- Talk - lists.gtalug.org

Mike's links from tonight
by Stewart Russell 08 Dec '20

08 Dec '20

* Free As In Health Care « blarg? — http://exple.tive.org/blarg/2016/08/29/free-as-in-health-care/ * The Evolution Of Open « blarg? — http://exple.tive.org/blarg/2018/11/09/the-evolution-of-open/

1 0

[GTALUG-Announce] Meeting Tomorrow
by hi＠gtalug.org 07 Dec '20

07 Dec '20

<https://gtalug.org/meeting/2020-12/> # The state of Mozilla with Mike Hoye We will be meeting on Zoom: * Join Zoom Meeting -- https://us02web.zoom.us/j/89306740154?pwd=V0xGekxFWGFpMExXUDdFQnVPbGNPZz09 * Meeting ID: 893 0674 0154P * Passcode: 456858 * Find your local dial-in number -- https://us02web.zoom.us/u/kijld0Qm1 ## Location Zoom meeting room url -- https://us02web.zoom.us/j/89306740154?pwd=V0xGekxFWGFpMExXUDdFQnVPbGNPZz09 ## Schedule * 7:30 pm - Meeting and presentation. # Code of Conduct We want a productive happy community that can welcome new ideas, improve every process every year, and foster collaboration between individuals with differing needs, interests and skills. We gain strength from diversity, and actively seek participation from those who enhance it. This code of conduct exists to ensure that diverse groups collaborate to mutual advantage and enjoyment. We will challenge prejudice that could jeopardise the participation of any person in the community. The Code of Conduct governs how we behave in public or in private whenever the Linux community will be judged by our actions. We expect it to be honoured by everyone who represents the community officially or informally, claims affiliation or participates directly. It applies to activities online or offline. We invite anybody to participate. Our community is open. Please read more about the GTALUG Code of Conduct here: <https://gtalug.org/about/code-of-conduct/>. If you have any questions, comments, or concerns about the GTALUG Code of Conduct please contact the GTALUG Board @ <board(a)gtalug.org>. --- GTALUG Announce mailing list announce(a)gtalug.org https://gtalug.org/mailman/listinfo/announce

2 1

Meeting tomorrow?
by D. Hugh Redelmeier 07 Dec '20

07 Dec '20

Are we meeting Tusday, 2020 December 8? In past days, I would have asked Chris Browne :-( In the more distant past, we would have travelled to dinner and the meeting together.

1 0

Re: [GTALUG] SSL Certs for both web and email servers
by William Witteman 04 Dec '20

04 Dec '20

Thanks for your help! I have not yet set the redirects from http -> https, but the result was achieved *much* more easily than I would have expected. I have an existing cert that I set up as a standalone, which dovecot has been using happily for a few years. I did not know that I could expand what that cert covers, but the good people at EFF have made this very easy. I used this command and it Just Worked(TM): sudo certbot -d comma,separated,list,of,each,domain,and,subdomain,including,the,ones,already,in,place --expand And after a moment, all of my domains and subdomains are under the single umbrella that I already had. Note that the above list includes three different domains and a half dozen subdomains, all of which seem to just work now. Thanks again! On Tue, 1 Dec 2020 at 06:37, ac via talk <talk(a)gtalug.org> wrote: > > On Tue, 1 Dec 2020 03:34:06 -0500 > John Sellens via talk <talk(a)gtalug.org> wrote: > > On Tue, 2020/12/01 08:16:49AM +0200, ac via talk <talk(a)gtalug.org> > > wrote: | > I have three domains and a small but invariant number of > > subdomains | > that I want to encrypt - should I try to pull them all > > under one SSL | > cert, or do one for each domain, or one for every > > subdomain? I don't | > need a wildcard, but I would like something > > relatively painless if | > possible. > > | > > | yes, in your case, and for painless and easy, just use the domain > > name | and one cert. so, instead of mail.example.com and > > www.example.com | - just use example.com. > > > > I think that might cause client complaints in some cases. > > > imho i do not think with three domains this will be an issue. > > what is the point of having mail.example.com if the IP number for > mail.example.com is the same as example.com ? the same can be asked > about imap.example.com and pop.example.com etc. > > This is just wasteful and increases the risk of issues, ads complexity > and does not serve any "real" technical, logical or functional purpose. > > The reason why mail.example.com used to be prevalent - pre container - > was because mail.example.com - was at a different IP number / different network > even... > > And, actually even if you had 100 domains on one server: reducing > complexity, reducing the amount of DNS lookups and reducing pebcac, > reducing comms, reducing traffic, reducing load and reducing wastage - > means: > > You are making it easier for clients > > And : You are even saving cycles, saving electricity, saving network > traffic and TOOOTEROOO: > > Saving the planet > > in case you did not know: In 2020 - 2030 - we will still get the vast > majority of our power from non sustainable fossil sources. so, we > should all try to be less wasteful, mind you, now with Alaska being > strip mined and auction sold, the planet has a lot more to waste. > > > I think letsencrypt now provides wildcard certifications, but you > > can use mutliple -d options when creating or updating a certificate > > e.g. > > > > certbot certonly \ > > --non-interactive \ > > --expand \ > > --webroot \ > > -w /var/www/html/letsencrypt \ > > --cert-name www.example.com \ > > -d example.com \ > > -d mail.example.com \ > > -d blog.example.com > > And then the one certificate is valid for all those names. > > > a small number of invariant sub domains usually means > www.example.com, pop.example.com, mail.example.com, > imap.example.com and in this case - x3 domains > > but, one could also wildcard (*) just simply -d *.example.com and add > _acme-challenge TXT record to example.com dns zone > (auth: preferred-challenges=dns - when you apply for cert) > > depending on your resources and very importantly, your dns servers > timeouts, rate_limits and other issues, there could be pain/risk with > multiple/many -d every 90 days > > > Hope that helps - letsencrypt is really remarkably convenient. > > > indeed it is. > > > John > > --- > > Post to this mailing list talk(a)gtalug.org > > Unsubscribe from this mailing list > > https://gtalug.org/mailman/listinfo/talk > > --- > Post to this mailing list talk(a)gtalug.org > Unsubscribe from this mailing list https://gtalug.org/mailman/listinfo/talk

