IRC: #boycottnovell @ FreeNode: Thursday, February 11, 2021

schestowitz__

restarted agate

schestowitz__

when trying to connect it denies proxy request, it says

schestowitz__

maybe the above record needs changing to cname? maybe dns propagation?

Techrights-sec

Yes, it would need the name there:

Techrights-sec

Failed to connect to the

Techrights-sec

server: hostname does not

Techrights-sec

verify: x509: certificate

Techrights-sec

is valid for gemini.

Techrights-sec

techrights.org, not host81

Techrights-sec

154-168-60.range81-154.

Techrights-sec

btcentralplus.com.

Techrights-sec

from the Gemini client amfora

Techrights-sec

did the registrar reply?

schestowitz__

Yes, I have a GUI where I can change this, defaults to A record, cannot be changed

Techrights-sec

nevermind

Techrights-sec

I see the name

Techrights-sec

however it is an A name. The A name needs to be provided by the dynamic DNS service

Techrights-sec

I am not sure but that will probably not work

Feb 11 10:45

Techrights-sec

What is the password for my login there at the registrar?

Feb 11 10:45

schestowitz__

only www. and ftp. show up as CNAME

Feb 11 10:48

Techrights-sec

The A name will point to an IP address

Techrights-sec

The CNAME will then point to the established A name.

Techrights-sec

;; ANSWER SECTION:

Techrights-sec

www.techrights.org. 14400 IN CNAME techrights.org.

Techrights-sec

techrights.org. 3375 IN A 23.161.112.116

Techrights-sec

The A name has to exist first

Techrights-sec

(AFAIK)

schestowitz__

maybe I will just ask them to assist...

https://lists.orbitalfox.eu/archives/gemini/2020/003792.html

schestowitz__

upside is, it seems like the pi already has a domain name for ssh, which I can keep updated after reset. does ssh@ name work for you?

Feb 11 10:52

schestowitz__

I also ping and ssh it, the ports are open for that. not sure why gemini is fussy but I assume its matching between certs and domain fail somewhere, will recheck

Feb 11 10:53

Techrights-sec

yes

Feb 11 10:56

Techrights-sec

but if the IP changes, then it will point at an old address ,possibly

Feb 11 10:56

Techrights-sec

someone else's machine

Feb 11 10:56

schestowitz__

that was always an issue when using IPv4 address as well, but now I can quickly access a GUI instead of notifying of changes

Feb 11 10:57

schestowitz__

for gemini I get "proxy request refused" and I tried from localhost and another machine on our LAN

Feb 11 11:00

Techrights-sec

Right but that task is meant to be automated.

Feb 11 11:00

schestowitz__

eventually the IP might be static anyway, if we deploy this to the HV under some container

Feb 11 11:01

schestowitz__

-TechrightsBN/#boycottnovell-lists.orbitalfox.eu | IDN with Gemini?

schestowitz__

schestowitz__

I'm pretty sure this is because no punycoding is being done in the DNS, and

schestowitz__

it's probably getting the UTF-8 encoding instead of "

schestowitz__

xn--gmeaux-bva.bortzmeyer.org". When I ask Lagrange to connect to the

schestowitz__

punycoded form explicitly, your server does not recognize it as "self" and

schestowitz__

replies with "Proxy Request Refused".

schestowitz__

schestowitz__

yes, both ipfs and gemini should eventually be on there, at risk of having less direct control over the physical hosting site. It's all about the load these incur.

Feb 11 11:06

schestowitz__

Hi,

schestowitz__

Thanks very much for the pointer.

schestowitz__

I've gotten as far as setting up the subdomain, but I cannot make it a CNAME, which is maybe what I need because Gemini browsers complain "Proxy Request Refused".

schestowitz__

I'm told it's likely because that's an A record. I am not given the option to change that in cpanel (screenshot attached).

Techrights-sec

The underlying problem with the name would be the dynamic dns.

