« first day (4127 days earlier)      last day (202 days later) » 

10:57 AM
"Linux system service bug gives root on all major distros, exploit released" bleepingcomputer.com/news/security/…
 
See also
1
Q: What is the consequence of chmod 0755 for pkexec

davidgoI understand that one way to quickly mitigate CVE-2021-4034 is to chmod 0755 /usr/bin/pkexec (ie remove the SUID bit from it). I am unclear exactly what the real world consequence of this is. (And, looking at my Ubuntu 20.04 install this appears to happen when I updated polkit to a version witho...

 
11:25 AM
What's the package where this is patched?
I assume "wherever pkexec is" but apt search pkexec doesn't find anything.
polkit doesn't seem to help either
OK, I've got tracker.debian.org/news/1297854/… and stuff
 
11:51 AM
dlocate /usr/bin/pkexec
policykit-1: /usr/bin/pkexec
Alternatively dpkg -S.
PolicyKit is priority optional, but in practice seems to be hard to get away from.
 
@FaheemMitha I don't have dlocate
 
@AndrasDeak apt-get install dlocate
 
too many steps ;)
but thanks
 
dpkg -S will also work, but slower.
@AndrasDeak ??!!
 
@FaheemMitha yeah, that works, not even slow, thanks
@FaheemMitha I was only joking. I already found a freshly installed patch in something polkity that referenced the CVE, so I'm happy
your suggestion was completely valid and much appreciated
 
12:00 PM
Random question: does anyone have any idea how many actual successful security attacks there have been on Linux-like systems in the recent past? Or just Debian derivatives, if that makes it easier.
I don't follow any relevant forum much now. I used to read LWN regularly, but don't do that much any longer. In part because LWNs servers seem convinced I'm part of a DDOS attack or something. They keep blocking me. At least on my main broadband lines. I guess I could use my phone.
 
12:56 PM
Heh, it turns out “pwnkit” was documented in 2013, but its exploitability wasn’t investigated: ryiron.wordpress.com/2013/12/16/argv-silliness
 
1:08 PM
@AndrasDeak Have you ever tried using pexpect?
 
1:50 PM
@FaheemMitha nope
 
@AndrasDeak OK
 
2:03 PM
I was trying the first example in pexpect.readthedocs.io/en/stable/overview.html
But the attempt to connect via ftp times out. It seems ftp.openbsd.org is no longer accepting ftp connections.
Is this a security thing? Can anyone suggest an alternative?
Or I guess I could try some other site.
 
 
3 hours later…
4:56 PM
Seems to me that you could write your own "interactive" script; maybe one of those number-guessing ones, and have the Python script read the prompts and react appropriately. Or maybe just ask for your name and print it back out, to start simpler.
 
@JeffSchaller I could, but expect and pexpect have the functionality built in.
Doing it "by hand" would mean extra work.
Well, I probably could. As of this moment I would no idea how to do so.
If it was trivial, expect and pexpect would not exist.
Seeing puzzling behavior with pexpect. Debating whether to post a question on SO or directly post a bug report/issue on GitHub.
 
5:11 PM
I'm confused about your goal, then. Sounded like you were trying out the pexpect module. Is FTP'ing something from openbsd your actual goal?
 
@JeffSchaller No, I was just trying out an example script.
Which didn't work, so it also wasn't very helpful.
I'm trying to write an expect/pexpect script to do POP operations by hand. In part for debugging services, and in part to understand better how POP works.
It's sort of working, but I'm seeing some puzzling behavior. Some of which is Python-related.
Doing stuff over the network to an unknown server is always problematic, because it's not just straight programming. One is introducing all sorts of other elements.
There is some related discussion on SO, but it seems to be mostly useless. Muddled discussion by people who clearly don't understand the issues.
This used to be the norm before SE came along. If nothing else, it's greatly improved the situation.
 
My best advice (since I haven't played with python or POP in a long time) is to add as much debugging output as possible and be careful of rate-limiting from the destination if you're on a quick retry cycle.
 
@JeffSchaller Yes, rate limiting can be an issue, but I don't think it is the case here. Yet.
Not sure what debugging output to add. There isn't that much going on here. And the behavior I'm seeing isn't supposed to happen. Possibly I'm missing something.
 
I'm slightly surprised that python doesn't have a (module? package?) that does what you want already, and you're forced to script it with something like expect.
 
@JeffSchaller pexpect is a Python library. That's what I'm using. It's also what's giving me problems.
I decided not to use expect (or at any rate, to try pexpect) because I don't really want to learn Tcl.
I might be forced back to expect at some point. Hard to say. What I'm trying to do isn't at all complicated. Some of what I'm seeing are Python 2/Python 3 compatibility issues, which is something we just get to live with.
 
5:25 PM
I didn't communicate clearly; it seems that pexpect is a wrapper or replacement for expect which seems like a manual, difficult way to do POP communication. I expected there to be a Python module that would speak POP already.
like maybe poplib
 
@JeffSchaller I see. Yes, that's a good point. I didn't think of that.
I see lots of talk about IMAP, but I'm still unclear if IMAP will just do a download of emails to my local machine.
I kind of think that's not the case, but I'm not sure.
Having said that, I'd still like to know what I'm doing wrong with pexpect.
 
@JeffSchaller If you mean, am I printing the child object, I haven't done that yet, no. I'll give that a try, because currently I don't have better ideas.
Tried it. Nothing obviously stands out as useful, but I'll leave it there anyway.
 
5:54 PM
I think part of my confusion is when a call to read is required.
In some cases, the server responds, and the response is printed without any further action at the client end. But in another case, it seems a read is required.
Maybe this is based on some assumed knowledge about how the process works.
 
@FaheemMitha I think it's normally the other way around: POP3 downloads your emails, IMAP keeps them on the server. I think you can configure them differently but I've been using only IMAP for more than a decade for this reason and it seems to work (i.e. keep emails on the server)
 
@AndrasDeak Does IMAP download them and also leaves them on the server?
 
It leaves them on the server. No idea about local caching.
 
@AndrasDeak So you read them locally, but they aren't actually downloaded to disk? Or possibly only temporarily for the purpose of reading?
 
My vague hunch is that it downloads a header that shows you that you got new email, and it only downloads it when you open it. But this is a very very vague and completely uneducated hunch.
 
6:01 PM
@AndrasDeak Sounds reasonable. A JIT approach.
 
@FaheemMitha well it can't not download it locally if it shows up in my email reader (even if thunderbird is mostly a webapp these days, I think). Question is how many emails are retained and for how long. I'm always connected so I never had to know. Hence I do not know.
 
Anyway, I definitely want my email downloaded, and removed from the server.
I've done it that way for many years.
 
sounds like what POP3 usually does
 
I'd be open to using IMAP, if it did that.
@AndrasDeak Yes, that's POP's normal mode of operation.
 
I assume one could google it and find a very clear answer very quick
but I have time, we can keep musing without exact foundations ;)
 
6:03 PM
@AndrasDeak About IMAP. I haven't, but perhaps I was looking in the wrong places.
I could try again, I suppose.
 
For what it's worth this is my thunderbird settings for an IMAP account.
 
Checking again, I'm seeing in multiple places that IMAP doesn't download messages. But I can't be completely sure how accurate this is.
@AndrasDeak Oh.
 
It doesn't suggest that it could be configured in a way that removes email from the server. Other accounts online suggest that IMAP fundamentally synchronises between a server and (potentially multiple) local clients.
So I would guess that IMAP would indeed not work for you.
 
@AndrasDeak Yes, that's my impression too.
 
 
2 hours later…
8:24 PM
So glad the fed's interest rate announcement was clear and concise trollface.jpg
 
 
1 hour later…
9:28 PM
I was looking for potential CDN issue reports on hackernews, but instead I found A Minimum Viable Computer, or Linux for $15
($15 if you can afford to build 10000 of it)
 
> Can it run a GUI? Also no
sold!
 
I'm still trying to figure out why the first piece would cost $10k
 
heh "The first one costs ten grand, the ten thousandth one costs fifteen bucks."
I'm guessing it's a minimum order of one of the components (F1C100?) I can't read enough of allwinnertech.com/index.php?c=product&a=index&id=73 to tell.
 

« first day (4127 days earlier)      last day (202 days later) »