July 2016 - Talk - lists.gtalug.org

Are you on the watch list?
by Evan Leibovitch 18 Jul '16

18 Jul '16

Sheesh, Five eyes or not, this is unwelcome. http://www.in.techspot.com/news/security/nsa-classifies-linux-journal-reade… -- Evan Leibovitch Geneva, CH Em: evan at telly dot org Sk: evanleibovitch Tw: el56

8 28

Re: [GTALUG] Are you on the watch list?
by James Knott 17 Jul '16

17 Jul '16

On 07/17/2016 01:17 AM, ac via talk wrote: > many problems humans face has a very simple explanation: greed > (and then the keyword in the above sentence is also:humans) Yep, it all boils down to what humans do, be it Bopal, Lac Megantic, the 2008 bust and much, much more. Far too often it boils down to blatant greed, the consequences be damned.

1 0

Microsoft doesn't have to give US government foreign data, says court - TechRepublic
by James Knott 15 Jul '16

15 Jul '16

http://www.techrepublic.com/article/microsoft-doesnt-have-to-give-us-govern…

1 0

The New Skype Alpha.
by scott＠ss.org 15 Jul '16

15 Jul '16

https://community.skype.com/t5/Linux/Skype-for-Linux-Alpha-and-calling-on-C… Just some initial impressions. This is on a Fedora 19 systems (don't ask, long story..). I don't have a Mic on this system, so I haven't made any test calls yet. Packaging: ========== Packages are 64-bit only... we've been asking and asking, and we get it finally, but 32-bit gets nothing. Irony. Single RPM file. A yum install identified no dependencies (so likely all backed in). The old fedora rpms used to actually use the Fedora libraries. The RPM installs a .repo so yum will automatically pull updates. What is arrogant and sneaky is it also installs an AT script which automatically imports the GPG key for that repo. Additionally, and Google Chrome shares this habit, the .repo file isn't in the file-list. So it's being dynamically generated at install time. Logging in: =========== Asks to store the password in A keyring. I can't tell if this the KDE key-ring, or the GNOME key-ring. But the FAQ says GNOME... I'm a KDE user. Gnome Keyring's dialog also stole focus on the keyboard. Not Skype's fault, but annoying. As I don't use this feature, I clicked cancel and the login continued. But it asks every time you login. https://support.skype.com/en/faq/FA34656/more-information-about-skype-for-l… Settings: ========= Going into settings, I see 6 options. 4 for showing content in messaging, and 2 drop-downs under privacy. In the old skype, you could control audio inputs and outputs, and had a quick launch button for a test call. All of that seem to just not be there. I find this irksome as there are a lot of fake 'skype call testing service' accounts. And I don't want to play in that mine field. Yes. This is defiantly and Alpha. -- Scott Sullivan

