spyked: ^ my point in the first place. POSIX ACL was designed from the idea that "all users are equal, except /a/b can be accessed only by X and /c/d only by Y etc.". while saying that "Z can only access /e/f" can only be implemented as "/a/b and /c/d and etc. can't be accessed by Z". and sure, there's chroot, that sets /e/f to /, but in practice this introduces other issues
a111: Logged on 2018-04-19 18:26 mircea_popescu: "i can't identify you so here's the oval office"
hanbot: http://btcbase.org/log/2018-04-19#1803390 << exactly, that blew my mind. no idea why limiting someone to their homedir should be complicated either. isn't keeping users cloistered like...the fucking reason a "users" system even exists? what else is it for, personalized wallpaper?
mircea_popescu: the fucking path. and for the very good reason that it's nonsense enough to make gates proud.
mircea_popescu: you know what is the HARDEST, most screaming, wailing and tear ladden item every time i explain unix, the posix model, linux basics etc to fundamentally minded slavegirls that are well accomplished in other fields and can think ?
mircea_popescu: fucking path, the hack of all time.
trinque: now there's a point. user's shell should just have whatever commands he can use loaded into it
mircea_popescu: (which is what is the only fucking POSSIBLE meaning of "set home directory" : as far as ALL POSSIBLE terminals that user springs up, the indicated point in the filestructure is his root. and he sees its downstream and nothing else fucking ever.)
mircea_popescu: and it all came from original idiocy, "oh, to have bash AT ALL you must have access to /sbin/bash or else a copy of it somewhere". bullcrap. look at what apache does -- somehow it DOES manage to run all users' php crapolade from whatever directories. bash can (and obviously should fucking have) worked the exact same way. of course you can run bash from your homedir even if that is /home/users/f/u/c//k/t/h/i/s/l/u/s/e/r/john.
mircea_popescu: "i can't identify you so here's the oval office"
mircea_popescu: understand, this model whereby user falls into root because "we couldn't open the subdir you should have" is the lulz of all time.
spyked: (note that I did not claim this to be "the wrong way" or anything. just that in other access control schemes it can be explicitly expressed, in some cases at cost of implementation complexity etc.)
mircea_popescu: spyked, by making the first dir that's not specifically world-visible or his own whatever she wanted it to make.
spyked: anyway, I'm sure that this can be enforced by having all the other users except the "limited user" deny rwx access to their dirs. but this doesn't say anything about the "limited user" explicitly, only implicitly. kinda like in that joke with enclosing the sheep using as little fence material as possible.
spyked: mircea_popescu, okay, but can you make klinki see *only* /home/klinki/sikrit and nothing else? that's how I understood hanbot's problem. I dun see any practical way of doing it (other than by chroot'ing).
lobbesbot: BingoBoingo: The operation succeeded.
mircea_popescu: what the fuck, there's 0 high level difficulty here, 100% unixtards being unixtards.
mircea_popescu: and if you want to get fancy you can even reconstruct dirstructure by restating it while skipping invisible spots, so that a path may be /a/b/c/ for one and /a/c/ for another.
mircea_popescu: ie if you have / 755 root:root home/ 755 root:root klinki 755 klinki:klinki /sikrit 700 klinki:klinki then user bolek can see all the way to /home/klinki and user klinki all the way to /home/klinki/sikrit.
a111: Logged on 2018-04-19 10:24 spyked: http://btcbase.org/log/2018-04-19#1803146 <-- this is (nearly?) impossible to achieve within the Unix access control model. it's easy to express "no one but user1 has access to dir1", but no reasonable way of expressing the reverse, i.e. "user2 can access only dir2". must be one of the reasons why namespaces and cgroups were added to Linux
mircea_popescu: http://btcbase.org/log/2018-04-19#1803308 << very fucking easy to do, are you kidding me ? system builds the FS tree, exposes / to all users symbolically but only lists permitted files and then for every node in the directory treee only lists those which are either all or user.
ckang: i ended up just adding a deb8 vm and my entire router is virtualized now, only lose ~2Mbit off the top (148Mbit) while still only using the tunnel with wireguard
ckang: what have you managed to push encrypted on the board?
phf: i should probably test it at some point in isolation. it would be a pointless exercise though since i don't have a 20MBit/s pipe out anyway. perhaps the value might be "look at what custom board can do compared to this chinese crap", but i somehow doubt that would be the result.
phf: soekris was one of those boutique operations. guy closed the u.s. branch (he's scandinavian), and now he only makes high end DACs instead.
phf: it's a shame that soekris stopped making their network boards. asciilifeform though thinks they were overpriced, but i suspect it's "not made in china" premium. i have one soekris board with 4 years uptime, and i use another one for the router, which does some of the tricks ckang mentioned.
trinque: ah, I thought we were talking about the arm thing, but it goes double for intel
ckang: well its on the intel silicon
trinque: idea that the chinese wouldn't diddle cryptography devices they export is pretty entertaining.
ckang: would be extra components and they are very thrifty
ckang: https://www.aliexpress.com/item/Fanless-Mini-PC-4-Gigabit-Lan-Ethernet-NIC-Core-i3-security-AES-NI-Qotom-Router-Pfsense/32847784876.html <-- ooo, i3
ckang: https://www.aliexpress.com/item/Minisys-4-Lan-pfsense-minipc-Intel-atom-E3845-quad-core-mini-itx-motherboard-linux-firewall-computer/32825684280.html
ckang: spyked: i think at that point i would go with an intel atom board with dual or quad port from ali, they arent too bad price wise and you dont get stuck maintaining a fork
spyked: ckang, one alternative you can consider is "pcengines" board. plenty of info in the logs. fanless, runs coreboot bios iirc and has at least 2 gigabit ethernet ports.
ckang: then for a minute I was exploring using the ESP32's cryptography accelerator with QSPI and DMA
ckang: with the ability to do policy based routing over various tunnels/vpns/tor what not
a111: Logged on 2018-04-03 18:27 asciilifeform: ROC-RK3328-CC ( currently building a kernel for it, without the 'evil' periphs )
trinque: yeah, it's fantastic to know the people touching the hardware. I'm so far very pleased with the service.
trinque: ah, looks like I need to get the src dir pulled over to pizarro
mod6: lobbes: ah! ok, glad to hear the doc was helpful. nothing worse than unhelpful docs.
a111: Logged on 2018-04-14 20:26 lobbes: hm, so I was following install steps for trinque's ircbot-genesis (http://btcbase.org/patches/ircbot-genesis#selection-167.10-167.39) and it looks like the "init http://trinque.org/src/ircbot" step downloads the robots.txt which, upon pressing, barfs with "INVALID SEAL" eggog >> http://p.bvulpes.com/pastes/qHlDI/?raw=true
lobbes: I did! Was simple as removing the robots.txt from .seals. btw I love the manual you included with yer vtron
mod6: Ah good! Resolved that seal issue then?
lobbes: ah can't complain. Trying to get logbot up and running (was able to successfully press the ircbot genesis and test it on my local machine the other night)
ckang: nowadays with docker and such its way easier to spin something up thats isolated and getting the networking control for the container
ckang: you can do the user limited to one dir but it would require chroot + copy of binaries or a R/O mount of the binaries linked inside but that shit gets messy
spyked: also, kinda what got me thinking about the whole "general-purpose os" thing a while ago. POSIX ACL wasn't designed to be very flexible, it assumes some level of trust in the processes running on the box (the Unix notion of "user" is attached to processes, while that of "permission" is tied to files)
a111: Logged on 2018-04-19 05:31 hanbot: <mod6> hanbot: I can help, what are you trying to achieve? Changing /home/username from chmod 755, to chmod 700? << i want to make a user whose access is entirely limited to one specific dir. i'm fed up for the night tho', will be back at it tomorrow evening if you still feel philanthropic then
spyked: http://btcbase.org/log/2018-04-19#1803146 <-- this is (nearly?) impossible to achieve within the Unix access control model. it's easy to express "no one but user1 has access to dir1", but no reasonable way of expressing the reverse, i.e. "user2 can access only dir2". must be one of the reasons why namespaces and cgroups were added to Linux
a111: Logged on 2018-04-19 03:23 hanbot: <mircea_popescu> hanbot, quick solution is to restrict (and immutable) the directory right above the intended home. << actually, if i do that, it tells me permission's denied to land in homedir ("Could not chdir to home directory /home/username/: Permission denied") and dumps me in... /
spyked: http://btcbase.org/log/2018-04-19#1802935 <-- iirc execute bit on $dir toggles whether {user,group,others} can "search" (i.e. chdir to) $dir or access other files within, including other dirs, making this a recursive thing. so this explains the chdir error.
spyked: http://btcbase.org/log/2018-04-19#1802891 <-- /me would love to, but is short on coin atm. will weigh this again in a few months from now if still available. and I still wanna buy a board for home too, to check out the hardware.
a111: Logged on 2018-04-18 17:10 mircea_popescu: there we go. mazel tov ; and spyked ave1 lobbes permit me to congratulate you an' to wish you long&happy tenure.
trinque would collect a whole household full of women like the girl he has now
mircea_popescu: this, my dear friend, MAY BE USED AGAINST YOU IN THE FUTURE
trinque: nah, I'm told my head wasn't as squashy as they often are
trinque: my noggin got stuck, did some damage on my way down the chute
ckang: yea they said twins are more likely to come early so any day/week now almost
mircea_popescu: anyway, macrosomia is a serious health risk. mostly for the mother, but not really great for the baby either.
mircea_popescu: dude check out that place, they supersized babies also.
trinque: anyhow I don't think much about the ideal woman, people don't come that way
ckang: fortunately shes 6' so they have some extra space
ckang: they are 4lbs now
mircea_popescu: twins rarely reach 3kgs each (which is the normal weight of humans at birth). so more like 5ish.
trinque: I think mircea_popescu is the one to talk to about that firmware upgrade
ckang: can we get them without emotion too trinque ?
trinque: I speak to my woman all the time; brain parts and mouth parts work fine
ckang: or do you want them to be able to speak sometimes
mircea_popescu: well, the pure sort, certainly.
trinque: rapture's coming, what's there to do but be PURE until we ascend
mircea_popescu: "you can only be the leader if you have a child with everybody!"
ckang: but the "one child all of whom must believe" thing
ckang: they will have 2 children
ckang: before they are married ?
mircea_popescu: so your plan for the ~rest of your life is to sit on a patch of dirt in ok and basically wait ?
mircea_popescu: they have some kind of priesthood no ?
mircea_popescu: danielpbarron, so, are you getting ordained in the true church ?
BingoBoingo: danielpbarron: When are you visiting the oriental republic?
ckang: hes comes in to use the bot for scripture
mircea_popescu: heh voat is down. anyway, apparently it's not his chan, but theirs.
BingoBoingo: <mircea_popescu> BingoBoingo, you soy esperando una / espero una. no por and verbs change in spanish! << Finger speed conjugation is still a work in progress. The locals feed me bad grammar habits the Venezolana has to correct. The accent however is servicable. Alf can elaborate when he has report time.
ckang: horrible net but, he pops in and out all the time
mircea_popescu: Visit the TempleOS chat room. << holy shit, he got an irc now ?
ckang: i can tell you about the time a finger got poked into it if you really want
mircea_popescu: "King Terry is, now, recruiting the Original Catholic brand Templar Knights. Send email to tdavis@templeos.org."
BingoBoingo: hanbot: There was one week where Qntra and Trilema had a weird menstrual sync going on
mircea_popescu: that's one thing you got in common with mod6 then.
ckang: checking the oil ?
BingoBoingo: ckang: That leaks information. You never tried out for the wrestling team!
ckang: i mean thats what may separate it from other anus' (not necessarily yalls)
mircea_popescu: i coulda swore we had that in there.
a111: 0 results for "THE STAIN, IT REMAINS", http://btcbase.org/log-search?q=THE%20STAIN%2C%20IT%20REMAINS
mircea_popescu: !#s THE STAIN, IT REMAINS
trinque puts that in the ckang HISTORY file
mircea_popescu: ckang, not like there's any rush.
ckang: yea, understandable, ive just been trying to soak things in up until this point, a lot of the stuff you speak about id need to look into further because i wont even pretend to have any idea on
BingoBoingo: ckang: I will lend you a +1 rating for a resume, life story, and a picture of a sharpie in your pooper with the string n3gg34Z on your cheeks
hanbot: BingoBoingo> None may know the timing of the MP... except maybe hanbot... And the idaho girlie... And... << i must regret to inform i have no MP clock, no MP clock at all!
mircea_popescu: that's not how it works. you're not in control in any sort of meaningful sense, it's not that you're limiting yourself or aren't limiting youself. with a history people can say meaningful things to youi ; without, they can't. that's pretty much the whole story.
hanbot: <mod6> hanbot: I can help, what are you trying to achieve? Changing /home/username from chmod 755, to chmod 700? << i want to make a user whose access is entirely limited to one specific dir. i'm fed up for the night tho', will be back at it tomorrow evening if you still feel philanthropic then
ckang: i can learn new stuff, but there needs to be some interest in the subject for me to dive deep and enjoy it
mircea_popescu: http://btcbase.org/log/2018-04-19#1803068 << except you won't say wtf you've done. and without some kind of a bio nobody's going to have much to say to you, because on what basis would they.
a111: Logged on 2018-04-19 04:42 ckang: i noticed things are more pleasant when they arent upset though
BingoBoingo: http://btcbase.org/log/2018-04-19#1803066 << This is how YOU get fucked. Girls just want to feel, aite? What they feel isn't important. That they feel is.
mircea_popescu: and i mean look at the weird shit. elevatedgal what are you doing with that hand ? explain it to me, are you saving on nipple or what is it ?
trinque: ckang here scurries off in a cuntoo thread because oh, gotta serve the woman
mircea_popescu: now there is that.
trinque: has as much to do with how much log these dummies are taking up
mircea_popescu: http://btcbase.org/log/2018-04-19#1803058 << nah, that's not the dao, you'll drive yourself mad. just do the 12, let the others wait for next batch.
elevatedgal: Head got cut but have another
ckang: or on the right path anways..
trinque: can go find wherever they had it in a git repo somewhere else, if I'm lucky, but here, who's responsible, what they did, and to what, crystallized right before the operator.
ckang: on the old school stuff too
trinque: it is a signed tree of patches which explicitly call out the hashes of the antecedents, the items to be patched
trinque: ckang: http://cascadianhacker.com/07_v-tronics-101-a-gentle-introduction-to-the-most-serene-republic-of-bitcoins-cryptographically-backed-version-control-system << read up
trinque: so rather than pulling someone's blessed stage3 every time you want to build one, you extract a cuntoo from your existing one
ckang: what the context?
ckang: seems like a bunch of distros have forks now resisting the switch
trinque: consists of an ebuild tree managed by the republic's versioning system, V, and a self-reproducing script
trinque: the republic's confiscated gentoo
ckang: im the type i simply need direction
trinque: then when my finger's hovering over the negrate button I'll have something to think about besides "brings in narcissistic nothing-holes that talk too much"
ckang: ive done linux from scratch way back in the day
ckang: i noticed things are more pleasant when they arent upset though
trinque: and I have other things to do
ckang: because they are complicated and finicky
BingoBoingo: <mod6> hottie huh << Seriously alive in the head, a rarity in the land of mate crack pipe lead solder poisoning
BingoBoingo: ascii_lander: however can confirm the venezolana that does the language lessons is not a fever dream and does exist
BingoBoingo: I have to say, ascii_lander's visit to this planet was very good for the morale. It puts into perspective that My experience with the orcs is what he has been suffering since landing in the EE.UU big prison
ckang: im over them though
ckang: allwinner im familiar with, used one of their SoC boards before
ascii_lander: and possibly a few other
ascii_lander: ckang: it isn't the only reasonable chinese armtron -- there is also, e.g., 'allwinner'
a111: Logged on 2018-04-03 18:27 asciilifeform: ROC-RK3328-CC ( currently building a kernel for it, without the 'evil' periphs )
ascii_lander: ckang: the full (by all indications) set of datashits for rockchip, is on their www. schem for the board is on board maker's www
ckang: and unless you are buying bulk, they wont pay attention
ckang: qualcomm is the same
ckang: lol, they dont come off a lot of stuff, NDAs and such required
BingoBoingo: Any deets on what put them in your niggers.txt file?
ckang: how libre are they with documents?
BingoBoingo: * ascii_lander mercilessly ripped audio & gpu out of the rockchip kernel build. because wai. << I am going to have to introduce the word "flensing" to the venezolana en Viernes
trinque: it's a kernel decision anyway, I don't care to make it in either direction. server doesn't need sound
ascii_lander mercilessly ripped audio & gpu out of the rockchip kernel build. because wai.
ckang: then to start, have to jump over a word and edit, small but still sorta boils my blood every time
ckang: true, but they are all broken thats for sure
ckang: im not sure how to do it otherwise though
ckang: The editing of init scripts to change run levels, PITA
trinque: might be too far, and might severely break portage more than we want to fix at the moment
trinque is willing to go as far as busybox, with mdev, and if you need anything else, you slam down a chroot and do your dirties there
BingoBoingo: The systemd-isms poison the readability of a lot of useful gentoo problem solution flovored docs
trinque: BingoBoingo: once there's a decent thread on base packages, I'll have a target for minimal set of packages in cuntoo repo, and we can get rolling
BingoBoingo: trinque: Vortage is the big sell, but saner user toileting defaults could also make it in. Because ain't nobody got time fo dat.
BingoBoingo: Pure relic of the future
BingoBoingo: tidbitnipply: The 23rd
trinque already had his fuck for the night. knees are just fine.
tidbitnipply: He would be weak at the knees 😍
trinque: because you're a woman right, and therefore.
BingoBoingo: None may know the timing of the MP... except maybe hanbot... And the idaho girlie... And...
BingoBoingo: tidbitnipply: He should wake up in the next 24 seconds or 24 hours
trinque: v-portage is the whole thing.
BingoBoingo: Still, the audacity of the motherfuckers. After being given a perfectly servicable location with a cat. "What street" Oh, their cat is grey how unfortunate for them.
trinque: BingoBoingo: what cuntoo is there without v-portage
hanbot: <mircea_popescu> hanbot, quick solution is to restrict (and immutable) the directory right above the intended home. << actually, if i do that, it tells me permission's denied to land in homedir ("Could not chdir to home directory /home/username/: Permission denied") and dumps me in... /
BingoBoingo: * mircea_popescu honestly thought this is the default, but apparently gentoo thinks /home should be 755. << Gentoo defaults are a strong case for a cuntoo split, even before getting into V and other Republican causes
mircea_popescu honestly thought this is the default, but apparently gentoo thinks /home should be 755.
mircea_popescu: but usually you'd do something like chroot / jailshell them.
mircea_popescu: hanbot, quick solution is to restrict (and immutable) the directory right above the intended home.
mod6: (which btw, I'm not saying the defaults are good, or bad, just typical across machines i've encountered)
BingoBoingo: My impressions of the gentoo thus far are that is very much a "some assembly required" product. This has up and down sides which is why eventually we will need to specify something narrower than Gentoo. I look forward to musl'd up cuntoo.
mod6: hanbot: typically things like /etc are chmod 755. "Others can read and execute" by default.
mircea_popescu: the hope of "enforcement" by fiatdorks against bitcoin people just became ~0.
BingoBoingo: I honestly don't think alf did a less than 15 km day here with yesterday being the short one. The others are all easily over 20 km
BingoBoingo: Turns out I packed the right hammer when I chase a 12 oz claw for my bag so many months ago
ascii_lander: phunphakt: rockboxen live in an iron micro-rack junkyard-machined by ascii_lander on the day prior to trip, bent in transit, then hammered back into shape by ascii_lander and BingoBoingo
ascii_lander: ben_vulpes is now equipped with errything he needs to deliver the rockboxen to customers immediately.
a111: Logged on 2018-04-19 02:10 ben_vulpes: mircea_popescu: how's shutter lag and low-light performance on the RX100?
mircea_popescu: http://btcbase.org/log/2018-04-19#1802827 << i don't usually do shutter-lag sorta stuff ; low light is fine, but then again im tolerant.
ascii_lander: ( i'ma post the 'standard' image, when i get home )
ascii_lander: iirc i recommended this : for rockchip users: buy 1 to test on at home, then upload yer image
a111: Logged on 2018-04-19 02:08 mod6: BingoBoingo: Yeah, indeed we'll want to set it up in a test network and ensure that it's 100% correct, then plan an outage. Whether we have alf build a thing, or we buy one or whatever. You're on the right track.
mircea_popescu: http://btcbase.org/log/2018-04-19#1802822 << the good news is that the test doesn't have to be in uy.
ben_vulpes: or stainless, excuse me i have to go unstick my eyes from all the rolling back in my head i can't keep them from
BingoBoingo: Actual sterling silver brazed bombilla pipes would likely be fine, if they could be found
ben_vulpes: not'te mate then
BingoBoingo: ben_vulpes: Alf has seen the parkinsonian gait and supports the crack pipe hypothesis having had time to see the evidence
lilmzthang: Oh I can't do all that, but I can move the sliders around and press auto adjust 😁
ben_vulpes: BingoBoingo: i doubt the causative link you pustulate
BingoBoingo: <ben_vulpes> imagine, if you lived online you could photoshop yourself into youth well into your thirties << As alf can attest there are specimines here who manage something similar to that by avoiding the mate crack pipe
mod6: BingoBoingo: We'll have to discuss. I could pick something up maybe... not sure about the config/testing myself. But next problem is, how to get it there.
BingoBoingo: mod6: If you want to pick up one to hack a test network together, my hands are rapidly filling and a physical backup for the thing is not a particularly high priority
jhvh1: mod6: The operation succeeded.
ben_vulpes: former is the greatest grit in my gears with nonslrs
ben_vulpes: mircea_popescu: how's shutter lag and low-light performance on the RX100?
ben_vulpes regrets the passive voice instantly
ben_vulpes: mircea_popescu, mod6, ascii_lander: lest it rest unclear, the key in question'll not be leased hardware on my watch.
mod6: BingoBoingo: Yeah, indeed we'll want to set it up in a test network and ensure that it's 100% correct, then plan an outage. Whether we have alf build a thing, or we buy one or whatever. You're on the right track.
BingoBoingo: http://btcbase.org/log/2018-04-18#1801964 << Nominally the main switch is capable of these things. I practice enabling these requires delicately ordered incantations I am hesistant to have executed on the production switch. It would require a second and someone with the hands to build a play network with with to test thoroughly before transplanting the config.
mod6: what a great name 'twointhepink'
douchebag: mircea_popescu: In terms of my girls, the only one who needs to be proccessed is twointhepink
ckang: what happens to the 3 people
ckang: if that person is 'downvoted' or untrusted by whoever trusted them initially
ascii_lander had cut erry possible gram from the crates, to maximize useful payload
ascii_lander: lol that's the thing ascii_lander left at home
mircea_popescu: and they're neither heavy nor expensive. it's the first time i see a digicam that actually sees better than i do.
mircea_popescu: in unrelated news : i can't recommend the dsc-rx100 quite warmly enough. it's a splendid sony compact with zeiss lenses that's easily the best camera i ever saw.
douchebag: Alright mircea_popescu, I'm done with these girls for tonight
ascii_lander: mod6: nah i used an ~ok camera in pnoje , in the end
ben_vulpes: stepping further upstack, i of course will defer to the senior statesmen mircea_popescu and ascii_lander should they demand i return adlai's coin, but i am direly loath to forego revenue, and do not much care from whom they come lest like douchebag they exhibit utter ignorance of and disregard for the variety speak
mircea_popescu: i'm not saying, you know, "dump the thing you have", jesus christ. i am saying, use it. build on it. blog landing pages, why the hell not.
mod6: Speaking of which... did we resolve the camera issue?