- luv-main - luv.asn.au

Network Security Device
by Robert Brown 12 Jan '18

12 Jan '18

Does this: https://www.kickstarter.com/projects/akita/akita-instant-privacy-for-smart-… do anything special that is not already available in linux software? Apart from a neat packaging exercise of course? The description includes: "Connected to a LAN port on your router, Akita scans your network for any unusual activity and immediately shuts it down. All-the-while letting you know an attempt was made to invade your privacy. Akita uses military-grade security protection that’s been retrofitted for the home. Then, if you run into any issues, we can remotely preserve and restore your privacy with the help of our always on-call privacy experts at Axi.us. Akita uses threat intelligence, behavioral analysis, machine learning and doesn't slow your connection at all. Importantly, it doesn't use deep packet inspection."

5 7

Debian/stretch screen corruption/hangs
by Brian May 11 Jan '18

11 Jan '18

Hello, I seem to be having an increasing problem on my Thinkpad Carbon X1 2015, where: * The screen will lose sync. Like it is an older analogue monitor. Sometimes it will come good after 1 second. Other times a suspend/resume will solve this. Some videos showing the problems: https://photos.app.goo.gl/g71psLYXEfcNK1Vx1 - the black screen with dots is uncommon, the scrolling display is more common. This is with *one* emacs window shown at full screen. * The screen will flash bright for a second, go back to normal, and then the computer will completely freeze. * These above symptoms typically happen in response to a keypress at a terminal window (gnome terminal and xterm both affected). Especially the down button or escape key, but these aren't the only ones. Happens with no external devices plugged in. * wayland/xorg gnome/kde/awesome/etc all have the same problem. Have latest Debian/stretch with latest security updates. It is possible that a regression in a security update has caused increased problems, but I am doubtful. At first I thought this was a hardware problem. Which means I should try to get it fixed under warranty. But: * Built in tests all pass. * The problem is not reproducible under Windows. * I installed Debian/stretch (brand new install) on a very different computer - a MacBook Pro, and encounter - what appears to be - exactly the same symptoms. Although the "lost sync" affect doesn't last as long. The only thing in common is both have high resolution displays. I reduced the resolution on the Thinkpad, just in case, but still get similar problems. This MacBook Pro works fine with OSX. Any ideas? This is making Linux on these computers unusable, I never know when it is going to crash. In practice, times are often very short, or worst time (e.g. 2nd time entering this email... This time under OSX). Regards

3 5

Re: AWC EC2 queries vs self hosting and other options for a email services
by Andrew McGlashan 11 Jan '18

11 Jan '18

Hi, On 03/01/18 09:09, Paul van den Bergen via luv-main wrote: > OK. As of reinvent 2017, AWS introduced bare metal server pricing. As > far as I understand it, if the hardware breaks, you get a new machine, > but it's up to you to manage DR. > > dedicated instances - it's a long term contract for a VM (not a bare > metal machine) > > on demand - you pay per hour. Typically you want a mailserver running 24/7, so about 750 hours every month. > spot price - you pay "bid" for a low priced VM. If someone outbids you, > you lose the VM. Do you mean, you have a box, working... then you get outbid and lose a working box? Kind Regards AndrewM

3 3

Intel CPUs
by Russell Coker 11 Jan '18

11 Jan '18

https://www.fool.com/investing/2017/12/19/intels-ceo-just-sold-a-lot-of-sto… https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/ Lev just tweeted the above links. This is annoying, it means rebooting all systems with Intel CPUs for which security is important and also ongoing performance loss for all modern systems with Intel CPUs. People who care about performance not security (EG gamers and people who mostly do compiles) could run in a less secure mode (run an old kernel or maybe a newer kernel patched to turn off this security feature). I guess the lesson from this and the previous security issues is to just avoid Intel CPUs. It's what Intel's CEO expects us to do.

10 25

Re: AWC EC2 queries vs self hosting and other options for a email services
by Colin Fee 02 Jan '18

