- Talk - lists.gtalug.org

Pen testing systems
by Terry Tanski 03 Jun '20

03 Jun '20

I have some Angular web applications that I would like a legitimate company to penetration test for me. Anyone on this list recommend anyone they have used in the past? Looking for good solid coverage, a findings report and then remediation suggestions if required. Thanks, Terry Tanski

1 0

I’m obviously way behind in my reading: IBM owns Redhat
by David Mason 31 May '20

31 May '20

This is not news… except to me, but I thought the article might be interesting to someone. https://www.popularmechanics.com/technology/a24397193/ibm-red-hat/ ../Dave

9 38

Raspberry Pi 4 with 8G of RAM
by D. Hugh Redelmeier 28 May '20

28 May '20

I just got an ad from Seeed Studio. It offers an 8G Raspberry Pi 4 for pre-order. I didn't know of this new RAM size before seeing the ad. Estimated availability date is June 5. <https://www.seeedstudio.com/Raspberry-Pi-4-Computer-Model-B-8GB-p-4595.html> US$75 for a computer with 8G seems quite reasonable. Being greedy, the only Pi 4's I've purchased have been 4G units. I will probably only buy 8G units in the future. I admit that 2G is enough for many purposes. 8G certainly makes a 64-bit OS more desireable. I think that Raspbian is still only 32 bits (so that all Pi's are still supported by one image, I think). Seeed is an interesting "maker" sort of vendor. I have ordered a couple of Pi 4's from them in the past. I consider them reputable. Slowish delivery (from China). They do have a warehouse in the US too. See also <https://techcrunch.com/2020/05/28/raspberry-pi-foundation-announces-raspber…> This says that the Foundation has started working on 64-bit Raspbian. 64-bit Ubuntu and other distros are already available now.

7 6

Automatic .local and .lan hostnames
by Giles Orr 27 May '20

27 May '20

I have a Raspberry Pi on my local network that acts as an MPD server. It's hostname is "pib". I have, for about a year and a half, been referencing it from other machines on the local network as "pib.local". Yesterday, one of the machines stopped being able to find "pib.local" but can now connect to "pib.lan" - which I don't think used to work. I've never set up my local machines to provide <hostname>.local or <hostname>.lan addresses, it seems to be an automatic service of both Fedora and Debian (or Raspbian). And I've always had problems with its indecisiveness about "is it .lan, or is it .local?" For some machines it's one, for some machines it's the other. But I think this is the first time it's switched. And no, I didn't make any configuration changes (or software upgrades) on the machine that switched. So now I'm really interested in how these names are made available. I don't care which of the two names it provides, but I'd really, really like it to do it consistently. Can someone point me in the right direction, and I'll go do my homework. Thanks. -- Giles https://www.gilesorr.com/ gilesorr(a)gmail.com

2 2

(off topic) What power bank should I avoid?
by William Park 20 May '20

20 May '20

My LG Nexus 5X died, and I'm temporarily using an old Samsung Galaxy S3 with poor battery. I may need to use a power bank, until I get a new phone. Which power bank do you recommend (or not recommend)? -- William Park <opengeometry(a)yahoo.ca>

5 6

Re: [GTALUG] CIRA officially launches free DNS firewall for consumers | IT World Canada News
by Sadiq Saif 16 May '20

16 May '20

On 2020-04-28 09:16, ac via talk wrote: > On Tue, 28 Apr 2020 08:13:11 -0400 > > How about just plain old DNSSEC? > (instead of a nanny) - yay, IT Works! - and is so mature > already...(without all the risks of having/using a nanny) DNSSEC and DNS-over-HTTPS/DNS-over-TLS are not the same thing and don't protect against the same threats. DNSSEC protects against DNS cache poisoning by verifying the digital signature and therefore integrity of the zone's contents. That is, it provides authentication not encryption. DOH/DOT provides transport level encryption of the contents of the DNS packets themselves from the host to it's resolver. This provides protection against packet snooping on the wire, for example on an unsecured WiFi connection. > and using connectivity providers (instead of third parties and dns over > https) -- for caching/recursive, like Bell (Bell CA actually does not > track/record/monetise their users DNS querries afaik) I would love if Bell.ca offered DOH/DOT service on their recursive/caching resolvers. > again, dnssec already protects users, it just needs wider adoption, > which is the issue.. .as for "shared" domains like outlook.com - abuse > management costs will increase? - which is probably why dnssec has > never caught on, it is not "sexy" (like some nannies...) DNSSEC adoption is indeed a problem. IMHO, this is because it is a pain to implement properly and provides little benefit to the user of the zone in most cases. Improperly signing a zone will result in it not resolving which is one hell of a failure mode for most people to put up with. I only recently started signing my domains again and that is only because my managed DNS provider made it very simple, as in I click a button, zone is signed and I add the ZSK digest to my domain registrar. Further reading on DOH/DOT and DNSSEC: DNS Wars by Geoff Huston https://blog.apnic.net/2019/11/04/dns-wars/ DNSSEC https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions -- Sadiq Saif https://sadiqsaif.com

