October 2023 - Talk - lists.gtalug.org

CVE-2023-43641: libcue bug allows Remote Code Execution in (at least) GNOME
by D. Hugh Redelmeier 20 Oct '23

20 Oct '23

TL;DR: update libcue to a version released after October 10. I read this last night: <https://arstechnica.com/information-technology/2023/10/one-click-remote-cod…> <https://nvd.nist.gov/vuln/detail/CVE-2023-43641> Summary: - libcue has a bug that allows an attacker to execute arbitrary machine code - libcue handles CUE sheet files - GNOME (at least) uses libcue for file indexing when it finds a suitable file - a bad actor can give you a bad CUE file without you knowing it (eg. via browsing a web site) - GNOME's tracker will automatically run libcue on the CUE file -- kaboom. You can update your system to get a fixed libcue. The fix is in version 2.3.0. Fedora 37 and 38 have fixes in version 2.2.1-13. I checked this by using "rpm -q --changelog libcue | less".

2 1

WikiConference North America is in Toronto next month
by D. Hugh Redelmeier 17 Oct '23

17 Oct '23

<https://wikiconference.org/wiki/2023/Main_Page> Where: Toronto Reference Library (Yonge, North of Bloor) When: November 9-12 Cost: US$25 for most of us. Free if you find that a burden. You must register by Oct 29. I really value Wikipedia. I do a bit of editing. Sounds like it would be interesting but I avoid crowds these days.

2 1

How do I get wlan0 interface for WiFi with any MAC
by Kevin Cozens 16 Oct '23

16 Oct '23

Greetings, all. I have an embedded system and WiFi works but the device name that is shown in ifconfig for it is wlx followed by the MAC address. What udev(?) rule do I need to add to have the WiFi device come up as wlan or wlan0 regardless of the MAC address that may be associated with the WiFi device? -- Cheers! Kevin. https://www.patreon.com/KevinCozens | "Nerds make the shiny things that | distract the mouth-breathers, and Owner of Elecraft K2 #2172 | that's why we're powerful" #include <disclaimer/favourite> | --Chris Hardwick

3 3

Debian has suddenly become unstable
by Giles Orr 13 Oct '23

13 Oct '23

I have a Debian 12 system that's my daily driver. In the last two days, it crashed twice when I was away from the keyboard and nothing was happening (around the same time of day now that I think about it). The system has previously been very stable, usually up for a month at a time with reboots only to pick up new kernels. I should note that when I turned it on and ran upgrades on Monday after a week away, it upgraded a lot of packages for Debian release 12.2. I'm not great at debugging Linux crashes. The `dmesg` command is useless, as it only shows the log since the last boot. So I turned to /var/log/syslog. What I noticed was this, the only line of consequence about a millisecond before the reboot: 2023-10-10T11:36:23.839046-04:00 sli7d systemd-modules-load[399]: Inserted module 'lp' I don't have a printer, and I hadn't just done a "print-to-PDF" or anything like that - the machine had been idle for a couple hours. This morning it crashed again, and milliseconds before the crash I found these (again, the machine was idle when this happened): 2023-10-11T12:20:54.647048-04:00 sli7d systemd-modules-load[382]: Inserted module 'lp' 2023-10-11T12:20:54.647254-04:00 sli7d systemd-modules-load[382]: Inserted module 'ppdev' 2023-10-11T12:20:54.647280-04:00 sli7d systemd-modules-load[382]: Inserted module 'parport_pc' 2023-10-11T12:20:54.647290-04:00 sli7d lvm[372]: 3 logical volume(s) in volume group "primary" monitored 2023-10-11T12:20:54.647302-04:00 sli7d systemd[1]: Starting systemd-journal-flush.service - Flush Journal to Persistent Storage... 2023-10-11T12:20:54.647312-04:00 sli7d systemd-udevd[398]: Using default interface naming scheme 'v252'. I just ran `apt full-upgrade` (right now) and watched it upgrade Samba. Is it possible that Samba was triggering "lp"-related stuff which was causing the crash? Although why it would cause a crash I don't know. No new kernel (and thus no new modules). I suppose I could reboot and select and older kernel and see if that was stable ... Suggestions on how to better debug this would be most welcome. Does blacklisting the "lp" module sound like a good idea? Any other ideas? Re-installing would be ... unpleasant. This is my primary machine and heavily tweaked-up. But I guess I'll do that if I have to. Keeping it as a last resort though (daily crashes would get me there!). -- Giles https://www.gilesorr.com/ gilesorr(a)gmail.com

6 10

Sun. Oct. 15th - Hacklab Junk Independence Day
by Scott Sullivan 13 Oct '23

13 Oct '23

Hacklab Junk Independence Day https://hacklab.to/archives/junk-independence-day-3/ Come drop off / swap old electronic and e-waste. * Sunday October 15th * 2PM – 7PM -- Scott Sullivan

1 0

editing and publishing our meeting recordings?
by D. Hugh Redelmeier 12 Oct '23

12 Oct '23

This message is unauthorized by the board, but I thought I'd float these ideas anyway. Alex used to do a wonderful job of filming, editing, and publishing our meetings. Lots of work. Alex has stepped back. Since we've had virtual meetings, we have made recordings. But none has been edited and uploaded to YouTube. (Did Alex upload them to other places too?) https://www.youtube.com/@GtalugOrg We used to get a modest number of views -- usually more than the number of people attending the meeting. One of my segments seems to have 20k views! Is anyone interested in trying to do editing and uploading? This might be something that could be shared. Some reasons why this would be useful - for our members who miss meetings - outreach: to let more folks know that we (still) exist and what we do - to share more broadly PS: in my opinion, the number of views does not correlate with the merits of the video's content. That hints to me that better marketing should be able to get more people watching.

1 0

US urged to ban RISC-V
by D. Hugh Redelmeier 12 Oct '23

12 Oct '23

<https://www.reuters.com/technology/us-china-tech-war-risc-v-chip-technology…> Land of the Free? "I fear that our export-control laws are not equipped to deal with the challenge of open-source software - whether in advanced semiconductor designs like RISC-V or in the area of AI - and a dramatic paradigm shift is needed," Warner said in a statement to Reuters.

4 3

October Meeting Announcement!
by Alan Heighway 09 Oct '23

09 Oct '23

Notes from the precipice <https://gtalug.org/meeting/2023-10/> with Mike Hoye <https://gtalug.org/> 10 October, 2023 at 07:30 PM For this month we will be conducting our annual general meeting, as well as a having a talk by Mike Hoye on 'Assorted thoughts from the edge of the future'. We're going to use Big BLue Button for this meeting: https://blue.lpi.org/b/eva-zjc-gjy-kgl *Time:* October 10th, 2023 7:30 PM Eastern Time *Join us on Big Blue Button:* https://blue.lpi.org/b/eva-zjc-gjy-kgl. LocationBig Blue Button - https://blue.lpi.org/b/eva-zjc-gjy-kgl

3 2

GTALUG meeting 19:30 Tuesday, Oct 10
by D. Hugh Redelmeier 08 Oct '23

08 Oct '23

(This is not the official announcement.) We will meet virutally, via Big Blue Button: <https://blue.lpi.org/b/eva-zjc-gjy-kgl> The first few minutes will be our Annual General Meeting. This is where the board presents the financial statement for the past year and where we the members of GTALUG elect the board of directors. There might be more business. Please volunteer to stand for election: we can use your energy and ideas. No experience is necessary. To be a member, you have to have paid membership dues for this year. I have appended a copy of Warren's helpful email from last year. After the short AGM, we'll have a regular meeting. As I understand it, Mike Hoye has agreed to give our October talk. Mike is a great speaker and I look forward to this. I have not heard what his topic will be. | From: Warren McPherson via talk <talk(a)gtalug.org> | To: Announce(a)gtalug.org | Date: Thu, 24 Nov 2022 23:43:11 -0500 | Subject: [GTALUG] [GTALUG-Announce] Membership Dues | | With the agm coming up, now is a great time to renew membership and make a | small twenty dollar contribution to the organization. | For those looking forward to the chance to wind their way through the | Interac E-Transfer process again here is my summary of how it works. | (Actually I forget each time so the novelty never wears off -- luckily it | is easy.) | | Log in to your bank and look for "Interac e-Transfers" you may need to go | to the "Transfers" page and then you will see this option. | | Select "email method" and use the email address: | membership(a)gtalug.org | | Putting your name in the message can be helpful as the notification I get | can sometimes be a touch obtuse. | | Thank you to those who have already contributed! | (I know who you are. Ha ha) | | Thank you, | Warren

1 0