02 Jan '18

On 2 Jan 2018 5:15 pm, "Brian May via luv-main" <luv-main(a)luv.asn.au> wrote: Andrew McGlashan via luv-main <luv-main(a)luv.asn.au> writes: > Okay, the problem pricing may be related to "Amazon EC2 Dedicated > Instances" ... that seems the closest (from what I can tell), to having > your own physical server and being able to do with it what you like. > > Perhaps this product is way overkill. If I am reading that correctly, sounds like you get exclusive access to the hardware. i.e. not a VM. So, probably will cost more. Correct. In AWS 'dedicated instances' are exclusive access to the hardware, typically there most expensive option. Last I looked, the reserved instance stuff was the cheapest. Although was somewhat confusing for me to understand initially, and I had to complain to Amazon when their website stuffed things up.... IIRC, if you have a reserved instance, then the hourly fees get reduced significantly (but are still payable). So the total payable is less. I think there might have been two types of reserved instances, but I have forgotten this stuff already. Reserved instances are the cheapest option. They come in full-upfront and partial-upfront versions and can be bought for 1, 2, or three years. Full-upfront is the most economical where as the name suggests you pay fully upfront for the resources you think you will need. There are some limitations on the elasticity of what you buy and of course if you end up using less than you paid for you lose out. Last time I talked to our account manager you can save up to 48% using the right RIs. Even with the reserved instance, you probably find you will end up paying more then for an alternative provider. At least that is what I found several years ago, when I moved to Hetzner instead. > I also find that all (or too many, if not all) AWS pages are super > resource hungry and cause performance issues (that is, their website > pages detailing the products on offer). This may be due to me using > Palemoon -- which is a fork of Firefox; I actually use a combination of > browsers, Firefox [due to how they have changed since version 57 in > particular], is used much less by myself now. No argument here. -- Brian May <brian(a)linuxpenguins.xyz> https://linuxpenguins.xyz/brian/ _______________________________________________ luv-main mailing list luv-main(a)luv.asn.au https://lists.luv.asn.au/cgi-bin/mailman/listinfo/luv-main

1 0

AWC EC2 queries vs self hosting and other options for a email services
by Andrew McGlashan 02 Jan '18

02 Jan '18

Hi Guys/Gals, As I understand it, if you want to host an AWS EC2 server, you need to pay a "region" price for access to a region; it is my belief that it costs roughly $1500 per month, not sure if that is already in AUD or not. Then, you pay per hour for the running machine and you pay again (even if only a little) for storage. To me, self-hosting a mail server makes much more sense; so, why would it make sense to set one up as an AWS EC2 instance? Have I got the figures wrong? Is that region charge an every month "once off" and then you can have as many servers there as you like? Even if you pay for every server by the hour plus other costs? I know they [AWS] have an offer of 1 year free, but that translates to me as a fremium product; you'll pay through the nose after 12 months if you continue to require the service. The only other alternative to self hosting is a VPS, then you are RAM, CPU and storage limited, that is, unless you really pay for a beefed up server, and, of course, that will cost you dearly. A cheap self hosted server on a good connection should suffice for email better than any other option. I've ran a mail server on a DSL connection for many years now, it has been improved by an HFC NBN connection for me, but it worked okay on DSL even if it wasn't ideal. There is one other option, but I really loath that choice. That is to use Google Apps or some other hosted service, just for email -- the only advantage I see is the level of storage available. But it comes at a cost of not being able to fully manage the server and the logs and almost everything else that you have with a hosted service; that is, you lose an awful lot of control. And then, if you increase user mailboxes, your costs go up every time. I'm talking about using one or more domain names for email services and not using LookOut (outlook.com) Gmail or any other hosted email. What am I missing? Why do people choose hosted services with all the costs and the negatives? It makes no sense to me, but one client is agitating to remove their very, very low cost server that I mange on their behalf. Your thoughts? Thanks and Kind Regards AndrewM

4 6

Ubuntu 17.04, openssh certificates, ssh-agent and fights with gnome-session + gnome-keyring-ssh
by Anthony 23 Dec '17

23 Dec '17

Hey folks, I decided it was time to upgrade my SSH key, so I set about creating a new one. I reacquainted myself with ssh-keygen, created a key with recommended options, and then worried because it was failing to work. ... I then found out that the recommended options which cover for some of keygen's previous format limitations are not supported by gnome-keyring-ssh. So, I found the instructions for turning off gnome-keyring-ssh and turning on normal ssh-agent. ... but then I realised my keys still weren't propagating to programs I ran (primarily ssh + rsync using ssh from command line) So I hacked around it with some stuff in .bashrc (I know, not pretty). export SSH_AGENT_PID="${SSH_AGENT_PID:-$(ps -o pid,ppid,command -u $(whoami) | grep '[s]sh-agent' | head -n 1 | awk '{print $1}')}" export SSH_AGENT_PPID="${SSH_AGENT_PPID:-$(ps -o pid,ppid,command -u $(whoami) | grep '[s]sh-agent' | head -n 1 | awk '{print $2}')}" export SSH_AUTH_SOCK="${SSH_AUTH_SOCK:-$(find /tmp -mindepth 2 -maxdepth 2 -name "agent.${SSH_AGENT_PPID}" 2>/dev/null | head -n 1)}" ... and this worked for a little bit, but then I found that: 1. This wasn't propagating to programs invoked from launcher (think Remmina) 2. That an update of some sort was now messing with the SSH_AUTH_SOCK variable I tweaked my bashrc hack job: export SSH_AUTH_SOCK="$(find /tmp -mindepth 2 -maxdepth 2 -name "agent.${SSH_AGENT_PPID}" 2>/dev/null | head -n 1)" ... but then wondered about: 1. Why was something that looked like gnome-keyring-ssh setting the path in SSH_AUTH_SOCK to something that didn't exist 2. How I could have the right variables set early enough that things "just work" for both command line and GUI launched apps Doing some reading, it seems like some hacks have been made to gnome-session and friends on the assumption that gnome-keyring is the default, so SSH_AUTH_SOCK should always point to where it puts things. In 17.10 (which I haven't moved to yet until they figure out a stable way of doing remote desktop into a machine running Wayland - I use connection to x11vnc over SSH to be able to interact with console session), apparently there is a variable one sets called GSM_SKIP_SSH_AGENT_WORKAROUND (and I thought my .bashrc was a hack job), though the suggestions I looked at didn't give me much luck in my 17.04 configuration. So, after that large chunk of explanation :) - Anyone else using SSH certificates on a linux GUI desktop? - How are you doing it? Anthony

