***: toddf has quit IRC (Ping timeout: 272 seconds)
trobotham has quit IRC (Ping timeout: 256 seconds)
toddf has joined #arpnetworks
ChanServ sets mode: +o toddf
Hien has quit IRC (Ping timeout: 272 seconds)
Hien has joined #arpnetworks
daca has joined #arpnetworks
daca has quit IRC (Client Quit)
NiTeMaRe has joined #arpnetworks
daca has joined #arpnetworks
poulsen has joined #arpnetworks
poulsen has quit IRC (Ping timeout: 240 seconds)
poulsen has joined #arpnetworks
poulsen has quit IRC (Quit: « Ë×Çü®§îöñX » Info~[v10B.1.1]~ Released~[Jul 31 2005]~ Channel~[#Excursion on EF.Net]~)
poulsen has joined #arpnetworks
poulsen has quit IRC (Client Quit)
poulsen has joined #arpnetworks
poulsen has quit IRC (Excess Flood)
poulsen has joined #arpnetworks
yoberi has joined #arpnetworks
yoberi is now known as yoberi_
yoberi_ has quit IRC (Quit: Leaving)
yoberi has joined #arpnetworks
poulsen has quit IRC (Remote host closed the connection)
poulsen has joined #arpnetworks m0unds: http://venom.crowdstrike.com/ vulnerability in virtual floppy stuff for KVM, Xen and QEMU ***: awyeah has quit IRC (Ping timeout: 265 seconds) brycec: If your web server can write to the floppy drive, you've already messed up big :P m0unds: haha brycec: Of course it's still a valid vulnerability.... Just don't be upset when a burglar uses a key you've left under your front doormat :p m0unds: same could be said for nearly anything brycec: Only the ones that rely on a pre-existing privilege escalation m0unds: user opens hosting account with derphost, derphost emails root password, user never changes root password, user's mail acct is compromised and root password and ip address are grabbed reardencode: problem is that another user on the same physical host can allow the host to be pwned and then we're all screwed m0unds: (there are plenty of hosts who do that, and plenty of users who don't know what they're doing who are looking for cheap hosting and don't know not to change host configured pws)
yes, exactly
err, know to* change ***: awyeah has joined #arpnetworks Hien: hi
everyone know status of bcp38 deployments around the world?
i know that page http://spoofer.csail.mit.edu/summary.php providing status, but now it's almost broken brycec: m0unds: good point, I'd overlooked the obvious fact that this means we're all only as safe as the least-safe guest on the host. -: brycec pokes up_the_irons over email about VENOM mkb: http://marc.info/?l=openbsd-misc&m=119318909016582 BryceBot: openbsd-misc: "Re: About Xen: maybe a reiterative question but .." from Theo de Raadt <deraadt () cvs ! openbsd ! org> @ 2007-10-24 1:14:13 m0unds: lol
brycec: yeah, i was just thinking along the lines of securing belongings in an apartment building, but your upstairs neighbor falls sleep with a cigarette in hand and burns the building down ***: yoberi is now known as yoberi_
yoberi_ has quit IRC (Quit: Leaving) m0unds: i like the custom element blocking in ublock
i use it to block comments on sites i visit who don't use discus or livefyre, since i block those with ghostery brycec: *disqus <.<
>.> m0unds: oh, whoops brycec: I don't know why I even bother perusing comments on news articles and the like :( m0unds: i just block them so i don't even think about it :) brycec: I should think about that m0unds: if i want to see them on a particular article, i just use the one-time load feature in ghostery
it'll reload the page so i can see it and then go back to blocking after
unfortunately, it only works with third party stuff like disqus***** and livefyre and the like brycec: What does ghostery do that uBlock can't/won't? Why a second extension? ***: poulsen has quit IRC (Remote host closed the connection) m0unds: focuses on privacy related stuff
and widgets
it can block ads, but i just opt out of that list because it's not as good ***: poulsen has joined #arpnetworks brycec: uBlock has privacy-lists though m0unds: ghostery also gives you the ability to selectively toggle seeing stuff or not, so it's convenient
without having to disable it for the whole site
