/dev/chat - 2020-10-26

« first day (3670 days earlier) ← previous day next day → last day (1277 days later) »

5:21 PM

1

Q: Difference between kill <pid> and kill -s TERM <pid>

What exactly is the difference between kill <pid> and kill -s TERM <pid>. Initially i thought the $TERM variable holds a signal number but when I echo TERM its gives me $echo $TERM xterm-256color

linux shell kill signals

What a reasonable mistake to make!

The OP has often seen variables being assigned without a $, and CAPS indicating variables, so they thought that kill -s TERM is passing the variable TERM.

2

I find that both funny and entirely understandable!

hello folks, I am at a loss to review this : unix.stackexchange.com/review/suggested-edits/356275

edit both bring a usefull (at first glance) update and conflict with last edited answer ...

@Archemar That feels like way too big of a change. I just rejected the edit with this message:

> This is too substancial an edit. Please post a new answer instead.

2 hours later…

7:21 PM

@terdon If you are not able to review something, then do NOT review it. Do not reject it with made-up reasons. Let the author of the answer or people familiar with the matter do it. Discouraging people from correcting misinformation in highly upvoted answers (which are the only ones that people coming here from searches read) is plain disgusting. Especially when coming from a moderator. No, I AM NOT THE AUTHOR of that edit suggestion neither affiliated with him or her in any way.

1 hour later…

8:42 PM

@user431397 rewriting other people's answers is not a technical question. If the answer is dangerous or misleading and obsolete then a disclaimer/warning on top might help readers from getting trapped.

@user431397 Woah there. Relax. I was perfectly capable of reviewing it, thank you. And it was a very, very extensive edit, changing the answer significantly. Such edits are regularly rejected, because substantial changes like that to an existing answer circumvents the quality control process of the site (voting) and that's why it is better to post a new answer instead of rewriting an existing one.

There doesn't appear to be any misinformation in that answer

Nevertheless, the quality control process needs circumventing, since it's fundamentally broken in exactly these situations

It is, yes. But the best way to fix that is usually posting a new answer that can be voted.

I'm told the company will roll out a solution for obsoletion; any minute now.

8:57 PM

However, the main reason I rejected it is that it was essentially a complete re-write of the answer. It kept the quote that was in the original, and the odd preposition and just about nothing else:

user image

There was a remark in the edit comment about a previous version "perverting" the answer or something like that. If that's the case a rollback might be called-for.

Then it should be rolled back. I admit that such strong language ("perverting"? really?) doesn't predispose me favorably towards the editor.

true

Finally, @user431397, please note the editing guidance in the help center, specifically this part (emphasis in the original):

> Common reasons for edits include:

To clarify the meaning of the post (without changing that meaning)

Fundamentally, adding a zero-vote answer below ten others, one accepted with several hundred votes, does not "fix" anything

9:01 PM

Since that edit was rewriting the entire question, that is clearly beyond the limits of acceptable edits which is why I recommended a new answer.

The recent editor is complaining about edits made to their writing in revision 5

@MichaelHomer Perhaps, but that is another problem entirely.

And it's hard to disagree that revision 6 was a deeply stupid edit

To be fair, I would also have rejected the original 5th edit as way too extensive.

Well, yes

But that is rather the problem, isn't it

9:03 PM

It is? What is?

If you are saying that we should allow edits that completely subvert the intent of the original answer, I would disagree, but that's something for meta.

If this answer is obsoleted/misleading/does not provide a useful solution to the title question today — which I don't know about — there is literally nothing to do about it and it will be left there to lead people astray forever

No, a new answer can be posted (answers are sorted by "active first" by default, apart from the accepted, so new answers would still be visible). If the new answer is right, it can be voted up.

Editing the answers is not a good solution either

On a side note, original editor doesn't have reputation to unprotect and post a new answer.

Alternatively, you can edit in a warning stating that this is obsolete and linking to the new, better answer. That is commonly done.

9:05 PM

@terdon Of course they're not

@Archemar 354 rep should be more than enough to post with protect, right?

protection has some crazy low rep limit

Editing in a "warning" is arguably more subverting of the intent of the answer than making it into an actual answer would be

I have 103 and it tells me I need 10 rep to post an answer

Ah yes 100+ to post many more to unprotect

Can someone help me understand how a client accepts a certificate presented by a server? The server has the certificate, and when the client connects to the server, the server shows that certificate to the client. How then does the client know if the certificate is valid or not? I think a private key is involved somewhere but I'm not sure how it is used in the interaction between the client and server.

