- Talk - lists.gtalug.org

serious RCE vulnerability via CUPS
by D. Hugh Redelmeier 28 Sep '24

28 Sep '24

There is a serious vulnerability in CUPS. (As usual, it is over-hyped.) A single unsolicited UDP packet can get root access on your machine if you have cups-browserd running. But there are other vulnerabilitied in CUPS, as I understand it. There was a lot of arguing about how serious it is: serious or very serious? It was supposed to be embargoed but it leaked. <https://isc.sans.edu/diary/31302> <https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-…> CUPS (the printing subsystem) is too promiscuous. And it runs as root. - no problem from the internet if you don't run CUPS (few servers and thus most things exposed to the internet). In particular, if a system is behind NAT, it is not exposed to attacks from the internet. - if your firewall blocks UDP port 631 (IPP), no problem behind it. - you should consider attacks from within your LAN. I wonder if a web page could use javascript to create a local attack. But if you want to print, update CUPS (fixes are out, I think). And some part are not fixed (cups-browserd in particular). I think that the simple act of printer discovery is no longer simple. (We just got a colour laser printer. I fed it the WiFi password. Now all our Linux computers can easily print to it. To use it with any Linux computer in the house, the only configuration was asking the print dialogue to use a different printer. I think cups-browserd enabled that.) (To be honest, I've never really thought network printers were trustable, just convenient. WiFi doubly so.) I don't know why anyone thought a big codebase like CUPS ought to run as root. Even after these fixes, the question remains. Michael Sweet, the/an original author of CUPS, left Apple, and has been working on a replacement. There are packages for my distro (Fedora) but I don't really know how it slides into the printing stack. <https://www.msweet.org/pappl/>

1 1

Does anyone have experience with Tuxedo OS?
by Evan Leibovitch 27 Sep '24

27 Sep '24

Hi all. Does anyone here have any experience using Tuxedo OS? It appears to have three benefits over my current distro of choice, KDE Neon: - It's Snap-free by design; packages like Firefox that default as snaps come in Tuxedo from .deb respositories as god intended - It's current but not bleeding-edge KDE; I don't need the kind of aggressive rolling release that Neon does for the desktop while remaining conservative using Ubuntu LTS - It's already abandoned PulseAudio in favour of Pipewire; the version in Neon is broken and may be fixed when it upgrades to use Ubuntu 24.04, Any feedback is appreciated, especially regarding suitability in a dual-boot scenario. Thanks! -- Evan Leibovitch, Toronto Canada @evanleibovitch / @el56

3 3

Programming/Consultancy job posting
by Jeffrey Pikul 17 Sep '24

17 Sep '24

Hello. I have a client who is running a home-brewed PHP 5.x web application on a MySQL database running on a Linux instance. Most of the work will be done on their site's cpanel interface on HostPapa, but there may be work to be done at their Queenston, New York location. This is consultancy work, not a full-time position. What they need is someone a lot better at PHP programming then I am, both to fix their current code issues and to migrate the system to a modern PHP version. The original programmer is long gone. There was an issue recently where php code failed when HostPapa "accidentally" upgraded the site up to php 7.2. This was solved by back-leveling to php 5.x, but the underlying issues remain, and now there are some slowdown issues. In the very short term, some sql statements inside of an ereg() verb will have to be rewritten to fix a problem with output grouping. I tried amending the existing SQL with a GROUP BY , and wasn't successful. When that is resolved, the existing ereg() and mysql_connect() statements will need replacement to something that exists in php 7.x and beyond. In the medium term, they would like a solution to work with this database capable of scanning incoming packages, updating the database directly, and printing to nearby label printers. In the longer term, migrating all of this to a proper virtual machine like Digital Ocean would be more stable, along with a look if there are any maintained FOSS systems that could provide a superior replacement. If interested, please contact me off-list at jpikul(a)rogers.com or jepikul(a)gmail.com Jeffrey Pikul jpikul(a)rogers.com jepikul(a)gmail.com

