[03:28] *** daca has quit IRC (Ping timeout: 272 seconds) [03:28] *** toddf has quit IRC (Ping timeout: 272 seconds) [03:29] *** trobotham has quit IRC (Ping timeout: 256 seconds) [03:29] *** toddf has joined #arpnetworks [03:29] *** ChanServ sets mode: +o toddf [03:30] *** Hien has quit IRC (Ping timeout: 272 seconds) [03:30] *** Hien has joined #arpnetworks [03:33] *** daca has joined #arpnetworks [03:33] *** daca has quit IRC (Client Quit) [03:33] *** NiTeMaRe has joined #arpnetworks [03:43] *** daca has joined #arpnetworks [06:49] *** poulsen has joined #arpnetworks [06:55] *** poulsen has quit IRC (Ping timeout: 240 seconds) [07:09] *** poulsen has joined #arpnetworks [07:21] *** poulsen has quit IRC (Quit: « Ë×Çü®§îöñX » Info~[v10B.1.1]~ Released~[Jul 31 2005]~ Channel~[#Excursion on EF.Net]~) [07:22] *** poulsen has joined #arpnetworks [07:23] *** poulsen has quit IRC (Client Quit) [07:23] *** poulsen has joined #arpnetworks [07:23] *** poulsen has quit IRC (Excess Flood) [07:23] *** poulsen has joined #arpnetworks [07:35] *** yoberi has joined #arpnetworks [07:47] *** yoberi is now known as yoberi_ [07:49] *** yoberi_ has quit IRC (Quit: Leaving) [07:52] *** yoberi has joined #arpnetworks [10:00] *** poulsen has quit IRC (Remote host closed the connection) [10:00] *** poulsen has joined #arpnetworks [10:17] http://venom.crowdstrike.com/ vulnerability in virtual floppy stuff for KVM, Xen and QEMU [10:20] *** awyeah has quit IRC (Ping timeout: 265 seconds) [10:28] If your web server can write to the floppy drive, you've already messed up big :P [10:29] haha [10:30] Of course it's still a valid vulnerability.... Just don't be upset when a burglar uses a key you've left under your front doormat :p [10:31] same could be said for nearly anything [10:31] Only the ones that rely on a pre-existing privilege escalation [10:33] user opens hosting account with derphost, derphost emails root password, user never changes root password, user's mail acct is compromised and root password and ip address are grabbed [10:33] problem is that another user on the same physical host can allow the host to be pwned and then we're all screwed [10:33] (there are plenty of hosts who do that, and plenty of users who don't know what they're doing who are looking for cheap hosting and don't know not to change host configured pws) [10:33] yes, exactly [10:34] err, know to* change [10:39] *** awyeah has joined #arpnetworks [10:53] hi [10:53] everyone know status of bcp38 deployments around the world? [10:53] i know that page http://spoofer.csail.mit.edu/summary.php providing status, but now it's almost broken [11:02] m0unds: good point, I'd overlooked the obvious fact that this means we're all only as safe as the least-safe guest on the host. [11:03] * brycec pokes up_the_irons over email about VENOM [11:10] http://marc.info/?l=openbsd-misc&m=119318909016582 [11:10] openbsd-misc: "Re: About Xen: maybe a reiterative question but .." from Theo de Raadt @ 2007-10-24 1:14:13 [11:11] lol [11:15] brycec: yeah, i was just thinking along the lines of securing belongings in an apartment building, but your upstairs neighbor falls sleep with a cigarette in hand and burns the building down [11:30] *** yoberi is now known as yoberi_ [11:30] *** yoberi_ has quit IRC (Quit: Leaving) [11:36] i like the custom element blocking in ublock [11:37] i use it to block comments on sites i visit who don't use discus or livefyre, since i block those with ghostery [11:38] *disqus <.< [11:38] >.> [11:39] oh, whoops [11:39] I don't know why I even bother perusing comments on news articles and the like :( [11:39] i just block them so i don't even think about it :) [11:39] I should think about that [11:39] if i want to see them on a particular article, i just use the one-time load feature in ghostery [11:39] it'll reload the page so i can see it and then go back to blocking after [11:39] unfortunately, it only works with third party stuff like disqus***** and livefyre and the like [11:40] What does ghostery do that uBlock can't/won't? Why a second extension? [11:41] *** poulsen has quit IRC (Remote host closed the connection) [11:41] focuses on privacy related stuff [11:41] and widgets [11:41] it can block ads, but i just opt out of that list because it's not as good [11:41] *** poulsen has joined #arpnetworks [11:41] uBlock has privacy-lists though [11:41] ghostery also gives you the ability to selectively toggle seeing stuff or not, so it's convenient [11:41] without having to disable it for the whole site [11:42] trying to find