March 2024 - Roundtable

Security vulnerability: Watch out for xz
by Alberto Abrao 29 Mar '24

29 Mar '24

Nasty one... https://www.openwall.com/lists/oss-security/2024/03/29/4 https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-…

3 2

MUUG Meeting, Tuesday, Apr 2, 7:30pm (In-person/Hybrid Meeting) -- AllStarLink
by Gilbert Detillieux 27 Mar '24

27 Mar '24

The Manitoba UNIX User Group (MUUG) will be holding its next monthly meeting IN PERSON, on Tuesday, April 2nd, at 7:30pm. Yes, that's the FIRST Tuesday of the month... AllStarLink - Ham Radio over IP AllStarLink is a Radio over IP (RoIP) application based on the popular Asterisk VoIP solution. AllStarLink is designed to connect licensed ham radio transceivers using VoIP protocols to allow extended coverage areas by connecting multiple transceivers at different locations together. Wyatt Zacharias will present on the history of amateur radio repeaters in Manitoba, and how they are being modernized with AllStarLink to use IP networks as the backbone for a connected system. Where to find the Meeting: Fortress Software Inc., 350 Keewatin St -- Unit #2 We have a new in-person meeting location now! Brad Vokey has graciously let us use his work office for our next in-person meeting. The meeting room will be open by 7:00 pm, with the actual meeting starting at 7:30 pm. If driving, enter the lot using the most north east entrance and drive around to the south west corner of the building (see route in map detail on poster linked below). You can use any of the free, ample, and safe parking spots that say "reserved" in front of units #1 through #4 before entering unit #2. Bus stops #30814 and #30880 (route 77) are only 150 meters away. The last bus leaves for Polo Park at 10:15 pm and for Garden City at 10:31 pm. Logan Ave. bus routes #19, #26, and #27 are a 600 meter (8 minute) walk to the south. For those unable or preferring not to attend in person, the meeting will also be available online, using BBB as usual. Stay tuned to our muug.ca home page for the official URL, which will be made available about a half hour before the meeting starts. (Reload the page if you don't see the link, or if there are issues with connecting.) The group now holds its meetings at 7:30pm on the *first* Tuesday of every month from September to June. (There are no meetings in July and August.) Meetings are open to the general public; you don't have to be a MUUG member to attend. For more information about MUUG, and its monthly meetings, check out their web server: https://muug.ca/ Help us promote this month's meeting, by putting this poster up on your workplace bulletin board or other suitable public message board, or linking to it on social media: https://muug.ca/meetings/MUUGmeeting.pdf -- Gilbert E. Detillieux E-mail: <gedetil(a)muug.ca> Manitoba UNIX User Group Web: http://muug.ca/

1 0

git subtree push suddenly got very slow?
by Trevor Cordes 23 Mar '24

23 Mar '24

All of a sudden about a month ago git subtree push from one local repo to another local repo got very slow. (Note: "subtree".) Like 90 secs instead of maybe 15s. Anyone else have this? Any solutions or chatter? I couldn't find anything except years-old chatter, which doesn't seem to apply. This feels like a new thing/bug, not a "I hit a weird corner case".

1 0

Editing long command lines
by Adam Thompson 20 Mar '24

20 Mar '24

I had no idea this shortcut existed! This is an issue for me at least once a month, I hope I remember it next time I need it! https://nuclearsquid.com/writings/edit-long-commands/ -Adam Get Outlook for Android<https://aka.ms/AAb9ysg>

2 1

What do I have to do to get some scam sites shut down?
by Brian Lowe 18 Mar '24

18 Mar '24

Recently I've received SMS alerts regarding package delivery problems directing me to three different scam sites: * completeshipingform.info (note the misspelling) * shipment-overview.info * shipmentsetback.info The sites masquerade as Canada Post and are stealing people's names, addresses, phone numbers, birth dates, and credit card info. They are designed for mobile devices; if the user-agent indicates a desktop browser they redirect to Google. (One can get around this by installing an add-on to spoof the user-agent.) I complained to NameSilo, the registrar. They told me they don't care what's running on the site they've registered. I've filed multiple complaints with Alibaba Cloud, who are apparently hosting these sites. They've done nothing. A chat with customer support indicated they want to get "their side" of the story--that is, the customer who put up the site. This is extremely disingenuous on their part, as it's obvious the sites are scams and exist only to steal information. I'm disappointed and frustrated at the lack of response to thieves and scammers openly operating on the web while the gatekeepers sit aside and do nothing.

4 4

double-natted ssh weirdness
by Trevor Cordes 17 Mar '24

17 Mar '24

I have a double-natted setup on one side (don't ask). I have port-forwarding working all the way through into a linux box behind the double-nat. Can connect great. But certain things seem to make the ssh connection "pause", for like 2-3 mins. It usually recovers and I can continue like nothing ever happened. What triggers it seems to be sudden medium-large output, like if I run an ll or start top. Commands with little output don't seem to affect it, but sometimes they do, especially if the connection has been idle. It'll show me typing the command and then pause when I hit enter. Rang bells, so I look at mss/mtu in past firewall setups and get the iptables magic to clamp the mss. If I install the rule on the box then it seems to make the pause problem go away, mostly. But often after idling the problem will return. As always, I'm hazy on the mss/mtu, and usually solve these with trial and error -- if indeed this is another mss/mtu problem. (The gear involved is all very old.) Instead of just shooting random clamp mss rules in the dark, I thought I'd hit up MUUG for ideas. I'd love to know how you can tell what the mss/mtu has been chosen on a given connection. Also, do I need to run a clamper on both sides? Or maybe other ideas that have nothing to do with mss/mtu? What I've tried so far: iptables -A INPUT -i eth1 -m tcpmss --mss 1397: -p tcp --dport ssh --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1396

2 3

Google cache? Now gone... sort of...
by Gilbert Detillieux 13 Mar '24

13 Mar '24

Another reason to dislike Google: They just quietly eliminated another useful feature. But wait, there's still hope, for now... https://lifehacker.com/tech/google-wont-let-you-check-cached-pages-anymore-… Gilbert

1 0

Fwd: Re: firefox font weirdness?
by Hartmut W Sager 12 Mar '24

12 Mar '24

Furthermore, here's my Firefox settings "fonts, advanced ...": Of those settings, the only one that might have been me is the Times New Roman for serif(ied) font. Hartmut ----- Original message ----- From: Hartmut W Sager <hwsager(a)marityme.net> To: MUUG - Round Table <roundtable(a)muug.ca> Subject: Re: [RndTbl] firefox font weirdness? Date: Friday, March 08, 2024 02:10 Oooh, ouch! I'm very sensitive to crap like that, and it has happened to me a few times over the years. Right now, I'm on (Win 10) Firefox ver 123.0 (nothing after the 0), but it wants to update me, which, in view of what you said, I will try to hold off. Besides, I have about 40 open tabs with unfinished business. I can also look up my Firefox settings on items of specific interest to you, since you can't view pre-123.0.2 settings. My Firefox default font is Times New Roman 16. (Hmmm, did I do that some time ago? - I don't recall, and I typically use Verdana 10 or 12 whenever I don't like someone else's font choice.) I haven't yet looked into all the "inspector" stuff you quoted. Hartmut On Fri 08 Mar 2024 at 01:52:09 -06:00, Trevor Cordes <trevor(a)tecnopolis.ca> wrote: > Has anyone noticed that newer/est(?) Firefox 123 (123.0.2) suddenly made > the fonts all weird in some cases? > > Like the default fonts were changed, and/or entire relaed css definitions > like line height? > > I have a simple web page with no css set and no font settings and it > suddenly looks very different, with the font just "wrong" and line height > set very strangely. If I click webdev inspector it doesn't tell me what > font it's using, so it must be the firefox default. Settings says that's > bitstream vera serif / vera sans. I really have no way to see what the > default was before? > > Worse, a forum site I frequent suddenly has the textarea box go mental on > the font and line height. But only in firefox, and never before v123. > The inspector shows > > font-family: DejaVu Sans Mono,Monaco,Consolas,monospace > > font: 83.33%/150% Segoe UI,Helvetica Neue,Nimubs Sans L,Arial,Liberation > Sans,sans-serif > > (I have no clue what the % prefixes are for in the font setting.) > Inspector says all the heights and related font- stuff is normal. > > The font looks like a decent sans, but in no way is it monospaced as the > family indicates! If I type in numbers, they come out lighter gray (vs > the normal black text), and line height is normal. But if I type a single > letter on a line, all of a sudden that line gets about half-line-height > padding above and below itself! I can send a screenshot if desired. > > In Chromium all of this stuff works and looks normal (as firefox used to). > And the mono font really is mono on that forum textarea. > > Is anyone else have font weirdness with firefox 123? Anything I can try > as a fix? Maybe I'm missing some fonts? The only font-y thing I've done > in the last year is try to get that new Monaspace stuff installed and > working in gnome-terminal, but even that hasn't been toyed with in over a > month. > > If someone has firefox <122 installed still, what are the default fonts in > the settings? > > Thanks! > _______________________________________________ > Roundtable mailing list > Roundtable(a)muug.ca > https://muug.ca/mailman/listinfo/roundtable > _______________________________________________ Roundtable mailing list Roundtable(a)muug.ca https://muug.ca/mailman/listinfo/roundtable

3 10

firefox font weirdness?
by Trevor Cordes 08 Mar '24

08 Mar '24

Has anyone noticed that newer/est(?) Firefox 123 (123.0.2) suddenly made the fonts all weird in some cases? Like the default fonts were changed, and/or entire relaed css definitions like line height? I have a simple web page with no css set and no font settings and it suddenly looks very different, with the font just "wrong" and line height set very strangely. If I click webdev inspector it doesn't tell me what font it's using, so it must be the firefox default. Settings says that's bitstream vera serif / vera sans. I really have no way to see what the default was before? Worse, a forum site I frequent suddenly has the textarea box go mental on the font and line height. But only in firefox, and never before v123. The inspector shows font-family: DejaVu Sans Mono,Monaco,Consolas,monospace font: 83.33%/150% Segoe UI,Helvetica Neue,Nimubs Sans L,Arial,Liberation Sans,sans-serif (I have no clue what the % prefixes are for in the font setting.) Inspector says all the heights and related font- stuff is normal. The font looks like a decent sans, but in no way is it monospaced as the family indicates! If I type in numbers, they come out lighter gray (vs the normal black text), and line height is normal. But if I type a single letter on a line, all of a sudden that line gets about half-line-height padding above and below itself! I can send a screenshot if desired. In Chromium all of this stuff works and looks normal (as firefox used to). And the mono font really is mono on that forum textarea. Is anyone else have font weirdness with firefox 123? Anything I can try as a fix? Maybe I'm missing some fonts? The only font-y thing I've done in the last year is try to get that new Monaspace stuff installed and working in gnome-terminal, but even that hasn't been toyed with in over a month. If someone has firefox <122 installed still, what are the default fonts in the settings? Thanks!

2 1

Chrome blows up the net?
by Trevor Cordes 08 Mar '24

08 Mar '24

So I hit the computer for the first time today and there's not the usual 2-5 Fedora sec update notices, but 356. That's a first. So Google Chrome has a really bad zero-day High CVE-2024-1938: Type Confusion in V8 High CVE-2024-1939: Type Confusion in V8 And these 356 are all this bug. This is very interesting because these just seem like random packages... how can they all have this bug? So it looks like the Chrome stuff got into JDK stuff, and the JDK stuff got into 300+ other things (uh, what?). Strangely, I don't see notices for Chromium or webkit libraries... unless they are coming next. Y'all started using firejail to wrap your Chrome/Chromium in after the Feb MUUG presentation, right?? ?? Add some more height to the histogram I posted of Chrome CVEs... Google: leading the pack. Luckily I mostly use Firefox! The info on these CVEs is currently very limited. If someone has some juicier info on the hole, let us know. CVE-2024-1938 Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High) CVE-2024-1939 Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

2 2