April 2020 - Talk - lists.gtalug.org

war story: power failure makes CentOS system unbootable
by D. Hugh Redelmeier 30 Sep '22

30 Sep '22

tl;dr / spoiler: change fstab so that /boot/efi is not automatically mounted. See the recommendation at the end of this message. My gateway computer is a little PC running CentOS. It does not come back after a power failure. The reason (as best I can tell) is interesting and I think that I have a fix. My system is UEFI. It boots from a UEFI system partition, known as /boot/efi to Linux. If this gets corrupted, it won't boot. It is a VFAT partition. On my gateway (a Zotac Zbox RI321, a cute little box with two ethernet ports), the UEFI firmware apparently won't boot if the dirty bit is set in the system partition. CentOS normally runs with /boot/efi mounted. So when the system isn't shut down cleanly, the dirty bit will be on. Consequence: the system is not going to boot after a power failure. Odd observation 1: if I put a live Fedora 25 USB stick in the system and try to boot in this otherwise-unbootable state, CentOS boots from the main disk. So this really looks like a firmware bug/quirk. Odd observation 2: fsck doesn't seem to automatically fix the system partition. Once CentOS 7 booted, I dismounted /boot/efi and did an fsck on it. $ sudo fsck /dev/sda1 fsck from util-linux 2.23.2 fsck.fat 3.0.20 (12 Jun 2013) 0x25: Dirty bit is set. Fs was not properly unmounted and some data may be corrupt. 1) Remove dirty bit 2) No action ? 1 Leaving filesystem unchanged. /dev/sda1: 16 files, 2420/51145 clusters Googling got me to <https://www.centos.org/forums/viewtopic.php?t=50917> In particular, this advice seemed quite good: ==== recommendation ==== Two other changes I recommend for UEFI systems, to each OS's /etc/fstab. - For the /boot/efi mountpoint, add the mount options x-systemd.automount,noauto - Change fs_passno (last column) to a 1 or 2; the canonical fstab instructions suggest 2, but systemd treats 1 and 2 as the same. The first change means the EFI System partition will not be automatically read-write mounted at boot time; it's a bad idea this is the default because it puts the ESP at risk especially if ther are crashes, FAT has no journal and will therefore always be marked dirty in such a case; no other UEFI OS mounts the ESP by default. Second, if anything tries to access /boot/efi (read or write), systemd will automatically mount it, and because of the fs_passno 1 or 2, it will fsck it first and that fixes and clears the dirty bit in case it's set. Right now without these changes, it's just a matter of having the right number and bad timing of crashes to render the EFI System partition corrupt.

3 9

security threats of Open Source
by D. Hugh Redelmeier 25 Nov '20

25 Nov '20

<https://www.zdnet.com/article/microsoft-spots-malicious-npm-package-stealin…> This article list six cases of malware contributed to npm (the repo for sharing node.js and JavaScript source). How many undetected cases exist? I've alway pretended that Linux distros vet their code. I'm not sure how true that is. Probably the greatest protection is the time delay between contribution and distribution. I wonder what can be done about this problem. I've said so at our meetings a few times too. Of course the problem is worse with closed source: it is impossible to audit the source. But closed source might have fewer contributors and more supervision. Of course much closed soure is built on top of open source and thuse all its weakness

7 12

Re: [GTALUG] CIRA officially launches free DNS firewall for consumers | IT World Canada News
by Sadiq Saif 16 May '20

16 May '20

On 2020-04-28 09:16, ac via talk wrote: > On Tue, 28 Apr 2020 08:13:11 -0400 > > How about just plain old DNSSEC? > (instead of a nanny) - yay, IT Works! - and is so mature > already...(without all the risks of having/using a nanny) DNSSEC and DNS-over-HTTPS/DNS-over-TLS are not the same thing and don't protect against the same threats. DNSSEC protects against DNS cache poisoning by verifying the digital signature and therefore integrity of the zone's contents. That is, it provides authentication not encryption. DOH/DOT provides transport level encryption of the contents of the DNS packets themselves from the host to it's resolver. This provides protection against packet snooping on the wire, for example on an unsecured WiFi connection. > and using connectivity providers (instead of third parties and dns over > https) -- for caching/recursive, like Bell (Bell CA actually does not > track/record/monetise their users DNS querries afaik) I would love if Bell.ca offered DOH/DOT service on their recursive/caching resolvers. > again, dnssec already protects users, it just needs wider adoption, > which is the issue.. .as for "shared" domains like outlook.com - abuse > management costs will increase? - which is probably why dnssec has > never caught on, it is not "sexy" (like some nannies...) DNSSEC adoption is indeed a problem. IMHO, this is because it is a pain to implement properly and provides little benefit to the user of the zone in most cases. Improperly signing a zone will result in it not resolving which is one hell of a failure mode for most people to put up with. I only recently started signing my domains again and that is only because my managed DNS provider made it very simple, as in I click a button, zone is signed and I add the ZSK digest to my domain registrar. Further reading on DOH/DOT and DNSSEC: DNS Wars by Geoff Huston https://blog.apnic.net/2019/11/04/dns-wars/ DNSSEC https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions -- Sadiq Saif https://sadiqsaif.com

