Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #157019 > unrolled thread
| Started by | rlharris@oplink.net |
|---|---|
| First post | 2015-08-29 07:00 +0200 |
| Last post | 2015-08-30 21:10 +0200 |
| Articles | 20 on this page of 73 — 22 participants |
Back to article view | Back to linux.debian.user
laptop protection in an office network rlharris@oplink.net - 2015-08-29 07:00 +0200
Re: laptop protection in an office network Riley Baird <BM-2cVqnDuYbAU5do2DfJTrN7ZbAJ246S4XiX@bitmessage.ch> - 2015-08-29 08:00 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 08:20 +0200
Re: laptop protection in an office network Joe <joe@jretrading.com> - 2015-08-29 09:20 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 10:20 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-29 14:00 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 18:20 +0200
Re: laptop protection in an office network Joe <joe@jretrading.com> - 2015-08-29 18:30 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 20:30 +0200
Re: laptop protection in an office network Reco <recoverym4n@gmail.com> - 2015-08-29 20:40 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 21:10 +0200
Re: laptop protection in an office network Reco <recoverym4n@gmail.com> - 2015-08-29 21:30 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 21:50 +0200
Re: laptop protection in an office network Gene Heskett <gheskett@wdtv.com> - 2015-08-30 02:40 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-30 03:30 +0200
Re: laptop protection in an office network Gene Heskett <gheskett@wdtv.com> - 2015-08-30 03:40 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-30 04:30 +0200
Re: laptop protection in an office network Doug <dmcgarrett@optonline.net> - 2015-08-30 04:50 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-30 05:00 +0200
Re: laptop protection in an office network Lisi Reisz <lisi.reisz@gmail.com> - 2015-08-31 00:20 +0200
Re: laptop protection in an office network Gene Heskett <gheskett@wdtv.com> - 2015-08-30 05:10 +0200
Re: laptop protection in an office network David Wright <deblis@lionunicorn.co.uk> - 2015-08-30 06:40 +0200
Re: laptop protection in an office network Gene Heskett <gheskett@wdtv.com> - 2015-08-30 07:30 +0200
Re: laptop protection in an office network Martin Read <zen75502@zen.co.uk> - 2015-08-31 03:50 +0200
quality keyboards rlharris@oplink.net - 2015-08-31 09:10 +0200
Re: quality keyboards Petter Adsen <petter@synth.no> - 2015-08-31 09:40 +0200
Re: quality keyboards "Gian Uberto Lauri" <saint@eng.it> - 2015-08-31 09:50 +0200
Re: quality keyboards Petter Adsen <petter@synth.no> - 2015-08-31 12:00 +0200
Re: quality keyboards Joel Rees <joel.rees@gmail.com> - 2015-08-31 13:20 +0200
Re: quality keyboards Petter Adsen <petter@synth.no> - 2015-08-31 14:30 +0200
Re: quality keyboards "Gian Uberto Lauri" <saint@eng.it> - 2015-08-31 14:40 +0200
Re: quality keyboards Joel Rees <joel.rees@gmail.com> - 2015-08-31 15:50 +0200
Re: quality keyboards Petter Adsen <petter@synth.no> - 2015-08-31 16:40 +0200
Re: quality keyboards "Gian Uberto Lauri" <saint@eng.it> - 2015-08-31 17:00 +0200
Re: quality keyboards Anthony Maples <anthonym7009@gmail.com> - 2015-09-01 00:10 +0200
Re: quality keyboards "Thomas Schmitt" <scdbackup@gmx.net> - 2015-08-31 16:10 +0200
Re: quality keyboards Haines Brown <haines@histomat.net> - 2015-08-31 13:00 +0200
Re: quality keyboards Curt <curty@free.fr> - 2015-08-31 14:20 +0200
Re: quality keyboards Joel Rees <joel.rees@gmail.com> - 2015-08-31 13:10 +0200
Re: quality keyboards Gene Heskett <gheskett@wdtv.com> - 2015-08-31 14:30 +0200
Re: quality keyboards Petter Adsen <petter@synth.no> - 2015-08-31 15:00 +0200
Re: quality keyboards "Gian Uberto Lauri" <saint@eng.it> - 2015-08-31 15:10 +0200
Re: quality keyboards Lisi Reisz <lisi.reisz@gmail.com> - 2015-08-31 15:10 +0200
Re: quality keyboards Martin Read <zen75502@zen.co.uk> - 2015-08-31 13:20 +0200
Re: quality keyboards David Wright <deblis@lionunicorn.co.uk> - 2015-08-31 17:40 +0200
Re: quality keyboards Glenn English <ghe@slsware.net> - 2015-08-31 18:30 +0200
Re: quality keyboards Don Armstrong <don@debian.org> - 2015-08-31 21:50 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-29 21:10 +0200
Re: laptop protection in an office network Reco <recoverym4n@gmail.com> - 2015-08-29 21:20 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-29 21:50 +0200
Re: laptop protection in an office network Reco <recoverym4n@gmail.com> - 2015-08-29 22:00 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 00:10 +0200
Re: laptop protection in an office network Reco <recoverym4n@gmail.com> - 2015-08-30 00:30 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 00:50 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-30 09:40 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 16:10 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-30 18:30 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 20:50 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 21:30 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-29 22:00 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 22:30 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-29 22:50 +0200
Re: laptop protection in an office network Renaud (Ron) OLGIATI <renaud@olgiati-in-paraguay.org> - 2015-08-29 23:40 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-29 23:00 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 00:30 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-30 09:50 +0200
Re: laptop protection in an office network Joe <joe@jretrading.com> - 2015-08-30 10:30 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-30 10:40 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-30 01:50 +0200
Re: laptop protection in an office network Chris Bannister <cbannister@slingshot.co.nz> - 2015-08-30 09:30 +0200
Re: laptop protection in an office network <tomas@tuxteam.de> - 2015-08-30 10:30 +0200
Re: laptop protection in an office network rlharris@oplink.net - 2015-08-30 11:10 +0200
Re: laptop protection in an office network Brian <ad44@cityscape.co.uk> - 2015-08-30 21:10 +0200
Page 3 of 4 — ← Prev page 1 2 [3] 4 Next page →
| From | Petter Adsen <petter@synth.no> |
|---|---|
| Date | 2015-08-31 15:00 +0200 |
| Subject | Re: quality keyboards |
| Message-ID | <q3wQO-89h-11@gated-at.bofh.it> |
| In reply to | #157206 |
[Multipart message — attachments visible in raw view] — view raw
On Mon, 31 Aug 2015 08:25:25 -0400 Gene Heskett <gheskett@wdtv.com> wrote: > On Monday 31 August 2015 07:04:22 Joel Rees wrote: > > > On Mon, Aug 31, 2015 at 4:09 PM, <rlharris@oplink.net> wrote: > > > On Sun, August 30, 2015 8:49 pm, Martin Read wrote: > > >> Cherry still *are* (or at some point resumed) making mechanical > > >> keyswitches with a rated life in the tens of millions, and the > > >> Internet is full of mail-order vendors selling keyboards (from > > >> several different manufacturers) built with those Cherry > > >> keyswitches. > > > > > > How much do those things cost? Now that a keyboard can be had for > > > $10 or $15, is it better to pay $150 or even $250 for a quality > > > keyboard, or replace a $15 keyboard every year or even every six > > > months? > > > > > > And in our present Window$-dominated, rodent-oriented, game-addicted > > > and generally-lliterate society, is there anyone who types more than > > > a few dozen keystrokes a day for the purpose of intelligent > > > conversation -- other than subscribers to a mail list such as this, > > > and the authors of pulp fiction? (And no, I do not consider > > > messages transmitted by "texting" or "twitter" to be intelligent > > > conversation.) > > > > Petter points out the comfort benefits. For some, however, it's not > > just comfort. > > Correct. > > There is another aspect of what I call a usable keyboard. My retirement > hobbies include cnc'ing the usual machine shop stuff, like mills and > lathes. Thats a "dirty" environment, where a cut chip of metal can fly > several feet, depending on method of keeping the cutting tools workspace > reasonably clear of these chips, which will adversely effect the smooth > surface of the cut if allowed to just lay there and be recut by the > passage of the tools next cutting edge. So keyboards need to be both > protected from this debris, but also built to ignore it as much as > possible. The net result is a tendency to, when keyboard shopping, to > stay well away from keyboards whose keycaps are molded with tapered > sides surrounded by a close fitting plastic molding. I have an ACER > keyboard with vertical sided keys and no surrounding mask, keycaps are > directly on the stem of the key that if buried in this "swarf" might not > go down and register a keypress because there is something under the > keycap. That would be the much preferable failure mode, whereas the > taper sided keycap, with the usual overlay mask, allows this materiel to > follow the key down, then wedge it down. Have you seen the Apple keyboards? They have keys that are barely raised from the keyboard itself, completely flat, and are AFAIK wireless. Sandstrøm, among others, makes clones of these that are dirt cheap. If I understand your problem correctly, they might work well for you. Just a thought, I have no idea how they are for actual work. You can also get keyboards with a plastic coating that are intended for industrial use, but I haven't seen any for some time. Petter -- "I'm ionized" "Are you sure?" "I'm positive."
[toc] | [prev] | [next] | [standalone]
| From | "Gian Uberto Lauri" <saint@eng.it> |
|---|---|
| Date | 2015-08-31 15:10 +0200 |
| Subject | Re: quality keyboards |
| Message-ID | <q3x0t-8b-3@gated-at.bofh.it> |
| In reply to | #157211 |
Petter Adsen writes:
> Have you seen the Apple keyboards? They have keys that are barely
> raised from the keyboard itself, completely flat, and are AFAIK
> wireless.
Wired or wireless. Personally I still prefer a keyboard with Cherry
switches.
Should I get rich enough to buy a fully featured "black dustbin" I
would nevertheless go for a Logitech trackball and a keyboard with
Cherry switches.
Maybe the Apple Mac II keyboard clone, if I am going to use OS X.
--
/\ ___ Ubuntu: ancient
/___/\_|_|\_|__|___Gian Uberto Lauri_____ African word
//--\| | \| | Integralista GNUslamico meaning "I can
\/ coltivatore diretto di software not install
già sistemista a tempo (altrui) perso... Debian"
Warning: gnome-config-daemon considered more dangerous than GOTO
[toc] | [prev] | [next] | [standalone]
| From | Lisi Reisz <lisi.reisz@gmail.com> |
|---|---|
| Date | 2015-08-31 15:10 +0200 |
| Subject | Re: quality keyboards |
| Message-ID | <q3x0t-8b-9@gated-at.bofh.it> |
| In reply to | #157211 |
On Monday 31 August 2015 13:50:55 Petter Adsen wrote: > On Mon, 31 Aug 2015 08:25:25 -0400 > > Gene Heskett <gheskett@wdtv.com> wrote: > > On Monday 31 August 2015 07:04:22 Joel Rees wrote: > > > On Mon, Aug 31, 2015 at 4:09 PM, <rlharris@oplink.net> wrote: > > > > On Sun, August 30, 2015 8:49 pm, Martin Read wrote: > > > >> Cherry still *are* (or at some point resumed) making mechanical > > > >> keyswitches with a rated life in the tens of millions, and the > > > >> Internet is full of mail-order vendors selling keyboards (from > > > >> several different manufacturers) built with those Cherry > > > >> keyswitches. > > > > > > > > How much do those things cost? Now that a keyboard can be had for > > > > $10 or $15, is it better to pay $150 or even $250 for a quality > > > > keyboard, or replace a $15 keyboard every year or even every six > > > > months? > > > > > > > > And in our present Window$-dominated, rodent-oriented, game-addicted > > > > and generally-lliterate society, is there anyone who types more than > > > > a few dozen keystrokes a day for the purpose of intelligent > > > > conversation -- other than subscribers to a mail list such as this, > > > > and the authors of pulp fiction? (And no, I do not consider > > > > messages transmitted by "texting" or "twitter" to be intelligent > > > > conversation.) > > > > > > Petter points out the comfort benefits. For some, however, it's not > > > just comfort. > > > > Correct. > > > > There is another aspect of what I call a usable keyboard. My retirement > > hobbies include cnc'ing the usual machine shop stuff, like mills and > > lathes. Thats a "dirty" environment, where a cut chip of metal can fly > > several feet, depending on method of keeping the cutting tools workspace > > reasonably clear of these chips, which will adversely effect the smooth > > surface of the cut if allowed to just lay there and be recut by the > > passage of the tools next cutting edge. So keyboards need to be both > > protected from this debris, but also built to ignore it as much as > > possible. The net result is a tendency to, when keyboard shopping, to > > stay well away from keyboards whose keycaps are molded with tapered > > sides surrounded by a close fitting plastic molding. I have an ACER > > keyboard with vertical sided keys and no surrounding mask, keycaps are > > directly on the stem of the key that if buried in this "swarf" might not > > go down and register a keypress because there is something under the > > keycap. That would be the much preferable failure mode, whereas the > > taper sided keycap, with the usual overlay mask, allows this materiel to > > follow the key down, then wedge it down. > > Have you seen the Apple keyboards? They have keys that are barely > raised from the keyboard itself, completely flat, and are AFAIK > wireless. Sandstrøm, among others, makes clones of these that are dirt > cheap. If I understand your problem correctly, they might work well for > you. > > Just a thought, I have no idea how they are for actual work. > > You can also get keyboards with a plastic coating that are intended for > industrial use, but I haven't seen any for some time. http://hopeindustrial.co.uk/lp/industrial-keyboards.html?gclid=CMSPkfOv08cCFQeeGwodmeYG1A also at (more appropriately for Gene) http://www.hopeindustrial.com/configuration_and_pricing_keyboards.htm http://www.ruggedtech.com/ etc. Lisi
[toc] | [prev] | [next] | [standalone]
| From | Martin Read <zen75502@zen.co.uk> |
|---|---|
| Date | 2015-08-31 13:20 +0200 |
| Subject | Re: quality keyboards |
| Message-ID | <q3vi2-64Z-17@gated-at.bofh.it> |
| In reply to | #157179 |
On 31/08/15 08:09, rlharris@oplink.net wrote: > How much do those things cost? Now that a keyboard can be had for $10 or > $15, is it better to pay $150 or even $250 for a quality keyboard, or > replace a $15 keyboard every year or even every six months? Well, I'm typing this on a Das Keyboard (Cherry MX Brown keyswitches), which I bought after having to return the genuine IBM keyboard I'd had on extremely-long-term loan from a friend, so I think my position on that one is pretty clear :) > And in our present Window$-dominated, rodent-oriented, game-addicted and > generally-lliterate society, Funnily enough, the single biggest market for keyboards with high-quality keyswitches today is almost certainly PC video game enthusiasts. Video games on the PC make heavy use of the keyboard, and having a keyboard with high reliability and good tactile characteristics makes it easier to play them well.
[toc] | [prev] | [next] | [standalone]
| From | David Wright <deblis@lionunicorn.co.uk> |
|---|---|
| Date | 2015-08-31 17:40 +0200 |
| Subject | Re: quality keyboards |
| Message-ID | <q3zlE-3rM-17@gated-at.bofh.it> |
| In reply to | #157179 |
Quoting rlharris@oplink.net (rlharris@oplink.net): > On Sun, August 30, 2015 8:49 pm, Martin Read wrote: > > Cherry still *are* (or at some point resumed) making mechanical > > keyswitches with a rated life in the tens of millions, and the Internet is > > full of mail-order vendors selling keyboards (from several different > > manufacturers) built with those Cherry keyswitches. > > How much do those things cost? Now that a keyboard can be had for $10 or > $15, is it better to pay $150 or even $250 for a quality keyboard, or > replace a $15 keyboard every year or even every six months? Well it's not really possible to buy my favourite keyboard any more. My second favourite is the IBM clicky which I still use, but with greater headaches as it has a PS/2 connector. I'm not a blind-typing person; I type mainly with four fingers and the left thumb (it appears, when I try to watch myself at the same time as typing). So the truncated LShift doesn't bother me. As it's a UK keyboard, it would be difficult to replace. I like the positive feel, and no keyboard had a longer cable. I do not like the US placement of # and ~. My favourite keyboard of all time was the VT220 (which was attached to a mighty VT241 display). The incomparable feature was the key-click because it was not passively generated. The click came back with the character reflection, so it gave you *truly* active feedback. With my EVE (Extensible Vax Editor) redefining the numeric keypad, it was my most comfortable editing platform. My wife (who is a true touch-typist) was also a VT220/EVE addict; so much so that when she went to sea one time, I had to use the crude shore-ship email system to get my 1150-line customisation file out to her. (This was the days of Greybook Mail over X25 with gateways to Bitnet and Arpanet, but fortunately post- the time when I could only email ships through BT Gold, which cost real money.) > And in our present Window$-dominated, rodent-oriented, game-addicted and > generally-lliterate society, is there anyone who types more than a few > dozen keystrokes a day for the purpose of intelligent conversation -- > other than subscribers to a mail list such as this, and the authors of > pulp fiction? (And no, I do not consider messages transmitted by > "texting" or "twitter" to be intelligent conversation.) Plenty of people originate and edit material with their keyboards. (I assume you don't class scientific literature as pulp fiction!) Cheers, David.
[toc] | [prev] | [next] | [standalone]
| From | Glenn English <ghe@slsware.net> |
|---|---|
| Date | 2015-08-31 18:30 +0200 |
| Subject | Re: quality keyboards |
| Message-ID | <q3A82-4DV-17@gated-at.bofh.it> |
| In reply to | #157224 |
Yet another vote for Cherry. They are lovely. The 'clicks' on mine come from the key hitting the bottom, not from something in the switch. You select how loud the clicks are. And 'most everything is made for Winders these days -- just ignore the key with the little flag on it. It never occurred to me that a Winders keyboard might not work with Debian. Cherry makes about a thousand different keyboards. Some of them have toasters on them :-) I got a really simple one with good switches; no back lighted keys, no mouse touchpad, no number pad, nothing extra. Just a compact USB qwerty with good switches. Well, one extra: it has USB ports on the back, for the mouse. And maybe an external USB disk. One less thing to plug into the scarce USB ports on your Raspberry Pi. There's another model that looks like mine, but with not as cool switches, but still a good keyboard. I've got a couple of those in the junk box, with PS-2 connectors, that you can have if you like. (Cherry's last a long time.) Mine has a couple model numbers on it: D-91275 and MX 1800 USB-2D. It was expensive, but not as bad as I've seen in this thread (~$80 from DigiKey, IIRC). I'd definitely go with a good one and type happily and noisily, without failures, for a long time. -- Glenn English
[toc] | [prev] | [next] | [standalone]
| From | Don Armstrong <don@debian.org> |
|---|---|
| Date | 2015-08-31 21:50 +0200 |
| Subject | Re: quality keyboards |
| Message-ID | <q3DfA-Bf-9@gated-at.bofh.it> |
| In reply to | #157179 |
On Mon, 31 Aug 2015, rlharris@oplink.net wrote: > On Sun, August 30, 2015 8:49 pm, Martin Read wrote: > > Cherry still *are* (or at some point resumed) making mechanical > > keyswitches with a rated life in the tens of millions, and the Internet is > > full of mail-order vendors selling keyboards (from several different > > manufacturers) built with those Cherry keyswitches. > > How much do those things cost? Now that a keyboard can be had for $10 > or $15, is it better to pay $150 or even $250 for a quality keyboard, > or replace a $15 keyboard every year or even every six months? There's really no comparison between a rubber dome keyboard and a quality cherry MX or gateron-based keyboard. I've been using a kinesis advantage pro with for about 13 years now, and I've recently picked up an ergodox;[2] both with cherry MX brown switches. Some of the newer mechanical keyboards coming out of the threads here: https://geekhack.org/index.php?topic=44940.1700 are also worth checking out if you've got the keyboard bug hard. 1: http://gallery.donarmstrong.com/don_lab/017_even_more_lab_desk_10232003.jpg 2: http://www.donarmstrong.com/posts/ergodox_keyboard/ -- Don Armstrong http://www.donarmstrong.com I'd sign up in a hot second for any cellular company whose motto was: "We're less horrible than a root canal with a cold chisel." -- Cory Doctorow
[toc] | [prev] | [next] | [standalone]
| From | Brian <ad44@cityscape.co.uk> |
|---|---|
| Date | 2015-08-29 21:10 +0200 |
| Message-ID | <q2TFM-2lh-7@gated-at.bofh.it> |
| In reply to | #157061 |
On Sat 29 Aug 2015 at 21:39:21 +0300, Reco wrote: > Hi. > > On Sat, 29 Aug 2015 13:25:28 -0500 > rlharris@oplink.net wrote: > > > On Sat, August 29, 2015 6:53 am, tomas@tuxteam.de wrote: > > > Also netstat (issued from your laptop) gives insight. For example > > > 'netstat - -lntu' shows you the TCP or UDP listening sockets. If you are > > > root (or sudo, of course), the extra option -p tells you which process is > > > "at the other side" listening. > > > > > > Note that the dhcp client itself (which you need to get an IP address to > > > take part in your customer's network) puts you already at some risk, > > > depending on how it's configured. > > > > Here is the output from the laptop: > > > > # netstat -lntup > > Active Internet connections (only servers) > > Prot Rec Snd Local Address Foreign State PID/Program name > > -Q -Q Address > > tcp 0 0 0.0.0.0:9999 0.0.0.0:* LIS 561/inetd > > tcp 0 0 0.0.0.0:111 0.0.0.0:* LIS 530/rpcbind > > tcp 0 0 0.0.0.0:46225 0.0.0.0:* LIS 540/rpc.statd > > tcp 0 0 0.0.0.0:22 0.0.0.0:* LIS 568/sshd > > tcp 0 0 127.0.0.1:631 0.0.0.0:* LIS 1248/cupsd > > tcp 0 0 127.0.0.1:5432 0.0.0.0:* LIS 675/postgres > > tcp 0 0 127.0.0.1:25 0.0.0.0:* LIS 1063/exim4 > > tcp 0 0 127.0.0.1:2628 0.0.0.0:* LIS 599/0 > > tcp6 0 0 :::111 :::* LIS 530/rpcbind > > tcp6 0 0 :::38930 :::* LIS 540/rpc.statd > > tcp6 0 0 :::22 :::* LIS 568/sshd > > tcp6 0 0 ::1:631 :::* LIS 1248/cupsd > > tcp6 0 0 ::1:5432 :::* LIS 675/postgres > > tcp6 0 0 ::1:25 :::* LIS 1063/exim4 > > udp 0 0 0.0.0.0:36358 0.0.0.0:* 612/avahi-daemon:r > > udp 0 0 0.0.0.0:631 0.0.0.0:* 647/cups-browsed > > udp 0 0 0.0.0.0:689 0.0.0.0:* 530/rpcbind > > udp 0 0 127.0.0.1:716 0.0.0.0:* 540/rpc.statd > > udp 0 0 0.0.0.0:57106 0.0.0.0:* 540/rpc.statd > > udp 0 0 0.0.0.0:111 0.0.0.0:* 530/rpcbind > > udp 0 0 192.168.1.99:123 0.0.0.0:* 664/ntpd > > udp 0 0 127.0.0.1:123 0.0.0.0:* 664/ntpd > > udp 0 0 0.0.0.0:123 0.0.0.0:* 664/ntpd > > udp 0 0 0.0.0.0:5353 0.0.0.0:* 612/avahi-daemon:r > > udp6 0 0 :::689 :::* 530/rpcbind > > udp6 0 0 :::43913 :::* 540/rpc.statd > > udp6 0 0 :::111 :::* 530/rpcbind > > udp6 0 0 fe80::ba70:f4ff:fe2:123 :::* 664/ntpd > > udp6 0 0 ::1:123 :::* 664/ntpd > > udp6 0 0 :::123 :::* 664/ntpd > > udp6 0 0 :::5353 :::* 612/avahi-daemon:r > > udp6 0 0 :::44274 :::* 612/avahi-daemon:r > > # > > > > Regrettably, the formatting of the output does not consider the need to > > include the output in the body of an e-mail, so editing was required to > > remove excess spaces so as to prevent every line from being wrapped. > > > Something like this should save you from the most troubles provided > that you don't plan to use your laptop as a print server or NFS: > > iptables -P INPUT DROP > iptables -A INPUT -i lo -j ACCEPT > iptables -A INPUT -p icmp -j ACCEPT > iptables -A INPUT -m conntrack --ctstate INVALID -j DROP > iptables -A INPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED \ > -j ACCEPT > iptables -A INPUT -p udp -m conntrack --ctstate RELATED,ESTABLISHED \ > -j ACCEPT > iptables -A INPUT -p tcp --dport 22 -j ACCEPT > iptables -A INPUT -p udp --dport 123 -j ACCEPT > > iptables -P FORWARD DROP > > ip6tables -P INPUT DROP > ip6tables -A INPUT -p ipv6-icmp -j ACCEPT > ip6tables -A INPUT -m conntrack --ctstate INVALID -j DROP > ip6tables -A INPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED \ > -j ACCEPT > ip6tables -A INPUT -p udp -m conntrack --ctstate RELATED,ESTABLISHED \ > -j ACCEPT > ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT > ip6tables -A INPUT -p udp --dport 123 -j ACCEPT > > ip6tables -P FORWARD DROP > > > Of course, it's *very* simplistic set of rules (for example, someone > may consider accepting ssh connections from arbitrary hosts a bad idea), > but it should work. Why does he need any iptables rules? I see nothing at risk there. It seems to me he can be confident his computer is safe. > Two things I'm unsure of are: > > 1) Avahi's udp 5353. I don't see any value in mDNS (especially in office > network), but YMMV. There is much value in mDNS in an office network with CUPS nowadays. > 2) Whatever thing you're listening for on tcp 9999 with inetd. Ditto.
[toc] | [prev] | [next] | [standalone]
| From | Reco <recoverym4n@gmail.com> |
|---|---|
| Date | 2015-08-29 21:20 +0200 |
| Message-ID | <q2TPr-2wt-9@gated-at.bofh.it> |
| In reply to | #157063 |
Hi. On Sat, 29 Aug 2015 20:01:40 +0100 Brian <ad44@cityscape.co.uk> wrote: > On Sat 29 Aug 2015 at 21:39:21 +0300, Reco wrote: > > > Hi. > > > > On Sat, 29 Aug 2015 13:25:28 -0500 > > rlharris@oplink.net wrote: > > > > > On Sat, August 29, 2015 6:53 am, tomas@tuxteam.de wrote: > > > > Also netstat (issued from your laptop) gives insight. For example > > > > 'netstat - -lntu' shows you the TCP or UDP listening sockets. If you are > > > > root (or sudo, of course), the extra option -p tells you which process is > > > > "at the other side" listening. > > > > > > > > Note that the dhcp client itself (which you need to get an IP address to > > > > take part in your customer's network) puts you already at some risk, > > > > depending on how it's configured. > > > > > > Here is the output from the laptop: > > > > > > # netstat -lntup > > > Active Internet connections (only servers) > > > Prot Rec Snd Local Address Foreign State PID/Program name <skip> > > > # > > > > > > Regrettably, the formatting of the output does not consider the need to > > > include the output in the body of an e-mail, so editing was required to > > > remove excess spaces so as to prevent every line from being wrapped. > > > > > > Something like this should save you from the most troubles provided > > that you don't plan to use your laptop as a print server or NFS: > > <skip> > > > > > > Of course, it's *very* simplistic set of rules (for example, someone > > may consider accepting ssh connections from arbitrary hosts a bad idea), > > but it should work. > > Why does he need any iptables rules? I see nothing at risk there. It > seems to me he can be confident his computer is safe. You need to look better. As of now, this laptop: 1) Has NFS portmapper open for no good reason. 2) Has some (possibly badly configured) tcp service port 9999. 3) Has possibly misconfigured SSH (i.e. PasswordAuthentication yes - a bad idea for untrusted network). > > Two things I'm unsure of are: > > > > 1) Avahi's udp 5353. I don't see any value in mDNS (especially in office > > network), but YMMV. > > There is much value in mDNS in an office network with CUPS nowadays. Provided that an office network allows multicasts *and* it's not a all-Windows shop *and* they did not forget to allow dnssd server-side - it's a possibility. Chances for all this are slim IMO. Reco
[toc] | [prev] | [next] | [standalone]
| From | Brian <ad44@cityscape.co.uk> |
|---|---|
| Date | 2015-08-29 21:50 +0200 |
| Message-ID | <q2Uiu-38a-15@gated-at.bofh.it> |
| In reply to | #157065 |
On Sat 29 Aug 2015 at 22:18:00 +0300, Reco wrote: > Hi. > > On Sat, 29 Aug 2015 20:01:40 +0100 > Brian <ad44@cityscape.co.uk> wrote: > > > On Sat 29 Aug 2015 at 21:39:21 +0300, Reco wrote: > > > > > Hi. > > > > > > On Sat, 29 Aug 2015 13:25:28 -0500 > > > rlharris@oplink.net wrote: > > > > > > > On Sat, August 29, 2015 6:53 am, tomas@tuxteam.de wrote: > > > > > Also netstat (issued from your laptop) gives insight. For example > > > > > 'netstat - -lntu' shows you the TCP or UDP listening sockets. If you are > > > > > root (or sudo, of course), the extra option -p tells you which process is > > > > > "at the other side" listening. > > > > > > > > > > Note that the dhcp client itself (which you need to get an IP address to > > > > > take part in your customer's network) puts you already at some risk, > > > > > depending on how it's configured. > > > > > > > > Here is the output from the laptop: > > > > > > > > # netstat -lntup > > > > Active Internet connections (only servers) > > > > Prot Rec Snd Local Address Foreign State PID/Program name > <skip> > > > > # > > > > > > > > Regrettably, the formatting of the output does not consider the need to > > > > include the output in the body of an e-mail, so editing was required to > > > > remove excess spaces so as to prevent every line from being wrapped. > > > > > > > > > Something like this should save you from the most troubles provided > > > that you don't plan to use your laptop as a print server or NFS: > > > > <skip> > > > > > > > > > Of course, it's *very* simplistic set of rules (for example, someone > > > may consider accepting ssh connections from arbitrary hosts a bad idea), > > > but it should work. > > > > Why does he need any iptables rules? I see nothing at risk there. It > > seems to me he can be confident his computer is safe. > > You need to look better. As of now, this laptop: > > 1) Has NFS portmapper open for no good reason. > > 2) Has some (possibly badly configured) tcp service port 9999. > > 3) Has possibly misconfigured SSH (i.e. PasswordAuthentication yes - a > bad idea for untrusted network). Covering up such problems with iptables doesn't tackle such problems. Why not fix them at source? > > > Two things I'm unsure of are: > > > > > > 1) Avahi's udp 5353. I don't see any value in mDNS (especially in office > > > network), but YMMV. > > > > There is much value in mDNS in an office network with CUPS nowadays. > > Provided that an office network allows multicasts *and* it's not a > all-Windows shop *and* they did not forget to allow dnssd server-side - > it's a possibility. Chances for all this are slim IMO. No mDNS then. No printing.
[toc] | [prev] | [next] | [standalone]
| From | Reco <recoverym4n@gmail.com> |
|---|---|
| Date | 2015-08-29 22:00 +0200 |
| Message-ID | <q2Usa-3kb-5@gated-at.bofh.it> |
| In reply to | #157069 |
Hi. On Sat, 29 Aug 2015 20:40:47 +0100 Brian <ad44@cityscape.co.uk> wrote: > On Sat 29 Aug 2015 at 22:18:00 +0300, Reco wrote: > > > Hi. > > > > On Sat, 29 Aug 2015 20:01:40 +0100 > > Brian <ad44@cityscape.co.uk> wrote: > > > > > On Sat 29 Aug 2015 at 21:39:21 +0300, Reco wrote: > > > > > > > Hi. > > > > > > > > On Sat, 29 Aug 2015 13:25:28 -0500 > > > > rlharris@oplink.net wrote: > > > > > > > > > On Sat, August 29, 2015 6:53 am, tomas@tuxteam.de wrote: > > > > > > Also netstat (issued from your laptop) gives insight. For example > > > > > > 'netstat - -lntu' shows you the TCP or UDP listening sockets. If you are > > > > > > root (or sudo, of course), the extra option -p tells you which process is > > > > > > "at the other side" listening. > > > > > > > > > > > > Note that the dhcp client itself (which you need to get an IP address to > > > > > > take part in your customer's network) puts you already at some risk, > > > > > > depending on how it's configured. > > > > > > > > > > Here is the output from the laptop: > > > > > > > > > > # netstat -lntup > > > > > Active Internet connections (only servers) > > > > > Prot Rec Snd Local Address Foreign State PID/Program name > > <skip> > > > > > # > > > > > > > > > > Regrettably, the formatting of the output does not consider the need to > > > > > include the output in the body of an e-mail, so editing was required to > > > > > remove excess spaces so as to prevent every line from being wrapped. > > > > > > > > > > > > Something like this should save you from the most troubles provided > > > > that you don't plan to use your laptop as a print server or NFS: > > > > > > <skip> > > > > > > > > > > > > Of course, it's *very* simplistic set of rules (for example, someone > > > > may consider accepting ssh connections from arbitrary hosts a bad idea), > > > > but it should work. > > > > > > Why does he need any iptables rules? I see nothing at risk there. It > > > seems to me he can be confident his computer is safe. > > > > You need to look better. As of now, this laptop: > > > > 1) Has NFS portmapper open for no good reason. > > > > 2) Has some (possibly badly configured) tcp service port 9999. > > > > 3) Has possibly misconfigured SSH (i.e. PasswordAuthentication yes - a > > bad idea for untrusted network). > > Covering up such problems with iptables doesn't tackle such problems. On the contrary, it does. Since nobody can connect to the problem service from the outside - it's irrelevant whenever the service is secure or not. > Why not fix them at source? I dunno. Some people are reluctant to remove stuff. Especially if the "stuff" in question is installed by "Standard" task of d-i. Adding stuff on top of "standard" installation is easier to grasp. > > > > Two things I'm unsure of are: > > > > > > > > 1) Avahi's udp 5353. I don't see any value in mDNS (especially in office > > > > network), but YMMV. > > > > > > There is much value in mDNS in an office network with CUPS nowadays. > > > > Provided that an office network allows multicasts *and* it's not a > > all-Windows shop *and* they did not forget to allow dnssd server-side - > > it's a possibility. Chances for all this are slim IMO. > > No mDNS then. No printing. Clarification needed. Are you suggesting that disabling Avahi also disables CUPS? It's not true. Are you suggesting that with disabling Avahi CUPS looses ability to print? It's not true too. Or are you suggesting that with Avahi disabled a client is unable to print using *known* CUPS over the network? It's also a false statement. Reco
[toc] | [prev] | [next] | [standalone]
| From | Brian <ad44@cityscape.co.uk> |
|---|---|
| Date | 2015-08-30 00:10 +0200 |
| Message-ID | <q2WtX-6xG-7@gated-at.bofh.it> |
| In reply to | #157071 |
On Sat 29 Aug 2015 at 22:58:57 +0300, Reco wrote: > Hi. > > On Sat, 29 Aug 2015 20:40:47 +0100 > Brian <ad44@cityscape.co.uk> wrote: > > > On Sat 29 Aug 2015 at 22:18:00 +0300, Reco wrote: > > > > > Hi. > > > > > > On Sat, 29 Aug 2015 20:01:40 +0100 > > > Brian <ad44@cityscape.co.uk> wrote: > > > > > > > On Sat 29 Aug 2015 at 21:39:21 +0300, Reco wrote: > > > > > > > > > Hi. > > > > > > > > > > On Sat, 29 Aug 2015 13:25:28 -0500 > > > > > rlharris@oplink.net wrote: > > > > > > > > > > > On Sat, August 29, 2015 6:53 am, tomas@tuxteam.de wrote: > > > > > > > Also netstat (issued from your laptop) gives insight. For example > > > > > > > 'netstat - -lntu' shows you the TCP or UDP listening sockets. If you are > > > > > > > root (or sudo, of course), the extra option -p tells you which process is > > > > > > > "at the other side" listening. > > > > > > > > > > > > > > Note that the dhcp client itself (which you need to get an IP address to > > > > > > > take part in your customer's network) puts you already at some risk, > > > > > > > depending on how it's configured. > > > > > > > > > > > > Here is the output from the laptop: > > > > > > > > > > > > # netstat -lntup > > > > > > Active Internet connections (only servers) > > > > > > Prot Rec Snd Local Address Foreign State PID/Program name > > > <skip> > > > > > > # > > > > > > > > > > > > Regrettably, the formatting of the output does not consider the need to > > > > > > include the output in the body of an e-mail, so editing was required to > > > > > > remove excess spaces so as to prevent every line from being wrapped. > > > > > > > > > > > > > > > Something like this should save you from the most troubles provided > > > > > that you don't plan to use your laptop as a print server or NFS: > > > > > > > > <skip> > > > > > > > > > > > > > > > Of course, it's *very* simplistic set of rules (for example, someone > > > > > may consider accepting ssh connections from arbitrary hosts a bad idea), > > > > > but it should work. > > > > > > > > Why does he need any iptables rules? I see nothing at risk there. It > > > > seems to me he can be confident his computer is safe. > > > > > > You need to look better. As of now, this laptop: > > > > > > 1) Has NFS portmapper open for no good reason. > > > > > > 2) Has some (possibly badly configured) tcp service port 9999. > > > > > > 3) Has possibly misconfigured SSH (i.e. PasswordAuthentication yes - a > > > bad idea for untrusted network). > > > > Covering up such problems with iptables doesn't tackle such problems. > > On the contrary, it does. Since nobody can connect to the problem > service from the outside - it's irrelevant whenever the service is > secure or not. > > > > Why not fix them at source? > > I dunno. Some people are reluctant to remove stuff. Especially if the > "stuff" in question is installed by "Standard" task of d-i. > Adding stuff on top of "standard" installation is easier to grasp. I hadn't appreciated that iptables main function is papering over the cracks. > > > > > Two things I'm unsure of are: > > > > > > > > > > 1) Avahi's udp 5353. I don't see any value in mDNS (especially in office > > > > > network), but YMMV. > > > > > > > > There is much value in mDNS in an office network with CUPS nowadays. > > > > > > Provided that an office network allows multicasts *and* it's not a > > > all-Windows shop *and* they did not forget to allow dnssd server-side - > > > it's a possibility. Chances for all this are slim IMO. > > > > No mDNS then. No printing. > > Clarification needed. > > Are you suggesting that disabling Avahi also disables CUPS? It's not > true. > Are you suggesting that with disabling Avahi CUPS looses ability to > print? It's not true too. > Or are you suggesting that with Avahi disabled a client is unable to > print using *known* CUPS over the network? It's also a false statement. None of these. Bonjour plays a central role in printing over a network. Discarding it as a very useful tool isn't very helpful.
[toc] | [prev] | [next] | [standalone]
| From | Reco <recoverym4n@gmail.com> |
|---|---|
| Date | 2015-08-30 00:30 +0200 |
| Message-ID | <q2WNj-6U1-5@gated-at.bofh.it> |
| In reply to | #157078 |
Hi. On Sat, 29 Aug 2015 23:00:51 +0100 Brian <ad44@cityscape.co.uk> wrote: > On Sat 29 Aug 2015 at 22:58:57 +0300, Reco wrote: > > > Hi. > > > > On Sat, 29 Aug 2015 20:40:47 +0100 > > Brian <ad44@cityscape.co.uk> wrote: > > > > > On Sat 29 Aug 2015 at 22:18:00 +0300, Reco wrote: > > > > > > > Hi. > > > > > > > > On Sat, 29 Aug 2015 20:01:40 +0100 > > > > Brian <ad44@cityscape.co.uk> wrote: > > > > > > > > > On Sat 29 Aug 2015 at 21:39:21 +0300, Reco wrote: > > > > > > > > > > > Hi. > > > > > > > > > > > > On Sat, 29 Aug 2015 13:25:28 -0500 > > > > > > rlharris@oplink.net wrote: > > > > > > > > > > > > > On Sat, August 29, 2015 6:53 am, tomas@tuxteam.de wrote: > > > > > > > > Also netstat (issued from your laptop) gives insight. For example > > > > > > > > 'netstat - -lntu' shows you the TCP or UDP listening sockets. If you are > > > > > > > > root (or sudo, of course), the extra option -p tells you which process is > > > > > > > > "at the other side" listening. > > > > > > > > > > > > > > > > Note that the dhcp client itself (which you need to get an IP address to > > > > > > > > take part in your customer's network) puts you already at some risk, > > > > > > > > depending on how it's configured. > > > > > > > > > > > > > > Here is the output from the laptop: > > > > > > > > > > > > > > # netstat -lntup > > > > > > > Active Internet connections (only servers) > > > > > > > Prot Rec Snd Local Address Foreign State PID/Program name > > > > <skip> > > > > > > > # > > > > > > > > > > > > > > Regrettably, the formatting of the output does not consider the need to > > > > > > > include the output in the body of an e-mail, so editing was required to > > > > > > > remove excess spaces so as to prevent every line from being wrapped. > > > > > > > > > > > > > > > > > > Something like this should save you from the most troubles provided > > > > > > that you don't plan to use your laptop as a print server or NFS: > > > > > > > > > > <skip> > > > > > > > > > > > > > > > > > > Of course, it's *very* simplistic set of rules (for example, someone > > > > > > may consider accepting ssh connections from arbitrary hosts a bad idea), > > > > > > but it should work. > > > > > > > > > > Why does he need any iptables rules? I see nothing at risk there. It > > > > > seems to me he can be confident his computer is safe. > > > > > > > > You need to look better. As of now, this laptop: > > > > > > > > 1) Has NFS portmapper open for no good reason. > > > > > > > > 2) Has some (possibly badly configured) tcp service port 9999. > > > > > > > > 3) Has possibly misconfigured SSH (i.e. PasswordAuthentication yes - a > > > > bad idea for untrusted network). > > > > > > Covering up such problems with iptables doesn't tackle such problems. > > > > On the contrary, it does. Since nobody can connect to the problem > > service from the outside - it's irrelevant whenever the service is > > secure or not. > > > > > > > Why not fix them at source? > > > > I dunno. Some people are reluctant to remove stuff. Especially if the > > "stuff" in question is installed by "Standard" task of d-i. > > Adding stuff on top of "standard" installation is easier to grasp. > > I hadn't appreciated that iptables main function is papering over the cracks. It's the most common usage of iptables IMO, and, to some extent it's Unix-style. I.e. you don't touch so called "base system", you merely write your own kludges around it. > > > > > > Two things I'm unsure of are: > > > > > > > > > > > > 1) Avahi's udp 5353. I don't see any value in mDNS (especially in office > > > > > > network), but YMMV. > > > > > > > > > > There is much value in mDNS in an office network with CUPS nowadays. > > > > > > > > Provided that an office network allows multicasts *and* it's not a > > > > all-Windows shop *and* they did not forget to allow dnssd server-side - > > > > it's a possibility. Chances for all this are slim IMO. > > > > > > No mDNS then. No printing. > > > > Clarification needed. > > > > Are you suggesting that disabling Avahi also disables CUPS? It's not > > true. > > Are you suggesting that with disabling Avahi CUPS looses ability to > > print? It's not true too. > > Or are you suggesting that with Avahi disabled a client is unable to > > print using *known* CUPS over the network? It's also a false statement. > > None of these. Bonjour plays a central role in printing over a network. > Discarding it as a very useful tool isn't very helpful. So it must be "printing over the network using *unknown* CUPS". While I can grant that such usecase is valid, it has way too many restrictions and prerequisites for my taste. Let's leave it at this. Reco
[toc] | [prev] | [next] | [standalone]
| From | Brian <ad44@cityscape.co.uk> |
|---|---|
| Date | 2015-08-30 00:50 +0200 |
| Message-ID | <q2X6F-7gn-3@gated-at.bofh.it> |
| In reply to | #157079 |
On Sun 30 Aug 2015 at 01:22:16 +0300, Reco wrote: > On Sat, 29 Aug 2015 23:00:51 +0100 > Brian <ad44@cityscape.co.uk> wrote: > > > > I hadn't appreciated that iptables main function is papering over the cracks. > > It's the most common usage of iptables IMO, and, to some extent it's > Unix-style. I.e. you don't touch so called "base system", you merely > write your own kludges around it. I prefer a sensible Debian-style approach without kludges, Close down all unwanted services by purging the relevant packages. IMHO the OP's laptop has no obvious security defects. Take it to work and use it confidently.
[toc] | [prev] | [next] | [standalone]
| From | <tomas@tuxteam.de> |
|---|---|
| Date | 2015-08-30 09:40 +0200 |
| Message-ID | <q35nA-2iL-15@gated-at.bofh.it> |
| In reply to | #157078 |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Sat, Aug 29, 2015 at 11:00:51PM +0100, Brian wrote: [...] > None of these. Bonjour plays a central role in printing over a network. > Discarding it as a very useful tool isn't very helpful. It aids in printer discovery. If your configuration is somewhat static, it's totally superfluous. In a highly dynamic environment it's convenient. I know for sure: my printing runs perfectly fine without Avahi (and without CUPS, at that). I've just two printers I've to talk to, "work" and "home". Once they are configured, LPRNG does the rest. Pick your tools. Know why. - -- t -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iEYEARECAAYFAlXisWYACgkQBcgs9XrR2kZVhwCggUEl80cZRBpY9UHhQwlMRnld wiEAniy1AV7ewsH2Ho33oM3GobIvQQBA =2X1C -----END PGP SIGNATURE-----
[toc] | [prev] | [next] | [standalone]
| From | Brian <ad44@cityscape.co.uk> |
|---|---|
| Date | 2015-08-30 16:10 +0200 |
| Message-ID | <q3bt0-2Nh-11@gated-at.bofh.it> |
| In reply to | #157106 |
On Sun 30 Aug 2015 at 09:31:50 +0200, tomas@tuxteam.de wrote: > On Sat, Aug 29, 2015 at 11:00:51PM +0100, Brian wrote: > > [...] > > > None of these. Bonjour plays a central role in printing over a network. > > Discarding it as a very useful tool isn't very helpful. > > It aids in printer discovery. If your configuration is somewhat static, > it's totally superfluous. In a highly dynamic environment it's convenient. The distinction between static and dynamic is a useful one when it comes to printing. With a policy of only printing to a local USB connected printer or a designated server in client.conf the need for service discovery with avahi-daemon is, as you say, superfluous. Whether it can be removed depends on the system setup. On GNOME its purging will take gnome-core with it. That doesn't look good. :), so disabling it looks a better bet. In a dynamic environment (moving from site to site, for example) I'd see the status of avahi-daemon as essential, not simply convenient. Setting up a static configuration in such a circumstance may not be easy. There is no assurance that anyone even knows the server address and, for some devices such as a mobile phone, it wouldn't do you much good if they did. > I know for sure: my printing runs perfectly fine without Avahi (and > without CUPS, at that). I've just two printers I've to talk to, "work" > and "home". Once they are configured, LPRNG does the rest. This is a static configuration equivalent to the CUPS one outlined above. It has the same drawbacks. There is no reason why either setup shouldn't produce a satisfactory printing experience. I believe LPRNG cannot do service discovery so a roaming user may have the trouble of needing to get a server name for every new situation. > Pick your tools. Know why. Indeed; but banning one of them reduces the possibilities of effortless printing.
[toc] | [prev] | [next] | [standalone]
| From | <tomas@tuxteam.de> |
|---|---|
| Date | 2015-08-30 18:30 +0200 |
| Message-ID | <q3dEu-5Qw-5@gated-at.bofh.it> |
| In reply to | #157124 |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Sun, Aug 30, 2015 at 03:07:44PM +0100, Brian wrote: > On Sun 30 Aug 2015 at 09:31:50 +0200, tomas@tuxteam.de wrote: > > > On Sat, Aug 29, 2015 at 11:00:51PM +0100, Brian wrote: > > > > [...] > > > > > None of these. Bonjour plays a central role in printing over a network. > > > Discarding it as a very useful tool isn't very helpful. > > > > It aids in printer discovery. If your configuration is somewhat static, > > it's totally superfluous. In a highly dynamic environment it's convenient. > > The distinction between static and dynamic is a useful one when it comes > to printing. With a policy of only printing to a local USB connected > printer or a designated server in client.conf the need for service > discovery with avahi-daemon is, as you say, superfluous. Whether it can > be removed depends on the system setup. On GNOME its purging will take > gnome-core with it. That doesn't look good. :), so disabling it looks a > better bet. I remember something like that. Actually, my wrangling to get rid of Avahi, and the realization of how intertwined things had become was the first nail in Gnome's coffin (for me, that is!). A couple more nails, and I'm now Gnome-free. Farewell, it was nice while it lasted. Too complex, to many dependencies and too hard to debug [1] > In a dynamic environment (moving from site to site, for example) I'd see > the status of avahi-daemon as essential, not simply convenient [...] > > I know for sure: my printing runs perfectly fine without Avahi [...] > This is a static configuration equivalent to the CUPS one outlined > above. It has the same drawbacks. There is no reason why either setup > shouldn't produce a satisfactory printing experience. I believe LPRNG > cannot do service discovery so a roaming user may have the trouble of > needing to get a server name for every new situation. Correct. LPRNG doesn't service discovery. I do that discovery (e.g. I walk in the office to the copier-printer and look at the label slapped on it where its IP is printed on). I gladly do that discovery. > > Pick your tools. Know why. > > Indeed; but banning one of them reduces the possibilities of effortless > printing. "Banning" is a loaded word. I choose simplicity (and am ready to pay some price for it). I don't tell others to do likewise, I just offer help in making a choice. I can only ban it from my computer. - - - - - [1] A case in point: at home we have a postscript network printer. For one file, my SO's computer (a fresh Debian installation, with all the Mate and Cups goodnes isn't able to print one specific PDF. My box, with LPRNG and apsfilter does print it. The CUPS log files say that yes, everything is fine. I've the hunch that the printer's Postscript implementation is crappy, and the CUPS variant is sending some Postscript Level 2 the printer can't digest (it prints an error message instead of the wanted document, so it seems to be the interpreter in the printer freaking out). With LPRNG/apsfilter, I'd be able to debug the thing. With all this CUPS mess, I don't even know where to start. Ick. Regards - -- tomás -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iEYEARECAAYFAlXjLx4ACgkQBcgs9XrR2kZTGgCfdLm6A73a718kWqyJx6HjiDR5 ZG4An2VHT4+16jfSPhQydfpvjFhUtTc7 =3vun -----END PGP SIGNATURE-----
[toc] | [prev] | [next] | [standalone]
| From | Brian <ad44@cityscape.co.uk> |
|---|---|
| Date | 2015-08-30 20:50 +0200 |
| Message-ID | <q3fPX-ve-3@gated-at.bofh.it> |
| In reply to | #157127 |
On Sun 30 Aug 2015 at 18:28:14 +0200, tomas@tuxteam.de wrote:
> On Sun, Aug 30, 2015 at 03:07:44PM +0100, Brian wrote:
> > On Sun 30 Aug 2015 at 09:31:50 +0200, tomas@tuxteam.de wrote:
> >
> > > I know for sure: my printing runs perfectly fine without Avahi [...]
>
> > This is a static configuration equivalent to the CUPS one outlined
> > above. It has the same drawbacks. There is no reason why either setup
> > shouldn't produce a satisfactory printing experience. I believe LPRNG
> > cannot do service discovery so a roaming user may have the trouble of
> > needing to get a server name for every new situation.
>
> Correct. LPRNG doesn't service discovery. I do that discovery (e.g. I
> walk in the office to the copier-printer and look at the label slapped
> on it where its IP is printed on). I gladly do that discovery.
That's fine and a helpful technique. But it isn't the norm in all
offices and if there is no one knowledgeable about.......
> > > Pick your tools. Know why.
> >
> > Indeed; but banning one of them reduces the possibilities of effortless
> > printing.
>
> "Banning" is a loaded word. I choose simplicity (and am ready to pay some
> price for it). I don't tell others to do likewise, I just offer help in
> making a choice. I can only ban it from my computer.
Apologies. I did not mean to imply you were all for the eradication of
service discovery on everyone's computer and did understand you had made
a choice for yourself only. I look like a Bonjour advocate but in a
similar way to you I have no wish to enforce its use. However, there is
a more mobile aspect to computing today and it cannot be ignored when it
comes to printing.
Picture a cosy suburban house in England. Daughter Number 1 returns with
a friend after a good day at the school's sports day. A simple job turns
into a saga.
Daughter Number 1: Hey Dad, Freya has a brilliant photo on her mobile of
me winning the 200 metre race. Can we print it out?
Dad (Dropping into technical expert mode): The IP of the server is,,,,
Daughter Number 1: How does she put it into her phone?
Dad (flummoxed): I don't know. She probably can't. That's the problem
with new technology.
Daughter Number 1: Please Dad, I want to show the photo to my friends.
Dad (Back in technical expert mode): Have her email it to me. I'll
process and print it.
Daughter Number 1: Freya has used up her WiFi allowance. Can't we just
send it to your computer.
Dad: No. I'll not have service discovery in this house. And I've no lead
for the phone and would have to install special software anyway.
Daughter Number 1: Daaaaaad!
> - - - -
> [1] A case in point: at home we have a postscript network printer.
> For one file, my SO's computer (a fresh Debian installation, with
> all the Mate and Cups goodnes isn't able to print one specific PDF.
> My box, with LPRNG and apsfilter does print it. The CUPS log files
> say that yes, everything is fine. I've the hunch that the printer's
> Postscript implementation is crappy, and the CUPS variant is sending
> some Postscript Level 2 the printer can't digest (it prints an error
> message instead of the wanted document, so it seems to be the interpreter
> in the printer freaking out). With LPRNG/apsfilter, I'd be able to
> debug the thing. With all this CUPS mess, I don't even know where
> to start. Ick.
I've had similar. It's nothing to do with CUPS. cups-filters is the
resposible agent and changing the renderer can help.
[toc] | [prev] | [next] | [standalone]
| From | rlharris@oplink.net |
|---|---|
| Date | 2015-08-29 21:30 +0200 |
| Message-ID | <q2TZ7-2Ii-13@gated-at.bofh.it> |
| In reply to | #157063 |
On Sat, August 29, 2015 2:01 pm, Brian wrote: > There is much value in mDNS in an office network with CUPS nowadays. Simply out of custom and the influence of the guru who helped me get started in Debian, I use static ip addresses for everything (including the printer) in my LAN, except the laptop. And I routinely connect the laptop with ethernet, rather than via WiFi. And every time I install or reinstall Debian on a machine, one of the first things I do is configure CUPS to use the laser as the default printer for the machine. In view of the fact that the configuration of CUPS takes only two or three minutes, I do not enable sharing of the printer. And all my printing is done locally, on the laser printer. So I do not understand how avahi or mDNS could benefit me with this tiny personal LAN. If it is something which I should be using, please enlighten me. RLH
[toc] | [prev] | [next] | [standalone]
| From | Brian <ad44@cityscape.co.uk> |
|---|---|
| Date | 2015-08-29 22:00 +0200 |
| Message-ID | <q2Usa-3kb-9@gated-at.bofh.it> |
| In reply to | #157067 |
On Sat 29 Aug 2015 at 14:25:17 -0500, rlharris@oplink.net wrote: > On Sat, August 29, 2015 2:01 pm, Brian wrote: > > There is much value in mDNS in an office network with CUPS nowadays. > > Simply out of custom and the influence of the guru who helped me get > started in Debian, I use static ip addresses for everything (including the > printer) in my LAN, except the laptop. And I routinely connect the laptop > with ethernet, rather than via WiFi. > > And every time I install or reinstall Debian on a machine, one of the > first things I do is configure CUPS to use the laser as the default > printer for the machine. In view of the fact that the configuration of > CUPS takes only two or three minutes, I do not enable sharing of the > printer. And all my printing is done locally, on the laser printer. > > So I do not understand how avahi or mDNS could benefit me with this tiny > personal LAN. If it is something which I should be using, please > enlighten me. mDNS does nothing nothing for local printers which are not shared. If you think it has no benefit for you in that situation you are correct. But your question was about taking your laptop onto a foreign network. Which goalposts do you want to aim for? What is your point if we take this into account?
[toc] | [prev] | [next] | [standalone]
Page 3 of 4 — ← Prev page 1 2 [3] 4 Next page →
Back to top | Article view | linux.debian.user
csiph-web