- Talk - lists.gtalug.org

"Atom Pi"
by D. Hugh Redelmeier 17 Sep '19

17 Sep '19

This is an inexpensive Atom-based Single-Board Computer (SBC). It created a flurry on Amazon a few months ago and then seemed to go out of stock. I just assumed that it was some surplus board that was being blown out. Maybe it is. Now it is being sold by AmeriDroid, a distributor/vendor of several interesting single-board computers. Cheap! https://ameridroid.com/products/atomic-pi Why I think that this is interesting: - SBC is an interesting form factor - cheap: US$37.95 for board + US$12.95 for power + ? for shipping. That's cheaper than a Raspberry Pi 4b with 4GiB. - x86 so any off-the-shelf distro should work. And the video driver is in-tree open source (a big missing piece with ARM). It would run Windows 10 but has no licence. - OK resources: + Intel Atom x5-Z8350 (hence name) + 2G RAM (not expandable) + 16G eMMC (preloaded with some Linux) (should perform better than Raspi's SD) + SD socket (supports up to 256G) + gigabit ethernet, dual band WiFi, Bluetooth + some kind of potentially interesting audio amplifier + HDMI + USB 3.0 port + fanless, with a big heat sink - oddities + need to add a weird power supply connector and a power supply + need to add WiFi antennae + no case + I don't really understand the choice of power supplies offered by AmeriDroid. The cheaper one has higher output (possibly useful in support of the audio amp). Why I won't buy it: - I have too many small PCs already. And too many unfinished projects. - 2GiB is a little cramped these days. First-world problem! But it is certainly fine for most SBC applications. I recommend browsing Ameridroid.com for other interesting toys.

6 10

Suspend/resume not working with latest kernel in Debian unstable/sid
by Daniel Wayne Armstrong 16 Sep '19

16 Sep '19

On my old C720 Chromebook, in the past I have needed to add `GRUB_CMDLINE_LINUX_DEFAULT="tpm_tis.force=1"` to GRUB to enable suspend/resume to work properly in Debian. After a fresh re-install and upgrade to Debian unstable/sid, suspend/resume is not working with kernel 5.2.9-2. System will suspend, but trying to resume results in a hard reboot. I think the problem is with tpm_tis. Messages in the log upon boot ... ``` $ journalctl -b | grep tpm Sep 16 18:18:01 cruithne kernel: tpm_tis tpm_tis: 1.2 TPM (device-id 0xB, rev-id 16) Sep 16 18:18:01 cruithne kernel: tpm tpm0: tpm_try_transmit: send(): error -5 Sep 16 18:18:01 cruithne kernel: tpm tpm0: A TPM error (-5) occurred attempting to determine the timeouts Sep 16 18:18:01 cruithne kernel: tpm_tis tpm_tis: Could not get TPM timeouts and durations Sep 16 18:18:01 cruithne kernel: tpm_tis 00:08: 1.2 TPM (device-id 0xB, rev-id 16) Sep 16 18:18:01 cruithne kernel: tpm tpm0: tpm_try_transmit: send(): error -5 Sep 16 18:18:01 cruithne kernel: tpm tpm0: A TPM error (-5) occurred attempting to determine the timeouts Sep 16 18:18:01 cruithne kernel: tpm_tis 00:08: Could not get TPM timeouts and durations Sep 16 18:18:01 cruithne kernel: tpm_inf_pnp 00:08: Found TPM with ID IFX0102 ``` Suspend/resume *does* continue to work with kernel 4.19.67-2 (current default in Debian stable). Messages in the log ... ``` Sep 16 18:00:38 cruithne kernel: tpm_tis 00:08: 1.2 TPM (device-id 0xB, rev-id 16) Sep 16 18:00:38 cruithne kernel: tpm tpm0: [Firmware Bug]: TPM interrupt not working, polling instead ``` Removing the "tpm_tis.force=1" line from GRUB when booting into kernel 5.2.9-2 makes no difference. A google search with "tpm tpm0" "tpm_try_transmit" "error -5" "A TPM error (-5) occurred attempting to determine the timeouts" returns NO hits. Dropping the last term is a bit more successful but still leads me to no solution. Any ideas how I might get this to work with the latest kernel 5.2*? Thanks in advance! -- Daniel Wayne Armstrong https://www.circuidipity.com <http://www.circuidipity.com> Accomplish the great task by a series of small acts. -- Lao Tzu

2 1

Script to show HTTP(S) and TLS details for a website
by Giles Orr 16 Sep '19

16 Sep '19

This may be seen as self-promotion - that's not totally wrong. But I think this may also be useful to others and (as I acknowledge in the blog post) I'm quite pleased with the resultant script. Over the past year and a half I've slowly developed a shell script that gives a concise summary of the state of TLS and HTTP(S) on a given website. It looks like this: $ tlsdetails google.ca Using OpenSSL: /usr/bin/openssl Expiry Date: Oct 27 17:27:07 2019 GMT (78 days) Issuer: Google Trust Services, CN TLS Versions: tls1_3 tls1_2 tls1_1 tls1 (tried but unavailable: ssl3 ssl2 ) HTTP Version: 2 I first started work on it after a couple embarrassing certificate expiries. It then grew to check the Issuer, TLS versions, and more recently whether or not a site supports HTTP2. (The pointer to the OpenSSL version is shown because the script will also run on Mac, and their version of 'openssl' is problematic at best. That line is of course easy to remove if you don't like it.) If you're interested, you can find the details here: https://www.gilesorr.com/blog/tls-https-details.html Any suggestions to improve the script would be most welcome. -- Giles https://www.gilesorr.com/ gilesorr(a)gmail.com