3 3

Request experts developers and/or DevOps wanted to help our school paperwork
by Marc Lijour 03 Dec '20

03 Dec '20

Hi everyone, This is a community support request. I've been part of this group for 20 years. I'm working for a non-profit supporting talent and innovation in the IT sector. As part of our efforts to help Canadians and Canadian businesses sustain their living through COVID, and while the ICT sector is searching for new talent to hire, ICTC is launching a novel training online. We will have three streams: software development, data science, and DevOps. For the government paperwork, we require three industry experts (for each one of these streams) to provide us with an assessment. The process should not be too onerous and I can share the questions in advance. The Information and Communications Technology Council (ICTC) is a not-for-profit national centre of expertise for the digital economy. Through trusted research, innovative talent solutions, and practical policy advice, ICTC fosters innovative and globally competitive Canadian industries empowered by a talented and diverse digital workforce. We've been out there for 25 years and we provide many programs for talent of all ages and origins, helping succeed in the digital economy. Examples of programs we have delivered include Arrival to FinTech. We're helping George Brown College launch a new stream for its Blockchain developer program and we're coaching the first cohort of 25 newcomers. We're also in the midst of delivering our Youth Dividend program, which includes hard skills training and a subsidized 7-month placement in enterprise. We're helping grow the talent pipeline. Any of your businesses can pretend to up to 75% in wage subsidies to hire a student. Conditions and information available at https://wil.digital Feel free to contact me here and we can take the conversation offline, unless there are general questions that could benefit this group. Thanks for your attention Marc

1 0

desktop thoughts on Black Friday
by D. Hugh Redelmeier 01 Dec '20

01 Dec '20

I love shopping for computers: studying what features are interesting or useful or inexpensive. I like looking for deals (recreational). I've been looking for non-notebooks (usually called desktops, even though few are on desks, and they vary in size). My current fleet is either Haswell or older, or Atom-based. My my main desktop's CPU is Haswell: Intel Core i7-4770, bought seven years ago. <https://en.wikipedia.org/wiki/Haswell_(microarchitecture)> I have not seen any really compelling reason to update these, even though I want to. Here are some features that my old computers don't have. They haven't yet compelled me to buy a new computer, even on this Black Friday. Up until now, I've replaced my main desktop every two or three years. Something shiny and new would come along. The old one would be relegated to other purposes. Here's a list of the things that make me consider getting a new desktop. Have I missed any that matter to you? ==== UltraHD ==== My old computers don't support HDMI 2.9. This makes is a barrier to using wonderful and cheap UltraHD TV sets. I use work-arounds: Haswell-era DisplayPort supports UltraHD. But not HDR (10 bits per colour per pixel) at that resolution. Dongles that convert DP to HDMI 2.0 are pretty hit-or-miss. New video cards are an obvious answer, if the computer will accept them. They are often noisy, burn power, generate heat, and are expensive. It is surprising how many new computers fail to support HDMI 2.x. Even figuring out if a particular computer supports it is often quite hard to discover from the specifications. - I was looking at a great deal on a Lenovo ThinkCentre M75q Tiny gen 2, with a very current AMD APU. But it doesn't support HDMI 2.x. <https://forums.redflagdeals.com/lenovo-canada-epp-perkopolis-796-thinkcentr…> - my XPS 15 notebook, with an UltraHD display, doesn't even support HDMI 2.x! - there has been a very good deal on a medium range notebook with the latest AMD chip. Its HDMI port doesn't support HDMI 2.x (but this isn't documented in the specs) <https://forums.redflagdeals.com/dell-dell-15-4500u-usb-c-dp-4k60-65w-pd-649…> ==== faster CPUs and more cores ==== Little of what I do is processor-bound. New processors are perhaps twice as fast (my unresearched belief). Not very compelling. My main desktop has 4 cores (8 if you count SMT). I doubt that more cores would help much of what I do. ==== NVMe SSD support ==== SATA SSD seems fast enough for my purposes. NVMe would be better, but would I notice? ==== fancy new features added to USB after USB 3.0 ==== This seems important, especially in notebooks, but I don't know what I'm missing. ==== hardware acceleration of crypto ==== AES and more is useful. I most want it on the little PCs I use as gateways for my networks (gateways are routers, firewalls, and more). ==== hardware acceleration of audio and video CODECs ==== This is most useful on streaming endpoints. But all desktops now seem to do some of that. DRM is mixed into this, often sidelining Linux desktops. We end up doing most of our TV-like streaming with a Google TV box so this takes the requirement off our desktops. ==== support for video-calling and video-conferencing ==== We just use notebooks for this. ==== power usage ==== Newer desktops could use less power but probably don't.