1 0

Re: [GTALUG] OT: Shots fired - heads up
by Karen Lewellen 14 Sep '24

14 Sep '24

I intended to ask about something touch more specifically? Evan, I freely own that my access to Linux development tends to come from Debian , where I have been a list member for well a very long time..mailing list by the way smiles. you indicate that "most people" have whatsap..spelling, that reddit and discord manage exchanges better. this is a Linux users group. can you please share the specific third party Linux tools from the command line, the most basic of Linux alloing for access to all these services? Not being provocative, simply want to understand since my own communication doors state that Linux is not supported by any of these services at all. I wrote of open source dedication, in my other post. Now I just want examples of how a person, using Linux at the most basic level, can reach these services. Cheers, Karen On Wed, 11 Sep 2024, ac wrote: > On Tue, 10 Sep 2024 13:40:23 -0400 > Evan Leibovitch via talk <talk(a)gtalug.org> wrote: > <snip> >> I see nothing in email (whether in Google Groups, groups.io or a >> conventional list like GTALUG's) that isn't functionally done better on >> Reddit (which allows people to "upvote" the most useful contributions) or >> Discord (which includes streaming and virtual ad-hoc meetings) or WhatsApp >> (which is super simple and most people have it anyway). All three of these >> are free of cost to join or start a group of as many people as you can >> gather. Discord also supports Markdown formatting which is easier to do >> than the HTML in most emails. >> >> You're right, it is about the audience. > > I am over 40 and I use discord and read reddit each and every day... > > > BUT, in the groups, specially the larger one's it is not easy to > read/scan each and every post, more so, when, like in email, the thread > devolves from Google being listed for abuse TO where do I think Glug chat > should migrate to... I usually avoid even reading threads with many replies as > I have no clue who would post anything useful, where in each reply (what I > would find useful, not the 'crowd' - I read upvoted drivel many times each day > and every times this happens I am sure I lose a braincell and seriously > consider leaving whatever platform. > > In fact, if I had no interest in spam/abuse and email and only scanned the > first post in this thread, I would not be even reading any of this on other > platforms. > > I have also had this same discussion, in a few formats and it always ends the > same way... (with everyone doing whatever they want to do :) ) > > >> As I said, this is a generational issue. > > hmm, maybe you are right, but maybe not for the reasons you think? > I recall my first 'smartphone' a Nokia brick, but I could ssh into my > servers (the Nokia had a shell) I could do IRC and so many things mobile. > I also recall using my own first self written App, 2008? (three years after > selling the Linux distro I made) App's were so cool, and surely now > email would become useless. Point I am trying to make is that I > used to be one of the charge leaders on 'email is now finally dead' :) > >> Email works great for people over 40, because it's comfortable and they >> grew up with it. > > Maybe you are right. maybe email is also now comfortable for me. I did not > grow up with it though. I used IRC way before using email. Email always > seemed to 'clunky' and just too much :) > > >> For younger people who grew up with smartphones and apps it's a very >> different story. >> > maybe. but it does not mean that technically one should promote mobile tech. > > we only now know that small kids should not have smartphones. we only now know > about myopia and so many many other harmful effects of where tech has taken > humanity. We will also still be paying that Invoice. > > I could also argue that maybe younger people, Gen A for example, is not even > going to use discord or reddit. They struggle to focus and/or read anything > over 120 characters. (In stating this, I am looking at actual eye tracking > data and analytic data) - When comparing data Gen X and Millenials have the > longest attention spans. imo, discord users are, on average, younger than > reddit users. Much more still needs to be known, but the foundations > expose a trend. > > You should think about what this means? > > also, to add : The 'upvote' idea, the 'like' idea and the 'herd' has advantages, > but as it turns out, has more disadvantages. > > this email has no "like' 'subscribe' 'upvote' 'downvote' and you have to > truly think about who the person is writing whatever and, if you have the > attention span, you have to really focus to understand what is being said :) > > sure, hindsight is perfect. but even in knowing something, like planetary > change is going to extinct us faster, this does not change anything. > > maybe we are evolving ourselves into extinction as we are truly disgusted at > our very nature and the herd is just the herd. > > and, btw, as there are useful things in the bottom post, I have left it > intact, for the record, email allows me to reply inline, snip stuff and > allsorts of other things which, depending on the platform, is either > impossible, or just too much of an effort and just to hard to do... > >> >> On Tue, Sep 10, 2024 at 11:44 AM Karen Lewellen <klewellen(a)shellworld.net> >> wrote: >> >>> As a counter to this idea I offer up groups.io. >>> www.groups.io >>> A location where email not only allows for exchange interaction and >>> communication, but often a great deal of community building as well. >>> especially for folks who wisely wish to avoid the minefield that is >>> Facebook and so forth. >>> Perhaps? it is less about how email may be declining generally, and more >>> about how, in your personal experience, email is less important? >>> I could have listed google groups, and freelists in the place of >>> groups.io, with comparative results. >>> Perhaps its more about the audience? >>> Cheers, >>> Karen >>> >>> >>> >>> On Tue, 10 Sep 2024, Evan Leibovitch via talk wrote: >>> >>>> On Tue, Sep 10, 2024 at 4:56 AM ac via talk <talk(a)gtalug.org> wrote: >>>> >>>> >>>>> I read in a thread here recently that email is dead, >>>> >>>> >>>> That would be me. Or something close to what I said. >>>> >>>> I never said email was dead, but rather it's evolved in a way that >>>> makes >>> it >>>> ever less useful ... just like postal mail. >>>> >>>> Email, like postal mail, is mainly these days for >>>> - Flyers and advertising >>>> - government, business and legal communications >>>> >>>> None of these uses is really interactive, at most they're occasionally >>>> transactional (ie, providing stimulus for me to do something that often >>>> itself does not require mail in response). >>>> >>>> The one benefit of postal mail that is not shared by its electronic >>>> counterpart is the ability to send and receive parcels; the >>>> consequences >>> of >>>> my doing e-commerce in a way that has zero to do with mail of any kind. >>>> >>> And >>>> the one unique benefit of email is that its addresses provide a unique >>>> identifier that can be used to create (and optionally authenticate) >>>> unrelated online accounts. >>>> >>>> I have been hearing that same thing for 30? years now and always for >>>>> different reasons. But volumes of actual transactional email has seen >>>>> exponential growth, year on year, with not even a hint of any decline >>>>> in the growth itself. >>>> >>>> >>>> For most email these days, "transactional" is an aspiration. Most have >>>> response rates of single digits at best. >>>> >>>> Sure, my spam filter is busier than ever ... but the signal-to-noise >>> ratio >>>> has plummeted. Same with postal mail. If it wasn't for flyer mail Canada >>>> Post would be in even more of a financial hole than it now is. Email >>>> marketing does not suffer quite the same financial fate as postal mail >>>> because costs are shared between sender and receiver. >>>> >>>> In a previous life I was on the other side of this. I was involved in >>>> choosing a bulk-mailing vendor and launching numerous bulk email >>> campaigns, >>>> for newsletters and announcements. (FWIW, the vendor we ended up using >>> was >>>> Moosend, based in London and India -- email doesn't care about domestic >>>> versus international rates.) It was cheap, but we never expected more >>> than >>>> low-single-digit percentage of recipients even opening what we sent, let >>>> alone responding by (say) going to the org's website. Providing >>>> strategy >>> to >>>> circumvent RBLs and spam filters has become a cottage industry of its >>> own. >>>> >>>> What interactive functions of email still exist -- mainly the social >>> ones, >>>> like personal mail and forums such as this -- are mostly the artifacts >>>> of the generation that grew up on it. Just like I still receive >>>> birthday >>> cards >>>> in the post, but only from relatives older than me. >>>> >>>> These services may very well never die. But both email and non-parcel >>> post >>>> are destined to continue their ever-further descent into pure nuisance. >>>> >>>> - Evan >>>> >> >> >> > >