a site w/disqus so i can take a screenshot [11:43] http://www.spokesman.com/stories/2015/may/13/spokane-adopts-new-rules-for-short-term-rentals/comments/ [11:43] (Kudos to that site for burying comments under another link from the article) [11:44] http://i.imgur.com/wfa52sf.png [11:44] ("There are 44 comments on this story. Click here to view comments >>") [11:44] cute [11:44] the other thing is that they control the list, so it can be updated whenever vs predefined intervals on some lists [11:45] i think all the easylists include a minimum update interval of like 5 days [11:45] and if you're using their lists, they expect you to respect that and not update more often [11:45] (not to say you /couldn't/ just update anyway) [11:48] *** poulsen has quit IRC (Remote host closed the connection) [11:48] *** poulsen has joined #arpnetworks [11:52] the other handy thing (imo) is that it blocks a lot of the junky media players that news sites use [11:53] and allows you to toggle them on/off if you want to see a video [11:53] our local news outlets are awful about autoplaying teaser videos for stories and stuff. i hate it. [11:54] I can't go to a local news site because my computer isn't powerful enough [11:54] lol [11:55] "i had to upgrade my pc to read local news" - story at 11 [11:56] *** jlgaddis has quit IRC (Ping timeout: 244 seconds) [12:08] m0unds: I flashblock for that (hooray for Chrome having that builtin) [12:18] ah [12:42] *** poulsen has quit IRC (Remote host closed the connection) [12:42] *** poulsen has joined #arpnetworks [12:52] *** poulsen has quit IRC (Remote host closed the connection) [12:52] *** poulsen has joined #arpnetworks [13:05] Anyone use The Great Suspender on chrome? [14:06] i saw a suspending thing on firefox, it seemed annoying [14:07] m0unds: local news auutoplays videos here too, and they're terrible quality, and it gives you 5 seconds to cancel, but you can't say "always cancel", so have to cancel every time :( [14:08] *** josephb_ has joined #arpnetworks [14:11] *** josephb has quit IRC (Ping timeout: 250 seconds) [14:12] I was not aware of TGS but I may have to play with it. I semi-often go through task explorer and kill unused tabs once memory usage gets heavy, but this could automate that [14:12] thx [14:23] erk this venom thing souunuds disturbing [14:23] people really shouldn't need floppy support these days [14:24] I don't mind fdc support in the emulator itself, because sometimes one needs that. But the fact that Venom is exploitable even without an FDC loaded in the guest is just silly. [14:26] what it brings to mind for me isr that normal processes on linux need more securing [14:26] like once youu break into qemu/kvm it shouuld be more bounded. [14:26] buut i don't think apparmour does much on ubuntu for kvm? [14:27] I thought you were limited to the whatever privs the qemu process has? [14:27] doesn't kvm split into two processes [14:27] i think it normally runs as an intermediate user though [14:28] so you won't have root, but will have access to other vm's [14:28] That's what she said!! [14:28] so like root/secondary user split process model [14:29] I imagine that paravirtualisation makes anything like apparmour rather difficult since you've moved the IO out of the host kernel's view [14:29] actually i think it's single process setuid to user, and kernel modules give it more root-like functionality [14:29] you still open a normal file for read/write [14:29] but how can they know what file the vm is associated with [14:30] or files [14:30] you really need to double-step that kind of thing [14:30] like libvirt could create a second template for the vm itself and both usued together? [14:30] i haven't looked into it, i duno if you can even do that [14:31] this packet of death thing seems to need some obscure driver loaded. [14:31] maybe i need a better place than phoronix to read about this stuff :) [14:31] What POD is that? I didn't see anything mentioned about a POD vector for Venom [14:31] lol phoronix... [14:32] http://www.phoronix.com/scan.php?page=news_item&px=OZWPWN-4-PoD-Linux [14:32] i hate phoronix's benchmarking [14:32] but really there isn't muuch benchmarking available for linux :( [14:32] and they did make a test suite. it's just that there's no good tests for the test suite to execute. [14:32] i suppose the "graphics" side of things isn't too bad. [14:33] but the disk stuff is terrible. [14:33] looks like the POD affects a wireless USB device/stack. Not many people have those... [14:33] (Looking at https://www.kernel.org/doc/readme/drivers-staging-ozwpan-README) [14:33] yeah exactly [14:34] So... fear mongering rather than bug reporting. *sigh* [14:34] a lot of linux vulnerabilities are in (obscure) drivers [14:34] No surprise there. [14:34] That's what she said!! [14:34] you read about scary vulnerabilitles [14:34] then realise it's fine because you don't have usb enabled [14:34] or wireless drivers or whatever it is :) [14:34] i have usb enabled these days. [14:35] but just like disk/keyboard/mouse [14:35] I really disagree with the use of "vulnerability" in this case, at least the way it's used. This is really more bug than vuln. [14:35] i'm not sure how i feel about that. [14:35] For a vuln to be a vuln, it should affect a large userbase and probably go back awhile too. [14:36] in some ways marking all buugs as vulnerabilities sounds like a "nice" idea. [14:36] I feel like "vuln" is more "intentional" than just an uncaught bug on an obscure driver. [14:36] true not for patching [14:36] ie from not being prudent? [14:37] i don't think most vulnerabiltiies are intentional. i think they're oversight, from people not being prudent enough to check all input sizes etc. [14:37] like we normally don't get packets > 1.5k so we'll assign 2k buffer, but we don't check if there's more data, and we'll send as much data as is in packet [14:38] Yeah probably. There's plenty of grey-area here. [14:38] so someone uses 9k mtu on their network, and people send more than 2k of data and do an overrun. [14:38] Really not sure these bugs warrant CVEs though. https://lkml.org/lkml/2015/5/13/739 [14:38] oh wow [14:38] that guuy seems to really putting himself ouut there, jusut looking at how many messages in the thread are his [14:39] i think he's probably trying to get a job or something :/ [14:39] lkml is craaaawling [14:39] it's fast for me [14:39] 1.28 seconds load time on page speed tracker [14:39] (back to normal now) [14:39] Any reason you didn't cc: the maintainer who could actually apply these [14:39] to the kernel tree? [14:39] hahaha [14:39] "You missed me, and the driverdev mailing list. netdev could care less" [14:39] about this. [14:40] greg kh seems cool. [14:40] (I'd clicked a couple of messages and it was just "waiting...") [14:40] 1.26 seconds now [14:40] That's what she said!! [14:40] yeh it's probably packet loss [14:40] what! it's hosted on digitalocean. [14:40] I'm not really familiar with Linux's layout, but a directory called "staging" strikes me as "super-beta" type stuff. Definitely not worth a CVE let alone Phoronix's hype. [14:40] in europe [14:41] sigh [14:41] ok i need a better news site [14:41] with as much news as phoronix is good :) [14:42] so i check news.arpnetworks.com even though i know it's just hosting news rather than what i'm looking for.. [14:42] http://www.itworld.com/article/2920349/security/for-containers-security-is-problem-1.html [14:42] and find this [14:43] "staging" is defined as "This option allows you to select a number of drivers that are not of the "normal" Linux kernel quality level. These drivers are placed here in order to get a wider audience to make use of them. Please note that these drivers are under heavy development, may or may not work, and may contain userspace interfaces that most likely will be changed in the near future." [14:43] And it recommends disabling staging drivers "If in doubt, say N here." [14:43] http://cateee.net/lkddb/web-lkddb/STAGING.html [14:44] yeah, i don't enable staging normally [14:44] i think i did once over 10 years ago [14:44] (Apparently Arch goes against the grain and has it enabled in their default kernel with ozwpan compiled as a module.) [14:46] And if you're curious about the whole Ozmo thing, here's a decent description from the Linux perspective http://fabiobaltieri.com/2013/02/14/hp-wi-fi-direct-mouse-on-linux/ [14:46] Apparently the idea is to have wireless peripherals connect over WiFi instead of Bluetooth or RF dongles. [14:46] And broadly only supported under Winders. Except for this driver. [14:46] * brycec found it interesting [14:47] ahh [14:47] i really have to get away from the arch kernels [14:47] all ubuntu systems are using custom kernels. [15:08] *** Hien has quit IRC (Ping timeout: 265 seconds) [15:16] hmm, so i don't have floppy enabled on kernel for my xen stuff [15:17] and i don't have it in the config for vm's, so i think that means i'm not vulnerable? [15:17] also there's no known exploit yet [15:25] *** jcv has quit IRC (Quit: leaving) [15:25] *** jcv has joined #arpnetworks [15:31] According to what I read, you're vulnerable so long as FDC is supported in qemu, whether or not it's enabled anywhere else. [15:31] yeah so if it's not in the config it's fine [15:32] vultr took 3 hours to apply patch whilst giving downtime it seems [15:32] i have another vm with some cheap place that's got downtime right now [15:32] mercutio: still affected "And on Xen and QEMU, even if the administrator explicitly disables the virtual floppy drive, an unrelated bug causes the vulnerable FDC code to remain active and exploitable by attackers." [15:32] http://venom.crowdstrike.com/ [15:32] yeh that sounds like disabling it insside the vm [15:32] rather than in the external vm config [15:33] err hangon did i disable it extenrakll [15:33] I read it as even if it's disabled in the config, you're still vuln. [15:35] oh [15:35] da,m [15:35] maybe i do have to patch [15:35] and i'm compiling from source for xen ... [15:35] but don't have random users with root [15:35] redhat seems to think that people not having root means you're "reasonably safe" [15:36] Well that IS the biggest thing you can do right :p [15:38] yeah [15:38] sweet vultr gave me an account credit [15:39] nice [15:39] I have a hard time taking this patch seriously. "+Signed-off-by: John Snow " [15:39] hahaha [15:39] (Because "John Snow" is a character on Game of Thrones) [15:39] yeh i know that, i don't watch it, but i still know it :) [15:39] (for anyone that doesn't get it) [15:39] I didn't watch it at first, but recently started (and caught up) and I quite enjoy it [15:39] i did try watching it, i just found it boring. [15:41] there's no good tv atm :( [15:41] i might have to watch mediocre stuff [16:12] venom's getting a lot of news about it [16:13] hmm i wonder if amazon is vulnerable. [16:23] Probably [16:23] then again, maybe not. Hmm. They have customized Xen pretty much, wouldn't be too surprised if they ripped out FDC entirely. [16:24] yeah they might have [16:25] they're not [16:25] they have a CVS advisory on their site [16:25] xen-pv isn't vulnerable either [16:26] oh xen pv is what i use, sweet. [16:26] http://aws.amazon.com/security/security-bulletins/XSA_Security_Advisory_CVE_2015_3456/ [16:26] ^ [16:26] is amazon xen-pv? [16:26] i wondeer if pvhvm is vulnerable [16:26] i imagine probably not too [16:27] if it uses qemu, it's likely vulnerable [16:27] hmm i dunno if it does or not [16:27] it's just using the ept stuff with pv [16:27] ie the performance of hvm, but still need special kernels [16:42] *** poulsen has quit IRC (Ping timeout: 256 seconds) [16:50] *** poulsen has joined #arpnetworks [16:51] mercutio: what did Vultr give you credit for? [16:51] skimming scrollback [16:53] mnathani_: 3 hours downtime to apply patch to kvm [16:54] it's not the first time i've had downtime with vultr, or that vm. [16:55] i haven't really got anything important on it, but to me 3 hours downtime seems like a long time. [16:56] i don't think i've had 3 hours total downtime on arp [16:56] *** poulsen has quit IRC (Ping timeout: 256 seconds) [16:58] there was one planned outage iirc [17:05] s/CVS/CVE [17:05] they have a CVE advisory on their site [17:06] and kudos to m0unds for the info [17:11] oh apparently apparmor is likely to block it on ubuntu [17:11] http://www.ubuntu.com/usn/usn-2608-1/ [17:11] judging from that [17:21] err, ye [17:21] a [17:21] i'm the typo kid [17:22] "The guest operating system communicates with the FDC by sending commands such as seek, read, write, format, etc. to the FDC’s input/output port" [17:22] ^^ so what if the guest OS doesn't have a floppy drive? [17:23] apparently you can't disable it in qemu properly. [17:23] i see: "even if the administrator explicitly disables the virtual floppy drive, an unrelated bug causes the vulnerable FDC code to remain active and exploitable by attackers" [17:23] but that's confusing... [17:23] yeah i don't know if that means in bios, or the libvirt config. [17:23] yaeh [17:23] yeah [17:24] yea, administrator is kind of vague in this case [17:24] is it host admin or guest admin [17:24] haha [17:24] yeah [17:28] https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/ up_the_irons [17:28] It is also exposed regardless of presence of any floppy related QEMU command line options so even guests without floppy disk explicitly enabled in the libvirt or Xen configuration files are affected. [17:28] ah ok thanks [17:29] i wonder if the long term fix is to allow to disable more devices in qemuu [17:29] * brycec hates thanking Red Hat for something [17:29] haha brycec [17:30] i'm surprised the redhat bug tracker is visible [17:30] half the time redhat bug tracking seems to be closed [18:23] regarding venom, Ubuntu advisory states: [18:23] A security issue affects these releases of Ubuntu and its derivatives: [18:23] - Ubuntu 15.04 [18:23] - Ubuntu 14.10 [18:23] - Ubuntu 14.04 LTS [18:23] - Ubuntu 12.04 LTS [18:23] but no mention of 10.04, which I believe is not EOL'd just yet. anyone know if 10.04 isn't affected? [18:25] EOL 4/30 [18:25] 2015 [18:25] https://lists.ubuntu.com/archives/ubuntu-announce/2015-April/000196.html [18:25] Yeah, EOL'd. [18:26] oh fuck, just got EOL'd... [18:26] * up_the_irons cries [18:28] oh, is that the release you were just upgrading stuff to? [18:29] no, but what a PITA anyway... [18:30] freebsd released an update for freebsd-update today too [18:30] errata, errata everywhere [18:30] That's what she said!! [18:31] LOL [18:31] haha, BryceBot you're a goon [18:35] Sigh. [18:44] freebsd apparently has resolved the reboot bug now too :) [19:33] *** awyeah has quit IRC (Quit: ZNC - http://znc.in) [19:35] *** awyeah has joined #arpnetworks [20:10] *** dwarren has quit IRC (Quit: leaving) [20:14] *** toddf has quit IRC (Remote host closed the connection) [20:14] *** dwarren has joined #arpnetworks [20:30] is there anywhere that provides free wildcard certificaters? [20:30] or at least really cheap [20:31] http://www.garrisonhost.com/ssl-certificates/alphassl.html alphassl resellers are usually your best bet [20:31] hmm $45 [20:31] let's encrypt will be around soon i'm hoping [20:32] i assume resellers are probably still more than 420 [20:32] $20 [20:33] myabe should just use cacert [20:33] just want it for testing :) [20:36] mercutio: i can do them pretty cheap [20:36] wildcards [20:36] less than $20? [20:37] no but i can do it cheaper then anyone likely advertises @ $35 [20:37] the more years obviously the cheaper per year [20:38] yeah i want like 3 months [20:38] i can do a free 3 month ssl cert [20:38] but it won't be wildcard [20:38] That's what she said!! [20:38] cacert should be fine i think [20:38] you can ruin an installer to install it at least [20:42] startssl should work too and at least they're in everybody's cert chain [20:42] "ruin an installer" eh? [20:44] startssl don't do wildcard. [20:44] s/ruin/run/ [20:44] "run an installer" eh? [20:44] oh [20:44] i wanted to fix my one :) [20:44] i have one now :) [20:44] mercutio: not for free, no. neither does cacert. [20:45] :P [20:46] oh cacert isn't for free? [20:46] http://wiki.cacert.org/WildcardCertificates [20:54] Last I knew Cacert didn't offer wildcards [20:54] Evidently that seems to have changed in the last 10 years [20:54] Actually this wiki just talks about wildcards in general, but doesn't state whether Cacert offers them. [20:55] "we provide host and wild card certificates which you can issue almost immediately" [20:55] (From http://wiki.cacert.org/FAQ/AboutUs) [20:57] hmm [20:57] i could try it in nginx [20:57] mnathani_: Biggest down-side to The Great Suspender is that in Chrome Sync, all my remote tabs just show as "Suspended Tab" [20:57] it's being annoying in trafficserver and not working but i don't know if it's my config [21:01] yeah seems to work fine [21:10] wiki.cacert.org uses an invalid security certificate. [21:10] The certificate is not trusted because the issuer certificate is unknown. [21:10] lol [21:10] yeah [21:10] what are they included in by default? [21:10] go to root [21:10] like.. a few linuxes? [21:10] and install their root cert [21:11] i dunno [21:11] i mean startssl is usable ebcause it's pre-installed root [21:11] i can't feasibly use cacert [21:11] you can use it for servers etc [21:11] because if i was making my clients install root certs i'd just use my own ca at that point [21:11] Exactly my points, hazardous [21:11] true, but just having a standard one seems good in some ways [21:12] * mercutio checks curl [21:12] if i'm using it for servers [21:12] wosign let you shove a few names in your free cert [21:12] yeah curl seems fine with it [21:12] I don't know about wildcards [21:12] i'd use my CA too [21:12] no wildcards gizmoguy [21:12] assuming you mean the free ssl [21:13] wosign give you 100 alternative names [21:13] hacky way of getting a half-wildcard cert [21:13] https://buy.wosign.com/free/ [21:14] heh yes hacky [21:14] i have a wildcard tinydns domain name :/ [21:14] *cough* [21:14] look up .ambitio.nz [22:57] woot, got http2 going. [23:15] *** toddf has joined #arpnetworks [23:15] *** ChanServ sets mode: +o toddf