@FaheemMitha Hi Faheem! Sorry for the delay. Unfortunate combination of time zones.

The document I was referring to is linked here.

Section 7.6.3.4 shows how the user password is encrypted using the owner password, and how to decrypt it.

@fra-san Ok. Thank you.

Section 7.6 is around 15 pages. Could be worse, I suppose.

Actually, as Michael said, the answer you got is a good summary of the relevant points -- but I agree it is not easy to understand without gathering further information elsewhere.

@fra-san Do you recommend reading through this spec section?

@FaheemMitha No, I wouldn't recommend it, unless you really want to know what is going on under the hood.

@fra-san Ok. Well, I might give it a try. Though it gets tiring reading through piles of documentation all the time.

@FaheemMitha It actually takes pages to say that, quoting Jay Berkenbilt answer, "..., the file was encrypted by an encryption key that is derived from the user password, and the user password is actually stored in the file encrypted with the owner password".

@fra-san Which seems like a weird way to go about things.

I would have just read the answer you had in the first place and saved the pages

It's not quite answering the right question but the necessary information is there

@MichaelHomer You mean Jay's answer?

He seems to be willing to answer questions, so perhaps having a discussion will clarify things, time permitting.

@FaheemMitha yes, it is so simple, and no, it’s not from scratch, your container runtime will download a pre-built image for you

@StephenKitt Download from where?

@StephenKitt Oh. That sounds handy. Is there any downside?

@FaheemMitha depending on your use-case you need to ensure the container is updated

@StephenKitt You mean like apt-get update, apt-get upgrade?

Or you mean that the upstream container is up to date?

@FaheemMitha exactly

Can I make two StackOverflow accounts with the same email address? Or do I need to use different addresses?

Basically, building containers seems easy, but it doesn’t absolve you from knowing how to manage the distribution that’s used inside your container (if there’s a distribution inside your container).

@StephenKitt Can I trust the distribution inside the container? Given that I'm downloading it from... somewhere.

@FaheemMitha that’s another point to be wary of; by default, Docker will pull from Docker Hub, and the Debian images there are “official” so they are trustworthy (and the namespace is protected). If you want to enforce a specific registry, you can do so, e.g. FROM registry.access.redhat.com/ubi8/ubi-minimal will always get the UBI8 minimal image from Red Hat servers.

As always, don’t copy and paste container references without checking them out ;-).

@StephenKitt Should I enforce a specific registry, since it pulls by default from Docker Hub? Unless Docker Hub is a decentralized network, and you're talking about a specific domain.

@FaheemMitha Docker Hub is centralized, but anyone can upload there (each person/group under his/her/its own namespace). Sort of like GitHub. So you have to be careful what you pull from it — a trusted section is fine, but you can just as easily pull random who-knows-what.

@derobert Hi. What's a "trusted section"?

@derobert BTW, are you familiar with numberbarn?

Apparently you can buy mobile numbers there.

I think Google Voice might be a hassle to use, even to get verified. See for example support.google.com/voice/forum/AAAAjq5-_rMk7GI8EP5hPk/?hl=en

@FaheemMitha Well, someone you trust. Just like you on GitHub. There are also "official images" that are pretty trustworthy as well.

@derobert Official, as in created by the Docker project? Or by Debian?

The site says the Docker project, but I think it's normally in collaboration with the project that the image is related to. The Debian ones are in collaboration with some Debian folks, for example.

@derobert Oh.

Like hub.docker.com/_/debian for example?

yeah

hub.docker.com/search/… has the full list of official images

docs.docker.com/docker-hub/official_images has an explanation

Ok, thanks.

Do you use Docker, then?

yes. Is there anyone left who doesn't?

(looks around...)

(raises hand)

@derobert I've never used it. Hence all these questions.

I feel relieved now. When I picked it up, I thought I was the last person to not use it...

At least now I don't have to worry that I'm the last person not using Kubernetes. :-P

It's possible to create a Debian VM by a variety of methods. But this does sound like an appealingly lazy method. How is it better than say Virtualbox or a (possibly soupedup) chroot. Including the Debian variants like schroot etc?

@derobert Go outside and throw a stone at someone. I think you'll find they don't use Docker either.

It provides more isolation than schroot. It provides less isolation than a VM, but is much more lightweight.

@JeffSchaller If there was a Docker container for ed, I bet you'd use it.

@derobert Hmm, and how does it compare in ease of use to those other two?

That's it's main advantages. It's really easy to use.

Oh, and do either of you have thoughts about numberbarn? Though I suppose it's most likely you've never heard of it.

I've never heard of it.

@derobert Ok. BTW, that would be "its".

@derobert Yes, I figured.

Apparently you can buy local US mobile phone numbers. There is no federal law against doing so.

And their parking plan includes unlimited free SMSs. And is $2 per month.

Probably worth trying, unless I can think of a better option. Of course, the bank would have to believe it belongs to me. I wonder if there is some centralized database of number ownership.

(E.g., with Docker, let's say I want to quickly try something out on a system. Running docker run --rm -ti debian is really easy.)

(I normally use a different, internal-to-the-company image, but... same idea)

@derobert It still has to download, though. Unless you keep images around. And is it fully networked? Or networkable?

@FaheemMitha Yeah, it downloads it unless you already have it local (which you can leave around locally forever). Default networking setup is for NAT for outgoing traffic, but you can do various other things including e.g., forwarding ports to "publish" services

@derobert So more convenient than VB?

I personally use libvirt/KVM, but yeah, definitely more convenient. Especially since a new VM often starts with running debian-installer.

And debootstrap?

Running out of memory. Need to kill some tabs. Back in a bit.

debootstrap was done by the folks building the image, so you don't. It's fully set up and you can, e.g., just apt install whatever.

Docker is great for building images and other dev/test work. And the registries are fine for distributing them. I don't like it for deploying images (in production); I'm currently using rkt for that; plan to switch to podman eventually.

Weird. AIX's ls allows a trailing forward-slash on (plain old) filenames

pretty sure I'm not hallucinating, but I'll double-check. No aliases, no -F action.

I wonder how common that is on various Unix-like systems. I have no idea, but being used to Linux that sure sounds weird.

indeed. No (obvious) mention of it in the manpage. Wondering where I could find some other OS's to play with. Hey, containers would be useful here :)

Containers have to run the same kernel. So you'd need VMs :-/

nothing obvious in the POSIX page

So, do US people own their own mobile phone numbers?

I thought it was just something the phone company gave you temporarily to use.

@FaheemMitha renting might be closer than "owning"

anyone here have an OSX, HPUX, Solaris, or *BSD box they can run ls on?

(BTW: It'd probably be in some POSIX chapter on pathnames, not specifically in the ls page)

@JeffSchaller As I mentioned earlier, there is a service called numberbarn that sells US numbers.

But who is doing the selling isn't clear.

@JeffSchaller found it!

> A pathname that contains at least one non- <slash> character and that ends with one or more trailing <slash> characters shall not be resolved successfully unless the last pathname component before the trailing <slash> characters names an existing directory or a directory entry that is to be created for a directory immediately after the pathname is resolved. (pubs.opengroup.org/onlinepubs/9699919799/basedefs/…)

@derobert good, because I was having no luck with the ls related pages

So that seems to violate POSIX.

ok I'm going to need more (caffeine and/or oxygen) to parse some of this

"Interfaces using pathname resolution may specify additional constraints1 when a pathname that does not name an existing directory contains at least one non- <slash> character and contains one or more trailing <slash> characters."

or, I happily skip by, because the footnote claims this exception only for rename()

@JeffSchaller Yeah. It also says additional constraints. So it wouldn't get rid of the constraints in the previous sentence.

I guess adding slashes to filenames is not one of the "automated tests" done by the POSIX testers.

I only happened to stumble across it when I saw someone else executing: /bin/ksh/ /some/script

of course encyclopedia Stéphane is/was already on it:

to: pubs.opengroup.org/onlinepubs/9699919799/xrat/…

> By specifying the behavior here, it is not possible to provide an implementation that is conforming but extends all interfaces that handle pathnames to also handle strings that are not legal pathnames (because they have trailing <slash> characters).

AIX RFE has been submitted!

Hi. Are there any Americans here you use T-mobile. I was just told by a T-Mobile rep over the phone that their $3 a month plan Pay As You Go plan has been discontinued. Which is surprising, because I can find no mention of it on the net.

And it's prominently mentioned on their web page. I guess I could always call back and ask someone else.

Never mind. It looks like it has really been cancelled. Apparently the cheapest T-mobile plan that will receive texts in India is USD 20.

@JeffSchaller About what, pray say

@Kusalananda scroll up a bit -- pathname resolution of filenames with trailing slashes. It's currently possible to execute /bin/sh/ -c "echo hi"

or ls -l /bin/sh /bin/sh/ and get the file twice

@JeffSchaller Oh.

This room goes quiet for a hours and hours, only to suddenly have 90+ messages posted at once.