Root Access - 2017-07-06 (page 1 of 3)

« first day (2526 days earlier) ← previous day next day → last day (2493 days later) »

12:50 AM

user image

1:22 AM

> The <marquee> element is obsolete and must not be used. While some browsers still support it, it's not required. In addition, using this element is basically one of the worst things you can do to your users, so please, please don't do it.

lol

2:10 AM

user image

2:25 AM

Stack Exchange Network Status: Data center failover - July 8, 2017

posted on July 05, 2017

This Saturday between 10AM EDT (14:00 UTC) and 2PM EDT (18:00 UTC), we will be moving all services from our primary New York data center over to our secondary data center in Colorado. We previously completed a read-only test in preparation for this move and have high hope confidence of success. All user-facing services will be moved including: All Q&A Sites (including Stack Overflow) Stack…

1 hour later…

Journeyman Geek

3:28 AM

mild irony...

whatsapp web dosen't have a mobile view

(Running it as a web panel on vivaldi so I can stop pulling my phone out to check if I have any new requests from people... )

4:19 AM

@JourneymanGeek well, you need your phone on you anyway, cause dumbapps

Journeyman Geek

@Bob yeah

@Bob was hacking at my ngnix instance today...

@JourneymanGeek \o/

Journeyman Geek

@Bob trying to get a second hostblock to work but its still pointing at default :(

@JourneymanGeek lol. you want a new server {} with a server_name blah.example.com; directive inside

Journeyman Geek

@Bob in its own file no?

4:21 AM

@JourneymanGeek optional. look at /etc/nginx/nginx.conf

you'll see that all sites-enabled/* are concatenated inside the main http {} block

recommended to put them in their own files though

Journeyman Geek

ya

also recommended to not modify default but rather create your own based off it

cause otherwise apt upgrade can be a pain if the default files are changed

Journeyman Geek

ah

which is essentially what I did

shrug

I'll stick up the config file later and maybe we can beat it into working

hm

@JourneymanGeek here's some examples:

==> /etc/nginx/sites-enabled/http-redir <==
server {
        listen 80 default_server;
        listen [::]:80 default_server;
        return 301 https://$host$request_uri;
        #root /var/www/nextcloud;
        #location / {
        #       try_files $uri $uri/ =404;
        #}
}

==> /etc/nginx/sites-enabled/nextcloud <==
server {
        listen 443 ssl default_server http2;
        listen [::]:443 ssl default_server http2;
        server_name files.floofyfox.com;

        # certs sent to the client in SERVER HELLO are concatenated in ssl_certificate

that's three different files

Journeyman Geek

I'm trying to do simple

4:31 AM

btw standard in ubuian is to put the main files in sites-available and symlink them from sites-enabled

Journeyman Geek

new.lupinenet.com/new/new.lupinenet.com

that's what did

@JourneymanGeek eh, poke me in the evening and we can go through it? :P

Journeyman Geek

k

@JourneymanGeek oh, you've already uploaded the conf? eh... I'll take a look

@JourneymanGeek this is pretty simple :P

Journeyman Geek

yeah, which is why I probably did something dumb

4:33 AM

if you wanted, you could chuck it all inside nginx.conf, but splitting into file-per-site makes maintenance much simpler

Journeyman Geek

I left the default default file for now and that's loading

yup

@JourneymanGeek wait, is that supposed to load anything? :P

connection reset...

Journeyman Geek

0_0

works for me

for some reason firefox thinks its a binary file 0_0

@JourneymanGeek works in console from testserver. I think it's not playing nice with my tunnel... hm.

@JourneymanGeek when you say that doesn't work... what do you mean?

Journeyman Geek

its loading the defaultpage

rather than the different root I set one level down

4:36 AM

oh

hm

Journeyman Geek

new.lupinenet.com/new is what I expect to see on new.lupinenet.com

@JourneymanGeek did you reload the nginx sserver? :P

systemctl reload nginx

Journeyman Geek

yes

@JourneymanGeek and this is in sites-enabled, yes?

Journeyman Geek

symlinked

4:37 AM

*scratches head*

Journeyman Geek

hm

permissions?

hm, I'm trying to remember which other server I had that ran php :P

ah, ttrss

Journeyman Geek

bash has coloured my new files red, and the original one blue

one sec

@JourneymanGeek ls -la?