trying to find a site w/disqus so i can take a screenshot brycec: http://www.spokesman.com/stories/2015/may/13/spokane-adopts-new-rules-for-short-term-rentals/comments/
(Kudos to that site for burying comments under another link from the article) m0unds: http://i.imgur.com/wfa52sf.png brycec: ("There are 44 comments on this story. Click here to view comments >>")
cute m0unds: the other thing is that they control the list, so it can be updated whenever vs predefined intervals on some lists
i think all the easylists include a minimum update interval of like 5 days
and if you're using their lists, they expect you to respect that and not update more often
(not to say you /couldn't/ just update anyway) ***: poulsen has quit IRC (Remote host closed the connection)
poulsen has joined #arpnetworks m0unds: the other handy thing (imo) is that it blocks a lot of the junky media players that news sites use
and allows you to toggle them on/off if you want to see a video
our local news outlets are awful about autoplaying teaser videos for stories and stuff. i hate it. mkb: I can't go to a local news site because my computer isn't powerful enough m0unds: lol
"i had to upgrade my pc to read local news" - story at 11 ***: jlgaddis has quit IRC (Ping timeout: 244 seconds) brycec: m0unds: I flashblock for that (hooray for Chrome having that builtin) m0unds: ah ***: poulsen has quit IRC (Remote host closed the connection)
poulsen has joined #arpnetworks
poulsen has quit IRC (Remote host closed the connection)
poulsen has joined #arpnetworks mnathani: Anyone use The Great Suspender on chrome? mercutio: i saw a suspending thing on firefox, it seemed annoying
m0unds: local news auutoplays videos here too, and they're terrible quality, and it gives you 5 seconds to cancel, but you can't say "always cancel", so have to cancel every time :( ***: josephb_ has joined #arpnetworks
josephb has quit IRC (Ping timeout: 250 seconds) brycec: I was not aware of TGS but I may have to play with it. I semi-often go through task explorer and kill unused tabs once memory usage gets heavy, but this could automate that
thx mercutio: erk this venom thing souunuds disturbing
people really shouldn't need floppy support these days brycec: I don't mind fdc support in the emulator itself, because sometimes one needs that. But the fact that Venom is exploitable even without an FDC loaded in the guest is just silly. mercutio: what it brings to mind for me isr that normal processes on linux need more securing
like once youu break into qemu/kvm it shouuld be more bounded.
buut i don't think apparmour does much on ubuntu for kvm? brycec: I thought you were limited to the whatever privs the qemu process has? mercutio: doesn't kvm split into two processes
i think it normally runs as an intermediate user though
so you won't have root, but will have access to other vm's BryceBot: That's what she said!! mercutio: so like root/secondary user split process model brycec: I imagine that paravirtualisation makes anything like apparmour rather difficult since you've moved the IO out of the host kernel's view mercutio: actually i think it's single process setuid to user, and kernel modules give it more root-like functionality
you still open a normal file for read/write
but how can they know what file the vm is associated with
or files
you really need to double-step that kind of thing
like libvirt could create a second template for the vm itself and both usued together?
i haven't looked into it, i duno if you can even do that
this packet of death thing seems to need some obscure driver loaded.
maybe i need a better place than phoronix to read about this stuff :) brycec: What POD is that? I didn't see anything mentioned about a POD vector for Venom
lol phoronix... mercutio: http://www.phoronix.com/scan.php?page=news_item&px=OZWPWN-4-PoD-Linux
i hate phoronix's benchmarking
but really there isn't muuch benchmarking available for linux :(
and they did make a test suite. it's just that there's no good tests for the test suite to execute.
i suppose the "graphics" side of things isn't too bad.
but the disk stuff is terrible. brycec: looks like the POD affects a wireless USB device/stack. Not many people have those...