1 0

Recommendation for a media center front end?
by Michael Galea 13 Sep '24

13 Sep '24

Hi All, The latest software upgrade of my MythTv Frontend dropped support for my video card, so I guess its time to go shopping. I would appreciate any recommendations for small form factor or mini PC style hardware. I'm currently looking at a Beelink Mini S12 Pro Mini PC, Intel 12th Gen Alder Lake- N100(up to 3.4GHz), 16GB DDR4 RAM 500GB PCIe SSD which is going for $329 on Amazon. Has anyone had experience with this brand? Thanks -- Michael Galea

10 21

War story: Hardware bloat
by Evan Leibovitch 13 Sep '24

13 Sep '24

Hi all. Slightly related to Linux because this ... or rather was ... about an Android tablet. Not a knockoff Alibaba tablet with no vowels in the brand name, an Acer Iconia One bought from Amazon in 2015. It served me well for quite a few years but, as always happens, support for updates ran out and it was replaced for daily use by an Amazon Fire 10 for which I paid almost the same amount (on Prime Day) as for the Acer a decade ago. This raised the issue of what to do with the old tablet, that was not only out of updates but also running much slower than the new stuff. I investigated the many "what can you do with an old tablet" articles and settled into turning the Iconia into a weather station that one could check at any time to see what was coming for the next six hours. It had been doing that task for about two years now, and was stationary and always plugged in. I was looking at it the other day, almost by accident, and noticed the back was much thicker than I recall. Everything was functional, and the tablet had barely been touched since given this role. I suspected something to do with the Lithium battery and immediately became wary. Was this going to be one of those times when the device caught fire or exploded? Some checking online led me to immediately turn off and unplug the device, and put it in the garage. Today I took it to the hazardous waste disposal depot on Ingram Drive (Lawrence/Keele area). Things were deteriorating fast. It had swollen so much that the screen had cracked. I drove to the dump gingerly as if I had a bomb in the car. After informing the depot staff of the nature of the tablet's battery, they were unfazed and had me just put it in the designated "electronic waste" portable dumpster, into which people had tossed their old printers, screens, faxes and a few desktop CPUs. At least it's a thick metal dumpster and any ... incident ... would certainly be well contained. Still, the disinterested response was a little surprising. I've also disconnected my Google account from the tablet, in case anyone has the bright idea to try restarting it. Lessons learned? 1. Routinely inspect any devices you have that contain lithium batteries, even if they're off. 2. Be especially careful with devices that are rarely unplugged such as old devices being repurposed as photo frames, clocks or weather stations. Overcharging is a common cause of such battery failure. 3. This doesn't just happen to Chinese mystery brands, it can happen to household names too. 4. Don't scavenge from electronic waste bins, you never know what's there. Hacklab swap events (the next one is sept 22 <https://hacklab.to/archives/junk-independence-day-5/>) are much more useful for this kind of thing. -- Evan Leibovitch, Toronto Canada @evanleibovitch / @el56

