| 00:40.19 | slashbeast | landley: been thinking, whats your opinion about default umask 0022? |
| 00:40.39 | slashbeast | I personaly think that 0077 is far more realistic. |
| 00:48.22 | *** join/#edev JoeLlama (~snork@unaffiliated/joellama) |
| 00:52.41 | *** join/#edev slashbeast (~slashbeas@unaffiliated/slashbeast) |
| 00:59.53 | *** join/#edev anunnaki (~anunnaki@c-174-54-115-236.hsd1.pa.comcast.net) |
| 01:03.52 | *** join/#edev anunnakiii (~anunnaki@c-174-54-115-236.hsd1.pa.comcast.net) |
| 01:52.27 | *** join/#edev prpplague (~prpplague@107-206-64-184.lightspeed.rcsntx.sbcglobal.net) |
| 02:13.20 | *** join/#edev prpplague (~prpplague@107-206-64-184.lightspeed.rcsntx.sbcglobal.net) |
| 02:17.05 | *** join/#edev baba (~fire@unaffiliated/security) |
| 02:24.26 | *** join/#edev mrcan (~mrcan@unaffiliated/mrcan) |
| 02:33.32 | *** join/#edev ccole (~cole@coledd.com) |
| 03:14.47 | *** join/#edev baba (~fire@unaffiliated/security) |
| 04:01.11 | *** join/#edev SpeedEvil (~quassel@tor/regular/SpeedEvil) |
| 04:07.07 | *** join/#edev TheSeven (~quassel@rockbox/developer/TheSeven) |
| 04:25.38 | *** join/#edev CosmicPe- (~nobody@soa.codeaurora.org) |
| 04:25.49 | *** join/#edev metaxa (metaxa@us.members.bombshellz.net) |
| 04:26.03 | *** join/#edev pytey (~pytey@howler.blatero.com) |
| 04:26.03 | *** join/#edev uwe_mobile (~uwe@static.88-198-8-117.clients.your-server.de) |
| 04:26.24 | *** join/#edev djinni (~djinni@li125-242.members.linode.com) |
| 04:26.24 | *** join/#edev _av500_ (~av500@lgf.archos.com) |
| 04:26.34 | *** join/#edev itdnhr (~quassel@64.31.59.70) |
| 04:26.34 | *** join/#edev Belliash (belliash@asiotec/constitutive/belliash) |
| 04:26.34 | *** join/#edev CosmicPe| (~nobody@soa.codeaurora.org) |
| 04:26.45 | *** join/#edev kergoth (~kergoth@covenant.kergoth.com) |
| 04:27.01 | *** join/#edev bsdfox (~Bob@unaffiliated/bsdfox) |
| 04:27.01 | *** join/#edev nullpuppy (~dustin@freematrix/staff/nullpuppy) |
| 04:27.01 | *** join/#edev blueness (~hnsctq40@gentoo/developer/blueness) |
| 04:27.15 | *** join/#edev landley (~landley@chippewa-nat.cray.com) |
| 04:27.15 | *** join/#edev dfarnsworth (~dfarnswor@xyzzy.zeniff.com) |
| 04:27.15 | *** join/#edev sjhill (~sjhill@home.bethel-hill.org) |
| 04:27.15 | *** mode/#edev [+o sjhill] by moorcock.freenode.net |
| 04:27.25 | *** join/#edev anunnaki (~anunnaki@c-174-54-115-236.hsd1.pa.comcast.net) |
| 04:27.26 | *** join/#edev mrcan (~mrcan@unaffiliated/mrcan) |
| 04:27.26 | *** join/#edev ikona_ (~ikona@e181101071.adsl.alicedsl.de) |
| 04:27.26 | *** join/#edev iospace (alex@wikipedia/Alexandria) |
| 04:27.26 | *** join/#edev roland (~quassel@218.223.196.88.sta.estpak.ee) |
| 04:27.26 | *** join/#edev gandhijee_ (~akp@50-195-36-113-static.hfc.comcastbusiness.net) |
| 04:27.26 | *** join/#edev calculus (~calculus@gentoo/user/calculus) |
| 04:27.37 | *** join/#edev jackmitchell (~Thunderbi@195.171.99.130) |
| 04:27.37 | *** join/#edev file (~file@asterisk/developer-and-muffin-lover/file) |
| 04:27.42 | *** join/#edev prpplague (~prpplague@107-206-64-184.lightspeed.rcsntx.sbcglobal.net) |
| 04:27.42 | *** join/#edev slashbeast (~slashbeas@unaffiliated/slashbeast) |
| 04:27.42 | *** join/#edev uwe_ (~uwe_@dslb-188-105-024-052.pools.arcor-ip.net) |