2 1

Humble Bundles: No Starch Press Coder stuff, Make from Make magazine
by Rodney Brown 19 Dec '17

19 Dec '17

13 Days Left Humble Book Bundle: Be a Coder by No Starch Press https://www.humblebundle.com/books/be-a-coder-books >=USD1 Learn You Some Erlang for Great Good! Learn You A Haskell for Great Good! Teach Your Kids to Code The Linux Command Line No Starch Press Sampler >=USD8 Land of Lisp Realm of Racket Clojure for the Brave and True The Art of Assembly Language (2nd ed.) Think Like a Programmer The Art of R Programming >=USD15 The Art of Debugging Code Craft Data Visualization with JavaScript Ruby Under a Microscope Understanding ECMAScript 6 >=USD18 Wicked Cool Shell Scripts (2nd ed.) The Book of R 8 Days Left Humble Book Bundle: Maker Skill Builders by Make: https://www.humblebundle.com/books/maker-skill-builders-books >=USD1 Woodworking for Young Makers Getting Started with Soldering DIY Robots: Make: Vol 55 >=USD8 Minecraft for Makers Easy Electronics mBots for Makers All Hands on Boards: Make: Vol 57 $10 off print and $5 off digital subscription to Make: magazine >=USD15 Getting Started with the micro:bit Getting Started with 3D Carving Modern Leatherwork for Makers The Community Issue: Make: Vol 58 More in 1 day 21 hours >=USD20 Zero to Maker: Learn (Just Enough) to Make (Just About) Anything (2nd ed.) Design for CNC Jumpstarting C Jumpstarting JavaScript

1 0

Check & update your Android version - Pixel Phone Help
by Andrew McGlashan 14 Dec '17

14 Dec '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi, This is probably why I stopped seeing updates.... https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_ devices Minimum update & support periods Device -- Nexus 6P No guaranteed Android version updates after -- September 2017 No guaranteed security updates after -- November 2018 No guaranteed telephone or online support after -- November 2018 So... insofar as official updates go, my phone will likely expire it's useful life in November, 2018. Unless I go with non-stock ROMs by then. I was a bit annoyed not to get the 6th Novebmer patch that was the one that fixes the KRACK problem, but it's all good now; pity anyone whom has this phone and [probably] won't get updates without sideloading though :( Kind Regards AndrewM -----BEGIN PGP SIGNATURE----- iF4EAREIAAYFAloxEm0ACgkQqBZry7fv4vtb7gD9F+s9gHTVeIEzQSbdTnZ8JEwH +bixCCuW8HgBXJ/SEvkBAKO0WVjvVV0rccOS5aGgIsKFWV9CIrQJWwBOR338PcpT =CyHw -----END PGP SIGNATURE-----

4 5

Full OTA Images for Nexus and Pixel Devices | Google APIs for Android | Google Developers
by Andrew McGlashan 13 Dec '17

13 Dec '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi, My Nexus 6P was stuck on 5th November security level, I knew there was a 6th November update, but I never got it for some reason; then the 5th December update come out. Android version 8.0.0 So, I found this page and downloaded 8.1.0 for the phone and sideloaded the update (no root required). https://developers.google.com/android/ota#angler Now it is all up to date again. Kind Regards AndrewM -----BEGIN PGP SIGNATURE----- iF4EAREIAAYFAloxD1sACgkQqBZry7fv4vtDvAEAmGlljNQaVZQVUSym1TCtXV3W aBdQ08Ugk7bbVlNh7aUBAKeZzK14f+Igtwjc7kX12QTZbJBT3qWhUiV+n+e6oVh3 =SgBC -----END PGP SIGNATURE-----

1 0