Journeyman Geek

geek@bast:/etc/nginx/sites-available$ ls -la
total 23
drwxr-xr-x 2 root root 5 Jul 6 04:29 .
drwxr-xr-x 6 root root 16 Jul 6 04:22 ..
-rw-r--r-- 1 root root 2068 Jun 26 02:00 default
-rw-r--r-- 1 root root 2068 Jun 26 01:58 default.old
-rw-r--r-- 1 www-data root 2058 Jul 6 03:51 new.lupinenet.com

4:39 AM

@JourneymanGeek what about sites-enabled

Journeyman Geek

drwxr-xr-x 2 root root 4 Jul 6 04:26 .
drwxr-xr-x 6 root root 16 Jul 6 04:22 ..
lrwxrwxrwx 1 root root 34 Jun 25 09:25 default -> /etc/nginx/sites-available/default
lrwxrwxrwx 1 root root 17 Jul 6 04:26 new.lupinenet.com -> new.lupinenet.com

.... what?

uhhhhhh link destination? :P

ln -s /etc/nginx/sites-available/new.lupinenet.com /etc/nginx/sites-enabled/

@JourneymanGeek also since you're using PHP you probably want to add index.php at the beginning of the index directive. ilel instead of index index.html... make it index index.php index.html...

otherwise it'd probably 404

Journeyman Geek

lrwxrwxrwx 1 root root 34 Jun 25 09:25 default -> /etc/nginx/sites-available/default
lrwxrwxrwx 1 root root 44 Jul 6 04:41 new.lupinenet.com -> /etc/nginx/sites-available/new.lupinenet.com

and still doing it ._.

caching

@JourneymanGeek shouldiblamecaching.com

Journeyman Geek

ah hah!

yeah, I shoud

ugh, so absolute links

not relative

4:43 AM

yea, no a2ensite :P

Journeyman Geek

which is a debianism too

though there's nothing stopping you from writing one! :P

Journeyman Geek

thanks. Least my config file was fine ;)

@JourneymanGeek almost fine* :P (don't forget that index.php, it took me a while to realise while setting up ttrss)

Journeyman Geek

done

I'll next want to get a working LE/cert config on new.lupinenet.com

then I can start moving over

but that's for another day, or maybe even another lunch break ;)

5:22 AM

@ThatREDACTEDGuy youtube.com/watch?v=7R1t8InSD8A

> 2016 Brazilian Navy 24 Hour MRE Ration Alternative Combat (RAC) Review Meal Ready to Eat Taste Test

thought you'd be interested; I found it interesting

5:53 AM

Hello!

(I'm Rahul2001)

Does anyone know how I can install a batch file as a system process so that it runs on startup even if no user is logged in?

Journeyman Geek

lol

6:14 AM

@rahuldottech set it as a scheduled task, on bootup, execute even if no user is logged in.

should be what you want.

Journeyman Geek

6:34 AM

@Bob heh, trying to build a minimal workable example, then slowly building from there. Slightly tempted to leave new.lnet alone and using/moving test.lnet over to do https setup instead

(AKA, I have no idea what I'm doing and am debating leaving breadcrumbs for myself)

@JourneymanGeek you sure you don't want a basic guide? :P

Journeyman Geek

no ;p

well, sort of finding that as a I go along.

@JourneymanGeek I could always chuck a couple links you way?

Journeyman Geek

shrug its well documented, I just want to be able to go "Ok, this precisely is what I did"

naw, I think between the mozilla guide, my LE/lighttpd guide and medium.com/@mvuksano/…

I am 90% covered

@JourneymanGeek heh, mind sharing after?

Journeyman Geek

6:44 AM

lol. I'll either throw it on SF or SU and/or my blog

@JourneymanGeek having a quick look... eh, I'd recommend ignoring the medium post

cause most/all of that is covered by the mozilla config generator

Journeyman Geek

there's a few things I need to steal from there - very little

(and assuming you don't want to support $old, if you use the modern config then it's even more secure)

@JourneymanGeek literally every option there is covered by the mozilla generator :P

Journeyman Geek

my current setup has a set of diffie hellman paramaters...

donno if they are worth the trouble but that's not really covered in the mozilla one

@JourneymanGeek mozilla modern config disables the DH suites

Journeyman Geek

6:47 AM

ah, why?

probably the debian bug

Journeyman Geek

from a few years ago?

lots of software turned off dh and dsa after that one

@JourneymanGeek because ECDHE is better

Journeyman Geek

hm

6:49 AM

And which falls first if the quantum computer works?

