Here s my (ninth) monthly update about the activities I ve done in the F/L/OSS world.
Debian
This was my 16th month of contributing to Debian.
I became a DM in late March last year and a DD last Christmas! \o/
This month was a little intense. I did a lot of different kinds of things in Debian this month. Whilst most of my time went on doing security stuff, I also sponsored a bunch of packages.
Here are the following things I did this month:
Uploads and bug fixes:
rails (2:5.2.4.3+dfsg-1) - fix a bunch of CVEs in Sid and Bullseye.
Sponsored ruby-ast for Abraham, libexif for Hugh, djangorestframework-gis and karlseguin-ccache for Nilesh, and twig-extensions, twig-i18n-extension, and mariadb-mysql-kbs for William.
GSoC Phase 1, Part 2!
Last month, I got selected as a Google Summer of Code student for Debian again! \o/
I am working on the Upstream-Downstream Cooperation in Ruby project.
The first half of the first month is blogged here, titled, GSoC Phase 1.
Also, I log daily updates at gsocwithutkarsh2102.tk.
Whilst the daily updates are available at the above site^, I ll breakdown the important parts of the later half of the first month here:
Spread the word/usage about this tool/library via adding them in the official RuboCop docs.
We had our third weekly meeting where we discussed the next steps and the things that are supposed to be done for the next set of cops.
Wrote more tests so as to cover different aspects of the GemspecGit cop.
Opened PR #4 for the next Cop, RequireRelativeToLib.
Introduced rubocop-packaging to the outer world and requested other upstream projects to use it! It is being used by 6 other projects already
Had our fourth weekly meeting where we pair-programmed (and I sucked :P) and figured out a way to make the second cop work.
Found a bug, reported at issue #5 and raised PR #6 to fix it.
And finally, people loved the library/tool (and it s outcome):
(for those who don t know, @bbatsov is the author of RuboCop, @lienvdsteen is an amazing fullstack engineer at GitLab, and @pboling is the author of some awesome Ruby tools and libraries!)
Continuation of GSoC for other Ruby related stuff!
Whilst I have already mentioned it multiple times but it s still not enough to stress how amazing Antonio Terceiro and David Rodr guez are!
They re more than just mentors to me!
Well, only they know how much I trouble them with different things, which are not only related to my GSoC project but also extends to the projects they maintain! :P
David maintains rubygems and bundler and Antonio maintains debci.
So on days when I decide to hack on rubygems or debci, only I know how kind and nice David and Anotonio are to me!
They very patiently walk me through with whatever I am stuck on, no matter what and no matter when.
Thus, with them around, I contributed to these two projects and more, with regards to working on rubocop-packaging.
Following are a few things that I raised:
Debian LTS
Debian Long Term Support (LTS) is a project to extend the lifetime of all Debian stable releases
to (at least) 5 years. Debian LTS is not handled by the Debian security team, but by a separate group
of volunteers and companies interested in making it a success.
This was my ninth month as a Debian LTS paid contributor. I was assigned 30.00 hours and worked on
the following things:
Uploaded a fix for CVE-2020-11082, for ruby-kaminari.
This upload was for Sid and Bullseye and this CVE was fixed in version 1.0.1-6.
Uploaded a fix for CVE-2020-10663, for ruby-json, ruby2.1, and ruby2.5.
These uploads were for Stretch and Buster and were fixed in the version 2.3.3-1+deb9u8, 2.1.0+dfsg-2+deb10u1, 2.3.3-1+deb9u8, and 2.5.5-3+deb10u2.
Other(s)
Sometimes it gets hard to categorize work/things into a particular category.
That s why I am writing all of those things inside this category.
This includes two sub-categories and they are as follows.
Personal:
This month I did the following things:
Wrote and published v0.1.0 of rubocop-packaging on RubyGems!
It s open-sourced and the repository is here.
Bug reports and pull requests are welcomed!
Integrated a tiny (yet a powerful) hack to align images in markdown for my blog.
Commit here.
Here is my monthly update covering what I have been doing in the free software world during June 2020 (previous month):
Opened two pull requests against the Ghostwriter distraction-free Markdown editor to:
Persist whether "focus mode" is enabled across between sessions. (#522)
Correct the ordering of the MarkdownAST::toString() debugging output. (#520)
Will McGugan's "Rich" is a Python library to output formatted text, tables, syntax etc. to the terminal. I filed a pull request in order to allow for easy enabling and disabling of displaying the file path in Rich's logging handler. (#115)
As part of my duties of being on the board of directors of the Open Source Initiative and Software in the Public Interest I attended their respective monthly meetings and participated in various licensing and other discussions occurring on the internet, as well as the usual internal discussions regarding logistics and policy etc.
Filed a pull request against the PyQtGraph Scientific Graphics and graphical user interface library to make the documentation build reproducibly. (#1265)
Reviewed and merged a large number of changes by Pavel Dolecek to my Strava Enhancement Suite, a Chrome extension to improve the user experience on the Strava athletic tracker.
For Lintian, the static analysis tool for Debian packages:
Don't emit breakout-link for architecture-independent .jar files under /usr/lib. (#963939)
Correct a reference to override_dh_ in the long description of the excessive-debhelper-overrides tag. [...]
Update data/fields/perl-provides for Perl 5.030003. [...]
Check for execute_after and execute_before spelling mistakes just like override_*. [...]
Reproducible Builds
One of the original promises of open source software is that distributed peer review and transparency of process results in enhanced end-user security. However, whilst anyone may inspect the source code of free and open source software for malicious flaws, almost all software today is distributed as pre-compiled binaries. This allows nefarious third-parties to compromise systems by injecting malicious code into ostensibly secure software during the various compilation and distribution processes.
The motivation behind the Reproducible Builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised.
The project is proud to be a member project of the Software Freedom Conservancy. Conservancy acts as a corporate umbrella allowing projects to operate as non-profit initiatives without managing their own corporate structure. If you like the work of the Conservancy or the Reproducible Builds project, please consider becoming an official supporter.
This month, I:
Filed a pull request against the PyQtGraph to make the documentation build reproducibly. (#1265)
Addressed a regression in the octave-queueing package in the handling of absolute paths in Texinfo files. (#962187)
Submitted the following patches to fix reproducibility-related toolchain issues within Debian:
critcl: Please make the teapot.txt files reproducible. (#963600)
sasmodels: Regression in debian/patches/reproducible-c-models.patch. (#962050)
Contributed to a discussion regarding improving the reproducibility of packages that use the CMake build system. [...]
Added to a conversation regarding the nondeterministic execution of order of Debian maintainer scripts that results in the arbitrary allocation of UNIX group IDs referencing the Tails operating system. [...]
Replace obscure references to "WF" with "Wagner-Fischer" for clarity. [...]
Use a semantic AbstractMissingType type instead of remembering to check for both types of "missing" files. [...]
Add a comment regarding potential security issue in the .changes, .dsc and .buildinfo comparators. [...]
Drop a large number of unused imports. [...][...][...][...][...]
Make many code sections more Pythonic. [...][...][...][...]
Prevent some variable aliasing issues. [...][...][...]
Use some tactical f-strings to tidy up code [...][...] and remove explicit u"unicode" strings [...].
Refactor a large number of routines for clarity. [...][...][...][...]
trydiffoscope is the web-based version of diffoscope. This month, I specified a location for the celerybeat scheduler to ensure that the clean/tidy tasks are actually called which had caused an accidental resource exhaustion. (#12)
Frontdesk duties, including responding to user/developer questions, reviewing others' packages, participating in mailing list discussions as well as attending our contributor meeting.
Issued DLA 2233-1 to fix two issues in the Django web development framework in order to fix a potential data leakage via malformed memcached keys (CVE-2020-13254) and to prevent a cross-site scripting attack in the Django administration system (CVE-2020-13596). This was followed by DLA 2233-2 to address a regression as well as uploads to Debian stretch (1.10.7-2+deb9u9) and buster (1.11.29-1~deb10u1). (More info)
Issued DLA 2239-1 for a security module for using the TACACS+ authentication service to prevent an issue where shared secrets such as private server keys were being added in plaintext to various logs.
Issued DLA 2244-1 to address an escaping issue in PHPMailer, an email generation utility class for the PHP programming language.
Issued DLA 2252-1 for the ngircd IRC server as it was discovered that there was an out-of-bounds access vulnerability in the server-to-server protocol.
Issued DLA 2253-1 to resolve a vulnerability in the Lynis a security auditing tool because a shared secret could be obtained by simple observation of the process list when a data upload is being performed.
You can find out more about the project via the following video:
Uploads
People love to tell you that they "don't watch sports" but the story of Lance Armstrong provides a fascinating lens through which to observe our culture at large.
For example, even granting all that he did and all the context in which he did it, why do sports cheats act like a lightning rod for such an instinctive hatred? After all, the sheer level of distaste directed at people such as Lance eludes countless other criminals in our society, many of whom have taken a lot more with far fewer scruples. The question is not one of logic or rationality, but of proportionality.
In some ways it should be unsurprising. In all areas of life, we instinctively prefer binary judgements to moral ambiguities and the sports cheat is a clich of moral bankruptcy cheating at something so seemingly trivial as a sport actually makes it more, not less, offensive to us. But we then find ourselves strangely enthralled by them, drawn together in admiration of their outlaw-like tenacity, placing them strangely close to criminal folk heroes. Clearly, sport is not as unimportant as we like to claim it is. In Lance's case in particular though, there is undeniably a Shakespearean quality to the story and we are forced to let go of our strict ideas of right and wrong and appreciate all the nuance.
There is a lot of this nuance in Marina Zenovich's new documentary. In fact, there's a lot of everything. At just under four hours, ESPN's Lance combines the duration of a Tour de France stage with the depth of the peloton an endurance event compared to the bite-sized hagiography of Michael Jordan's The Last Dance.
Even for those who follow Armstrong's story like a mini-sport in itself, Lance reveals new sides to this man for all seasons. For me, not only was this captured in his clumsy approximations at being a father figure but also in him being asked something I had not read in countless tell-all books: did his earlier experiments in drug-taking contribute to his cancer?
But even in 2020 there are questions that remain unanswered. By needlessly returning to the sport in 2009, did Lance subconsciously want to get caught? Why does he not admit he confessed to Betsy Andreu back in 1999 but will happily apologise to her today for slurring her publicly on this very point? And why does he remain so vindictive towards former-teammate Floyd Landis? In all of Armstrong's evasions and masterful control of the narrative, there is the gnawing feeling that we don't even know what questions we should be even asking. As ever, the questions are more interesting than the answers.
Lance also reminded me of how professional cycling's obsession with national identity. Although I was intuitively aware of it to some degree, I had not fully grasped how much this kind of stereotyping runs through the veins of the sport itself, just like the drugs themselves. Journalist Daniel Friebe first offers us the portrait of:
Spaniards tend to be modest, very humble. Very unpretentious. And the Italians are loud, vain and outrageous showmen.
Former directeur sportif Johan Bruyneel then asserts that "Belgians are hard workers... they are ambitious to a certain point, but not overly ambitious", and cyclist J rg Jaksche concludes with:
The Germans are very organised and very structured. And then the French, now I have to be very careful because I am German, but the French are slightly superior.
This kind of lazy caricature is nothing new, especially for those brought up on a solid diet of Tintin and Asterix, but although all these examples are seemingly harmless, why does the underlying idea of ascribing moral, social or political significance to genetic lineage remain so durable in today's age of anti-racism? To be sure, culture is not quite the same thing as race, but being judged by the character of one's ancestors rather than the actions of an individual is, at its core, one of the many conflations at the heart of racism. There is certainly a large amount of cognitive dissonance at work, especially when Friebe elaborates:
East German athletes were like incredible robotic figures, fallen off a production line somewhere behind the Iron Curtain...
... but then bermensch Jan Ullrich is immediately described as "emotional" and "struggled to live the life of a professional cyclist 365 days a year". We see the habit to stereotype is so ingrained that even in the face of this obvious contradiction, Friebe unironically excuses Ullrich's failure to live up his German roots due to him actually being "Mediterranean".
I mention all this as I am known within my circles for remarking on these national characters, even collecting stereotypical examples of Italians 'being Italian' and the French 'being French' at times. Contrary to evidence, I don't believe in this kind of innate quality but what I do suspect is that people generally behave how they think they ought to behave, perhaps out of sheer imitation or the simple pleasure of conformity. As the novelist Will Self put it:
It's quite a complicated collective imposture, people pretending to be British and people pretending to be French, and then they get really angry with each other over what they're pretending to be.
The really remarkable thing about this tendency is that even if we consciously notice it there is no seemingly no escape even I could not smirk when I considered that a brash Texan winning the Tour de France actually combines two of America's cherished obsessions: winning... and annoying the French.
Italianization (Italian: Italianizzazione; Croatian: talijanizacija; Slovene: poitaljan evanje; German: Italianisierung; Greek: ) is the spread of Italian culture and language, either by integration or assimilation.[1][2]
In 1919, at the time of its annexation, the middle part of the County of Tyrol which is today called South Tyrol (in Italian Alto Adige) was inhabited by almost 90% German speakers.[1] Under the 1939 South Tyrol Option Agreement, Adolf Hitler and Benito Mussolini determined the status of the German and Ladin (Rhaeto-Romanic) ethnic groups living in the region. They could emigrate to Germany, or stay in Italy and accept their complete Italianization. As a consequence of this, the society of South Tyrol was deeply riven. Those who wanted to stay, the so-called Dableiber, were condemned as traitors while those who left (Optanten) were defamed as Nazis. Because of the outbreak of World War II, this agreement was never fully implemented. Illegal Katakombenschulen ("Catacomb schools") were set up to teach children the German language.
The Prontuario dei nomi locali dell'Alto Adige (Italian for Reference Work of Place Names of Alto Adige) is a list of Italianized toponyms for mostly German place names in South Tyrol (Alto Adige in Italian) which was published in 1916 by the Royal Italian Geographic Society (Reale Societ Geografica Italiana). The list was called the Prontuario in short and later formed an important part of the Italianization campaign initiated by the fascist regime, as it became the basis for the official place and district names in the Italian-annexed southern part of the County of Tyrol.
Ettore Tolomei (16 August 1865, in Rovereto 25 May 1952, in Rome) was an Italian nationalist and fascist. He was designated a Member of the Italian Senate in 1923, and ennobled as Conte della Vetta in 1937.
The South Tyrol Option Agreement (German: Option in S dtirol; Italian: Opzioni in Alto Adige) was an agreement in effect between 1939 and 1943, when the native German speaking people in South Tyrol and three communes in the province of Belluno were given the option of either emigrating to neighboring Nazi Germany (of which Austria was a part after the 1938 Anschluss) or remaining in Fascist Italy and being forcibly integrated into the mainstream Italian culture, losing their language and cultural heritage. Over 80% opted to move to Germany.
LWN published today yet another great piece of writing, Loaded terms
in free software. I am sorry, the
content will not be immediately available to anybody following at
home, as LWN is based on a subscription model But a week from now,
the article will be open for anybody to read. Or you can ask me (you
most likely can find my contact addresses, as they are basically
everywhere) for a subscriber link, I will happily provide it.
In consonance with the current mood that started with the killing of
George Floyd
and sparked worldwide revolts against police brutality, racism (mostly
related to police and law enforcement forces, but social as well) and
the like, the debate that already started some months ago in technical
communities has re-sparked:
We have many terms that come with long histories attached to them, and
we are usually oblivious to their obvious meaning. We? Yes, we, the
main users and creators of technology. I never felt using master and
slave to refer to different points of a protocol, bus, clock or
whatever (do refer to the Wikipedia article for a fuller
explanation)
had any negative connotations but then again, those terms have never
tainted my personal family. That is, I understand I speak from a
position of privilege.
A similar although less heated issue goes around the blacklist and
whitelist terms, or other uses that use white to refer to good,
law-abiding citizens, and black to refer to somewhat antisocial uses
(i.e. the white hat and black hat hackers).
For several years, this debate has been sparking and dying off. Some
important changes have been made Particularly, in 2017 the Internet
Software Consortium started recommending Primary and
Secondary,
Python dropped master/slave pairs after a quite thorough and deep
review throughout 2018, GitHub
changed the default branch from master to main earlier this
week. The
Internet Engineering Task Force has a draft (that lapsed and thus
sadly didn t become an RFC, but still, is archived), Terminology,
Power and Oppressive
Language
that lists suggested alternatives:
There are also many other relationships that can be used as
metaphors, Eglash s research calls into question the accuracy of the
master-slave metaphor. Fortunately, there are ample alternatives for
the master-slave relationship. Several options are suggested here
and should be chosen based on the pairing that is most clear in
context:
Primary-secondary
Leader-follower
Active-standby
Primary-replica
Writer-reader
Coordinator-worker
Parent-helper
I ll add that I think we Spanish-speakers are not fully aware of the
issue s importance, because the most common translation I have seen
for master/slave is maestro/esclavo: Maestro is the word for
teacher (although we do keep our slaves in place). But think
whether it sounds any worse if you refer to device pairs, or members
of a database high-availability cluster, or whatever as Amo and
Esclavo. It does sound much worse
I cannot add much of value to this debate. I am just happy issues like
this are being recognized and dealt with. If the topic interests you,
do refer to the LWN article! Some excrepts:
I consider the following to be the core of Jonathan Corbet s writeup:
Recent events, though, have made it clear even to those of us who
were happy to not question this view that the story of slavery and
the wider racist systems around it is not yet finished. There are
many people who are still living in the middle of it, and it is not
a nice place to be. We are not so enlightened as we like to think we
are.
If there is no other lesson from the events of the last few weeks,
we should certainly take to heart the point that we need to be
listening to the people who have been saying, for many years, that
they are still suffering. If there are people who are telling us
that terms like slave or blacklist are a hurtful reminder of the
inequities that persist in our society, we need to accept that as
the truth and act upon it. Etymological discussions on what, say,
master really means may be interesting, but they miss the point
and are irrelevant to this discussion.
Part of a comment by user yokem_55:
Often, it seems to me that the replacement words are much more
descriptive and precise than the old language. Allowlist is far
more obviously a list of explicitly authorized entities than
whitelist . Mainline has a more obvious meaning of a core stream
of development than master .
The benefit of moving past this language is more than just changing
cultural norms, it s better, more precise communication across the
board.
Another spot-on comment, by user alan:
From my perspective as a Black American male, I think that it s nice
to see people willing to see and address racism in various
spheres. I am concerned that some of these steps will be more
performative than substantial. Terminology changes in software so as
to be more welcoming is a nice thing. Ensuring that oppressed
minorities have access to the tools and resources to help reduce
inequity and ensuring equal protection under the laws is
better. We ll get there one day I m sure. The current ask is much
simpler, its just to stop randomly killing and terrorizing
us. Please and thank you.
So Maybe the protests of this year caught special notoriety because
the society is reacting after (or during, for many of us) the
lockdown. In any case, I hope for their success in changing the
planet s culture of oppression.
Comments
Tomas Janousek 2020-06-19 10:04:32 +0200
In the blog post On masters and slaves, whitelists and blacklists
you claim that GitHub changed the default branch from master to main
earlier this week but I don t think that change is in effect
yet. When you create a repo, the default branch is still named
master .
Gunnar Wolf 2020-06-19 11:52:30 -0500
Umh, seems you are right. Well, what can I say? I m reporting only
what I have been able to find / read
Now, given that said master branch does not carry any Git-specific
meaning and is just a commonly used configuration I hope people
start picking it up.
No, I have not renamed master branches in any of my repos but
intend to do so soonish.
Tomas Janousek 2020-06-19 20:01:52 +0200
Yeah, don t worry. I just find it sad that so much inaccurate news is
spreading from a single CEO tweet, and I wanted to help stop that. I m
sure some change will happen eventually, but until it does, we
shouldn t speak about it in the past tense. :-)
Paul-F lix Armand-Delille (3 July 1874 in Fourchambault, Ni vre 4 September 1963) was a physician, bacteriologist, professor, and member of the French Academy of Medicine who accidentally brought about the collapse of rabbit populations throughout much of Europe and beyond in the 1950s by infecting them with myxomatosis.
Charles Franklin Kettering (August 29, 1876 November 25, 1958) sometimes known as Charles "Boss" Kettering[1] was an American inventor, engineer, businessman, and the holder of 186 patents.[2] He was a founder of Delco, and was head of research at General Motors from 1920 to 1947. Among his most widely used automotive developments were the electrical starting motor[3] and leaded gasoline.[4][5] In association with the DuPont Chemical Company, he was also responsible for the invention of Freon refrigerant for refrigeration and air conditioning systems. At DuPont he also was responsible for the development of Duco lacquers and enamels, the first practical colored paints for mass-produced automobiles. While working with the Dayton-Wright Company he developed the "Bug" aerial torpedo, considered the world's first aerial missile.[6] He led the advancement of practical, lightweight two-stroke diesel engines, revolutionizing the locomotive and heavy equipment industries. In 1927, he founded the Kettering Foundation, a non-partisan research foundation. He was featured on the cover of Time magazine on January 9, 1933.
John Charles Cutler (June 29, 1915 February 8, 2003) was a senior surgeon, and the acting chief of the venereal disease program in the United States Public Health Service. After his death, his involvement in several controversial and unethical medical studies of syphilis was revealed, including the Guatemala and the Tuskegee syphilis experiments.
Ivy Ledbetter Lee (July 16, 1877 November 9, 1934) was an American publicity expert and a founder of modern public relations. Lee is best known for his public relations work with the Rockefeller family. His first major client was the Pennsylvania Railroad, followed by numerous major railroads such as the New York Central, the Baltimore and Ohio, and the Harriman lines such as the Union Pacific. He established the Association of Railroad Executives, which included providing public relations services to the industry. Lee advised major industrial corporations, including steel, automobile, tobacco, meat packing, and rubber, as well as public utilities, banks, and even foreign governments. Lee pioneered the use of internal magazines to maintain employee morale, as well as management newsletters, stockholder reports, and news releases to the media. He did a great deal of pro bono work, which he knew was important to his own public image, and during World War I, he became the publicity director for the American Red Cross.[1]
Here is my monthly update covering what I have been doing in the free software world during May 2020 (previous month):
Opened a pull request against the kitty shell to set a default socket timeout when retrieving remote items via the icat command-line tool. (#659)
Opened a pull request to make the documentation for the Wand Python/ImageMagick graphics library to build in reproducible manner. [...]
Fixed an issue in my tickle-me-email library that implements Gettings Things Done (GTD)-like behaviours in IMAP inboxes to prevent a traceback when adding text attachments that were not valid UTF-8. ...]
The Open Source Initiative held their twice-annual multi-day 'face-to-face' board meeting this time held virtually and participated in the accompanying conversations on strategy, tactical and governance issues, as well as the usual discussions regarding licensing and policy (minutes pending). I also attended the regular monthly meeting for Software in the Public Interest (minutes).
For my django-slack library (which provides a convenient library between projects using the Django and the Slack chat platform) I reviewed and merged a pull request from Cleiton de Lima to fix an issue due to the force_text method was deprecated favour of force_str. [...]
Replace Copyright (C) with the Unicode copyright symbol for consistency [...] and update my copyright years [...].
Factor out matching Homepage fields to data/fields/bad-homepages. [...]
Various alterations for the continuous integration pipeline. [...][...]
Reproducible builds
One of the original promises of open source software is that distributed peer review and transparency of process results in enhanced end-user security. However, whilst anyone may inspect the source code of free and open source software for malicious flaws, almost all software today is distributed as pre-compiled binaries. This allows nefarious third-parties to compromise systems by injecting malicious code into ostensibly secure software during the various compilation and distribution processes.
The motivation behind the Reproducible Builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised.
The initiative is proud to be a member project of the Software Freedom Conservancy, a not-for-profit 501(c)(3) charity focused on ethical technology and user freedom.
Conservancy acts as a corporate umbrella allowing projects to operate as non-profit initiatives without managing their own corporate structure. If you like the work of the Conservancy or the Reproducible Builds project, please consider becoming an official supporter.
Opened a pull request to make the documentation for the Wand Python/ImageMagick graphics library to build in reproducible manner. [...]
Categorised a large number of packages and issues in the Reproducible Builds "notes" repository.
In disorderfs, our FUSE-based filesystem that deliberately introduces non-determinism into directory system calls in order to flush out reproducibility issues, I replaced the term "dirents" in place of "directory entries" in human-readable output/log messages [...] and used the astyle source code formatter with the default settings to the main disorderfs.cpp file [...].
Elsewhere in our tooling, I made the following changes to diffoscope, our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues, including preparing and uploading versions 142, 143, 144, 145 and 146 to Debian:
Comparison improvements:
Improve fuzzy matching of JSON files as file now supports recognising JSON data. (#106)
Refactor .changes and .buildinfo handling to show all details (including the GnuPG header and footer components) even when referenced files are not present. (#122)
Use our BuildinfoFile comparator (etc.) regardless of whether the associated files (such as the orig.tar.gz and the .deb) are present. [...]
Include GnuPG signature data when comparing .buildinfo, .changes, etc. [...]
Add support for printing Android APK signatures via apksigner(1). (#121)
Identify "iOS App Zip archive data" as .zip files. (#116)
Don't print a traceback if we pass a single, missing argument to diffoscope (eg. a JSON diff to re-load). [...]
Correct differences typo in the ApkFile handler. (#127)
Output improvements:
Never emit the same id="foo" anchor reference twice in the HTML output, otherwise identically-named parts will not be able to linked to via a #foo anchor. (#120)
Never emit an empty "id" anchor either; it is not possible to link to #. [...]
Don't pretty-print the output when using the --json presenter; it will usually be too complicated to be readable by the human anyway. [...]
Use the SHA256 over MD5 hash when generating page names for the HTML directory-style presenter. (#124)
Reporting improvements:
Clarify the message when we truncate the number of lines to standard error [...] and reduce the number of maximum lines printed to 25 as usually the error is obvious by then [...].
Print the amount of free space that we have available in our temporary directory as a debugging message. [...]
Clarify Command [ ] failed with exit code messages to remove duplicate exited with exit but also to note that diffoscope is interpreting this as an error. [...]
Don't leak the full path of the temporary directory in Command [ ] exited with 1 messages. (#126)
Clarify the warning message when we cannot import the debian Python module. [...]
Don't repeat stderr from if both commands emit the same output. [...]
Clarify that an external command emits for both files, otherwise it can look like we are repeating itself when, in reality, it is being run twice. [...]
Testsuite improvements:
Prevent apksigner test failures due to lack of binfmt_misc, eg. on Salsa CI and elsewhere. [...]
Install/remove the build-essential during build so we can install the recommended packages from Git. [...]
Codebase improvements:
Bump the officially required version of Python from 3.5 to 3.6. (#117)
Drop the (default) shell=False keyword argument to subprocess.Popen so that the potentially-unsafe shell=True is more obvious. [...]
Perform string normalisation in Black [...] and include the Black output in the assertion failure too [...].
Inline MissingFile's special handling of deb822 to prevent leaking through abstract layers. [...][...]
Allow a bare try/except block when cleaning up temporary files with respect to the flake8 quality assurance tool. [...]
Rename in_dsc_path to dsc_in_same_dir to clarify the use of this variable. [...]
Abstract out the duplicated parts of the debian_fallback class [...] and add descriptions for the file types. [...]
Various commenting and internal documentation improvements. [...][...]
Rename the Openssl command class to OpenSSLPKCS7 to accommodate other command names with this prefix. [...]
Misc:
Rename the --debugger command-line argument to --pdb. [...]
Normalise filesystem stat(2) "birth times" (ie. st_birthtime) in the same way we do with the stat(1) command's Access: and Change: times to fix a nondeterministic build failure in GNU Guix. (#74)
Ignore case when ordering our file format descriptions. [...]
Drop, add and tidy various module imports. [...][...][...][...]
Investigated and triaged freerdp, keystone, nginx, tcpreplay & thunderbird, as well as tended to the general upkeep of the dla-needed.txt and ela-needed.txt files, adding various notes, references, attributions and citations.
Frontdesk duties including responding to user/developer questions, reviewing others' packages, participating in mailing list discussions as well as attending our second regular IRC contributor meeting.
Issued DLA 2201-1 to prevent a Denial of Service (DoS) vulnerability the ntp network time protocol server/client. ntp allowed an "off-path" attacker to block unauthenticated synchronisation via a server mode packet with a spoofed source IP address because transmissions were rescheduled even if a packet lacked a valid "origin timestamp".
Issued DLA 2203-1 for the SQLite database to prevent a denial of service attack. In the event of a semantic error in an aggregate query, SQLite did not return early from the resetAccumulator() function which would lead to a crash via a segmentation fault.
Issued DLA 2204-1 for the Mailman mailing list manager to prevent an arbitrary content injection attack.
Review: The Ten Thousand Doors of January, by Alix E. Harrow
Publisher:
Redhook
Copyright:
September 2019
ISBN:
0-316-42198-7
Format:
Kindle
Pages:
373
In 1901, at the age of seven, January found a Door. It was barely more
than a frame in a ruined house in a field in Kentucky, but she wrote a
story about opening it, and then did.
Once there was a brave and temeraryous (sp?) girl who found a Door.
It was a magic Door that's why it has a capital D. She opened the
Door.
The Door led to a bluff over the sea and above a city, a place very far
from Kentucky, and she almost stayed, but she came back through the Door
when her guardian, Mr. Locke, called. The adventure cost her a diary,
several lectures, days of being locked in her room, and the remnants of
her strained relationship with her father. When she went back, the frame
of the Door was burned to the ground.
That was the end of Doors for January for some time, and the continuation
of a difficult childhood. She was cared for by her father's employer as a
sort of exotic pet, dutifully attempting to obey, grateful for Mr. Locke's
protection, and convinced that he was occasionally sneaking her presents
through a box in the Pharaoh Room out of some hidden kindness. Her father
appeared rarely, said little, and refused to take her with him. Three
things helped: the grocery boy who smuggled her stories, an intimidating
black woman sent by her father to replace her nurse, and her dog.
Once upon a time there was a good girl who met a bad dog, and they
became the very best of friends. She and her dog were inseparable
from that day forward.
I will give you a minor spoiler that I would have preferred to have had,
since it would have saved me some unwarranted worry and some mental
yelling at the author: The above story strains but holds.
January's adventure truly starts the day before her seventeenth birthday,
when she finds a book titled The Ten Thousand Doors in the box in
the Pharaoh Room.
As you may have guessed from the title, The Ten Thousand Doors of
January is a portal fantasy, but it's the sort of portal fantasy that is
more concerned with the portal itself than the world on the other side of
it. (Hello to all of you out there who, like me, have vivid memories of
the Wood between the Worlds.) It's a book about traveling and
restlessness and the possibility of escape, about the ability to return
home again, and about the sort of people who want to close those doors
because the possibility of change created by people moving around freely
threatens the world they have carefully constructed.
Structurally, the central part of the book is told by interleaving
chapters of January's tale with chapters from The Ten Thousand
Doors. That book within a book starts with the framing of a scholarly
treatment but quickly becomes a biography of a woman: Adelaide Lee Larson,
a half-wild farm girl who met her true love at the threshold of a Door and
then spent much of her life looking for him.
I am not a very observant reader for plot details, particularly for books
that I'm enjoying. I read books primarily for the emotional beats and the
story structure, and often miss rather obvious story clues. (I'm hopeless
at guessing the outcomes of mysteries.) Therefore, when I say that there
are many things January is unaware of that are obvious to the reader,
that's saying a lot. Even more clues were apparent when I skimmed the
first chapter again, and a more observant reader would probably have seen
them on the first read. Right down to Mr. Locke's name, Harrow is not
very subtle about the moral shape of this world.
That can make the early chapters of the book frustrating. January is
being emotionally (and later physically) abused by the people who have
power in her life, but she's very deeply trapped by false loyalty and lack
of external context. Winning free of that is much of the story of the
book, and at times it has the unpleasantness of watching someone make
excuses for her abuser. At other times it has the unpleasantness of
watching someone be abused. But this is the place where I thought the
nested story structure worked marvelously. January escapes into the story
of The Ten Thousand Doors at the worst moments of her life, and the
reader escapes with her. Harrow uses the desire to switch scenes back to
the more adventurous and positive story to construct and reinforce the
emotional structure of the book. For me, it worked extremely well.
It helps that the ending is glorious. The payoff is worth all the
discomfort and tension-building in the first half of the book. Both
The Ten Thousand Doors and the surrounding narrative reach deeply
satisfying conclusions, ones that are entangled but separate in just the
ways that they need to be. January's abilities, actions, and decisions at
the end of the book were just the outcome that I needed but didn't
entirely guess in advance. I could barely put down the last quarter of
this story and loved every moment of the conclusion.
This is the sort of book that can be hard to describe in a review because
its merits don't rest on an original twist or easily-summarized idea. The
elements here are all elements found in other books: portal fantasy, the
importance of story-telling, coming of age, found family, irrepressible
and indomitable characters, and the battle of the primal freedom of travel
and discovery and belief against the structural forces that keep rulers in
place. The merits of this book are in the small details: the way that
January's stories are sparse and rare and sometimes breathtaking, the
handling of tattoos, the construction of other worlds with a few deft
strokes, and the way Harrow embraces the emotional divergence between
January's life and Adelaide's to help the reader synchronize the emotional
structure of their reading experience with January's.
She writes a door of blood and silver. The door opens just for her.
The Ten Thousand Doors of January is up against a very strong slate
for both the Nebula and the Hugo this year, and I suspect it may be edged
out by other books, although I wouldn't be unhappy if it won. (It
probably has a better shot at the Nebula than the Hugo.) But I will be
stunned if Harrow doesn't walk away with the
Mythopoeic Award. This seems
like exactly the type of book that award was created for.
This is an excellent book, one of the best I've read so far this year.
Highly recommended.
Rating: 9 out of 10
Guglielmo Achille Cavellini (11 September 1914 20 November 1990), also known as GAC, was an Italian artist and art collector. After an initial activity as a painter, in the 1940s and 1950s he became one of the major collectors of contemporary Italian abstract art, developing a deep relationship of patronage and friendship with the artists. This experience has its pinnacle in the exhibition Modern painters of the Cavellini collection at the National Gallery of Modern Art in Rome in 1957. In the 1960s Cavellini resumed his activity as an artist, with an ample production spanning from Neo-Dada to performance art to mail art, of which he became one of the prime exponents with the Exhibitions at Home and the Round Trip works. In 1971 he invented autostoricizzazione (self-historicization), upon which he acted to create a deliberate popular history surrounding his existence. He also authored the books Abstract Art (1959), Man painter (1960), Diary of Guglielmo Achille Cavellini (1975), Encounters/Clashes in the Jungle of Art (1977) and Life of a Genius (1989).
Paul Gustave Louis Christophe Dor (/d re /; French: [ ys.tav d . e]; 6 January 1832 23 January 1883[1]) was a French artist, printmaker, illustrator, comics artist, caricaturist, and sculptor who worked primarily with wood-engraving.
Enrico Baj era bravissimo a pij per culo er potere usanno a fantasia.
Co quaa sempricit che solo dii granni, raccatta robbe tipo bottoni, pezzi de
stoffa, cordoni, passamanerie varie, e l appiccica su a tela insieme aa
pittura sua: che pare quasi che sta a gioc ma giocanno giocanno, zitto zitto,
riesce a rovesci er monno. >>
Because posting private keys on the Internet is a bad idea, some
people like to redact their private keys, so that it looks kinda-sorta like a private key,
but it isn t actually giving away anything secret. Unfortunately, due to the way that
private keys are represented, it is easy to redact a key in such a way that it
doesn t actually redact anything at all. RSA private keys are particularly bad at this,
but the problem can (potentially) apply to other keys as well.
I ll show you a bit of Inside Baseball with key formats, and then demonstrate the practical
implications. Finally, we ll go through a practical worked example from an actual not-really-redacted
key I recently stumbled across in my travels.
The Private Lives of Private Keys
Here is what a typical private key looks like, when you come across it:
Obviously, there s some hidden meaning in there computers don t encrypt
things by shouting BEGIN RSA PRIVATE KEY! , after all. What is between the
BEGIN/END lines above is, in fact, a
base64-encoded
DER format
ASN.1 structure representing a PKCS#1 private
key.
In simple terms, it s a list of numbers very important numbers. The list
of numbers is, in order:
A version number (0);
The public modulus , commonly referred to as n ;
The public exponent , or e (which is almost always 65,537, for various unimportant reasons);
The private exponent , or d ;
The two private primes , or p and q ;
Two exponents, which are known as dmp1 and dmq1 ; and
A coefficient, known as iqmp .
Why Is This a Problem?
The thing is, only three of those numbers are actually required in a private
key. The rest, whilst useful to allow the RSA encryption and decryption to be
more efficient, aren t necessary. The three absolutely required values are
e, p, and q.
Of the other numbers, most of them are at least about the same size as each
of p and q. So of the total data in an RSA key, less than a quarter of the
data is required. Let me show you with the above toy key, by breaking it
down piece by piece1:
MGI DER for this is a sequence
CAQ version (0)
CxjdTmecltJEz2PLMpS4BXn
AgMBAAe
ECEDKtuwD17gpagnASq1zQTYd
ECCQDVTYVsjjF7IQp
IJANUYZsIjRsR3q
AgkAkahDUXL0RSdmp1
ECCB78r2SnsJC9dmq1
AghaOK3FsKoELg==iqmp
Remember that in order to reconstruct all of these values, all I need are
e, p, and q and e is pretty much always 65,537. So I could redact
almost all of this key, and still give all the important, private bits of this
key. Let me show you:
Now, I doubt that anyone is going to redact a key precisely like
this but then again, this isn t a typical RSA key. They usually
look a lot more like this:
People typically redact keys by deleting whole lines, and usually replacing them
with [...] and the like. But only about 345 of those 1588 characters
(excluding the header and footer) are required to construct the entire key.
You can redact about 4/5ths of that giant blob of stuff, and your private parts
(or at least, those of your key) are still left uncomfortably exposed.
But Wait! There s More!
Remember how I said that everything in the key other than e, p,
and q could be derived from those three numbers? Let s talk about one
of those numbers: n.
This is known as the public modulus (because, along with e, it is also
present in the public key). It is very easy to calculate: n = p * q. It
is also very early in the key (the second number, in fact).
Since n = p * q, it follows that q = n / p. Thus, as long
as the key is intact up to p, you can derive q by simple division.
Real World Redaction
At this point, I d like to introduce an acquaintance of mine: Mr. Johan Finn.
He is the proud owner of the GitHub repo johanfinn/scripts.
For a while, his repo contained a script that contained a poorly-redacted private
key. He since deleted it, by making a new commit, but of course because
git never really deletes anything, it s
still available.
Of course, Mr. Finn may delete the repo, or force-push a new history without
that commit, so here is the redacted private key, with a bit of the surrounding
shell script, for our illustrative pleasure:
Now, if you try to reconstruct this key by removing the obvious garbage
lines (the ones that are all repeated characters, some of which aren t even valid
base64 characters), it still isn t a key at least, openssl pkey
doesn t want anything to do with it. The key is very much still in there,
though, as we shall soon see.
Using a gem I wrote and a quick bit of
Ruby, we can extract a complete private key. The irb session looks something
like this:
What I ve done, in case you don t speak Ruby, is take the two chunks of
plausible-looking base64 data, chuck them together into a variable named b64,
unbase64 it into a variable named der, pass that into a new DerParse
instance, and then walk the DER value tree until I got all the values I need.
Interestingly, the q value actually traverses the split in the two chunks,
which means that there s always the possibility that there are lines missing
from the key. However, since p and q are supposed to be prime, we can
sanity check them to see if corruption is likely to have occurred:
Excellent! The chances of a corrupted file producing valid-but-incorrect prime
numbers isn t huge, so we can be fairly confident that we ve got the real p
and q. Now, with the help of another one of my
creations we can use e, p,
and q to create a fully-operational battle key:
and there you have it. One fairly redacted-looking private key brought back
to life by maths and far too much free time.
Sorry Mr. Finn, I hope you re not still using that key on anything
Internet-facing.
What About Other Key Types?
EC keys are very different beasts, but they have much the same problems as RSA
keys. A typical EC key contains both private and public data, and the public
portion is twice the size so only about 1/3 of the data in the key is
private material. It is quite plausible that you can redact an EC key and
leave all the actually private bits exposed.
What Do We Do About It?
In short: don t ever try and redact real private keys. For documentation purposes,
just put KEY GOES HERE in the appropriate spot, or something like that. Store your
secrets somewhere that isn t a public (or even private!) git repo.
Generating a dummy private key and sticking it in there isn t a great idea,
for different reasons: people have this odd habit of reusing demo keys in
real
life.
There s no need to encourage that sort of thing.
Technically the pieces aren t 100% aligned with the underlying DER, because of how base64 works.
I felt it was easier to understand if I stuck to chopping up the base64, rather than
decoding into DER and then chopping up the DER.
TL;DR; For those (admins) of you who run GNU/Linux on staff computers: How do you organize your graphical remote support in your company? Get in touch, share your expertise and experiences.
Researching on FLOSS based Linux Desktops
When bringing GNU/Linux desktops to a generic folk of productive office users on a large scale, graphical remote support is a key feature when organizing helpdesk support teams' workflows.
In a research project that I am currently involved in, we investigate the different available remote support technologies (VNC screen mirroring, ScreenCasts, etc.) and the available frameworks that allow one to provide a remote support infrastructure 100% on-premise.
In this research project we intend to find FLOSS solutions for everything required for providing a large scale GNU/Linux desktop to end users, but we likely will have to recommend non-free solutions, if a FLOSS approach is not available for certain demands. Depending on the resulting costs, bringing forth a new software solution instead of dumping big money in subscription contracts for non-free software is seen as a possible alternative.
As a member of the X2Go upstream team and maintainer of several remote desktop related tools and frameworks in Debian, I'd consider myself as sort of in-the-topic. The available (as FLOSS) underlying technologies for plumbing a remote support framework are pretty much clear (x11vnc, recent pipewire-related approaches in Wayland compositors, browser-based screencasting). However, I still lack a good spontaneous answer to the question: "How to efficiently software-side organize a helpdesk scenario for 10.000+ users regarding graphical remote support?".
Framework for Remote Desktop in Webbrowsers
In fact, in the context of my X2Go activities, I am currently planning to put together a Django-based framework for running X2Go sessions in a web browser. The framework that we will come up with (two developers have already been hired for an initial sprint in July 2020) will be designed to be highly pluggable and it will probably be easy to add remote support / screen sharing features further on.
And still, I walk around with the question in mind: Do I miss anything? Is there anything already out there that provides a remote support solution as 100% FLOSS, that has enterprise grade, that up-scales well, that has a modern UI design, etc. Something that I simply haven't come across, yet?
Looking forward to Your Feedback
Please get in touch (OFTC/Freenode IRC, Telegram, Email), if you can fill the gap and feel like sharing your ideas and experiences.
light+love
Mike
After losing a fair bit of hair due to quality and reliability issues
with our home laser multifunctional (Brother
DCP1600-series,
which we bought after checking it was meant to work on Linux And it
does, but with a very buggy, proprietary driver Besides being the
printer itself of quite low quality), we decided it was time to survey
the market again, and get a color inkjet printer. I was not very much
an enthusiast of the idea, until I found all of the major
manufacturers now offer refillable ink tanks instead of the darn
expensive cartridges of past decades. Lets see how it goes!
Of course, with over 20 years of training, I did my homework. I was
about to buy an Epson printer, but decided for an HP Ink Tank 410
Wireless
printer. The day it arrived, not wanting to fuss around too much to
get to see the results, I connected it to my computer using the USB
cable. Everything ran smoothly and happily! No driver hunting needed,
print quality is superb I hope, years from now, we stay with this
impression.
Next day, I tried to print over WiFi. Of course, it requires
configuration. And, of course, configuration strongly wants you to
do it from a Windows or MacOS machine which I don t have. OK, fall
back to Android For which an app download is required (and does not
thrill me, but what can I say. Oh and the app needs location
services to even run. Why Maybe because it interacts with the
wireless network in WiFi Direct, non-authenticated way?)
Anyway, things seem to work. But they don t My computers can
identify and connect with the printer from CUPS, but nothing ever
comes out. Printer paused, they say. Entering the printer s web
interface is somewhat ambiguous Following the old HP practices, I
tried http://192.168.1.75:9100/ (no point in hiding my internal IP),
and got a partial webpage sometimes (and nothing at all
othertimes). Seeing the printer got detected over ipps://, my
immediate reaction was to try pointing the browser to port 631. Seems
to work! Got some odd messages But it seems I ll soon debug the
issue away. I am not a familiar meddler in the dark lands of cups,
our faithful print server, but I had to remember my toolkit..
Sucess in enabling, but self-auto-disabled right away lpstat -t
was not more generous, reporting only it was still paused.
Some hours later (mix in attending kids and whatnot), I finally
remember to try cupsctl --debug-logging, and magically,
/var/log/cups/error_log turns from being quiet to being quite
chatty. And, of course, my first print job starts being processed:
D [10/May/2020:23:07:20 -0500] Report: jobs-active=1
(...)
D [10/May/2020:23:07:25 -0500] [Job 174] Start rendering...
(...)
D [10/May/2020:23:07:25 -0500] [Job 174] STATE: -connecting-to-device
(...)
Everything looks fine and dandy so far! But, hey, given nothing came
out of the printer keep reading one more second of logs (a couple
dozen lines)
D [10/May/2020:23:07:26 -0500] [Job 174] Connection is encrypted.
D [10/May/2020:23:07:26 -0500] [Job 174] Credentials are expired (Credentials have expired.)
D [10/May/2020:23:07:26 -0500] [Job 174] Printer credentials: HPC37468 / Thu, 01 Jan 1970 00:00:00 GMT / 28A59EF511A480A34798B6712DEEAE74
D [10/May/2020:23:07:26 -0500] [Job 174] No stored credentials.
D [10/May/2020:23:07:26 -0500] [Job 174] update_reasons(attr=0(), s=\"-cups-pki-invalid,cups-pki-changed,cups-pki-expired,cups-pki-unknown\")
D [10/May/2020:23:07:26 -0500] [Job 174] STATE: -cups-pki-expired
(...)
D [10/May/2020:23:08:00 -0500] [Job 174] envp[16]="CUPS_ENCRYPTION=IfRequested"
(...)
D [10/May/2020:23:08:00 -0500] [Job 174] envp[27]="PRINTER_STATE_REASONS=cups-pki-expired"
My first stabs were attempts to get CUPS not to care about expired
certificates, but it seems to have been hidden or removed from its
usual place. Anyway, I was already frustrated.
WTF Well, yes, turns out that from the Web interface, I paid some
attention to this the first time around, but let it pass (speaks
wonders about my security practices!):
So, the self-signed certificate the printer issued at itself expired
116 years before even being issued. (is this maybe a Y2k38 bug?
Sounds like it!) Interesting thing, my CUPS log mentions the printer
credentials to expire at the beginning of the Unix Epoch
(01 Jan 1970 00:00:00 GMT).
OK, lets clickety-click away on the Web interface Didn t take me
long to get to Network Advanced settings Certificates:
However, clicking on Configure leads me to the not very
reassuring
I don t remember what I did for the next couple of minutes. Kept
fuming Until I parsed again the output of lpstat -t, and found
that:
# lpstat -t
(...)
device for HP_Ink_Tank_Wireless_410_series_C37468_: ipps://HPF43909C37468.local:443/ipp/print
(...)
Hmmmm CUPS is connecting using good ol port 443, as if it were a
Web thingy What if I do the same?
Click on New self-signed certificate , click on Next, a couple of
reloads And a very nice color print came out of the printer, yay!
Now, it still baffles me (of course I checked!): The self-signed
certificate is now said to come from
Issuer : CN=HPC37468, L=Vancouver, ST=Washington, C=US, O=HP,OU=HP-IPG,
alright not that it matters (I can import a more meaningful one if I really feel like
it), but, why is it Issued On: 2019-06-14 and set to
Expires On: 2029-06-11?
Anyway, print quality is quite nice. I hope to keep the printer long
enough to rant at the certificate being expired in the future!
Comments
Jeff Epler (Adafruit) 2020-05-11 20:39:17 -0500
why is it Issued On: 2019-06-14 and set to Expires On: 2029-06-11?
Because it s 3650 days
Gunnar Wolf 2020-05-11 20:39:17 -0500
Nice catch! Thanks for doing the head-scratching for me
Here s my (seventh) monthly update about the activities I ve done in the F/L/OSS world.
Debian
It s been 14 months since I ve started contributing to Debian.
And 4 months since I ve been a Debian Developer. And in this beautiful time,
I had this opprotunity to do and learn lots of new and interesting things. And most
importantly, meet and interact with lots of lovely people!
Debian is $home.
Sponsored a lot of uploads for William Desportes and Adam Cecile.
Mentoring for newcomers.
FTP Trainee reviewing.
Moderation of -project mailing list.
Applied for DUCI project for Google Summer of Code 2020.
Ruby2.7 Migration:
Ruby2.7 was recently released on 25th December, 2019. Santa s gift. Believe it or not.
We, the Debian Ruby team, have been trying hard to make it migrate to testing. And it finally happened.
The default version in testing is ruby2.7. Here s the news! \o/
Here s what I worked on this month for this transition.
Upstream:
Opened several issues and proposed patches (in the form of PRs):
Issue #35 against encryptor for Ruby2.7 test failures.
Issue #28 against image_science for removing relative paths.
Issue #106 against ffi-yajl for Ruby2.7 test failures.
Debian LTS
Debian Long Term Support (LTS) is a project to extend the lifetime of all Debian stable releases
to (at least) 5 years. Debian LTS is not handled by the Debian security team, but by a separate group
of volunteers and companies interested in making it a success.
This was my seventh month as a Debian LTS paid contributor. I was assigned 24.00 hours and worked on
the following things:
Other(s)
Sometimes it gets hard to categorize work/things into a particular category.
That s why I am writing all of those things inside this category.
This includes two sub-categories and they are as follows.
Personal:
This month I could get the following things done:
Most importantly, I finally migrated to a new website. Huge UI imporvement! \o/
From Jekyll to Hugo, it was not easy. But it was worth it! Many thanks to Luiz for writing hugo-coder, Clement, and Samyak!
If you find any flaws, issues and pull requests are welcomed at utkarsh2102/utkarsh2102.com
Wrote battery-alert, a mini-project of my own to show battery alerts at <10% and >90%.
Written in shell, it brings me all the satisfaction as it has saved my life on many occasions.
And guess what? It has more users than just myself!
Reviews and patches are welcomed \o/
Mentored in HackOn Hackathon. Thanks to Manvi for reaching out!
It was fun to see people developing some really nice projects.
Thanks to Ray and John, I became a GitLab Hero!
(I am yet to figure out my role and responibility though)
Atteneded Intro Sec Con and had the most fun!
Heard Ian s keynote and attended other talks and learned how to use WireShark!
Open Source:
Again, this contains all the things that I couldn t categorize earlier.
Opened several issues and pull requests:
Issue #297 against hugo-coder, asking to enable RSS feed for blogs.
PR #316 for hugo-coder for fixing the above issue myself.
Issue #173 against arbre for requesting a release.
Issue #104 against combustion, asking to relax dependency on rubocop. Fixed in this commit.
Issue #16 against ffi-compiler for requesting to fix homepage and license.
Issue #57 against gographviz for requesting a release.
Issue #14 against crb-blast, suggesting compatability with bio 2.0.x.
Issue #58 against uniform_notifier for asking to drop the use of ruby-growl.
PR #2072 for polybar, adding installation instructions on Debian systems.
Here is my monthly update covering what I have been doing in the free software world during April 2020 (previous month's report). Looking it over prior to publishing, I am surprised how much I got done this month I felt that I was not only failing to do all the extra things I had planned, but I was doing far less than normal. But let us go easy on ourselves; nobody is nailing this.
Made some small changes to my tickle-me-email library which implements Gettings Things Done (GTD)-like behaviours in IMAP inboxes in order to decode various headers correctly [...] and correct the counting logic in the send-later command's message limit. [...]
Worked with @dormando with a architecture-specific problem in the Memcached caching system to fix grossly incorrect behaviour on big-endian architectures. [...]
As part of my duties of being on the board of directors of the Open Source Initiative and Software in the Public Interest I attended their respective monthly meetings and participated in various licensing and other discussions occurring on the internet, as well as the usual internal discussions regarding logistics, licensing, policy, liaising with the ClearlyDefined project and so on. In particular, I on-boarded the Ganeti project to SPI.
In addition, I did more hacking on the Lintian static analysis tool for Debian packages:
New features and improvements:
Check for debian/rules files that specify -Wl,--as-needed as this is now the default from bullseye onwards. (#956146)
Warn about automatically-generated debug packages that ship files other than .debug. (#958945)
Warn about packages that specify --with=systemd with a Debhelper compatibility level of 10 or higher. (#949844)
Detect $* as using the Debhelper sequencer. (#930679)
Check for override dh_install (ie. with a space) in debian/rules; in 99% of cases this will be an omission of the underscore. [...]
Bug fixes:
Allow python3-all-dev and python3-all-dbg to satisfy the check for packages that use py3versions with the -s argument. (#955799, #956134)
Build-Depends-Arch and Build-Depends-Indep do not imply each other, so don't warn about "duplicate" dependencies in this case. (#956368)
Ignore build profiles when checking packages for py3versions -s without the corresponding Build-Depends. (#958794)
Remove the pre-depends-directly-on-multiarch-support tag; any package pre-depending on the multiarch-support will not be installable in the bullseye distribution. (#798762)
Mark mailing-list-obsolete-in-debian-infrastructure as being experimental. (#958182, #958666)
Do not warn about empty dh_dwz-generated "multi-files". (#955752)
Drop the .travis.yml file as we are using Salsa now. [...]
Reproducible builds
One of the original promises of open source software is that distributed peer review and transparency of process results in enhanced end-user security. However, whilst anyone may inspect the source code of free and open source software for malicious flaws, almost all software today is distributed as pre-compiled binaries. This allows nefarious third-parties to compromise systems by injecting malicious code into ostensibly secure software during the various compilation and distribution processes.
The motivation behind the Reproducible Builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised.
The initiative is proud to be a member project of the Software Freedom Conservancy, a not-for-profit 501(c)(3) charity focused on ethical technology and user freedom.
Conservancy acts as a corporate umbrella allowing projects to operate as non-profit initiatives without managing their own corporate structure. If you like the work of the Conservancy or the Reproducible Builds project, please consider becoming an official supporter.
Submitted the following patches to fix reproducibility-related toolchain issues within Debian:
dh-cargo: Please make the output reproducible. (#958301)
rspamd: Please make paths.lua files reproducible. (#956120)
Wrote a 20-page funding report to the Open Technology Fund -- whilst the Reproducible Builds project has submitted monthly reports to the otf-active mailing list this final report described in detail the status of each objective, our overall lessons and our future plans.
The Reproducible Builds project also operates a Jenkins-based testing framework that powers tests.reproducible-builds.org. I made the following changes:
Print the build environment prior to executing a build. [...]
Drop a misleading disorderfs-debug prefix in log output when we change non-disorderfs things in the file and, as it happens, do not run disorderfs at all. [...]
The CSS for the package report pages added a margin to all a HTML elements under li ones, which was causing a comma/bullet spacing issue. [...]
Add support for custom .zip filename filtering and exclude two patterns of files generated by Maven projects in "fork" mode. (#13)
disorderfs is our FUSE-based filesystem that deliberately introduces non-determinism into directory system calls in order to flush out reproducibility issues. This month I fixed a long-standing issue by not drop UNIX groups in FUSE multi-user mode when we are not root. (#1)
Categorised a large number of packages and issues in the Reproducible Builds "notes" repository.
Elsewhere in our tooling, I made the following changes to diffoscope, our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues, including preparing and uploading versions 139, 140, 141 and 142 to Debian:
Comparison improvements:
Dalvik.dex files can also serve as APK containers so restrict the narrower identification of .dex files to files ending with this extension and widen the identification of APK files to when file(1) discovers a Dalvik file. (#28)
Add support for Hierarchical Data Format (HD5) files. (#95)
Strip paths from the output of zipinfo(1) warnings. (#97)
Don't uselessly include the JSON "similarity" percentage if it is "0.0%". [...]
Render multi-line difference comments in a way to show indentation. (#101)
Testsuite improvements:
Add pdftotext as a requirement to run the PDF test_metadata text. (#99)
apktool 2.5.0 changed the handling of output of XML schemas so update and restrict the corresponding test to match. (#96)
Explicitly list python3-h5py in debian/tests/control.in to ensure that we have this module installed during a test run to generate the fixtures in these tests. [...]
Correct parsing of ./setup.py test --pytest-args arguments. [...]
Misc:
Capitalise "Ordering differences only" in text comparison comments. [...]
Improve documentation of FILE_TYPE_HEADER_PREFIX and FALLBACK_FILE_TYPE_HEADER_PREFIX to highlight that only the first 16 bytes are used. [...]
Frontdesk duties, responding to user/developer questions, reviewing others' packages, participating in mailing list discussions, etc.
Issued DLA 2171-1 for the Ceph distributed storage and file system to prevent a header-splitting vulnerability (CVE-2020-1760).
It was discovered that there was a path-traversal issue in the Apache Shiro Java security framework (CVE-2020-1957) where a specially-crafted request could cause an authentication bypass. I therefore issued DLA 2181-1 to address this.
Issued ELA-225-1 for dom4j, a library for working with various XML formats on the Java platform to address an XML external external entity vulnerability (CVE-2020-10683). This type of attack occurs when XML input containing a reference to an internet-faced entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, server side request forgery as well as other system impacts.
Issued ELA-224-2 to update the fix to ntp in ELA-224-2 to add further protection that was not present in the previous update.
1.6.5-2 Fix a failing autopkgtest that assumes a particular string is in the first kilobyte of the response which was no longer the case due to the addition of new configuration options.
1.2.2-2 Ensure that the server is started before running autopkgtests.
1.2.2-3 Sleep to ensure the server has really started before running the autopkgtests.
OnionShare (2.2-2) Replace python-nautilus in the build-dependencies with python3-nautilus. (#943137)
installation-birthday (15) Correct the (confusing) internal logic of --force from being visible to users. (#895686)
txtorcon (20.0.0-1) New upstream release and refresh packaging.
python-hiredis (1.0.1-1) New upstream release and refresh packaging.
onioncircuits (0.6-3) Mark a non-deterministic autopkgtest as "flaky" for now to ease migration (#930448) and use DEB_VERSION_UPSTREAM_REVISION over manually parsing dpkg-parsechangelog in debian/rules.
I have made the 1.0 release of subdirmk.
subdirmk is a tool to help with writing build systems in make, without use of recursive make.
Why
Peter Miller's 1997 essay Recursive Make Considered Harmful persuasively argues that it is better to arrange to have a single make invocation with the project's complete dependency tree, rather than the conventional $(MAKE) -C subdirectory approach.
This has become much more relevant with modern projects which tend to be large and have deep directory trees. Invoking make separately for each of these subdirectories can be very slow. Nowadays everyone needs to run a parallel build, but with the recursive make approach great discipline is needed to avoid introducing races which cause the build to sometimes fail.
There are various new systems which aim to replace make. My general impression of these is that they mostly threw away the good parts of make (often, they discard the flexibility, and the use of the shell command as the basic unit of execution, making them hard to extend), or make other unfortunate assumptions. And there are a lot of programming-language-specific systems - a very unsatisfactory development. Having said all that, I admit I haven't properly evaluated every make competitor. Other reasons for staying with make including that it is widely available, relatively widely understood, and has a model relatively free of high-level abstract concepts. (I like my languages with high-level concepts, but not my build systems.)
But, with make, I found that actually writing a project's build system in non-recursive make was not very ergonomic. So with some help and prompting from Mark Wooding, I have made a tool to help.
What
subdirmk is a makefile preprocessor and aggregator, typically run from autoconf. subdirmk provides convenience syntaxes for references to per-directory variables and pathnames. It also helps by providing a little syntactic sugar for GNU make's macro facilities, which are awkward to use in raw make.
subdirmk's features are triggered by the sigil &. The syntax is carefully designed to avoid getting in the way of makefile programming (and programming of shell commands in make rules).
subdirmk is fully documented in the README. There is a demo in the example directory (which also serves as part of the test suite).
What's new
The version number.
I have not felt the need to make any changes since releasing 0.4 in mid-February. The last non-docs change was a (backwards-compatible) extension, in late January, to pass through unaltered GNU make's new grouped multiple targets syntax.
Advantages and disadvantages of subdirmk
Compared to recursive make, subdirmk is easier and simpler, although you do have to decorate a lot of your variables and filenames with & to indicate that they are directory-local. It is much easier to avoid writing parallel make bugs. You naturally get properly working per-subdirectory targets. subdirmk-based nonrecursive make is much, much faster than recursive make.
Compared to many other recent build system tools, subdirmk retains all the flexibility and extensibility of make, and operates at a fairly low level of abstraction. subdirmk-based makefiles can easily invoke other build systems. make knows it's not the only thing in the universe. You can adopt subdirmk incrementally or partially, gradually bringing your recursive submakefiles into the unified build. The build system code in subdirmk's Dir.sd.mk files will be readily navigable by most readers; much will be familiar.
Because subdirmk is a small collection of (fairly simple) scripting and makefile code, there is no need to build it; you can simply ship it with your project using git-subtree. For an autoconf-based project, there need be no change to how your users and downstreams invoke your build.
On the other hand the price you (continue to) pay is make's punctation soup, which subdirmk adds a new sigil to. subdirmk-based makefiles are terse and help you use make's facilities to abstract away repetition, but that can make them dense. The new & sigil will faze some readers.
Currently, the provided mechanism for incorporating subdirmk into your project assumes you are using autoconf but not automake. It would be possible to use subdirmk with autoconf-less projects, or with automake-based ones, but I haven't done the glue work to make that easy.
subdirmk does require GNU make and it assumes you have perl installed. But GNU make is very portable, and perl is very widely available. (The perl used is very conservative.) The make competitors are, themselves, even less standard build tools. I don't think a build-dependency on GNU make, or perl, is a significant barrier nowadays, for most projects.
Note about comment moderation
I have deliberately been vague about other build systems and avoided specific criticisms or references. I don't want the comments to become a build system advocacy debate. Comments may be screened and moderated accordingly. Pointers to other obscure build system tools are very welcome. If you want to write a survey of build tools, or a critique of subdirmk, please do so on your own blog; I would be happy to consider linking to it.
Folks who acutely dig into this website might know that I have been
taking more pictures recently, as I got a new camera
since January 2018: a beautiful Fujifilm X-T2 that I really
like. Recently, I went out on a photo shoot in the rain. It was
intermittent, light rain when I left so I figured the "weather
proofing" (dpreview.com calls this "environmentally sealed") would
keep the camera secure. After an hour of walking outside, however,
rain intensified and I was just quickly becoming more and more
soaked. Still trusting the camera would function, I carried on. But
after about 90 minutes of dutiful work, the camera just turned off and
wouldn't power back on.
It had drowned.
I couldn't believe it; "but this is supposed to be waterproof! This
can't be happening!", I thought. I tried swapping out the battery for
a fresh one, which was probably a bad idea (even if I was smart enough
to do this under cover): still no luck, yet I could still not believe
it was dead, so I figured I would look at it later when I was home. I
still eventually removed the battery after a while, remembering that
it mattered.
Turns out the camera was really dead. Even at home, it wouldn't power
up, even with fresh batteries. After closer inspection, the camera was
as soaked as I was...
...even the SD cards were wet!
I was filled with despair! My precious camera! I had been waiting for
litterally decades to find the right digital camera that was as
close to the good old film cameras I was used to. I was even working
on black and white "film" to get back to basics, which turned into a
project to witness the impact of the coronavirus on city life! All
that was lost, or at least stopped: amazingly, the SD cards were just
absolutely fine and survived the flooding without problem.
The last photo my camera took before it died
A good photographer friend told me that this was actually fairly
common: "if you shoot outside, get used to this, it will happen".
So I tried "the rice trick": plunge your camera in a pile
of rice and let it rest there for a long time. It didn't work so well:
I didn't have a big enough container to hold the camera and the
rice. I was also worried about rice particles inserting themselves
into the camera holes, as I had opened all the ports to let it dry.
I could also not keep myself from inserting a battery and trying it
out again: amazingly, it powered up, only once, and died again. After
shopping in desperation for dessicators (who would have thought
you should keep those little bags from the stuff you order online!), I
ended up buying silica gel dehumidifier from Lee Valley (13$, the
small one!) which comes in a neat little metal box. But that never
arrived in time so I had to find another solution.
My partner threw the idea out in jest, but the actual solution worked,
and it was surprisingly simple!
Tada! Turns out you can dehydrate hardware too!
We have a food dehydrator at home (a Sedna Express if you really
want to know) since we do a lot of backpacking and canot-camping, but
I never thought I would put electronics in there. Turns out a
food dehydrator is perfect: it has a per degree temperature control
that can go very low and a timer. I set it to 30 C for 24 hours. (I
originally set it to 40 C but it smelled like plastic after a while so
my partner turned it off thinking it was melting the camera.)
And now the camera is back! I was so happy! There is probably some
permanent damage to the delicate circuitry in the camera. And I will
probably not go back out in heavy rain again with the camera, or at
least not without a rainjacket (35$USD at B&H) on the
camera. And I am now in a position to tell other people what to do
if they suffer the same fate...
Tips for dealing with electronic liquid damage
So, lessons learned...
when you have a liquid spill over your electronics: IMMEDIATELY
REMOVE ALL ELECTRIC POWER, including the battery! (this is
another reason why all batteries should be removable)
if the spill is "sticky" (e.g. coffee, beer, maple syrup, etc)
or "salty", do try to wash it with water, yet without
flooding it any further (delicate balance, I know) some devices
are especially well adapted to this: I have washed a keyboard with
a shower head and drowned the thing completely, it worked fine
after drying.
do NOT power it back on until you are certain the equipment is
dry
let the electronics device dry for 24 to 48 hours with all
ports open in a humidity-absorbing environment: a bag of rice
works, but a food dehydrator is best. make sure the rice doesn't
get stuck inside the machine: use a small mesh bag if necessary
once you are confident the device has dried, fiddle with the
controls and see if water comes out: it might not have dried
because it was stuck inside a button or dial. if dry, try
powering it back on and watch the symptoms. if it's still weird,
try drying it for another day.
if you get tired of waiting and the machine doesn't come back up,
you will have to send it to the repair shop or open it up
yourself to see if there is soldering damage you can fix.
I hope it might help careless people who dropped their coffee or ran
out in the rain, believing the hype of waterproof cameras. Amateur
tip: waterproof cameras are not waterproof...
Artemisia Lomi or Artemisia Gentileschi (US: / d nt l ski, -ti -/, Italian: [arte mi zja d enti leski]; July 8, 1593 c. 1656) was an Italian Baroque painter, now considered one of the most accomplished seventeenth-century artists working in the dramatic style of Caravaggio. In an era when women had few opportunities to pursue artistic training or work as professional artists, Artemisia was the first woman to become a member of the Accademia di Arte del Disegno in Florence and had an international clientele.
Maria Pellegrina Amoretti (1756 1787), was an Italian lawyer. She is referred to as the first woman to graduate in law in Italy, and the third woman to earn a degree.
Laura Maria Caterina Bassi (October 1711 20 February 1778) was an Italian physicist and academic. She received a doctoral degree in Philosophy from the University of Bologna in May 1732. She was the first woman to earn a professorship in physics at a university. She is recognized as the first woman in the world to be appointed a university chair in a scientific field of studies. Bassi contributed immensely to the field of science while also helping to spread the study of Newtonian mechanics through Italy.
Maria Gaetana Agnesi (UK: / n je zi/ an-YAY-zee,[1] US: / n -/ ahn-,[2][3] Italian: [ma ri a ae ta na a zi, - e z-];[4] 16 May 1718 9 January 1799) was an Italian mathematician, philosopher, theologian, and humanitarian. She was the first woman to write a mathematics handbook and the first woman appointed as a mathematics professor at a university.[5]
Elena Lucrezia Cornaro Piscopia (US: /k r n ro p sko pi /,[4] Italian: [ lena lu kr ttsja kor na ro pi sk pja]) or Elena Lucrezia Corner (Italian: [kor n r]; 5 June 1646 26 July 1684), also known in English as Helen Cornaro, was a Venetian philosopher of noble descent who in 1678 became one of the first women to receive an academic degree from a university, and the first to receive a Doctor of Philosophy degree.
Maria Tecla Artemisia Montessori (/ m nt s ri/ MON-tiss-OR-ee, Italian: [ma ri a montes s ri]; August 31, 1870 May 6, 1952) was an Italian physician and educator best known for the philosophy of education that bears her name, and her writing on scientific pedagogy. At an early age, Montessori broke gender barriers and expectations when she enrolled in classes at an all-boys technical school, with hopes of becoming an engineer. She soon had a change of heart and began medical school at the Sapienza University of Rome, where she graduated with honors in 1896. Her educational method is still in use today in many public and private schools throughout the world.
Rita Levi-Montalcini OMRI OMCA (US: / le vi mo nt l t i ni, l v-, li vi
m nt l -/, Italian: [ ri ta l vi montal t i ni]; 22 April 1909 30 December
2012) was an Italian Nobel laureate, honored for her work in neurobiology. She
was awarded the 1986 Nobel Prize in Physiology or Medicine jointly with colleague
Stanley Cohen for the discovery of nerve growth factor (NGF). From 2001 until
her death, she also served in the Italian Senate as a Senator for Life. This
honor was given due to her significant scientific contributions. On 22 April
2009, she became the first Nobel laureate ever to reach the age of 100, and
the event was feted with a party at Rome's City Hall. At the time of her
death, she was the oldest living Nobel laureate.
Margherita Hack Knight Grand Cross OMRI (Italian: [mar e ri ta (h)ak]; 12 June 1922 29 June 2013) was an Italian astrophysicist and scientific disseminator. The asteroid 8558 Hack, discovered in 1995, was named in her honour.
Samantha Cristoforetti (Italian pronunciation: [sa manta kristofo retti]; born 26 April 1977, in Milan) is an Italian European Space Agency astronaut, former Italian Air Force pilot and engineer. She holds the record for the longest uninterrupted spaceflight by a European astronaut (199 days, 16 hours), and until June 2017 held the record for the longest single space flight by a woman until this was broken by Peggy Whitson and later by Christina Koch. She is also the first Italian woman in space. Samantha Cristoforetti is also known as the first person who brewed an espresso in space.
Yes, that's quite a mouthful! That magic selector is long in that
way because it needs a special syntax (specifically the
.anarcat.user suffix) for Debian to be happy. The -debian
string is to tell me where the key is published. The marcos
prefix is to remind me where the private is used.
(nsp.dnsnode.net being one of the NS records of the
debian.org zone.)
If all goes well, the tests should pass when sending from your server
as anarcat@debian.org.
Testing
Test messages can be sent to dkimvalidator, mail-tester.com
or check-auth@verifier.port25.com. Those tools will run Spamassassin
on the received emails and report the results. What you are looking
for is:
-0.1 DKIM_VALID: Message has at least one valid DKIM or DK
signature
-0.1 DKIM_VALID_AU: Message has a valid DKIM or DK signature from
author's domain
-0.1 DKIM_VALID_EF: Message has a valid DKIM or DK signature from
envelope-from domain
If one of those is missing, then you are doing something wrong and
your "spamminess" score will be worse. The latter is especially tricky
as it validates the "Envelope From", which is the MAIL FROM: header
as sent by the originating MTA, which you see as from=<> in the
postfix lost.
The following will happen anyways, as soon as you have a signature,
that's normal:
0.1 DKIM_SIGNED: Message has a DKIM or DK signature, not necessarily valid
And this might happen if you have a ADSP record but do not correctly
sign the message with a domain field that matches the record:
1.1 DKIM_ADSP_ALL No valid author signature, domain signs all mail
That's bad and will affect your spam core badly. I fixed that issue by
using a wildcard key in the key table:
What is DKIM?
DKIM (DomainKeys Identified
Mail), as
Wikipedia puts it, "is an email authentication method designed to
detect forged sender addresses in emails (email spoofing), a technique
often used in phishing and email spam". More prosaically, one of the
reasons email spam is so abundant is that, given a certain email
message, there is no simple way to know for certain who sent it and
how reputable they are. So even if people having addresses
@debian.org are very nice and well-behaving, any random spammer can
easily send emails from whatever@debian.org, and even if you trust
people from @debian.org you cannot easily configure your antispam
filter to just accept all emails from @debian.org, because spammers
would get in too.
Since nearly ten years DKIM is there to help you. If you send an email
from @debian.org with DKIM, it will have a header like this:
The field d=debian.org is the domain this email claims to be from
and the fields bh= and b= are a cryptographic public key signature
certifying this fact. How do I check that the email is actually from
@debian.org? I use the selector s=vps.gio.user to fetch the public
key via DNS, and then use the public key to verify the signature.
There it is! Debian declares in its DNS record that that key is
authorized to sign outbound email from @debian.org. The spammer
hopefully does not have access to Debian's DKIM keys, and they cannot
sign emails.
Many large and small email services have already deployed DKIM since
years, while most @debian.org emails still do not use it. Why not?
Because people send @debian.org emails from many different
servers. Basically, every DD used their @debian.org address sends
email from their own mail server, and those mail servers (fortunately)
do not have access to Debian's DNS record to install their DKIM
keys. Well, that was true until yesterday! :-)
A few weeks ago I poked DSA asking to allow any Debian Developer to
install their DKIM keys, so that DDs could use DKIM to sign their
emails and hopefully reduce the amount of spam sent from
@debian.org. They have done it (thank you DSA very much, especially
adsb), and now it is possible to use it!
How do I configure it?
I will not write here a full DKIM tutorial, there are
manyaround. You
have to use opendkim-genkey to generate a key and then configure
your mail server to use opendkim to digitally sign outbound email.
There are a few Debian-specific things you have to care about, though.
First the have to choose a selector, which is a string used to
distinguish many DKIM keys belonging to the same domain. Debian allows
you to installa a key whose selector is <something>.<uid>.user,
where <uid> is your Debian uid (this is done both for namespacing
reasons and for exposing who might be abusing the system). So check
carefully that your selector has this form.
Then you cannot edit directly Debian's DNS record. But you can use the
email-LDAP gateway on db.debian.org to
install your key in a way similar to how entries in debian.net are
handled (see the updated
documentation). Specifically,
suppose that opendkim-genkey generated the following thing for
selector vps.gio.user and domain debian.org:
vps.gio.user._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "
"p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsM/W/kxtKWT58Eak0cfm/ntvurfbkkvugrG2jfvSMnHHkFyfJ34Xvn/HhQPLwX1QsjhuLV+tW+BQtxY7jxSABCee6nHQRBrpDej1t86ubw3CSrxcg1mzJI5BbL8un0cwYoBtUvhCYAZKarv1W2otCGs43L0sGtEqqtmYN/hIVVm4FcqeYS1cYrZxDsjPzCEocpYBhqHh1MTeUE"
"ddVmPHKZswzvllaWF0mgIXrfDNAE0LiX39aFKWtgvflrYFKiL4hCDnBcP2Mr71TVblfDY0wEdAEbGEJqHR1SxvWyn0UU1ZL4vTcylB/KJuV2gMhznOjbnQ6cjAhr2JYpweTYzz3wIDAQAB" ) ; ----- DKIM key vps.gio.user for debian.org
Then you have to carefully copy the content of the p= field (without
being fooled by it being split between different strings) and
construct a request of the form:
and then send it GPG-signed to changes@db.debian.org:
echo 'dkimPubKey: vps.gio.user blahblahblah' gpg --clearsign mail changes@db.debian.org
Then use host -t TXT vps.gio.user._domainkey.debian.org to chech the
key gets published (it will probably take some minutes/hours, I don't
know). Once it is published, you can enable DKIM in you mail server
and your email will be signed. Congratulations, you will not look like
a spammer any more!
You can send an email to check-auth@verifier.port25.com to check
that your setup is correct. They will reply with a report, including
the success of DKIM test.
Notice that currently Debian's setup only allows you to use RSA DKIM
keys and doesn't allow you to set other DKIM fields (but you probably
won't need to set them).
EDIT DSA made an official announcement about DKIM
support,
which you might want to check out as well, together with its links.
EDIT 2 Now ed25519 keys are supported, the syntax for specifying
keys on LDAP is a little bit more flexible and you can also insert
CNAME records. See the official
documentation for the updated
details.
So we have solved our problems with spam?
Ha, no! DKIM is only a small step. Useful, also because it enable
other steps to be taken in the future, but small.
In particular, DKIM enables you to say: "This particular email
actually comes from @debian.org", but doesn't tell anybody what to
do with emails that are not signed. A third-party mail server might
wonder whether @debian.org emails are actually supposed to be signed
or not.
There is another standard for dealing with that, which is called
DMARD, and I believe that Debian should eventually use it, but not
now: the problem is that currently virtually no email from
@debian.org is signed with DKIM, so if DMARC was enabled other mail
servers would start to nuke all @debian.org emails, except those
which are already signed, a minority. If people and services sending
emails from @debian.org will start configuring DKIM on their
servers, which is now possible, it will eventually come a time when
DMARC can be enabled, and spammers will find themselves unable to send
forged @debian.org emails. We are not there yet, but todays we are a
little step closer than yesterday.
Also, notice that having DKIM on @debian.org only counters spam
pretending to be from @debian.org, but there is much more. The
policy on what to accept is mostly independent on that on what you
send. However, knowing that @debian.org emails have DKIM and DMARC
would mean that we can set our spam filters to be more aggressive in
general, but whitelist official Debian Developers and services. And
the same can be done for other domains using DKIM and DMARC.
Finally, notice that some incompatibilities between DKIM and mailing
lists are known, and do not have a definitive answer yet. Basically,
most mailing list engines modify either the body of the headers in
forwarded emails, which means that DKIM does not validate any
more. There are many proposed solutions, possibly none completely
satisfying, but since spam is not very satisfying as well, something
will have to be worked out. I wrote a lot already, though, so I wont't
discuss this here.
Last month, I got selected as a Google Summer of Code student for Debian again! \o/
Here is my monthly update covering what I have been doing in the free software world during June 2020 (
LWN published today yet another great piece of writing, 
Here is my monthly update covering what I have been doing in the free software world during May 2020 (
Because 
TL;DR; For those (admins) of you who run GNU/Linux on staff computers: How do you organize your graphical remote support in your company? Get in touch, share your expertise and experiences.
Researching on FLOSS based Linux Desktops
When bringing GNU/Linux desktops to a generic folk of productive office users on a large scale, graphical remote support is a key feature when organizing helpdesk support teams' workflows.
In a research project that I am currently involved in, we investigate the different available remote support technologies (VNC screen mirroring, ScreenCasts, etc.) and the available frameworks that allow one to provide a remote support infrastructure 100% on-premise.
In this research project we intend to find FLOSS solutions for everything required for providing a large scale GNU/Linux desktop to end users, but we likely will have to recommend non-free solutions, if a FLOSS approach is not available for certain demands. Depending on the resulting costs, bringing forth a new software solution instead of dumping big money in subscription contracts for non-free software is seen as a possible alternative.
As a member of the X2Go upstream team and maintainer of several remote desktop related tools and frameworks in Debian, I'd consider myself as sort of in-the-topic. The available (as FLOSS) underlying technologies for plumbing a remote support framework are pretty much clear (x11vnc, recent pipewire-related approaches in Wayland compositors, browser-based screencasting). However, I still lack a good spontaneous answer to the question: "How to efficiently software-side organize a helpdesk scenario for 10.000+ users regarding graphical remote support?".
Framework for Remote Desktop in Webbrowsers
In fact, in the context of my X2Go activities, I am currently planning to put together a Django-based framework for running X2Go sessions in a web browser. The framework that we will come up with (two developers have already been hired for an initial sprint in July 2020) will be designed to be highly pluggable and it will probably be easy to add remote support / screen sharing features further on.
And still, I walk around with the question in mind: Do I miss anything? Is there anything already out there that provides a remote support solution as 100% FLOSS, that has enterprise grade, that up-scales well, that has a modern UI design, etc. Something that I simply haven't come across, yet?
Looking forward to Your Feedback
Please get in touch (OFTC/Freenode IRC, Telegram, Email), if you can fill the gap and feel like sharing your ideas and experiences.
light+love
So, the self-signed certificate the printer issued at itself expired
116 years before even being issued. (is this maybe a Y2k38 bug?
Sounds like it!) Interesting thing, my CUPS log mentions the printer
credentials to expire at the beginning of the Unix Epoch
(
However, clicking on Configure leads me to the not very
reassuring
I don t remember what I did for the next couple of minutes. Kept
fuming Until I parsed again the output of 
Click on New self-signed certificate , click on Next, a couple of
reloads And a very nice color print came out of the printer, yay!
Now, it still baffles me (of course I checked!): The self-signed
certificate is now said to come from
Here is my monthly update covering what I have been doing in the free software world during April 2020 (
...even the SD cards were wet!
The last photo my camera took before it died
Tada! Turns out you can dehydrate hardware too!