3 3

Re: [GTALUG] OT: Shots fired - heads up
by Evan Leibovitch 13 Sep '24

13 Sep '24

On Tue, Sep 10, 2024 at 4:56 AM ac via talk <talk(a)gtalug.org> wrote: > I read in a thread here recently that email is dead, That would be me. Or something close to what I said. I never said email was dead, but rather it's evolved in a way that makes it ever less useful ... just like postal mail. Email, like postal mail, is mainly these days for - Flyers and advertising - government, business and legal communications None of these uses is really interactive, at most they're occasionally transactional (ie, providing stimulus for me to do something that often itself does not require mail in response). The one benefit of postal mail that is not shared by its electronic counterpart is the ability to send and receive parcels; the consequences of my doing e-commerce in a way that has zero to do with mail of any kind. And the one unique benefit of email is that its addresses provide a unique identifier that can be used to create (and optionally authenticate) unrelated online accounts. I have been hearing that same thing for 30? years now and always for > different reasons. But volumes of actual transactional email has seen > exponential growth, year on year, with not even a hint of any decline in > the growth itself. For most email these days, "transactional" is an aspiration. Most have response rates of single digits at best. Sure, my spam filter is busier than ever ... but the signal-to-noise ratio has plummeted. Same with postal mail. If it wasn't for flyer mail Canada Post would be in even more of a financial hole than it now is. Email marketing does not suffer quite the same financial fate as postal mail because costs are shared between sender and receiver. In a previous life I was on the other side of this. I was involved in choosing a bulk-mailing vendor and launching numerous bulk email campaigns, for newsletters and announcements. (FWIW, the vendor we ended up using was Moosend, based in London and India -- email doesn't care about domestic versus international rates.) It was cheap, but we never expected more than low-single-digit percentage of recipients even opening what we sent, let alone responding by (say) going to the org's website. Providing strategy to circumvent RBLs and spam filters has become a cottage industry of its own. What interactive functions of email still exist -- mainly the social ones, like personal mail and forums such as this -- are mostly the artifacts of the generation that grew up on it. Just like I still receive birthday cards in the post, but only from relatives older than me. These services may very well never die. But both email and non-parcel post are destined to continue their ever-further descent into pure nuisance. - Evan

3 5

Opinions on container management for self-hosting
by Mark Prosser 12 Sep '24

12 Sep '24

Hi GTALUG group, Currently, I'm using docker-compose to deploy my self-hosted apps. I'm considering upgrading this to something easier to maintain. What is everyone using? - Docker/Podman & diligence? - Pulumi / Ansible Terraform / OpenTofu to automate things? - Docker Swarm? - Watchtower for updates? - Rancher? - Kubernetes for a local install? The main issue I'm having is keeping on top of updating my containers, along with keeping track of how my deployments stitch together (aside from my Caddy reverse proxy). I think this is very easy to fix; however, I'm wondering if the community has some feedback on how they made their container management turn-key... without taking on too much technical debt. Warm regards, -- Mark Prosser // E: mark(a)zealnetworks.ca // W: https://zealnetworks.ca

3 7

Weird Keyboard Issue
by Jim Ruxton 12 Sep '24

12 Sep '24

I am having a strange keyboard issue and wondering if it could be a weird setting that got changed somehow. If I hold down my left shift key then press a letter while holding down the shift key, the first character typed is lowercase but all subsequent letters come out uppercase as expected. I can't figure out why the first character typed when holding down that shift key comes out lowercase. My right shift key works as expected., always producing uppercase while held down. I'm on Ubuntu 22.04. My keyboard hasn't always been like this. I can't figure out why this is happening and what has changed. Any thoughts? Thanks Jim

