IRC: #techbytes @ FreeNode: Tuesday, June 08, 2021

schestowitz

>>>

>>> http://techrights.org/2021/06/07/censorship-of-epo-stakeholders/

schestowitz

schestowitz

>> Where? The background image?

-TechBytesBot/#techbytes-techrights.org | The EPO’s Censorship of Stakeholders is a Misguided Case of Digging One’s Own Grave | Techrights

schestowitz

> The one attached.

schestowitz

Ah, I do not know that place by name.

https://lists.orbitalfox.eu/archives/gemini/2021/006648.html

*asusbox has quit (Ping timeout: 240 seconds)

Jun 08 09:09

*asusbox (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 09:09

*asusbox has quit (Ping timeout: 258 seconds)

Jun 08 09:17

*rianne has quit (Ping timeout: 255 seconds)

Jun 08 09:17

*asusbox (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 09:32

*rianne (~rianne@2a00:23c4:c3aa:7d01:3424:c2fa:ee24:c4e0) has joined #techbytes

Jun 08 09:33

*GNUmoon2 has quit (Ping timeout: 240 seconds)

Jun 08 09:55

*rianne has quit (Ping timeout: 245 seconds)

Jun 08 10:30

*asusbox has quit (Ping timeout: 245 seconds)

Jun 08 10:31

*asusbox (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 10:36

*rianne (~rianne@2a00:23c4:c3aa:7d01:3424:c2fa:ee24:c4e0) has joined #techbytes

Jun 08 10:37

*asusbox has quit (Ping timeout: 258 seconds)

Jun 08 10:43

*rianne has quit (Ping timeout: 260 seconds)

Jun 08 10:44

*GNUmoon2 (~GNUmoon@gateway/tor-sasl/gnumoon) has joined #techbytes

Jun 08 10:49

*rianne (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 11:59

*asusbox (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 11:59

schestowitz

-TechBytesBot/#techbytes-lists.orbitalfox.eu | [tech] Agate server: path traversal error security advisory

schestowitz

Hi everyone,

schestowitz

there is a security vulnerability in all Agate versions prior to 3.1.0, which has been discovered by Matthew Ingwersen.

schestowitz

It has been fixed in the new version which is available on crates.io, prebuilt binaries are also available: <https://qwertqwefsday.eu/agate/v3.1.0/> or <https://github.com/mbrubeck/agate/releases/tag/v3.1.0>

-TechBytesBot/#techbytes-qwertqwefsday.eu | Index of /agate/v3.1.0/

schestowitz

Percent-encoded slashes were misunderstood, possibly allowing arbitrary files to be accessed. This can be an issue depending on with which permissions and/or user you are running the server. Therefore an update is highly recommended.

-TechBytesBot/#techbytes-github.com | Release v3.1.0 · mbrubeck/agate · GitHub

schestowitz

Regards,

schestowitz

I am not to all this, have just caught up

schestowitz

can we not just swap the binary in place? It's in ~/bin

Techrights-sec

yes, the binary can be swapped but then the key and certificate

Jun 08 12:22

Techrights-sec

must first be converted to der format or else replaced with new ones

Jun 08 12:22

schestowitz

is there a Web page that explains why?

Jun 08 12:23

*asusbox has quit (Ping timeout: 240 seconds)

Jun 08 12:26

*rianne has quit (Ping timeout: 255 seconds)

Jun 08 12:26

*asusbox (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 12:28

*rianne (~rianne@2a00:23c4:c3aa:7d01:3424:c2fa:ee24:c4e0) has joined #techbytes

Jun 08 12:28

*asusbox2 (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 12:34

*asusbox has quit (Ping timeout: 258 seconds)

Jun 08 12:35

*asusbox2 has quit (Read error: No route to host)

Jun 08 12:37

*asusbox2 (~rianne@2a00:23c4:c3aa:7d01:3424:c2fa:ee24:c4e0) has joined #techbytes

Jun 08 12:37

Techrights-sec

yes, the binary can be swapped but then the key and certificate

Techrights-sec

must first be converted to der format or else replaced with new ones

Techrights-sec

not that I know of. Sometime between now and the last (overdue) update

Techrights-sec

Agate has changed the expected format of the private key and the certificate

Techrights-sec

I'm sure it's an easy conversion for someone that knows how

*asusbox2 has quit (Ping timeout: 260 seconds)

Techrights-sec

Aside from the matter of the cert and key, the following works:

Techrights-sec

gemini@raspberrypi:~/certs $ ./agate.armv7-unknown-linux-gnueabihf.new --content /home/gemini/gemini/ --certs /home/gemini/certs

Techrights-sec

(copy-paste error with the path above)

Techrights-sec

(it's in ~/bin/ really)

*rianne has quit (Ping timeout: 245 seconds)

schestowitz

I welcome you having a poke and breaking some things in the process. Totally understandable. Just let's ensure we keep copies of any changed config files and older binaries that can be reverted back to.

Jun 08 12:51

Techrights-sec

I hope I have not changed anything, there would just be the addition of the new binary and the new directory holding the certs.

Jun 08 12:53

Techrights-sec

So things are hopefully not broken and the old Agate is still running.

Jun 08 12:53

schestowitz

I can access everything OK at the moment and have it monitored for any errors

Jun 08 12:53

Techrights-sec

Yes, that would be the old Agate. The new one will compain about

Techrights-sec

new, untrusted certs until I can learn the trivial task of converting

Techrights-sec

to der from pem.

schestowitz

Oh, I see...

*asusbox2 (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 13:03

*rianne (~rianne@2a00:23c4:c3aa:7d01:3424:c2fa:ee24:c4e0) has joined #techbytes

Jun 08 13:03

*asusbox2 has quit (Ping timeout: 258 seconds)

Jun 08 13:24

*rianne has quit (Ping timeout: 260 seconds)

Jun 08 13:25

*asusbox2 (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 13:36

*rianne (~rianne@2a00:23c4:c3aa:7d01:3424:c2fa:ee24:c4e0) has joined #techbytes

Jun 08 13:37

*asusbox2 has quit (Quit: Konversation terminated!)

Jun 08 13:44

*asusbox2 (~rianne@2a00:23c4:c3aa:7d01:a5d6:c2f1:c89e:ea6e) has joined #techbytes

Jun 08 13:44

*rianne has quit (Ping timeout: 245 seconds)

Jun 08 13:48

*rianne (~rianne@2a00:23c4:c3aa:7d01:a5d6:c2f1:c89e:ea6e) has joined #techbytes

Jun 08 14:01

*asusbox (~rianne@2a00:23c4:c3aa:7d01:a5d6:c2f1:c89e:ea6e) has joined #techbytes

Jun 08 14:09

*asusbox2 has quit (Ping timeout: 260 seconds)

Jun 08 14:12

*rianne has quit (Ping timeout: 260 seconds)

Jun 08 14:36

*asusbox has quit (Ping timeout: 245 seconds)

Jun 08 14:36

*tr-bridge (~tr-bridge@meowr.ru) has joined #techbytes

Jun 08 14:45

Techrights-sec

This is supposed to work, but does not:

Techrights-sec

openssl pkey -outform der -in key.pem -out key.der

Techrights-sec

Agate then reports that the resulting der file is malformed.

Techrights-sec

back in a bit

Techrights-sec

back

Techrights-sec

should we just go with a new key+cert combination?

Techrights-sec

sudo systemctl stop agate.service ;

Techrights-sec

~/bin/agate.armv7-unknown-linux-gnueabihf.new \

Techrights-sec

--content /home/gemini/gemini/ \

Techrights-sec

--certs /home/gemini/certs/ \

Techrights-sec

--hostname gemini.techrights.org \

Techrights-sec

--lang en-GB \

Techrights-sec

|| sudo systemctl start agate.service

schestowitz

yes, no harm changing certs/keys if needed

*rianne (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 15:47

*asusbox (~rianne@2a00:23c4:c3aa:7d01:a5d6:c2f1:c89e:ea6e) has joined #techbytes

Jun 08 15:51

*asusbox2 (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 16:10

*asusbox has quit (Ping timeout: 260 seconds)

Jun 08 16:11

Techrights-sec

ok, then I'll just let the new version make a new key + certificate

Jun 08 16:14

schestowitz

seems reasonable if agate as a whole moved away to a different kind of pair standard

Jun 08 16:14

*rianne has quit (Ping timeout: 240 seconds)

Jun 08 16:19

*asusbox2 has quit (Ping timeout: 258 seconds)

Jun 08 16:19

Techrights-sec

the new version is in place, along with the new key and certificate

Jun 08 16:20

Techrights-sec

the unit file is also updated

Jun 08 16:20

Techrights-sec

/etc/systemd/system/agate.service

Jun 08 16:20

schestowitz

fantastic, I will mention that the key+cert pair had changed, not that I can see any of 4 gemini clients blocking the capsule, just moaning about it. Only moonlander is completely freaking out about this and not letting me through

Jun 08 16:23

schestowitz

LOL, moonlander does not even have the option of bypassing this, not even application restart. But it's an alpha version. Upside it, we might have a better agate version now, wonder if new features are available. Sooner or later we'd have had to deal with the standard conversions I suppose...

Jun 08 16:29

*asusbox2 (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 16:31

*rianne (~rianne@2a00:23c4:c3aa:7d01:a5d6:c2f1:c89e:ea6e) has joined #techbytes

Jun 08 16:32

*asusbox2 has quit (Quit: Konversation terminated!)

Jun 08 16:37

*asusbox (~rianne@2a00:23c4:c3aa:7d01:a5d6:c2f1:c89e:ea6e) has joined #techbytes

Jun 08 16:37

*asusbox2 (~rianne@2a00:23c4:c3aa:7d01:a5d6:c2f1:c89e:ea6e) has joined #techbytes

Jun 08 16:40

*asusbox has quit (Ping timeout: 245 seconds)

Jun 08 16:42

Techrights-sec

I'm not sure any of the clients have a provision for verifying new certs

Techrights-sec

It would have been best to just convert the old cert + key but there

Techrights-sec

is no accurate information about how to do that anywhere I could find

Techrights-sec

in a few hours wasted checking mailing list archives and whatnot

Techrights-sec

also OpenSSL is a little complex to put it mildly

schestowitz

sounds like a conversion or migration was inevitable though if agate made a change in direction, so it's good to leave that behind sooner rather than later

Jun 08 17:07

*asusbox (~rianne@2a00:23c4:c3aa:7d01:a5d6:c2f1:c89e:ea6e) has joined #techbytes

Jun 08 17:11

*asusbox2 has quit (Ping timeout: 260 seconds)

Jun 08 17:14

schestowitz

I've just announced the change, let's hope it's the last before the pi dies http://techrights.org/2021/06/08/updating-our-keys/

Jun 08 17:22

-TechBytesBot/#techbytes-techrights.org | Announcement: Updating Our Keys (Don’t Be Alarmed by Warnings) | Techrights

Jun 08 17:22

*asusbox has quit (Ping timeout: 260 seconds)

Jun 08 17:32

*rianne has quit (Ping timeout: 245 seconds)

Jun 08 17:32

schestowitz

64924 gemini reqs so far this month, mostly spiders, I just hope the warnings won't deter too many people. in moonlander only it's not possible to bypass. as i noted before, morever, seems liek sooner or later, we'd have had to make the change, so better do that asap to limit the technical debt so to speak

Jun 08 17:51

Techrights-sec

better sooner than later, it is done now. I would hope that the

Jun 08 17:55

Techrights-sec

documentation catches up

Jun 08 17:55

schestowitz

if you have some notes/cheat cheets, then we can publish these to help others, we already how manuals for setting up agate

schestowitz

*sheets

Techrights-sec

nothing useful, there were some things which looked promising but

Techrights-sec

did not actually work

*asusbox (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 18:04

*rianne (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 18:04

*liberty_box has quit (Ping timeout: 245 seconds)

Jun 08 18:16

*rianne__ has quit (Ping timeout: 272 seconds)

Jun 08 18:16

*asusbox has quit (Quit: Konversation terminated!)

Jun 08 18:17

*asusbox (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 18:18

*rianne__ (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 18:24

*asusbox2 (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 18:26

*liberty_box (~liberty@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 18:28

*asusbox has quit (Ping timeout: 258 seconds)

Jun 08 18:30

*rianne__ has quit (Remote host closed the connection)

Jun 08 19:15

*rianne__ (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 19:16

*asusbox2 has quit (Quit: Konversation terminated!)

Jun 08 19:42

*asusbox2 (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 19:42

*asusbox2 has quit (Quit: Konversation terminated!)

Jun 08 19:48

*asusbox2 (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 19:48

Techrights-sec

The issues we encountered were Agate-specific:

https://gemini.circumlunar.space/docs/tls-tutorial.gmi

Techrights-sec

Techrights-sec

so the tls-tutorial won't address it. Though key and certificate formats

Techrights-sec

are of general importance.

