Ping a mod, there should be a mod message going his way.

(@Mokubai, @JourneymanGeek)

I mean how can I been wrong in saying that data recovery after opening a HDD in a non-cleanroom environment is going to be extremely tough. even if I am wrong what does that have to do with the rest of his comment where he basically substantiates what I said

@Mokubai @JourneymanGeek See my previous messages about @qasdfdsaq

Man...Don't remind me of that explorer.exe comment :$

I am still trying to understand what he was trying to even say.

That really was trolling ;)

They are not real explorers.

I mean since when was files used from within the WinSxS directory contained in .cab files

Exactly - that's why I said trolling. How long did it take him to come up with that? More than an hour ;)

It didn't even come into my consideration when I said there was only one location for explorer.exe

@Ramhound, gotta watch out for those types. had a bit of unfriendly scrape with another user, know what you mean.

I might be one those types....But everything I have done to mend whatever relationship we might have had has failed

have you played MMOG's?

I am either called a liar or told I am wrong continuously.

Yes

for over 2 decades.

some are notorious for that behavior and when it's done by groups, it becomes dangerous

experiences with just such types of groups are what led to my HDD issue that brought me here.

I might be naive, but I try to provide no non-sense responses, and the way I see the world supports how I communicate to others. It basically amount to the only way I can communicate is with low context direct statements because literally anything else escapes me.

So I expect everyone else to communicate in similar ways, based on analysis of how I view the world, I am almost the least likely to adapt or even have that capability. But I know this which is the reason I love canned responses :$

Good to be direct, but telling the truth in certain situations, say alone as a witness of a cyberbully group of pedos on a MMOG, is almost always moot.

they use those group tricks like naming you a liar, to influence others and pretty soon, you're hated before you even know why. I seen it done many times.

hey @DragonLord

back to containers

If you guys played Heroes of the Storm I would be Lili and throw you tons of jugs ;-)

I've used Linux-vserver and OpenVZ in production in the past, and experimented with "raw" lxc, but my latest solution is to use lxd ("d", not "c") on my dedi. LXD builds on top of LXC to basically provide secure, isolated containers in a way that base LXC really can't.

I'm pretty sure that because LXD is so new, its isolation isn't 100% air-tight, but that's their goal, at least. And I don't have actively hostile users with shell access to my box.

OpenVZ is airtight, but they don't have a stable build of their kernel for modern Linux anymore (latest stable is RHEL6 2.6.32 - yuck!) so that's out of the running until Open Virtuozzo gets here

@Ramhound I discovered through my years of experiences in one particular famed MMORPG especially, those online games are proving grounds of social engineering for sociopaths, you can find the evidence rather easy if you know where to look and what to look for. Down there, law does not exist; it's a gang world.

I basically create a container any time I have either (a) a trust boundary (e.g., a friend I basically trust but don't want them poking around in my files, even accidentally), or (b) a compatibility boundary (some old/new software, usually proprietary, that simply won't work on my existing containers due to lib versions, etc.)

I give each container a public IP and pick a compatible Linux distro that's capable of behaving nicely in a container and running on the Ubuntu 14.04 stable kernel

Hmm...

Would I want to run containers on a VPS?

(I know you have bare-metal, but not sure if the same is workable under a virtualized environment.)

@DragonLord containers have near-zero overhead because the container "guests" run on the actual host kernel, and use the actual host filesystem, and there's no hypervisor, so containers on a VPS is not perceptibly slower than running stuff directly on the VPS.

the features of the kernel itself are what logically separates the containers, not any kind of hardware-level virtualization.

the overhead exists, but actual attempts to measure it have come up inconclusive

it must be extremely tiny with Linux's mainline container solution

(namespaces, cgroups, etc.)

linode.com/docs/applications/containers/docker

Docker seems to be supported.

in fact, systemd uses certain subsets of the features that LXC and LXD use for container isolation

(That article is old, though.)

so if you're using systemd, you're already using bits and pieces of what LXD does

@DragonLord Docker is very different in design philosophy from LXD

the mainline Linux kernel features that enable containers in the first place have a very complicated configuration space that makes them flexible enough to produce two completely different products (Docker and LXD) that are staggeringly different in purpose and architecture.

Docker is for running applications you 100% trust and control in a way that prevents accidental interference between apps

the base unit of containerization in Docker is an application (which can be one process, or a series of cooperating processes)

LXD is for running virtual environments that you don't completely trust or don't want to completely control (multi-tenant boxes) in a way that prevents intentional interference between the different environments.

the base unit of containerization in LXD is a virtual system (which has a start/stop cycle like a VM, can be rebooted, etc.)

