- Talk - lists.gtalug.org

Re: [GTALUG] Ongoing war story (currently issues of user trust)
by Peter King 24 Jan '24

24 Jan '24

Can't say that I disagree with any of this. I protested when the UofT decided to amalgamate all its services on Microsoft Server (to no avail), and even more so when they made it all but impossible not to use Outlook (after using mutt happily for years and years) - on the grounds that Outlook somehow had "more modern" security, which turned out to be doublespeak for "proprietary closed-source protocols" for accessing the mailserver that they now controlled. Rewriting links and pushing their brand is the completely predicable result. I tried to warn people in IT that this was all security theatre, but they, like me, were victims of decisions made by administrative staff rather than made by informed technical experts. There you have it. Just recently I was told that the University would not allow me to ssh in to my office computer "because ssh had to be protected from the internet" (!), and instead I was supposed to use some binary blob to create a VPN into the UofT network -- and how having one point of entry into the whole system, trusted internally, "improves" security over a single ssh connection to a single computer, I could not tell you (and neither can they). But it's policy, so that ends discussion. On 1/20/24 02:51, ac via talk wrote: > <https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.amazo…> <snip> > Anyway, so to issues of user trust: To me, it seems that utoronto.ca > uses/pays Microsoft and outgoing emails, opens and reads all email > Even https links in already replied to chains (which are now seen as > outgoing links from the users@ utoronto.ca - are clearly - visited, > indexed, checked/scanned (probably Microsoft would say : the > websites/domains/links etc are scanned for malware, I would say that > Microsoft has previously, and in the past, simply 'blocked', 'broken' or > done other things to various websites it does not 'like') > > It does so many other things as well, one small one being > 'brand dilution' as readers and senders of emails and DM etc etc > - where names are re-written to the Microsoft or Facebook or > whatever abbreviated link brand name - > > this serves to underline the brand doing the re-writing - as the "safe" > link in the above example - COULD easily been displayed as AMAZON > (with the actual a href -> protection.outlook.com/ as in example: > <a href='https:outlook.com'>https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Famazon.co…</a> > > Which would then just display the original link, but with an outlook > landing. > > BUT - Microsoft 'chooses' to display : > protection.outlook.com?var=very.long.&data=ascii.long.long.long.long.long.long.long.long.long.long.long > > Apparently because users@ utoronto.ca (and microsoft users) send > out malware links and this is a way that Microsoft chooses to try to > protect recipients and their users from malware/abuse - instead of > their users or recipients relying on other software, like browsers, > local anti virus, local script blockers, etc (taking the control away) -- Peter King peter.king(a)utoronto.ca Department of Philosophy 170 St. George Street #521 The University of Toronto (416)-946-3170 ofc Toronto, ON M5R 2M8 CANADA http://individual.utoronto.ca/pking/ ========================================================================= GPG keyID 0x7587EC42 (2B14 A355 46BC 2A16 D0BC 36F5 1FE6 D32A 7587 EC42) gpg --keyserver pgp.mit.edu --recv-keys 7587EC42

5 7

HowTo: mail with mutt, davmail, exchange, and XOAUTH2
by John Sellens 22 Jan '24

22 Jan '24

Peter King and Dave Collier-Brown expressed interested in using mutt (or other IMAP client) with exchange, and I thought this might be of general interest. So a new thread. I've been using mutt and davmail to do Office365 (exchange style) mail for almost two years, and it has been working great for me. I archive my mail into mbox files on my local machine, but there should be nothing preventing saving to IMAP folders (other than more typing). I mentioned this in a list message in April last year I use this to access work M365 and Seneca College M365, which both require multi factor authentication. On my ubuntu desktop/laptop I install the packages davmail and openjfx, and my ~/.davmail.properties includes (among others) davmail.mode=O365Interactive davmail.url=https://outlook.office365.com/EWS/Exchange.asmx davmail.smtpPort=1025 at startup/login I run ( davmail -server > /dev/null 2>&1 & ) and my .muttrc has things like set imap_user="jsellens(a)example.com" set spoolfile=imap://localhost:1143/INBOX set smtp_url = "smtp://jsellens@example.com@localhost:1025/" set smtp_authenticators = "login" set ssl_force_tls = no Start up mutt, get prompted for password, get popup window asking for two factor (e.g. google authenticator, or duo push), comply, and there's my mail. And davmail is willing to cache credentials, so I don't always have to two factor. Note that this does not require IMAP access to M365 - it uses the "normal" exchange protocols, just like Outlook would. Feel free to let me know if you run into problems, and I'll try to help. Hope that's helpful! John