Techrights-sec

the output of the following ought to be included in the most recent post

Techrights-sec

about Gemini:

-TechBytesBot/#techbytes-gemini.circumlunar.space | TLS, client certificates, TOFU, and all that jazz

Techrights-sec

$ openssl x509 -inform der -in cert.der -text -noout

https://twitter.com/benbfranklin/status/1402239324071108608

Techrights-sec

That way people can verify manually.

Jun 08 20:26

Techrights-sec

kind of

Jun 08 20:26

Techrights-sec

afk

Jun 08 20:26

*asusbox (~rianne@2a00:23c4:c3aa:7d01:a5d6:c2f1:c89e:ea6e) has joined #techbytes

Jun 08 21:12

*asusbox2 has quit (Ping timeout: 240 seconds)

Jun 08 21:14

*asusbox has quit (Quit: Konversation terminated!)

Jun 08 21:31

*asusbox (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 21:33

*asusbox2 (~rianne@2a00:23c4:c3aa:7d01:a5d6:c2f1:c89e:ea6e) has joined #techbytes

Jun 08 21:55

*asusbox has quit (Ping timeout: 258 seconds)

Jun 08 21:58

*asusbox2 has quit (Quit: Konversation terminated!)

Jun 08 22:01

*asusbox (~rianne@host81-154-169-167.range81-154.btcentralplus.com) has joined #techbytes

Jun 08 22:01

*rianne has quit (Ping timeout: 245 seconds)

Jun 08 22:12

*asusbox has quit (Ping timeout: 272 seconds)

Jun 08 22:13

schestowitz

-TechBytesBot/#techbytes-@benbfranklin: @schestowitz AFAIK IBM didn't try to point the redhat Crew in IBM blue, but that information is a bit old.

https://twitter.com/JenniferNOTL/status/1402232809905852419

schestowitz

-TechBytesBot/#techbytes-@JenniferNOTL: Tons of lies here https://t.co/4RvejqtYqr

-TechBytesBot/#techbytes-@schestowitz: There is no solution to the GOP's #vaccine refusal https://t.co/nYKyBHJcH2

https://twitter.com/pceebee23/status/1402230793628393476

schestowitz

-TechBytesBot/#techbytes-@pceebee23: @schestowitz as do computer/phone users need the right to repair their equipment #RightToRepair is going to be a big fight nasty long fight

https://twitter.com/glynmoody/status/1402172963907063810

schestowitz

-TechBytesBot/#techbytes-@glynmoody: .@WordPress Economy Drives More Than Half a Trillion in Revenue, New Global Study Shows - https://t.co/SWa587x4xo… https://t.co/r7sxTf1UvN

schestowitz

schestowitz

Economy Drives More Than Half a Trillion in Revenue, New Global Study Shows - https://businesswire.com/news/home/20210607005793/en/ another incredible result for #opensource software: half trillion dollars based on a free program (v @schestowitz

-TechBytesBot/#techbytes-www.businesswire.com | WordPress Economy Drives More Than Half a Trillion in Revenue, New Global Study Shows | Business Wire

schestowitz

)

schestowitz

https://twitter.com/iridesce57/status/1402067505573736454

schestowitz

-TechBytesBot/#techbytes-@iridesce57: @schestowitz :smile: underscores are my friends

https://twitter.com/ArthurDungasCuz/status/1402059131809239055

schestowitz

-TechBytesBot/#techbytes-@ArthurDungasCuz: will stick with @debian https://t.co/1votSxIAre

-TechBytesBot/#techbytes-@schestowitz: #IBM is Doing to #RedHat What #Novell Did to #SUSE (and People Are Leaving) • 𝔗𝔢𝔠𝔥𝔯𝔦𝔤𝔥𝔱𝔰 ⚓ https://t.co/EzgbqnlxnD… https://t.co/EZsbvcvQPx

https://twitter.com/ArtBrowski/status/1401992685695782918

schestowitz

-TechBytesBot/#techbytes-@ArtBrowski: @schestowitz If you get down on the floor and play with a toddler they don’t care if you own 10 cars and 20 boats… https://t.co/88vfQne0la

-TechBytesBot/#techbytes-@ArtBrowski: @schestowitz If you get down on the floor and play with a toddler they don’t care if you own 10 cars and 20 boats… https://t.co/88vfQne0la

schestowitz

schestowitz

If you get down on the floor and play with a toddler they don’t care if you own 10 cars and 20 boats

schestowitz

For 100,000 years problem has been jealousy

schestowitz