(Looking at https://www.kernel.org/doc/readme/drivers-staging-ozwpan-README) mercutio: yeah exactly brycec: So... fear mongering rather than bug reporting. *sigh* mercutio: a lot of linux vulnerabilities are in (obscure) drivers brycec: No surprise there. BryceBot: That's what she said!! mercutio: you read about scary vulnerabilitles
then realise it's fine because you don't have usb enabled
or wireless drivers or whatever it is :)
i have usb enabled these days.
but just like disk/keyboard/mouse brycec: I really disagree with the use of "vulnerability" in this case, at least the way it's used. This is really more bug than vuln. mercutio: i'm not sure how i feel about that. brycec: For a vuln to be a vuln, it should affect a large userbase and probably go back awhile too. mercutio: in some ways marking all buugs as vulnerabilities sounds like a "nice" idea. brycec: I feel like "vuln" is more "intentional" than just an uncaught bug on an obscure driver. mercutio: true not for patching
ie from not being prudent?
i don't think most vulnerabiltiies are intentional. i think they're oversight, from people not being prudent enough to check all input sizes etc.
like we normally don't get packets > 1.5k so we'll assign 2k buffer, but we don't check if there's more data, and we'll send as much data as is in packet brycec: Yeah probably. There's plenty of grey-area here. mercutio: so someone uses 9k mtu on their network, and people send more than 2k of data and do an overrun. brycec: Really not sure these bugs warrant CVEs though. https://lkml.org/lkml/2015/5/13/739 mercutio: oh wow
that guuy seems to really putting himself ouut there, jusut looking at how many messages in the thread are his
i think he's probably trying to get a job or something :/ brycec: lkml is craaaawling mercutio: it's fast for me
1.28 seconds load time on page speed tracker brycec: (back to normal now) mercutio: Any reason you didn't cc: the maintainer who could actually apply these
to the kernel tree?
hahaha brycec: "You missed me, and the driverdev mailing list. netdev could care less"
about this. mercutio: greg kh seems cool. brycec: (I'd clicked a couple of messages and it was just "waiting...") mercutio: 1.26 seconds now BryceBot: That's what she said!! mercutio: yeh it's probably packet loss
what! it's hosted on digitalocean. brycec: I'm not really familiar with Linux's layout, but a directory called "staging" strikes me as "super-beta" type stuff. Definitely not worth a CVE let alone Phoronix's hype. mercutio: in europe
sigh
ok i need a better news site
with as much news as phoronix is good :)
so i check news.arpnetworks.com even though i know it's just hosting news rather than what i'm looking for..
http://www.itworld.com/article/2920349/security/for-containers-security-is-problem-1.html
and find this brycec: "staging" is defined as "This option allows you to select a number of drivers that are not of the "normal" Linux kernel quality level. These drivers are placed here in order to get a wider audience to make use of them. Please note that these drivers are under heavy development, may or may not work, and may contain userspace interfaces that most likely will be changed in the near future."
And it recommends disabling staging drivers "If in doubt, say N here."
http://cateee.net/lkddb/web-lkddb/STAGING.html mercutio: yeah, i don't enable staging normally
i think i did once over 10 years ago brycec: (Apparently Arch goes against the grain and has it enabled in their default kernel with ozwpan compiled as a module.)
And if you're curious about the whole Ozmo thing, here's a decent description from the Linux perspective http://fabiobaltieri.com/2013/02/14/hp-wi-fi-direct-mouse-on-linux/
Apparently the idea is to have wireless peripherals connect over WiFi instead of Bluetooth or RF dongles.
And broadly only supported under Winders. Except for this driver. -: brycec found it interesting mercutio: ahh
i really have to get away from the arch kernels
all ubuntu systems are using custom kernels. ***: Hien has quit IRC (Ping timeout: 265 seconds) mercutio: hmm, so i don't have floppy enabled on kernel for my xen stuff
and i don't have it in the config for vm's, so i think that means i'm not vulnerable?
also there's no known exploit yet ***: jcv has quit IRC (Quit: leaving)
jcv has joined #arpnetworks brycec: According to what I read, you're vulnerable so long as FDC is supported in qemu, whether or not it's enabled anywhere else. mercutio: yeah so if it's not in the config it's fine
vultr took 3 hours to apply patch whilst giving downtime it seems
i have another vm with some cheap place that's got downtime right now brycec: mercutio: still affected "And on Xen and QEMU, even if the administrator explicitly disables the virtual floppy drive, an unrelated bug causes the vulnerable FDC code to remain active and exploitable by attackers."
http://venom.crowdstrike.com/ mercutio: yeh that sounds like disabling it insside the vm
rather than in the external vm config
err hangon did i disable it extenrakll brycec: I read it as even if it's disabled in the config, you're still vuln. mercutio: oh
da,m
maybe i do have to patch
and i'm compiling from source for xen ...
but don't have random users with root
redhat seems to think that people not having root means you're "reasonably safe" brycec: Well that IS the biggest thing you can do right :p mercutio: yeah
sweet vultr gave me an account credit brycec: nice
I have a hard time taking this patch seriously. "+Signed-off-by: John Snow <jsnow at redhat.com>" mercutio: hahaha brycec: (Because "John Snow" is a character on Game of Thrones) mercutio: yeh i know that, i don't watch it, but i still know it :) brycec: (for anyone that doesn't get it)
I didn't watch it at first, but recently started (and caught up) and I quite enjoy it mercutio: i did try watching it, i just found it boring.
there's no good tv atm :(
i might have to watch mediocre stuff
venom's getting a lot of news about it
hmm i wonder if amazon is vulnerable. brycec: Probably
then again, maybe not. Hmm. They have customized Xen pretty much, wouldn't be too surprised if they ripped out FDC entirely. mercutio: yeah they might have m0unds: they're not
they have a CVS advisory on their site
xen-pv isn't vulnerable either mercutio: oh xen pv is what i use, sweet. m0unds: http://aws.amazon.com/security/security-bulletins/XSA_Security_Advisory_CVE_2015_3456/
^ mercutio: is amazon xen-pv?
i wondeer if pvhvm is vulnerable
i imagine probably not too m0unds: if it uses qemu, it's likely vulnerable mercutio: hmm i dunno if it does or not
it's just using the ept stuff with pv
ie the performance of hvm, but still need special kernels ***: poulsen has quit IRC (Ping timeout: 256 seconds)
poulsen has joined #arpnetworks mnathani_: mercutio: what did Vultr give you credit for?
skimming scrollback mercutio: mnathani_: 3 hours downtime to apply patch to kvm
it's not the first time i've had downtime with vultr, or that vm.
i haven't really got anything important on it, but to me 3 hours downtime seems like a long time.
i don't think i've had 3 hours total downtime on arp ***: poulsen has quit IRC (Ping timeout: 256 seconds) mercutio: there was one planned outage iirc brycec: s/CVS/CVE BryceBot: <m0unds> they have a CVE advisory on their site brycec: and kudos to m0unds for the info mercutio: oh apparently apparmor is likely to block it on ubuntu
http://www.ubuntu.com/usn/usn-2608-1/
judging from that m0unds: err, ye
a
i'm the typo kid up_the_irons: "The guest operating system communicates with the FDC by sending commands such as seek, read, write, format, etc. to the FDC’s input/output port"
^^ so what if the guest OS doesn't have a floppy drive? mercutio: apparently you can't disable it in qemu properly. up_the_irons: i see: "even if the administrator explicitly disables the virtual floppy drive, an unrelated bug causes the vulnerable FDC code to remain active and exploitable by attackers"
but that's confusing... mercutio: yeah i don't know if that means in bios, or the libvirt config. up_the_irons: yaeh
yeah m0unds: yea, administrator is kind of vague in this case
is it host admin or guest admin
haha up_the_irons: yeah m0unds: https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/ up_the_irons
It is also exposed regardless of presence of any floppy related QEMU command line options so even guests without floppy disk explicitly enabled in the libvirt or Xen configuration files are affected. up_the_irons: ah ok thanks mercutio: i wonder if the long term fix is to allow to disable more devices in qemuu -: brycec hates thanking Red Hat for something mercutio: haha brycec
i'm surprised the redhat bug tracker is visible
half the time redhat bug tracking seems to be closed up_the_irons: regarding venom, Ubuntu advisory states:
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
- Ubuntu 14.10
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
but no mention of 10.04, which I believe is not EOL'd just yet. anyone know if 10.04 isn't affected? m0unds: EOL 4/30
2015
https://lists.ubuntu.com/archives/ubuntu-announce/2015-April/000196.html mhoran: Yeah, EOL'd. up_the_irons: oh fuck, just got EOL'd... -: up_the_irons cries m0unds: oh, is that the release you were just upgrading stuff to? up_the_irons: no, but what a PITA anyway... m0unds: freebsd released an update for freebsd-update today too
errata, errata everywhere BryceBot: That's what she said!! up_the_irons: LOL m0unds: haha, BryceBot you're a goon mhoran: Sigh. mercutio: freebsd apparently has resolved the reboot bug now too :) ***: awyeah has quit IRC (Quit: ZNC - http://znc.in)
awyeah has joined #arpnetworks
dwarren has quit IRC (Quit: leaving)
toddf has quit IRC (Remote host closed the connection)
dwarren has joined #arpnetworks mercutio: is there anywhere that provides free wildcard certificaters?
or at least really cheap staticsafe: http://www.garrisonhost.com/ssl-certificates/alphassl.html alphassl resellers are usually your best bet mercutio: hmm $45
let's encrypt will be around soon i'm hoping
i assume resellers are probably still more than 420
$20
myabe should just use cacert
just want it for testing :) NiTeMaRe: mercutio: i can do them pretty cheap
wildcards mercutio: less than $20? NiTeMaRe: no but i can do it cheaper then anyone likely advertises @ $35
the more years obviously the cheaper per year mercutio: yeah i want like 3 months NiTeMaRe: i can do a free 3 month ssl cert
but it won't be wildcard BryceBot: That's what she said!! mercutio: cacert should be fine i think
you can ruin an installer to install it at least brycec: startssl should work too and at least they're in everybody's cert chain
"ruin an installer" eh? mercutio: startssl don't do wildcard.
s/ruin/run/ BryceBot: <brycec> "run an installer" eh? mercutio: oh
i wanted to fix my one :)
i have one now :) brycec: mercutio: not for free, no. neither does cacert. NiTeMaRe: :P mercutio: oh cacert isn't for free?
http://wiki.cacert.org/WildcardCertificates brycec: Last I knew Cacert didn't offer wildcards
Evidently that seems to have changed in the last 10 years
Actually this wiki just talks about wildcards in general, but doesn't state whether Cacert offers them.
"we provide host and wild card certificates which you can issue almost immediately"
(From http://wiki.cacert.org/FAQ/AboutUs) mercutio: hmm
i could try it in nginx brycec: mnathani_: Biggest down-side to The Great Suspender is that in Chrome Sync, all my remote tabs just show as "Suspended Tab" mercutio: it's being annoying in trafficserver and not working but i don't know if it's my config
yeah seems to work fine hazardous: wiki.cacert.org uses an invalid security certificate.
The certificate is not trusted because the issuer certificate is unknown.
lol mercutio: yeah hazardous: what are they included in by default? mercutio: go to root hazardous: like.. a few linuxes? mercutio: and install their root cert
i dunno hazardous: i mean startssl is usable ebcause it's pre-installed root
i can't feasibly use cacert mercutio: you can use it for servers etc hazardous: because if i was making my clients install root certs i'd just use my own ca at that point brycec: Exactly my points, hazardous mercutio: true, but just having a standard one seems good in some ways -: mercutio checks curl hazardous: if i'm using it for servers gizmoguy: wosign let you shove a few names in your free cert mercutio: yeah curl seems fine with it gizmoguy: I don't know about wildcards hazardous: i'd use my CA too
no wildcards gizmoguy
assuming you mean the free ssl gizmoguy: wosign give you 100 alternative names
hacky way of getting a half-wildcard cert
https://buy.wosign.com/free/ mercutio: heh yes hacky
i have a wildcard tinydns domain name :/
*cough*
look up <anything>.ambitio.nz
woot, got http2 going. ***: toddf has joined #arpnetworks
ChanServ sets mode: +o toddf