| 04:27.43 | *** join/#edev jonmasters (~jcm@edison.jonmasters.org) |
| 04:27.50 | *** join/#edev RushPL (~quassel@2a01:4f8:151:73a3::2) |
| 04:27.50 | *** join/#edev n17ikh (~n17ikh@unaffiliated/n17ikh) |
| 04:27.50 | *** join/#edev mnemoc (~amery@geeks.cl) |
| 04:27.50 | *** join/#edev keesj (~keesj@dellpc132.few.vu.nl) |
| 04:27.56 | *** join/#edev jackmitchell (~Thunderbi@195.171.99.130) |
| 04:59.36 | *** join/#edev [7] (~quassel@rockbox/developer/TheSeven) |
| 05:41.58 | *** join/#edev mbuf (user@nat/redhat/x-tqisvfuytdjvxnrf) |
| 06:31.15 | *** join/#edev megha (~fire@unaffiliated/security) |
| 06:46.11 | *** join/#edev JoeLlama (~snork@unaffiliated/joellama) |
| 07:02.26 | *** join/#edev pvanhoof (~philip@codeminded.be) |
| 07:13.54 | *** join/#edev landley (~landley@chippewa-nat.cray.com) |
| 07:43.47 | *** join/#edev anunnaki (~anunnaki@c-174-54-115-236.hsd1.pa.comcast.net) |
| 08:14.46 | *** join/#edev pvanhoof (~philip@codeminded.be) |
| 08:17.23 | *** join/#edev clio (~andrej@85.159.109.222) |
| 09:00.29 | *** join/#edev flo_lap (~fuchs@Maemo/community/contributor/florian) |
| 10:08.15 | Shinda | hello |
| 10:12.09 | *** join/#edev florian_kc (~fuchs@Maemo/community/contributor/florian) |
| 11:45.34 | *** join/#edev g1powermac (~g1powerma@unaffiliated/g1powermac) |
| 12:10.37 | *** join/#edev florian_kc (~fuchs@Maemo/community/contributor/florian) |
| 12:35.23 | *** join/#edev Crofton (~balister@pool-96-240-188-95.ronkva.east.verizon.net) |
| 14:45.09 | *** join/#edev mrcan_ (~mrcan@78.173.24.21) |
| 14:45.10 | *** join/#edev mrcan_ (~mrcan@unaffiliated/mrcan) |
| 14:55.45 | *** join/#edev GPSFan (~kenm@64.92.145.112) |
| 14:55.46 | *** mode/#edev [+o GPSFan] by ChanServ |
| 15:01.58 | *** join/#edev gustavoz (~gustavoz@host132.190-136-125.telecom.net.ar) |
| 15:02.33 | *** join/#edev Crofton|work (~balister@pool-96-240-188-95.ronkva.east.verizon.net) |
| 15:18.48 | landley | I hate firefox. |
| 15:20.33 | _av500_ | landley: use chrome |
| 15:21.18 | kergoth | i switch every couple months, get pissed off at whatever browser i'm using, then move on to the next, coming back around to the first again periodically.. they all suck to various degrees imo |
| 15:21.26 | kergoth | heh |
| 15:21.31 | landley | I do. But the "you do not have root on this machine" setup with the horrible locked-down gnome menu uses firefox. |
| 15:21.42 | landley | kergoth: I know how to beat chrome into submission. |
| 15:21.46 | landley | You can kill tabs by PID. |
| 15:22.03 | _av500_ | dead tbs can be killed by clicking on the x, no? |
| 15:22.06 | _av500_ | tabs* |
| 15:22.34 | landley | I have a script that runs to to spit out a page of processes sorted by CPU usage, runs it through grep and awk to find chrome tabs that aren't using "0.0%", and kills them. |
| 15:22.57 | landley | I can also sort by memory usage and kill hogs that way. |
| 15:23.07 | kergoth | what bugs me about chrome is it has no capability to load tabs on demand rather than at startup. restarting gets a bit lagged if the tab count gets too high |
| 15:23.35 | landley | No, my problem with firefox is it crashed overnight again, and after carefully editing my tab list to unclick the tabs I don't need to reopen, "start new session" does not reopen tabs and there's no undo for that. |
