Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #237388 > unrolled thread

Re: MDs & Dentists

Back to article view | Back to linux.debian.user

Contents

  Re: MDs & Dentists Charlie Gibbs <cgibbs@surfnaked.ca> - 2021-07-14 17:40 +0200
    Re: MDs & Dentists Jude DaShiell <jdashiel@panix.com> - 2021-07-14 20:30 +0200
      Re: MDs & Dentists John Hasler <john@sugarbit.com> - 2021-07-14 21:30 +0200
        Re: MDs & Dentists Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-07-15 00:30 +0200
      Re: MDs & Dentists ellanios82 <ellanios82@gmail.com> - 2021-07-14 21:50 +0200
        Re: MDs & Dentists Weaver <weaver@riseup.net> - 2021-07-14 22:00 +0200
          Re: MDs & Dentists Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-07-15 00:40 +0200
            Re: MDs & Dentists Weaver <weaver@riseup.net> - 2021-07-15 01:00 +0200
              Re: MDs & Dentists Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-07-15 01:40 +0200
              Re: MDs & Dentists Weaver <weaver@riseup.net> - 2021-07-15 02:40 +0200
                Re: MDs & Dentists Gene Heskett <gheskett@shentel.net> - 2021-07-15 03:20 +0200
                Re: MDs & Dentists Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-07-15 04:00 +0200
                  Re: MDs & Dentists Weaver <weaver@riseup.net> - 2021-07-15 04:00 +0200
                    Re: MDs & Dentists Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-07-15 04:10 +0200
        Re: MDs & Dentists Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-07-15 00:30 +0200
          Re: MDs & Dentists jeremy ardley <jeremy@ardley.org> - 2021-07-15 01:10 +0200
            Re: MDs & Dentists jeremy ardley <jeremy@ardley.org> - 2021-07-15 02:30 +0200
              Re: MDs & Dentists Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-07-15 04:00 +0200
            Re: MDs & Dentists Stefan Monnier <monnier@iro.umontreal.ca> - 2021-07-15 03:50 +0200
              Re: MDs & Dentists Weaver <weaver@riseup.net> - 2021-07-15 04:00 +0200
            Re: MDs & Dentists ellanios82 <ellanios82@gmail.com> - 2021-07-15 09:50 +0200
              Re: MDs & Dentists Jeremy Ardley <jeremy@ardley.org> - 2021-07-15 10:10 +0200
              Re: MDs & Dentists Weaver <weaver@riseup.net> - 2021-07-15 10:10 +0200
            Re: MDs & Dentists Joe <joe@jretrading.com> - 2021-07-15 11:40 +0200
              Re: MDs & Dentists <tomas@tuxteam.de> - 2021-07-15 12:30 +0200
          Re: MDs & Dentists Reco <recoverym4n@enotuniq.net> - 2021-07-15 08:50 +0200
            Re: MDs & Dentists Celejar <celejar@gmail.com> - 2021-07-20 17:40 +0200
              Re: MDs & Dentists Reco <recoverym4n@enotuniq.net> - 2021-07-21 10:20 +0200
                Re: MDs & Dentists Celejar <celejar@gmail.com> - 2021-07-21 17:00 +0200
                  Re: MDs & Dentists Reco <recoverym4n@enotuniq.net> - 2021-07-21 17:40 +0200
                    Re: MDs & Dentists Dan Ritter <dsr@randomstring.org> - 2021-07-21 18:00 +0200
                      Re: MDs & Dentists Gunnar Gervin <dofeelok@gmail.com> - 2021-08-01 15:40 +0200
                        Re: MDs & Dentists "Andrew M.A. Cater" <amacater@einval.com> - 2021-08-01 16:00 +0200
                          Re: MDs & Dentists Gunnar Gervin <dofeelok@gmail.com> - 2021-08-01 16:00 +0200
                            Re: MDs & Dentists rhkramer@gmail.com - 2021-08-01 18:30 +0200
                            Re: MDs & Dentists "Andrew M.A. Cater" <amacater@einval.com> - 2021-08-01 19:10 +0200
                            Re: MDs & Dentists Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-08-01 22:30 +0200
                            Re: MDs & Dentists Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-08-01 22:50 +0200
                              Re: MDs & Dentists Gunnar Gervin <dofeelok@gmail.com> - 2021-08-02 15:00 +0200
                              Re: MDs & Dentists Gunnar Gervin <dofeelok@gmail.com> - 2021-08-02 15:00 +0200
                          Re: MDs & Dentists Dan Ritter <dsr@randomstring.org> - 2021-08-01 18:00 +0200
                      Re: MDs & Dentists Gunnar Gervin <dofeelok@gmail.com> - 2021-08-01 15:50 +0200
                        Hard to understand, being clear [ was Re: MDs & Dentists] Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-08-01 22:40 +0200
                          Re: Hard to understand, being clear [ was Re: MDs & Dentists] Gunnar Gervin <dofeelok@gmail.com> - 2021-08-02 15:40 +0200
                          Re: Hard to understand, being clear [ was Re: MDs & Dentists] Gunnar Gervin <dofeelok@gmail.com> - 2021-08-02 16:00 +0200
                    Re: MDs & Dentists Nicholas Geovanis <nickgeovanis@gmail.com> - 2021-07-21 18:20 +0200
                      Re: MDs & Dentists "James H. H. Lampert" <jamesl@touchtonecorp.com> - 2021-07-21 18:40 +0200
                        Re: MDs & Dentists "Thomas Schmitt" <scdbackup@gmx.net> - 2021-07-21 19:10 +0200
                          Re: MDs & Dentists Stefan Monnier <monnier@iro.umontreal.ca> - 2021-07-21 19:40 +0200
                            Re: MDs & Dentists "Thomas Schmitt" <scdbackup@gmx.net> - 2021-07-21 20:20 +0200
                              Re: MDs & Dentists Stefan Monnier <monnier@iro.umontreal.ca> - 2021-07-21 21:50 +0200
                                Re: MDs & Dentists "Thomas Schmitt" <scdbackup@gmx.net> - 2021-07-21 23:50 +0200
                        Re: MDs & Dentists Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-07-21 19:20 +0200
                          Re: MDs & Dentists Reco <recoverym4n@enotuniq.net> - 2021-07-21 19:40 +0200
                        Re: MDs & Dentists Reco <recoverym4n@enotuniq.net> - 2021-07-21 19:30 +0200
                          Re: MDs & Dentists Nicholas Geovanis <nickgeovanis@gmail.com> - 2021-07-21 22:40 +0200
                    Re: MDs & Dentists Celejar <celejar@gmail.com> - 2021-07-21 20:40 +0200
                      Re: MDs & Dentists Reco <recoverym4n@enotuniq.net> - 2021-07-21 21:10 +0200
                        Re: MDs & Dentists Celejar <celejar@gmail.com> - 2021-07-21 22:30 +0200
                    Re: MDs & Dentists Richard Hector <richard@walnut.gen.nz> - 2021-07-21 21:20 +0200
          Re: MDs & Dentists Michael Lange <klappnase@freenet.de> - 2021-07-15 13:10 +0200
            Re: MDs & Dentists Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-07-15 15:40 +0200
      Re: MDs & Dentists Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2021-07-15 00:30 +0200

Page 3 of 4 — ← Prev page 1 2 [3] 4  Next page →

#237986

Andrew M.A. Cater wrote: 
> On Sun, Aug 01, 2021 at 04:30:45PM +0300, Gunnar Gervin wrote:
> > Security.
> > Rarely discussed in Linux(?)..

Discussed all the time.

> > After trying "all" workarounds, I installed another, more simple Linux
> > distro, built up a new setup of relevant programs to build VM, containers,
> > websites, Debian iso image, & CHEF.
> 
> Which distro - are you still using Debian?
> 
> If not, we can't really help you. Although many of us have run other 
> distributions in the past, all of the Debian/Ubuntu derivatives do
> something slightly different - we can only really help with generic
> Debian things. If we offer help with any other distribution, it's
> only ever best efforts - Debian derivatives have their own support
> infrastructure.
> 
> > Now Chef asks me to give URL to continue setting up a VM etc.
> > Plz advise &/or help to do it/this.

You need a chef-server already set up on another machine. You
probably don't have a chef-server set up. Installing one on
Debian is a problem...

> It may not be relevant but the chef and chef-zero packages in Buster appear 
> to no longer be packaged in Bullseye - the upcoming release due in two weeks.
> 
> Ask on a Chef list, perhaps?

The problem is that the company that was developing chef was
purchased by a company which is rather hostile to open source,
and - as far as I can tell - the group which was planning on
forking chef and producing cinc (cinc is not chef) has run into
trouble.

Although I like chef quite a bit, I cannot recommend it to anyone who
is starting to use an open source configuration automation system at
this time. Existing users may or may not be comfortable
continuing on with old chef-server versions until cinc is ready.

Viable alternatives include puppet, salt, ansible, bcfg2,
cfengine3, and probably many others.

-dsr-

[toc] | [prev] | [next] | [standalone]

#237977

[Multipart message — attachments visible in raw view] — view raw

Dual boot'ed,
I forgot to tell you.
Thus the sucker(?) can sit 'alone' in a dysfunctional 1/2 of my PC, maybe
'he' never returns anyway.
After built up all in 1 'secret' 1/2, I plan to re-partition the 1t half,
to clean out 'all' dysfunctions, in a Linux, & Linux Debian 'answer' to
Factory Reset, a learning way, which FReset really isn't, or little.
BR,
Geg.

On Wed, 21 Jul 2021, 18:59 Dan Ritter, <dsr@randomstring.org> wrote:

> Reco wrote:
> > On Wed, Jul 21, 2021 at 10:51:40AM -0400, Celejar wrote:
> > Numbers show that I was incorrect. Let's call it "unlikely" instead of
> > "rare". Let the popcon graphs speak for themselves:
> >
> > https://qa.debian.org/popcon.php?package=firefox-esr
> > vs
> > https://qa.debian.org/popcon.php?package=openjdk-11
>
> Standard reminder: popcon vastly over-represents
> individually-owned laptops and desktops over servers and
> corporately-owned anything.
>
> In this case, individuals are sometimes infected with ransomware
> by happenstance, but corporates are actually targets.
>
> > It won't by itself, of course. One sure way to beat ransomware is to
> > take immutable backups (i.e. unmodifiable by host during and after the
> > backup is taken), and as recent history shows us - ransomware victims
> > apparently do not use this approach.
>
> Yes indeed.
>
> -dsr-
>
>

[toc] | [prev] | [next] | [standalone]

#237996 — Hard to understand, being clear [ was Re: MDs & Dentists]

[Multipart message — attachments visible in raw view] — view raw

Hi,
Here's some example of hard to understand posts...
Maybe I ain't the only one following the thread, that tried to help
Gunnar but got lost in the linguistics problems.

On 2021-08-01 9:39 a.m., Gunnar Gervin wrote:
> Dual boot'ed,
> I forgot to tell you.
> Thus the sucker(?) can sit 'alone' in a dysfunctional 1/2 of my PC,
> maybe 'he' never returns anyway.
*dysfunction 1/2 of your PC ?*

Okay this could be related to the first sentence about dual booting.
So you got one of the two system not working.

Which one ?
You know, how are we supposed to know.

> After built up all in 1 'secret' 1/2, I plan to re-partition the 1t
*all in 1 'secret' 1/2 ?*

What is this supposed to mean

> half, to clean out 'all' dysfunctions, in a Linux, & Linux Debian
*clean out all dysfunction in a Linux & Linux Debian*

So you have two Debian system ?

> 'answer' to Factory Reset, a learning way, which FReset really isn't, or
> little.
*'answer' to Factory Reset* ?

Where you answered what ?

FReset ? Is it a typo for Reset or a way for you to say Factory Reset ?

Trying to save a few letter won't help your case.

Unless you are using a 300 baud modem, maybe you should let go the space
saving acronym and use plain English.

I won't go back to the list of messages...

But here's one that is pretty much the top of line when we consider hard
to understand.

https://lists.debian.org/debian-user/2021/07/msg01033.html

Thx for the request to help in this project even not knowing code. I'll
firstly try it on my 14 yr old Debian Buster ex-macbook. Nice way to
include more people &, probably, improve+stabilize the distro much faster.
Learning Linux Debian is a nice hobby(feels more like a lifestyle)

--

*A ex-Macbook ? what make it change from a MacBook to a none-Macbook ?*

https://lists.debian.org/debian-user/2021/07/msg01219.html

>> On 2021-07-28 3:16 p.m., Gunnar Gervin wrote:
>>> It is a Toshiba 160 gb hd in a 14 years old Macbook i386 ❤️/x86 32 b
>>> booting from Bios not uefi. I'll give full report in 1-2 weeks, after
>>> put in VM in it, faster internet to it to handle VM.
>>> And built websites with it.
>>> Geg

....

> One might assume from
>
> https://lists.debian.org/debian-user/2021/07/msg01033.html
> https://lists.debian.org/debian-user/2021/07/msg01167.html
>
> that these deal with the same machine, and that Gunnar hasn't quite
> mastered the technique of threading, but is keen to add to the
> list of tested hardware.
>
One doesn't always read all the messages and only uses the subject to
get a idea.

Now is he saying his machine can WORK with Debian or is this related to
the message I had with him earlier about a problem with his system NOT
WORKING and CRASHING on update, requiring CLEAN REINSTALL.

And this is the part that would be nice to know...

----

*And we still don't know !*

> BR,
> Geg.
> 
> On Wed, 21 Jul 2021, 18:59 Dan Ritter, <dsr@randomstring.org
> <mailto:dsr@randomstring.org>> wrote:
> 
>     Reco wrote:
>     > On Wed, Jul 21, 2021 at 10:51:40AM -0400, Celejar wrote:
>     > Numbers show that I was incorrect. Let's call it "unlikely" instead of
>     > "rare". Let the popcon graphs speak for themselves:
>     >
>     > https://qa.debian.org/popcon.php?package=firefox-esr
>     <https://qa.debian.org/popcon.php?package=firefox-esr>
>     > vs
>     > https://qa.debian.org/popcon.php?package=openjdk-11
>     <https://qa.debian.org/popcon.php?package=openjdk-11>
> 
>     Standard reminder: popcon vastly over-represents
>     individually-owned laptops and desktops over servers and
>     corporately-owned anything.
> 
>     In this case, individuals are sometimes infected with ransomware
>     by happenstance, but corporates are actually targets.
> 
>     > It won't by itself, of course. One sure way to beat ransomware is to
>     > take immutable backups (i.e. unmodifiable by host during and after the
>     > backup is taken), and as recent history shows us - ransomware victims
>     > apparently do not use this approach.
> 
>     Yes indeed.
> 
>     -dsr-
> 

-- 
Polyna-Maude R.-Summerside
-Be smart, Be wise, Support opensource development

[toc] | [prev] | [next] | [standalone]

#238034 — Re: Hard to understand, being clear [ was Re: MDs & Dentists]

[Multipart message — attachments visible in raw view] — view raw

My exMac looks like old Mac, but 1/2 of software/harddisk is Debian i386
32b Buster, another
1/2 of HD (Toshiba MK1655GS ssd 160gb, Intel, 3gb memory) is Linux Mint 32b
Ubuntu-based.
Wikipedia said it's the first Mac (Snow Leopard)to run on 64bit.
You asked what changed it from being a Macbook to an exmac.
Letting Linux Debian 10.9 take over 100% of 160gb software. It is now
impossible(?) to go back to Macbook 2.1 osx 10.6.8 Snow Leopard. The
hardware is Mac, which is the keyboard & screen.
Debian (& Mac) 'said' dvd player didn't work, neither the external dvd
player. Mint didn't 'complain'. The Apple symbol appears on screen starting
& a fanfare tune. Mac or not: Depends how you define it, external,
internal, both.
I didn't much think of it until now.
For me it's no longer a Mac. Because for me the main use of a computer is
the desktop look, the programs, the distribution. It's not a car, to get me
around. It's to get my brainwork done; it's main value is on the inside.
See?
BR,
Geg

BR,
Geg

On Sun, 1 Aug 2021, 23:33 Polyna-Maude Racicot-Summerside, <
debian@polynamaude.com> wrote:

> Hi,
> Here's some example of hard to understand posts...
> Maybe I ain't the only one following the thread, that tried to help
> Gunnar but got lost in the linguistics problems.
>
> On 2021-08-01 9:39 a.m., Gunnar Gervin wrote:
> > Dual boot'ed,
> > I forgot to tell you.
> > Thus the sucker(?) can sit 'alone' in a dysfunctional 1/2 of my PC,
> > maybe 'he' never returns anyway.
> *dysfunction 1/2 of your PC ?*
>
> Okay this could be related to the first sentence about dual booting.
> So you got one of the two system not working.
>
> Which one ?
> You know, how are we supposed to know.
>
> > After built up all in 1 'secret' 1/2, I plan to re-partition the 1t
> *all in 1 'secret' 1/2 ?*
>
> What is this supposed to mean
>
> > half, to clean out 'all' dysfunctions, in a Linux, & Linux Debian
> *clean out all dysfunction in a Linux & Linux Debian*
>
> So you have two Debian system ?
>
> > 'answer' to Factory Reset, a learning way, which FReset really isn't, or
> > little.
> *'answer' to Factory Reset* ?
>
> Where you answered what ?
>
> FReset ? Is it a typo for Reset or a way for you to say Factory Reset ?
>
> Trying to save a few letter won't help your case.
>
> Unless you are using a 300 baud modem, maybe you should let go the space
> saving acronym and use plain English.
>
> I won't go back to the list of messages...
>
> But here's one that is pretty much the top of line when we consider hard
> to understand.
>
> https://lists.debian.org/debian-user/2021/07/msg01033.html
>
> Thx for the request to help in this project even not knowing code. I'll
> firstly try it on my 14 yr old Debian Buster ex-macbook. Nice way to
> include more people &, probably, improve+stabilize the distro much faster.
> Learning Linux Debian is a nice hobby(feels more like a lifestyle)
>
> --
>
> *A ex-Macbook ? what make it change from a MacBook to a none-Macbook ?*
>
> https://lists.debian.org/debian-user/2021/07/msg01219.html
>
> >> On 2021-07-28 3:16 p.m., Gunnar Gervin wrote:
> >>> It is a Toshiba 160 gb hd in a 14 years old Macbook i386 ❤️/x86 32 b
> >>> booting from Bios not uefi. I'll give full report in 1-2 weeks, after
> >>> put in VM in it, faster internet to it to handle VM.
> >>> And built websites with it.
> >>> Geg
>
> ....
>
> > One might assume from
> >
> > https://lists.debian.org/debian-user/2021/07/msg01033.html
> > https://lists.debian.org/debian-user/2021/07/msg01167.html
> >
> > that these deal with the same machine, and that Gunnar hasn't quite
> > mastered the technique of threading, but is keen to add to the
> > list of tested hardware.
> >
> One doesn't always read all the messages and only uses the subject to
> get a idea.
>
> Now is he saying his machine can WORK with Debian or is this related to
> the message I had with him earlier about a problem with his system NOT
> WORKING and CRASHING on update, requiring CLEAN REINSTALL.
>
> And this is the part that would be nice to know...
>
> ----
>
> *And we still don't know !*
>
> > BR,
> > Geg.
> >
> > On Wed, 21 Jul 2021, 18:59 Dan Ritter, <dsr@randomstring.org
> > <mailto:dsr@randomstring.org>> wrote:
> >
> >     Reco wrote:
> >     > On Wed, Jul 21, 2021 at 10:51:40AM -0400, Celejar wrote:
> >     > Numbers show that I was incorrect. Let's call it "unlikely"
> instead of
> >     > "rare". Let the popcon graphs speak for themselves:
> >     >
> >     > https://qa.debian.org/popcon.php?package=firefox-esr
> >     <https://qa.debian.org/popcon.php?package=firefox-esr>
> >     > vs
> >     > https://qa.debian.org/popcon.php?package=openjdk-11
> >     <https://qa.debian.org/popcon.php?package=openjdk-11>
> >
> >     Standard reminder: popcon vastly over-represents
> >     individually-owned laptops and desktops over servers and
> >     corporately-owned anything.
> >
> >     In this case, individuals are sometimes infected with ransomware
> >     by happenstance, but corporates are actually targets.
> >
> >     > It won't by itself, of course. One sure way to beat ransomware is
> to
> >     > take immutable backups (i.e. unmodifiable by host during and after
> the
> >     > backup is taken), and as recent history shows us - ransomware
> victims
> >     > apparently do not use this approach.
> >
> >     Yes indeed.
> >
> >     -dsr-
> >
>
> --
> Polyna-Maude R.-Summerside
> -Be smart, Be wise, Support opensource development
>
>

[toc] | [prev] | [next] | [standalone]

#238035 — Re: Hard to understand, being clear [ was Re: MDs & Dentists]

[Multipart message — attachments visible in raw view] — view raw

Debian buster 32b i386 is the dysfunctional 1/2 part (that the scammer
might have access to until I am able to find acceptable dvd to burn 64bit
Debian 10.10 into (dropped Bullseye because of request I couldn't do; no
Grub)
So I can renew that half. For me a probable way to test different distros
and releases is simply a dualboot. I need now to build websites, not a
virtual machine.
I just didn't have a working PC     -yet- that could build websites.
In Synaptic I found ASCII only.
Then I'd have to learn HTML? Heard about Wordpress & YAML
Geg

On Sun, 1 Aug 2021, 23:33 Polyna-Maude Racicot-Summerside, <
debian@polynamaude.com> wrote:

> Hi,
> Here's some example of hard to understand posts...
> Maybe I ain't the only one following the thread, that tried to help
> Gunnar but got lost in the linguistics problems.
>
> On 2021-08-01 9:39 a.m., Gunnar Gervin wrote:
> > Dual boot'ed,
> > I forgot to tell you.
> > Thus the sucker(?) can sit 'alone' in a dysfunctional 1/2 of my PC,
> > maybe 'he' never returns anyway.
> *dysfunction 1/2 of your PC ?*
>
> Okay this could be related to the first sentence about dual booting.
> So you got one of the two system not working.
>
> Which one ?
> You know, how are we supposed to know.
>
> > After built up all in 1 'secret' 1/2, I plan to re-partition the 1t
> *all in 1 'secret' 1/2 ?*
>
> What is this supposed to mean
>
> > half, to clean out 'all' dysfunctions, in a Linux, & Linux Debian
> *clean out all dysfunction in a Linux & Linux Debian*
>
> So you have two Debian system ?
>
> > 'answer' to Factory Reset, a learning way, which FReset really isn't, or
> > little.
> *'answer' to Factory Reset* ?
>
> Where you answered what ?
>
> FReset ? Is it a typo for Reset or a way for you to say Factory Reset ?
>
> Trying to save a few letter won't help your case.
>
> Unless you are using a 300 baud modem, maybe you should let go the space
> saving acronym and use plain English.
>
> I won't go back to the list of messages...
>
> But here's one that is pretty much the top of line when we consider hard
> to understand.
>
> https://lists.debian.org/debian-user/2021/07/msg01033.html
>
> Thx for the request to help in this project even not knowing code. I'll
> firstly try it on my 14 yr old Debian Buster ex-macbook. Nice way to
> include more people &, probably, improve+stabilize the distro much faster.
> Learning Linux Debian is a nice hobby(feels more like a lifestyle)
>
> --
>
> *A ex-Macbook ? what make it change from a MacBook to a none-Macbook ?*
>
> https://lists.debian.org/debian-user/2021/07/msg01219.html
>
> >> On 2021-07-28 3:16 p.m., Gunnar Gervin wrote:
> >>> It is a Toshiba 160 gb hd in a 14 years old Macbook i386 ❤️/x86 32 b
> >>> booting from Bios not uefi. I'll give full report in 1-2 weeks, after
> >>> put in VM in it, faster internet to it to handle VM.
> >>> And built websites with it.
> >>> Geg
>
> ....
>
> > One might assume from
> >
> > https://lists.debian.org/debian-user/2021/07/msg01033.html
> > https://lists.debian.org/debian-user/2021/07/msg01167.html
> >
> > that these deal with the same machine, and that Gunnar hasn't quite
> > mastered the technique of threading, but is keen to add to the
> > list of tested hardware.
> >
> One doesn't always read all the messages and only uses the subject to
> get a idea.
>
> Now is he saying his machine can WORK with Debian or is this related to
> the message I had with him earlier about a problem with his system NOT
> WORKING and CRASHING on update, requiring CLEAN REINSTALL.
>
> And this is the part that would be nice to know...
>
> ----
>
> *And we still don't know !*
>
> > BR,
> > Geg.
> >
> > On Wed, 21 Jul 2021, 18:59 Dan Ritter, <dsr@randomstring.org
> > <mailto:dsr@randomstring.org>> wrote:
> >
> >     Reco wrote:
> >     > On Wed, Jul 21, 2021 at 10:51:40AM -0400, Celejar wrote:
> >     > Numbers show that I was incorrect. Let's call it "unlikely"
> instead of
> >     > "rare". Let the popcon graphs speak for themselves:
> >     >
> >     > https://qa.debian.org/popcon.php?package=firefox-esr
> >     <https://qa.debian.org/popcon.php?package=firefox-esr>
> >     > vs
> >     > https://qa.debian.org/popcon.php?package=openjdk-11
> >     <https://qa.debian.org/popcon.php?package=openjdk-11>
> >
> >     Standard reminder: popcon vastly over-represents
> >     individually-owned laptops and desktops over servers and
> >     corporately-owned anything.
> >
> >     In this case, individuals are sometimes infected with ransomware
> >     by happenstance, but corporates are actually targets.
> >
> >     > It won't by itself, of course. One sure way to beat ransomware is
> to
> >     > take immutable backups (i.e. unmodifiable by host during and after
> the
> >     > backup is taken), and as recent history shows us - ransomware
> victims
> >     > apparently do not use this approach.
> >
> >     Yes indeed.
> >
> >     -dsr-
> >
>
> --
> Polyna-Maude R.-Summerside
> -Be smart, Be wise, Support opensource development
>
>

[toc] | [prev] | [next] | [standalone]

#237581

[Multipart message — attachments visible in raw view] — view raw

On Wed, Jul 21, 2021, 10:38 AM Reco <recoverym4n@enotuniq.net> wrote:

> On Wed, Jul 21, 2021 at 10:51:40AM -0400, Celejar wrote:
> > On Wed, 21 Jul 2021 11:16:46 +0300
> > Reco <recoverym4n@enotuniq.net> wrote:
> >
> >
> > browsers are just full of vulnerabilities,
>
> True. Every version of Chromium and Firefox fixes at least one.
> Most of said vulnerabilities do cannot be used to get Remote Code
> Execution (RCE) though. Which leaves us with "random download" scenario,
> which I've discussed above.
>
> > so why couldn't ransomware get in that way?
>
> It could. In a lack of a proper execution environment (be it JRE,
> flatpak, snap or whatever) - what should it do next? Wait for a user to
> execute it?
>

AFAICS the only solution with any finality is multilevel granular security
on any OS with connectivity. This means SElinux in true multilevel-security
mode, a bit beyond what RedHat used to call "targeted mode". The US DoD
called it mandatory access-control in its Rainbow Books in the 1990s,
B-level security. The Rainbow Books are freely available online today.

It doesn't have to be SElinux, I don't know if RSBAC is still an active
project for example. The key to getting this granularity is configuring the
security rule-base for any given desktop or server in an unattended way
(YOURS for example :-) There are templated rulesets but what seems to be
lacking is an easy way to refine that ruleset into something that works
right for you personally, your desktop or server. Ideally without your
intervention IOW. And without removing any lower-stack security mechanisms,
just using them as building blocks. As mandatory builds on "discretionary"
access-control, which is built into the Linux filesystem model.

Reco
>
>

[toc] | [prev] | [next] | [standalone]

#237584

"Immutable backups." Interesting concept. But how? Optical media? 
Enormous decks of Hollerith cards? Enormous reels of punched paper tape?

So far as I'm aware, there is *only one* operating system currently in 
wide use, that has never been successfully infected with malware outside 
of laboratory experiments: the IBM Midrange operating system that goes 
by such names as OS/400 and i5OS (among others, and although I work with 
it on a daily basis, I've long-since given up keeping track of what IBM 
is calling it in any given week).

But Linux comes a lot closer to being malware-secure than WinDoze, or 
even Mac OS, which is one reason why, with my "bionic desk lamp" iMac on 
its last legs, instead of buying another Mac, or a WinDoze box, I bought 
a Meerkat.

As to MDs and Dentists making poor decisions where computers are 
concerned, it's not just healthcare professionals: over a quarter 
century ago, I spent about a year trying to fix the hidden flaws in a 
small business accounting program. It had been written, not by a 
programmer, but by an accountant. In C. It was his first non-trivial 
program in a language other than BASIC. And it ran on the Amiga. 
Aggressively multitasking within itself, on a platform where there was 
no memory protection, and nothing but "good intentions" to keep one task 
from stomping all over another task's memory. It nearly killed me.

--
James H. H. Lampert

[toc] | [prev] | [next] | [standalone]

#237588

Hi,

James H. H. Lampert wrote:
> "Immutable backups." Interesting concept. But how? Optical media?

Yes. BD-R single layer are affordable and can take 25 GB each. With some
compression you can put the whole operating system and the most important
user data onto a single medium.

BD-R is also usable for multi-session. So if the important data do not fill
the medium, then it is possible to write updates, which do not overwrite
the older backups but rather re-use their data where possible.
The older backups stay accessible (unless the potential malware knows more
about operating a BD drive than i do).


Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#237592

Thomas Schmitt [2021-07-21 19:00:48] wrote:
> James H. H. Lampert wrote:
>> "Immutable backups." Interesting concept. But how? Optical media?
> Yes. BD-R single layer are affordable and can take 25 GB each. With some
> compression you can put the whole operating system and the most important
> user data onto a single medium.

Plain old HDDs and SSDs also work for "immutable" backups: just don't
keep them connected to the host after you've done the backup.
E.g. keep a handful of external SSDs to which you backup "in rotation".


        Stefan

[toc] | [prev] | [next] | [standalone]

#237594

Hi,

Stefan Monnier wrote:
> Plain old HDDs and SSDs also work for "immutable" backups: just don't
> keep them connected to the host after you've done the backup.

But how do you keep the system from messing them up during the first
backup after the malware took over ?


Reco wrote before i asked above question:
> > It's a really simple concept - one host is doing the backup, another one
> > controls where and how it written.
> > To inflict some damage, one has to compromise both, and frankly if one
> > does not protect their backups properly one has bigger problems to worry
> > about than a "ransomware attack".

In the hypothetical attack scenario the malware is able to encrypt files to
which not everybody is supposed to be able to write. So the attacker already
got the fingers deep in the system and - if applicable - in the network.
The demand for ransom is only the payload of a skilled system takeover.

So i think the concept of an "immutable" backup is of value in case the
data are worth more than 50 cent per 25 GB and don't exceed a few hundred
GB. The use of write-once-read-many media is a fine component of a backup
strategy which puts emphasis on protecting the older backups from being
altered or destroyed after the malware took over.

(I fail to find in the list archive the post by which this idea was proposed
first. So i cannot properly attribute the merit of having introduced it
here.)


> > Of course, not doing any backups at all is equally bad.

Especially since Layer 8 (aka PEBKAC aka ID-10-T) as main threat to data
integrity has not lost any of its damage potential.


Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#237601

Thomas Schmitt [2021-07-21 20:11:15] wrote:
> Stefan Monnier wrote:
>> Plain old HDDs and SSDs also work for "immutable" backups: just don't
>> keep them connected to the host after you've done the backup.
> But how do you keep the system from messing them up during the first
> backup after the malware took over ?

That's what

    keep a handful of external SSDs to which you backup "in rotation"

is about.  Of course, if the time between the moment the malware takes
control and the moment when you notice it is longer than your rotation
you might be in trouble, indeed (tho that depends on the details of how
the malware operates w.r.t removable media).

Then again, this implies that all the work you've done between those two
moments would likely have been lost just as well if you backed up to
a BD-R.


        Stefan

[toc] | [prev] | [next] | [standalone]

#237606

Hi,

Stefan Monnier wrote:
> Of course, if the time between the moment the malware takes
> control and the moment when you notice it is longer than your rotation
> you might be in trouble, indeed (tho that depends on the details of how
> the malware operates w.r.t removable media).

With Write-Once media it is natural to keep them indefinitely. So there
is no destruction by rotation.

I doubt that it is easy to develop custom firmware and an installer for
the victim's BD drive. Only then it would be possible to let the drive
destroy data on a BD-R medium. (I am not sure whether the BD-R dyes and
M-Disc minerals stay fully receptive to the laser beam. But i assume that
drive firmware could let it burn bright enough to damage the contrast
between land and pit.)


> Then again, this implies that all the work you've done between those two
> moments would likely have been lost just as well if you backed up to
> a BD-R.

Yes. The non-repairable damage depends on the time between the first
hostage taking of data and the detection of the attack by the victim.
Restored data from the backups need to be tested for integrity before they
can be used. So the pain stays substantial.

Nevertheless it is better to have old restore candidates rather than to see
original and backups being victim of the same malware.


Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#237590

[Multipart message — attachments visible in raw view] — view raw

Hi,

On 2021-07-21 12:36 p.m., James H. H. Lampert wrote:
> "Immutable backups." Interesting concept. But how? Optical media?
> Enormous decks of Hollerith cards? Enormous reels of punched paper tape?
> 
There's only one real type of very effective immutable backup : Stone,
Pick and Hammer.... And ideally some cheap labor.
> -- 
> James H. H. Lampert
> 

-- 
Polyna-Maude R.-Summerside
-Be smart, Be wise, Support opensource development

[toc] | [prev] | [next] | [standalone]

#237593

	Hi.

On Wed, Jul 21, 2021 at 01:12:52PM -0400, Polyna-Maude Racicot-Summerside wrote:
> Hi,
> 
> On 2021-07-21 12:36 p.m., James H. H. Lampert wrote:
> > "Immutable backups." Interesting concept. But how? Optical media?
> > Enormous decks of Hollerith cards? Enormous reels of punched paper tape?
> > 
> There's only one real type of very effective immutable backup : Stone,
> Pick and Hammer.... And ideally some cheap labor.

Hardly. The amount of time needed to perform such backup is atrocious,
and Recovery Time Objective is way too high. Also, the costs of a single
backup prevents nearly anyone but government to perform it.

And it's not Modern™. Storing QR-encoded text - [1] on a
specially-crafted film is the Modern™ replacement of Stone, Pick and
Hammer.

Reco

[1] https://archiveprogram.github.com/

[toc] | [prev] | [next] | [standalone]

#237591

On Wed, Jul 21, 2021 at 09:36:37AM -0700, James H. H. Lampert wrote:
> "Immutable backups." Interesting concept. But how?

In a dull enterprise world they usually used tape libraries for that.
It's not popular these days, but still used here and there.

"Cloud backups" are getting their share, although they carry their own
risks.


> Optical media?

20 years ago my answer would be "yes".
10 years ago - "maybe".
Today's answer - go to eBay, and buy that LTO-6 drive, and a FC HBA
while you're at it. If tinkering with tapes is not your cup of tea -
rent an appropriate amount of disk space from several cloud vendors, and
put each locally-encrypted backup in several places.


> Enormous decks of Hollerith cards? Enormous reels of punched paper tape?

It's a really simple concept - one host is doing the backup, another one
controls where and how it written.

To inflict some damage, one has to compromise both, and frankly if one
does not protect their backups properly one has bigger problems to worry
about than a "ransomware attack".
Of course, not doing any backups at all is equally bad.


> So far as I'm aware, there is *only one* operating system currently in
> wide use, that has never been successfully infected with malware
> outside of laboratory experiments: the IBM Midrange operating system
> that goes by such names as OS/400 and i5OS (among others, and although
> I work with it on a daily basis, I've long-since given up keeping
> track of what IBM is calling it in any given week).

OS/400 was before my time, but I have a limited experience with z/VM
which ran at z9 mainframe about 10 years ago.  One day certain IBM
engineer somehow managed to execute a certain job from one LPAR in
another, completely breaking the isolation between LPARs. The mainframe
just shutdown presumably to prevent other abuse to happen, and in modern
terms this could be classified as locally executed DOS attack.

My point is - maybe IBM gone wrong direction somewhere with Z-series.
And, of course - they do not make these things today like they used to.


> But Linux comes a lot closer to being malware-secure than WinDoze, or
> even Mac OS, which is one reason why, with my "bionic desk lamp" iMac
> on its last legs, instead of buying another Mac, or a WinDoze box, I
> bought a Meerkat.

Why "even Mac OS"? Being UNIX does not make it magically secure, nor
being produced by Apple does.
As long as OS promotes and considers perfectly normal to run arbitrary
software obtained from $DEITY knows where - such OS cannot provide any
kind of meaningful security, user data being considered.
Note that obtaining a software from third-party and providing it as is
(iOS, Android being prime examples here, and M$ tries to get there) does
not make the security of user data any better.

Reco

[toc] | [prev] | [next] | [standalone]

#237603

[Multipart message — attachments visible in raw view] — view raw

On Wed, Jul 21, 2021, 12:27 PM Reco <recoverym4n@enotuniq.net> wrote:

> On Wed, Jul 21, 2021 at 09:36:37AM -0700, James H. H. Lampert wrote:
> > "Immutable backups." Interesting concept. But how?
>
> .......
> OS/400 was before my time, but I have a limited experience with z/VM
> which ran at z9 mainframe about 10 years ago.


I wrote security software for z/VM's ancestors VM/XA and VM/SP. I read
years ago of trojan proof-of-concept code for the MVS series OSs from IBM.
It could be done but of course was an insider attack.

One day certain IBM
> engineer somehow managed to execute a certain job from one LPAR in
> another, completely breaking the isolation between LPARs. The mainframe
> just shutdown presumably to prevent other abuse to happen, and in modern
> terms this could be classified as locally executed DOS attack.
>

A B-level mandatory-access control OS is specified to prevent that. It can
be done by 3rd party software if, of course, you are able to front-end the
system calls (SVCs in their terminology). We did have source licenses for
our implementation on HP/UX and Solaris but it was not strictly necessary.

......
> As long as OS promotes and considers perfectly normal to run arbitrary
> software obtained from $DEITY knows where - such OS cannot provide any
> kind of meaningful security, user data being considered.
>

It's counter-intuitive I know, but your statement is provably false with
the right security model. Google the Bell-LaPadula model. Equally valid in
what we consider a normal computing environment and even in multi-user
unix/Linux environments.


> Reco
>
>

[toc] | [prev] | [next] | [standalone]

#237595

On Wed, 21 Jul 2021 18:38:30 +0300
Reco <recoverym4n@enotuniq.net> wrote:

> On Wed, Jul 21, 2021 at 10:51:40AM -0400, Celejar wrote:
> > On Wed, 21 Jul 2021 11:16:46 +0300
> > Reco <recoverym4n@enotuniq.net> wrote:
> > 
> > > 	Hi.
> > > 
> > > On Tue, Jul 20, 2021 at 11:32:26AM -0400, Celejar wrote:
> > > > On Thu, 15 Jul 2021 09:46:59 +0300
> > > > Reco <recoverym4n@enotuniq.net> wrote:

...

> > > > https://hacked.com/linux-ransomware-notorious-cases-and-ways-to-protect/
> > > 
> > > Requires Java to be installed. A rare case on a Linux *desktop*.
> > 
> > Rare? I don't have statistics, but on one of my Linux desktops, I do
> > some development work for Android, using IntelliJ IDEA / Android Studio,
> > which depend on at least some Java components.
> 
> Numbers show that I was incorrect. Let's call it "unlikely" instead of
> "rare". Let the popcon graphs speak for themselves:
> 
> https://qa.debian.org/popcon.php?package=firefox-esr
> vs
> https://qa.debian.org/popcon.php?package=openjdk-11

I'm not sure I'm reading the numbers correctly, but the openjdk-11-jre
figures are 26-29% (as opposed to firefox-esr's 42%) - hardly "unlikely."

> I agree with you that one should uninstall Java unless it's needed.
> After all, they at Oracle always find something to fix in Java security
> every three months, and this goes on for last ten years.
> 
> > I don't know if I have
> > enough Java installed to be susceptible to the malware in question ;)
> 
> Famous Java's slogan "you write it once and run it everywhere" is an
> exaggeration, to put it lightly. Chances are, you don't have that exact
> minor update of Oracle JRE that this malware actually needs.

Well, I suppose that's a relief ;)

> > Fair enough - but I see no reason why in principle desktop Linux will
> > remain immune from ransomware.
> 
> It won't by itself, of course. One sure way to beat ransomware is to
> take immutable backups (i.e. unmodifiable by host during and after the
> backup is taken), and as recent history shows us - ransomware victims
> apparently do not use this approach.
> 
> Another sure way is to forbid running executables downloaded from random
> Internet sites, but no thanks to appimage, flatpak, snap, and Go Linux
> desktop goes straight into Windows desktop direction.
> And again, as recent history shows us - ransomware victims apparently do
> not use this approach too.

Good points.

> Currently a Linux desktop is better in this regard, but I agree that it
> may not remain the same.
> 
> 
> > Even if Linux word processors are safer than their Windows counterparts,
> 
> Last time I ran Libreoffice I had that distinct feeling I'm running a
> Java program. You know - long startup, eating memory like no tomorrow,
> trying to write useless junk at least to four different places at my
> filesystems, and eating the unhealthy amounts of CPU time in the
> process.

Funny - I always have that feeling and most of those experiences with
Firefox, (even) these days ;)

> I know that Libreoffice is written in C++, but the code quality of it is
> definitely left to be desired. At least then the thing crashes (it did,
> several times) it produces a standard core dump, not some unreadable
> stack trace and a heapdump.
> 
> In retrospect, maybe feeding Libreoffice Draw that 800-pages PDF was not
> the best of ideas, but no free software tool comes close to the
> capabilities of Libreoffice in editing PDFs, and I really needed that
> PDF to be modified (mass-replacing embedded fonts, to be specific).
> 
> 
> On the other hand, Windows counterparts are typical enterprisey software
> written by generations of overseas workers with the code quality (or
> rather the lack of) that's expected from enterprisey software.
> 
> My opinion on this - both are bad. Lireoffice is better being free
> software, of course, but that does not make it secure by definition.
> 
> 
> > browsers are just full of vulnerabilities,
> 
> True. Every version of Chromium and Firefox fixes at least one.
> Most of said vulnerabilities do cannot be used to get Remote Code
> Execution (RCE) though. Which leaves us with "random download" scenario,
> which I've discussed above.

Most, yes. But the pwn2own hackers, for example, seem to pretty
routinely get RCE on the major browsers, so I wouldn't bet my data that
ransomware authors won't as well:

https://www.zerodayinitiative.com/blog/2019/3/21/pwn2own-vancouver-2019-day-two-results
https://www.bleepingcomputer.com/news/security/researchers-earn-1-2-million-for-exploits-demoed-at-pwn2own-2021/

> > so why couldn't ransomware get in that way?

> It could. In a lack of a proper execution environment (be it JRE,
> flatpak, snap or whatever) - what should it do next? Wait for a user to
> execute it?

> Reco

Celejar

[toc] | [prev] | [next] | [standalone]

#237598

On Wed, Jul 21, 2021 at 02:38:50PM -0400, Celejar wrote:
> > > > > https://hacked.com/linux-ransomware-notorious-cases-and-ways-to-protect/
> > > > 
> > > > Requires Java to be installed. A rare case on a Linux *desktop*.
> > > 
> > > Rare? I don't have statistics, but on one of my Linux desktops, I do
> > > some development work for Android, using IntelliJ IDEA / Android Studio,
> > > which depend on at least some Java components.
> > 
> > Numbers show that I was incorrect. Let's call it "unlikely" instead of
> > "rare". Let the popcon graphs speak for themselves:
> > 
> > https://qa.debian.org/popcon.php?package=firefox-esr
> > vs
> > https://qa.debian.org/popcon.php?package=openjdk-11
> 
> I'm not sure I'm reading the numbers correctly, but the openjdk-11-jre
> figures are 26-29% (as opposed to firefox-esr's 42%) - hardly "unlikely."

I was referring to absolute numbers, which are 57847 and 83915
respectively.  Looks like I was incorrect again, I looked at jre, not
jdk. Ok, let's make this "common".

I wonder which software (that requires JDK) is provided by Debian and
is that popular.


> > True. Every version of Chromium and Firefox fixes at least one.
> > Most of said vulnerabilities do cannot be used to get Remote Code
> > Execution (RCE) though. Which leaves us with "random download" scenario,
> > which I've discussed above.
> 
> Most, yes. But the pwn2own hackers, for example, seem to pretty
> routinely get RCE on the major browsers, so I wouldn't bet my data that
> ransomware authors won't as well:
> 
> https://www.zerodayinitiative.com/blog/2019/3/21/pwn2own-vancouver-2019-day-two-results
> https://www.bleepingcomputer.com/news/security/researchers-earn-1-2-million-for-exploits-demoed-at-pwn2own-2021/

Given the amount of money and the publicity these people earn - I'd be
surprised if they did not find anything. Still, it's one (ok, several)
RCE per year, and due to the nature of pwn2own - it's unlikely that such
vulnerabilities are common knowledge before the actual pwn2own event,
and they're patched afterwards.

Reco

[toc] | [prev] | [next] | [standalone]

#237602

On Wed, 21 Jul 2021 22:00:04 +0300
Reco <recoverym4n@enotuniq.net> wrote:

> On Wed, Jul 21, 2021 at 02:38:50PM -0400, Celejar wrote:

...

> > Most, yes. But the pwn2own hackers, for example, seem to pretty
> > routinely get RCE on the major browsers, so I wouldn't bet my data that
> > ransomware authors won't as well:
> > 
> > https://www.zerodayinitiative.com/blog/2019/3/21/pwn2own-vancouver-2019-day-two-results
> > https://www.bleepingcomputer.com/news/security/researchers-earn-1-2-million-for-exploits-demoed-at-pwn2own-2021/
> 
> Given the amount of money and the publicity these people earn - I'd be
> surprised if they did not find anything. Still, it's one (ok, several)
> RCE per year, and due to the nature of pwn2own - it's unlikely that such
> vulnerabilities are common knowledge before the actual pwn2own event,
> and they're patched afterwards.

Oh, I don't mean those specific vulns, just that the money ransomware
authors can hope to make might be a pretty powerful incentive for them
to find similar ones.

Celejar

[toc] | [prev] | [next] | [standalone]

#237600

On 22/07/21 3:38 am, Reco wrote:
> One sure way to beat ransomware is to
> take immutable backups

That's fine if keeping access to your data is all you care about.

With the more modern ransomware that threatens to publish your (and/or 
your customers') data, not so much.

Richard

[toc] | [prev] | [next] | [standalone]

Page 3 of 4 — ← Prev page 1 2 [3] 4  Next page →

Back to top | Article view | linux.debian.user

csiph-web