| *** n2klb_ is now known as n2klb | 02:34 | |
| *** n2klb_ is now known as n2klb | 07:51 | |
| Mister_Magister | yooo obs is still up nice | 10:28 |
|---|---|---|
| Mister_Magister | aaand it just died | 11:37 |
| Mister_Magister | aaand its back | 11:37 |
| Mister_Magister | abr: i created this for testing qmlglsink on devices https://build.sailfishos.org/project/show/home:mister:qmlglsink | 11:38 |
| Mister_Magister | probably too old for 5.2 | 11:38 |
| * mia glares at the ca-certificates package from 2025 that still contains unrevoked emudhra certs | 14:43 | |
| mia | jolla are you for real | 14:43 |
| mal | I thought those were removed in latest 5.2 release, how did you check it? | 14:50 |
| henk | O_O /-: | 14:50 |
| mal | the version says it is from 2025 but removals were done to it | 14:52 |
| mal | https://github.com/sailfishos/ca-certificates/commits/master/ | 14:52 |
| mia | still saw the certs in the settings app | 14:54 |
| mia | that version does not appear to be in the repo yet | 14:54 |
| mal | which sailfish version do you have? | 14:54 |
| mia | 5.2.0.22 | 14:55 |
| mia | oooh hang on. wrong certs i’ve been looking at. | 15:10 |
| mia | tbh i’d rather distrust the entire CA after a fuckup like this but ehh | 15:11 |
| mia | sorry for the noise anyway | 15:11 |
| mal | it was G3 that was the problem, I only see C2, C3 and G2 in the list | 15:19 |
| mia | yeah i saw C3 and confused it | 15:33 |
| zhasha | This has been marked fixed but I thought it was the same bug that caused a crash on my phone so I ended up dumping a bunch of debugging work in this thread and now I'm afraid jlaakkonen won't see it: https://forum.sailfishos.org/t/fixed-5-2-jolla-phone-2026-wireguard-vpn-crashes-other-network-connections/30643 | 18:19 |
| zhasha | What do I do to get it noticed and tracked? | 18:19 |
| poetaster | did you try a bug report on the conman github repo? | 18:49 |
| poetaster | ah, issues not open. 16 PRs in the queue. | 18:51 |
| zhasha | I'm not great at Microsoft's social media site but it doesn't appear to have an Issues page https://github.com/sailfishos/connman/ | 18:52 |
| poetaster | zhasha, name jlaakkonen in the thread and he'll get a mail. | 18:52 |
| zhasha | was afraid that was considered bad etiquette | 18:53 |
| zhasha | It's always like this. I just wanted to secure my IMAP server with WireGuard and now I'm several hours in diagnosing the kernel not honoring a several decade old interface with libc | 18:56 |
| poetaster | zhasha, I secure my IMAP server with rubber bands and razor blades :) | 19:04 |
| poetaster | zhasha, there a number of in depth conman/wireguard reports. did you read: https://forum.sailfishos.org/t/5-2-0-22-jolla-phone-2026-ipv6-data-leak-protection-does-not-cover-the-modem-managed-ims-interface-ccmni-ipv6-is-routed-outside-the-vpn/36233 | 19:05 |
| zhasha | No but I'm only interested in using a scoped link-local address specifically so it can't be routed wrong | 19:08 |
| zhasha | skimming that report I can tell you it works with ipv6 because a total vpn turns split routing off, which means it doesn't hit the code that crashes for me | 19:09 |
| poetaster | ah, see it. | 19:10 |
| zhasha | unfortunately I switched all of my self hosted stuff to layer on wg over a week ago and now I'm going with mail and IRC on my phone :( | 19:11 |
| mal | I linked the wireguard topic to jolla internal chat | 19:11 |
| poetaster | I think you need not consider etiquette, but the better route might be a new bug report since it's not covered. | 19:11 |
| poetaster | sorry, you switched off your self hosted stuff to layer on wg. I'm way too conservative to do that :) | 19:12 |
| zhasha | I took out all of the TLS stuff and replaced it with wg | 19:12 |
| zhasha | and I went the whole 9 yards with it. Symmetric keys to protect against quantum supremacy and everything | 19:13 |
| zhasha | the real reason I did it was that my IMAP server was constantly under attack and I was tired of it | 19:14 |
| poetaster | zhasha. I've been running my mail server continuously for decades. It's evolved from qmail circa 2003 ... :) | 19:14 |
| zhasha | well then I'm just some silly noob here since I've only run mine since 2009 :P | 19:15 |
| poetaster | 2009 is a long run. Why all super safe just about now? | 19:15 |
| zhasha | I'd already done it for a much more paranoid setup and it was easy to copy, plus it solves some annoyances I've had for many years | 19:15 |
| poetaster | Ok. I'm only paranoid if I don't get network trust from the evil corps (ie. MS & Google) | 19:16 |
| zhasha | My log used to be 99% futile attacks | 19:17 |
| Mister_Magister | 99%? so 1% succeded | 19:18 |
| zhasha | lol | 19:19 |
| zhasha | then I implemented a quick fix where I only allow whitelisted IPs to access it, and I can remotely add to the whitelist with an HTTP GET request to a very long random URL | 19:19 |
| zhasha | and it's nice and all but now I have to click the button every time I want to access mail on my phone | 19:20 |
| zhasha | and of course I also have my IRC bouncer that isn't being actively attacked but I'm betting is full of holes | 19:21 |
| zhasha | and finally I'm terrible about updating my server | 19:22 |
| poetaster | ah. ah, sure. I do have a significant futile attack rate, but no where near 99% | 19:23 |
| poetaster | this is the current funny one: grep sasl_username=blueprint@poetaster.de /var/log/mail.log | wc -l | 19:24 |
| poetaster | 574 | 19:24 |
| poetaster | pw crackers, go. it's post quantum. It's post scarcity. They're going for the bounty. | 19:26 |
| zhasha | I've become majorly prejudiced against TLS over the past couple of years | 19:29 |
| zhasha | The CA system is Trust Me Bro™ security and practically just DANE without DNSSEC | 19:29 |
| x2s | We need more honeypots to waste their time... | 19:29 |
| zhasha | yet everyone refuses to implement DANE because ... | 19:30 |
| x2s | zhasha: that criticism is probably as old as the CA system itself... I remember the same discussions 25 years ago | 19:30 |
| zhasha | it was less true 25 years ago | 19:30 |
| poetaster | zhasha, I did do dane, but currently need to set up dnssec again. | 19:30 |
| poetaster | zhasha, no it was even worse 25 years ago because you had to do cacert or purchase. | 19:31 |
| zhasha | 25 years ago we didn't do second-to-second auto-issuing based on plaintext DNS | 19:32 |
| zhasha | At least they pretended to give a shit and sent you an email | 19:32 |
| x2s | zhasha: nah, it was equally true back then. But we didn't have Let's Encrypt back then. So many things got better thanks to that project. | 19:32 |
| zhasha | It was, for its faults, a separate system to DNS. Now it's just DNS, except they also don't bother with the SEC part | 19:33 |
| zhasha | Let's Encrypt is DANE but worse | 19:33 |
| poetaster | zhasha, well, it's also a political issue. If complete anon and encrypted email traffic were common, it would be made illegal :) | 19:34 |
| zhasha | If you read the ACME standards they mention things like multi-path verification to mitigate the fact that they're just fetching plaintext DNS records to issue valid certificates for literally any name on the internet | 19:35 |
| poetaster | zhasha, yes, it's true. But as recent events in Germany demonstrate, no one is competent at rolling over those DNSSEC keys, so everyone just lives in fear :) | 19:37 |
| zhasha | I'm not trying to be anonymous. My domains are registered in my name after all, and I even host public stuff over plain HTTP because I don't care if you can see my picture of Ainsley Harriot pouring oil coming over the wire | 19:37 |
| zhasha | and as a bonus, now I don't have to ask permission from some random organization every month to pretty please let me verify my own identity when I log in to my own stuff | 19:39 |
| poetaster | zhasha, ok, not sure I understand, but I don't every have to verify my identity unless it's for my sons fake id or my online shop on etsy. | 19:40 |
| zhasha | When you log in to your mail server you presumably verify that you're talking to your mail server and not the great firewall of China | 19:41 |
| zhasha | or rather, TLS does that for you using your system trust store | 19:42 |
| zhasha | and a certificate issued by a CA | 19:42 |
| poetaster | I use mutt ON the mail server most of the time. But my telephone does do what you suggest :) | 19:43 |
| poetaster | zhasha, that is, I put too much faith in ssh :) | 19:44 |
| zhasha | I'd put my trust in OpenSSH before I put my trust in every CA on Earth combined for sure | 19:45 |
| poetaster | I used log into a server at mae west via a server at mae east and read my mail in Germany via California. But, sadly, the sysadmin who managed my little black box retired :) | 19:49 |
| poetaster | I used to be spoiled cause I had a friend who was 'the' network architect for sprint. I had dark fiber. | 19:51 |
| poetaster | sigh. now I'm just a noob with a proxmox cluster at hetzner. sigh. | 19:52 |
| zhasha | We get older, we have less time to faff about with sysadmin'ing | 19:52 |
| zhasha | I don't have any cool history like you though. My internet life has been frightfully boring | 19:53 |
| zhasha | my server is physically in my house though | 19:53 |
| poetaster | zhasha, my internet life started in 1989 in my friend Jonathan's barn. Irix box (8 processors) as a mail server. It was a crazy ride until about 1999. | 19:54 |
| sharks[m] | A noob with a proxmox at hetzner? Man, I'm just a guy with a headless debian box in my cupboard as my mailserver | 19:55 |
| poetaster | You have a headless debian in a CUPBOARD. envy. | 19:55 |
| poetaster | Ok. Now I know why you're paranoid. You let internet traffic into your home. | 19:56 |
| poetaster | I have to admit, I don't know too many people who went scuba diving for a network admin to get fiber from his offic to his apartment. That's what you have to do to get an off the grid box at a pop. | 19:58 |