I really hope the question I just asked has a satisfying answer

root@li1241-34:~ # zypper if lxc
Loading repository data...
Reading installed packages...


Information for package lxc:
----------------------------
Repository: openSUSE Tumbleweed Main
Name: lxc
Version: 1.1.2-3.1
Arch: x86_64
Vendor: openSUSE
Installed: No
Status: not installed
Installed Size: 1.4 MiB
Summary: Userspace tools for the Linux kernel containers
Description:
  It provides commands to create and manage containers. It contains a
  full featured container with the isolation/virtualization of the pids,

Hmm...

@DragonLord LXC and LXD are very different. LXC is a more elemental "basis" that LXD builds upon. LXC alone won't give you proper container isolation without a ton of manual configuration.

LXD uses the AppArmor Linux Security Module to "lock down" LXC.

LXD is not available in the main repos, though.

@DragonLord There's an effort to start supporting LXD on non-Ubuntu hosts, and some people have been successful on Debian, but other than that you pretty much will have to build a custom kernel with a new AppArmor feature that LXD needs.

If you want it to be easy and supported, as of right now, you'll need to run an Ubuntu 14.04 (or later) host in order to use LXD.

But supporting other distros is definitely a priority

So there are dependencies on the Ubuntu core platform?

(AppArmor has always been part of SUSE.)

@DragonLord No. There are dependencies on a patch to the Ubuntu kernel that adds an entire new type of security to the AppArmor LSM. This patch is not yet mainlined to upstream Linux.

It's a patch that's indeed generally useful and makes AppArmor more secure when it's used.

I expect it will be mainlined soon.

Much of this stuff is still beyond me. How do AppArmor and MAC work and what do they do in the first place? I've never touched this functionality directly.

@DragonLord One word: policy. You tell AppArmor (or NSALinux, or Tomoyo, or whatever) to monitor the system for specific patterns of action, (by certain actors, if necessary), and to block them.

It's actually a really simple concept. Break down the system into a bunch of component parts. For each system call or permission or capability, that's potential for something to be blocked if there were a monitoring policy layer keeping track of this stuff.

Then you just have to figure out how to write strong, secure policy rules to tell the Linux Security Module exactly what to deny and what to allow.

Projects requiring the utmost security (and would rather things break than be insecure) will implement capability whitelisting -- meaning, by default, every damn thing you try to do on the system is going to be blocked by the policy layer (!) -- except for a specific whitelisted set of things that can be done by specific programs and users.

Systems needing less security implement capability blacklisting -- for example, Fedora has a default policy set that denies a bunch of "unsafe" or "dangerous" actions that could be security issues, but anything that's not explicitly blocked is allowed.

@allquixotic "AVC denial"

yeah

I didn't quite get what was going on here when I installed Fedora once (I hated it, too unstable, things were broken from the start).

I guess I'll be studying MAC in a bit more detail.

The funny thing is, none of the policy is "built in". Specific Linux distros or specific sysadmins may write policies, but if you just install AppArmor or NSALinux, the code itself won't block anything.

From a certain point of view, most of the valuable stuff related to NSALinux is probably closed source. Meaning, the valuable knowledge are the policies that advanced organizations implement to be more secure than the average bear.

But there aren't a great number of freely-available, good policy sets for NSALinux or AppArmor.

The main one is the Fedora/RHEL policy set for NSALinux, but that one has only the most basic protections. It can't get too strict, because the authors of Fedora don't know what you're going to do with your system.

Isn't there an entire separate SE for *nix systems?

Beat me to it.

Let me guess: that chatroom is used as often

@NateKerkhofs what's your question?

hi

@allquixotic Why are you discussing *nix poweruser actions and kernel rebuilding in a generalist computer chatroom instead of in a more focused *nix chatroom? Nothing against it, but I can't follow with most the things you say

how come my folder had 2000 odd items in the properties pane now it only has 900 odd

I would think that Unix & Linux chatroom might be better suited for this talk about lxc and lxd

@NateKerkhofs Chatrooms don't have any strict topicality rules like the Q&A sites. We very frequently go (way) off-topic in chatrooms. Super User is a community I identify with, and I have a lot of friends here with shared interests. There may be folks over in the U&L chat, but I don't go there much.

Right

Super User is the site I contribute to most often on the Q&A side, and I'm a room owner here with the #3 most messages sent, so I think I'm allowed to talk about more advanced concepts if I want to. There's no requirement that everyone in the room be able to follow what I'm saying. You're free to have other conversations at the same time. We often have 3, 4, or 5 convos going at once. It's no problem.

@RecycleBin Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, its hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.

;)

I copied a folder from my docs to the desktop and I checked the properties pane, it said it contains 2019 items, however ive just checked again and it is now saying 900 odd items

(Besides which, the whole reason I got into talking about Linux containers and security modules is that another user specifically asked for information about them; I'm happy to oblige.)

oh wait the original says 1900 but the copy says 2050 for some strange reason

Did you let the properties pane finish for at least 30 seconds before you checked how many items there were?

it has done this several times now - it cannot seem to count properly

yes

Any services like antivirus or dropbox running?

@RecycleBin The "number of items" is not very reliable in the properties pane of Windows Explorer. It may be including/excluding hidden items, or there may be invisible Thumbs.db files in there, or a number of other things.

theres definetneyl no hidden items in there

only photos, .jpg, and .png

I just ran the uninstaller for VS 2015 and there is still crap hanging around on my drive

I did scan using chkdsk and it gave a few errors

How many files does dir give you in each folder?

I have AVG and dropbox

and one time it deleted like half of my stuff almost so dont want that again

@NateKerkhofs That's not unusual, especially if you've ever launched the program. Once you launch it, it'll create a bunch of files for user-specific data.

The installer of a program will generally only remove those specific files that the installer itself created, and that doesn't include any user-specific data, third-party SDKs or add-ins, etc.

@allquixotic I'm not talking about user files, I'm talking about "remove program" entries in the control panel

@NateKerkhofs did you refresh the control panel?

I still got a bunch of emulators and SDKs in my "remove programs" list, like Windows 10 SDK, windows Phone 8.1 emulators, Xamarin, Java SE DK,...

if you're talking about things like the Visual C++ runtimes, DirectX runtimes, Windows SDKs, MSSQL Compact Edition, etc., these are all considered to be "extras" that aren't part of the core VS2015 distribution, so they won't be uninstalled automatically.

yep, sounds like that's what you're talking about.

that's "by design"...

yes even doing dir gives different results

And here I am, thinking that using the uninstall function on the installer that I originally downloaded would actually uninstall everything

the original says 1926 and the copy says 2050

@RecycleBin Can you compare the files that are in both directories to see what those files that make the difference are?

@NateKerkhofs It's harder to get something back after you uninstall it, than to remove it if it doesn't uninstall it when you expect it to. They'd rather do less than uninstall too much.

I done checkdisk and one scan said there is a filesystem bitmap error

I knew it was a filesystem problem but nobody here belived me

im not sure how nate

the original directory has about 4 files deleted on purpose where as the copy doesnt

@RecycleBin support.microsoft.com/en-us/kb/976329

I also got another error about some files being corrupted but it didnt say which ones

also when I rebooted there was noise on the screen

@RecycleBin Read the MS support article I just linked

so I just get the hotfix

Basically, because your partition size is a multiple of 8 GB, some files are corrupted

@RecycleBin that seems like the right solution, I think. You're using W7, right?

yeah unfortunetley

I have little choice

how do I check if windows 7 uses EFI or legacy boot

I want to delete the EFI partition

nm

I still dont know why it tried to delete a load of my stuff when all I did was copy a folder do dropbox

my partition is 999,946,012,455 bytes

it says the update is not applicable to your computer FFS

@Ramhound If this happens again then send me a ping please. Only contacted him for the moment, see where it goes.

cant a type 1 hypervisor run an old version of windows on modern hardware

like VMware vSphere / ESXi

sounds like a good idea to me

morning

@RecycleBin: to a point

You'd still need driver support

I wouldnt need to remotley administor it

Running a VM without proper video drives would suck

you can install several OS's on one computer but I just need one for now

I thought the VM has its own drivers rather than the OS needing them for the actual hardware

Assuming they exist

foooor example

OS/2 won't run on virtualbox

ive got OS2 working on virtualbox

windows 98 will but you have no graphics driver so you're stuck with bad colour depth

(there's a workaround but it involves abandonware and finding keys for it in dark corners of the internet)

its XP but my hardware isnt supported to do a non vm install

XP ought to be fine

I mean OS2 warp btw

yeah

its the only VM host that support it tho ;p

so its either use a type 1 hypervisor, get another laptop thats older, or maybe try again on this laptop

I got the sata working so it installed on the drive but the wifi didnt work and can only see one driver for it which im not sure will work

when I plug the second drive in windows tries to boot from it but the BCD is messed up it is impossible to boot the primary drive without first removing the secondary drive because of damn uefi

techreport.com/news/29202/…

This is pretty crazy

brb

I have just been restarted! This happens daily automatically, or when my owner restarts me. Ready for commands.