3 2

Acer Aspire 3 A315-21 laptop has mono sound only?
by Ken Heard 03 May '20

03 May '20

I think that this particular laptop has mono sound. I have been using it temporarily to stream content by HDMI to a LG HD monitor and then by fibre optical cable to a NED D3020 V2 hybrid amplifier and finally to a pair of bass reflect speakers. Unfortunately sound comes out of only one speaker. After extensive tests I have determined to my satisfaction that the problem is in the laptop. I can test the two speakers built in the laptop separately, but I have no way of knowing whether the sound so produced is mono or stereo. I could find no specs for this laptop with details about the sound card. Lack of such specs indicates to me that Acer does not want people to know that this laptop is mono only. Is mono sound the norm for low market laptops such as this one and notebooks? Ken Heard

9 12

Problem new virtual host
by Stephen 02 May '20

02 May '20

I posted this to the Apache list but someone here may be able to help: I have a standard LAMP for development. I set up a new virtual host about once every two years and always struggle. I have added the web site to my hosts file and direct to my server. I have a dozen entries. I have updated my virtual hosts Apache file I can ping the new virtual host just fine. But both Brave and Firefox raise an error saying that the host cannot be reached? Firefox: Unable to connect Firefox can’t establish a connection to the server at roissystudiotest.ca. Brave: This site can’t be reached www.roissystudiotest.ca refused to connect. I was getting the Apache default page but corrected the file permissions to 755. Any and all help welcome! -- Stephen www.roissy.ca -- Stephen

5 8

Laptop recommendations?
by Gron Arthur 02 May '20

02 May '20

Need to buy a new laptop, any recommendations? Any good outlets that deliver?

20 60

ftrace-time support in Clang
by Nicholas Krause 30 Apr '20

30 Apr '20

Greetings, This seems to be a rather not know option on the LLVM side and it seems GCC does not support it. https://www.phoronix.com/scan.php?page=news_item&px=LLVM-Clang-9.0-Time-Tra… Its now in mainline as the articles like this one were mostly written before it was merged in clang/llvm version 9. 10 was just released so its now in the mainline. Maybe it interests some people here who build large software products or use embedded build systems, Nick

2 2

Re: [GTALUG] CIRA officially launches free DNS firewall for consumers | IT World Canada News
by Alvin Starr 28 Apr '20

28 Apr '20

On 4/28/20 9:16 AM, ac wrote: > On Tue, 28 Apr 2020 08:13:11 -0400 > Alvin Starr <alvin(a)netvel.net> wrote: > <snip so many cool things around here somewhere> >> How about DNS over TOR? >> > as usual, LOVE the way you think :) > > How about just plain old DNSSEC? > (instead of a nanny) - yay, IT Works! - and is so mature > already...(without all the risks of having/using a nanny) I thought DNSSEC was more to secure the content of the query and not the communication channel. But I my DNSSEC knowledge is spotty at best. > > and using connectivity providers (instead of third parties and dns over > https) -- for caching/recursive, like Bell (Bell CA actually does not > track/record/monetise their users DNS querries afaik) All the Canadian carriers will always work to maximize their profit because they are obligated to by their shareholders. So always assume they are monetizing anything they can even in the face of public denials. They all perform deep packet inspection so assume anything the is in the clear will be monetized. I am not saying they are evil. Its just that their profit motive may not be in the end users best interest. > > Problems all solved? > >>> my further opinions are that any "nanny" type "free" service where >>> someone else decides what and where i may or may not go or what i >>> may or may not see, needs to be either well >>> regulated/controlled/open/published/etc or simply not be >>> accepted... >> Sometimes nannies are good things. > yes, nannies are 'sometimes' good things, but for some people BAD > nannies are sometimes even better :) Are you thinking of the Nanny from Queen's Fat Bottomed Girls? > >> People without the wherewithal or interest in managing their own >> security likely are in need of a nanny. >> > again, dnssec already protects users, it just needs wider adoption, > which is the issue.. .as for "shared" domains like outlook.com - abuse > management costs will increase? - which is probably why dnssec has > never caught on, it is not "sexy" (like some nannies...) > I have had mixed luck with DNSSEC from the point of view of internal implementation and have fallen back to SEC-less. As a side story. DNS(bind) has been SO reliable over the years that people have not upgraded their software. A month or so ago a few customers had their DNS partly break because the old DNSSEC root keys were removed. The solution was to turn off DNSSEC till they were able to upgrade the software. >>> anyway, i am probably a minority as i also do not like/use/support >>> very popular and world dominating services such as 'whatsapp' and i >>> do not tweet or post photos of my food on insta and i have zero >>> tiktok vids >> I have a feeling your take is not a minority on this list. > ooh, warm & fuzzies to you too, I have a home *sigh* :) > Ya. Safe at home some times feels like locked in trying to avoid the zombie apocalypse. -- Alvin Starr || land: (647)478-6285 Netvel Inc. || Cell: (416)806-0133 alvin(a)netvel.net ||

2 1

Re: [GTALUG] CIRA officially launches free DNS firewall for consumers | IT World Canada News
by Alvin Starr 28 Apr '20

28 Apr '20

On 4/28/20 1:10 AM, ac via talk wrote: > On Mon, 27 Apr 2020 12:31:50 -0400 > Gordon Chillcott via talk <talk(a)gtalug.org> wrote: >> On Mon., Apr. 27, 2020, 09:08 James Knott via talk, <talk(a)gtalug.org> >> wrote: >>> I came across this today: >>> https://www.itworldcanada.com/article/cira-officially-launches-free-dns-fir… >>> https://www.cira.ca/cybersecurity-services/canadian-shield/configure > so... no opinions... no comments... no discussion... just posting > links, multiple times, or doing marketing now, we are? Ouch. > > my not so humble opinion is that dns over https is very evil, even if > done under the guise of "privacy" or "protection/nanny" or "to protect > us" or under any other logic or reasoning. DNS over https is not in and of itself evil. If it is used as a way to implement surveillance capitalism then it becomes evil. I rather liked the quote from the CIRA CTO “As a non-profit with no interest in monetizing user data we were able to bring together a group of great partners who are committed to protecting Canadians online–including the first-ever national deployment of DNS over HTTPS globally,” The only thing missing was the " yet " after the words "no interest". Somewhere down the line CIRA will likely face a fiscal problem and suddenly there will be value in that user data that cannot be passed up. How about DNS over TOR? > > my further opinions are that any "nanny" type "free" service where > someone else decides what and where i may or may not go or what i may > or may not see, needs to be either well regulated/controlled/open/published/etc > or simply not be accepted... Sometimes nannies are good things. People without the wherewithal or interest in managing their own security likely are in need of a nanny. > > anyway, i am probably a minority as i also do not like/use/support very > popular and world dominating services such as 'whatsapp' and i do not > tweet or post photos of my food on insta and i have zero tiktok vids I have a feeling your take is not a minority on this list. > > so i guess ymmv, > > Andre > > > --- > Post to this mailing list talk(a)gtalug.org > Unsubscribe from this mailing list https://gtalug.org/mailman/listinfo/talk -- Alvin Starr || land: (647)478-6285 Netvel Inc. || Cell: (416)806-0133 alvin(a)netvel.net ||

2 1

Re: [GTALUG] CIRA officially launches free DNS firewall for consumers | IT World Canada News
by James Knott 28 Apr '20

28 Apr '20

On 2020-04-28 01:10 AM, ac via talk wrote: >>> I came across this today: >>> https://www.itworldcanada.com/article/cira-officially-launches-free-dns-fir… >>> https://www.cira.ca/cybersecurity-services/canadian-shield/configure > so... no opinions... no comments... no discussion... just posting > links, multiple times, or doing marketing now, we are? I don't use it and I just posted to see what comments came up. I have pfSense running a DNS resolver, so it goes to the top level servers. > > my not so humble opinion is that dns over https is very evil, even if > done under the guise of "privacy" or "protection/nanny" or "to protect > us" or under any other logic or reasoning. > > my further opinions are that any "nanny" type "free" service where > someone else decides what and where i may or may not go or what i may > or may not see, needs to be either well regulated/controlled/open/published/etc > or simply not be accepted... > > anyway, i am probably a minority as i also do not like/use/support very > popular and world dominating services such as 'whatsapp' and i do not > tweet or post photos of my food on insta and i have zero tiktok vids I also tend to shy away from many of those services. I have better ways to waste my time.

1 0