6 8

Re: [GTALUG] Email problem and some observations.
by Alvin Starr 14 Jul '16

14 Jul '16

On 07/14/2016 09:55 AM, ac via talk wrote: > On Thu, 14 Jul 2016 09:28:48 -0400 > Alvin Starr via talk <talk(a)gtalug.org> wrote: >> A bitof history to start off. >> Years ago we started putting spf records in our domains and email >> clients domains and that is mostly where things stuck. >> For the most part is was of little help but generally putting a >> correctlyconfigured SPF statement did not hurt. >> > spf records already help a lot with spam/abuse True enough but hype and initial exuberance did not quite pan out the way some claimed. But it does work and helps. > >> I recentlydiscovered DMARC and decided to implement it on my own >> domain as an experiment. > DMARC has real interesting reporting, but many ISP's do not even > respond to abuse@ so... we are a long way off from a perfect world :) Sadly the usual addresses like postmaster and abuse make for an easy target for spammers so its the kind of address that gets quickly ignored. Postmaster is so bad the its almost all noise now. > > Like your SPF v=spf1 mx a:mail.netvel.net ip4:54.236.96.217/32 -all > many email servers will disregard even the -all (and the entire SPF) I was looking at an email problem yesterday and got a message from a spam filtering service that my client uses. "1) The simplest, and since SPF is only beneficial to large corporate domains, we would suggest that they log into their DNS Providers site and delete their SPF record." With that kind of attitude its not surprising that SPF is used at all. > >> After running for a while and looking at the information that came >> back from the other dmarcians I noticed some interesting trends. >> >> 1) Some days there are lots of spam messages sent to google as >> someone on my domain (likely me). >> 2) There are not a whole lot of people who are honouring dmarc and >> sending status messages. > nope... and there are soo many that do not even respond to direct > complaints.. recently on RIPE anti-abuse, an abuse-c record addition > failed, due to simply too many objections... - If people/society does > not even want to accept responsibility for what they transmit - how will > they to co-op with DMARC... I cannot help all those that will not work within the system but enough people are using DMARC that it is causing problems for mail list operators so its gaining some traction. > >> 3) Something in my network is sending mail to CheatCodes.com >> Here is a snippet from my dmarc log. >> >> Wed, 06 Jul 2016 14:47:25 -0400 CheatCodes.com 12 >> Thu, 07 Jul 2016 19:59:59 -0400 google.com 2 >> Thu, 07 Jul 2016 19:59:59 -0400 Yahoo! Inc. 2 >> Fri, 08 Jul 2016 11:29:47 -0400 CheatCodes.com 10 >> Sun, 10 Jul 2016 17:19:04 -0400 CheatCodes.com 3 >> Mon, 11 Jul 2016 19:59:59 -0400 google.com 2 >> Mon, 11 Jul 2016 14:45:57 -0400 CheatCodes.com 12 >> Tue, 12 Jul 2016 12:00:00 -0400 Microsoft Corp. 1 >> Tue, 12 Jul 2016 19:59:59 -0400 google.com 591 >> Tue, 12 Jul 2016 19:59:59 -0400 Yahoo! Inc. 8 >> Tue, 12 Jul 2016 15:22:56 -0400 CheatCodes.com 13 >> Wed, 13 Jul 2016 19:59:59 -0400 google.com 785 >> Wed, 13 Jul 2016 14:49:03 -0400 CheatCodes.com 3 >> >> So about cheatcodes.com. > hmm, looks like this could be a fake reverse zone for a private ip on > your home pvt network? > If you look at my headers I have a pvt range setup with a inaddr to > cow.co.za :) - my DMARC would report "cow.co.za" on the sec gw > 192.168. - otherwise you could have malware, either way - you should > have fun figuring it out :) DMARC reports the sending IP. and in my case the sending ip is my firewall. That is what got me going. I know it cannot be my laptop because that runs Linux and we all know that is impervious to hacks. OOPS. My android phones also run Linux(of sorts)... Possibly its time to re-evaluate this belief. > > -- Alvin Starr || voice: (905)513-7688 Netvel Inc. || Cell: (416)806-0133 alvin(a)netvel.net ||

2 1

Email problem and some observations.
by Alvin Starr 14 Jul '16

14 Jul '16

A bitof history to start off. Years ago we started putting spf records in our domains and email clients domains and that is mostly where things stuck. For the most part is was of little help but generally putting a correctlyconfigured SPF statement did not hurt. I recentlydiscovered DMARC and decided to implement it on my own domain as an experiment. After running for a while and looking at the information that came back from the other dmarcians I noticed some interesting trends. 1) Some days there are lots of spam messages sent to google as someone on my domain (likely me). 2) There are not a whole lot of people who are honouring dmarc and sending status messages. 3) Something in my network is sending mail to CheatCodes.com Here is a snippet from my dmarc log. Wed, 06 Jul 2016 14:47:25 -0400 CheatCodes.com 12 Thu, 07 Jul 2016 19:59:59 -0400 google.com 2 Thu, 07 Jul 2016 19:59:59 -0400 Yahoo! Inc. 2 Fri, 08 Jul 2016 11:29:47 -0400 CheatCodes.com 10 Sun, 10 Jul 2016 17:19:04 -0400 CheatCodes.com 3 Mon, 11 Jul 2016 19:59:59 -0400 google.com 2 Mon, 11 Jul 2016 14:45:57 -0400 CheatCodes.com 12 Tue, 12 Jul 2016 12:00:00 -0400 Microsoft Corp. 1 Tue, 12 Jul 2016 19:59:59 -0400 google.com 591 Tue, 12 Jul 2016 19:59:59 -0400 Yahoo! Inc. 8 Tue, 12 Jul 2016 15:22:56 -0400 CheatCodes.com 13 Wed, 13 Jul 2016 19:59:59 -0400 google.com 785 Wed, 13 Jul 2016 14:49:03 -0400 CheatCodes.com 3 So about cheatcodes.com. All the traffic to cheatcodes is comming from the outside address of my firewall either home or cottage. Since I only email via submission to my external mail-server there is nothing inside my domain that should be sending email. So I blocked ports 25,2525 and a few other well known ports for email but still the mail is flowing. Then I blocked the cheatcodes MX address class C... Still flowing. I noticed that the IP source of the messages moved with my changing location. There are only 3 connected things that will move between these locations. My laptop and 2 Android phones. I guess its time to start more serious tracking of traffic from my portable devices. So someone is connected and sending messages through non-regular channels to CheatCodes.com. This disturbs me. I intend to keep working on this. But it makes me ask the question: Who would go so far as to setup a surreptitious email link and then run it through DMARC? I have to admit that I kind of like DMARC. It is letting me get a feel for how much abuse of my domain is going on and it is way more than I thought. Its by no means a spam solution but it can cut down spam generated in my name. -- Alvin Starr || voice: (905)513-7688 Netvel Inc. || Cell: (416)806-0133 alvin(a)netvel.net ||

2 1

Re: [GTALUG] Heads Up
by Kevin Cozens 14 Jul '16

14 Jul '16

On 16-07-13 01:43 AM, ac via talk wrote: > Just started seeing many email attachments with .html active > javascript ransomware in base64 fully loaded anyway this is going > to be the new normal, disabling javascript on email clients as filtering > these will be challenging) > > so, if you are not using mutt or custom email (like moi) I would > strongly suggest not opening any .html attachments without disabling > Javascript I set my email program to treat all my mail/mailinglist messages as text only. I don't need to act like a web browser and show me nicely formatted pages as I have a separate program for that. Viewing messages as simple text means you don't should not have to worry about any attempt to include something other than simple text. -- Cheers! Kevin. http://www.ve3syb.ca/ |"Nerds make the shiny things that distract Owner of Elecraft K2 #2172 | the mouth-breathers, and that's why we're | powerful!" #include <disclaimer/favourite> | --Chris Hardwick

2 1

Heads Up
by ac 13 Jul '16

13 Jul '16

Just started seeing many email attachments with .html active javascript ransomware in base64 fully loaded anyway this is going to be the new normal, disabling javascript on email clients as filtering these will be challenging) so, if you are not using mutt or custom email (like moi) I would strongly suggest not opening any .html attachments without disabling Javascript I also operate http://ascams.com and currently public dnsbl's here: block.ascams.com and superblock.ascams.com - unfortunately these are quite strict as most of facebook and twitter is blocked (for abuse - both those do not react to spam/abuse/phish and other issues - whereas Google and Microsoft generally do... - go figure) - anyway, ymmv, but use for scoring and not for hard bounce (at my present employer we use for hard bounce, but we have multiple neural net abuse nodes, so without that you may have too many fp's) I also track bots, (anything from ZeUS, XOR, 0access etc as well as the controllers :) payload ip's etc (which go to superblock.ascams.com ) the bots I am listing here at the moment http://spamid.net (yes, I also operate spamid.net - but I am thinking about merging spamid.net with ascams.com - as my focus is becoming more and more cybercrime, data and tracking bad bots I am presently writing an edi for abuse nodes, as it is neural it is challenging to stick to the kiss principle, and I will publish this somewhere shortly.. Andre

1 0

Re: [GTALUG] [GTALUG-Announce] GTALUG Meeting Tomorrow at 7:30pm
by Sammy Lao 12 Jul '16

12 Jul '16

Myles, Please send an unencrypted version. Thanks! Sent from my mobile > On Jul 11, 2016, at 1:27 PM, Myles Braithwaite via talk <talk(a)gtalug.org> wrote: > > PGh0dHA6Ly9ndGFsdWcub3JnL21lZXRpbmcvMjAxNi0wNy8+CgojIFRoZSBEb2N1bWVudCBGb3Vu > ZGF0aW9uIHdpdGggR2lvdmFubmkgQ2FsaWdhcmlzCgpBbiBpbnRyb2R1Y3Rpb24gb2Ygd2hhdCAq > KkxpYnJlT2ZmaWNlKiogaXMsIHdoYXQgaXMgKipUaGUgRG9jdW1lbnQKRm91bmRhdGlvbioqLCBo > b3cgdGhleSB3b3JrIGFuZCB3aGF0IHRoZXkgZG8uIFRoZSBiZW5lZml0cyBvZgpjb250cmlidXRp > bmcgdG8gTGlicmVPZmZpY2UgYW5kIGhvdyBjYW4geW91IGltcHJvdmUgeW91ciBza2lsbHMuCgoj > IyBMb2NhdGlvbgoKR2VvcmdlIFZhcmkgRW5naW5lZXJpbmcgYW5kIENvbXB1dGluZyBDZW50cmUK > MjQ1IENodXJjaCBTdHJlZXQsIFJvb20gMjAzClJ5ZXJzb24gVW5pdmVyc2l0eQoKPGh0dHA6Ly9n > b28uZ2wvbWFwcy8xNm9KMj4KCjxodHRwOi8vd3d3Lm9wZW5zdHJlZXRtYXAub3JnL3dheS8yMzQ0 > NzUyNT4KCiMjIFNjaGVkdWxlCgoqIDY6MDAgcG0gLSBQbGVhc2UgZGlzY3VzcyBvbiB0aGUgZ2Vu > ZXJhbCBtYWlsaW5nIGxpc3QgKGkuZS4KPHRhbGtAZ3RhbHVnLm9yZz4pIHdoZXJlIHlvdSB3YW50 > IHRvIGdvIGZvciBkaW5uZXIuCiogNzozMCBwbSAtIE1lZXRpbmcgYW5kIHByZXNlbnRhdGlvbi4K > KiA5OjAwIHBtIC0gQWZ0ZXIgZWFjaCBtZWV0aW5nIGEgZ3JvdXAgb2YgR1RBTFVHZXJzIG1vdmUg > dG8gdGhlIFRoZQpJbXBlcmlhbCBQdWIgKDU0IER1bmRhcyBTdCBFYXN0KSBmb3IgcmVmcmVzaG1l > bnRzIGFuZCBtb3JlCnNvY2lhbGl6aW5nLgoKIyBDb2RlIG9mIENvbmR1Y3QKCldlIHdhbnQgYSBw > cm9kdWN0aXZlIGhhcHB5IGNvbW11bml0eSB0aGF0IGNhbiB3ZWxjb21lIG5ldyBpZGVhcywKaW1w > cm92ZSBldmVyeSBwcm9jZXNzIGV2ZXJ5IHllYXIsIGFuZCBmb3N0ZXIgY29sbGFib3JhdGlvbiBi > ZXR3ZWVuCmluZGl2aWR1YWxzIHdpdGggZGlmZmVyaW5nIG5lZWRzLCBpbnRlcmVzdHMgYW5kIHNr > aWxscy4KCldlIGdhaW4gc3RyZW5ndGggZnJvbSBkaXZlcnNpdHksIGFuZCBhY3RpdmVseSBzZWVr > IHBhcnRpY2lwYXRpb24gZnJvbQp0aG9zZSB3aG8gZW5oYW5jZSBpdC4gVGhpcyBjb2RlIG9mIGNv > bmR1Y3QgZXhpc3RzIHRvIGVuc3VyZSB0aGF0CmRpdmVyc2UgZ3JvdXBzIGNvbGxhYm9yYXRlIHRv > IG11dHVhbCBhZHZhbnRhZ2UgYW5kIGVuam95bWVudC4gV2Ugd2lsbApjaGFsbGVuZ2UgcHJlanVk > aWNlIHRoYXQgY291bGQgamVvcGFyZGl6ZSB0aGUgcGFydGljaXBhdGlvbiBvZiBhbnkKcGVyc29u > IGluIHRoZSBjb21tdW5pdHkuCgpUaGUgQ29kZSBvZiBDb25kdWN0IGdvdmVybnMgaG93IHdlIGJl > aGF2ZSBpbiBwdWJsaWMgb3IgaW4gcHJpdmF0ZQp3aGVuZXZlciB0aGUgTGludXggY29tbXVuaXR5 > IHdpbGwgYmUganVkZ2VkIGJ5IG91ciBhY3Rpb25zLiBXZSBleHBlY3QKaXQgdG8gYmUgaG9ub3Jl > ZCBieSBldmVyeW9uZSB3aG8gcmVwcmVzZW50cyB0aGUgY29tbXVuaXR5IG9mZmljaWFsbHkKb3Ig > aW5mb3JtYWxseSwgY2xhaW1zIGFmZmlsaWF0aW9uLCBvciBwYXJ0aWNpcGF0ZXMgZGlyZWN0bHku > IEl0CmFwcGxpZXMgdG8gYWN0aXZpdGllcyBvbmxpbmUgb3Igb2ZmbGluZS4KCldlIGludml0ZSBh > bnlib2R5IHRvIHBhcnRpY2lwYXRlLiBPdXIgY29tbXVuaXR5IGlzIG9wZW4uCgpQbGVhc2UgcmVh > ZCBtb3JlIGFib3V0IHRoZSBHVEFMVUcgQ29kZSBvZiBDb25kdWN0IGhlcmU6CjxodHRwOi8vZ3Rh > bHVnLm9yZy9hYm91dC9jb2RlLW9mLWNvbmR1Y3QvPi4KCklmIHlvdSBoYXZlIGFueSBxdWVzdGlv > bnMsIGNvbW1lbnRzLCBvciBjb25jZXJucyBhYm91dCB0aGUgR1RBTFVHIENvZGUKb2YgQ29uZHVj > dCBwbGVhc2UgY29udGFjdCB0aGUgR1RBTFVHIEJvYXJkIEAgPGJvYXJkQGd0YWx1Zy5vcmc+Lgot > LS0KR1RBTFVHIEFubm91bmNlIG1haWxpbmcgbGlzdAphbm5vdW5jZUBndGFsdWcub3JnCmh0dHBz > Oi8vZ3RhbHVnLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2Fubm91bmNlCi0tLQpUYWxrIE1haWxpbmcg > TGlzdAp0YWxrQGd0YWx1Zy5vcmcKaHR0cHM6Ly9ndGFsdWcub3JnL21haWxtYW4vbGlzdGluZm8v > dGFsawo=

3 2

OwnCloud vs Nextcloud?
by D. Hugh Redelmeier 12 Jul '16

12 Jul '16

Nextcloud forked OwnCloud last month and made its first release this month. <http://www.zdnet.com/article/nextcloud-adds-enterprise-support-and-ios-appl…> Includes links to "Related Stories". Does anyone have any insight into which would be worth adopting? Or something else? - it looks as if more devs went with Nextcloud - both are trying to make a commercial go of it. I fear that this doesn't match my desire for open source from an open project. - I cringe at PHP. Especially since I'd like to expose my installation to the internet.

5 8