March 2022 - Talk - lists.gtalug.org

war story: power failure makes CentOS system unbootable
by D. Hugh Redelmeier 30 Sep '22

30 Sep '22

tl;dr / spoiler: change fstab so that /boot/efi is not automatically mounted. See the recommendation at the end of this message. My gateway computer is a little PC running CentOS. It does not come back after a power failure. The reason (as best I can tell) is interesting and I think that I have a fix. My system is UEFI. It boots from a UEFI system partition, known as /boot/efi to Linux. If this gets corrupted, it won't boot. It is a VFAT partition. On my gateway (a Zotac Zbox RI321, a cute little box with two ethernet ports), the UEFI firmware apparently won't boot if the dirty bit is set in the system partition. CentOS normally runs with /boot/efi mounted. So when the system isn't shut down cleanly, the dirty bit will be on. Consequence: the system is not going to boot after a power failure. Odd observation 1: if I put a live Fedora 25 USB stick in the system and try to boot in this otherwise-unbootable state, CentOS boots from the main disk. So this really looks like a firmware bug/quirk. Odd observation 2: fsck doesn't seem to automatically fix the system partition. Once CentOS 7 booted, I dismounted /boot/efi and did an fsck on it. $ sudo fsck /dev/sda1 fsck from util-linux 2.23.2 fsck.fat 3.0.20 (12 Jun 2013) 0x25: Dirty bit is set. Fs was not properly unmounted and some data may be corrupt. 1) Remove dirty bit 2) No action ? 1 Leaving filesystem unchanged. /dev/sda1: 16 files, 2420/51145 clusters Googling got me to <https://www.centos.org/forums/viewtopic.php?t=50917> In particular, this advice seemed quite good: ==== recommendation ==== Two other changes I recommend for UEFI systems, to each OS's /etc/fstab. - For the /boot/efi mountpoint, add the mount options x-systemd.automount,noauto - Change fs_passno (last column) to a 1 or 2; the canonical fstab instructions suggest 2, but systemd treats 1 and 2 as the same. The first change means the EFI System partition will not be automatically read-write mounted at boot time; it's a bad idea this is the default because it puts the ESP at risk especially if ther are crashes, FAT has no journal and will therefore always be marked dirty in such a case; no other UEFI OS mounts the ESP by default. Second, if anything tries to access /boot/efi (read or write), systemd will automatically mount it, and because of the fs_passno 1 or 2, it will fsck it first and that fixes and clears the dirty bit in case it's set. Right now without these changes, it's just a matter of having the right number and bad timing of crashes to render the EFI System partition corrupt.

3 9

Dignity in a Digital Age
by Warren McPherson 27 Mar '22

27 Mar '22

University of Toronto is having a book event. I don't think it's a book release but it's that kind of thing. But the topic look interesting: Congressman Ro Khanna on 'Dignity in a Digital Age' https://rotman.force.com/events/s/special-event/a1VAm00000002SAMAY/congress… <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> Virus-free. www.avg.com <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

1 0

Open Source Archetypes
by D. Hugh Redelmeier 22 Mar '22

22 Mar '22

Evan pointed out this paper. It is from Mozilla and it describes several different ways of organizing opens source projects. Worth reading. <https://blog.mozilla.org/wp-content/uploads/2018/05/MZOTS_OS_Archetypes_rep…>

1 0

supply chain risks: a real example
by D. Hugh Redelmeier 19 Mar '22

19 Mar '22

Supply chain risks are important in open source: with so many contributors, how can one be sure that there aren't malicious components? (Buggy components are also a threat.) (Closed source has this problem too, with some variations.) This is a scary real current example: <https://www.bleepingcomputer.com/news/security/big-sabotage-famous-npm-pack…> As I understand it, this malicious software tried to damage systems in Russia and Belarus. That's terrible. And it has had unintended side-effects: <https://web.archive.org/web/20220317140340/https://github.com/RIAEvangelist…> (One could also argue that leaving important information in Belarus, with no recent backup, is a very dumb.)

3 3

Vulcan Information
by Nicholas Krause 12 Mar '22

12 Mar '22

Greetings Hugh, I was playing around with Vulcan awhile ago and these may be of interest: Vulcan Tutorial: https://vulkan-tutorial.com/ Khorno's Maintained Github of Vulcan Examples: https://github.com/KhronosGroup/Vulkan-Samples I've looked through it briefly and there are lots of various types of examples. From playing around it seems you need to have a working knowledge of certain parts of C++17 or later. Not sure this helps with your interest in GPU programming, Nick

1 0

two or three tricks for installing Linux as a second OS on a Windows box
by D. Hugh Redelmeier 09 Mar '22

09 Mar '22

Most computers come with Microsoft Windows. If you insist on buying a computer without Windows, you have less choice and may have to pay more. Besides, once in a blue moon Windows is useful. To install Linux, you can either blow away Windows (easy!) or your can install Linux beside Windows. If you want to install Linux beside Windows, you usually have to get Windows to relinquish some disk space. (Alternatively you might be able to add another disk.) Windows has a way of reducing the size of a volume but it is unwilling to relocate a structure that is in the middle of the volume. So it is only willing to give up slightly less than half of the volume. I use gparted (ntfresize is underneath) to shrink a Windows NTFS volume, because I always want to shrink in to less than 50% of its original size. I do this from a live Linux flash drive. Here are the tricks that are not so obvious: - if Windows is using bitlocker, you need to turn that off in Windows. Otherwise gparted cannot do anything with the partition. Our newest computer came with bitlocker enabled (with no password). That's probably a good idea but not for us. After bitlocker is turned off, gparted can operate. Perhaps you can turn it on again after resizing. I don't know. (On Windows: Settings: Privacy & Security: Device Encryption) - By default, Windows assumes that it can leave the filesystem in an inconsistent state when it shuts down. It assumes that you'll boot Windows again when you power the system up. Apparently this speeds things up a little bit. This is very unhealthy if you are going to boot Linux next, especially if you are going to run gparted to muck with the NTFS filesystem. You can fix this by going to Windows' Control Panel (which is something different from Settings), Power Settings, and untick "turn on fast startup (recommended)". It is slightly tricky because you have to click some option to allow you to change the fast startup option. Sheesh. - (old advice; may be obsolete; I don't wish to find out the hard way that it is still needed.) After you have resized the NTFS partition, reboot to Windows. Don't do anything else with the disk in Linux first. Why: it used to be the case that gparted got something slightly wrong in the NTFS partition, something that a Windows boot fixed silently. After booting Windows, you can reboot to a Linux install medium safely.

7 9

keeping my systems updated: Windows vs Linux
by D. Hugh Redelmeier 09 Mar '22

09 Mar '22

I want to keep my systems up to date. Not everyone does. As I understand it, Windows Update does not update the Linux portion. Yet another step to keep a Windows system safe as possible. My drill: - Run Windows update. If it actually applied an update, you should run it again in case the update enables a subsequent update (you cannot tell by its cheerful declaration that your system is up to date). Rinse and repeat. BTW, Windows Update seems unreasonably slow. And prone to inscrutable failures. - go to the Microsoft App Store and get updates. Be careful, it too can prematurely say that your apps are up to date. - ask the machine vendor's software if it has driver or firmware updates (Dell, Lenovo, HP, ...). Sometimes I have to manually download and install firmware updates. - for WSL: "sudo apt update" and "sudo apt full-upgrade" - for each piece of third party software, ask it if it has updates. This includes FireFox. My Linux drill: - [Fedora] "sudo dnf update" [debian family] "sudo apt update" and "sudo apt full-upgrade" - once in a while: "sudo fwupdmgr get-updates". If the vendor doesn't support the Linux Firmware project, another process is required (maybe involving Windows). Linux sure wins here!

2 3

Package Manager upgrades on Linux
by Giles Orr 08 Mar '22

08 Mar '22

This is curiosity on my part and not meant to start a massive debate. I apologize should it do so. I started using Linux with Slackware. That wasn't really a "managed package system" at the time - you just unpacked tarballs. I moved to RedHat, where "rpm" was a huge improvement in package management over Slackware. But rpm was subject to "dependency hell," which wasn't much fun. I switched to Debian, where I was impressed by the superior "apt-get". These days I use both Debian and Fedora. Debian has moved to "apt" (not terribly different from "apt-get"), while RedHat/Fedora first came up with "yum" (painfully slow, but eliminated "dependency hell"), and then moved on to "dnf" which I'd say is almost as fast as "apt" - even though it's mostly an abstraction layer on top of "rpm" (as was "yum"). Just recently I started using Arch on one of my machines. Arch is a rolling release, and has fairly high package turn-over. If I leave the machine alone for a couple weeks and tell it to do a full upgrade (their package manager is called "pacman"), it usually comes back with "have to download 650M packages." My reaction the first couple times was "Damn, I'd better go get a coffee!" Only to find that by the time I stood up and started heading for the door ... it was finished. "apt" and "dnf" should hide their heads in shame. Fedora and Debian could learn a hell of a lot from whatever pacman is doing to fly through package installations perhaps four times faster than their package managers. So my questions (yes, there are questions here): does anyone know of other package management systems? I suppose I'm thinking of OS-specific ones rather than flatpak or snap. How fast are those other systems relative to those already mentioned? And do we have any full-time Arch users on the list? Contrary to this discussion, my decision of what Linux distro to install and use isn't primarily based on the package manager's speed. Installing Arch in 2021 was a lot like installing Slackware in 1998: I had to research and type dozens of commands in a shell just to get a functional system, and at that I'm not entirely sure I did all the security stuff right - which is more than a little alarming. But I think they have the best documentation of any distro in existence (which made that tricky install possible), and a really excellent package manager. -- Giles https://www.gilesorr.com/ gilesorr(a)gmail.com

3 2

[GTALUG-Announce] GTALUG March Meeting Reminder
by Alan Heighway 07 Mar '22

07 Mar '22

*When: *Mar 8, 2022 7:30PM *Speaker:* Trevor Woerner *Topic:* Update Strategies for Embedded Devices *Location:* https://blue.lpi.org/b/eva-zjc-gjy-kgl For various reasons, the strategies for performing a software update on an embedded device have diverged from what is commonly done on the desktop. This talk will discuss why, introduce the most common embedded strategies currently in use, and how to employ them. *A*lan *H*eighway <http://heighway.ca/> heighway.ca VA3WAH / VA3YKZ [image: Please consider the environment before printing] --- GTALUG Announce mailing list announce(a)gtalug.org https://gtalug.org/mailman/listinfo/announce

1 0

Sane Email System?
by Peter King 05 Mar '22

05 Mar '22

Hello! I've just been informed that "legacy authentication" is going to be disabled at the University of Toronto for my email account. Well, I suspected something like this was in the works when they adopted MS Outlook 365+ as the mail server, but it still isn't welcome. Up to now, I've been able to use mutt and getmail for all my needs; I run a daemon that picks up (and then deletes) email from a variety of servers (University of Toronto, GMail, and so on) onto a single computer. There I apply all the filters, spam protection, sorting into various inboxes, and so on. To read email I just ssh in from any computer anywhere and run mutt. All configurable with nice text-based scripts. The email files are automatically backed up and sychronized to other computers, too. When I'm out of town I have the mail be downloaded/deleteed manually, and I have full fallover capability, so if one machine is offline I can switch to another without any hiccups. But it looks like that is all going away, since Microsoft only supports what they call "modern" email clients, and on Linux only Thunderbird. I could switch. But then rather than the fetch-and-store model, which has worked fine over the years, I would either have to change to a view-in-a- browser model (and so have to be running a GUI locally and store all my email somewhere else out of my control), or chuck my university email account and set up something else. At the moment I'm really inclined to do the latter. I'll just set up some way of forwarding all my email to some text-based *NIX server somewhere that is happy to let me run scripts to deal with email. But maybe I'm not being fair to the former alternative. I have *no* experience with any of the "modern" email clients, and have been stubbornly clinging to the plain ASCII text as how email should work. Maybe there are perfectly reasonable email clients these days with powers I know nothing of. (I am currently teaching a few courses at UCLA and was forced to use their webmail system, run by Google, and I have to say I despise it: graphical for no good reason, with limited search/sort capabilities, threading of old messages not clearly visible, and so on.) Any advice, suggestions, hints? War stories? Ways to thwart the powers that be? Thanks in advance. -- Peter King peter.king(a)utoronto.ca Department of Philosophy 170 St. George Street #521 The University of Toronto (416)-946-3170 ofc Toronto, ON M5R 2M8 CANADA http://individual.utoronto.ca/pking/ ========================================================================= GPG keyID 0x7587EC42 (2B14 A355 46BC 2A16 D0BC 36F5 1FE6 D32A 7587 EC42) gpg --keyserver pgp.mit.edu --recv-keys 7587EC42

12 12