1 0

Re: [GTALUG] Ongoing war story (currently issues of user trust)
by David Collier-Brown 20 Jan '24

20 Jan '24

On 2024-01-20 02:51, ac via talk wrote: > On Fri, 19 Jan 2024 22:44:01 -0500 > Alvin Starr via talk<talk(a)gtalug.org> wrote: >> I have a client who buys systems fromhttps://www.servergiant.net/ >> I have also bought systems from them. >> The prices will not be as cheap as a minipc from amazon but you can >> get a decent HP or Dell tower system. >> > <snip snip> >>> On 1/19/24 17:53, D. Hugh Redelmeier via talk wrote: >>>> | From: Peter King via talk<talk(a)gtalug.org> > <snip snip> >>>> <https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.amazo…> > look at these two "links" above, see whence they came, what they > were and what actually happened :) > > to me, it is interesting that there are so very many things (and > increasing at an alarming pace every and each passing day) Yes: we suffer from that at work, because we use some MS services. > Apparently because users@ utoronto.ca (and microsoft users) send > out malware links and this is a way that Microsoft chooses to try to > protect recipients and their users from malware/abuse - instead of > their users or recipients relying on other software, like browsers, > local anti virus, local script blockers, etc (taking the control away) We also use a company to send us "practice" phishing emails. /*Every single one of those*/ I've received were marked as spam when I submitted them to spamcop.net. Spamcop is the service I use for my home emails. --dave

1 0

Re: [GTALUG] "AI" on getting correct technical answers
by o1bigtenor 17 Jan '24

17 Jan '24

On Sun, Jan 14, 2024 at 3:06 AM ac via talk <talk(a)gtalug.org> wrote: > snip > > And, it's just a generic LLM. I've heard experienced developers > > saying surprisingly positive things about GitHub's Copilot for quite > > a while now. > > As for the SQL issue - all search queries on Qwant / DDG / Google > > lead to "how to join tables in SQL"; utterly useless. I know that > > reasonably well. > > And, who hasn't had a search lead them to StackOverflow where the > > highest rated answer is strongly condemned further in the comments as > > being wrong / out of date / insecure, etc.? > > > Actually, this is an interesting point. > > Google search seems to prioritise answers from humans and human sources. > > I searched on Microsoft the other day and was surprised to see that I > could supply .js snippets (which I did not code and was too lazy to > read through) and receive a correct answer direct from "search" > > So, us humans will be replaced as 'coders" - Machines will be writing > the code which powers machines. Not only is that something for us to > understand fully, but we also have to comprehend where we are all > choosing to go. > > It is like watching episodes of "the Traitors" and seeing how the > majority votes out a faithful. > > there is just nothing to do but be along for the ride :) > > > Lots of incorrect answers supplied by humans. > > > indeed, if only there was some way to 'sort' or use advanced search to > set dates... (to exclude popular answers from 2009) or do more settings > on search options... oh, wait.... - and then there are no search > results... when is "search" not "search" and just becomes "answer" - > interesting! - it is like a mobile phone - it is hardly even a mobile > phone any longer, why do so many people still call it a 'phone' or a > mobile phone... > > I think though that I will still be using Google for search, although > when looking at it all from my perspective we are all already screwed, > unless we can vote out all of the tratitors. (which seems increasingly > unlikely) > Re: search engines - - - - to me they are totally frustrating. If I'm asking for a search where I want terms 'a + b + c + d + e' well - I'm looking for where ALL 5 terms show up. Not where any one term is or any two (etc etc). So if one is looking for very generic kind of items - - well search is useful - - - if you're looking for the specific - - - - search - - - well - - its quite useless! As I've been pondering the AI stuff (tried to sign up for chatgpt but as I'm unable to use a cellphone at my location that's a no for even signup (and no way to reach the idiots - - - - sorry I guess I should use people but I wonder - - to let them know that I can't because its only after registration that connection is allowed - - - total circular logic that is!) what I've come up with is from looking at the past. Truly innovative and unique ideas/things are rarely enough even designed or developed by a 'team' (that's changing in advanced materials these days though) most often its an individual that finds something that the thundering herd has either ignored or doesn't know about. Somehow to date AI is more about the thundering herd (and a technique that when fully utilized will allow major chip makers (and some small group of other hardware vendors) to really cache in the bucks ('Follow the money' is the adage!). Am wondering if that is the reason for AI's proliferation? What say you? TIA

16 54

AI - Llama 2 an open source AI that can run on a Raspberry PI
by Colin McGregor 16 Jan '24

16 Jan '24

As noted last evening I am running the open source (but NOT GPL) Llama 2 AI on a Raspberry PI 5. Llama 2 is a product of Meta (parent company of Facebook), and as you will see in clause 2 of their licence agreement, there is a poison pill clause aimed at the likes of Google (for a hobbyist interested in seeing / playing with a local AI there are no issues) : https://ai.meta.com/llama/license/ . Here is the guide I used for getting Llama 2 up and running on a Raspberry PI (I am using the PI 5, but as the video notes (subject to conditions) it can run on a PI 4) : https://youtu.be/idZctq7WIq4?si=kekFWQHty60dp2ce There is an old saying "The amazing thing about a dancing bear is not how well the bear dances, but that the bear can dance at all.". So, yes, I will to some degree mock Llama 2 on a Raspberry PI in the following, but... It is kind of amazing that you can get a functional, local AI running on a machine as modest as Raspberry Pi, so the flaws are very forgivable. I have run Llama 2 on a Raspberry Pi 5 with 4GB of RAM and one with 8GB of RAM, with no obvious difference in performance. At present the key issue appears to be storage I/O performance, to try to attack that I currently have a PCIe to NVMe adapter on order from Pimoroni that will let me use NVMe SSD storage with the PI (I want to see if/how much that helps). I have also tried the 7b and 13b language models on the Pi, the 7b runs (crawls?) faster than the 13b model, but the 13b model gives better (but far from perfect) answers. I am currently normally using the 13b model and accept the slowness. As it is, obviously different questions take different amounts of time, but as things stand, I will ask a question in the evening and see how things are coming the next morning after a good night's sleep. I have been keeping a log of the questions / answers I have had with Llama 2 and I will start with a question I asked both the 7b and 13b models. For those who didn't take (or failed) Canadian history in school, let me point out that Lester B. Pearson didn't have any significant role in the Cuban Missile Crisis of the 1960s (but his role in the 1950s Suez Crisis got him a Nobel Peace Prize). Also, Joe Clark was Prime Minister of Canada from June 4, 1979 to March 3, 1980 so Pierre Trudeau both preceded and succeeded Joe Clark. These are two of the issues (there are others) in the 7b answer. There is some legitimate room for debate on which Prime Ministers should be on lists like these, but I don't consider any of the names presented as clearly wrong. 7b : -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > Who was Canada's best Prime Minister? Canada has had several effective and well-respected Prime Ministers throughout its history, making it difficult to pinpoint a single individual as the "best." However, some notable Prime Ministers who have made significant contributions to the country include: 1. Sir John A. Macdonald (1867-1873, 1878-1880): Often considered one of Canada's most important Prime Ministers, Macdonald played a crucial role in shaping the country's political and economic systems. He was instrumental in creating the National Policy, which helped establish Canada as a major industrial power, and he also negotiated the Northwest Passage Agreement with the United States, securing Canada's western border. 2. William Lyon Mackenzie King (1921-1930, 1935-1948): King was a skilled diplomat and leader who guided Canada through two major crises: World War I and the Great Depression. He implemented policies that helped stabilize the economy and provided support to those affected by the economic downturn. Additionally, he played a key role in establishing the Canadian Broadcasting Corporation (CBC), which has become an important institution for Canadian culture and identity. 3. Lester B. Pearson (1963-1967): Pearson is best known for his role in resolving the Cuban Missile Crisis, which brought the world closer to nuclear war. He also played a crucial part in establishing the United Nations, for which he was awarded the Nobel Peace Prize in 1957. As Prime Minister, Pearson implemented policies that promoted peace and disarmament, and he worked tirelessly to improve Canada's international reputation. 4. Pierre Trudeau (1968-1984): Trudeau is remembered for his charismatic leadership and his efforts to promote Canadian identity. He implemented a number of progressive policies, including the patriation of the Canadian Constitution, which gave the province of Quebec greater autonomy, and he also legalized same-sex marriage in 1979. Additionally, Trudeau was instrumental in establishing the Canadian Human Rights Commission, which has helped protect the rights of marginalized communities. 5. Jean Chrétien (1993-2003): Chrétien is credited with helping to stabilize Canada's economy and promote international trade. He also played a key role in the Belfast Agreement, which brought an end to the Troubles in Northern Ireland. Additionally, he implemented policies that helped to promote diversity and inclusion within Canadian society. Of course, there are many other notable Prime Ministers in Canadian history, but these five individuals have had particularly significant impacts on the country's political landscape and international reputation. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- 13b -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > Who was Canada's best Prime Minister? Determining the "best" Prime Minister of any country is subjective and can depend on various factors such as political affiliation, policy preferences, and the current events that occurred during their tenure. However, here are some of the most highly-regarded Canadian Prime Ministers based on historical assessments and public opinion: 1. Pierre Trudeau (1968-1979, 1980-1984): Known for his charisma, progressive policies, and efforts to promote Canadian unity, Trudeau is often considered one of Canada's greatest Prime Ministers. He implemented policies such as official bilingualism, the Canadian Charter of Rights and Freedoms, and the creation of the Canadian Human Rights Commission. 2. John A. Macdonald (1867-1873, 1878-1891): As Canada's first Prime Minister, Macdonald played a crucial role in shaping the country's Confederation and establishing many of its foundational institutions. He is credited with developing the National Policy, which aimed to promote economic growth and unity through tariffs and transportation infrastructure. 3. Lester B. Pearson (1963-1968): Pearson's tenure as Prime Minister saw significant social and political changes in Canada, including the introduction of universal healthcare, the establishment of a new flag, and the devolution of power to Quebec. He was also instrumental in promoting Canadian diplomacy and peacekeeping efforts globally. 4. Wilfrid Laurier (1896-1911): Laurier is often praised for his leadership during Canada's early years, when the country faced challenges such as population growth, economic development, and the need for greater autonomy from Britain. He is credited with promoting French-English relations and expanding the scope of federal powers. 5. Jean Chrétien (1993-2003): Chrétien's tenure saw significant economic growth, the repayment of Canada's national debt, and the negotiation of several major international agreements, including the Free Trade Agreement with the United States. He also played a key role in promoting Canadian unity during the Quebec sovereignty referendum in 1995. Of course, these are just a few examples of highly-regarded Prime Ministers in Canadian history. Other notable leaders include William Lyon Mackenzie King, Joe Clark, and Brian Mulroney, among others. Ultimately, the "best" Prime Minister is a matter of personal opinion and depends on one's values, priorities, and perspectives on Canadian history. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- As someone who lives near Yonge & Eglinton, I found the following answer out of the 13b model ALMOST amusing: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > When will Toronto's Eglinton Crosstown LRT line open? The Eglinton Crosstown Light Rail Transit (LRT) line is a major transit project under construction in Toronto, Canada. The project has been underway since 2013 and is expected to be completed in two phases. Here's the current status of the project and when you can expect it to open: Phase 1: * The first phase of the Eglinton Crosstown LRT line will run from Kennedy Station in the east to Brentcliffe Road in the west, with 25 stops along the route. * This phase is expected to be completed and open to the public in spring 2023. Phase 2: * The second phase of the Eglinton Crosstown LRT line will extend the line from Brentcliffe Road to the Toronto Pearson International Airport, with 15 additional stops. * This phase is expected to be completed and open to the public in the fall of 2024. Please note that these dates are subject to change based on various factors, including construction progress and any unforeseen delays. The Toronto Transit Commission (TTC) will provide updates on the project's status and opening dates as more information becomes available. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Two questions I asked Llama 2 13b related to itself, which I assume to be totally correct: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > Does Llama 2 learn from past questions? Yes, I can learn from past questions! As a large language model, I have the ability to retain information and use it to inform my responses to future questions. This allows me to improve my performance over time and provide more accurate and helpful answers. For example, if you ask me a question that I have seen before, I can draw on my past knowledge to provide a more informed response. Additionally, I can use my understanding of language and context to recognize when a question is similar to one I have seen before, and adapt my response accordingly. However, it's important to note that my ability to learn from past questions is limited by the data that I have been trained on. While I have been trained on a vast amount of text data, there may be certain topics or questions that I am not familiar with or cannot answer accurately. In these cases, I will do my best to provide a helpful response based on the information that I do have. > Do you access the internet when answering questions? Yes, I do access the internet when answering questions! As a large language model, my primary function is to assist with tasks and answer questions to the best of my ability. To do this, I rely on a vast amount of text data that I have been trained on, as well as the ability to access the internet for more up-to-date information. When you ask me a question, I use a combination of natural language processing (NLP) and machine learning algorithms to understand the context and intent behind your question. I then draw on my training data and any relevant information available online to provide an accurate and helpful response. However, it's important to note that while I can access the internet for information, I do not have the ability to browse or search the web in the same way that a human would. My primary focus is on providing answers to specific questions based on the information that I have been trained on and what is available online. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- I find the Llama 2 answers to be interesting enough to keep the program around, but I wouldn't use the answers it provides without some extra checking / verification. Any event, I could go on, but... Any questions for me or Llama 2? Colin VE3ZAA

11 20

Small typo on the Feb 2024's meeting title
by Myles 15 Jan '24

15 Jan '24

Noticed in my calendar today that there is a small typo in the title for next month's meeting. Did up a quick PR (or is it MR in GitLab??): https://gitlab.com/gtalug/website/-/merge_requests/3 On a side note, I'm pretty surprised that the website code base is still working for you folks.

2 1

mailing list convention
by D. Hugh Redelmeier 15 Jan '24

15 Jan '24

There is a long standing convention for this list. 1. when replying to a post, only quote the parts you are responding to. Why? Because this makes it easier for the reader and there are more readers than writers. 2. your response should immediately follow the part of the quote you are responding to. Why? That makes a linear reading work.

1 0

Keeping old machines running.
by Colin McGregor 12 Jan '24

12 Jan '24

Back when dinosaurs still ran the world (ie: +/- 72 million years ago) the standard for high performance mass storage was SCSI hard drives. Of course SCSI has been superseded by other storage solutions, but for various reasons some people want / need to keep those old machines that use SCSI drives in operation. The problem is those SCSI drives are old and failing. I've run across a solution for anyone desperate to keep one of those old machines in operation, BlueSCSI. In summary BlueSCSI uses an Arduino series Pico controller and a microSD card to mimic a SCSI hard drive. All the files required to build a BlueSCSI are available for free here : https://bluescsi.com/ With those files you can build a BlueSCSI from top to bottom. Alternatively, you can get it as a kit or pre-assembled. I don't (any longer) have any machines that use SCSI, but I know our community has a few people that love those old servers so might be interested in a way to keep those dinosaurs up and crawling with new hardware. Colin VE3ZAA

