02:18:10 #join #venezuela 02:37:13 https://forums.freebsd.org/threads/forum-outage.102193/ 02:41:12 Almost two months of not installing an available security patch, for both FreeBSD and linux.org... 02:53:58 I think this is an excellent moment to ask: How could community and tools support admins more to prevent scenarios like these? 02:55:29 Should there be automated updates for all internet-facing software? Maybe some split standard, so non-breaking-changes are installed automatically while breaking changes are held back for manual approval? 02:58:17 Should we (as in FLOSS) introduce community-visible labels to denote availability for routine things as well as mental workload? 03:04:41 * llua laughs in work mandated quarterly updates only 03:08:41 in my experience, it is always the trust but verify model. 04:25:58 installing FreeBSD :) 04:44:56 Hi, are there any way to get auditd from jails? 04:54:45 I see its mentioned here https://freebsdsoftware.org/blog/freebsd-jails-guide/ - but I cant seem to get any audit events from jails in the logfile of the jailhost 04:56:45 i'm not familiar, but if it's similar to other virtualization, perhaps yo9u can get it inside the jail? 05:10:01 Any news about CUDA support on FreeBSD 06:39:58 hey 06:42:39 I would like to use pkgbasify on my FreeBSD in order to use pkgbase. Unfortunately, I read that hardlink error could be present if the base system is splitted into multiples mounts and this is my case (/var/crash, /usr/ports, /usr/src, /tmp, /var/tmp, /var/mail, /var/audit) is it a problem? 06:47:48 no? 06:54:09 rtprio: ok but I don't want pkgbase crashs my system :) 06:55:52 and another question on another topic: i recently migrated from synth to poudriere. Now I upgraded my ports. Should I need to perform "poudriere jail -c -j ..." again in order to upgrade packages or is there another solution? 06:57:06 i don't know much about poudriere, but probably "do what you have been doing" 06:57:21 the system doesnt change, just how the files are accounted for 07:08:37 titou: pkgbase doesn't install anything into any of those directories. that looks like a fairly standard zfs root configuration? which is well tested with pkgbase 07:11:54 ivy: ok super thank you both four your answer 08:20:25 So unlike launchd, cron doesn’t check to see if a script is still/already running before relaunching it if the clock says its time to run, correct? If so, then whats the best way to make sure a script isn’t run twice at the same time? 08:35:54 you probably need to add that check in the script yourself, like checking for process name/etc 08:36:25 or just making and deleting an invisible .running file somewhere 08:36:27 Check out lockf(1) - might help. 08:36:39 i would probably have the script create a lockfile rather than trying to grep for process name, which is a bit fragile 08:37:00 the lockfile option could be fragile too, if the script crashes for some reason 08:37:09 GoSox: lockf - see the examples at the end of the man page 08:37:11 then it would be unable to run ever again, until i noticed 08:37:16 if your script crashes then your lockfile will stay forever and no more runs 08:37:22 le sigh 08:37:53 i guess i’d need ANOTHER script running in the background, cleaning up all of the runfiles for all of my scripts like once a day 08:38:01 GoSox: no, use lockf(1) 08:38:23 Apparently incapable of understanding that or checking. Mentioned 3 times now. 09:35:15 titou: there is always #poudriere 10:04:48 Gedge: great thank you 12:07:35 It wasn't just freebsd which got pwned interesting 12:08:05 lts: I am 99% sure both Linux and FreeBSD are using managed hosting, thus it is at fault with the company they are paying to manage the hosting for them 12:08:15 IMO there should be a move to replace the forums now 12:08:31 FreeBSD operates in Europe too afaik and wouldn't want to get bitten by the GDPR next time they get pwned 12:08:47 Its time the freebsd team takes control of the forums, and a FOSS solution is deployed. 12:08:51 i don't think that is correct, both linux.org and forums.freebsd.org admins posted that it was their own responsibility to update the software 12:09:03 ivy: you also said that its not hosted on freebsd infra 12:09:10 that is correct 12:09:21 and also the IP addresses on the freebsd infra is a completely different datacentre from the one the forums is hosted on 12:09:30 the forum is nothing to do with the freebsd project, aside from having a hostname under freebsd.org, which is probably a mistake but too difficult to change now 12:10:24 ivy: what I want to know is whether this is the freebsd taking responsibility to something which wasn't their fault, or whether they genuinely have full control over the forums and choose not to do critical security patches 12:10:41 if it is a latter, it looks extremely bad for the freebsd project 12:11:01 How can people trust in the security of an OS when their forums gets pwned... 12:11:11 the fact linux.org was also pwned somewhat takes the heat off freebsd... 12:11:32 polarian: the forums is not operated by core, the project in general, or the Foundation. it is hosted and managed by a third-party user. no freebsd.org admins have access to the forum other than as users 12:12:09 ivy: right... but because it has the freebsd branding the freebsd project's reputation is on the line 12:12:24 like I said, from a users point of view, if a project cant keep its infra secure, than why trust the OS is secure? 12:12:50 the fact it was a script kiddie is even more humilating imo 12:12:54 humiliating* 12:13:08 perhaps users are intelligent enough to not engage in such ridiculous black-and-white thinking? who knows 12:13:17 * polarian shrugs 12:13:24 I saw the backlash from the pwn 12:13:31 Linux users were rather vocal about freebsd being dogshit 12:13:36 until they realised linux.org also got pwned :) 12:14:53 ivy: also, the forums is an official community platform for the project (unlike the Discord for example), it is lucky this was an XSS attack by a script kiddie only wanting attention, and not a data breach, or distribution of malware... 12:15:40 a data breach would have likely gotten the attention of the authorities, and then you have them breathing down your neck 12:16:19 "Linux users" were vocal about that? really? what percentage of Linux users, would you say? 12:16:56 this isn't 1998, no one cares about stupid OS wars 12:17:11 also, is linux.org even connected to Linux? (i can't seem to work out who owns/runs it) 12:18:06 ivy: the ones I know :) 12:18:15 obviously I cant speak on behalf of millions maybe even a billion people 12:18:34 I am in security circles though, so they are going to be vocal about such things 12:19:15 but anyways, the fact this wasn't managed by the core team means nothing, a freebsd branded platform was pwned yesterday, something has to be done about it 12:19:33 you cant just say "oh its a third party user not our problem" 12:20:12 like imo this is yet another failure for the project to do the most basic security 12:20:18 yes its not the teams fault this time 12:20:39 there has been major xorg vulns sitting in the port tree unpatched, despite there is a team to handle that... 12:21:14 xorg is SUID binary 12:21:53 and also before someone says "do something about it then" I have, I try my best to look through the vuln disclosures and push through patches for ports which are affected. 12:22:17 idk... 12:22:37 a personality problem is more challenging than an engineer problem at times 12:22:47 I am rather pissed off that such a trivial exploit was used against one of the freebsd's platforms 12:23:02 and it seems ivy is very chilled and lax about it, which I dont see why? 12:23:32 you had a bunch of likely teenage script kiddies exploit a XSS vulnerability, which took out the forums... 12:24:04 voy4g3r2: wdym? 12:26:23 polarian: you think it is "critical" and other stakeholders think it is "not critical as a 3rd part thing" as you references above. So you are at an enpasse.. is it critical or is it not. If the person/team responsible for the maintenance of the servers, you can say all you want it is critical, but they do not think it is. So this becomes a person situation. how do you inform a stakeholder, who deso not 12:26:29 agree with assessment, that their limited time needs to be invested in resolving an issue. 12:26:57 a people problem :) 12:27:07 anyone who has concerns about how the project is run should contact core, not random developers on irc who have no influence over that 12:27:53 correct, because none of them (on irc) are associated with this resolution path. 12:30:16 a great model to evaluate against is a Risk/Reward model or even a CAPA (Corrective Action Preventive Action).. the 5 whys is a great tool. 12:32:59 ivy: lol I was just discussing it 12:33:08 but if you urge me to contact core, then maybe I will 12:33:29 you can feel free to demand to speak to the manager all you want 12:33:37 whos the security liason 12:33:51 I remember it listed somewhere 12:34:05 Allan is 12:34:15 polarian: you asked why i was "chill". i am chill because mediating the relationship between the project and the forum is nothing to do with me. i am suggesting that if you want to contact the people who actually care about this, that would be core 12:34:41 well you both seem to think its outrageous im angry about such a thing 12:34:55 it doesnt matter if you are core, or have any role in the problem 12:35:02 but FreeBSD's "branding"(tm) is, uhh, mostly to people who (1) don't pay for it and (2) understand that, sometimes, the script kiddies score a goal 12:35:03 if you care about freebsd, why wouldnt you be angry? 12:35:22 hodapp: if you get pwned by script kiddies, there is serious problems, im sorry... 12:35:35 polarian: and I wasn't pwned by script kiddies 12:35:37 how long ago was the vuln patcched? 3 months? 12:35:48 hodapp: even the post on the forums said it was script kiddies 12:35:53 and ccome fucking on 12:36:01 who else pwns a site to stick their discord accounts on it 12:36:03 polarian: because it is just a whole meme of.. forest gump movie where tom hanks was running and stepped in poo.. it happens 12:36:27 I guess nobody shares the same concerns as me then... 12:36:53 it is not there is no concern, it is the severity of it 12:36:54 literally everyone here understands that When Your Forum Gets Hacked, That's Bad 12:38:11 voy4g3r2: ***ANY*** attack which is successful is a concern 12:38:13 but the "I would like to speak to the CEO, this moldy onion indicates a supply chain problem, a societal rot, and a moral failing, and I demand an IMMEDIATE plan for how you will ensure that I never again receive MOLDY PRODUCE" tone isn't gonna get you anywhere 12:38:38 hodapp: I will simply email my concerns, im not going to be putting a complaint in against the project 12:38:46 its more a "what can we do to ensure this doesnt happen again" 12:39:08 because right now the response seems to be "oh it was only an XSS attack, nobody got harmed, all continue like usual!" 12:39:16 polarian: i would suggest taking a step back and considering what specific outcome you are expecting here. if you think something should be changed about the relationship between freebsd projet and the forums, or how the project in general handles security, being angry about it here probably isn't going to produce any useful results 12:39:16 go lecture them on their finances while you're at it, like you were doing the other day 12:40:25 right now it sounds like you expect several hundred freebsd developers to all drop what we're doing and go yell at core until some unspecified change is made which will satisfy you... but regardless of whether that's a good approach, it doesn't seem to be working, so a different approach may be in order 12:41:09 ivy: outcome, let me think 12:41:15 1. freebsd project takes the forums 12:41:21 or cuts ties with the forums and marks it a unofficial community 12:41:34 and urges people onto IRC or mailing list instead 12:41:38 again, please don't tell me. this is nothing to do with me, i have no more influence over this than you do 12:41:46 ivy: YOU JUST ASKED 12:41:49 im so fucking confused 12:41:57 no, i didn't 12:42:06 welp I shall part for a bit 12:42:08 I also don't see where ivy asked anything 12:42:18 i said *you* should consider what outcomes *you* expect, then *you* should consider the steps you take to achieve those outcomes 12:42:21 they're gone 12:42:26 oh well 12:42:58 it's the same person who was complaining the other day about how it's an *OUTRAGEOUS* waste of resources for some other project (I don't think this was even under FreeBSD's umbrella, it was some outside project making FreeBSD builds) to do a nightly build of FreeBSD 12:44:21 i mean, i can understand their concern (except for the weird bit about Linux users), i was just trying to suggest that complaining in IRC is not going to achieve much... 12:46:24 he was doing the same thing with complaining about how much money someone was wasting doing nightly builds of FreeBSD and how this is a symptom of a wider problem of open source projects being really bad with finance 12:46:54 regardless of me pointing out that it was 99% likely being done on a VPS/dedi that they pay the same price for regardless of usage 12:53:07 what's the situation guys? 12:53:33 polarian being polarian 12:53:41 demanding to speak to the manager of FreeBSD 12:53:53 okay? 12:54:09 who is that? Marshall McKusick? 12:56:11 * hodapp shrugs 12:56:27 quite odd 13:10:12 alright I sent an email to core 13:10:14 and I am calm 13:12:48 are you tho? 13:15:00 yeah :) 13:39:51 I can confirm. I've never seen polarian this calm 14:14:38 Is anyone else seeing random reboots with 14.3-RELEASE-p10 and 14.4-RELEASE-p1? I can't tell if there is panicking or not since I did not have a console on the machine. Rolling back, first to -p9, and then after upgrading to 14.4-, to the base release (not p1) indeed stopped the reboots every few hours. 14:15:05 It doesn't look like any dumps are being written; nothing shows up in /var/crash. 14:16:48 Also apparently on this particular system, booting with no monitor or keyboard connected means you get no /dev/console at all. (it's a Seeed Odyssey with a weird Intel LPSS uart that I cannot get to work at all, much less as a console) 14:40:16 for what it's worth, i'm getting occasional complete freezes on a box with igc NIC, no ping, nothing, but console works fine; a reboot fixes it. this is on 15-Rel. 15:02:37 anyone else upgraded to 14.4-RELEASE only to have nextcloud refuse to allow access to files? (this is in an iocage jail). log level 9 isn't producing anything... 15:03:08 (I can view that the files are there but neither download, upload, or modify them) 15:11:32 pkg: Failed to fetch https://pkg.FreeBSD.org/FreeBSD:16:amd64/kmods_latest_0/packagesite.pkg: Failed writing received data to disk/application 15:11:43 did someone mention a fix for this? ivy ? 15:16:30 or perhaps i just hosed my pkg.conf 15:16:37 rtprio: there isn't a version 16 of FreeBSD yet 15:21:55 rtprio: you want kmods_latest, not kmods_latest_0, probably 15:21:57 amigan: no problems here with 14.3p10 15:22:19 rtprio: this is a terrible error though, i suggest filing a PR about that 15:23:06 rtprio: (you can see the available repositories for 16 at https://pkg.freebsd.org/FreeBSD:16:amd64/, which is a good place to start for problems like this) 15:33:39 yeah, 404 would have given a ton more context 16:05:48 ivy: wait, what's the difference between latest and weekly? 16:06:14 and for 15, is quarterly a link to the latest _quarterly_[0-3] indicating quarter? 16:06:25 is this documented someplace 16:06:49 latest is LATEST, quarterly is older 16:07:01 rtprio: the repositories beginning with 'base_' are for base; latest, quarterly and kmods_* are for ports 16:07:24 that is the only part of this convention that i know 16:07:31 i'm confused by the suffixes 16:07:46 rtprio: kmods_quarterly_X is for 14.X. e.g. on 14.4, you should use kmods_quarterly_4. that's because the modules have to be built for each minor release 16:08:30 right, ok 16:08:32 rtprio: do you mean the difference between base_latest and base_weekly? base_latest is built twice a day, base_weekly is built once a week 16:09:17 yes, base_latest vs base_weekly. thanks. 16:09:28 so when 15.1 comes out, it will be $ABI/base_release_1 16:09:33 right? 16:09:35 yes 16:10:03 great, thanks 16:10:14 i think some of these names could have been chosen a little better, in hindsight, but it's difficult to change them without breaking everyone's pkg 16:10:36 like, base_latest, ports_latest, kmods_latest, or something 16:11:12 maybe for 17 16:12:26 i get why _x is for abi.x but yeah, having that explicit would align closer to the 14/14.2-RELEASE/ browsable and easily identifiable system 16:18:14 I'm running 15 on a laptop with two buttons. Anyone know where the emulation of the middle button is defined? 16:18:30 wayland or x? 16:18:47 I don't understand what it's doing; it's like it gets stuck in some state. 16:18:48 X 16:19:30 (I forgot my mouse today, so it seems like a good day to finally fix it.) 16:20:00 are you using moused? man it's been a while since i've done this in x 16:23:20 rtprio: I don't think so? It's libinput, which I think means no? 16:23:41 Me too. Probably a decade. Those memories are long gone. 16:25:15 jw, if you open up xev and press both buttons, what do you get? 16:27:37 Wait, never mind. This is one library doing its own emulation and getting it wrong. 17:48:12 hi. when switching terminals then pasting does anyone sometimes get ~01thing-being-pasted01~ instead of just thing-being-pasted ? 17:48:57 i keep having to enter 'reset' then return to get normal behaviour 17:49:29 f451: that sounds like something has enabled bracketed paste on your terminal and forgot to term it off. perhaps a text editor or something with a readline CLI? 17:49:38 s/term if off/turn it off 17:50:35 i thought it was an option in /etc/make.conf. i have it turned off there, i make my ports in poudriere 17:50:53 the /etc/make.conf is what the builder uses 17:51:07 for readline there's a ports config option for it, but anything can enabled bracketed paste if it wants, so it could be something else 17:51:19 right 17:51:49 id like to universally turn it off if possible it's really annoying 17:52:36 theres no option in x11/terminator for it (in fact theres no options at all in the port) 17:53:35 oh, is this in X? i thought you were talking about the vt console 17:53:57 yeah its in X 17:55:14 i think you may have to ask the developers of your terminal emulator, if it doesn't have a config option for that already 17:55:25 i checked in devel/readline just in case and it's off there, too 17:57:05 it's happened in other terminals i think, am 75% sure. i use terminator 99% of the time though 17:59:28 to top it all off, i use tcsh LOL 18:00:05 looking at it, seems it's a bash or zsh interaction, hmm 18:46:44 adding my 2 cents to the discussion of the forums issue. defacement is usually harmless. the thing I am a bit worried about is the linux.org admin saying they managed to obtain session tokens for the admin. I assume they didn't manage to exfiltrate data, and had very limited control over the forums. other than that, it happens. like I said, this is 18:46:45 not as big of an issue as Manjaro "forgetting" to renew their SSL certificates for the 6th year in a row. 18:47:49 if you wanna discuss this feel free to DM me, I don't think it's warranted to discuss this any further in this chat room :P 22:12:22 hello, does anyone know about chroot handling changes between 14.3-RELEASE and 14.4-RELEASE? background info: https://github.com/php/php-src/issues/21589 22:19:39 wait, you chroot directly to your php path? 22:19:54 that doesn't make any sense 22:20:23 there is a jail, and in its php-fpm.conf, I run roundcube chrooted. it worked so far 22:20:41 so in the jail, of course you would need a resolv.conf 22:20:50 the jail has it, yes 22:21:08 but roundcube only works if I put an extra etc/resolv.conf under its chroot 22:21:31 (hence why I left out the leading slash) 22:21:47 you chroot inside the jail? 22:21:52 yup 22:22:47 but why 22:23:08 and also, how would you expect it to resolv things if it doesn't have a resolv.conf, inside the chroot 22:23:28 but how did it work so far? was that an 'undocumented feature' aka bug? 22:23:58 I'm just wondering, really. I'm willing to make changes but I also want to get to the bottom of what caused it 22:24:04 well you could query what chroot changes happend to know for sure 22:24:45 not sure where to begin with that, to be honest 22:27:12 I've upgraded from 14.3-RELEASE-p9 to 14.4-RELEASE-p1, and I think that broke it 22:27:29 or fixed it, depending on how you look at it 22:29:08 i'd argue fixed 23:05:07 well by eyeballing the changes between 14.3-RELEASE-p9 to 14.4-RELEASE-p1, there are changes to chroot, but my understanding of them is murky to say the least.. I really need to talk to actual devs to get a clearer picture 23:06:36 kevans: I'm looking at your changes now, babab49eee9472f628d774996de13d13d296c8c0 in src 23:08:38 not sure if that has anything to do with it at all 23:10:33 besides, that's the command line tool, not the kernel provided functionality