> Most modern clients that support both ECDHE and DHE typically prefer the former, because ECDHE provides faster handshakes than DHE ([1], [2]).

Unfortunately, some widely used clients lack support for ECDHE and must then rely on DHE to provide perfect forward secrecy:

Android < 3.0.0
Java < 7
OpenSSL < 1.0.0

Journeyman Geek

shrug

unless you need to support ^, just use the modern config with the ECDHE suites

Journeyman Geek

My primary focus here is really to stop browsers from whining at me ;)

eh, most of my gear is newer

@JourneymanGeek I used the mozilla modern config cause (a) easier, (b) documented, (c) A+ :P

ssllabs.com/ssltest/…

Journeyman Geek

6:50 AM

ah

I merely have an A

@JourneymanGeek A+ is probably the HSTS tbh, but still...

I don't have to worry about dhparam

Journeyman Geek

lol, I have the file building now

so its an option

and older stuff would break cause of SNI anyway

@JourneymanGeek also mozilla recommends against generating your own params too wiki.mozilla.org/Security/Server_Side_TLS#Forward_Secrecy

> Instead of using pre-configured DH groups, or generating their own with "openssl dhparam", operators should use the pre-defined DH groups ffdhe2048, ffdhe3072 or ffdhe4096 recommended by the IETF in [RFC 7919 tools.ietf.org/html/rfc7919]. These groups are audited and may be more resistant to attacks than ones randomly generated.

but still, ECDHE > DHE

Journeyman Geek

ah

I've been cargo culting :(

@JourneymanGeek perhaps the mozilla guide is also cargo culting :P

Journeyman Geek

6:54 AM

@Bob mozilla is also probably smarter than someone who is setting up a server over lunch

5

Q: Why is Mozilla recommending predefined DHE groups?

In a revision dated 2016-10-31, Mozilla changed their Server Side TLS recommendation from generating a random DH group to the ones published in RFC 7919. Mozilla claims: These groups are audited and may be more resistant to attacks than ones randomly generated. Isn't using a published DH gr...

tls diffie-hellman logjam

@JourneymanGeek eh, apparently not that much difference

I still prefer avoiding the issue entirely :P

7:21 AM

Freedom is the ultimate power. #spreadyourwings

Tweeted by bwDraco on July 6, 2017 at 7:18 AM

@Bob puts on tinfoil hat more secure... but allow NSA backdoor access.

7:39 AM

@JourneymanGeek ietf.org/mail-archive/web/tls/current/msg16645.html

8:14 AM

morning

8:30 AM

hi

user image

hmm...

@FloofyFox Is that you @Bob?

@DavidPostill its not @NotDog either so I am really confused

@Burgi It's Bob.

> Hi!

I'm an alternate account ("sock-puppet") for https://superuser.com/users/117590/bob

I'm just here for a bit of testing. I might also serve as a chatbot later, who knows?

ah

did @Bob's building burn down?

8:47 AM

@DavidPostill ya, was testing rdp

@Burgi nah. smelt like burnt plastic all day though

morning guys

Oliver Salzburg

9:16 AM

0

Q: How can I verify AD replication between two DCs works

We have a domain with 3 DCs in different networks and we want to decomission one of them. However, I suspect that the two remaining DCs will not replicate properly between each other due to some network misconfiguration. So I want to ensure that, after I switch off the obsolete DC, the two remai...

active-directory domain-controller windows-server-2016

In case anyone here knows :)

Probably some repladmin magic

I guess I could set the two safe DCs up to replicate with each other and take the smelly DC out of the loop for a while

3

Q: Using Amazon EC2 for postgres_fdw or BDR replication

I've been tasked to do two proofs of concept with Postgres on Amazon RDS, one with postgres_fdw and another one with BDR (bi-directional replication extension). After many searches on the internet, it seems to be not possible to do either the replication or setting up postgres_fdw on RDS. Howe...

amazon-ec2 amazon-web-services database-replication

Oliver Salzburg

@AndyK I could have answered that!

