warthog9

@corbet@social.kernel.org @lwn@fedi.lwn.net if you need more capacity, give a shout, I've a bit i can throw to the cause if you need it

Wonders when we can have #PyConCA again...

Just wondering...

Question that's spent 2 days already driving me crazy: has anyone broken security+ 3.0 yet?

Today's cranky involves the Urban Arrow bike's garage door opener not being able to pair, and I'm now trawling the universe looking for last gen openers to stash and replace this with.

This would then obviously leave me a unit I could dismantle...

OOOOOOUCH, had a drive fail in a mirrored pair back in December, and I've been so busy I haven't gotten to it till today-ish. Looked at it, I can get a backup of the data, and all good, right?

Well, it is, UNTIL I go to look at the prices of the obvious replacements:
$89.99/ea in September 2024
$245/ea today

OUCH

Well, should have pretty graphs back soon, but ugh

@gregkh@social.kernel.org @argv_minus_one@mastodon.sdf.org won't disagree in the slightest on that front, and I'm not laying my grumbles at the kernel communities feet here. The kernel security team did it's job, there's a fix, no issue there. Where I'm grumbling is it looks like the public disclosure happened before the distros were aware, and in such a way that there was even a chance at a fix out for people to actually update to. While I would love to have folks be able to go, compile their own kernel and get to mainline to pick up the fix, the reality in a lot of deployments means you can't, even in some of the deployments I've got to handle these days we can't just because of other driver mess issues (that's a whole different can of worms worthy of much void screaming, but I'm not going to do that here right now). Debian and Ubuntu look like they have a minor up side they left the code as modules, reject loading the modules and you can steer clear of this right now. EL / Fedora, look like they picked the option to compile it straight in and are kinda up a creek right now. Fedora will likely be sorted quite shortly, but that's because they track mainline a lot closer. EL, only good option there is to flip to elrepo and go mainline there assuming you don't have other messes to deal with. Mostly the grumble is laid at the feet of the finder wanting to publicize it seemingly as quickly as they did, some of the distros for dragging their feet and/or ignoring these things the way they tend to, and for at least not vaguely giving the distros a chance to go "ohhh poop", and have fixes in place once it was public (again that's more laid back at the publicized situation vs. not). Right now there's a lot of scramble for a bunch of folks, and not a lot of ways to get to a fix, and that's where I'm grumbling from (though I haven't had enough coffee / tea yet this morning to go find how far that's moved overnight, so bear with me if they've all miraculously pulled a fast one and everyone has a fix out for everyone)

@ehashman@cloudisland.nz twitch

@ehashman@cloudisland.nz pretty bad, and disclosure looks like it sucked so we aren't far from calling it a 0-day

@argv_minus_one@mastodon.sdf.org nevermind, I need to go remind myself why I don't drink: root@erebor:/var/log# modinfo algif_aead name: algif_aead filename: (builtin) description: AEAD kernel crypto API user space interface author: Stephan Mueller license: GPL file: crypto/algif_aead root@erebor:/var/log#

@argv_minus_one@mastodon.sdf.org I was just commenting something similar that the advisory seems to be wackadoodle in another venue. I'd argue this not having a broader security push before the public release happened, is a pretty serious failure on someone's part. I'm back-tracking if ELs are even at risk, because I can't find the module but I haven't confirmed if it's just compiled in and not a module now 😕 (I've seen notes they are, I just want to confirm before I just table flip and move to elrepo's mainline kernels to get around this)

Happy Linux update your kernel and reboot day!

@funkylab@mastodon.social It feels epicly sus that I tripped over it 6 months on only because Paypal was complaining they couldn't send me an e-mail. I also can't replicate it so something is very off somewhere, and I'm not convinced it's on my side.

stubs toe

OW, what the heck was that...

Ohhhhh, 'hi' Paypal, I see you stopped being able to send me e-mail back in October and I only just noticed. Lets take a look at why...

Apr  2 11:37:29 shards postfix/smtpd[85832]: SSL_accept error from mx0.slc.paypal.com[173.0.84.225]: Connection timed out
Apr  2 11:37:29 shards postfix/smtpd[85832]: lost connection after STARTTLS from mx0.slc.paypal.com[173.0.84.225] 

And that started back on October 18th (about when EPEL switched to OpenSSL 3.5, and Postfix got updated)?

Ok, kicks and giggles lets try a newer Postfix. Nope, didn't solve it.

Sooooo disables TLS announcement to Paypal's netblock

Ohhh THAT works?

So yeah #PayPal not only has broken TLS support somewhere, but they also don't try secondary MXes listed in DNS. That's pretty epicly bad e-mail setup frankly.

@CursedSilicon@social.restless.systems @kwf@social.afront.org that would be on you, we won't get involved till they've got their house back in order and capable of dealing with what we need.

@kwf@social.afront.org @CursedSilicon@social.restless.systems at the end of the day we are volunteering our time and energy. There's a threshold for what we can/want to fix, and what we can't. Specific to Gentoo we reached out, tried, it didn't work as it's not a good fit for the model we are running and how they are/aren't working.

@CursedSilicon@social.restless.systems @kwf@social.afront.org Gentoo fell into the FAQ: http://mirrors.fcix.net/faq/

@CursedSilicon@social.restless.systems @kwf@social.afront.org it's one of the bigger faster ones. I'm not sad about my connectivity to it 😜

@CursedSilicon@social.restless.systems @kwf@social.afront.org several entities, Ziply being one, there's a new one run by another entity within the past week too

@mwl@io.mwl.io I feel this in my bones