9:07 PM

@MichaelHomer but then the single point of failure is the quality of the person rewriting the answer. With a warning the original intent is there, but readers can think "OK, I need to investigate what I should do, let me look at the other answers"

Apologies for breaking the chain, but I don't get how it works.

@AndrasDeak Pretty much, and that is always the single point of failure if it's not possible to edit the answers to make them adequate

So while I agree that technically it's more against author's intent to say their answer is useless, from a usability and knowledge repository standpoint it's the lesser wrong

@BlackPanther are you talking about ssh or ssl/https ?

It's difficult to accept that the intent of the original answer was to disclaim its own value

9:11 PM

That's what I'm saying

@AndrasDeak From a usability and knowledge repository standpont the lesser wrong is to edit the answer to be correct

There are two wrong solutions, and I think the warning is the less wrong choice, all things considered

@MichaelHomer well, if you trust the rewriter, sure. In general I don't trust anybody.

There's no conceivable way that usability is enhanced by a see-elsewhere-instead

400 upvotes on an answer that has been completely rewritten tells me nothing

if it's on an answer that used to be correct it tells me all I need to know

Unfortunately, the whole model is just broken

9:13 PM

yup

Even without accounting for the company behind it, or the godawful user base

I feel attacked

(no, not really :P)

@BlackPanther If this is TLS, the certificate chain presented will lead to a root (digitally signed along the way) that is preemptively trusted by the client. The operating system or browser comes with a fairly large set of root certificates that it trusts and any certificate that it accepts is signed by a certificate that's signed by a certificate ... that's in that store

@MichaelHomer do you count yourself among those godawful people?

Basically, I'm trying to understand why this answer works:
https://stackoverflow.com/a/60516812/8825683

Thanks, can you explain using this answer as an example?:
https://stackoverflow.com/a/60516812/8825683

9:21 PM

@BlackPanther You're adding a new trusted root certificate to the store & your server certificate is signed by that

It work because last line self sign certificate, note when used as https: //192.168.1.3/foo any browser will complain about certificate being untrustworthy.

@MichaelHomer that really is a shame, because I miss your excellent and informative answers. Your constant passive aggressive attacks on the community I could do without.

@MichaelHomer Thanks for looking at that answer. The Certificate authority in that example is localhost. Is the certificate authority the same as the root authority you mention?

@BlackPanther yes

@terdon There's nothing passive about them. A small number of persistently abusive users drove me away, as you well know, and at a few points in the last year or so we have also seen the indefensibly repugnant behaviour of large swathes of users across the network, with whom I would not wish to associate

I stand by all of the aggression on both of those points and it is quite direct.

@MichaelHomer Great! So because the server's certificate is signed by the certificate authority in the browser, that certificate authority can vouch for/validate the certificate is legitimate. Is this how the interaction between the server and browser works when a certificate authority is imported to the browser and the server the browser connects to has a certificate signed by the certificate authority?

9:34 PM

@BlackPanther The CA has signed (transitively) the server's certificate, claiming that it knows the certificate belongs to who it says it belongs to. The certificate corresponds to the private key stored on the server, and between the public (certificate) & private keys the server and client can verify that the server is in possession of the private key, the public key has been asserted by the CA to belong to some particular entity (domain name), and thus that the server is controlled by that entity

@Archemar Thanks. In that answer there are two keys, myCA.key and $NAME.key. What is the difference between these two keys? It looks like only myCA.key is used to sign the certificate at the end, but I'm not sure.

The CA has a public-private key pair, and the server certificate also has a public-private pair

The CA signs other people's certificates with its private key so that the signatures can be verified with its public key

Since there is only one customer here, that private key only gets used once, but you could for example sign further certificates with it

The customer public key is signed by the CA and that's the certificate distributed to clients. The customer private key is used in the exchange process to verify that you are talking to the other half of that public key

9:50 PM

@MichaelHomer this is starting to make sense, thanks.

@MichaelHomer does the private key of the CA encrypt, and the public key decrypt?

@MichaelHomer Okay, the private key is like a pen. I see now, it doesn't get used up.

@BlackPanther The CA really only does signatures, but in RSA those are essentially identical operations anyway

All of them, I mean: you sign something by decrypting it, and you validate the signature by encrypting it

Is the customer the creator of the private key which was used to create the following certificate signing request?
`openssl req -new -key $NAME.key -out $NAME.csr`

The CA signs other people's certificates with its private key, and other people validate those using its public key. Something similar happens with the customer's two keys to authenticate the TLS connection

@BlackPanther I was distinguishing three roles: CA (root), customer (e.g. server), and client (e.g. browser). The customer would be the one making the CSR, yes

@MichaelHomer Okay, I got it mixed up. It's the other way round.

Can you confirm that $NAME.key is the customer's (i.e. in this case, the server's) private key?

@MichaelHomer It sounds like the public key is the same as the certificate, are they the same?

10:08 PM

@BlackPanther yes

Thanks :)

@BlackPanther The certificate that's distributed in the TLS handshake contains the public key and the signature(s) on it, so I was a bit sloppy conflating them exactly

Also the keys are really numbers

@MichaelHomer I got it! The certificate includes/contains the public key, but not the private key. The private key is a separate entity.

Yes, the private key is the part you keep secret, that acts as the counterpart to the public key everyone can see

@MichaelHomer I don't understand how the customer's private key is used in the exchange process to verify that you are talking to the other half of it's paired public key?

10:20 PM

There are two paths: historically, the client generated a random number, encrypted that with the public key, then sent it to the server. The server would decrypt it with the private key, and so they both had that number to use to encrypt all the traffic (and so if they're successfully communicating, it has to have been decrypted correctly)

@MichaelHomer I'm thinking of the CA's public-private key pair as a witness-committer pair. I can't think of a better word for committer right now. But any way, my reasoning is that the committer (i.e. the private key) signs the public key in the customer's certificate, and the witness is the only one other than the committer, who knows what the signature looks like.

Better, they use Diffie-Helman exchange for a session key, which means the transaction has forward secrecy, and the authentication exchange isn't used for the actual transmission encryption

For the CA, it generates a hash of the customer's certificate details, decrypts that with its private key, and attaches that to the certificate

The client gets the certificate and the signature, encrypts it with the public key, and verifies that the hash of the actual certificate details matches the result of the encryption

(signing and encryption are dual in RSA)

There are other crypto systems that work slightly differently, but that's the general idea of it

@MichaelHomer So it's not currently done like this anymore?

@BlackPanther It's preferred to use D-H secret exchange to set the session key so that a later compromise of the private key doesn't allow decrypting the transmissions

nevermind, you said that earlier

10:28 PM

The authentication is more a side effect of the encryption exchange in the most basic version of my "historic" path there, but in reality there is always a separate authentication phase since very early on. That can work the same way (generate random data, encrypt it, get the other side to send it back to you in plaintext), but also some more complex ones

After starting the server (Kestrel), when I try to connect to localhost at port 5002 which I set up for HTTPS, I get the following error:

System.NotSupportedException: The server mode SSL must use a certificate with the associated private key.

@MichaelHomer that fits my naive mental model that public keys are padlocks and private keys are, well, keys. You can give people your padlock which they can use to lock stuff, and you can prove to them that the padlock is yours by opening the lock and revealing the contents.

(All of this has been substantially simplified - there are several different cryptographic algorithms, different TLS versions, different kinds of key exchange, all of which could still be in use today - your example is generating RSA keys, but it wouldn't have to be)

@MichaelHomer Would this indicate that I am not providing the private key that should be paired with the public key in the customer's certificate?

@BlackPanther Sounds like it, but I don't know what Kestrel's errors diagnose

@AndrasDeak Yes, but in RSA-type crypto systems both keys are both keys and padlocks, and you can also use a padlock to unlock a key

10:32 PM

Crazy :)

The "proof" case would more often be signatures, which is the reverse of the example I gave: I send you a nonce value, you sign it (which is actually the decryption operation) and send it back, then I verify it (by encrypting with the public key) to check

@MichaelHomer Thanks. Would you know how to combine the customer's private key with a certificate? Dotnet only allows me to send a single file to Kestrel so I cannot supply both the private key and public key separately.

Can I just concatenate the .crt and $NAME.key to get a .pem file?

I don't know what format it wants, but hopefully it's documented somewhere

As a layman it's pretty mind-boggling to me that all of this works

@BlackPanther Probably not

10:36 PM

I too am a layman, and it's surprisingly complicated.

Your baseline is off if it's "surprisingly" complicated.

RSA is simple enough that you can actually learn it and do it manually

All the rest of the details that are necessary to make an actually secure system, on the other hand...

There was a programming game (of the choose-your-own-adventure kind) that taught you to build crypto. Uh, cryptopals, I think.

@AndrasDeak come again, please?

@BlackPanther crypto underpins the entirety of IT and is responsible for the safety of all our data. If anything it's "surprisingly simple" :)

I'm just saying that I wouldn't expect any of this to be simple, so it can't be "surprisingly" complicated to me.

10:42 PM

@AndrasDeak I see, bitcoin is crypto right? That must also be quite complicated.

eh

@MichaelHomer is all this you've been trying to explain to me how TLS works under the hood?

@BlackPanther It is a small portion of how TLS works under the hood

I just checked for how much a bitcoin is worth, and google says 1 Bitcoin equals
10,024.36 Pound sterling.

That's over 9000!!!

Also quite a lot about RSA in general

10:48 PM

Man I wish I could post gifs in chat.

alas...

What's RSA?

The chat system oneboxes links to some images, but I don't know exactly which

@MichaelHomer nooo :P

RSA (cryptosystem)

RSA (Rivest–Shamir–Adleman) is a public-key cryptosystem that is widely used for secure data transmission. It is also one of the oldest. The acronym RSA comes from the surnames of Ron Rivest, Adi Shamir, and Leonard Adleman, who publicly described the algorithm in 1977. An equivalent system was developed secretly, in 1973 at GCHQ (the British signals intelligence agency), by the English mathematician Clifford Cocks. That system was declassified in 1997.In a public-key cryptosystem, the encryption key is public and distinct from the decryption key, which is kept secret (private). An RSA user...

10:50 PM

All of them. But moving pictures are more often than not intrusive, so use with discretion.

Are thanks.

Let's try again.

> I just checked for how much a bitcoin is worth, and google says 1 Bitcoin equals
10,024.36 Pound sterling.
That's over 9000!!!

tenor.com/view/vegeta-its-over9000-gif-14419267

not a good start

Okay that didn't embed the gif like I thought.

Yeah, you need a proper image link, preferably with extension. Sometimes you can fool the engine by appending ?.gif or something

@AndrasDeak how come it took you so long to join Unix StackExchange?

If you don't mind me asking, of course.

10:54 PM

I'm only passing by

I only registered when I wanted to flag or comment something a while back

or maybe upvote...

I see, hope you find it welcoming so far, just like the python forums.

I'm surprised your reputation didn't carry over. Why is that?

I only interact here in chat, where half the regulars are moderators. So no problem there :P

@BlackPanther why would it? Each site has its own reputation, as it should. It's only chat.SE that adds up network rep.

Cool.

@AndrasDeak I would think a bit of someones reputation would carry over, since we are all Stack Exchange.

That bit is 100 points

I see, I knew I didn't have to start from scratch when joining a new stackexchange site.

10:58 PM

Yeah, it's the association bonus.

So everyone gets 100, even those with super high reputation.

It's really confusing when you join a new community, and ten minutes later you see a "+100" rep notification...

@BlackPanther yes. But this is probably explained in the corresponding item of /help/privileges

@AndrasDeak What's the max you can earn in a day?

There's no theoretical limit. But you can only earn 200 rep from upvotes.

@AndrasDeak StackExchange is quite gamified so I'm not sure why they didn't make the association bonus correlate with rep.

Interesting, that's not much.

11:02 PM

@BlackPanther because it's only there to push you above new user restrictions

You don't magically become a photography expert just because you have 60k rep on history.SE

Presumably it's calibrated specifically so you can't drive-by downvote off HNQ

Actually, I think I know why the association bonus is a flat rate. Some Stack exchange sites are easier to gain rep on than others, so someone from a totally unrelated field to software engineering could sign up to stack overflow, and carry over their really high rep.

They may seem like an expert due to their rep, but they're actually not.

There are multiple sites where I signed up and posted an answer specifically so I could downvote an existing post

@MichaelHomer I wish that weren't the case. That makes HNQ so diabolical.

all the "i+++++++j" C questions getting tons of upvotes all the time

@AndrasDeak Of course. But isn't the minimum rep to comment or post still higher than the 100 reps they gift you?

11:06 PM

@BlackPanther no. You need 1 rep to post and 50 to comment.

Yes, but if I turned up somewhere new ready to cast my 62,000 downvotes that would probably be disruptive

15 or so to upvote, 20 to use chat I think.

unix.stackexchange.com/help/privileges

@MichaelHomer I think you can only downvote 50 or so times a day ;)

> You can vote 30 times per UTC day. You get an additional 10 votes on questions only. (Why?)

even fewer

@MichaelHomer What is HNQ?

High ____ Questions?

@MichaelHomer exactly.

@MichaelHomer Wow thanks, I haven't seen that before. Might bookmark it.

11:09 PM

On the other hand, when I encountered wrong answers on AU, I couldn't do anything about them

Is there a separate rep system for chat?

@MichaelHomer and I didn't mean to carry on your rep. I just meant balancing upvote and downvote privileges and rep cost.

@BlackPanther no

The reputation displayed in chat is the total network sum of linked accounts

chat.SO uses SO rep, chat.SE uses network rep, chat.MSE uses MSE rep

@MichaelHomer Thanks, I was wondering why rep in chat is different.

11:11 PM

More accurately, that ↑

Most specifically, I hate that featured company posts on MSE get upvotes from MSE-inactive users but not downvotes. Biases perception of important posts a lot.

@AndrasDeak SO is treated differently to the rest. Sounds like London lol.

No, it's treated like MSE

terdon doesn't want me to talk about MSE, so I won't

I've not seen that. Do you think people game the rep system on stack exchange?

11:13 PM

But yeah, SO has always been the flagship site, and the company is thinking about cutting off non-tech sites (at least smaller ones) if they can pull it off

@MichaelHomer Okay, is terdon a mod?

MSE is perhaps a special case where network-wide downvoting privileges should probably stand

@BlackPanther come on, you can look these things up

read terdon's profile

It's weirdly off to the side where it's not an actual meta site and works differently

My bad. His name has a blue diamond, so he must be.

11:15 PM

I mean main site profile. But yeah, diamond is suspicious too.

@BlackPanther Also, you might find just reading the high-level overview of TLS from Wikipedia useful if you're interested in that sort of detail. It's not really relevant to using TLS that someone already implemented, though

But in particular the handshake description:

Transport Layer Security

Transport Layer Security (TLS), and its now-deprecated predecessor, Secure Sockets Layer (SSL), are cryptographic protocols designed to provide communications security over a computer network. Several versions of the protocols find widespread use in applications such as web browsing, email, instant messaging, and voice over IP (VoIP). Websites can use TLS to secure all communications between their servers and web browsers. The TLS protocol aims primarily to provide privacy and data integrity between two or more communicating computer applications. When secured by TLS, connections between a client...

There are 13 listed steps involved (though some are a bit minimal and some could be split up)

I feel like one could ask many academically relevant but practically useless questions ;)

Yes, though there are solid cryptography texts out there that you could refer to, and also Cryptography

There is a continuum between useless and useful and people can shift along it with different activities

@MichaelHomer Thanks, I will read that.

@MichaelHomer I want to give a very simplified summary of what I learned from you about the certificate exchange between a (localhost) server and a client. Please point out any wholes in my understanding:

The CA has a public-private key, so does the certificate. The CA's private key signs the certificates public key, and the CA's public key witnesses this signing process so that it can verify it later. The client connects to the Server, the Server's certificate is presented to the client, and the private key of the certificate is used by the CA's private key to authenticate the public key of the certificate that is paired to the certificates private key.

Hence the client accepts the Server's certificate as legitimate.

11:39 PM

"the private key of the certificate is used by the CA's private key to authenticate the public key of the certificate" no

The CA's private key is irrelevant by this point

The CA's public key can be used to verify the signature on the server's certificate

The server's private key is also not relevant so far

@MichaelHomer Okay, great. I see - from that point the CA's public key is used to verify the signature on the server's certificate.

The private key of the certificate is used to prove that the server the client is talking to is the owner of the certificate. That is a separate decision than whether the certificate is validly attested by the CA

@BlackPanther yes

11:55 PM

@MichaelHomer This answers what I was going to ask: But what is the server's (i.e. certificate's) private key used for then? I mean it's a separate entity so why give it to the server in the first place?

Yes, key pairs are always used correspondingly to each other to verify that something came from the other key/ensure only the other key can see it

@MichaelHomer If the public key of the CA verifies the signature. Then why is the private key of the certificate (i.e. the server's certificate) needed to verify the owner of the certificate, isn't this already accomplished by the CA's public key?

« first day (3670 days earlier) ← previous day next day → last day (1277 days later) »

Transcript for

Oct '2026

/dev/chat

General discussion for unix.stackexchange.com. If you have a q...

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile