Ask Ubuntu General Room - 2017-10-16 (page 1 of 2)

« first day (2574 days earlier) ← previous day next day → last day (2391 days later) »

12:06 AM

can't wait to farm hats

ono

Journeyman Geek

@HusnainRaza dabbing intensifies!

@TheWanderer BANNING INTENSIFIES!

no

Journeyman Geek

CANIS VULT!

ban jmg pls

Journeyman Geek

12:07 AM

Canae? I donno. I don't speak latin.

Ubuntu Questions on U&L

1:06 AM

1

Q: How can I run docker on diskless machines?

I want to run docker on diskless Ubuntu 16.04. I setted up PXE server and could run diskless ubuntu referring here. But when I run docker run --rm hello-world, the diskless machine returned following messages. [1731.173432] overlayfs: filesystem on '/var/lib/docker/overlay2/0fdffd6d...76-init/d...

ubuntu nfs docker

2 hours later…

3:08 AM

So I was watching some random guys's Unreal Engine 4 showcase on YouTube and....

WOW

Just look at this:

user image

That looks insanely good

If I didn't know any better I'd say that was real footage

cc @NathanOsman --^

kinda low def, but wow

3 hours later…

5:55 AM

Nice.

That's pretty impressive.

o/ @NathanOsman

5 hours later…

Ubuntu Questions on U&L

11:27 AM

0

Q: How to revert back to ALSA?

I wanted to try out oss because sound on alsa is not great. I am on elementaryOS Loki which is built on ubuntu. Anyways I installed alsa-oss using sudo apt-get install alsa-oss but it didn't recognize my sound card(its Realtek ac290). So I uninstalled it and now I dont have any sound. I have tr...

ubuntu audio alsa elementary-os oss

Stay off your WiFi, folks! WPA2 is insecure!

4

does this mean we don't have any secure WiFi encryption?

Errrm my smartphone does not come with a network jack.

wut

@ByteCommander well, shoot :/

"The weaknesses are in the Wi-Fi standard itself" ohhhboy

Journeyman Geek

11:47 AM

just run it with no security... ;p

12:03 PM

Huawei Mate 10 launch!

HUAWEI Mate 10 Keynote Live

lol they showed someone filming on an S8

Ubuntu Questions on U&L

0

Q: TL-WN722N with Oracle VirtualBox on Ubuntu 16.04

I am trying to setup the TL-WN722N connection over Ubuntu running in a Virtual Box. The later idea is to interface TL-WN722N with a cyclone V SoC running a lightweight Linux - Angstrom. Right now, I have followed the steps/suggestions provided here: How can I get my wifi card TP-Link TL-WN722N...

ubuntu virtualbox

1 hour later…

Hans Petter Taugbøl Kragset

1:37 PM

hey guys. Anyone of you have a good answer to what kind of ETA we can expect for the updated wpa_supplicant (already patched at the maintainer w1.fi/cgit/hostap) to be available through packet manager? Or alternately, how can I use the code there to update my installation?

2:12 PM

@HansPetterTaugbølKragset Right now there is no ETA

They haven't published the Ubuntu security notice yet: usn.ubuntu.com/usn

Red Hat hasn't done that yet either: access.redhat.com/security

Hans Petter Taugbøl Kragset

I find it strange that it is taking so long, that is all. I know there is no ETA, but maybe someone with historical knowledge can make a better guess than me, I initially thought that it will be fixed by the end of the day, but we will see.

Apparently already fixed in debian: seclists.org/bugtraq/2017/Oct/25

Typically ubuntu is 5-6 hours behind debian

3

Hans Petter Taugbøl Kragset

Thanks that is exactly the type of estimate I was after

But it can be up to 3 days

Hans Petter Taugbøl Kragset

Hope not in this case

2:16 PM

that email was sent 4 hours ago

@jrg for major patched bugs like that, it's probably being worked on by the security team

i'd guess maybe by the end of the day UK time it will be patched?

#ubuntu-hardened has the channel topic as "#ubuntu-hardened WPA updates are being worked on and will be published shortly."

Ubuntu Questions on U&L

0

Q: notebook halts after suspended mode

there is a problem i have with Linux mint 18.2 xfce on fresh notebook Lenovo IdeaPad 110-14IBR. sometimes after i choose Suspend mode and restore work with notebook opening all system halts and only power off button works. can it be software or hardware problem? is there some way to understand wh...

ubuntu linux-mint

@jrg Yep. MAJOR major issues like this one get to the 'fix it now' issue.

as i said, by EOD most likely it'll be fixed.

usually a 24-hour turnaround for ultracritical bugs

though I wonder if the vulnerability also extends to WPA2 Enterprise 802.1X cert auth networks as well...

Yes it does

2:29 PM

oh, well, okay then.

But can it be fixed? I'd understood that the vulnerability is in the WPA2 implementation itself. So you'd need to fix that, then fix your router, your phone and your computer.

Yes it can be fixed

@jrg But will require patching everything, right?

I mean, if I just patch my Linux, that doesn't solve it. I'll also need firmware updates for my router and updates for any other wifi-enabled device I own.

Hans Petter Taugbøl Kragset

Everything with a wireless adapter needs to be patched for things to be safe.

Imagine all those poor masochists who paid money to be spied on and bought one of them fancy alexa or google dot thangs.

Of course, those people presumably don't care much about privacy in the first place, so I guess they might not mind.

Hans Petter Taugbøl Kragset

2:42 PM

the vulnerability lies in handling of the 3rd part of the 4-way handshake of the protocol, meaning the initiating side will need a patch for the connection to be safe. this is in all normal situations your computer, i.e. your router is not critical to update.

Computer or phone. Any client, really, right?

Hans Petter Taugbøl Kragset

The problems arise because the standard/protocol does not specify how to handle retransimissions of the third packet of the 4-way handshake leading to predictable cryptographic keys.

Any client yes

And when the protocol does not specify what to do implementations (unfortunately) ignored the issue leading to severe issues

read it all here: krackattacks.com

@terdon yes and no

Hans Petter Taugbøl Kragset

No because some clients are not vulnerable already because of good implementations, or do you think of something else @jrg?

his question was "will require patching everything"

and the answer is yes and no

yes, you should patch everything

however, if the client is patched then you're ok

2:56 PM

So the router doesn't need to be patched is what you're saying, unless the router itself can also act as a client. And I can't really think of any cases where the router would be a client.

Right

now, there is a scenario that i didn't see covered

and that is where you are targeting the access point and not the client

Access point where the router is connecting to wireless, and providing hardwire connection to another computer

theoretically the AP is a client for 50% of the transaction

Wireless range extender....

yeah, that's one

those will never get patched

3:01 PM

I patched my once, immediately after purchasing it!

@jrg great. . .

> The weaknesses are in the Wi-Fi standard itself, and not in individual products or implementations. Therefore, any correct implementation of WPA2 is likely affected. [...] the attack works against personal and enterprise Wi-Fi networks, against the older WPA and the latest WPA2 standard, and even against networks that only use AES.

Yupppppp

I found a nice post on security.se and that says that routers are also vulnerable.

51

Q: Consequences of the WPA2 KRACK attack

Today new research was published on vulnerabilities in wireless network security called Krack. What are the real-world consequences of these attacks for users and owners of wireless networks, what can an attacker actually do to you? Also is there anything a wireless network owner can do apart f...

wifi wireless wpa2 krack

8

user136984

3:21 PM

In terms of the poisonous plant I may have consumed yesterday. I went to the hospital and I am fine.

user136984

Although I do still feel a little odd.

user136984

It appears as though it releases small amounts of itself into the air so that's probably all it was.

I'm glad to hear you are all right!

user136984

:)

user136984

I've given the plant to a friend of mine who eats poisonousness plants for a hobby to see what they do.

user136984

3:24 PM

I forgot that he does that sort of thing.

user136984

He only reminded me about that though after I had already given it to him.

user136984

Hopefully he won't do anything stupid.

randomly screams

4

user136984

I've warned him about it.

Why does someone randomly eat poisonous things to see what they do?

user136984

3:27 PM

I don't know.

user136984

You'd have to ask him.

user136984

I guess for fun.

Does your friend have the poison control center number on speed dial?

user136984

He doesn't trust the establishment.

betcha it's speed dial #1 lol

user136984

3:29 PM

He's training to be a doctor so hopefully he will be ok.

user136984

I think he generally has a more qualified medical friend around when he tries these things.

Does he raise poisonous spiders also?

user136984

His parents don't let him. :D

user136984

He's been forced to move in with them again due to housing prices.

user136984

And they think he's bonkers.

