September 2019 - Talk - lists.gtalug.org

Re: [GTALUG] SPF and Anti Forgery
by Dave Collier-Brown 20 Sep '19

20 Sep '19

On 2019-09-20 8:55 a.m., ac via talk wrote: > I have noticed something interesting in > the email you just sent to the list, so I have started a new thread... :) > > Your sent email, came in marked as SPAM, and I wondered why... > > yes, it is from Google, who sends a lot of spam, scams etc. but that > alone should not get it marked as spam... So, I looked and it is so > interesting... (maybe I need a life :) ) > > Dave, in the headers you literally have three email addresses: > Relayed For: <davec-b(a)rogers.com> - No SPF / Anti Forgery > Cc:<davecb.42(a)gmail.com> - Which is currently a -> ~all > Reply-To: davecb(a)spamcop.net and your SpamCop receive only addy, > also a -> ~all > > Which is why your relay is scored additional, as this is also what > spammers do very frequently (They use (rather abuse) @gmail with a reply > to of @outlook.com, etc) > > It is also interesting, that Google, probably in the interests of > becoming a better netizen?, has again started including relay headers, > again, after not including same for a long while... > > Anyway, long winded, but here is the question: Do you not find many > fake sent from and backscatter issues to your @rogers.com? If yes, why > even still use it in your Thunderbird config? > > Andre That's an artifact of fighting with outgoing mail relays: in principle it should go out via Rogers Yahoo, but it and Google take turns being broken. Spamcop was bought by cisco, who dropped their outgoing relay offering, otherwise that's all Id ever use. This one may be better or worse, as it's from my work address. Alas, they use paid-for Microsoft services, which may be broken in different ways. --dave -- David Collier-Brown, | Always do right. This will gratify System Programmer and Author | some people and astonish the rest dave.collier-brown(a)indexexchange.com | -- Mark Twain CONFIDENTIALITY NOTICE AND DISCLAIMER : This telecommunication, including any and all attachments, contains confidential information intended only for the person(s) to whom it is addressed. Any dissemination, distribution, copying or disclosure is strictly prohibited and is not a waiver of confidentiality. If you have received this telecommunication in error, please notify the sender immediately by return electronic mail and delete the message from your inbox and deleted items folders. This telecommunication does not constitute an express or implied agreement to conduct transactions by electronic means, nor does it constitute a contract offer, a contract amendment or an acceptance of a contract offer. Contract terms contained in this telecommunication are subject to legal review and the completion of formal documentation and are not binding until same is confirmed in writing and has been signed by an authorized signatory.

1 0

Was: Linux kernel 5.3 - Now: SPF and Anti Forgery
by ac 20 Sep '19

20 Sep '19

On Fri, 20 Sep 2019 08:00:10 -0400 David Collier-Brown via talk <talk(a)gtalug.org> wrote: > On 2019-09-19 11:11 p.m., William Park via talk wrote: > > I just tried kernel 5.3.0, and it's noticeably faster in opening > > windows. Not sure about overall throughput, though. > I'd be interested in how quick it is in unblocking processes who just > got I/O. I have servers doing arrays of heavily parallel network > requests who race each other to get back, but /then / compete to get > a core to service them. > --dave > Please do accept my apology in advance, I do not mean or intend to hijack an existing thread, but I have noticed something interesting in the email you just sent to the list, so I have started a new thread... :) Your sent email, came in marked as SPAM, and I wondered why... yes, it is from Google, who sends a lot of spam, scams etc. but that alone should not get it marked as spam... So, I looked and it is so interesting... (maybe I need a life :) ) Dave, in the headers you literally have three email addresses: Relayed For: <davec-b(a)rogers.com> - No SPF / Anti Forgery Cc:<davecb.42(a)gmail.com> - Which is currently a -> ~all Reply-To: davecb(a)spamcop.net and your SpamCop receive only addy, also a -> ~all Which is why your relay is scored additional, as this is also what spammers do very frequently (They use (rather abuse) @gmail with a reply to of @outlook.com, etc) It is also interesting, that Google, probably in the interests of becoming a better netizen?, has again started including relay headers, again, after not including same for a long while... Anyway, long winded, but here is the question: Do you not find many fake sent from and backscatter issues to your @rogers.com? If yes, why even still use it in your Thunderbird config? Andre

1 0

CentOS 8 - Sept 24th
by Scott Sullivan 19 Sep '19

19 Sep '19

With the release work for 7.7 completed, we now have a release date for CentOS 8. Tuesday Sept. 24th. https://wiki.centos.org/About/Building_8 As I already run a split CentOS/Fedora environment, I'm looking forward to the usual reduction in differences for my Ansible playbooks. -- Scott Sullivan

1 0

anyone here build pro computer workstations?
by Karen Lewellen 18 Sep '19

18 Sep '19

Hope the topic is not ot: but I have a colleague looking to have a pro studio workstation built. They have the funds to pay for the talent, and the specs they have in mind. Think mid to high end daw, but in windows 10 professional. Any takers? Kare

6 12

Docker-based Mail Server
by Christopher Browne 18 Sep '19

18 Sep '19

A colleague at work (in the US) found that his ISP was going to outsource his email to Microsoft and charge $25/month for that. He poked around, and found his own personal "outsourcing" in the form of the following... https://github.com/tomav/docker-mailserver Explained further here: https://tvi.al/simple-mail-server-with-docker/ -- When confronted by a difficult problem, solve it by reducing it to the question, "How would the Lone Ranger handle this?"

4 3

"Atom Pi"
by D. Hugh Redelmeier 17 Sep '19

17 Sep '19

This is an inexpensive Atom-based Single-Board Computer (SBC). It created a flurry on Amazon a few months ago and then seemed to go out of stock. I just assumed that it was some surplus board that was being blown out. Maybe it is. Now it is being sold by AmeriDroid, a distributor/vendor of several interesting single-board computers. Cheap! https://ameridroid.com/products/atomic-pi Why I think that this is interesting: - SBC is an interesting form factor - cheap: US$37.95 for board + US$12.95 for power + ? for shipping. That's cheaper than a Raspberry Pi 4b with 4GiB. - x86 so any off-the-shelf distro should work. And the video driver is in-tree open source (a big missing piece with ARM). It would run Windows 10 but has no licence. - OK resources: + Intel Atom x5-Z8350 (hence name) + 2G RAM (not expandable) + 16G eMMC (preloaded with some Linux) (should perform better than Raspi's SD) + SD socket (supports up to 256G) + gigabit ethernet, dual band WiFi, Bluetooth + some kind of potentially interesting audio amplifier + HDMI + USB 3.0 port + fanless, with a big heat sink - oddities + need to add a weird power supply connector and a power supply + need to add WiFi antennae + no case + I don't really understand the choice of power supplies offered by AmeriDroid. The cheaper one has higher output (possibly useful in support of the audio amp). Why I won't buy it: - I have too many small PCs already. And too many unfinished projects. - 2GiB is a little cramped these days. First-world problem! But it is certainly fine for most SBC applications. I recommend browsing Ameridroid.com for other interesting toys.

6 10

Suspend/resume not working with latest kernel in Debian unstable/sid
by Daniel Wayne Armstrong 16 Sep '19

16 Sep '19

On my old C720 Chromebook, in the past I have needed to add `GRUB_CMDLINE_LINUX_DEFAULT="tpm_tis.force=1"` to GRUB to enable suspend/resume to work properly in Debian. After a fresh re-install and upgrade to Debian unstable/sid, suspend/resume is not working with kernel 5.2.9-2. System will suspend, but trying to resume results in a hard reboot. I think the problem is with tpm_tis. Messages in the log upon boot ... ``` $ journalctl -b | grep tpm Sep 16 18:18:01 cruithne kernel: tpm_tis tpm_tis: 1.2 TPM (device-id 0xB, rev-id 16) Sep 16 18:18:01 cruithne kernel: tpm tpm0: tpm_try_transmit: send(): error -5 Sep 16 18:18:01 cruithne kernel: tpm tpm0: A TPM error (-5) occurred attempting to determine the timeouts Sep 16 18:18:01 cruithne kernel: tpm_tis tpm_tis: Could not get TPM timeouts and durations Sep 16 18:18:01 cruithne kernel: tpm_tis 00:08: 1.2 TPM (device-id 0xB, rev-id 16) Sep 16 18:18:01 cruithne kernel: tpm tpm0: tpm_try_transmit: send(): error -5 Sep 16 18:18:01 cruithne kernel: tpm tpm0: A TPM error (-5) occurred attempting to determine the timeouts Sep 16 18:18:01 cruithne kernel: tpm_tis 00:08: Could not get TPM timeouts and durations Sep 16 18:18:01 cruithne kernel: tpm_inf_pnp 00:08: Found TPM with ID IFX0102 ``` Suspend/resume *does* continue to work with kernel 4.19.67-2 (current default in Debian stable). Messages in the log ... ``` Sep 16 18:00:38 cruithne kernel: tpm_tis 00:08: 1.2 TPM (device-id 0xB, rev-id 16) Sep 16 18:00:38 cruithne kernel: tpm tpm0: [Firmware Bug]: TPM interrupt not working, polling instead ``` Removing the "tpm_tis.force=1" line from GRUB when booting into kernel 5.2.9-2 makes no difference. A google search with "tpm tpm0" "tpm_try_transmit" "error -5" "A TPM error (-5) occurred attempting to determine the timeouts" returns NO hits. Dropping the last term is a bit more successful but still leads me to no solution. Any ideas how I might get this to work with the latest kernel 5.2*? Thanks in advance! -- Daniel Wayne Armstrong https://www.circuidipity.com <http://www.circuidipity.com> Accomplish the great task by a series of small acts. -- Lao Tzu

2 1

Script to show HTTP(S) and TLS details for a website
by Giles Orr 16 Sep '19

16 Sep '19

This may be seen as self-promotion - that's not totally wrong. But I think this may also be useful to others and (as I acknowledge in the blog post) I'm quite pleased with the resultant script. Over the past year and a half I've slowly developed a shell script that gives a concise summary of the state of TLS and HTTP(S) on a given website. It looks like this: $ tlsdetails google.ca Using OpenSSL: /usr/bin/openssl Expiry Date: Oct 27 17:27:07 2019 GMT (78 days) Issuer: Google Trust Services, CN TLS Versions: tls1_3 tls1_2 tls1_1 tls1 (tried but unavailable: ssl3 ssl2 ) HTTP Version: 2 I first started work on it after a couple embarrassing certificate expiries. It then grew to check the Issuer, TLS versions, and more recently whether or not a site supports HTTP2. (The pointer to the OpenSSL version is shown because the script will also run on Mac, and their version of 'openssl' is problematic at best. That line is of course easy to remove if you don't like it.) If you're interested, you can find the details here: https://www.gilesorr.com/blog/tls-https-details.html Any suggestions to improve the script would be most welcome. -- Giles https://www.gilesorr.com/ gilesorr(a)gmail.com

8 19

tilde.club reopens signups (vaguely off-topic)
by Stewart C. Russell 16 Sep '19

16 Sep '19

Hey — Aligned with the small scale, homebrew hosting that I know that some of you were/are involved in, I see that tilde.club <https://tilde.club/> has reopened its member lists: https://tilde.club/signup/ tilde.club is small web hosting with ssh access. You only get a (comparatively) tiny amount of space. It's named from earlyweb days, when user pages were at hostname/~user. They've been stalled for new members for 4 years as the organizer couldn't quite give it the attention it needed. Announcement from the bird site: A tildeverse-builder named Mike Buchholz (info(a)retrodigital.net) offered to take over http://tilde.club <http://tilde.club> AND the backlog of 10,000+ people who asked for accounts. I said, that would be a blessing! If you had an account, it still works. If you asked, they'll be in touch. — Paul Ford (@ftrain) 9:21 AM - 13 Sep 2019 https://twitter.com/ftrain/status/1172545886968324098 I always meant to set up a tilde node (I think I still have the domain and hosting, even) but tildeverse admin requires a certain attachment to IRC and that's someone else's trash fire. cheers, Stewart

1 0

detecting whether a recipient has read email you sent
by D. Hugh Redelmeier 15 Sep '19

15 Sep '19

In Evan's talk, he showed how the mailing list software he used could report how many recipients had read each message. I asked how that worked. This devolved into a discussion with more heat than light. So I looked into this a bit. I was puzzled because, generally speaking, mail servers talk to each other but Mail User Agents generally don't. And yet only MUAs know when a message is read. RFC 8098 <https://tools.ietf.org/html/rfc8098> describes a MIME mechanism for "Message Disposition Notification". For example, an email sender can request the the user's MUA send back notification when a message is read. Apparently some MUAs implement this and some don't. Alpine, my MUA, can issue an MDN request but will not respond to one. Mozilla products seem to be able to optionally respond. I suspect that Outlook unconditionally responds. There are other variations on this <https://en.wikipedia.org/wiki/Email_tracking> I'm going to try to set DSN on this message.

1 0