2 1

video: The Dark Side of Open Source
by D. Hugh Redelmeier 08 Jan '24

08 Jan '24

This video was recommended to me: Chris Titus Tech: The Dark Side of Open Source <https://www.youtube.com/watch?v=Q-02fW-n4qg> Apparently Titus recommended Thorium, a mod of the Chromium browser. Now he feel burned because of a couple of non-mainstream Easter eggs. It seems mostly overwrought silliness to me. But you can decide for yourself. The story isn't really about open source. It is about trust and verification of software. The bigger / more complex the object, the harder it is to trust. A very very deep problem. How does open source relate to this? - (we think that) it is harder to sue an open source project than a commercial software producer. - the infrastructure for open source (GitHub, for example) lets you build and distribute new mixes things without a lot of effort. So one oddball can create and distribute a useful system - a larger team, needed in the past, would probably have an average weirdness that is less than some random single creator. - open source software can be examined. This is likely how the "problems" with Thorium were discovered. I don't even know why Thorium was interesting. It is a hacked version of Chromium. Are the hacks interesting? Apparently its main advantage is that it is compiled with higher optimization. If they judged it worth doing, the Chrome project could do this itself. As could the distros that package Chrome or Chromium. The only browsers that I (reluctantly) trust enough to use are FireFox, Chrome, Chromium. Links or Lynx when desperate. Browser-of-the-month isn't a club for me since the browser is my main exposure to security threats. There is a very interesting question here: how can software earn trust? Any software, including open source software. A recent enthusiasm has been to implement procedures to prevent "supply chain attacks". Things like "software bills of materials" (provenance of components). The (deserved) whipping boy has been NPM, the repo for open source JavaScript. Equally scary things exist for Python, Perl, and Rust, for example. The Thorium browser problem could be classified as a supply chain problem. Reliable software is hard. We have to work on it any way that is effective. PS: I'm looking at Titus' video recommending Thorium in the first place. <https://www.youtube.com/watch?v=naDYUVFs1-8> - He gushes about how much faster it is than Chromium and Chrome. - He suggests that the author has added accelerators not in chromium. - A few nice little things. - He mentions "multi-threading improvements" which seems unlikely.

2 1

Re: [GTALUG] lazy jail server admin forced to act
by Alvin Starr 08 Jan '24

08 Jan '24

On 2024-01-08 05:22, ac via talk wrote: [snip] > https://ascams.com/info/domain-anti-forgery/ > > https://www.rfc-editor.org/rfc/rfc7208.txt > > imnsho you can add dkim etc - but ALL Cyber Criminals have DKIM & DMARC > in fact ALL SPAMMERS also have DKIM & DMARC so it is a fairly useless > thing/loop to jump through and disables privacy and has more minusses > than plusses for general society. > > anyway, ymmv > > Andre > SPF and DKIM are more to make it harder for people to spoof your email address. SPF should insure that only your email servers can be used to send mail from your domain. DKIM has the advantage of digitally signing your emails as they go out so that if someone screws with them it should be obvious. DMARC is more about information sharing so that you can get and give reports about who is trying to spoof email. This does not help with spammers who are using Microsft, or Google so that the email comes from their domains. But at least you can stop people sending stuff out as though it was coming from your domain. There was once a guy who insisted on running an open relay and believed that anybody blocking open relays were infringing on his rights. He was VERY loud about his convictions that open relays were not the problem, spammers were. Granted, closing down open relays did not make spamming go away. It did cut down on the vectors that spammers could use to get their content out. -- Alvin Starr || land: (647)478-6285 Netvel Inc. || Cell: (416)806-0133 alvin(a)netvel.net ||

2 1