5 10

Re: [GTALUG] SSL Certs for both web and email servers
by John Sellens 01 Dec '20

01 Dec '20

On Tue, 2020/12/01 08:16:49AM +0200, ac via talk <talk(a)gtalug.org> wrote: | > I have three domains and a small but invariant number of subdomains | > that I want to encrypt - should I try to pull them all under one SSL | > cert, or do one for each domain, or one for every subdomain? I don't | > need a wildcard, but I would like something relatively painless if | > possible. | | yes, in your case, and for painless and easy, just use the domain name | and one cert. so, instead of mail.example.com and www.example.com | - just use example.com. I think that might cause client complaints in some cases. I think letsencrypt now provides wildcard certifications, but you can use mutliple -d options when creating or updating a certificate e.g. certbot certonly \ --non-interactive \ --expand \ --webroot \ -w /var/www/html/letsencrypt \ --cert-name www.example.com \ -d example.com \ -d mail.example.com \ -d blog.example.com And then the one certificate is valid for all those names. Hope that helps - letsencrypt is really remarkably convenient. John

2 1

SSL Certs for both web and email servers
by William Witteman 01 Dec '20

01 Dec '20

Hi! Can I use the same SSL (from letsencrypt) cert for both web and email traffic? I have three domains and a small but invariant number of subdomains that I want to encrypt - should I try to pull them all under one SSL cert, or do one for each domain, or one for every subdomain? I don't need a wildcard, but I would like something relatively painless if possible. I use Apache2 for web (running virtual servers) and Dovecot for inbound email. There are a lot of old tutorials, but I haven't found one that answers my questions quite yet. Thanks!

2 1

Network issues with github
by Alex Beamish 30 Nov '20

30 Nov '20

Hi All, This is probably a blindingly obvious question, but I'm a little stumped. I've done a little work for local business, setting up a Linux server (Ubuntu), developing some code and pushing it to github. It's all worked wonderfully until a few weeks ago, when he had someone in to do something to the network. Since then, Things Are Broken in ways that I don't understand. When I try to do anything with github, I see the response Received disconnect from 140.82.113.3 port 22:2: Connection blocked because server only allows public key authentication. Please contact your network administrator. Because I was worried I'd borked my account, this afternoon I tried again, creating a brand-new account and ssh-ing in .. and still got the same result. My github account works fine from my own machine, and also from my web provider (pair.com) so I'm guessing there's something going on within my client's network. Suggestions gratefully received. Alex -- Alex Beamish Software Developer / https://ca.linkedin.com/in/alex-beamish-5111ba3 Speaker Wrangler / Toronto Perlmongers / http://to.pm.org/ Chair, Sponsorship Committee, TPF / https://www.perlfoundation.org/ Baritone, Operations Manager / Toronto Northern Lights, 2013 Champions / www.northernlightschorus.com

3 5

Fedora 33 uses RAM for swap?
by Giles Orr 25 Nov '20

25 Nov '20

A few days after upgrading the last of my machines from Fedora 32 to 33, I noticed my main machine has acquired a new disk: NAME SIZE FSTYPE LABEL MOUNTPOINT zram0 4G [SWAP] I didn't set that up, and I don't think it was there on F32. So the OS has, without asking, co-opted 1/4 of my 16G of RAM to use as swap space. This system has an SSD, so when I initially set it up (Fedora 27), I made a conscious decision to go without swap space. I rarely push the limits of 16G. But now I'm in the situation that I have only 12G of RAM, so the system will become memory-starved earlier ... and what will it do? It will go to swap. Which is RAM anyway. How does this help? To me this seems like adding complexity without adding utility. Can someone please explain A) if I'm correct about this behaviour in the first place, and B) why it's useful? Thanks. -- Giles https://www.gilesorr.com/ gilesorr(a)gmail.com

4 4