| poetaster | Ok, back to polishing rbl scripts :) | 20:00 |
| Renaud[m] | I hope your OpenSSH is not built against musl... https://sshhole.com | 20:00 |
| zhasha | has to be with password auth and without PAM | 20:01 |
| zhasha | OpenSSH pulling clever tricks and musl adhering to the standard to the letter -> kaboom | 20:01 |
| poetaster | yeah, that's a mess. password auth. is that a thing with ssh :) | 20:03 |
| zhasha | poetaster: the real reason I got so paranoid is because I own and develop a payment service provider IRL. I'm required by the PCI SSC to be paranoid as hell | 20:05 |
| poetaster | zhasha. Ah. I wouldn't touch that work with a ten foot pole :) My idea of internet facilitated payment services is a fax server serviced by a woman name Michele in upstate New York. | 20:06 |
| poetaster | (true story). | 20:07 |
| zhasha | However bad you think credit cards on the internet is just know: it's several orders of magnitude worse | 20:07 |
| zhasha | stolen cards are sold by the millions | 20:07 |
| zhasha | we've had to implement complex and hilarious mitigations against (for some reason mostly Egyption) people testing stolen credit cards against our customers webshops | 20:08 |
| poetaster | zhasha, oh, I know. But I got out of the game in 2001 :) We used to book the sale (US -> Germany) of Mercedes automobiles via a test transaction against a credit card. That's were Michele came in :) | 20:08 |
| zhasha | MOTO (Mail Order/Telephone Order) is still a thing | 20:09 |
| poetaster | zhasha, yeah, and that'd be good if you had to do it, err, by mail. With a postcard from Tahiti. | 20:10 |
| zhasha | Credit cards are an absolute shit show | 20:11 |
| zhasha | Peak security theater | 20:11 |
| poetaster | zhasha, true, true. The German DHL's agreement with Paypal is even more theatrical. | 20:12 |
| poetaster | DHL circumvents 2nd factor for a 'better customer experience'. I have complained. | 20:12 |
| zhasha | The funniest thing about that is that it was the acquirers and issuers who were the most against implementing PSD2, because it's way more expensive to maintain than just paying back people who've been defrauded | 20:13 |
| poetaster | But then, my bank ('the' German bank) can't get simple cross site requests (ie. CORS) proper and has permanently broken web pages. The DB admins they have on staff do coke. | 20:13 |
| poetaster | Yeah, that's interesting. A reminder of the beginning of fight club. | 20:14 |
| poetaster | zhasha, I once went down the rabbit hole with a fraudster (cost about 54 Euro) to see what might happen and how, if at all I could get the powers that be to take notice. | 20:16 |
| zhasha | 3-D Secure v2 has something called the frictionless flow. We insert an iframe sourced from your issuer that fingerprints your browser and if they deem you worthy then you don't have to go through a manual challenge | 20:16 |
| poetaster | zhasha, yeah, I watched the traffic. Paypal via DHL had stopped working (cause I don't allow pop-ups) and I got curious. | 20:17 |
| poetaster | I don't always use paypal, but when I have a balance (from sales) I sometimes use it. | 20:17 |
| zhasha | it'll still work with us, you'll just get a challenge | 20:17 |
| zhasha | and you'll probably have to wait 10 seconds for it to time out | 20:18 |
| zhasha | I thought when I got into this industry that it would be full of people who put meticulous care into getting it right because it's about moving money but holy shit was I wrong | 20:19 |
| poetaster | zhasha. and that is why I got out of the C-Suite. I realized that earning too much money leads to a disconnect with the reality shared by the vast majority of human beings. | 20:20 |
| zhasha | Don't worry, I'm still dirt poor | 20:20 |
| zhasha | turns out you're supposed to nickle and dime your customers | 20:20 |
| poetaster | zhasha, me too :) again :) | 20:20 |
| poetaster | nickle and dime. sigh. when will we ever evolve. | 20:25 |
| titinonero | Hi, all... anyone can help me for a new account on OBS? I read that I shall contact Keto... but they look offline | 20:28 |
| poetaster | titinonero, I keep saying ignor etiquette and post to the forums with an @keto that produces mail :) | 20:34 |
| poetaster | sorry, keto :) | 20:34 |
| *** Mister_Magister_ is now known as Mister_Magister | 20:47 | |
| Mister_Magister | abr: got qmlglsink stuff working on miami and pipa so we're good again | 20:58 |
| Mister_Magister | droidmedia fix will only land if port owner built latest tag, gst-droid lacks the fix, so i guess I have to wait for 5.3 | 21:15 |
| Mister_Magister | for like mass adoption | 21:15 |
| Mister_Magister | but we getting closer | 21:16 |
| *** Mister_Magister_ is now known as Mister_Magister | 21:32 | |
| Mister_Magister | lmao wpa3 works on op6 | 21:35 |
Generated by irclog2html.py 2.17.1 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!