| 15:24.11 | landley | And I'd just finished commenting that firefox has no "bookmark all these tabs" option. It's reopen them all or lose them. |
| 15:24.25 | _av500_ | kergoth: load tabs on demand? like bookmarks? |
| 15:24.27 | landley | And my locked down workstation won't let me temporarily switch network access off, which is my other workaround there. |
| 15:24.28 | kergoth | ugh. there's extensions that help with that. iirc Session Manager saves a backlog of previous sessions you can restore |
| 15:25.00 | kergoth | _av500_: no, I meant when the tab is focused |
| 15:25.56 | _av500_ | ah |
| 15:26.26 | _av500_ | is not a tab junkie |
| 15:26.56 | landley | sjhill: hello. You pinged me after I went home yesterday, looks like. :) |
| 15:28.15 | landley | slashbeast: I think that having multiple actual users on modern machines without containers is anachronistic? |
| 15:28.23 | landley | So it's "root/not root" that's the interesting one. |
| 15:29.30 | landley | _av500_ if the one monolithic process hasn't locked solid waiting for the flash plugin, sure. |
| 15:29.49 | landley | If you can figure out which tab is using 50% of all memory and pegging the cpu at 100% while you're on battery. |
| 15:30.05 | landley | As individual processes, doing that's trivial. |
| 15:32.52 | slashbeast | landley: you mean lxc containers? |
| 15:33.10 | slashbeast | they aren't taht good and for sure aren't proper security solution |
| 15:33.39 | slashbeast | landley: the thing is, if you run a server that have multiple users, the default umask making some logs wolrd readable etc is pure stupidness. |
| 15:34.23 | slashbeast | landley: and re: containers, I know a lot of ways how to harm host-system from withing a lxc guest. |
| 15:34.31 | slashbeast | including with gaining root on host |
| 15:34.56 | slashbeast | and since there is no 'user' cgroup you cant 'fix' it. |
| 16:05.57 | jackmitchell | landley: there is a tab manager somewhere for firefox which is a lifesaver |
| 16:06.37 | landley | slashbeast: I mean the namespaces and cgroups functionality. lxc is just one userspace control package for it, and it's one made by mainframe punchcard guys so it's a bit... administration-heavy. |
| 16:07.06 | landley | If you run a server with multiple users, these days you use openvz or similar. (Which is also containers.) |
| 16:07.47 | jackmitchell | landley: https://addons.mozilla.org/en-US/firefox/addon/tab-mix-plus/ |
| 16:12.04 | landley | jackmitchell: if I could install that, I could probably just install chrome. |
| 16:12.18 | landley | Locked down workstation. |
| 16:12.30 | landley | Impolite to poke at the cracks, really. |
| 16:14.07 | _av500_ | landley: your dev station is locked down? |
| 16:21.33 | slashbeast | landley: nope, when you run such server yo usualy use something like RBAC |
| 16:21.44 | slashbeast | landley: but I am also aware how you refuse to even thing about grsecurity ;p |
| 16:25.12 | landley | slashbeast: no, when _you_ run such server. :) |
| 16:26.25 | landley | Making security controls more granular and making a system more secure really aren't the same thing. |
| 16:27.46 | *** join/#edev prpplague (~danders@192.91.66.186) |
| 16:27.51 | landley | Any security approach that involves thinking of every possible corner case and being more familiar with the idiosyncrasies of behavior than the hordes of anonymous on the internet at large... I have trouble trusting such approaches, categorically. |
| 16:28.43 | landley | You don't make a submarine by grabbing an ordinary room, hunting for cracks and grouting them. |
| 16:52.30 | *** join/#edev baba (~fire@unaffiliated/security) |
| 17:34.12 | *** join/#edev Shinda_ (~Loup@unaffiliated/toroop) |
| 17:35.49 | *** join/#edev pvanhoof (~philip@codeminded.be) |
| 17:51.27 | *** join/#edev keesj (~keesj@dellpc132.few.vu.nl) |
| 17:55.18 | slashbeast | landley: you generalize grsec without even briefly checking on it |
| 17:56.24 | slashbeast | ;you would see in how many aspects the mainline kernel is insecure |
| 18:13.50 | *** join/#edev sndcrb (~sndcrb@cs181245200.pp.htv.fi) |
| 18:18.57 | *** join/#edev florian (~fuchs@sign-4db6b69f.pool.mediaWays.net) |
| 18:18.58 | *** join/#edev florian (~fuchs@Maemo/community/contributor/florian) |
| 18:26.10 | *** join/#edev _av500_ (~av500@lgf.archos.com) |
| 18:33.39 | *** join/#edev NightMonkey (~NightrMon@pdpc/supporter/professional/nightmonkey) |
| 18:37.12 | landley | slashbeast: I read its wikipedia page. I realize this isn't an in-depth dig, but I dug into pax circa 2010. |
| 18:38.56 | slashbeast | pax is a part of grsec indeed |
| 18:39.23 | slashbeast | trusted path exec, memory protection and more, its really something awesome. |
| 18:39.51 | slashbeast | dening doublechroot, forcing chdir"/" for chroot, there are quite a lot of features. |
| 18:40.26 | slashbeast | including proper /proc protection so users' cannot view each other environ or cmdline which could, for example, contain a password |
| 18:41.06 | slashbeast | I run grsecurity in production for at least 6 years and I cannot think about not doing so, unless I must use openvz which is not compatible with mainline nor grsec. |
| 18:44.35 | landley | slashbeast: you give shell access to multiple users in the same container and can't think about not doing so, yes. |
| 18:44.58 | landley | openvz is not compatible with mainline, that's why its features are being ported to vanilla. Still ongoing, that. |
| 19:06.50 | *** join/#edev ikona__ (~ikona@e181098183.adsl.alicedsl.de) |
| 19:17.01 | *** join/#edev mrcan (~mrcan@unaffiliated/mrcan) |
| 19:27.47 | slashbeast | landley: container grants me isolation between users, not enhance system security. |
| 19:27.57 | slashbeast | landley: inside container user still can run exploits and such |
| 19:31.46 | slashbeast | landley: you can for example use /proc/sys/kernel/core_pattern to execute a code on host, outside container, and you can't do anything about it because there is no prevention for it within kernel. |
| 19:31.51 | slashbeast | here's come grsecurity. |
| 19:32.20 | slashbeast | and yes I give a shell access to multiple users because I need to, on staging dev boxes for example |
| 19:32.56 | slashbeast | And I presume they have no idea about security so I prevent them from touching each-other files, I also presume they are harmful so I hardend the system as good as I can. |
| 19:55.28 | *** join/#edev pvanhoof (~philip@codeminded.be) |