Root Access

12:00 AM

I'm using bash on ubuntu on windows on solus

via Windows 10 VM

@djsmiley2k It's supposed to be opaque. It's like asking why you can't just go in and edit a myd (MySQL database) file without the right tools...

FYI, the right tool in this case is using WSL, not trying to mount/access it via Windows Explorer directly.

@still_dreaming_1 They probably never will. Because there's no need nor reason to.

Pretend the whole lxss folder is a single giant data file. And never go inside it.

still_dreaming_1

Since when does no need equal never will? There was no need for bash on windows.

djsmiley2k

@Bob but then why can you access it

still_dreaming_1

It is only natural to want to use a mix of Windows and bash tools to edit files created in / for either one when you start mixing OSs like this

djsmiley2k

this makes me sad

Bob

12:04 AM

@still_dreaming_1 Since it fell into the minus 100 point hole and never got out again.

There was a good use case for WSL that wasn't easily satisfied otherwise.

There isn't much of a case for directly touching WSL VolFS files.

It's like asking why you can't just modify a DLL directly.

Maybe, maybe at some point it'll be useful enough to do something about.

But at this point that's looking pretty unlikely. There's many other things they can (and are) improving - WSL is a pretty big project.

djsmiley2k

you remember how going into C:\windows would get the 'warning screwing around in here may seriously screw stuff up' ?

well turn that on D:

still_dreaming_1

That's the problem with geeks these days. Any time you want a cool feature their first reply is the technical limitations.

Instead the first thought should be is it desirable, not is it easy to accomplish

If it is seen to be desirable there is almost always a good way to do it, but it may take time to figure that out

Bob

@still_dreaming_1 Honestly? I'd be more interested in seeing native support for VFS filesystems altogether (e.g. ext, definitely ZFS). But who knows.

@still_dreaming_1 ...that's literally what they're looking at here.

There isn't even any technical analysis until it passes the "is it desirable" check.

But the "desirability" check isn't "oh, this one random guy wants it".

still_dreaming_1

If the Windows install was on the same type of file system would that be the end of it?

Bob

They get millions of such requests.

djsmiley2k

12:10 AM

@still_dreaming_1 My answer is to not use windows :/

Bob

It needs to be sufficiently more desirable than the vast majority of these other requests.

still_dreaming_1

True, but the first reply in general when someone requests a feature in most projects does not start with "that is or is not desirable because of x". It typically starts with "Oh no <insert technical jargon here>".

which is a huge mistake

if there is a will there is a way.

The conversation should focus on priorities and if it is a good feature

not if it is possible or not

that part should come last

how exactly to do it

but instead it typically comes first

Bob

@still_dreaming_1 I don't see how that's applicable here, though. We started with a "this is probably deliberately not wanted", then moved to a "also, there's other more important things"

@still_dreaming_1 People don't have infinite time - it makes sense to consider just how big a job is and weigh it up against 'desirability'.

djsmiley2k

@still_dreaming_1 is the will strong enough to work through the way tho?

There's a will to colonise mars.... will it happen? maybe

but just because 100,000+ people want it, isn't really pushing it into happening. One guy is making that happen instead lol

Bob

It's not like "oh, we want this, we'll do this" *POOF* feature created!

still_dreaming_1

12:15 AM

If someone is not willing to work for it they won't really want it that badly

Bob

If one wanted thing takes 1000 man-hours, and other less-wanted things take 10 man-hours each, the latter will probably be tackled first (at least until the level of "wanted-ness" of the big one rises high enough)

still_dreaming_1

I agree scope should be taken into account before deciding to do something

it is part of deciding the current priorities

But enabling the feature in Windows should at least warn you not to mess with those files in windows.

djsmiley2k

@still_dreaming_1 so like I've already said basically.

11 mins ago, by djsmiley2k

you remember how going into C:\windows would get the 'warning screwing around in here may seriously screw stuff up' ?

Bob

I think they at least have that folder hidden, and maybe marked as system (can't remember).

djsmiley2k

As a native Linux user, I'd see no reason why I couldn't go and edit stuff

Bob

12:19 AM

Those are the standard warning mechanisms... people have just grown used to ignoring them *shrug*

djsmiley2k

@Bob people ignore speed limits and smoking warnings, should we get rid of those too?

Bob

@djsmiley2k Then you'll be happy to note that they didn't implement anything to actually stop you. They just hid them ... and you'll probably break things if you edit them. Your loss.

still_dreaming_1

Being hidden should warn you it is special to change it, not that changing those file will corrupt the file system.

djsmiley2k

@Bob I'd just like some warning that you really shouldn't edit them.

Bob

@djsmiley2k ...they didn't get rid of the hidden/system warnings.

Though IIRC system can't be applied to a folder so maybe that's a problem.

djsmiley2k

12:22 AM

@Bob yeah I thought your message was meant for my hiding files with the warning in the side bar thing

I think we agree

but from different arguements

:D

Bob

@still_dreaming_1 I do think they chose a bit of an odd mix of actually keeping them as independent files. But there probably was a reason for that.

still_dreaming_1

Using bash in ubuntu in windows in solus reminds me of the night after I watched inception

Bob

@still_dreaming_1 There's a screenshot floating around in chat somewhere from the time I ran a bunch of nested virt :P

still_dreaming_1

I found myself that night questioning if I was in a dream or not. Then I decided I was sure I was not because I felt sure and normally I once I start questioning it I'm only sure if I'm actually awake. Then a little later I felt like I was in a dream. Then i woke up... or at least I think I did...

maybe I will wake up again and remember my life prior to this 34 year long dream (in dream years)

Bob

Oh here it is

Sep 8 '15 at 15:13, by Bob

Oct 7 '14 at 6:02, by Bob

Apr 23 '13 at 13:25, by Bob

Then there was that time with Hyper-V inside VMware...

djsmiley2k

12:28 AM

@Bob needs more layers...

I did about 5 lxc's in side of each other before getting confused.

Also, ssh running in each one, to th next one...

Bob

@djsmiley2k but lxc doesn't use hardware virt :(

I kinda stopped there cause the VT-x emulation wasn't working so well and the OSes were trampling over the HDD and lagging quite horribly.

Maybe I should try again now I've got SSDs and a post-Ivy CPU...

containers are easier cause they share a kernel

djsmiley2k

hehe yeash

Journeyman Geek

Bob

lol

Oh. @JourneymanGeek speaking of rumors (in recent convos)... blogs.msdn.microsoft.com/oldnewthing/20170228-00/?p=95605

Journeyman Geek

lol

Ramhound

1:17 AM

@Bob - So you ran Hyper-V within VMWare but what about Hyper-V within Hyper-V within VMWare head explode

Here's What Happens When an 18 Year Old Buys a Mainframe

►

Is it right to be jealous of an 18 year old?, lol

Michael Frank

Hey I watched that.

It's a pretty cool video.

Ramhound

Is it cool or depressing that I get paid to work with that type of hardware?

I almost cried when he talked about Bus in Tag..

Michael Frank

shrug it was mostly all Greek to me.

djsmiley2k

$100, heh

Michael Frank

> please address your email to xxxxxxxxxx, amending the subject so
that it contains only the exact string: "<CASE:xxxxxxxxxxxxxxxx>" (not including the quotes). Please note, you must
include the < > brackets and use no spaces. Lastly, please do not include any other text in the subject, such as
'CREATE CASE', as this can result in incorrect processing.

Hmm... Please do not include THIS SPECIFIC PHRASE in any emails, eh?

djsmiley2k

1:28 AM

hehehehe

Journeyman Geek

@Ramhound yes

djsmiley2k

; GET username where uid = 1

Ramhound

Yes what?

djsmiley2k

Right kids, lets caffine up!

Journeyman Geek

hooks @djsmiley2k to an IV

djsmiley2k

1:33 AM

Here's What Happens When an 18 Year Old Buys a Mainframe

►

that is the best

'no matter what you think, your floor isn't flat, and 1500lb of mainframe will move itself'

Ramhound

So what were you saying yes to @JourneymanGeek

djsmiley2k

1:44 AM

@JourneymanGeek plz

Bob

@Ramhound That wasn't possible until recent Win10 and Server 2016

Hm. I should try nested virt inside Hyper-V sometime.

Journeyman Geek

2:00 AM

@Ramhound at least one of the things you said, duh

@Bob for the record, the original DOID is back in action I think

Bob

@JourneymanGeek I need to try mine again sometime :P

But then I also need to get a proper 3.5" (12V) caddy

Ramhound

didn't ask a yes/no question :$

Journeyman Geek

they're in the openelec box

@Ramhound you asked an or question ;p

Michael Frank

Journeyman Geek

sadly, wifi is a little too slow to transfer stuff over

Run5k

2:06 AM

OK, perhaps I need a quick sanity check: is it just me, or do we seem to get a lot of questions from people who encountered problems with their Windows/Linux dual-boot configuration?

djsmiley2k

@Run5k I've not noticed an overabundance...

Run5k

Exactly! Some time ago, I started recommending that those people run Linux inside either VirtualBox or Hyper-V.

Journeyman Geek

2:24 AM

@Run5k I notice a lot of people have trouble with Kali

to the point where I post a good chunk of my aibobot answers on the topic in a snarducational manner

erf. Guess who has no running PCs with a SD card reader?

Run5k

@JourneymanGeek, that's a good point. Kali is probably leading the charge in that regard, but I still see a steady stream of them pertaining to Ubuntu, Fedora, etc.

Michael Frank

Mile of Pi - Numberphile

►

Run5k

Heh... I ensure that I still have one computer in the house with a built-in 5-in-1 SD card reader, just in case.

Bob

@Run5k Fairly typical... I've said it a lot, but GRUB loves to clobber BOOTMGR. And BOOTMGR pulls funny crap with UEFI startup order too.

Run5k

@Bob, agreed on all counts. Like I said, I try to encourage people to utilize Windows 10 with one of the free hypervisors if they really want to run some flavor of Linux.

Journeyman Geek

2:34 AM

@Run5k I'm of the opinion most people who ~~use~~ ask kali questions are clueless

actually, that's uncharitable

djsmiley2k

I wonder, if there's some way to capture this post request, re-do it, and then autoselect soem of the fields too

Bob

I have a Kali VM :(

djsmiley2k

infact I'm sure there is, I' just don't know how right now

Journeyman Geek

they've basically been thrust into a badly made, single purpose linux environment without actually learning the basics.

Bob

Granted, I've only used it once, and I can't even remember what for now.

Journeyman Geek

2:35 AM

@Run5k I have a few spare systems that still do

djsmiley2k

it's the ubuntu problem

and the thing is also the solutions are the same 'reinstall'

windows thinking :/

Journeyman Geek

@djsmiley2k i've used and broken ubuntu installs many times in the past

Bob

Oh. Was to run OWASP ZAP.

Michael Frank

@JourneymanGeek Google "linux for hacking" - kali.org is the first result.

djsmiley2k

oh is kali the distro that comes with metasploit 'set up' ?

it's the sub7 of the 21st century

Journeyman Geek

2:37 AM

yup

Bob

@djsmiley2k eh. sometimes, a reinstall makes the most sense.

Journeyman Geek

it also encourages people to use it as root by default

Bob

I'd not do that for a primary-use system, simply because it's a massive pain to set things up again.

Run5k

@JourneymanGeek I certainly understand what you are saying. While they may not be clueless, I think that many of those people are computer "enthusiasts" who don't fully comprehend the complexity of their desired configuration.

djsmiley2k

@JourneymanGeek a bit like how one of the solutions in ubuntu to everything is 'use sudo' ? :/

Bob

2:38 AM

But for a VM? ...if it's broken, easier to blow it away and start over.

Journeyman Geek

@djsmiley2k but that makes sense in many ways

djsmiley2k

@JourneymanGeek depends on the problem, a lot of the times it doesn't make sense

Bob

@JourneymanGeek it's a tool, not an OS you're actually meant to run and spend time in -_-

Journeyman Geek

but the correct lesson eventually is "use a non privileged account"

@djsmiley2k why?

djsmiley2k

In windows, do you tell everyone to just 'run as administrator' ?

@JourneymanGeek I can't write to this directory! - use sudo!

no, learn properly how permissions work.

Bob

2:39 AM

- and then use sudo

:P

Journeyman Geek

@djsmiley2k see, that's what I mean by education

djsmiley2k

I can't run this executable! - use sudo.

Journeyman Geek

or people set chmod777

Michael Frank

Okay... so round two of troubleshooting the wifi...

djsmiley2k

@MichaelFrank does the gateway exist yet?

Bob

2:39 AM

@JourneymanGeek oh that one is always fun

Michael Frank

Yea, it's there.

Bob

I try to encourage people to not use octal permissions

Journeyman Geek

or worse!

2

A: XAMPP why need to change application permission of application folder?

Its worth understanding what this does (and why its a terrible idea). chmod -R 777 gives Read + Write + Execute permissions to any account. While it works, its roughly the equivalent of leaving your home unlocked, while you go to work, cause you can't find your keys. Find out what user XAMPP i...

Bob

using things like +w forces people to at least kinda think about what they're diong

djsmiley2k

chmod 777 -r /

D:

Journeyman Geek

2:40 AM

@Bob oddly I can remember the octals better

Michael Frank

They're talking about increasing the bandwidth on the wireless http tunnel

djsmiley2k

deliverately failed to type that correctly :D

Bob

It's time for my yearly requote!

Dec 22 '16 at 3:59, by Bob

Jun 30 at 8:36, by Bob

Aug 27 '15 at 22:08, by Bob

"oh just chmod 777 it, it'll work!"

Michael Frank

Huh... so the packet shaper is completely choked.

djsmiley2k

@MichaelFrank o_O

Journeyman Geek

2:41 AM

I remember a worse one where someone gave www-data full, passwordless sudo rights

Bob

@JourneymanGeek I don't like octals. Among other things, they overwrite permissions.

@JourneymanGeek I remember that!

you can do a chmod u+x to grant execute to the owner, but there's no easy equivalent with octal modes

you'd either clobber or have to check existing permissions

of course, the symbolic ones are kinda confusingly named...

g is group, ok

u is owner... user? close enough

o is ... is it owner or others? bleh.

Journeyman Geek

lol

SEE? SEEEEEEE?

(user, group, others is how I remember it)

Bob

@JourneymanGeek yea. then I occasionally get confused about others vs world vs public...

then again, I don't do this all that often

djsmiley2k

then there's suid...

:D

Bob

but it's usually near a chown which puts owner in my mind instead of user :\

Journeyman Geek

2:45 AM

another 'fun' bad habit is to use root to work on /var/www then chown it later

djsmiley2k

So, something to 'record' and allow me to repeat a number of steps in chrome, stop, wait for some input, and then carry on?

Bob

@JourneymanGeek I think I've actually done that from time to time, minus the chown step.

But they're usually in kinda-throwaway containers that don't even have other users set up

Journeyman Geek

@djsmiley2k I think @allquixotic uses... er... something for that for work

djsmiley2k

yeah heh

i mean postman can malnipulate and do posts...

Bob

@djsmiley2k Selenium

Journeyman Geek

2:48 AM

Selenium!

djsmiley2k

but I have some 'filling in' bits I do too

Journeyman Geek

selenium would do that

djsmiley2k

copy stuff from the email, paste it here, submit the form, paste some more stuff there..

Bob

9

Q: Manual input from user while running selenium IDE script

can user is able to give manual input while running selenium IDE script? For ex. If there is name field then can we open input box everytime script runs so that user can give his input for name field? Let me know whether it is possible or not.. If yes then please suggest me a solution. Thanks ...

Journeyman Geek

wiki.saucelabs.com/display/DOCS/…

jhmckimm

2:49 AM

Dang, SU has far fewer chat rooms than SO. :(

djsmiley2k

can selenium just run ontop of my existing chrome?

Journeyman Geek

@jhmckimm we're a much smaller site, and most of the action is focused right here.

jhmckimm

So I see. :P

djsmiley2k

tis awesome here

we have dogs.

jhmckimm

I have some questions regarding networking, but I'm not sure this might be the place.

Journeyman Geek

2:50 AM

We can, at the very least, point you at a vaguely correct direction

Psycogeek

for simple home networking SU for higher end server stuff even if it is at home, serverfault

jhmckimm

Great.

Journeyman Geek

there's also a specialist network engineering site

Run5k

jhmckimm

Thanks.

Journeyman Geek

2:51 AM

erf. That's barely visible

Run5k

I see that... white-on-yellow! :-/

Bob

s/yellow/grey/

jhmckimm

"The last message was posted 2 days ago."

Oh boy.

djsmiley2k

I have porkchat and dark background enabled - looks good here :D

Psycogeek

nice

Journeyman Geek

2:58 AM

I see it white on light grey ;p

Michael Frank

@Run5k It's white on yellow because it's your comment.

Run5k

@MichaelFrank, thanks for educating me. That one appears to be white on light-gray from my perspective, just as JourneymanGeek described.

jhmckimm

I'm from the old days, so everything is just black and white for me.

Michael Frank

@jhmckimm I always joke to my younger cousins that black and white photos are from the days before colour was invented.

Journeyman Geek

@jhmckimm ~~There's a running joke here that~~ I'm a dog

and there's an urban myth that dogs don't see colour ;p

jhmckimm

3:20 AM

Hehe.

Sorry, I remembered that I wanted sandwiches. I'm back.

Michael Frank

Well the wireless is working now.

Apparently they just took the tunnel down, then brought it back up. o.o

Bob

@jhmckimm Black and white? Naw. Black and green.

jhmckimm

@Bob youtube.com/watch?v=UePtoxDhJSw

djsmiley2k

black and orange plz

allquixotic

@JourneymanGeek yep, lots of Selenium

djsmiley2k

3:28 AM

oh did i mention i can't install programs? ;/

allquixotic

@djsmiley2k if there are (only) technical limitations preventing this, you can certainly get around that, 99% sure

if you can download zip files from the net and run exes, you're good to go

the concept that everything you download has to be installed somehow and go into the registry and Add/Remove Programs is flawed

trust me, I've dealt with permissions issues on Windows for more than a decade at various employers

Bob

@allquixotic sometimes it's policy and then you fail an audit

allquixotic

the way you deal with it is grab portable versions of everything you need

@Bob meh. 99% of places don't have visibility into individual files you have, only "officially installed" programs

mine, for example, uses Big Brother-style software to monitor what's in Add/Remove Programs, but you can grab any random EXEs you want off the Internet, and as long as they don't get flagged as a virus by McAfee, you're fine

and by "mine" I mean four different environments for four different, independent organizations

djsmiley2k

nod

allquixotic

and if they block the download, just host an encrypted 7z on your server somewhere... you do have a server, right? :)

Bob

3:33 AM

@allquixotic they're actually coming around and physically checking here now

djsmiley2k

I haz ssh ;)

I'm second line and expected to 'just fix it!'

allquixotic

@djsmiley2k oh, pssh, you're squared away then! any company that allows outbound ssh to arbitrary servers surely won't care about what you have installed

@Bob oh. poking around in your home directory looking for EXEs and stuff?

do you have a mandatory proxy with forced SSL MITM for Internet access? if not... you can almost certainly stand up an Eclipse-based, Maven-based Selenium environment if you have a Java 1.7 or newer JRE/JDK

if you do and it blocks the maven central repos, you can always poke around if the internal network has a mirror, as many orgs do now

Bob

@allquixotic not too sure, I've not been randomly chosen yet

allquixotic

@Bob that sucks. wonder if it's just a scare tactic or if they're for real

although I suppose if you did all your civil disobedience stuff using scripting languages, they'd never know unless they started opening random text files :P

Thomas Ward

throws a pipe from /dev/urandom towards @JourneymanGeek

allquixotic

3:38 AM

:35752904 jobs like that need airgapped, separate locked-down machines where it is acceptable and understandable for them to !!no all non-approved third-party software, even scripts and such

but on your non-locked-down machine it should be free reign

Journeyman Geek

@ThomasWard ceci n'est pas un pipe

Thomas Ward

I had to google translate that heh

can I borrow your hammer to do some antispam cleanup on this?

allquixotic

@ThomasWard urandom? huh... stuffs insecure numbers into @ThomasWard's urandom and makes Geek run arbitrary code

gains a diamond suddenly

Thomas Ward

somehow gains the godly abilities of SE devs during these happenings, and laughs evilly

Journeyman Geek

@ThomasWard handled

Thomas Ward

3:40 AM

@allquixotic not sure how you're going to adjust my urandom seed, it's being fed by haveged

@JourneymanGeek thank you kindly

Journeyman Geek

so, silly thing I'm trying to work out. I've gotten a PC connected to an old widescreen plasma TV. Openelec picks up 640x480 and 1024x768. The latter looks dreadful, and there's a tiny pink noise border at the bottom...

allquixotic

oh, didn't know about this haveged... TIL

Journeyman Geek

is it really 640x480 with shitty upscaling or am I missing something?

Ben N

TVs are all awful

allquixotic

@JourneymanGeek unfortunately, if it's a really badly designed monitor/TV and only supports VGA, you may have to manually adjust the modelines/scanlines

Thomas Ward

3:42 AM

^ this

Journeyman Geek

ah

I know nothing of it ;p

Thomas Ward

@JourneymanGeek I have the same issue with widescreen LCD TVs, except the HDMI is "supported" but it doesn't support a valid 'widescreen' resolution

:P

Journeyman Geek

like its so old I don't even know the model and its literally as ash

allquixotic

@JourneymanGeek recommendation would be to scour the corners of the Internet for anything resembling a matching model number and see if anyone's already done the work

I once went a month with a 720p TN LCD TV as my primary display for my main desktop while on a work assignment

Journeyman Geek

Oh, I've adjusted the aspect ratio and such

it looks REALLY good for the crappy resolution

allquixotic

3:47 AM

TWSS

Journeyman Geek

ah

nice

I have no idea what model it is

Since I have no access to the back

and there's identical models with different features.

... which apparently has HDMI

whaaaat?

djsmiley2k

the problem is now tv's res's caught up with monitors... monitor makers are getting lazy too

@allquixotic STATTB

?

what's twss again?

4:02 AM

@djsmiley2k "that's what she said", usually

djsmiley2k

lul

Bob

Said the actress to the bishop

The phrase "Said the actress to the bishop" is an informal (and usually vulgar) British exclamation, offering humour by serving as a punch line that exposes an unintended double entendre. An equivalent phrase in North America is "that's what she said". Each phrase is an example of a Wellerism, exposing a second meaning of what precedes it. The versatility of such phrases, and their popularity, lead some to consider them clichéd. == History and variations == The term, or its variant "as the actress said to the bishop", may have been used as far back as Edwardian times, and is apparently British...

jhmckimm

So, any default behaviour in Debian 8 that I should be wary of for a web/db server environment? Pretty new to Linux. I'm a Windows user.

MD is different here...

djsmiley2k

default behaviouR?

:/

allquixotic

@jhmckimm #TooBroad

djsmiley2k

4:10 AM

rm -rf / will delete everything, maybe

jhmckimm

I literally can't be specific.

allquixotic

What web server? What database? What're you using it for? Is it on the public Internet, or local? Scalable/HA or dev?

jhmckimm

LEMP

Public.

allquixotic

well if you can't be specific then neither can we

my answer would be "Possibly"

hope that's useful for you

what's the E for?

jhmckimm

Nginx

allquixotic

4:12 AM

so Nginx, MySQL and PHP?

jhmckimm

Yup. :)

Bob

...wait. how does E translate to Nginx?

allquixotic

@Bob "engine x" pronounced?

jhmckimm

Nginx is pronounced "Engine X"

Also LNMP is harder to say.

allquixotic

@jhmckimm well -- it may not be issues in the traditional sense (like, security issues); in fact it may be the opposite; but one thing to be aware of if you're new to Debian and Debian-based distros is that for packages such as Nginx and MySQL, they have a ton of extremely custom, Debian-specific default configuration files and package management installation scripts

I believe the defaults are designed to be "sane" in some sense of that word, specifically to make the default /etc/init.d/whatever start not open up a huge attack vector

things like only listening on localhost for mysql, for instance, should be default; or at least a default random password for the root user

jhmckimm

4:14 AM

Yup.

Bob

Also you'll be on an older, stable, version of them unless you specifically install from backports or stable. (You'll still get security fixes but maybe not non-security bugfixes.)

allquixotic

so in some sense it's a good thing, because they do the security hardening for you. or part of it

Bob

But that's good for a production system.

jhmckimm

Alright. So I'm completely safe leaving everything as-is, pretty much?

allquixotic

but yeah, the config files and init scripts you get with Debian for specific packages like web servers and databases will be wildly different from what you get by untarring the source tree of the upstream package

@jhmckimm "completely" -- not exactly; with nginx in particular, the default is to listen on all interfaces, so you're open to inbound HTTP(S) traffic... if you are doing development on that and not ready for public to see it, you should change that

and if you want to open it up to a limited test group but have it on the public internet, you could use some form of authentication combined with TLS for a pretty good way to stave off the script kiddies and bots

if it's a production box, and your software is already written/debugged/tested, you should be able to fairly soon open up the ports needed and just let the Internet rain down upon your website with only enough configuration done to install your app and map the directory path to your PHP app

but if you're doing new development, hold off on that until your app is at least ready for testing or beta

also look into security hardening guides for Linux webservers... pretty sure you'll quickly stumble upon good suggestions such as a NIDS (like Snort) and an active virus scanner if your software does any form of storing user data files on disk

and make sure your OpenSSH server denies password-based authentication entirely; set up certificate-based authentication ASAP

also good security practice to run netstat -pan | grep LISTEN and audit each and every listening service on either TCP or UDP, and make sure (1) you know what it is and (2) if it's only intended for internal consumption, don't listen on the public IP, just localhost or a local subnet

jhmckimm

4:25 AM

Oh, that cert SSH thing might be useful.

allquixotic

if there are services you want to access temporarily during dev that you'd normally have listening on localhost during production, one nice hack that's quite secure is to (assuming your SSH server is secure), use SSH as a port forwarding mechanism to open up, say, the server's MySQL port to your specific local dev box only and not the whole Internet

definitely better than having MySQL accessible on the public IP from everyone on the Internet

(MySQL is difficult to configure so that its TCP wire protocol is airtight, and even then it's had a history of protocol vulnerabilities)

jhmckimm

I see.

Bob

@allquixotic On the topic of publicly accessible...

troyhunt.com/…

jhmckimm

Daaaamn.

bwDraco

GeForce GTX 1080 Ti announced: 3584 CUDA cores in 28 of 30 SMs on Pascal GP102 @ 1600 MHz; 11 GB GDDR5X @ 11 Gbps on 352-bit bus.

jhmckimm

4:39 AM

@allquixotic Thanks for that wall of text btw.

bwDraco

(looks like they disabled 1/12th of the memory controllers and ROPs this time around, unlike the TITAN X)

Bob

> "Spiral Toys was not contacted by any cyber security professionals nor a hacker holding the data for ransom": Yes they were, it's all documented above and whilst the ransoms didn't involve contacting them, when the only databases remaining on the system demand Bitcoin in exchange for the return of data, that's a bit of a red flag

ow.

bwDraco

The card is slightly faster than the TITAN X. It will retail for $699; lesser cards have had their prices reduced to make way.

Also, the exhaust vent at the back of the card has been widened by removing the DVI port; this should reduce the thermal throttling problems the TITAN X had.

Aug 20 '16 at 5:28, by bwDraco

$1200 graphics card has bad thermal throttling. Seriously, NVIDIA?

allquixotic

4:56 AM

@bwDraco wtf, less than the 1080 FE :/

jhmckimm

How do I configure SSH to use certs then?

oh. my. god. What is that paperclip doing here?

allquixotic

@jhmckimm easter egg

bwDraco

I'll update build plans and will lay out plans for a new Ryzen-based system (codename Astaroth) soon.

9

Q: Pick an easter egg for chat.superuser!

On chat.meta.stackoverflow, there's a little easter egg where text entered as [status-blah] will be rendered as a moderator only tag. We'd like to do something similar, but specific to superuser -- namely, when you type a magic string, something amusing and in-joke-y for superuser.com happ...

discussion chat

allquixotic

@jhmckimm digitalocean.com/community/tutorials/…

basically ssh-keygen -t rsa on your client, then put the .pub file's contents in ~/.ssh/authorized_keys of the user you want to login to on the server side

then edit /etc/ssh/sshd_config and find PasswordAuthentication (should be commented out) and set it to no and uncomment it

jhmckimm

Oh, my local is Windows.

allquixotic

4:59 AM

but only do the latter and restart your ssh server after verifying that key login works

djsmiley2k

ssh-copy-id is the win

putty.

jhmckimm

I s'pose I can fire up a VM.

bwDraco