IRC Logs for #crux Monday, 2016-11-28

nogagplzsince it's all the rage these days, crux could use its own display server and desktop environment, which is incompatible with all other distros00:14
john_cephalopodanogagplz: Great idea!00:16
john_cephalopodaWe could do it like Ubuntu and say "Wayland is nice, but it has a crappy input system. We make something else!", then we build our display server, realize that input is difficult and just take the wayland input library.00:17
john_cephalopodaAnd because making a display server is a lot of work and we got no infinite time resources, we should just use the existing init system/text editor/3d modelling software/digital art program/photo editing software/adventure game engine/web browser "systemd".00:20
john_cephalopodaA BSD-style init is way too simple, it will just trick people into thinking that Linux isn't just 100% magic.00:21
pedjafor 90% of people, anything related to computers is 'magic'.00:24
john_cephalopodapedja: For people who use CRUX, only a few things in computing should magic.00:25
pedjafor me it's networking.00:26
john_cephalopodaBut if we would use systemd and pulseaudio, things would magically stop working properly and you couldn't just fix it by writing stuff like "killall dhcpcd" into the stop section of /etc/rc.d/net00:26
john_cephalopodapedja: Networking isn't much magic. It's just abstraction layers.00:26
john_cephalopodaYou can connect to HTTP servers with telnet.00:27
pedjai know how it works on a higher level.nitty gritty details are the problem :)00:28
john_cephalopodaATNLP. Application, Transfer, Network, Link, Physical.00:29
pedjanice00:29
john_cephalopodaI just remember "ATM" (the bank machines) but with an N, and "LP" like "Let's Play".00:30
john_cephalopodaI needed it for an exam two years back or so and this was quite helpful.00:30
pedjaor 'attention lizzard people'00:31
john_cephalopoda:D00:31
pedjawhich exam?CCNA or something like that?00:31
john_cephalopodaNetwork Security exam in college.00:32
pedjado you prefer red or blue team?00:32
john_cephalopodaPff, it wasn't such an exam. It was mostly about knowing how RSA and stuff work.00:33
retardAPSTNDP00:37
retardless catchy00:37
retardalso further from actual reality00:37
pedjaOSI model00:39
pedja(yes, i googled it)00:39
pedja35.000 Io(shitty)T devices were used in the biggest DDOS so far.how many millions of them were sold this year?00:42
pedjathe future is bright, indeed.00:42
pedjatalk about job security for netsec professionals.00:43
john_cephalopodaI recently got interested in netsec and related things after watching a short documentation snippet about some red team ethical hacker group who work for companies to find gaps in the systems.00:44
pedjaeveryone wants to be in the red team.defense is just not sexy enough.00:46
john_cephalopodaBut how can you defend when you don't attack?00:49
john_cephalopodaI think as blue team admin, you have to think like a red team member to get really good defense up.00:50
john_cephalopodaOr you will just fail hard and get told what to do by the red team.00:50
pedja"So in war, the way is to avoid what is strong and to strike at what is weak."00:51
john_cephalopodaHumans are the weakest point.00:51
ryu0john_cephalopoda: thought if you have some really gapping security flaws in devices, that's even worse imho. =p00:52
john_cephalopodaThere was a case where people poisoned the daughter of a sys admin. The daughter got into hospital for a few weeks and the admin paid on that until he was out of money. Then he was easy to bribe into doing various things.00:53
pedjapeople keep forgetting that the HUMINT is still the main source of intelligence data.00:54
john_cephalopodaThe one who made the system security lecture told us, that security people are completely helpless about that. The current ideas how to change that are putting up signs in the cafeteria that say 'Don't plug in USB sticks you found!'00:55
pedjahttps://samy.pl/poisontap/00:56
pedjathis guy is a rockstar.00:56
pedjaas Scheier said, security is a process, and fucking hard to do right.00:58
pedjaSchneier00:59
pedjahis 'cryptography engineering' book is pretty interesting, even for someone math-challenged as me01:01
pedjathe tl;dr is 'do not roll your own crypto, stupid', basically01:04
john_cephalopodaHeh, but when you roll openSSL you are suddenly struck by a bug :P01:04
pedjalibsodium is nice01:05
john_cephalopodaThere's also gnutls01:06
pedjaand libressl01:06
john_cephalopodaLibressl still exists?01:07
pedjaof course it does, why would it not?01:07
john_cephalopodaI thought it just sprouted for a year or so after the heartbleed bug and then died again.01:08
pedjaOpenBSD devs are serious people :)01:09
john_cephalopodaWell, still not as widely adopted as openssl01:11
pedjathe 'problem' with it is that they *will* break stuff if it makes sense from security standpoint01:11
pedjaso, any LTS distro, or FreeBSD, that has a long support cycles can;t rely on it01:12
pedjaas for adoption, they don't really care.They are making it for themselves.01:13
pedjaif it is useful for others, good.If it's not, oh well.01:14
john_cephalopodaSo there is the choice between LTS and security?01:14
pedjabackporting patches is not fun, I would presume01:15
pedjabut RedHat built an empire on the concept, so01:17
pedjasomeone here commented that some debian systems that he admins are so old, that they are not vulnerable to the dirtyCOW :)01:19
*** nullspoon has joined #crux01:19
john_cephalopoda:D01:19
*** admincomplex has quit IRC01:20
john_cephalopodaYeah, Debian used to be ultra-old systems with backported patches.01:20
pedja'used to be'?01:20
john_cephalopodaI think they changed quite a lot.01:20
john_cephalopodaIs their new stuff still compatible with their old init system?01:21
pedjaDon't know, never used Debian01:21
john_cephalopodaI think it would be a PITA to do everything for two different init systems.01:21
*** admincomplex has joined #crux01:21
john_cephalopodaHmm, a pentesting repo for crux...01:23
pedjanow that would be fun01:24
john_cephalopodaAlready working on it :D01:26
*** emmett1 has quit IRC01:27
pedjametasploit would be the biggest challenge, it is very picky about Ruby version, iirc01:29
john_cephalopodaMmh01:29
john_cephalopodaI got nmap (with zenmap) and kismet build scripts already.01:30
pedjapaste the list of tools you have in mind somewhere, maybe someone already did some of them01:32
john_cephalopodahttp://tools.kali.org/tools-listing ;)01:32
john_cephalopodaThere are already nmap and aircrack-ng. The nmap in the repo has zenmap disabled for some reason though.01:32
*** ryu0 has quit IRC01:34
pedjadepends on python.GUI could be a separate port.01:34
pedjaI have a (rather small) forensics repo, if you are interested01:36
pedjaforemost, volatility, sleuthkit01:36
pedjaI tried to package Autopsy, but it's still partially broken on Linux01:37
pedjadamn, it's late.good night.01:39
retardanyone got a tip for a fairly simple pdf tool that can still edit form fillable pdfs?01:39
john_cephalopodaShould sleep, too.01:39
john_cephalopodaBye~01:39
*** john_cephalopoda has quit IRC01:40
*** blueness has quit IRC01:54
*** blueness has joined #crux01:57
*** Emmett1 has joined #crux03:01
*** ryu0 has joined #crux03:25
*** mavrick61 has quit IRC03:25
*** mavrick61 has joined #crux03:27
*** Emmett1_ has joined #crux03:28
*** Emmett1 has quit IRC03:31
*** nullspoon has quit IRC03:34
*** Emmett1_ has quit IRC03:41
*** emmett1 has joined #crux03:42
*** nullspoon has joined #crux03:52
*** blueness has quit IRC04:16
*** blueness has joined #crux04:17
*** groovy3shoes has joined #crux04:36
*** emmett1 has quit IRC04:46
*** tilman_ has joined #crux05:17
*** Emmett1 has joined #crux05:33
*** nullspoon has quit IRC06:19
*** groovy3shoes has quit IRC07:20
*** Emmett1 has quit IRC07:21
*** emmett1 has joined #crux07:28
*** SiFuh has joined #crux09:54
*** emmett1 has quit IRC10:03
*** SiFuh has quit IRC11:27
*** SiFuh has joined #crux11:28
*** SiFuh has quit IRC11:34
*** SiFuh has joined #crux11:35
*** SiFuh has quit IRC11:54
*** SiFuh has joined #crux11:54
*** blueness has quit IRC12:27
*** SiFuh has quit IRC13:04
*** SiFuh has joined #crux13:05
*** emmett1 has joined #crux13:20
*** frinnst has quit IRC13:24
*** frinnst2 has joined #crux13:24
*** frinnst has joined #crux13:49
*** john_cephalopoda has joined #crux13:56
*** __dutch__ has quit IRC14:03
john_cephalopodaHi btw14:17
druid_droidhi crux'ers :)14:24
*** emmett1_ has joined #crux14:25
*** emmett1 has quit IRC14:28
john_cephalopodapedja: You said yesterday that you got a few tools in a repo already. How about making a github repo for all the pentesting ports?14:34
pedjado it :)14:35
pedjathere are a *lot* of tools, might as well make it a (informal) team effort14:36
john_cephalopodaHmm, does it make sense to make a github organisation for that? Or should I just make a repo in my profile?14:37
pedjait depends if you want to be the sole maintainer or not.14:38
john_cephalopodaNah, sole maintainership is no fun.14:39
john_cephalopodaI'll make an organisation and invite you.14:39
john_cephalopodaHow should I call it? "CRUX-Pentesting"?14:41
pedjaI would suggest contacting someone from 6c37 team, maybe they will be interested?14:43
pedjathey already have a couple crux repos14:43
pedjaand it makes sense to spread the workload14:44
john_cephalopodaTrue.14:45
pedjaone place on GH of all things Crux would be cool :)14:46
john_cephalopodaI'll ask in their channel if they are interested in putting a repo for that up in their organisation.14:48
pedjaok14:48
john_cephalopodaI asked, now waiting for an answer.14:52
*** frinnst2 has quit IRC14:54
*** emmett1_ has quit IRC14:54
john_cephalopodapedja: /join #6c37 :)15:15
john_cephalopodapedja: No solution yet, but some discussion.15:16
*** emmett1 has joined #crux15:31
*** nullspoon has joined #crux15:33
*** Workster has quit IRC15:42
*** ensycrvmkyrujrid has joined #crux15:42
*** nullspoon has quit IRC15:42
*** Workster has joined #crux15:42
*** nullspoon has joined #crux15:42
*** nullspoon has quit IRC15:43
*** frinnst has quit IRC15:45
*** frinnst has joined #crux15:48
*** frinnst has quit IRC15:48
*** frinnst has joined #crux15:48
john_cephalopodaDoes anybody know the license of the CRUX logo?16:00
*** admincomplex has quit IRC16:01
*** groovy2shoes has quit IRC16:01
*** dbrooke has quit IRC16:01
*** dlcusa has quit IRC16:01
*** pips has quit IRC16:01
*** Stealth has quit IRC16:01
*** dbrooke has joined #crux16:01
*** admincomplex has joined #crux16:01
*** tilman has joined #crux16:01
*** Stealth has joined #crux16:01
*** dlcusa has joined #crux16:02
*** pips has joined #crux16:02
*** groovy2shoes has joined #crux16:02
*** SiFuh has quit IRC16:04
frinnstpublic domain16:05
frinnstafaik16:05
*** SiFuh has joined #crux16:05
john_cephalopodafrinnst: Nice.16:06
*** ryu0 has quit IRC16:22
*** lounge has joined #crux17:13
*** druid_droid has quit IRC17:31
*** druid_droid has joined #crux17:33
*** chris2 has quit IRC17:36
*** chris2 has joined #crux17:48
*** blueness has joined #crux18:16
*** ubuuu has joined #crux18:17
*** blueness_ has joined #crux18:19
*** onodera has joined #crux18:21
*** blueness has quit IRC18:21
*** frinnst has quit IRC18:22
*** frinnst has joined #crux18:22
*** emmett1 has quit IRC18:54
*** emmett1 has joined #crux18:55
teK__dlcusa: okay, but do you record the sources of each port also? I would guess you dont20:07
teK__pedja: wrt openstack: http://www.cio.com/article/3144337/cloud-computing/mirantis-moves-out-of-openstack-bs-as-a-service-market.html20:08
teK__I was toled the article is good *despite* being published by cio.com20:08
teK__disclaimer: I did not read it (yet)20:08
teK__john_cephalopoda: pedja the repo on github scenario for one topic and multiple commiters is exactly what will be possible with gitolite in the future (and on crux.nu) ;-)20:09
john_cephalopodateK__: Nice.20:11
john_cephalopodateK__: Is it easy to migrate git repos? If yes, we could just start on github and then switch to crux.nu as soon as it is ready.20:11
teK__I put one or the other pentesting tool into contrib. skipfish and kinda afl, too20:11
teK__hping20:11
teK__etc20:11
john_cephalopodateK__: Also aircrack-ng and nmap are there iirc.20:12
teK__it's fairly easy by adding a new remote, pull and pushing to the new remote20:12
teK__yeah20:12
teK__I tend to forget ;)20:12
cruxbot[contrib.git/3.2]: afl: 2.27b -> 2.35b20:13
teK__8)20:13
pedjateK__, so you are the person that needs to be bribed for a repo on a new Crux server :) ?20:13
teK__kinda. Or sepen if he is around20:13
pedjaI haven' seen him or updates to xfce repo for a while20:14
pedjabusy with RealLife[tm], I guess20:15
teK__yeah, he had some great changes in that department :]20:15
teK__(my guess)20:15
*** donato has joined #crux20:16
crash_is the mate port gonna jump to 1.16?20:16
teK__wasnt that jaeger's repo?20:16
teK__it ist.20:17
crash_yeah jaeger's port i think it is :)20:18
donatoI'm trying to install tint2 but the install keeps failing because of librsvg. Anyone got an idea why that can be?20:18
teK__it would help if you pasted the relevant parts of the compilation to dpaste.com20:19
pedjateK__, interesting article.20:19
pedjathey are trying to do something like HPE does, complete packaged managed OpenStack solution.20:20
teK__that actually makes sense because I left with the impression that it is a hell of a stack20:21
cruxbot[contrib.git/3.2]: nmap: 7.12 -> 7.3020:21
pedjaOpenStack is a complex beast20:22
teK__because the issue it tries to solve itself is not hard enough? ;-)20:22
pedjaflexibility comes with a hefty price :)20:23
teK__yeah, I guess you will hit a thousand issues once you are at the implementation / maturing stage20:23
*** donato has left #crux ("WeeChat 1.6")20:24
pedjathat happens even with the packaged solution, but at least you have someone to call/shout at :)20:26
teK__'sorry, shortcoming of the architecture/software' incoming!20:26
john_cephalopodaLol, tint2 :D20:27
john_cephalopodaI just started it without looking up what it is. Turns out it creates a bottom bar with the programs on it when launched in i3wm.20:28
john_cephalopodaWorks though.20:28
john_cephalopodaCompiles for me.20:28
pedjaHPE support wanted debug logs, to try to pinpoint the cause of network issues.My friend gladly obliged.Couple of gigs of debug logs/packet captures/etc.20:30
pedjaThey were not amused.20:30
teK__cry babies :D20:31
pedjawell, his company payed an arm and the leg for it, so tough for them.20:32
pedjathey are supposed to be (highly payed) 'the Cloud experts', so20:33
pedjaluckily, his manager was in the trenches before the promotion, so he knows the drill.20:35
teK__that's always good20:37
pedjabtw, you said you are a Python guy.How difficult would it be to write prt-get module for Ansible?20:38
pedjausing apt-get module, for instance, as a starting point20:39
*** blueness has joined #crux20:40
pedjabtw, latest stable nmap version is 7.31 :)20:42
john_cephalopodaI already got that version through my port :D20:43
teK__thats not what the news said20:43
teK__pah20:43
john_cephalopodaI like nmap. It's great for finding hosts in a network.20:44
teK__pedja: I dont' know, I started doing some puppet related work @facter and puppet20:44
cruxbot[contrib.git/3.2]: nmap: 7.30 -> 7.3120:45
pedjaHm, I have a 'Learn Puppet' VM somewhere, but somehow never got around to trying it.20:47
teK__it's quite nice but writing modules yourself is semi-funny20:48
teK__especially if you want to do python stuff20:48
john_cephalopodapedja: I tried to run kali in a VM, but the network stuff in the VM work in weird ways, and nmap couldn't find the devices in my wifi.20:49
pedjaI played with Backtrack, haven't tried Kali yet.20:51
john_cephalopodaKali is Backtrack, they just renamed it.20:52
john_cephalopodaAnd since 2.0, it's rolling release.20:52
pedjaI know.20:52
pedjaIt is slightly broken by design, so skiddies couldn't use it OOTB :)20:53
pedjaor so I've heard...20:54
pedjarunning it as a VM makes little sense, imho.20:55
pedjaas a learning tool, perhaps.But even then, dual booting laptop makes more sense, particularly if you want to play with wifi20:58
pedjaand you have supported WiFi (not Broadcom) :)20:59
frinnstjohn_cephalopoda: have fun scanning a ipv6 prefix :-)21:12
frinnsthttps://rednectar.net/2012/05/24/just-how-many-ipv6-addresses-are-there-really/21:12
frinnst"It would take three times the age of the universe to actually scan all the IPv6 addresses on a 48 bit IPv6 subnet if you were scanning at a million addresses per second."21:13
john_cephalopodafrinnst: A bit harder. But I've never actually seen a WLAN with ipv621:13
frinnst"With a bit of creative programming, it would only take 69000 years to scan all the IPv6 addresses on a 48 bit IPv6 subnet if you were scanning at a million addresses per second."21:13
DaViruzi think masscan can do 10 million a second21:18
DaViruzor rather, has done21:18
john_cephalopodafrinnst: There are theoretically 4294967296 ipv4 addresses. A million addresses per second would mean a bit of an hour of work.21:19
DaViruzthe masscan devs scanned the entire internet in about 6 minutes iirc21:19
john_cephalopodaSounds about right.21:20
DaViruzto the dismay of quite a few government agencies :)21:20
john_cephalopodaHaha :D21:21
DaViruzhttps://www.youtube.com/watch?v=UOWexFaRylM21:21
*** lounge has quit IRC21:25
john_cephalopodaDaViruz: Nice :D21:25
*** emmett1 has quit IRC21:40
dlcusaTek__. by "record the sources of each port" do you mean snapshot the files in the port and/or archive the distfiles' URLs?21:46
dlcusaOr something else?  I do neither at this time but have been considering starting a ports way-back capability.  So far I haven't encountered a need.21:48
dlcusaOops.  teK__ see previous two posts.21:50
teK__the repo(url) ie the original source. There may be multiple possibilities22:10
john_cephalopodaDaViruz: Finished watching. Awesome.22:16
rmullAnyone use CRUX with a midi piano keyboard?22:22
rmullI've never done anything with midi22:22
dlcusateK__, the only port that matters is the one /etc/prt-get.conf points to, as far as my scripts are concerned.22:23
dlcusaIt would be trivial to tar cz the port directory somewhere at build time.22:24
*** ubuuu has quit IRC22:31
*** john_cephalopoda has quit IRC22:36
dlcusaHeck, just park it in the packages dir with the name of the package file except s/pkg.tar.gz/prt.tar.gz/22:37
*** john_cephalopoda has joined #crux22:38
john_cephalopodarmull: I am using a midi keyboard.22:39
john_cephalopodarmull: Got any problems with a midi keyboard?22:40
dlcusaYou could throw in the build's ebvironment variables, installed versions and config files of all the packaging tools, whatever build docs is deemed useful.22:41
rmulljohn_cephalopoda: No problems - looking for recommendations on software and workflow and stuff. Looking to maybe try to learn how to play a little bit. Any good resources?22:45
john_cephalopodarmull: Have you got a keyboard already?22:46
pedjaI never noticed that the licence for core/opt/xorg is GPLv3.22:52
pedjaand after reading harvey's tl;dr for versions 2 and 3, I still can't tell the difference.22:54
rmulljohn_cephalopoda: Nope, recommendations there would be nice too :)22:56
john_cephalopodarmull: Yamaha MOXF-6 ;)22:57
rmullHah, definitely outside of the budget for a thing that I'll probably try for a few weeks and then lose interest in22:58
john_cephalopodarmull: That's what I got. I can recommend it, but I think that not everybody has that type of money and is willing to pay so much.22:58
john_cephalopodaYeah :D22:58
john_cephalopodarmull: It kinda depends on what you want to do.23:00
rmullWhat about something like this? https://www.amazon.com/M-Audio-Keystation-61-II-Controller/dp/B00IWX2SR0/ref=sr_1_4?ie=UTF8&qid=148037400123:00
john_cephalopodarmull: Yep, those are well-known and quite popular.23:00
rmullSeems pretty basic. Would just be trying to learn to read music and pick up some skills that would transfer to an actual piano23:01
john_cephalopodarmull: The problem with that one is: It has no own sound output. It just works as MIDI controller.23:01
rmullI'm okay with that23:02
rmullPlenty of computers23:02
rmullI can just plug it into a USB port and use something like Ardour?23:02
john_cephalopodarmull: I think you'd be better off buying one that has sound output (maybe even built-in speakers), so you can also play without having to hook it up to a computer, start jack (which I never got running in crux) or live with the delay between played key and sound that might occur.23:02
rmullHmm, I see23:03
rmullI will keep shopping then23:03
john_cephalopodarmull: Yamaha has a good reputation.23:05
john_cephalopodarmull: For what you should definitely go is semi-weighted keys and velocity control.23:08
john_cephalopodaVelocity control ( has also other names ) allows you to vary volume by pressing stronger or lighter.23:08
john_cephalopodarmull: Important: When you want to use MIDI over USB, you need the driver in the kernel. Device Drivers > Sound Card Support > Advanced Linux Sound Architecture > USB Sound Devices > USB Audio/MIDI driver23:23
pedjathis is cool (yes, from *that* GCHQ) https://gchq.github.io/CyberChef/23:34
DaViruzi have an akai usb keyboard. the keys are velocity control, but they are very spongy. downright unpleasant23:36

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!