5 6

Re: [GTALUG] OT: Shots fired - heads up
by o1bigtenor 11 Sep '24

11 Sep '24

On Wed, Sep 11, 2024 at 1:57 AM ac via talk <talk(a)gtalug.org> wrote: > On Tue, 10 Sep 2024 13:40:23 -0400 > Evan Leibovitch via talk <talk(a)gtalug.org> wrote: > <snip> > > I see nothing in email (whether in Google Groups, groups.io or a > > conventional list like GTALUG's) that isn't functionally done better on > > Reddit (which allows people to "upvote" the most useful contributions) or > > Discord (which includes streaming and virtual ad-hoc meetings) or > WhatsApp > > (which is super simple and most people have it anyway). All three of > these > > are free of cost to join or start a group of as many people as you can > > gather. Discord also supports Markdown formatting which is easier to do > > than the HTML in most emails. > > > > You're right, it is about the audience. > > I am over 40 and I use discord and read reddit each and every day... > > > BUT, in the groups, specially the larger one's it is not easy to > read/scan each and every post, more so, when, like in email, the thread > devolves from Google being listed for abuse TO where do I think Glug chat > should migrate to... I usually avoid even reading threads with many > replies as > I have no clue who would post anything useful, where in each reply (what I > would find useful, not the 'crowd' - I read upvoted drivel many times each > day > and every times this happens I am sure I lose a braincell and seriously > consider leaving whatever platform. > > In fact, if I had no interest in spam/abuse and email and only scanned the > first post in this thread, I would not be even reading any of this on other > platforms. > > I have also had this same discussion, in a few formats and it always ends > the > same way... (with everyone doing whatever they want to do :) ) > > > > As I said, this is a generational issue. > > hmm, maybe you are right, but maybe not for the reasons you think? > I recall my first 'smartphone' a Nokia brick, but I could ssh into my > servers (the Nokia had a shell) I could do IRC and so many things mobile. > I also recall using my own first self written App, 2008? (three years > after > selling the Linux distro I made) App's were so cool, and surely now > email would become useless. Point I am trying to make is that I > used to be one of the charge leaders on 'email is now finally dead' :) > > > Email works great for people over 40, because it's comfortable and they > > grew up with it. > > Maybe you are right. maybe email is also now comfortable for me. I did not > grow up with it though. I used IRC way before using email. Email always > seemed to 'clunky' and just too much :) > > > > For younger people who grew up with smartphones and apps it's a very > > different story. > > > maybe. but it does not mean that technically one should promote mobile > tech. > > we only now know that small kids should not have smartphones. we only now > know > about myopia and so many many other harmful effects of where tech has taken > humanity. We will also still be paying that Invoice. > > I could also argue that maybe younger people, Gen A for example, is not > even > going to use discord or reddit. They struggle to focus and/or read anything > over 120 characters. (In stating this, I am looking at actual eye tracking > data and analytic data) - When comparing data Gen X and Millenials have > the > longest attention spans. imo, discord users are, on average, younger than > reddit users. Much more still needs to be known, but the foundations > expose a trend. > > You should think about what this means? > > also, to add : The 'upvote' idea, the 'like' idea and the 'herd' has > advantages, > but as it turns out, has more disadvantages. > > this email has no "like' 'subscribe' 'upvote' 'downvote' and you have to > truly think about who the person is writing whatever and, if you have the > attention span, you have to really focus to understand what is being said > :) > > sure, hindsight is perfect. but even in knowing something, like planetary > change is going to extinct us faster, this does not change anything. > > maybe we are evolving ourselves into extinction as we are truly disgusted > at > our very nature and the herd is just the herd. > > and, btw, as there are useful things in the bottom post, I have left it > intact, for the record, email allows me to reply inline, snip stuff and > allsorts of other things which, depending on the platform, is either > impossible, or just too much of an effort and just to hard to do... > > Hmmmmmmmm - - - been following the thread - - - - I'm thinking that its not that email is dead or dying, its not that attention span has been decreasing (although not training ourselves to think and learn really is increasing the level of helplessness in our society) I think the real problem is that we have or are most definitely forgotten how to communicate - - - because we really don't!!! The idea with writing is that one can communicate - - - have worked with those that can read anything unless it is printed (wow - - - huge handicap!). Now one gets notifications for most everything - - - why - - - because it makes one feel good - - - is that what communication is all about - - - feeling good?!!? So - - - can we change the direction of the thundering herd? (I think that that is the crucial question - - in point of fact!) Regards

1 0