Root Access

bwDraco

00:01

Gigabyte teases new Aorus Z370 (Coffee Lake) boards, to launch on October 5

The biggest mistake Intel made here is their requiring a 300-series chipset for Coffee Lake. 6C/12T desktop processors with very high single-threaded performance may be exciting news, but existing Z270 users are very upset about not being able to upgrade without replacing the motherboard.

This plays right into AMD's hands, since the need to replace the motherboard in order to upgrade presents an opportunity to switch to Ryzen.

Journeyman Geek

@bwDraco other than that intel's basically only really supported processors/platforms across 2 generations...

Can we be a bit more mindful of the fanboying?

Its constantly "intel bad" and "AMD good" and its tiresome.

bwDraco

TBH, I really think Intel has some very big advances here but they seriously did not need to force users to change the motherboard.

@JourneymanGeek Is this an official "mod hat" warning?

Journeyman Geek

No, its an annoyed user warning.

bwDraco

I think that most users on Intel will stick with Intel, but some subset will switch to AMD.

Journeyman Geek

I think the subset of people who swap processors annually is small and vocal.

bwDraco

00:12

It wasn't my intention to fanboy AMD. Intel still has a very significant single-threaded advantage.

Journeyman Geek

Moost people won't care

@bwDraco you do it a lot, to the point where people joke about you needing to work for AMD's marketing team

bwDraco

My big question is why does Intel need to do this?

Journeyman Geek

cause they might need to change pinouts for various reasons...

bwDraco

I really hope they're forthcoming with some valid technical reason.

Bob

@JourneymanGeek I find myself defending Intel more than I really care for, if only to provide a bit of balance :P

Journeyman Geek

00:14

;p

I'd rather go "this is neat" rather than everything being A vs B

bwDraco

So, let's treat this as a mod warning. I'm taking this very seriously and will aggressively work towards correcting this issue.

If it happens again... please consider a kick-mute.

Journeyman Geek

Its not a mod warning ;p

bwDraco

After all, we've crossed the line and this is no longer "we'd like it if you stopped doing this". It's "you're actively annoying others."

Bob

@bwDraco I would suggest not leaping to the assumption of malice.

bwDraco

@Bob I did not.

I'm certainly thinking they probably have some technical reason for this.

Journeyman Geek

00:17

@bwDraco and you know I'd much rather have people talk things through than whack people over the head with my modhammer

bwDraco

Look, I care about my conduct a lot.

@Bob Perhaps Intel never designed the 200 series chipsets to handle 6C processors?

Bob

@bwDraco Well, it's an easy one, and I'm pretty sure I guessed/mentioned it a bit ago.

bwDraco

@JourneymanGeek To tell you the truth... I still want to be a mod or RO, but I'm not aggressively pursuing these positions at this time - but I still want to make progress towards that eventuality. Hence, every little issue is to be worked on.

Bob

> The compatibiliy issues are apparently FIVR-induced since Coffee Lake (and presumably Cannon/Ice Lake) have brought the FIVR back while Sky Lake & Kaby Lake lacked it.

bwDraco

@Bob Well, why can't Intel make up their mind on whether to use the FIVR?

Bob

00:21

@bwDraco Maybe because it's new and has advantages and disadvantages?

Haswell was the only other attempt. There were issues, so Broadwell dropped it. Skylake didn't introduce it. Coffee apparently will.

bwDraco

I never really understood the whole purpose of the FIVR and its pros and cons.

Bob

It's not exactly far-fetched.

I guessed it earlier because, to me, it was the obvious reason.

Hm. My bad. Broadwell had it too?

bwDraco

My apologies about this whole fanboying issue.

I just can't hold a conversation with others because I have had so little active socialization with others...

Journeyman Geek

and just cause its the same socket, dosen't mean its the same pins

and keeping a socket might make sense in terms of parts stocks, even if keeping the pin out does not

bwDraco

@JourneymanGeek I've heard that they might be changing the pin layout a bit (LGA1151-2), but it's not yet clear.

Bob

00:26

@bwDraco Looks like the high core count (Xeon) CPUs always kept it.

And apparently it was bad for lower-TDP processors so it was dropped on the lower-end Skylakes.

Journeyman Geek

@bwDraco then they're basically keeping the 2 generation compatibility since they had since ivy

Bob

(That said, I'm having trouble finding reliable references, so take all this with a decent helping of salt.)

@bwDraco People focus too much on the pins and assume they add one or two extra pins for fun/profit.

bwDraco

Aug 16 '16 at 0:00, by Journeyman Geek

@bwDraco I was stuck at home due to agoraphobia for a few years. I had crippling social anxiety and I'm still arkward around people, online and off. Its just a matter of stopping to think before you do things.

I'll be putting a concerted effort towards fixing this.

Journeyman Geek

This was mentioned in the latest LGR... dansdata.com/fkeyboard.htm It is one of the odder layouts I have seen ;p

bwDraco

That reminds me of this: gaming.kinesis-ergo.com

From the makers of the original ergonomic keyboard, Kinesis.

Journeyman Geek

00:37

Yup

but it has a circular touchpad (thank goodness those things are dead) in the middle

Bob

> At the end of July, the Chrome team and the PKI community converged upon a plan to reduce, and ultimately remove, trust in Symantec’s infrastructure in order to uphold users’ security and privacy when browsing the web.

hm.

> Symantec’s PKI business, which operates a series of Certificate Authorities under various brand names, including Thawte, VeriSign, Equifax, GeoTrust, and RapidSSL

Wait.

Waitwaitwaitwaitwait.

> Equifax

> Equifax

Now... where have I heard that recently?

Journeyman Geek

> EQUIFAX

bwDraco

@Bob Meta-question... Why ask a rhetorical question instead of just saying something like "didn't they just have a breach?"

Journeyman Geek

cause its funny, and we assume everyone knows they had a breach

bwDraco

Just trying to understand so I can socialize better.

(as has been stated before, my not having a sense of humor did result in disruption in the past)

Journeyman Geek

00:45

@Bob oh yeah, in case I didn't mention - running fedora with lxqt for the home linux box...

lxqt seems pretty nice here.

bwDraco

You see, I'm trying to seize upon every learning opportunity so I can get back on track when it comes to social skills.

I wonder if Symantec is past the point where they can regain trust and start getting their certs accepted in the near future...

Journeyman Geek

@bwDraco no

they suck.

bwDraco

So... is it time to switch from Norton Security to Bitdefender Total Security?

(my subscription will be up in about two months)

Journeyman Geek

eh. I just run defender

Bob

@bwDraco lol. those quotes were from Google's plan to distrust Symantec certificates.

The only way back is to get their network and policies audited as if they were a completely new CA

@JourneymanGeek I'm *this* close to going hunting for a way to neuter Defender

bwDraco

00:53

I don't want to switch AV vendors when the solution we're using has been problem-free for us.

Bob

Every A/V will impact file access speeds. Usually quite significantly. Heck, Defender does.

bwDraco

@Bob I've seen this first-hand. I've had to briefly (<5 minutes) disable real-time protection during installation operations.

@Bob I'm using Defender on this cheap netbook because I'm trying to keep the machine lean and clean, but this will decide what AV solution Astaroth will get. Stick with Norton Security, or get Bitdefender or some other security suite? Or perhaps just use the stock Windows Defender?

Bob

Personally, I use Common Sense™

Journeyman Geek

@Bob in theory you could just disable realtime scanning?

Bob

Also known as Don't Download Weird Shit™

Journeyman Geek

01:00

I'm silly and insist on an admin account...

Bob

@JourneymanGeek Nah, Defender ... forcibly turns it back on.

Journeyman Geek

(also, linux box for anything odd)

Bob

Also, I would never run manual scans anyway.

bwDraco

@Bob It's not always that simple. Ads on legitimate websites can be compromised. Websites can be hacked.

Bob

@bwDraco And antivirus does absolutely FA when that happens.

bwDraco

01:03

I've seen this happen several times. In at least one case, Norton Security detected and blocked an attack through a compromised ad.

Journeyman Geek

@Bob funny thing that...

Bob

@JourneymanGeek hmm... lighter KDE? :P

Journeyman Geek

@Bob pretty much

comes with qupzilla (removed) qtransmission (removed...)

also runs well on small, low res screens

unlike KDE

bwDraco

I hate how telling openSUSE to install a standard desktop (even just Xfce) causes it to install a whole bunch of desktop apps that I don't really need.

Bob

Then you're probably installing the wrong package.

Journeyman Geek

01:07

@bwDraco this is pretty light

Bob

There's entire-environment metapackages, then there's lighter mostly-DE packages, there's WM packages, there's very light and half broken only-DE packages...

@JourneymanGeek ...removed?

Journeyman Geek

@Bob literally that's all that's preinstalled ;p

bwDraco

@Bob I've removed the extraneous multimedia packages, but the system still insists on reinstalling them when I run a distribution upgrade.

Journeyman Geek

but I swapped it out for FF and qBitorrent

since the entire reason for that box needing a DE is the latter's torrent rss feature

bwDraco

This is on one of my servers (separate from the one that provides public-facing services like my website), which runs an Xfce-based "cloud desktop" with access via VNC over SSH.

Bob

01:09

@bwDraco If you install a metapackage, of course it will try to keep them.

Remove the metapackage and install the DM separately.

Journeyman Geek

I also have one more daemon on it, but I won't talk about that here ;)

bwDraco

I was not able to identify the metapackage in question.

Journeyman Geek

Not sure if I want to run VMs on it. ;p

bwDraco

I've wound up resorting to package locks to prevent the system from installing packages I don't want.

Bob

@JourneymanGeek Hm, lxqt looks decent enough to try. I'm currently using... openbox, I think?

on the RDP-enabled virt-manager VM

Journeyman Geek

01:12

@Bob there's no proper respin for ubuntu, but coming soon

fedora has a prebuilt one

Bob

@JourneymanGeek bleh, dnf can go die in a fire

bwDraco

root@li1241-34:~ # zypper se -tpattern xfce
Loading repository data...
Reading installed packages...

S | Name | Summary                  | Type
--+------+--------------------------+--------
  | xfce | XFCE Desktop Environment | pattern

Bob

but it'd probably take a few decades to finish burning

Journeyman Geek

hah, I actually rather mind it.

ah, nice thing for me now is that new drive

bwDraco

The pattern is not installed. I can't really tell what's generating all those "recommends" for all those packages.

Bob

01:14

*shrug* been a while since I last used zypper

the new apt is nice

yum was alright

Journeyman Geek

new apt is nice

Bob

dnf just does weird crap (and very slowly)

Journeyman Geek

@Bob works well for me

bwDraco

Also...

root@li1241-34:~ # zypper rm -tapplication "Xfce power manager"
Loading repository data...
Reading installed packages...
Resolving package dependencies...

The following application is going to be REMOVED:
  "Xfce power manager"

The following 2 packages are going to be REMOVED:
  xfce4-panel-plugin-power-manager xfce4-power-manager

2 packages to remove.
After the operation, 3.1 MiB will be freed.
Continue? [y/n/...? shows all options] (y):
(1/2) Removing xfce4-panel-plugin-power-manager-1.4.4-1.9.x86_64 ......................................................................................…

This behavior is what really irks me.

Journeyman Geek

@Bob I still have no good backup method for this ;p

bwDraco

01:17

Short of locking the package with zypper al xfce4-power-manager, what's the best way to go about this?

Bob

@JourneymanGeek for which one?

Journeyman Geek

linux in general

Bob

@JourneymanGeek oh. I have two decent methods now.

Journeyman Geek

tried veeam again. Hates the kernel

Bob

if zfs, recursive snapshot followed by a recursive zfs send through gzip through openssl (encryption) through ftp :P

if not zfs, tar the root filesystem

Journeyman Geek

01:19

yeah, I kinda didn't want to go zfs...

Bob

@JourneymanGeek is this the zfs box?

Journeyman Geek

that said, this is a rediculously minimal build, and rebuilding it is easy

naw, its the box I have at home that just lost its data drive

Bob

@JourneymanGeek well, it's really the perfect backup :P

exact snapshot/image, with zero wasted space

Journeyman Geek

possibly the whole interface is hosed, I need to take it down again to check

oh, I'm not actually concerned with space

the system itself fits quite neatly into 32gb

Bob

@JourneymanGeek then you can dd if you want

Journeyman Geek

01:23

on a live system? ;p

though nearly anything I care about is on /home so...

Bob

@JourneymanGeek sure, why not

(there's a reason I like zfs :P)

Journeyman Geek

01:53

yeah

Michael Frank

02:04

Does anyone know where the Manage Wireless Networks options are in Windows 10? :/

Journeyman Geek

I think its called manage known networks

Michael Frank

I found it, apparently they moved it from a menu item to an option during intial config of the SSID.

allquixotic

@Bob Holy CRAP -- they're going to remove trust for Thawte, Verisign and Geotrust? that's HUGE news

that's the PKI equivalent of Apple going bankrupt / canceling future iPhone / iOS device releases

Michael Frank

Remove trust completely? I thought they were just only allowing very short expiring certs?

allquixotic

2 hours ago, by Bob

> At the end of July, the Chrome team and the PKI community converged upon a plan to reduce, and ultimately remove, trust in Symantec’s infrastructure in order to uphold users’ security and privacy when browsing the web.

> ultimately remove, trust in Symantec's infrastructure

Michael Frank

02:18

Oh right... the reduce part is in there.

Here's a good timeline on what's going to happen with Symantec:

bleepingcomputer.com/news/security/…

bwDraco

I'm on Comodo Positive SSL so I'm not impacted, but sigh

This is making me question my trust in Symantec (Norton) as my AV vendor. Time to switch?

I have not had any serious issues with Norton Security over the past several years.

Ben N

I've always avoided Norton

bwDraco

Bitdefender?

It's more expensive, though.

Ben N

I don't know anything about Bitdefender, sorry :/

Michael Frank

Avast! thumbsup

Ben N

02:29

I used to use Avast! and it was nice, then I switched to the built-in Windows Defender

rahuldottech

@allquixotic huh.

Wasn't Symantec supposed to be good?

Michael Frank

s/good/big

Avery

no

all ssl issuers suck

like

not all

but most

rahuldottech

@BenN I've been doing the same for years now. Run Windows Defender, occasionally scan with Malware Bytes

Avery

Linux can't get viruses

rahuldottech

02:33

@Avery /s

Bob

@MichaelFrank @allquixotic Better source: security.googleblog.com/2017/09/…

@allquixotic Yea it's slower than the StartCom/WoSign one but by this time (+1 month) 2018 Symantec certs will be untrusted.

allquixotic

@Bob just Google, or Apple/Microsoft/Mozilla too?

bwDraco

02:48

@allquixotic Google takes this very seriously because customer trust in them hinges on their being a leader in Internet privacy.

allquixotic

IIRC there was a point during the StartCom debacle when they proudly advertised that their free SSL certs were supported on IE, Edge, and Android 2.3 or earlier :P

bwDraco

Chrome is very, very aggressive when it comes to security. Google is probably doing this for business reasons: if it can't secure user data against government actors, users will lose their faith in Google very quickly. Hence, Google considers establishing itself as a leader in Internet privacy a top priority, despite the fact that its ad-based business model utterly relies on user behavioral tracking. Users trust Google to be a safe steward of their personal data, to not leak data out to unauthorized third parties, so they can't afford to do anything less. — bwDraco Jul 26 '15 at 13:21

allquixotic

now they're a sub-CA to Spain

@bwDraco and yet their browser doesn't do proper CRL and OCSP checking; instead, they have a hard-coded list of bad domains

bwDraco

@allquixotic Firefox had this feature for years.

allquixotic

dev.chromium.org/Home/chromium-security/crlsets

Bob

02:54

@allquixotic Currently Google is the first out with a planned timeline, but Mozilla was active in the original reporting thread so they'll probably have one soon. Microsoft might follow, might not, but at that point Symantec certs are fscked anyway.

bwDraco

Problem is, Firefox is a niche browser at this point (<10% share), and only time will tell if Fx57 will revitalize the aging browser...

allquixotic

my opinion is you should hit OCSP/CRL first, and only if the server is down would you fall back to something like CRLSets

Journeyman Geek

@Avery hah. riiiight

Bob

@bwDraco Firefox doesn't do that.

Journeyman Geek

@bwDraco comodo is... kinda evil.

Bob

02:55

Firefox uses OneCRL, which is only a list of intermediates and other Very Important (TM) certificates.

bwDraco

@JourneymanGeek Explain?

Bob

Google's CRLSets are a full list including all leaf revocations (from major CAs...)

Journeyman Geek

@bwDraco they tried to file a copyright for letsencrypt...

Bob

@allquixotic problem is a lot of OCSP responders are slow. see @DavidPostill's recent issues.

@allquixotic The correct answer is OCSP stapling (and must-staple)

Journeyman Geek

letsencrypt.org/2016/06/23/defending-our-brand.html

Bob

02:56

Even Firefox doesn't hard-fail OCSP by default, but the soft-fail can take a bit of time.

bwDraco

@JourneymanGeek Eh, trademark registration - this was later resolved.

Journeyman Geek

@bwDraco the intent...

bwDraco

Everybody confuses trademarks with copyrights.

rahuldottech

@bwDraco It was still a messed up thing to do in the first place

bwDraco

(I did a research paper on intellectual property so I know the difference)

Bob

02:58

@bwDraco Not only does that get a meh from me, it's also far more nuanced than that.

bwDraco

I think this was more of a bad business decision than malice.

Bob

You have to consider desktop vs mobile, you have to consider the soure of the data, and you have to consider what proportion uses adblockers that also conveniently block the trackers/counters.

For extra fun, Firefox has its own built-in tracking protection too.

Though that might still be private-mode only, I can't remember.

Transcript for