3 2

Compressing an image of a microSD card
by Giles Orr 14 May '20

14 May '20

I have an Anbernic RG350, a very nice hand-held gaming console: https://retrogame300.com/products/rg350 It uses a Linux distro that was developed for an older hand-held game console. It turns out that the OS and "internal storage" are on an actual microSD card inside the case: four screws and a gentle tug to get the card out, and you can image the "main drive." It's a 16G SD card with two partitions that occupy the whole card. Between them, they have 1.4G of used space. I imaged the whole card: # time dd if=/dev/sdi bs=4M of=./RG350.SD.2020-05-14.img conv=fsync status=progress This produced a roughly 16G image as expected. Then I compressed it: # time xz --threads=5 RG350.SD.2020-05-14.img This produced a 10G image. My assumption was that compression would see the empty partition space, presumably as a bunch of zeroes, and compress the crap out of it so that the final image would be the same size or smaller than the 1.4G of used space. I'm aware that the free space may not be zeroed out ... It's not encrypted, so that's not the issue. Is there a sane way to back this up that would produce a smaller image? I prefer to image the whole card ... and I like 'dd' because I'm familiar with it, although maybe I should move on ... Is somehow zeroing the empty space on the card a possibility? Suggestions welcomed ... I can live with the 10G backup if I have to, but would prefer a "better" solution if it's available. -- Giles https://www.gilesorr.com/ gilesorr(a)gmail.com

5 11

Somewhat edited copy of EtherPad
by Christopher Browne 14 May '20

14 May '20

https://linuxdatabases.info/blog/?p=233 I turned the EtherPad of notes from last night's meeting into OrgMode, and then that into HTML, and just published it on my blog. That may be a more readable form, perhaps... -- When confronted by a difficult problem, solve it by reducing it to the question, "How would the Lone Ranger handle this?"

1 0

There is a Time Machine Clone for Linux
by Ivan Avery Frey 14 May '20

14 May '20

https://www.rastersoft.com/programas/cronopete.html

5 5

Lightweight Linux Distributions and Graphics Drivers
by Nicholas Krause 14 May '20

14 May '20

Greetings. I've not looked recently but from memory and the discussion yesterday seems people have a use case for them. Off the top of my memory the three ideal candidates depending on what you requirements would be: 1. Arch or Gentoo if your fine rolling basically your own distro with a package manager 2. Debian - Any version with a lightweight desktop should work 3. Debian unstable derivatives based on Debian unstable. Seems there were a lot, the only issue was some like antix were 32 bit, but it now seems to have a 64 bit version. They recommend 256 mems of ram and I was able to open like 3 "normal tabs without hitting swap in firefox with that. Idles between 0 and 3% of a single core from a i5 2500K at 4.2 Ghz in a VM. Rarely hits 3 percent at idle, through mostly its a flat 0% to 1% usage. Even on that amount of hardware it was surprisingly fast. And yes it can probably run YouTube 1080p on a Pentium 4 with enough ram, didn't try through. https://antixlinux.com/ Debian or Arch would be best if your using GPU packages as those would be in either AUR, the user Arch repo probably or another non distribution repo for Debian. Also to my knowledge outside of Nvidia and a few ARM vendors most GPUs are upstreamed in Mesa these days. The problem is that Nvidia has been the only real choice in the high end due to it performing better there for the last few years, there are rumors of Intel building discrete cards through: https://www.tomshardware.com/news/intel-xe-graphics-all-we-know Maybe that helps some people as I forget to mention this yesterday, Nick -- Fundamentally an organism has conscious mental states if and only if there is something that it is like to be that organism--something it is like for the organism. - Thomas Nagel

4 4