bike> oxek: Thank you. What I am looking for are walk-through documents on completely re-imaging an android tablet with debian. It's not a new device but I have not attempted this before so risk factor is zero.
32[00:48:48] *** Quits: genr8_ (~genr8_@replaced-ip) (Remote host closed the connection)
37[00:49:38] <short-bike> Google hits on the subject produce a bunch of ubuntu / ubuntu touch youtube's
38[00:49:48] <oxek> ubuntu is going to be pretty similar
39[00:50:12] <oxek> in general, if ubuntu can run on something, then so can debian
40[00:51:09] <short-bike> makes sense. I'll scan the ^^ wiki and thanks again.
41[00:55:46] <sney> specificity is important when researching if a device is compatible.
42[00:56:39] <short-bike> The wiki trail led to here (which is perfect) -> replaced-url
43[00:56:40] <sney> rather than saying, "can I put debian on this tablet/computer", try "does debian (or mainline linux) support this nic/gpu/input device" etc
44[00:57:14] <sney> booting is usually a concern too
45[00:58:02] *** debhelper sets mode: +l 1028
46[00:58:36] *** Seto_Kaiba is now known as Hunterkll
49[01:00:43] *** Quits: Newami (~Newami@replaced-ip) (Remote host closed the connection)
50[01:01:08] <silent-failure> Debian is the "universal" operating system, so it better run on everything ubuntu can.
51[01:01:20] <short-bike> sney: understood and agree. The 'lildebi' installer looks like a god fit but I need to read up on the whole process.
52[01:02:05] <sney> at a glance, this lildebi thing looks like a chroot running on top of android, rather than a baremetal OS. that reduces a lot of the complexity but also doesn't sound like what you want.
53[01:04:08] <short-bike> It's not. I would like to completely re-image to device but a parallel install might be a good start.
66[01:13:18] <sney> you may also want to get another arm device (like a rpi or similar) in order to improve familiarity with using debian on arm, plus you'd able to compile binaries and packages for the tablet
91[01:45:56] <dannylee> i reinstall my debian 9.13 os...and it went ok...the first installation was not that Good..this time i installed KDE and Gnome and LXDE to...now konqueror is working better,,i'm on Gnome..its the best...i install the firewall too...the first installation was my fist time with debian...
111[01:53:30] <dannylee> my installation took me all night...it Burn me out...fedora is easier to config...but Debian is really Good...
112[01:53:32] <ryouma> t know firewalls could make the machine slower
113[01:54:13] <dannylee> web browser just run slower...i just don't why..
114[01:54:21] <ryouma> unless they are the fancy type which idk if debian has
115[01:54:52] <ryouma> which one are you using?
116[01:55:18] <dannylee> i now i do make allot of miss sta..ke
117[01:55:25] <petn-randall> dannylee: Why would we fight with your firewall?
118[01:55:43] <mrjpaxton[m]> I don't recall if Debian Stable comes with iptables or nftables (with a wrapper for the `iptables` command) by default. But I know it's some form of netfilter.
120[01:55:59] <dannylee> some of you guys are hackers...ill do the same..
121[01:56:09] <ryouma> ufw and arno are pretty straightforward. of course you can also do raw.
122[01:56:11] <mrjpaxton[m]> And I think if you run `iptables -L` it will show you if you have any rules enabled, or not. I think the default is not to set up any rules.
123[01:56:43] <ryouma> arno-iptables-firewall *
124[01:56:45] <petn-randall> dannylee: Are you conflating hackers and script kiddies?
125[01:56:57] <mrjpaxton[m]> dannylee: Well, I've set up my own custom router before, so I just like to tinker and build with computers, more than "hack" on them. But I can't speak for everyone here! Lol.
126[01:57:11] <dannylee> ok i just a bit new with Debian ill check...thanks..
127[01:59:07] <mrjpaxton[m]> After playing with Ubuntu 20.04, I can confirm that it really is a good, solid OS, and definitely easier to use out of the box than Debian. Since it's based on Debian, you still use a lot of the same packages and utilities on it. Just something to consider.
128[01:59:31] <ryouma> some folk will say you should do your own firewall using raw. but the syntax sometimes changes and semantics too and it can get tricky. this description kind of motivates the idea of using a front end: replaced-url
132[02:01:14] <ryouma> especially "First, the "Sanity checks", then it modprobes all the necessary kernel modules (again, some of which I'd never heard of). Arno's doing all the obscure: echo ${some_integer} > /proc/sys/net/blah/blah that I've never managed to either take the time to understand or find a decent reference for."
133[02:01:19] <mrjpaxton[m]> I love using a raw nftables config though. After learning for a month how to use it when setting up my router, it feels better to use. There's also `ufw` which is a bit easier. Most likely though, having your router manage the firewall is enough. You probably don't even need a firewall on any of your other LAN machines.
134[02:01:45] <dannylee> i got set -o emacs as my default terminal editor...debian is allot of work...ok ubuntu is ok for most....but i went for Debian...i;; just buy buster on my next credit card...
135[02:01:58] *** cluelessperson_ is now known as cluelessperson
147[02:04:51] <mrjpaxton[m]> dannylee: SSH is called "secure shell" for a reason. No one can log in with a shell on your system without a password, and most `sshd` programs have root disabled by default, anyway.
148[02:04:52] <oxek> hence firewalld, with its integration into NetworkManager
149[02:05:03] <petn-randall> dannylee: Most consumer routers do NAT to allow multiple devices to access the internet. NAT however prevents any connection attempts from the internet to local devices, unless you explicitely set up port forwarding.
150[02:05:07] <oxek> mrjpaxton[m]: I login without a password ;P
151[02:05:23] <petn-randall> dannylee: And even then an accessible service doesn't equal "being hacked".
152[02:05:34] <mrjpaxton[m]> oxek: I mean, is it a saved password on your display manager? Because that's different.
153[02:05:35] <dannylee> ok that is rite...
154[02:05:51] <oxek> mrjpaxton[m]: no passwords anywhere
155[02:05:58] <petn-randall> mrjpaxton[m]: I'm guessing login via ssh key.
156[02:06:00] <mrjpaxton[m]> Well, at least a root password would be a good idea. sweat
157[02:06:02] <oxek> only keys
158[02:06:03] <dannylee> my password is hello...
159[02:06:15] <mrjpaxton[m]> Oh, keys are good, too.
160[02:06:17] <ryouma> dannylee: i suspect of the most popular distros debian is one of the more secure if kept up to date. i don't know this though.
161[02:06:29] <oxek> mrjpaxton[m]: not just good, they should be used everywhere where possible
164[02:07:23] <mrjpaxton[m]> Keys are good, until they get stolen. You can always set up "poor man's" 2FA by either putting a password on the key, or setting up both a key and a passphrase.
165[02:07:35] <dannylee> ok my new installation i enable update...this time...my machine will do update auto madic
166[02:07:43] <mrjpaxton[m]> But that's too inconvenient, I guess. haha.
167[02:07:52] <oxek> keys getting stolen is no worse than passwords getting stolen. Meanwhile you have full protection against brute-force attacks.
168[02:08:32] <oxek> imagine a world where nobody bothers with brute-force attacks because they know it's impossible. Unless the keys were generated on debian :p
170[02:08:38] <oxek> (a bad joke about that openssl time)
171[02:08:49] <petn-randall> oxek: I remember the old times ;)
172[02:08:58] <mrjpaxton[m]> Well, it's not like SSH enables weak ciphers with no salt+hash. I bet even a 12 or 16 character password can protect you for many years.
173[02:09:29] <mrjpaxton[m]> But yeah, I really should set up my SSH keys sometime. It's just laziness at this point.
174[02:09:42] <oxek> mrjpaxton[m]: the difference is that hackers don't know your password is at least 12 chars, might be 6 chars hence worth a try. Whereas if they know that a key is being used, then they know it's pointless to bruteforce.
175[02:10:00] <dannylee> i use Gnome 10 years with fedora...debian is a bit better for hacking...IBM just don;t like hackers.
177[02:10:23] <oxek> it's like my freenode SASL account - people try bruteforcing the password from time to time, even though I don't use it at all.
178[02:10:44] <oxek> so if SASL plain went away, nobody would bruteforce anymore
179[02:10:54] <mrjpaxton[m]> I mean both can be used for hacking. It's not like Kali Linux had to be based off of Debian, for example. The just chose it because Debian is probably really easy to make into a custom OS.
180[02:11:41] <oxek> I don't even know my freenode password, don't have it stored anywhere
181[02:11:59] <oxek> hence fully resistant to rubber hose attacks
188[02:13:36] <oxek> if you're using pidgin still, then you're just asking for trouble anyway
189[02:14:10] <mrjpaxton[m]> SASL Plain reminds me of STARTTLS, where you had to send your password over IMAP before actually sending the E-mail. It's so backwards. Lol.
190[02:15:07] <oxek> I think that was something else. Having to do POP auth before SMTP (IMAP).
191[02:15:12] <mrjpaxton[m]> And now... introducing Darkmail with Lavabit. ;)
192[02:15:27] <mrjpaxton[m]> I still can't believe they're around, too.
205[02:41:20] <mrjpaxton[m]> Peasant65: Did you download the installer called "standard", or one with a desktop,like "gnome", "kde" or something like that? I can't remember exactly, but I'm not sure if the "standard" one even has a GUI installer. Also, is it the net install, the hybrid ISO, or something else?
209[02:42:26] <Peasant65> hm, it's bunsenlab linux. But from what I gathered it's basically debian 10 with some configuration tweaks and openbox out of the box.
210[02:43:27] <mrjpaxton[m]> Oh, well you probably want to ask specifically on the Bunsenlab channel then. As far as I know, almost all of the Debian installers (not sure about "standard") have a GUI installer.
211[02:43:35] <Peasant65> How would you start the graphic installer from a debian gnome live installer?
212[02:43:41] <Peasant65> What would be the command?
213[02:45:35] <mrjpaxton[m]> If it was Debian's installer, there would just be a GRUB menu entry called something like "Install with Graphical installer", or something like that. But yeah, sorry. I'm not sure how else to start it.
229[02:56:02] *** Quits: Lupricon (~Lupricon@replaced-ip) (Remote host closed the connection)
230[02:56:24] <oxek> !bunsenlabs
231[02:56:24] <dpkg> BunsenLabs Linux is a community continuation of <crunchbang> that features the <Openbox> window manager. It is not supported in #debian. replaced-url
268[03:47:39] *** Quits: Cypher100 (~Cypher100@replaced-ip) (Remote host closed the connection)
269[03:48:49] <rangergord> Hi. How easy is it to get a self-compiled from source Debian working (minimal install + a few chosen packages by me)? I want it to be identical to the official master. Is it just a matter of running a single build script on a Debian build VM?
274[03:53:30] <mrjpaxton[m]> rangergord: You might be interested in Debian's "live-build" project. It allows you to make custom Debian live images and installers. But in terms of building everything with, say "deb-src" repos, I have no idea. Haven't needed to do it yet. There's better OSes for building from source, namely Gentoo.
277[03:55:44] <rangergord> thanks, I'll look into it
278[03:56:14] <mrjpaxton[m]> Debian is also pretty good about doing reproducible builds, though not perfect by any means. I'm guessing you want to build from source because you want custom program features, or is it for security as well?
459[08:47:08] <jelly> seems to download _something_
460[08:48:17] <jelly> but funny thing is, it doesn't contain libpepflashplayer.so either
461[08:49:38] <jelly> I do seem to have a -rw------- 1 jelly users 19509216 Dec 9 20:42 /home/jelly/.config/google-chrome/PepperFlash/32.0.0.465/libpepflashplayer.so on a machine that hasn't been updated in a while, but I do not know exactly where it came from
463[08:50:25] <mrjpaxton[m]> If it's possible that Adobe Connect can be downloaded and used as a SWF file, then hopefully the standalone Adobe Flash player I linked at Flathub will work.
464[08:50:45] <mrjpaxton[m]> But yeah, that's a tricky one to solve.
465[08:52:34] <jelly> sabasedigh, if you trust binaries from random people on irc, I can put it somewhere
466[08:52:45] <sabasedigh> jellyI trust U
467[08:52:47] <jelly> (you really shouldn't)
468[08:52:48] <sabasedigh> plz
469[08:52:53] <sabasedigh> Version 79.0.3945.88 (Official Build) unknown (64-bit)
470[08:53:00] <sabasedigh> from slimjet didn't work
500[09:02:44] <jelly> hey you people using The Lounge irc client, you should probably be aware your real IP address is exposed any time anyone posts a link in channel
501[09:03:21] <jelly> very nice feature... if I want to figure out where people live
502[09:04:14] <mrjpaxton[m]> Phf. Well... I at least used WHOIS to find out that you prefer Namecheap. ;)
503[09:05:07] <jelly> 20 thelounges, 1 irssi, 1 synapse/matrix.org, and a curious - [06/Mar/2021:08:57:28 +0100] "GET /other/pepperflash.tar.gz HTTP/1.1" 200 47135 "-" "Links (2.1pre37; Linux 2.6.9-023stab048.6-enterprise i686; 125x40)"
528[09:16:58] <arwn> I'm trying to install cataclysm-dda-sdl 0.E in debian buster using backports but running `sudo apt -t buster-backports install cataclysm-dda-sdl` installs version 0.C instead. my apt/sources has buster-backports in it. What am I doing wrong?
554[09:27:45] <jelly> it's a warm standby system in case I manage to ruin my current workhorse
555[09:30:09] <arwn> ok sorry for the ignorance but if i need a testing version of a package that isn't in backports, what are my options other than upgrading to testing.
556[09:30:25] <mrjpaxton[m]> For a minute I thought `apt -t buster-backports show <package>` would work, but I guess not....
557[09:30:39] <mrjpaxton[m]> I keep forgetting about `apt policy` for some silly reason.
558[09:31:08] <mrjpaxton[m]> So thanks craigevil for saving me (from my own stupidity).
563[09:32:36] <arwn> i assume i can follow SimpleBackportCreation on the wiki to do that?
564[09:33:04] <craigevil> yes
565[09:33:14] <mrjpaxton[m]> Some options for getting and using newer programs in Debian: Flatpak, Docker, other containers, VMs, debootstrap chroot, and the Nix package manager.
566[09:33:41] <mrjpaxton[m]> But it's good to keep your system stable.
567[09:34:02] <arwn> i've looked at nix and docker. but it's a lot of extra confusion and skill just to install a game :p
568[09:34:30] <craigevil> you could check flathub or snap for it
569[09:35:06] <mrjpaxton[m]> It can be, yeah. But you really don't want to mix Testing with Stable.
576[09:40:35] <mrjpaxton[m]> Those are just some ideas. I think the chroot, Flatpak, Snap (as mentioned) methods might be the easiest. Docker is only harder if you are running a graphical application. And setting up a VM and Nix is more intermediary. :)
577[09:41:22] <mrjpaxton[m]> So you could have a chroot with Debian Testing. I think some people do that??
582[09:44:01] <mrjpaxton[m]> The reason why I say chroot is easier is simply because it's less restrictive, and not sandboxed. The hardest part is setting it up, but it's really easy to use once it is set up.
584[09:44:56] <arwn> oh that's not a bad idea, just chroot a debian testing
585[09:45:15] <ratrace> nspawn it
586[09:45:27] <arwn> yeah that
587[09:45:43] <mrjpaxton[m]> I think nspawn is different.
588[09:45:55] <arwn> it's sandboxed from what I remeber
589[09:46:07] <ratrace> yes. it prepares the environment properly and securely
590[09:46:20] <mrjpaxton[m]> I've never done that method successfully before. It might be a good project for me to try again, as well.
591[09:46:26] <ratrace> you can still (bind)mount (read-only) parts into therwise private /dev and things like that
592[09:46:38] *** Quits: hisacro (~OBSD@replaced-ip) (Remote host closed the connection)
593[09:47:21] <ratrace> and it's all contained in the single command. otherwis mounting, chrooting, etc... you'll have issues with tearing down the container with umounting all that
737[12:30:41] <ratrace> dob1: simplest check would be if you have any lines starting with anything other than . but note there may be changes that are done that aren't uploads. so it depends on what kind of change you're looking for, and parse that out of the list
738[12:31:11] <dob1> ratrace, if at least a file was transfered
745[12:41:20] <ratrace> damned rsyslog documentation is terrible. trying to find out what the $variables for use in conditional expressions are, and/or whether it's just "properties" prefixed with $ . eg, if :programname can be if $programname == '...' ...
779[13:13:54] <guyru> Hi, I'm trying to replace PulseAudio with Pipewire and use a Bluetooth headset. I successfully replaced PulseAudio with PipeWire and now `pactl info` reports `PulseAudio (on PipeWire 0.3.23)`. However, bluetooth is not working. Whenever, I try to connect to my headset it fails and the following error is reported in `journalctl` by bluetoothd:
780[13:13:54] <guyru> "a2dp-sink profile connect failed for 94:...:52: Protocol not available". Any ideas? (running on Unstable with PipeWire from experimental)
826[14:33:42] *** Quits: XsiSec (~xsisec@replaced-ip) (Remote host closed the connection)
827[14:34:16] <vincent-> Hello. I'm trying to automate the installation using a preseed. I'm booting from PXE and I manage to get the Debian installer on the screen. However, I think the problem I'm having is that the preseed file is not being downloaded (I'm using preseed/url). If I go to a console (ctrl-alt-F2) I can see I don't have any network connectivity. However, if I type "udhcpc" in that console my network card gets an IP address and I have network
828[14:34:16] <vincent-> connectivity, and I'm even able to download the preseed file using wget from the URL I provided via "preseed/url". I don't know what I'm doing wrong. This is the kernel command line that I'm using: "auto url=replaced-url
907[16:19:09] <ratrace> bleb: why you ask here after you got the help and answered for that in #zfslinux full two minutes before?
908[16:19:26] <bleb> loaded question whose premise i don't agree with
909[16:19:31] <cybercrypto> ratrace: good question...
910[16:19:48] <ratrace> !cross post
911[16:19:48] <dpkg> Posting the same question in several places at the same time (IRC channels, news groups, mailing lists, forums) is impolite; your time is NOT more valuable than everyone else's. Your question might be answered elsewhere, meanwhile we are wasting our time doing research for a problem you've already solved. Cross-posting can also make you look like a spammer and get you k:lined. See also <multiple ask> <hurry>.
917[16:30:57] <vincent-> ratrace, regarding that "cross post" message, is it OK asking for help in this channel about a question made in the forums? Not repeating the question here, but point to the post URL in the forums.
918[16:32:11] <ratrace> sure. the issue is when multiple channels on irc are asked in, then teh support is split among them and same people are usually in all of them. 'tis 2021. the few of us on irc are probably all over it :)
919[16:32:55] <ratrace> in this case, the question was asked here even after it was answered and the poster engaged in another so I was really confused why would they repost like that.
920[16:34:36] <vincent-> Thanks. In that case, could anyone have a look at this forum post I just made? It's regarding an automated installation booting from PXE and using "preseed/url" -> replaced-url
943[17:11:34] <unixbsd_> vincent-: I have a little own custom app, I press 'e' and It opens a vim editor, I can modify it. Then, I press 'c' and it refresh teh PDF after running pdflatex. Sort of lightweight tex editor.
944[17:11:55] <unixbsd_> vincent-: here the source code: git clone replaced-url
945[17:12:01] *** Quits: paulgrmn (~paulgrmn@replaced-ip) (Remote host closed the connection)
987[18:01:47] <miguel_clean> I have an old laptop with 3gb ram, but without a hdd and wonder how to boot it from network only and use as X-server, launching apps and everything else on a remote desk.
1011[18:29:37] <jhutchins> Understood. I built my wife a diskless workstation back when Etch was current. The Debian Educational project had several packages and documentation for pxeboot which were very helpful. I never did manage to get a boot menu to work.
1012[18:30:13] <miguel_clean> jhutchins: yeah similar story. wanted to reuse it for my kid
1013[18:31:20] <miguel_clean> but just realized it will not work over WIFI anyway.. so will go for smallest/cheapesst SSD available
1014[18:33:14] *** Quits: dreamon (~dreamon@replaced-ip) (Remote host closed the connection)
1044[18:55:36] <jelly> miguel_clean, is it able to boot from usb? Plugging in a tiny low profile 32GB usb stick might be an option. Not a large one that sticks out because kids.
1045[18:56:45] *** Quits: Jerrynicki (~niklas@replaced-ip) (Remote host closed the connection)
1049[18:57:09] <locrian9> 'Wine' is giving me an error when I try to install it. I've tried 'apt-get install --install-recommends winehq-stable', and it returns 'The following packages have unmet dependencies : Depends: wine-stable (= 6.0.0~focal-1) but it is not going to be installed'. Trying to install 'wine' so I can revamp a laptop with Debian (2GB RAM) w/ Centrino CPU to run 'Roblox' (not supported on Linux).
1050[18:59:34] <ratrace> focal? winehq? I think you have the wrong repo there, winehq's for ubuntu and not for debian
1065[19:10:59] <jelly> locrian9, if you don't have other choice but to try packages built against ubuntu, try picking a repo for "bionic" not "focal" to use on buster, that's a more similar vintage
1066[19:11:22] <jelly> the best thing to do would be to use the correct distro
1067[19:11:32] <ratrace> jelly: winehq has a repo for debian tho
1068[19:11:39] <jelly> does it
1069[19:11:43] <ratrace> yes. see link milkt posted
1070[19:12:10] <ratrace> I've used it myself in the past. for steam. stopped when proton became a thing.
1071[19:14:10] <jelly> what's proton
1072[19:15:08] <beelzebuzz> steam's version of wine basically
1073[19:15:28] <jelly> would it help this user run "Roblox"
1074[19:15:29] <beelzebuzz> lutris is a thing too
1075[19:15:30] <ratrace> wh.... it's Steam's built-in wine with lotsa custom patches made to run windows games on linux transparently, one-click, no installation required (xce3pt the game)
1076[19:16:59] <ratrace> < jelly> would it help this user run "Roblox" :: probably not as Roblox is not a steam game.... HOWEVER.... Proton can be installed and used separately so ..... "Maybe"?
1077[19:17:40] <beelzebuzz> it might have a playonlinux install script
1078[19:17:52] <beelzebuzz> lutris might also have support for it
1081[19:18:16] <beelzebuzz> proton has worked for my un-ported games so far
1082[19:18:57] <ratrace> Proton is surprisingly good. Played Doom (2016) literally without a single glitch. I was floored with how well it worked. fasterr than doom on same machien booted from windows10 disk
1083[19:19:05] <beelzebuzz> yeah
1084[19:19:40] <ratrace> not to say it's not glitchless for some games. Evin Within is atrocious under Proton but that may change, there's open bug reports.
1085[19:20:18] <ratrace> Borderlands 3 wouldn't work at all as Proton is missing some video decoding component vital for story progression triggers (there's a custom proton mod tho, but that never worked for me properly)
1115[20:05:24] <ratrace> Borley: dhclient is not doing any resolving, so what are you asking exactly? Can you configure a static nameserver that's lower in priority than the nameserver obtained via dhcp?
1116[20:09:37] <Borley> What I'm doing with dhclient is out of the ordinary as I've found
1117[20:09:57] <ratrace> and what are you doing with dhclient?
1118[20:09:58] <Borley> I have the first address set to resolve using Tor
1125[20:11:21] <Borley> I only want the second name server to be queried just that once, in order to bring up tor
1126[20:11:22] <ratrace> so back to square one: are you asking how to set up a static nameserver entry that's lower in priority than the one obtained via DHCP?
1127[20:11:34] <Borley> and then never talk to it again once the tor nameserver is available
1128[20:11:36] *** Quits: magic_ninja (~sparkie1@replaced-ip) (Remote host closed the connection)
1129[20:11:50] <ratrace> Borley: that's not possible with default configuration options.
1142[20:14:45] <KOLANICH> Is there anyone here that can answer it just now?
1143[20:14:50] <KOLANICH> *who
1144[20:14:52] <ratrace> !anyone
1145[20:14:52] <dpkg> Please do not ask if anyone can help you, knows 'something' or uses 'some_program'. Instead, ask your real question. (If the real question _was_ "does anyone use 'some_program'?" ask me about <popcon> instead.) See <ask> <ask to ask> <polls> <search> <sicco> <smart questions>.
1146[20:15:20] <ratrace> this is not your first rodeo so c'mon.... you know the drill.
1147[20:17:41] <Borley> Thanks, ratrace, I just used append domain-name-server for the fallback option.
1148[20:17:48] <Borley> It seems to be respecting the order so far
1158[20:20:41] <ratrace> a mitm actor can alter http responses any way they want. as long as the responded packages and metadata passes signature validation, apt won't complain
1159[20:21:23] <ratrace> but sounds to me the "worst" that can happen here is.... trolling the user by messing up repositories or something... they can't mess signed content without access to the private keys that signed it.
1160[20:21:44] <Borley> There is also apt-transport-https available to consider
1164[20:23:13] <KOLANICH> ratrace: Just as I expected. Thank you. So Debian's advice to pin only third-party repos to keys, not all the repos, not doing it by default, and the mere possibility to use repos not pinned to keys, can be considered a backdoor.
1165[20:23:34] *** Quits: magic_ninja (~sparkie1@replaced-ip) (Remote host closed the connection)
1166[20:24:25] <ratrace> KOLANICH: "backdoor"? to or from what?
1173[20:29:33] <Borley> I am using the feature freeze period to review my configs and make sure everything is working neat and clean before Bullseye drops
1178[20:30:59] <ratrace> Borley: I'll start upgrading machines to bullseye when the full freeze comes. but not main productio ones, those will wait some period after release
1189[20:40:20] <KOLANICH> Borley: debsums are for already installed packages. I am speaking about tampering with remote repo metadata. I have just now looked for repo format docs. It seems that the described attack can be prevemted, if the repo uses Signed-By in its metadata on server side.
1190[20:40:30] <KOLANICH> *prevented
1191[20:41:20] <KOLANICH> Then in order to have the attack succesful, 2 repos must share the same key.
1192[20:42:12] <ratrace> "attack" doing what exactly? without the private keys they can't change the contents of packages, so what would the attack... attack?
1193[20:43:04] <KOLANICH> ratrace: I mean a replay attack. Replaying the original metadata, but from wrong place.
1194[20:44:19] <ratrace> that sounds made up. and what would it do anyway, since the packages cannot be modified?
1195[20:45:41] <unixbsd_> vincent-: I finally managed to get the latex live-view-pdf editor... it works very well. i use with two large monitors (over ssh): replaced-url
1196[20:46:19] <KOLANICH> ratrace: and non-expired, the actual one, but from wrong place. Apt asked for repo a with packages A B C, but adversary returns the metadata repo b with packages B C D. I.e. A has a vulnr, A in the repo got a fix, adversary wants us not to install the fix and not to notice that. So our computer asks for repos a and b, but adversary intercepts and returns b and b
1197[20:46:27] <ratrace> jhutchins: the ttys stay connected so I _think_ that yes, doing something like ssh remoteserver 'tmux' will launch tmux on the controlling tty
1205[20:49:00] <Borley> after adding a fallback nameserver on resolv.conf, dns queries are getting resolved in ~20ms indicating that Tor is being skipped somewhere along the way
1247[21:15:35] <Borley> I think for my use case, I should probably just write a startup script which brings up my Tor nameserver apparatus and then removes all other nameservers
1252[21:17:19] <Borley> without looking at docs, if dhclient overwrites resolv.conf say every 5 minutes, appending a temporary address should last long enough for it to do what I need it to do
1288[22:08:02] <Borley> jhutchins: while that is true, what I am configuring is for a nameserver entry to be used only once after boot then defer to a different nameserver
1289[22:10:22] <jhutchins> Borley: What I'm suggesting is that you're probably going to get resolv.conf once, at boot, and not every five minutes.
1385[23:26:33] <H-var> touch. I remember touch. Pictures came with touch. A painter in my mind. Tell me what you see. A tourist in a dream. A visitor it seems. A half forgotten song. Where do I belong? Tell me what you see? I need something more.
1391[23:42:00] *** Joins: Chop (~email@replaced-ip)
1392[23:42:02] <Chop> halllo
1393[23:42:08] <Chop> can i have help
1394[23:42:09] <Chop> ?
1395[23:42:30] <Brigo> ask!
1396[23:42:38] <Brigo> !ask
1397[23:42:39] <dpkg> If you have a question, just ask! For example: "I have a problem with ___; I'm running Debian version ___. When I try to do ___ I get the following output ___. I expected it to do ___." Don't ask if you can ask, if anyone uses it, or pick one person to ask. We're all volunteers; make it easy for us to help you. If you don't get an answer try a few hours later or on replaced-url