8 19

tilde.club reopens signups (vaguely off-topic)
by Stewart C. Russell 16 Sep '19

16 Sep '19

Hey — Aligned with the small scale, homebrew hosting that I know that some of you were/are involved in, I see that tilde.club <https://tilde.club/> has reopened its member lists: https://tilde.club/signup/ tilde.club is small web hosting with ssh access. You only get a (comparatively) tiny amount of space. It's named from earlyweb days, when user pages were at hostname/~user. They've been stalled for new members for 4 years as the organizer couldn't quite give it the attention it needed. Announcement from the bird site: A tildeverse-builder named Mike Buchholz (info(a)retrodigital.net) offered to take over http://tilde.club <http://tilde.club> AND the backlog of 10,000+ people who asked for accounts. I said, that would be a blessing! If you had an account, it still works. If you asked, they'll be in touch. — Paul Ford (@ftrain) 9:21 AM - 13 Sep 2019 https://twitter.com/ftrain/status/1172545886968324098 I always meant to set up a tilde node (I think I still have the domain and hosting, even) but tildeverse admin requires a certain attachment to IRC and that's someone else's trash fire. cheers, Stewart

1 0

detecting whether a recipient has read email you sent
by D. Hugh Redelmeier 15 Sep '19

15 Sep '19

In Evan's talk, he showed how the mailing list software he used could report how many recipients had read each message. I asked how that worked. This devolved into a discussion with more heat than light. So I looked into this a bit. I was puzzled because, generally speaking, mail servers talk to each other but Mail User Agents generally don't. And yet only MUAs know when a message is read. RFC 8098 <https://tools.ietf.org/html/rfc8098> describes a MIME mechanism for "Message Disposition Notification". For example, an email sender can request the the user's MUA send back notification when a message is read. Apparently some MUAs implement this and some don't. Alpine, my MUA, can issue an MDN request but will not respond to one. Mozilla products seem to be able to optionally respond. I suspect that Outlook unconditionally responds. There are other variations on this <https://en.wikipedia.org/wiki/Email_tracking> I'm going to try to set DSN on this message.

1 0

Sudo in Script
by Stephen 15 Sep '19

15 Sep '19

I do work in a LAMP system. When debugging I like to clear the Apache error file and save as null. To continue error logging I have to restart Apache. 1) Not a big deal, but is there an easier way? I restart Apache in a script file that requires a Sudo command. That requires a password. 2) Can I provide the password in the script file to avoid the prompt and save a little time? Thanks! -- Stephen

4 4

York University WiFi and Certificate Authority root certificates
by D. Hugh Redelmeier 14 Sep '19

14 Sep '19

We needed to set up WiFi on a notebook with Fedora at York University. The IT staff were steadfastly unhelpful. I'm posting this in case someone else needs to set up WiFi at York. This page is for Students: <http://student.computing.yorku.ca/airyorkplus/#squelch-taas-toggle-shortcod…> In this case, the user was faculty, but the faculty page is less helpful. We looked at how Windows and ChromeOS were configured and did something similar on Fedora. One slightly tricky part was filling in the "CA certificate" field. We ended up using /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem This is the bundle of CA root certificates known to and trusted by Firefox, OpenSSL, and perhaps NSS.

1 0

New Rogers offerings and guest access
by David Collier-Brown 13 Sep '19

13 Sep '19

I have an old Rogers cable setup, and the new one is cheaper and in principle less restricted. Does anyone have one and know if they allow "guest" accounts on their wi-fe hubs, like Open WRT does? I have friends/neighbors I want to give bandwidth to. --dave -- David Collier-Brown, | Always do right. This will gratify System Programmer and Author | some people and astonish the rest davecb(a)spamcop.net | -- Mark Twain

4 8

Decrypting and Re-encrypting Network Traffic
by Giles Orr 11 Sep '19

11 Sep '19

Decrypting and re-encrypting network traffic is becoming more and more popular. I think it's an appalling violation of both trust and privacy, but corporations seem to feel justified to "protect their network" (it's not necessary to explain the logic to me, I get it ... I'm just more about individual rights). Or maybe they're just doing it to mine your data, depending on the context. There seem to be two circumstances (this is just about web traffic): - a private computer on a shared network, ex. you take your personal computer to a coffeeshop - a company computer on a company network, ex. you sit down at your work computer I think I understand the latter: with a company computer on a company network, all that's necessary is to push a trusted certificate and all future communications will be done with that newly trusted cert and, well, you're hosed. Everything you send is examined and re-encrypted with the receiving site's certificate at the company firewall. Can this be detected? Can this be prevented? It seems that some shared networks (ie. the coffeeshop in the above examples) manage to do this to people: is this only possible if they convince you to install something, and presumably that install package includes a certificate? Or is there another way? -- Giles https://www.gilesorr.com/ gilesorr(a)gmail.com

6 8

Unix at 50: How the OS that powered smartphones started from failure | Ars Technica
by James Knott 09 Sep '19

09 Sep '19

A bit of history... https://arstechnica.com/gadgets/2019/08/unix-at-50-it-starts-with-a-mainfra…

4 3