#join #venezuela

Almost two months of not installing an available security patch, for both FreeBSD and linux.org...

I think this is an excellent moment to ask: How could community and tools support admins more to prevent scenarios like these?

Should there be automated updates for all internet-facing software? Maybe some split standard, so non-breaking-changes are installed automatically while breaking changes are held back for manual approval?

Should we (as in FLOSS) introduce community-visible labels to denote availability for routine things as well as mental workload?

in my experience, it is always the trust but verify model.

installing FreeBSD :)

Hi, are there any way to get auditd from jails?

I see its mentioned here freebsdsoftware.org/blog/freebsd-jails-guide - but I cant seem to get any audit events from jails in the logfile of the jailhost

i'm not familiar, but if it's similar to other virtualization, perhaps yo9u can get it inside the jail?

Any news about CUDA support on FreeBSD

hey

I would like to use pkgbasify on my FreeBSD in order to use pkgbase. Unfortunately, I read that hardlink error could be present if the base system is splitted into multiples mounts and this is my case (/var/crash, /usr/ports, /usr/src, /tmp, /var/tmp, /var/mail, /var/audit) is it a problem?

no?

rtprio: ok but I don't want pkgbase crashs my system :)

and another question on another topic: i recently migrated from synth to poudriere. Now I upgraded my ports. Should I need to perform "poudriere jail -c -j ..." again in order to upgrade packages or is there another solution?

i don't know much about poudriere, but probably "do what you have been doing"

the system doesnt change, just how the files are accounted for

titou: pkgbase doesn't install anything into any of those directories. that looks like a fairly standard zfs root configuration? which is well tested with pkgbase

ivy: ok super thank you both four your answer

So unlike launchd, cron doesn’t check to see if a script is still/already running before relaunching it if the clock says its time to run, correct? If so, then whats the best way to make sure a script isn’t run twice at the same time?

you probably need to add that check in the script yourself, like checking for process name/etc

or just making and deleting an invisible .running file somewhere

Check out lockf(1) - might help.

i would probably have the script create a lockfile rather than trying to grep for process name, which is a bit fragile

the lockfile option could be fragile too, if the script crashes for some reason

GoSox: lockf - see the examples at the end of the man page

then it would be unable to run ever again, until i noticed

if your script crashes then your lockfile will stay forever and no more runs

le sigh

i guess i’d need ANOTHER script running in the background, cleaning up all of the runfiles for all of my scripts like once a day

GoSox: no, use lockf(1)

Apparently incapable of understanding that or checking. Mentioned 3 times now.

titou: there is always #poudriere

Gedge: great thank you

It wasn't just freebsd which got pwned interesting

lts: I am 99% sure both Linux and FreeBSD are using managed hosting, thus it is at fault with the company they are paying to manage the hosting for them

IMO there should be a move to replace the forums now

FreeBSD operates in Europe too afaik and wouldn't want to get bitten by the GDPR next time they get pwned

Its time the freebsd team takes control of the forums, and a FOSS solution is deployed.

i don't think that is correct, both linux.org and forums.freebsd.org admins posted that it was their own responsibility to update the software

ivy: you also said that its not hosted on freebsd infra

that is correct

and also the IP addresses on the freebsd infra is a completely different datacentre from the one the forums is hosted on

the forum is nothing to do with the freebsd project, aside from having a hostname under freebsd.org, which is probably a mistake but too difficult to change now

ivy: what I want to know is whether this is the freebsd taking responsibility to something which wasn't their fault, or whether they genuinely have full control over the forums and choose not to do critical security patches

if it is a latter, it looks extremely bad for the freebsd project

How can people trust in the security of an OS when their forums gets pwned...

the fact linux.org was also pwned somewhat takes the heat off freebsd...

polarian: the forums is not operated by core, the project in general, or the Foundation. it is hosted and managed by a third-party user. no freebsd.org admins have access to the forum other than as users

ivy: right... but because it has the freebsd branding the freebsd project's reputation is on the line

like I said, from a users point of view, if a project cant keep its infra secure, than why trust the OS is secure?