Feb 11 11:26

Techrights-sec

That step has to come first afaik

Feb 11 11:26

schestowitz__

I have just received a reply and it seems they can change it, but not from the GUI

Feb 11 11:27

schestowitz__

will fwd to you the mail

Feb 11 11:27

schestowitz__

check mail

Feb 11 11:28

Techrights-sec

It should not be overriden, the A name must be supplied by the dynamic

Techrights-sec

dns serivce first. Can the registrar provide that for the RPi?

Techrights-sec

It would be a user-name, password, and URL that would go into ddclient

Techrights-sec

Then all that can be managed automatically and it won't need intervention

Techrights-sec

when the IP number changes

schestowitz__

ddclient installed

schestowitz__

│ Dynamic DNS service provider: │

schestowitz__

│ │

schestowitz__

│ www.dyndns.com │

schestowitz__

│ www.easydns.com │

schestowitz__

│ www.dslreports.com │

schestowitz__

│ www.zoneedit.com │

schestowitz__

│ other │

schestowitz__

│

Feb 11 11:33

schestowitz__

easydns is 35 bucks a year

Feb 11 11:34

Techrights-sec

Yes, can catalyst2 provide a dynamic dns subscription?

Techrights-sec

If they can, we'll plug that info into ddclient.

Techrights-sec

If not, then we can consider one of the other services for that.

Techrights-sec

What about catalyst2 though? Can they provide dynamic dns?

Techrights-sec

Some provide it free with their package.

schestowitz__

schestowitz__

I've spoken to a colleague, who says that what we probably want is dynamic dns, where the aforementioned record points to that instead of the IP address. I've just installed ddclient and it seems to be asking what provider to use (mostly US-based ones exist).

schestowitz__

Does Catalyst2 provide dynamic dns as a service? I'd prefer to keep all those things with the same provider.

schestowitz__

schestowitz__

thought: if we were to use dynamic dns with hostname/domain, we'd not at all have to go with a subsite address... or have another address as an alias of gemini.techrights.org though I don't think agate can deal with multiple address, as it does not "self-identify" as multiples

Feb 11 11:51

Techrights-sec

Does agate neet the A name? You can set the cert for the CNAME, possiibly

Feb 11 11:53

Techrights-sec

The idea behind the Dynamic DNS is that it takes care of the A anem

Techrights-sec

then the CNAME points to the A name

Techrights-sec

so all our services and certs use the CNAME

Techrights-sec

It hides the changing of the IP number nicely

schestowitz__

yes

schestowitz__

I have just tinkered a bit with agate, to no avail, and am waiting for the webhost to reply

Feb 11 11:57

schestowitz__

dyn is 55 bucks a year

Feb 11 12:03

schestowitz__

and dskreport no longer seems to provide this kind of service

Feb 11 12:03

schestowitz__

by that sort of price list it would be cheaper to just register a domain for gopher/gemini/other alone, set aside the subdomain (as this whole thing might involve a registration anyway)

Feb 11 12:04

schestowitz__

turns out there's no public .gopher address or .gemini domains

Feb 11 12:11

schestowitz__

gemini.techrights.org. 14400 IN CNAME

Feb 11 12:16

schestowitz__

host81-154-168-60.range81-154.btcentralplus.com

Feb 11 12:16

schestowitz__

All configs updated now in agate, but I still get the same error message, even when it's a cname with domain from BT instead of IP

Feb 11 12:17

Techrights-sec

that's ok tld changes are stupid

Feb 11 12:21

Techrights-sec

the host name can carry the service title if needed

Techrights-sec

otherwise it gets sorted by port

schestowitz__

with gemini.techrights,org now being a cname entry, can you figure out with me what goes wrong and why?

Techrights-sec

(oops the editor is not in this window)

schestowitz__

This one has a flatpak btw https://gmi.skyjake.fi/lagrange/

Feb 11 12:30

-TechrightsBN/#boycottnovell-gmi.skyjake.fi | Lagrange

Feb 11 12:30

Techrights-sec

;; ANSWER SECTION:

Techrights-sec

foo.ddns.net. 60 IN A 80.220.103.250

Techrights-sec

gemini.techrights.org. 60 IN CNAME foo.ddns.net

Techrights-sec

That's kindof how it should look later when we have some kind of dynamic dns

Techrights-sec

that would be from No_IP in the above example (faked for demo purposes)

Techrights-sec

lagrane is a client if I read correctly

schestowitz__

yes, it is, as the others are rust or C# or worse

schestowitz__

can we not bypass the ddclient part for testing purposes and if not, do we know for sure it would work ok with ddclient?

Feb 11 12:33

Techrights-sec

yes ddclient can be bypassed, but the A name needs to point at an IP number

Techrights-sec

then the CNAME 'gemini.techrights.org' needs to point at that A name.

Techrights-sec

Then it will be set up to drop in a dynamic dns serivce.

Techrights-sec

and the certificat should be able to work off of the CNAME

schestowitz__

this is proving to be harder than the setup of the server, I wonder if we can swap " foo.ddns.net" (in the example above) for the time being?

Feb 11 12:38

Techrights-sec

'foo.ddns.net' can be 'temporary.techrights.org' or something like that.

Feb 11 12:42

schestowitz__

I have just done that using home.techrights.org and it still fails to connect from amfora :(

Feb 11 12:42

Techrights-sec

how is the cert set up? It should then be built around the new CNAME

Feb 11 12:45

schestowitz__

I even tried to change the cert to home.techrights.org

Feb 11 12:45

schestowitz__

and to access that domain over gemini

Feb 11 12:45

schestowitz__

the host just came back to me, saying they do not do dynamic dns

Feb 11 12:46

schestowitz__

if we ever move the whole thing to the server, which has a static IP, then we won't need dynamic dns services at all

Feb 11 12:47

schestowitz__

(afaik)

Feb 11 12:47

Techrights-sec

how is the cert set up? It should then be built around the new CNAME

Feb 11 12:48

Techrights-sec

ExecStart=/home/gemini/bin/agate.armv7-unknown-linux-gnueabihf -s --content /home/gemini/gemini/ --key /home/gemini/certs/key.pe

Feb 11 12:48

Techrights-sec

m --cert /home/gemini/certs/cert.pem --hostname host81-154-168-60.range81-154.btcentralplus.com --lang en-GB

Feb 11 12:48

schestowitz__

oh. I forgot it is hard-coded there too.

Feb 11 12:49

schestowitz__

side note/ot: re dynamic ip, if I go on holiday and fear losing ssh access for ip hops at router level I have some workaround, like the machine writing its ip to somewhere I can access from anywhere

Feb 11 12:50

schestowitz__

THIS IS SOLVED NOW!!! \0/

Feb 11 12:52

schestowitz__

and it gives a layer of indirection at home.techrights.org, which is where for now I need to keep my IP up to date (won't take more than a minute, in case the hub resets itself)

Feb 11 12:53

Techrights-sec

next step would be the index files for Gemini. I am working on that

Techrights-sec

The article conversion is ok, but I don't see a way to browse empty directories

Techrights-sec

over the net.

Techrights-sec

Yes!

Techrights-sec

It works from here too.

schestowitz__

I am going to do a raspi video and gemini video later, still recovering mentally from the TM incident this morning and at least we managed to get gemini.techrights.org running

Feb 11 13:00

Techrights-sec

yes, the CNAM should go there too

Feb 11 13:00

Techrights-sec

that's progress

Feb 11 13:02

schestowitz__

and we now know what happens when TM runs out of space, even in /tmp (I will need to internalise this as it happened years ago and I could not remember the diagnosis)

Feb 11 13:03

schestowitz__

(sorry for the wrong pastes, they're also redacted/sanitised a bit as it might help other people set up gemini capsules... there's VERY scarce documentation about it online

Feb 11 13:04

schestowitz__

For the time being I have removed ddclient from the pi, seeing that when you set it up it has a wizard for doing all the configs and we might want to use that wizard later. Since new hub was installed no disconnected (yet)

Feb 11 13:08

Techrights-sec

yes, there's scarce documentation because it is in the early stages

Feb 11 13:08

Techrights-sec

if it takes off TR will be in very early too

Feb 11 13:08

Techrights-sec

It'll be interesting to hear if Catalyst2 has a dynamic service available

Feb 11 13:09

schestowitz__

As I mentioned earlier, they said no, will fwd you the mail

Feb 11 13:09

schestowitz__

then, mind me adding some ascii art to main index?

Feb 11 13:09

Techrights-sec

Sure, format it as you wish and I will incorporate it into the script

Feb 11 13:10

schestowitz__

just to be sure, do you get a blank page if entering over www the address gemini.techrights.org? Because to me it gives HUB SETTINGS and I took remote screen grabs of the address just to be sure it shows nothing dodgy to people outside our LAN.

Feb 11 13:11

schestowitz__

200 is OK for one page, depending on the gemini client used (amfora is ok with a dozen links or less)

Feb 11 13:12

Techrights-sec

Bulletin for Saturday, February 06, 2021

Feb 11 13:12

Techrights-sec

That's the first line

Feb 11 13:12

Techrights-sec

There are around 200 articles last month, probably on pace with other

Feb 11 13:13

Techrights-sec

months perhaps that is too long for all in one page?

Feb 11 13:13

schestowitz__

schestowitz__

Hi Roy,

schestowitz__

I've checked this with management and i'm afraid we do not support dynamic DNS. Sorry. There's a fair few free ones that might be of use - https://www.ionos.co.uk/digitalguide/server/tools/free-dynamic-dns-providers-an-overview/

-TechrightsBN/#boycottnovell-www.ionos.co.uk | Free DynDNS | Best free dynamic DNS services - IONOS

schestowitz__

Best regards

schestowitz__

schestowitz__

when you ssh the pi, assuming I keep the records up to date, there's now a domain (updated manually) instead of ip

Feb 11 13:18

Techrights-sec

Ah, thanks for the remininer, I'll fix my ssh_config file

Feb 11 13:20

schestowitz__

to avoid conflicting edits, how are you generating links list for the main index?

Feb 11 13:21

Techrights-sec

The main index was done by hand. I have not an idea about how that one should

Feb 11 13:30

Techrights-sec

be generated. Maybe just the last week's worth plus links to the various months in reverse chronological order?

Feb 11 13:30

schestowitz__

I can do one by piping find into sed and grep, then make it sort of dynamic, with some cron job adding more articles periodically and then another cron job listing the latest?

Feb 11 13:30

Techrights-sec

I'm slowly making one which populates the lower directories.

Feb 11 13:31

schestowitz__

oh, comms important here, to avoid duplicate effort

Feb 11 13:31

Techrights-sec

It can be extended to include the main index, too.

schestowitz__

flatfak of bloated[rant[

schestowitz__

flatpak of bloated[rant]

schestowitz__

flatpak install /home/roy/Desktop/Text_Workspace/images/fi.skyjake.Lagrange.flatpakref

schestowitz__

almost half a gig to download to install some trash

Feb 11 13:33

Techrights-sec

One question is how to keep it in sync. Is a 0-24 hour lag ok?

Feb 11 13:33

Techrights-sec

I would avoid flatpak

Techrights-sec

same for snaps

Techrights-sec

I tried snaps but they accumulate cruft. Old updates never went away

Techrights-sec

and filled up the HD

schestowitz__

I had MANY reservations about this, but I DO need a GUI front end to test with... and all the others are potentially worse, like compiling from source, which I hate doing as it means installing devtools, debugging etc.

Feb 11 13:36

schestowitz__

re update lags, those are modifiable, we can start 24 hrs apaet

Feb 11 13:37

schestowitz__

*apart

Feb 11 13:37

schestowitz__

LOL!!!!! IBM!!!!

schestowitz__

Lagrange: A Beautiful Gemini Client

schestowitz__

[the_Foundation] version: 1.0.0 cstd:201112

schestowitz__

[the_Foundation] locale: en_GB.UTF-8

schestowitz__

SDL init failed: Could not connect to PulseAudio

schestowitz__

After letting it install half a gig (!) of unspecified crap on my system!!

Feb 11 13:40

schestowitz__

"sorry man!!! Can't use gemini to suft the web without a lousy audio stack of LP!! Try another media player man!!"

Feb 11 13:40

Techrights-sec

ok, sounds good

Techrights-sec

ewww

Techrights-sec

While you're in the Rpi, can you please add libpath-iterator-rule-perl to the

Techrights-sec

system?

schestowitz__

installed

Techrights-sec

It's probably tied to systemd too

Techrights-sec

(the lagrange client, that is)

schestowitz__

buster already comes with systemd regardless

Feb 11 13:42

schestowitz__

schestowitz__

are not in the search path set by the XDG_DATA_DIRS environment variable, so

schestowitz__

applications installed by Flatpak may not appear on your desktop until the

schestowitz__

session is restarted.

schestowitz__

schestowitz__

!!!

schestowitz__

IBM(R) Windows(TM)

schestowitz__

"Never mind, issue resolved when PC was rebooted." https://github.com/flathub/org.signal.Signal/issues/122

Feb 11 13:47

-TechrightsBN/#boycottnovell-github.com | Unable to allocate instance id · Issue #122 · flathub/org.signal.Signal · GitHub

Feb 11 13:47

schestowitz__

Windows

Feb 11 13:47

schestowitz__

Turns out there are some Android clients https://en.wikipedia.org/wiki/Gemini_(protocol)#Software

Feb 11 13:52

-TechrightsBN/#boycottnovell-en.wikipedia.org | Gemini (protocol) - Wikipedia

Feb 11 13:52

schestowitz__

This graph says it shot up from almost nothing to a quarter million last year alone https://en.wikipedia.org/wiki/Gemini_space

Feb 11 13:53

-TechrightsBN/#boycottnovell-en.wikipedia.org | Gemini space - Wikipedia

Feb 11 13:53

Techrights-sec

Good, Android, despite its problems, is a very large market.

Feb 11 13:53

schestowitz__

I'm thinking, I can work on linking to the static text objects (bulletins and IRC as text) while you focus on articles as gemini, to avoid conflicting/overlapping work

Feb 11 13:56

schestowitz__

we now have about 1,000 pages at 100MB of disk space for that part, so given the size of the DB, sans markup, we're probably looking at a few GBs for the whole site, excluding multimedia and old IRC logs (before we has text versions of them)

Feb 11 15:58

*asusbox2 (~rianne@2a00:23c4:c3aa:7d01:f203:8cff:fe93:1f55) has joined #boycottnovell

*asusbox has quit (Ping timeout: 240 seconds)

*schestowitz (~schestowi@unaffiliated/schestowitz) has joined #boycottnovell

*ChanServ gives channel operator status to schestowitz

*schestowitz__ has quit (Ping timeout: 264 seconds)

*Techrights-sec has quit (Ping timeout: 272 seconds)

*Techrights-sec (~quassel@2a00:23c4:c3aa:7d01:c5ee:dc42:6b82:466) has joined #boycottnovell

x https://cio.economictimes.indiatimes.com/news/corporate-news/india-sees-improvement-in-online-civility-score-in-2020-microsoft-study/80787768\

schestowitz

-TechrightsBN/#boycottnovell-cio.economictimes.indiatimes.com | CIO News | Enterprise IT, Enterprise Technology, Tech Industry News - ET CIO

x https://cio.economictimes.indiatimes.com/news/corporate-news/india-sees-improvement-in-online-civility-score-in-2020-microsoft-study/80787768

schestowitz

-TechrightsBN/#boycottnovell-cio.economictimes.indiatimes.com | India sees improvement in online civility score in 2020: Microsoft study, IT News, ET CIO