3:33 PM

They sound like sensible people :D

user136984

So I would think that they will have something to say about this poisonous plant.

user136984

Especially as he'll probably put it in their kitchen. :D

3:48 PM

Hi.

ubuntu + kali tools = Kalibuntu. shot

Today's important task is switching my mailserver from the wildcard TLS certificate I paid $100+ for to Let's Encrypt.

@NathanOsman not too hard. But I have five mailservers with my domain, so...

i kinda needed the wildcard cert :P

also for the company validation level certs - can't get that with LE :P

Let's Encrypt is offering wildcard certs. next year.

@NathanOsman true but I don't think they're offering validated green-bar certs

3:55 PM

How about that WPA2 vulnerability?

That's going to make things interesting.

Extended Validation Certificate

An Extended Validation Certificate (EV) is a certificate used for HTTPS websites and software that proves the legal entity controlling the website or software package. Obtaining an EV certificate requires verification of the requesting entity's identity by a certificate authority (CA). Web browsers show the verified legal identity prominently in their user interface, either before, or instead of, the domain name. For software, the verified legal identity is displayed to the user by the operating system (e.g., Microsoft Windows) before proceeding with the installation. EV certificates use the same...

Yup. I know what an EV cert is. :)

@NathanOsman I know right

I hope Netgear issues firmware updates for my router...

i'm after OV certs starting next year

which means more money.

3:56 PM

Yes.

but the 3 year wildcard cert helps :P

@NathanOsman it also kinda helps I funnel all my mail through a mail gateway box BEFORE it gets to my mailserver box.

so... :P

dual layer spam controls :P

since i run checks both at the gateway AND the ingress of the mail server (because sometimes the gateway is down briefly)

all my domains' mail runs through the gateway.

so... :P

I just have a single mail server but it receives mail for half a dozen domains.

I push everything that comes in through SpamAssassin.

well I have multiple endpoints for my domain mails.

I have individual mail servers, or Google Apps.

yet everything filters first through my mail gateway box.

Which is really good for training my spam filters because it's catching all the things Google catches plus additional rules I've put in place for filtering things

so with 7500 individual instances of spam caught within the past month that's helping heh

across five domains

I catch about 500 spam emails a day.

LOL.

> "Q. Should I temporarily use WEP until my devices are patched?"
> "A. NO."

6

4:17 PM

LLOLL

I would hope no serious administrator would ask that.

user136984

@ByteCommander: Turns out I'm quite a bit German by the way. It's made my interested in learning the language. I don't suppose you would know of any good courses? I guess as you're German you probably would have come across them?

I wonder when dd-wrt will have patches out.

#%$DFH#. I hadn't thought about the phones in the house..

Ugh.

Mine will get patched.. but everyone else is on old/cheap phones that likely won't.

user136984

4:33 PM

Fortunately I have never used Wi-Fi and I don't really have any plans for moving away from the grounded Ethernet.

Luckily this happened before Orea came to the OP3.

Luddite

Maybe they will be able to add the patch before release.

And it's the last major update we're getting.

@ParanoidPanda You plug an ethernet cable into your phone? :P

user136984

:D

user136984

@Nathan: I don't use the Internet for that, that's what the computer is for, the phone is for phoning and texting. ;P

4:35 PM

Fair enough :P

@NathanOsman you should stop using Oxygen OS anyway and switch to Lineage: chrisdcmoore.co.uk/post/oneplus-analytics

Lineage is based off 8.0 or still 7.1?

@NathanOsman I mean, with OTG you probably could.

@NathanOsman no idea. Read the article. It's not about versions

I know.

I am aware of that issue.

user136984

Does anybody else use NoScript and the latest Firefox?

user136984

4:37 PM

Because the icon seems to have disappeared...

I have nightly installed.

user136984

Very strange...

@NathanOsman Okay.

But I don't use it.

user136984

I mean just the latest stable version.

4:37 PM

Ah, no - got rid of it.

I only have Chrome and Firefox nightly.

user136984

Right

BTW, Firefox is really looking good.

I may switch to it.

user136984

In terms of themes the dark compact one is really great.

Good to know.

user136984

Just got this email:

user136984

4:40 PM

==========================================================================
Ubuntu Security Notice USN-3455-1
October 16, 2017

wpa vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 17.04
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in wpa_supplicant.

Software Description:
- wpa: client support for WPA and WPA2

Details:

Mathy Vanhoef discovered that wpa_supplicant and hostapd incorrectly

I assume Arch has updates already...

Depends at what level the network stack needs to be patched.

iirc it's wpa_supplicant

user136984

We just had them.

user136984

Version 2.6.

Lemme see what my Pi is using.

user136984

4:41 PM

You've only got version 2.4.

hasn't hit artful yet. :(

user136984

Haha! >:P

Yup, Arch on the Pi is using wpa_supplicant.

Fix for dd-wrt has been committed.

2

Apparently debian patched already.

Tries to remember the root password for the Pi...

Tries really really hard to remember the password...

Remembers it.

# systemctl status wpa_supplicant
* wpa_supplicant.service - WPA supplicant
   Loaded: loaded (/usr/lib/systemd/system/wpa_supplicant.service; disabled; vendor preset: disabled)
   Active: inactive (dead)

Wat.

It isn't even running?

Oh.

# systemctl status wpa_supplicant@wlan0
* wpa_supplicant@wlan0.service - WPA supplicant daemon (interface-specific version)
   Loaded: loaded (/usr/lib/systemd/system/wpa_supplicant@.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2017-07-12 18:56:04 PDT; 3 months 4 days ago

There we go.

Restarting wpa_supplicant over WiFi is fun.

There goes my container's three months of uptime...

> "In particular this means that attacking macOS and OpenBSD is significantly easier than discussed in the paper."

Pokes fun of macOS users.

Realizes that he is a macOS user.

5:05 PM

@ParanoidPanda Nope, can't advise you there. Sorry.

user136984

@ByteCommander: I thought that would probably be the case, but I thought I would ask anyway. :)

@ParanoidPanda It disappeared once for me within the last weeks , but was back after restarting the browser.

user136984

Thank anyway.

user136984

I seems to have just disappeared, I'm hoping it will just come back at some point.

user136984

I guess I could file a bug report.

user136984

5:11 PM

I'm kind of hoping someone else already has.

The average email ingress rate for my mailserver in October (so far) is about 475 messages per day.

i'm just going to say "thank you so much, archwiki"

Yeah still not in the artful repos

5:31 PM

hm. got an update for wpasupplicant on 1604?

that was fast

Aaaand. My Pi is now up to date.

Yay, it's here too. I thought my local mirror would lag behind longer.

Only other wireless devices are an HP printer (good luck getting a firmware update for that), my laptop (running 16.04), and everyone's Android phone.

2.4-0ubuntu6.2 is the correct version for Xenial?

@ByteCommander That's the update I just got.

5:34 PM

great

Also, more reliably speaking, yes, that's the one:

usn.ubuntu.com/usn/usn-3455-1

so wow

bluetooth was pwned, wifi is pwned...

are we going to have to go back to 100% wires?

It was always the safest and fastest.

Not perfectly 100% safe, but better than anything wireless.

so... yay. i'm going to have to have my wired headphones, my smartwatch needs to be wired, my charger needs to be wired... gah

It depends on how valuable the privacy of the traffic actually is.

For example, wireless headphones aren't a concern for just listening to music, right?

5:37 PM

and i need to buy an ethernet dock for my phone. and then there's still LTE

unless their firmware gets blueborne'd

Also, EVERYONE SHOULD BE USING HTTPS ANYWAY.

So in theory, this shouldn't be so serious.

In theory.

also holy crap remote X is amazing

i wish i used this more in the past

Remote X?

yeah

What's that?

5:44 PM

running programs over SSH on another computer and tunneling them to mine

e.g. work computer is in a different room, so just using ssh -X to launch IntelliJ

Ooooooh.

X11 over SSH.

Right. Yeah, that works fairly well over LAN.

It's a great way to go through about 30GB of data

running apps in 1080p tunneled over SSH

well, i am running over lan

4k*

I remember VNC at 1080p over LAN from my Mac averaging about 20 MB/s.

But I think that was with compression disabled.

X11 over SSH isnt as bad iirc

5:50 PM

X11 would be a bit lighter.

and it's compressed

Well, but compression won't do anything if the content is sufficiently complex.

but you can go through 20+GB if you're using it all day every day

(Like you're looking through photos, etc.)

true

5:51 PM

eh, this is just intellij

I tend to prefer Chrome Remote Desktop.

It's surprisingly usable.

true, but most of the time i don't want the desktop

b-but my libre

3

As long as you don't mind proxying your screen through Google :P

i want a single app

5:53 PM

RemoteFX over RDP is pretty amazing.

krdc even includes support.

Ask Ubuntu Meta

6:25 PM

0

Q: How to deal with an old question with two separate queries

The disputed question is this one: Any way to use Maximus-two (or similar extension) on Gnome 3.24 in 17.04? Notice the in the last paragraph ("PS: Not really related, but my other issue...") the asker posed a separate question not directly related to the original query. I posted a comment askin...

Ubuntu Questions on U&L

6:38 PM

0

Q: RAID 1 issue involving linux-image-4.4.0-87 generic, UBUNTU 16.04 LTS

I'm trying to get RAID 1 installed on an older "SuperMicro" server. I can install UBUNTU fine without RAID, and everything works perfectly, but for some reason when I try to run a RAID 1 set up I get an error after the partitioning step. The way I have my partitions laid out is. HDD 1 and 2 ar...

ubuntu kernel raid raid1 mirror

6:57 PM

Attention owners of YubiKey 4s - security issue found in the RSA key generator.

If you are affected, it sounds like they will issue a new device.

I only have the U2F :/

Wanted the 4 but was too cheap..

It's not affected (the U2F key).

FFFFFFFFFF

WHY IS ALL SECURITY SUDDENLY BROKEN

5

I take it you have one?

ugh

Mate 10 Pro is the only variant sold in the US

and it doesn't have SD support

while the normal 10 does

7:07 PM

I do have one

God damn it.

Well, I have two. sigh

kek

@KazWolfe Sounds like they'll replace them.

see, this is why you don't go all-out securing things

because when the security breaks, you aren't affected :D

Lol.

#SoundsLegit

@NathanOsman you can connect to a WEP network by entering 123456789 for the password

7:09 PM

Well there you go.

Equifax: Last Week Tonight with John Oliver (HBO)

ye

@KazWolfe I'll take them off your hands :P

@Seth after i replace them, sure

@KazWolfe what, you don't want them anymore?

7:11 PM

user image

says the man who doesn't use 2FA

shhh

@Seth well, if i don't have to ship them back, i'll have four :)

@KazWolfe oh lol. but 2 shouldn't be used :P

As has always been the case, your best form of security is airgapping.

7:13 PM

naw, I'll just wait for another black friday sale or something.

right. i'll have two patched yubikeys, and you'll have my old ones

@KazWolfe Which are now useless :D

They fill them with epoxy IIRC so you can't disassemble them without physical destruction.

Q. Why does Yoda's code always crash? A. Because there is no try.

Tweeted by nixcraft on October 15, 2017 at 7:20 PM

@NathanOsman it's a security feature

@Seth heheheh

ew

who uses TKIP?

AES FTW

7:17 PM

"cloud-based encryption"

What does that even mean?

yes

7:41 PM

ok key 1 of 2 submitted

@NathanOsman your 1kb docker container got mentioned in cron.weekly!

Oh!

i need to get back to LA to submit key 2

Yeah these guys cronweekly.com @NathanOsman

That's great.

Thanks for pointing it out.

7:42 PM

Issue 100: cronweekly.com/issue-100

I am behind, was 100% pure chance that I opened it and spotted it

@NathanOsman ah man

yubikey

:(

8:02 PM

@KazWolfe wait now you're giving them your keys?

8:15 PM

well, replacing keys

hrmmmmm

Ask Ubuntu Meta

8:48 PM

0

Q: Suggesting to change Ubuntu default CMD text editor

Currently 'nano' is the default CMD text editor in all Ubuntu variants I have seen. I suggest to change the default editor to 'ne'. Reason: especially for new users the Linux CMD is a tough learning curve, the more as today even less people have experienced a command line at all, its almost ...

discussion command-line text-editor

9:06 PM

My Ubuntu VM just randomly added a printer.

:O

12

A: To sufficiently protect against KRACK is patching the client, the AP, or both, required?

According to this: IBM XForce post "if even only one of the devices (client or access point) has been patched, the pair are not vulnerable to this form of attack"

I hope that's true.

@NathanOsman The apocalypse is here.

9:46 PM

user image

yubico is awesome

wait, they're giving free ones to affected customers?

yep

nice

i think we even get to keep the old ones

Double nice - although not as useful.

9:59 PM

@KazWolfe well it's not really like they have a use for them

« first day (2574 days earlier) ← previous day next day → last day (2391 days later) »

Transcript for

Oct '1716

Ask Ubuntu General Room

Normally: General discussion around Ask Ubuntu, Ubuntu & offic...

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile