IRC Logs for #crux Wednesday, 2014-06-18

*** phant0mas has quit IRC00:04
*** BitPuffin has quit IRC00:22
*** BitPuffin has joined #crux00:28
*** BitPuffin has quit IRC00:32
*** DaViruz has quit IRC00:33
*** DaViruz has joined #crux00:47
*** himynameisphil has quit IRC01:04
*** himynameisphil has joined #crux01:26
*** himynameisphil has quit IRC01:33
*** himynameisphil has joined #crux01:40
*** hamsterslayer has joined #crux02:20
*** hamsterslayer has quit IRC02:20
Romsterq5sys, i don't think many know about crux. which is a shame everyone seems to know arch but not crux. where can we see trhe stream cast or recorded presentations on the net?02:48
Romsterpidsley, ports -u; prt-get sysup; rejmerge02:51
Romsterwill do the job.02:51
*** mavrick61 has quit IRC02:59
*** mavrick61 has joined #crux03:01
*** hotaronohanako has quit IRC03:17
*** hotaronohanako has joined #crux03:17
*** vlnx has quit IRC04:14
*** vlnx has joined #crux04:29
*** deus_ex has joined #crux05:16
*** phant0mas has joined #crux06:10
*** vlnx has quit IRC06:19
*** DaViruz has quit IRC06:19
*** heroux has quit IRC06:19
*** horrorSt1uck has quit IRC06:19
*** darfo has quit IRC06:19
*** BitPuffin has joined #crux06:22
*** vlnx has joined #crux06:23
*** DaViruz has joined #crux06:23
*** heroux has joined #crux06:23
*** horrorSt1uck has joined #crux06:23
*** darfo has joined #crux06:23
BitPuffinq5sys: well I was just surprised because most people in the JB community I know don't have much of an interest in crux. I use it and have even been on LUP a few times :P06:24
*** darfo has quit IRC06:24
*** darfo has joined #crux06:41
*** Pingax has joined #crux07:19
*** hotaronohanako has quit IRC07:41
*** hotaronohanako has joined #crux07:41
*** lnds has joined #crux08:27
*** BitPuffin has quit IRC08:29
frinnstteK--: bind needs bumping to -P108:30
*** hotaronohanako has quit IRC08:33
*** lnds has quit IRC08:49
*** SiFuh has joined #crux08:54
*** SiFuh_ has quit IRC08:57
frinnsthttp://secureworks.com/resources/blog/hacker-hijacks-synology-nas-boxes-for-dogecoin-mining-operation-reaping-half-million-dollars-in-two-months/09:17
frinnstawesome09:17
*** BitPuffin has joined #crux09:26
teK--hehe yeah :p09:36
teK--bumping bind. Still hating ISC's uplink, what a joke.09:38
cruxbot[contrib.git/3.0]: bind: 9.9.5 -> 9.9.5-P109:48
teK--thx frinnst --^09:48
teK--pidsley: you have to use the ISO to go from 3.0 to 3.109:49
teK--no need for the ISO if you want to go from 3.1-rcX to 3.109:50
frinnstRe: [oss-security] docker VMM breakout10:15
frinnstnice10:15
frinnstfuck office365 with a chainsaw..10:16
frinnstand fuck microsofts indian techsupport10:17
BitPuffinthat's racist10:28
BitPuffinwait docker just released 1.0 and first thing they do is have a VMM breakout vulnerability?10:28
*** hotaronohanako has joined #crux10:34
Romsterprologic, http://seclists.org/oss-sec/2014/q2/56510:38
BitPuffin"Its fixed in docker 1.0" -> "It's ..." FIXED10:39
Romsterstill best to subscribe to the security list, and for reference if james hasn't read that.10:39
Romsterthey say it's fixed but is it really fixed BitPuffin10:40
Romsteri don't touch office 365 and what happens on a leap year? a day of total non-useable?10:40
BitPuffinI dunno10:40
BitPuffinRomster: I was pointing out their spelling error10:41
BitPuffinalso prologic, the md5 checksum isn't matching for the docker port10:49
prologicBitPuffin, ok10:50
BitPuffinjust letting you know :)10:51
prologicta :)10:51
prologicI'll check that out10:51
prologicre the security note10:51
prologicthat's fine :)10:52
*** SiFuh_ has joined #crux10:54
Romsterguess no one can trust docker for awhile eh?10:55
BitPuffinyou can10:55
BitPuffinjust that you need to update it when there is a security fail10:55
BitPuffinlike with every software on earth10:55
Romsteryeah but that one is /kinda/ important what if someone got in got out of it did havoc. just updating it wont fix what they messed up/stole.10:57
*** SiFuh has quit IRC10:57
BitPuffinRomster: well you should maybe not use it to host docker containers for other people10:58
BitPuffinhowever using docker on all your shit is a very good idea10:58
teK--virtualisation can never be a security feature10:59
teK--hsa never been, never gonna be ;)10:59
teK--*has10:59
BitPuffinexactly10:59
Romstermore layers more chance one has a bug in it.10:59
teK--there's this (insecure) code base.. I do not fully trust. Let's throw another code base I cannot trust 100% at it10:59
Romsterway too many unknowns.11:00
Romsterfull coverage tests anyone?11:00
BitPuffinRomster: if I run everything in a docker and there is no known security exploit but say someone knows a security exploit for lighttpd or something that I'm running in docker and they can get a shell, at least they won't be able to get into my system, they will be like oh, this is it?11:00
teK--tests for test, anyone? ;)11:00
teK--they still can tamper with your website, though11:01
RomsterBitPuffin, true it does offer that.11:01
BitPuffinI'd be more cautious however, with using a service that hosts containers11:01
teK--and if PHP is running within the same dokcer instance, with your database, too. Even if it was separated..11:01
BitPuffinat least for important things11:01
Romstergrab your sql password screw over the database11:01
BitPuffinif it's just like host a static webpage, then what they gonna do, act a fooool11:02
teK--than the asset is probably not very very important :)11:02
BitPuffinteK--: it doesn't have to be11:02
BitPuffinteK--: you could have PHP communicating over a socket or something11:02
Romsteruse it to offer virus downloads, then spam everyone with your url and get you blacklisted on all sorts of lists.11:02
teK--yes, I said IF php was within.11:03
BitPuffinwith the db11:03
BitPuffinalthough11:03
BitPuffinif they get the password11:03
BitPuffinthen yeah11:03
BitPuffinuse a compiled language :P11:03
BitPuffindoesn't make it impossible, but less trivial11:03
Romsterphp over a socket is that even efficient?11:03
teK--Romster: it's called fastcgi.11:03
Romster-_-11:03
BitPuffinRomster: I don't know if I've ever seen PHP in production not using a socket :P11:04
teK--and it's the preferred way for scalability (vs. mod_php) for obvious reasons11:04
BitPuffinbut I meant between the db and php processes11:04
teK--as for lighttpd I don't think there's a php module11:04
BitPuffinyou'd probably use *CGI11:05
prologicman I haven't read the fulll backlog11:05
prologicbut don't panic :)11:05
prologicoverreacting11:06
Romsterman wont help you here :D11:06
Romsteri'm being paranoid again.11:06
prologicyes yes you are :)11:06
Romsteronly safe way is not exposing anything at all.11:06
prologicseriously who's going to hack my desktop? :P11:06
Romsterlol i dunno11:07
prologicexactly11:07
teK--seriously?11:07
Romsterbut i was talking in general if there was a big site using docker.11:07
teK--serverop is running quite some php sites (not administered by myself) that got hacked11:07
teK--impression was that these were done using automation; so yes, getting your server screwed is not unlikely11:09
teK--gotta go.11:09
Romsterlater teK--11:10
Romsterprobably some insecure php code.11:10
Romsterthat was poorly written11:11
*** SiFuh_ has quit IRC11:12
*** SiFuh_ has joined #crux11:13
*** hotaronohanako has quit IRC11:17
*** jdolan has joined #crux11:39
*** jdolan has quit IRC12:01
frinnstdoes microsoft offer a suicide prevention hotline due to office 365 stress?12:16
frinnstand does anybody know the phone number?12:16
frinnstwords cannot describe how much i hate it12:22
teK--I feel with you. Had to/will have to code VBA12:25
Pingaxlighttpd serves php spawning fcgi ;)12:33
openfbtdahem. Who aside from apache has a native php module?12:46
BitPuffinnobody wants that shit12:51
frinnstMicrosoft Outlook (Not Responding)12:55
frinnsthow can it suck this bad?12:55
BitPuffinfrinnst: install crux12:56
BitPuffin(best thing to say someone who works in a linux-oppressed place)12:56
Romsterwindows keeps paying my wages.13:03
frinnstyeah, very helpful13:05
frinnst...13:05
Romsterindirectly of course.13:06
Romsterfrinnst, needs a holiday13:07
Romsterwho in there right mind would trust "the cloud" to there precious files.13:09
frinnstits not my files, so i dont care13:10
frinnstI do care, however, when im tasked to fix  someones fuckup13:10
frinnstand working against a black box without any debug info seems pointless13:10
frinnstyet, here I am13:11
Romsterdo yu have a backup? "whats a backup?"13:11
Romster"oh yes i stored a copy on my external hard disk about a year ago" ...13:11
Romsterso no current backup "no"13:11
Romster/dev/null13:12
frinnst2 employees of our customer had their passwords expire13:12
frinnstso office365 exchange broke too13:13
Romsteri did have one god customer had a recent backup and the laptop... external hdd died and the laptop got stood on bent the hdd case. buggered.13:13
Romstereeps13:13
frinnstand its impossible to readd the account in outlook13:13
RomsterO_O13:13
Romsterwhos bright idea was that.13:14
Romsternope no one will let there password expire. that will never happen.13:14
Romsterprogrammers need to get thee shit together and handle all these corner cases.13:15
frinnstIm 2 hours in trying to setup a fucking email account13:16
Romstererror handling, unhanded exceptions, oh and my favourte wating on a printer or disk and the program becomes unresponsive and you have to end up end task it.13:16
Romsterexchange i did mess with them a little and then i go nope let the the guy deal with them.13:16
Romsteri was all yep that should work.... ok why is that not working... talk to the the IT tech, oh you cna't do it the obvious easy way how it's meant to work. you have to do it this way and hop one one leg while repeating work damn it.13:18
Romstergave up on exchange.13:18
Romsterfix viruses and compiers.13:18
Romsterand data recovery13:18
Romsterfrinnst, is in a bad bad place.13:19
Romsteri have come across a ton of corupted pst files.13:19
*** Pingax has quit IRC13:23
*** SiFuh has joined #crux13:33
*** SiFuh_ has quit IRC13:36
*** SiFuh_ has joined #crux14:18
*** SiFuh has quit IRC14:18
*** dkoby has joined #crux14:27
*** jdolan has joined #crux14:34
*** jdolan has quit IRC14:42
*** rexich has joined #crux14:50
*** z3bra has joined #crux14:53
*** jdolan has joined #crux15:30
*** sh4rm4 has joined #crux16:00
*** BitPuffin has quit IRC16:03
*** sh4rm4 has quit IRC16:04
*** sh4rm4 has joined #crux16:06
*** rexich_ has joined #crux16:07
*** rexich has quit IRC16:11
*** sh4rm4 has quit IRC16:17
*** sh4rm4 has joined #crux16:21
*** dkoby has quit IRC16:28
*** BitPuffin has joined #crux17:33
*** BitPuffin has quit IRC17:53
*** BitPuffin has joined #crux17:57
*** rexich_ has quit IRC18:05
*** Pingax has joined #crux18:07
*** Tezu has joined #crux19:00
*** looop has joined #crux19:02
*** sh4rm4 has quit IRC19:32
*** Tezu has quit IRC19:52
*** sh4rm4 has joined #crux19:54
*** sh4rm4 has quit IRC20:04
*** sammi`_ has joined #crux20:28
*** sammi` has quit IRC20:32
*** sh4rm4 has joined #crux20:52
*** sh4rm4 has quit IRC20:55
*** sh4rm4 has joined #crux20:57
*** sh4rm4 has quit IRC21:03
*** sh4rm4 has joined #crux21:07
*** sh4rm4 has quit IRC21:14
cruxbot[opt.git/3.0]: [notify] Revert "nettle: updated to 3.0"21:17
prologichttp://blog.docker.com/2014/06/docker-container-breakout-proof-of-concept-exploit/21:21
prologicSee :)21:21
prologicnothing to panic about :)21:21
frinnstAlso, note that Docker Engine will also soon support user namespaces which will provide a further layer of security for your containers.21:22
frinnstyeah, because user namespaces has had suuuuch a clean security history in the kernel :)21:23
prologicyeah well21:23
prologicit's the kernel :)21:23
prologicit'll get rock solid21:23
prologicit has to :)21:23
prologicthe BD won't allow antything but :)21:23
frinnsthttp://seclists.org/oss-sec/2014/q2/51121:24
frinnstanyways, still better than office36521:25
prologicheh21:26
prologicindeed21:26
prologicwho writes perfect software anyway? :)21:26
joacimmy vb.net assignments in school were pretty damn perfect21:28
joacimmy java assignments too21:28
*** phant0mas has quit IRC21:35
BitPuffinjoacim: liar21:41
*** jdolan has quit IRC21:47
*** jdolan has joined #crux21:48
*** jdolan has quit IRC21:52
joacimok :(21:53
joacimalways got bored by assignments that were made for me21:54
joacimi much rather sit at home and play vide ogames and update gentoo than do my java and vb.net assignments ;)21:54
joacimI wonder if I can do anything with java anymore. think i forgot pretty much everything21:55
*** tilman has quit IRC22:03
*** tilman has joined #crux22:05
*** hotaronohanako has joined #crux22:39
*** jdolan has joined #crux22:55
*** Pingax has quit IRC22:57
*** sh4rm4 has joined #crux23:00
*** Feigr has quit IRC23:06
*** BitPuffin has quit IRC23:08
*** SiFuh_ has quit IRC23:18
q5sysRomster: All the aired shows are at http://jupiterbroadcasting.com  There are links on the main page for the show schedule and the live stream. (which airs reruns except for the live shows).23:18
q5sysBitPuffin, I've seen you in the mumble several times. :P  I know who you are.  tahts why I was teasing you.23:18
q5sysRomster: yea I'd like to get more people aware of Crux, from the little I've played around with it the past few days... I really like it.what I have played around with..23:20
*** SiFuh has joined #crux23:23
*** jdolan has quit IRC23:47
*** jdolan has joined #crux23:47
*** jdolan has quit IRC23:52
*** jdolan has joined #crux23:53
*** sh4rm4 has quit IRC23:57

Generated by irclog2html.py 2.11.0 by Marius Gedminas - find it at mg.pov.lt!