March 2023 - Lug-nuts

[gary@garymcglinn.com: Re: Re: Snort]
by saclug＠garymcglinn.com 14 Sep '23

14 Sep '23

Again sent earlier. Thanks for the intervening comments about vulnerabiliteis and versions. A lot of issues and suggestions have been made and raised. My brief response is that yes, according to nmap and my intention I had port 23, for ssh (I moved it) and port 5900 open and the rpc port, I think. I'm going by memory. Theoretically the only pinhole in the ISP router firewall was port 23. To use port 5900, you had to use an ssh tunnel. My web server is on another machine. Since I only use it for development, I don't leave it up. My actual web pages are hosted externally on a vendor's box. My experience with the upgrade treadmill is that it is a waste of time. By its own admission (if a concept can have that) the new versions will have issues and you need to upgrade. If the issues with an older version don't affect you, then it is perfectly fine to use it. Why upgrade and risk the fact that the new issues will affect your use case. The developers for Fedora 13 were no smarter or dumber than the developers who are writing Fedora 36. Or pick your distro of choice. The issue with an older release is that nifty new things come out and you can't really use them. But, if you run a VM with a recent version of the distro, you can use them just fine. The other issues is that if you are getting vendor support, they can only reasonably commit to supporting a limited number of versions. This is AMD hardware from '06. -Gary On Fri, Aug 05, 2022 at 06:19:54PM -0700, Rick Moen wrote: > Quoting Brian E. Lavender (brian(a)brie.com): > > > Gary, > > > > You were running Fedora 13? > > If so, _that_ is likely a big problem. Fedora 13's initial release was > May 25, 2010, and it was EOLed on June 24, 2011. > > Because Fedora. If you don't want to keep moving to newer versions, > it's about the worst possible distro. (But it's possible Gary meant > that he did _original_ installation 15 years ago, but has been following > the recommended upgrade treadmill^W path. > > Linus Sphinx wrote: > > > https://www.bleepingcomputer.com/news/security/new-linux-malware-brute-forc… > > You know, I have a _lot_ of things to be grateful for, and somewhere on > the list is the glad tidings that I don't need to rely on > Bleepingcomputer.com for IT information. > > Over the past 1.5 months since its discovery, the new botnet used > over 3,500 unique IPs worldwide to scan and attempt brute-forcing Linux > SSH servers. > [...] > The SSH brute-forcing relies on a list of credentials downloaded from > the [command and control server]. [...] > > *snore* > > So, doorknob-twisting for "joe accounts", like user=service > password=manager and like that. > > Guestimate the math, and measure the lengthly setup and teardown times > for remote connections to an sshd, and you'll find that > dictionary-attacking an sshd with any reasonable rules set about > password quality and length is going to take an appreciable fraction of > the time to the heat death of the universe, to succeed. > > I mentioned upthread that a lot of IT device comes from gadget freaks. > The _other_ common problem is that most security _articles_ are > copied-pasted press releases from security/antimalware firms. > So, they're big on shockhorror, and small on conveying understanding. > > I've only quick-glanced at this article about enforcing password policy > via PAM, so won't swear to it being a good one: > https://www.techrepublic.com/article/controlling-passwords-with-pam/ > Of course, if you're the -only- user, you ought to stick to decent > passwords without PAM forcing you to. (Also, a user who can su to > root has the power to overrule PAM. But if you do that, you have only > yourself to blame for consequences.) > > _______________________________________________ > Lug-nuts mailing list -- lug-nuts(a)bigbrie.com > To unsubscribe send an email to lug-nuts-leave(a)bigbrie.com ----- End forwarded message -----

6 12

Re: GTK
by Gary 30 Mar '23

30 Mar '23

Thanks for the idea. It looks interesting. SDL2 is available in my repo. I found this on Stack Exchange: SDL and GTK are quite different in the sense that SDL just tries to provide you with a drawing surface and device inputs. GTK provides you with a user interface toolkit, that is, it provides you with user interface elements such as scrollbars, push buttons and so on. GTK is also quite complex compared to SDL. So I'd definitely go with SDL here. C or C++.. That's a can of worms I'm not going to open I also found comments that SDL is easier and lower level, which seem contradictory to me, but which is consistent with the Stack Exchange post. I only want to capture mouse events a la xdotool, so SDL might be just what I need. I've found some tutorials that aren't Youtube videos, so I'll check it out. -Gary Think the easiest, smoothest path for that might be SDL. On Sat, Mar 25, 2023 at 11:03 AM Gary <saclug(a)garymcglinn.com> wrote: > I'm thinking about writing a small app that uses mouse input. I could do > it in Java pretty quickly, but I thought I would broaden my horizons and > used GTK. I did something with Perl and GTK a very long time ago This > time, I was thinking of using C. Maybe I'll explore C++ or Rust, but for > such a small app, I think it is probably overkill. I never learned C++ and > I'm wondering if I should invest in it or just learn Rust, That is > probably for another day anyhow. > > My question is about GTK versions. Normally, I would just take the most > recent version of GTK and go from there, but it seems like there are > backwards compatibility issues. My devel system seems to have libraries > for 2 and 3 at least. I just ran into a bunch of version incompatibility > issues with XPRA. Am I going to have more that the usual amount of pain > with GTK and should I pick a version other that 4? I am assuming I can > just install 4 on the deployment system and it will happily live with the > other versions. > > -Gary >

2 3

GTK
by Gary 29 Mar '23

29 Mar '23

I'm thinking about writing a small app that uses mouse input. I could do it in Java pretty quickly, but I thought I would broaden my horizons and used GTK. I did something with Perl and GTK a very long time ago This time, I was thinking of using C. Maybe I'll explore C++ or Rust, but for such a small app, I think it is probably overkill. I never learned C++ and I'm wondering if I should invest in it or just learn Rust, That is probably for another day anyhow. My question is about GTK versions. Normally, I would just take the most recent version of GTK and go from there, but it seems like there are backwards compatibility issues. My devel system seems to have libraries for 2 and 3 at least. I just ran into a bunch of version incompatibility issues with XPRA. Am I going to have more that the usual amount of pain with GTK and should I pick a version other that 4? I am assuming I can just install 4 on the deployment system and it will happily live with the other versions. -Gary

2 1

smtp.gmail.com
by Chris Miller 24 Mar '23

24 Mar '23

Hi Folks, I want to use gmail to send myself backup logs, since my mail server is not available during backup. I continue to get a credential error, but the credentials I am using are correct. I suspect that this is the result of "two-factor" authentication, which I am not using on gmail, but which has caused the "allow less secure access" to be disabled. I could use my ISP and configure an "Upstream SMTP-Smart Host", but then I have a detail to remember and reconfigure should I ever change my ISP. Is anybody doing this successfully, without submitting to "Google Workspaces" or "Microsoft Office 365"? Thanks for the help, -- Chris. V:916.799.9461 F:916.974.0428 A: Because we read from top to bottom, left to right. Q: > Why should I start my reply below the quoted text?

3 10

Re: smtp.gmail.com
by Chris Miller 20 Mar '23

20 Mar '23

1 0

any local electronics stores left?
by Brian E. Lavender 09 Mar '23

09 Mar '23

I need to get an USB to 2.1mm Male Barrel Jack Cable. It's similar to the following. https://www.adafruit.com/product/2697 Are there any local stores that sell this? Brian -- Brian Lavender http://www.brie.com/brian/ "There are two ways of constructing a software design. One way is to make it so simple that there are obviously no deficiencies. And the other way is to make it so complicated that there are no obvious deficiencies." Professor C. A. R. Hoare The 1980 Turing award lecture

2 3

2026

2025

2024

2023

2022

Lug-nuts March 2023