the fact it was a script kiddie is even more humilating imo

humiliating*

perhaps users are intelligent enough to not engage in such ridiculous black-and-white thinking? who knows

I saw the backlash from the pwn

Linux users were rather vocal about freebsd being dogshit

until they realised linux.org also got pwned :)

ivy: also, the forums is an official community platform for the project (unlike the Discord for example), it is lucky this was an XSS attack by a script kiddie only wanting attention, and not a data breach, or distribution of malware...

a data breach would have likely gotten the attention of the authorities, and then you have them breathing down your neck

"Linux users" were vocal about that? really? what percentage of Linux users, would you say?

this isn't 1998, no one cares about stupid OS wars

also, is linux.org even connected to Linux? (i can't seem to work out who owns/runs it)

ivy: the ones I know :)

obviously I cant speak on behalf of millions maybe even a billion people

I am in security circles though, so they are going to be vocal about such things

but anyways, the fact this wasn't managed by the core team means nothing, a freebsd branded platform was pwned yesterday, something has to be done about it

you cant just say "oh its a third party user not our problem"

like imo this is yet another failure for the project to do the most basic security

yes its not the teams fault this time

there has been major xorg vulns sitting in the port tree unpatched, despite there is a team to handle that...

xorg is SUID binary

and also before someone says "do something about it then" I have, I try my best to look through the vuln disclosures and push through patches for ports which are affected.

idk...

a personality problem is more challenging than an engineer problem at times

I am rather pissed off that such a trivial exploit was used against one of the freebsd's platforms

and it seems ivy is very chilled and lax about it, which I dont see why?

you had a bunch of likely teenage script kiddies exploit a XSS vulnerability, which took out the forums...

voy4g3r2: wdym?

polarian: you think it is "critical" and other stakeholders think it is "not critical as a 3rd part thing" as you references above. So you are at an enpasse.. is it critical or is it not. If the person/team responsible for the maintenance of the servers, you can say all you want it is critical, but they do not think it is. So this becomes a person situation. how do you inform a stakeholder, who deso not

agree with assessment, that their limited time needs to be invested in resolving an issue.

a people problem :)

anyone who has concerns about how the project is run should contact core, not random developers on irc who have no influence over that

correct, because none of them (on irc) are associated with this resolution path.

a great model to evaluate against is a Risk/Reward model or even a CAPA (Corrective Action Preventive Action).. the 5 whys is a great tool.

ivy: lol I was just discussing it

but if you urge me to contact core, then maybe I will

you can feel free to demand to speak to the manager all you want

whos the security liason

I remember it listed somewhere

Allan is

polarian: you asked why i was "chill". i am chill because mediating the relationship between the project and the forum is nothing to do with me. i am suggesting that if you want to contact the people who actually care about this, that would be core

well you both seem to think its outrageous im angry about such a thing

it doesnt matter if you are core, or have any role in the problem

but FreeBSD's "branding"(tm) is, uhh, mostly to people who (1) don't pay for it and (2) understand that, sometimes, the script kiddies score a goal

if you care about freebsd, why wouldnt you be angry?

hodapp: if you get pwned by script kiddies, there is serious problems, im sorry...

polarian: and I wasn't pwned by script kiddies

how long ago was the vuln patcched? 3 months?

hodapp: even the post on the forums said it was script kiddies

and ccome fucking on

who else pwns a site to stick their discord accounts on it

polarian: because it is just a whole meme of.. forest gump movie where tom hanks was running and stepped in poo.. it happens

I guess nobody shares the same concerns as me then...

it is not there is no concern, it is the severity of it

literally everyone here understands that When Your Forum Gets Hacked, That's Bad

voy4g3r2: ***ANY*** attack which is successful is a concern

but the "I would like to speak to the CEO, this moldy onion indicates a supply chain problem, a societal rot, and a moral failing, and I demand an IMMEDIATE plan for how you will ensure that I never again receive MOLDY PRODUCE" tone isn't gonna get you anywhere

hodapp: I will simply email my concerns, im not going to be putting a complaint in against the project

its more a "what can we do to ensure this doesnt happen again"

because right now the response seems to be "oh it was only an XSS attack, nobody got harmed, all continue like usual!"

polarian: i would suggest taking a step back and considering what specific outcome you are expecting here. if you think something should be changed about the relationship between freebsd projet and the forums, or how the project in general handles security, being angry about it here probably isn't going to produce any useful results

go lecture them on their finances while you're at it, like you were doing the other day

right now it sounds like you expect several hundred freebsd developers to all drop what we're doing and go yell at core until some unspecified change is made which will satisfy you... but regardless of whether that's a good approach, it doesn't seem to be working, so a different approach may be in order

ivy: outcome, let me think

1. freebsd project takes the forums

or cuts ties with the forums and marks it a unofficial community

and urges people onto IRC or mailing list instead

again, please don't tell me. this is nothing to do with me, i have no more influence over this than you do

ivy: YOU JUST ASKED

im so fucking confused

no, i didn't

welp I shall part for a bit

I also don't see where ivy asked anything

i said *you* should consider what outcomes *you* expect, then *you* should consider the steps you take to achieve those outcomes

they're gone

oh well

it's the same person who was complaining the other day about how it's an *OUTRAGEOUS* waste of resources for some other project (I don't think this was even under FreeBSD's umbrella, it was some outside project making FreeBSD builds) to do a nightly build of FreeBSD

i mean, i can understand their concern (except for the weird bit about Linux users), i was just trying to suggest that complaining in IRC is not going to achieve much...

he was doing the same thing with complaining about how much money someone was wasting doing nightly builds of FreeBSD and how this is a symptom of a wider problem of open source projects being really bad with finance

regardless of me pointing out that it was 99% likely being done on a VPS/dedi that they pay the same price for regardless of usage

what's the situation guys?

polarian being polarian

demanding to speak to the manager of FreeBSD

okay?

who is that? Marshall McKusick?

quite odd

alright I sent an email to core

and I am calm

are you tho?

yeah :)

I can confirm. I've never seen polarian this calm

Is anyone else seeing random reboots with 14.3-RELEASE-p10 and 14.4-RELEASE-p1? I can't tell if there is panicking or not since I did not have a console on the machine. Rolling back, first to -p9, and then after upgrading to 14.4-, to the base release (not p1) indeed stopped the reboots every few hours.

It doesn't look like any dumps are being written; nothing shows up in /var/crash.

Also apparently on this particular system, booting with no monitor or keyboard connected means you get no /dev/console at all. (it's a Seeed Odyssey with a weird Intel LPSS uart that I cannot get to work at all, much less as a console)

for what it's worth, i'm getting occasional complete freezes on a box with igc NIC, no ping, nothing, but console works fine; a reboot fixes it. this is on 15-Rel.

anyone else upgraded to 14.4-RELEASE only to have nextcloud refuse to allow access to files? (this is in an iocage jail). log level 9 isn't producing anything...

(I can view that the files are there but neither download, upload, or modify them)

pkg: Failed to fetch pkg.FreeBSD.org/FreeBSD:16:amd64/kmods_latest_0/packagesite.pkg: Failed writing received data to disk/application

did someone mention a fix for this? ivy ?

or perhaps i just hosed my pkg.conf

rtprio: there isn't a version 16 of FreeBSD yet

rtprio: you want kmods_latest, not kmods_latest_0, probably

amigan: no problems here with 14.3p10

rtprio: this is a terrible error though, i suggest filing a PR about that

rtprio: (you can see the available repositories for 16 at pkg.freebsd.org/FreeBSD:16:amd64, which is a good place to start for problems like this)

yeah, 404 would have given a ton more context

ivy: wait, what's the difference between latest and weekly?

and for 15, is quarterly a link to the latest _quarterly_[0-3] indicating quarter?

is this documented someplace

latest is LATEST, quarterly is older

rtprio: the repositories beginning with 'base_' are for base; latest, quarterly and kmods_* are for ports

that is the only part of this convention that i know

i'm confused by the suffixes

rtprio: kmods_quarterly_X is for 14.X. e.g. on 14.4, you should use kmods_quarterly_4. that's because the modules have to be built for each minor release

right, ok

rtprio: do you mean the difference between base_latest and base_weekly? base_latest is built twice a day, base_weekly is built once a week

yes, base_latest vs base_weekly. thanks.

so when 15.1 comes out, it will be $ABI/base_release_1

right?

yes

great, thanks

i think some of these names could have been chosen a little better, in hindsight, but it's difficult to change them without breaking everyone's pkg

like, base_latest, ports_latest, kmods_latest, or something

maybe for 17

i get why _x is for abi.x but yeah, having that explicit would align closer to the 14/14.2-RELEASE/ browsable and easily identifiable system

I'm running 15 on a laptop with two buttons. Anyone know where the emulation of the middle button is defined?

wayland or x?

I don't understand what it's doing; it's like it gets stuck in some state.

X

(I forgot my mouse today, so it seems like a good day to finally fix it.)

are you using moused? man it's been a while since i've done this in x

rtprio: I don't think so? It's libinput, which I think means no?

Me too. Probably a decade. Those memories are long gone.

jw, if you open up xev and press both buttons, what do you get?

Wait, never mind. This is one library doing its own emulation and getting it wrong.

hi. when switching terminals then pasting does anyone sometimes get ~01thing-being-pasted01~ instead of just thing-being-pasted ?

i keep having to enter 'reset' then return to get normal behaviour

f451: that sounds like something has enabled bracketed paste on your terminal and forgot to term it off. perhaps a text editor or something with a readline CLI?

s/term if off/turn it off

i thought it was an option in /etc/make.conf. i have it turned off there, i make my ports in poudriere

the /etc/make.conf is what the builder uses

for readline there's a ports config option for it, but anything can enabled bracketed paste if it wants, so it could be something else

right

id like to universally turn it off if possible it's really annoying

theres no option in x11/terminator for it (in fact theres no options at all in the port)

oh, is this in X? i thought you were talking about the vt console

yeah its in X

i think you may have to ask the developers of your terminal emulator, if it doesn't have a config option for that already

i checked in devel/readline just in case and it's off there, too

it's happened in other terminals i think, am 75% sure. i use terminator 99% of the time though

to top it all off, i use tcsh LOL

looking at it, seems it's a bash or zsh interaction, hmm

adding my 2 cents to the discussion of the forums issue. defacement is usually harmless. the thing I am a bit worried about is the linux.org admin saying they managed to obtain session tokens for the admin. I assume they didn't manage to exfiltrate data, and had very limited control over the forums. other than that, it happens. like I said, this is

not as big of an issue as Manjaro "forgetting" to renew their SSL certificates for the 6th year in a row.

if you wanna discuss this feel free to DM me, I don't think it's warranted to discuss this any further in this chat room :P

hello, does anyone know about chroot handling changes between 14.3-RELEASE and 14.4-RELEASE? background info: php/php-src #21589

wait, you chroot directly to your php path?

that doesn't make any sense

there is a jail, and in its php-fpm.conf, I run roundcube chrooted. it worked so far

so in the jail, of course you would need a resolv.conf

the jail has it, yes

but roundcube only works if I put an extra etc/resolv.conf under its chroot

(hence why I left out the leading slash)

you chroot inside the jail?

yup

but why

and also, how would you expect it to resolv things if it doesn't have a resolv.conf, inside the chroot

but how did it work so far? was that an 'undocumented feature' aka bug?

I'm just wondering, really. I'm willing to make changes but I also want to get to the bottom of what caused it

well you could query what chroot changes happend to know for sure

not sure where to begin with that, to be honest

I've upgraded from 14.3-RELEASE-p9 to 14.4-RELEASE-p1, and I think that broke it

or fixed it, depending on how you look at it

i'd argue fixed

well by eyeballing the changes between 14.3-RELEASE-p9 to 14.4-RELEASE-p1, there are changes to chroot, but my understanding of them is murky to say the least.. I really need to talk to actual devs to get a clearer picture

kevans: I'm looking at your changes now, babab49eee9472f628d774996de13d13d296c8c0 in src

not sure if that has anything to do with it at all

besides, that's the command line tool, not the kernel provided functionality