@OliverSalzburg really?

Oliver Salzburg

@AndyK Yeah

@OliverSalzburg if you want to answer, I can you some points

Oliver Salzburg

9:32 AM

Well, I would have given basically the same answer ;D

Thanks Oliver, can you mark the answer as accepted if it works for you. — Michael Brown 59 secs ago

Yeah, thanks, but I don't think you got my comment :P

@OliverSalzburg why begs for point...?

@OliverSalzburg #LMAOOOOO

9:50 AM

@OliverSalzburg that answer tho

"have you tried <tool that does a million things, but I won't tell you how to do the thing you want>?"

you have issues with your PC?

have you tried fixing it with windows?

linux?

mac/hackintosh?

you can do a whole lot in them!

Oliver Salzburg

@Bob It was helpful though. I think. Still verifying all the output from the tool

obviously one of them should allow you to use the right tool [which i won't name]

Oliver Salzburg

It already made me realize that it is incredibly helpful to allow IPv6 traffic from your office to reach your DC ;P

And I was right about thinking my IPv6 is not correctly set up \o/

I know that IPv6 smell ;)

@Bob did they say what the problem was?

Oliver Salzburg

9:54 AM

Aw yeah. Such replication

That was pretty easy in hindsight

And someone downvoted my answer wat

@OliverSalzburg who downvoted you...?

Oliver Salzburg

I bet it was someone!

its server fault... it happens

Oliver Salzburg

Logon operations seem a lot snappier now as well. Have to verify from home though

Pretty hyped about this setup :D

@Burgi no :S

Oliver Salzburg

10:04 AM

Now I want to subnet our AWS environment!

@Bob take a fire extinguisher with you in your packed lunch

@Burgi someone said it came from the server room, but infra said they checked and it was all fine in there

sooooo.

HVAC?

10:24 AM

the smoke?

Magic smoke

Journeyman Geek

ALL THE MAGIC SMOKE

@Burgi hm?

yea it was coming through the ac

was it the ventilation system itself that was burning?

@Rahul2001 did anyone say arduino rubber ducky

10:37 AM

@Burgi that's one theory. I don't think anyone here has the details

well, I checked out the stuff I had. Apparently one of my dev boards (the best one- 16mb flash, wifi etc) is supported on windows without the need of drivers.

So I ordered 5 of these and will write some code later.

Likely something that allows remote commands

hi!

@Avery Softonic!

@satibel Anyway to do so from cmd?

##tell Rahul2001 google create a scheduled task batch

@satibel Command ddg does not exist. (note that /tell works on commands, it's not an echo.)

bad bot

##tell Rahul2001 google create a scheduled task batch

well, it is broken it seems

@Rahul2001 ddg create a scheduled task batch

11:00 AM

@Rahul2001 ss64.com/nt/schtasks.html

i've just been thinking... why wasn't skynet able to exterminate the human race?

i have a theory that maybe they were keeping humans alive on purpose

:O

so the matrix comes nextr/

Oliver Salzburg

@WilliamHilsum How do you manage address lists and address book policies in O365? Is that PS-only?

> You can’t use the Exchange Administration Center (EAC) to create ABPs. You must use the Shell.

:(

@Burgi The Mind Blowing Truth About The Terminator Series

@DavidPostill Thanks :)

UNBOXING A QUANTUM COMPUTER! – Holy $H!T Ep 19

2

Henry WH Hack v2.0

11:39 AM

interesting

@DavidPostill Anyone written about lego movie and how ever character in it is just a mental condition, personified, yet?

Henry WH Hack v2.0

I didn't know that guy the creepy looking guy was Linus until I saw the video. Who would of guessed?

It's not Linus of Linux...

OHMYGAWD

Henry WH Hack v2.0

no no no

It's the guy from LinusTechTips.

11:47 AM

@djsmiley2k No idea :/

Linus! :D

12:06 PM

Text Mining of Stack Overflow Questions

Julia Silge on July 06, 2017

This week, my fellow Stack Overflow data scientist David Robinson and I are happy to announce the publication of our book Text Mining with R with O’Reilly. We are so excited to see this project out in the world, and so relieved to finally be finished with it! Text data is being generated all the time around us, in healthcare, finance, tech, and beyond; text mining allows us to transform that unstructured text data into real insight that can increase understanding and inform decision-making. In our book, we demonstrate how using tidy data principles can make text mining easier and more ef …

12:34 PM

a lady in the office has just said her sister's contactless CC has been skimmed remotely

chip card?

credit, I think.

yeah

Not really surprised..

its not meant to be possible

12:35 PM

There should be more of a handshake going on

Contactless cc is for <20€ for a reason.

^

eh, just bump into someone with a reader, and have someone else with a reciever, bam! free beer.

though, there's an insurance for that.

but the range is super limited, we are talking centimetres

Sounds like wireless 802.11ad

ZING!

Journeyman Geek

12:39 PM

heh, my wallet blocks RFID

and if there is crap in the way like leather purses and coins....

tbh i think it was probably skimmed at an ATM or in a petrol station type place

I should get an nfc implant

@Avery what on earth for?

reasons.

Journeyman Geek

if you get lost....

tho the ones they use on dogs are a different tech/frequency

12:43 PM

RFID tags are cheaper and don't need a battery

Journeyman Geek

NFC tags don't either

i thought they did

nfc chips use rfid?

Journeyman Geek

you can even buy NFC stickers for a few dollars

contactless CC? why would you want that? We have contact cards, the opposite, where there's a chip with conductors that has to be physically powered by the reader

12:44 PM

there is a swedish guy who got the RFID tag out of his lanyard pass for the offices implanted into his palm

Journeyman Geek

androidauthority.com/nfc-tags-explained-271872

@Burgi O_O

@allquixotic i'll hunt the article down

TBH if I married one day, I'd much rather have an NFC implant with their name and the date than a ring.

@allquixotic telegraph.co.uk/technology/2017/04/04/…

@Avery harder to remove if you got divorced

12:47 PM

@Burgi what if he gets laid off?

@Burgi true.

@allquixotic i was wondering the same when i first read about it

Journeyman Geek

Its 'easy'

We use contactless prepaid train cards. Same idea

@Avery but then again if you think about the the dissolving of the bond before you bond then there's kinda something wrong with you

oh and uh they're apparently available

i was also thinking "what happens when the company moves offices are upgrades its security system. do they need to get re-chipped?"

12:51 PM

that crosses a line I will probably never go over personally, implanting things in my body

Journeyman Geek

ugh

Its hot. I have the air con turned down. PARENTS KEEP WALKING IN AND LEAVING THE DOOR OPEN :(

@allquixotic heh, preeeety much

@allquixotic why not?

@Avery its creepy and weird

arguable

notice how the older folks in the room are like "nope, ain't touching that" and the youngins are like "that's nice"

#GetOffMyDigitalLawn

12:55 PM

it will cause issues with international travel when you have to explain to a border control guard at the airport why your hand is making the machines beep

Journeyman Geek

almost as annoying as when you notice you're a dog. ._.

almost as annoying as THONK... THONK.... THONK....

Journeyman Geek

Well peg legs arn't exactly elective...

I was referring to your dryer

Journeyman Geek

Oh. The Washing Machine ;)

12:56 PM

i thought he was talking about the channel ping noise!

Journeyman Geek

Yeah, that's a bit of a inside joke

Today We Learned that THONK can have many interpretations

@Burgi small metals don't really trigger them

@Avery #MetalDetectorTriggered

Journeyman Geek

heh

12:57 PM

@Avery the components inside my plastic watch set them off

Journeyman Geek

I pass through one every week on my way to mandatory fitness classes

it's about density

and size.

@Burgi :O YOU HAVE A PLASTIC EXPLOSIVE WATCH????

Journeyman Geek

I don't think my watch triggers it, but coins do

@allquixotic aliexpress.com/item/…

12:58 PM

RUN!!!!!

this doesn't need any inserting.

4

tick tick tick..........

OMG IT'S TICKING

my smartwatch doesn't trigger generic metal scanners

Neither does my Cook Watch

Journeyman Geek

12:59 PM

samsung?

neither does my overwatch.

Journeyman Geek

;p

« first day (2526 days earlier) ← previous day next day → last day (2493 days later) »

Transcript for

Jul '176

Root Access

For all you Super Users out there. You have backups, right?

computers technology

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile