[12:03] Aha. I always thought it was 640x480 by default. === jouston [n=jouston@59-105-136-199.adsl.static.seed.net.tw] has joined #ubuntu-devel [12:07] infinity: 640x480? [12:07] 640x400 is 8:5 [12:07] Yes, I know. [12:08] And it's also the default resolution for the EGA/VGA BIOS of most PC video cards, and the default resolution of vga16fb. [12:08] http://omega.avalanchestudios.net/personal/dropbox/usplash/zeta_8x5-bold.png <-- here we go. [12:09] Now to make a mock-up of how it would look in usplash. [12:16] http://omega.avalanchestudios.net/personal/dropbox/usplash/_usplash_misc_7.png <-- hmm... I kind of liked the font also used on the CD a bit better. It might be nice for the logging, but most (including myself) believe we should not do logging anymore. [12:16] *CD splash screen [12:17] As I already said, the logging won't be going away for dapper. [12:18] And even if it goes away in edgy, you will be able to optionally turn it back on. [12:18] Okay... so it's not possible to get rid of the logging before release? [12:18] I doubt it'll happen. [12:18] What about the possibility of making the change and then installing it into the system at a later update? [12:19] That's even worse. :) [12:19] Well, I guess I can kind of agree with that... [12:19] We don't make UI changes to stable releases, and we try not to make them after the UI freeze (which is long past) [12:20] What if I supplied you with a BDF font somewhere in the next few days? [12:20] And, other than the "it'll irritate people and cause a time consuming flamewar" issue, there's also just the issue that people like me need to spend the next 3 weeks fixing as many bugs as possible, not implementing feature changes. [12:20] If you supply me with a less crap font, I can get that in with minimal effort on my part (and minimal impact on the UI), so I don't see that one being an issue. [12:22] I'll try my best to tame that xmbdfed thing you were talking about, then. Since my main issue here is the fact that, well, I find the current logging font at startup to be really ugly. [12:22] (As for the mockup you just gave me, I suspect that the "text-free" version will be REALLY text-free... "System is starting up" is redundant, when everyone knows what the progress bar means) [12:22] Maybe. I think that's up for debate. I don't think it's entirely illogical to state what's happening. [12:23] I suspect I'll just have a logo and a progress bar... And maybe, for the first 5 seconds, a "F1: boot messages, F2: text-mode" hint at the bottom. Or something. [12:23] I've not put too muhc thought into it, since the latter part (allowing keystrokes to do something) requires real effort. [12:24] Right now, the keyboard passes straight through to init. Which is actually really handy. So, trapping one or two keys, while passing the rest through, will require some thoughtful coding. [12:27] does anyone have a usb printer? [12:27] I have a small test [12:27] infinity: I'll try to come up with some things for future releases. I should really have checked in before UI freeze, though, I guess. :) [12:28] omeg: I'm open to plenty of suggestions for edgy (though, I'd prefer not to spend much time thinking about them until after June 1st) :) === [PUPPETS] Gonzo [i=gonzo@80.69.47.16] has joined #ubuntu-devel [12:29] http://omega.avalanchestudios.net/personal/dropbox/usplash/_usplash_misc_8.png <-- what do you think of this? [12:29] The font, that is. [12:29] What is Edgy, by the way? The stable release that comes after Dapper? [12:29] omeg: Yeah, Edgy Eft. Ubuntu 6.10. [12:30] omeg: That font's probably a bit too large, I'd guess, to get all the text in horizontally. [12:30] Hmm, you're right. Maybe if it has 1 px spacing instead of 2? === infinity shrugs... [12:30] Experimentation++ === CarlFK [n=carl@c-67-163-39-124.hsd1.il.comcast.net] has joined #ubuntu-devel === infinity decides to wander off and do "weekend work" instead of "work work". [12:31] omeg: Mail me (adconrad@ubuntu.com) when you have more stuff to look at. [12:31] omeg: Bonus points if one of those things is a font. :) [12:32] omeg: You're only the third person in the last 3 months who's offered a new font, so I'm becoming skeptical. :) [12:32] omeg: Deliver that pixel font of yours in a useable state, and you'll be my new best friend. [12:33] http://omega.avalanchestudios.net/personal/dropbox/usplash/_usplash_misc_9.png [12:33] Thanks. I'll try to make a BDF font out of it. === jjesse [n=jjesse@c-67-172-111-99.hsd1.mi.comcast.net] has joined #ubuntu-devel === AlinuxSOS [n=AlinuxOS@d83-176-74-119.cust.tele2.it] has joined #ubuntu-devel === sits [n=sits@cpc3-cwma2-0-0-cust739.swan.cable.ntl.com] has left #ubuntu-devel [] === \sh [n=shermann@unaffiliated/sh/x-000000002] has joined #ubuntu-devel === Toadstool is now known as ToadZzZztool [01:09] any asian font geeks still around? [01:15] hmm. my dapper just broke very strangely. === irvin [n=irvin@ubuntu/member/irvin] has joined #ubuntu-devel === irvin [n=irvin@ubuntu/member/irvin] has left #ubuntu-devel ["Leaving"] === _jdong [n=jdong@d192-24-132-154.try.wideopenwest.com] has joined #ubuntu-devel === j_ack [n=nico@p508D9172.dip0.t-ipconnect.de] has joined #ubuntu-devel [01:27] or perhaps even anyone who knows even something vague about fonts? === irvin [n=irvin@ubuntu/member/irvin] has joined #ubuntu-devel === jdong_ [n=jdong@d192-24-132-154.try.wideopenwest.com] has joined #ubuntu-devel === jdong_ [n=jdong@d192-24-132-154.try.wideopenwest.com] has joined #ubuntu-devel === nictuku [n=yves@ubuntu/member/nictuku] has joined #ubuntu-devel === kyr0 [n=kyr0@ppp-82-135-66-153.mnet-online.de] has joined #ubuntu-devel === Harti [n=Harti@unaffiliated/harti] has left #ubuntu-devel ["-carpe] === didymo [n=ashley@CPE-61-9-197-223.nsw.bigpond.net.au] has joined #ubuntu-devel === bpuccio [n=brian@ool-457a9c38.dyn.optonline.net] has joined #ubuntu-devel === TomB| [n=ownthebo@ACD8A0DC.ipt.aol.com] has joined #ubuntu-devel === TomB| [n=ownthebo@ACD8A0DC.ipt.aol.com] has joined #ubuntu-devel === bpuccio [n=brian@ool-457a9c38.dyn.optonline.net] has joined #ubuntu-devel === nictuku [n=yves@ubuntu/member/nictuku] has joined #ubuntu-devel === alef-null [i=alef0@M867P013.adsl.highway.telekom.at] has joined #ubuntu-devel === slomo__ [n=slomo@p5486D0E9.dip.t-dialin.net] has joined #ubuntu-devel === jjesse [n=jjesse@c-67-172-111-99.hsd1.mi.comcast.net] has joined #ubuntu-devel === nekohayo [n=jeff@ip216-239-82-183.vif.net] has joined #ubuntu-devel === stratus [n=stratus@200.97.70.119] has joined #ubuntu-devel === AlinuxSOS [n=AlinuxOS@d83-176-74-119.cust.tele2.it] has joined #ubuntu-devel === ealden [n=ealden@203.76.212.154] has joined #ubuntu-devel === mroth_ [n=mroth@unaffiliated/mroth] has joined #ubuntu-devel === LeeJunFan [n=junfan@adsl-69-210-207-5.dsl.klmzmi.ameritech.net] has joined #ubuntu-devel === jdong [n=jdong@ubuntu/member/jdong] has joined #ubuntu-devel === jinty [n=jinty@115.Red-83-56-152.dynamicIP.rima-tde.net] has joined #ubuntu-devel === sfeehan [n=sfeehan@pool-64-223-101-180.burl.east.verizon.net] has joined #ubuntu-devel === mroth_ is now known as mroth === jjesse_ [n=jjesse@c-67-172-111-99.hsd1.mi.comcast.net] has joined #ubuntu-devel === Lorenzod [n=lordan@63.218.103.162] has joined #ubuntu-devel === freeflying-ibook [n=freeflyi@61.190.65.30] has joined #ubuntu-devel === freeflying [n=freeflyi@61.190.65.30] has joined #ubuntu-devel === poningru [n=poningru@pool-71-251-119-149.tampfl.fios.verizon.net] has joined #ubuntu-devel === jjesse_ [n=jjesse@c-67-172-111-99.hsd1.mi.comcast.net] has joined #ubuntu-devel === Huahua [n=hua_@221.172.50.71] has joined #ubuntu-devel === robitaille [n=daniel@ubuntu/member/robitaille] has joined #ubuntu-devel === ToadZzZztool is now known as Toadstool === mgalvin [n=mgalvin@ubuntu/member/mgalvin] has joined #ubuntu-devel === poningru [n=poningru@pool-71-251-119-149.tampfl.fios.verizon.net] has joined #ubuntu-devel === poningru [n=poningru@pool-71-251-119-149.tampfl.fios.verizon.net] has joined #ubuntu-devel === ivoks [n=ivoks@ubuntu/member/ivoks] has joined #ubuntu-devel === Burgundavia [n=corey@ubuntu/member/burgundavia] has joined #ubuntu-devel === ab2304 [n=ab2304@207-118-208-125.dyn.centurytel.net] has joined #ubuntu-devel === kagou [n=kagou@84.4.154.175] has joined #ubuntu-devel [08:11] hi === czr [n=czr@cs183171.pp.htv.fi] has joined #ubuntu-devel [08:31] hi. a bit ot question. is it easy to setup a cross-arch toolchain (gcc/libc) inside ubuntu (5.10)? [08:31] (running on i386, want to build x86-64 stuff) === ivoks [n=ivoks@ubuntu/member/ivoks] has joined #ubuntu-devel === fabbione [i=fabbione@gordian.fabbione.net] has joined #ubuntu-devel === zyga [n=zyga@ubuntu/member/zyga] has joined #ubuntu-devel === AnThOnYhO [n=anthonyh@218.104.248.126] has joined #ubuntu-devel === freeflying [n=freeflyi@61.190.65.30] has joined #ubuntu-devel === vurdak [n=vurdak@151.56.112.241] has joined #ubuntu-devel === dsas [n=dean@host86-128-54-253.range86-128.btcentralplus.com] has joined #ubuntu-devel === dsas_ [n=dean@host86-128-54-253.range86-128.btcentralplus.com] has joined #ubuntu-devel === highvoltage [n=Jono@mtngprs7.mtn.co.za] has joined #ubuntu-devel === ompaul [n=ompaul@ubuntu/member/ompaul] has joined #ubuntu-devel === Lure [n=lure@ubuntu/member/lure] has joined #ubuntu-devel === Gloubiboulga [n=gauvain@ubuntu/member/gloubiboulga] has joined #ubuntu-devel [10:06] hi all [10:09] czr: "apt-get install libc6-dev-amd64" and compile with "gcc -m64" === BenC [n=bcollins@debian/developer/bcollins] has joined #ubuntu-devel === doko_ [n=doko@dslb-088-073-092-132.pools.arcor-ip.net] has joined #ubuntu-devel === pygi [n=administ@83-131-243-180.adsl.net.t-com.hr] has joined #ubuntu-devel [10:17] please do see and comment http://students.mimuw.edu.pl/~mb219407/ubuntuRPG.html [10:17] thanks :) === BenC [n=bcollins@debian/developer/bcollins] has joined #ubuntu-devel [10:18] pygi: I'd love to see it real-time, but apart from that, interesting. [10:19] Mithrandir: I suggested real-time, but turn-based on combat :) [10:19] Mithrandir: problem is who would mentor that? [10:19] pygi: no idea; prefereably somebody with some gfx experience, etc. === freeflying [n=freeflyi@61.190.65.30] has joined #ubuntu-devel [10:21] Mithrandir: indeed :) [10:21] pygi: having developers battling it out? [10:21] ajmitch: hehe :) [10:22] ooh! [10:23] I indeed don't know...I'll let you decide :) === sedak [n=fred@APuteaux-151-1-104-157.w86-217.abo.wanadoo.fr] has joined #ubuntu-devel [10:23] Ooo, I could run around killing hordes of Mithrandirs and banging infinities on the head with my mace. Count me in. [10:24] ok, 3 votes by now :( [10:24] indeed [10:24] I'll be chucking live cds at anybody who dares come near me? [10:24] and have an armour made of amd64 dualcores? [10:24] Sounds about right. :) [10:24] Mithrandir: in that case, you'll have lots of people running to you :) === zakame would be one of them [10:24] highvoltage: Not if they're razor-sharp LiveCDs that decapitate you. [10:25] they won't run for long, at least. :-P [10:25] more votes? :P [10:25] infinity: probably not :) [10:25] for or against? :P === pygi knows ajmitch is against :P [10:25] Mithrandir: if you throw out Windows XP cd's, perhaps we'd keep our distance then [10:25] for an ubuntu SoC project, I think it's crack :) [10:25] Mithrandir: but we'll also be putting in more effort to kill you [10:25] Yeah, I don't think it's a sane SoC project. [10:25] but other things are higher priority I believe, so he's right :) [10:25] We can't really claim we need this feature in Ubuntu. [10:26] infinity: agreed :) [10:26] But it's a cool project for someone to do in non-sponsored space. [10:26] I want somebody to sit down and write a clone of syndicate or syndicate wars. [10:26] Especially if I get to crush opponents with my pedantry, and wear an armour of +12 build logs. [10:27] :P [10:27] you can have a level with 10000 bugs you have to kill, to save dholbach from insanity === fabbione [i=fabbione@gordian.fabbione.net] has joined #ubuntu-devel === pygi taking notes, for some more sane days :) [10:28] don't forget the X god :) [10:28] infinity: have you looked over the samba applications? [10:31] Well, the comments on the GUI config tool seemed to end up in it being a "not really necessary" spec. [10:31] What was the other one? [10:31] well, there are several ones [10:31] Oh boy. Links? [10:32] lemme go check it out : [10:32] :) [10:32] none are good by my opinion tho :P [10:32] http://code.google.com/soc/ubuntu/app.html?csaid=io.alex.2002@gmail.com:0b88daa9:90900c7c [10:32] one [10:33] http://code.google.com/soc/ubuntu/app.html?csaid=sed.nivo@gmail.com:0450af38:273c59fb [10:33] two [10:33] third you saw probably === infinity kicks Firefox. [10:33] LOAD FASTER. [10:33] :) [10:34] not so much good applications this year I am afraid :( [10:34] I don't suppose we have any students interested in running more underwater fiber to Australia as their SoC project? [10:34] but those we selected are good [10:34] no, indeed :) [10:34] I could try & do that [10:34] but I doubt you'd care about faster connectivity to NZ [10:35] Bah, there's no one worth talking to in NZ anyway. :P [10:35] Oh, this isn't bandwidth anyway, it's broken Google. [10:35] Awesome. [10:35] The server encountered a temporary error and could not complete your request. [10:35] Please try again in 30 seconds. === infinity waits. === Huahua [n=hua_@221.172.50.71] has joined #ubuntu-devel === pvanhoof [n=pvanhoof@d54C0E27E.access.telenet.be] has joined #ubuntu-devel [10:37] pygi: Meh. It's not loading for me. [10:37] pygi: Do they link to specs in the wiki or something? === pygi check [10:38] infinity: nop, but I could pm you applications? [10:38] infinity: i don't think it's just .au; it's not loading here either. === Huahua [n=hua_@221.172.50.71] has joined #ubuntu-devel [10:39] pygi: Sure. [10:43] tell me when you are done with this one === jpatrick [n=patrick@ubuntu/member/jpatrick] has joined #ubuntu-devel === jjesse__ [n=jjesse@c-67-172-111-99.hsd1.mi.comcast.net] has joined #ubuntu-devel [10:50] guys ... update-manager (which runs as root) has a very critical security problem [10:51] I don't understand howcome nobody has yet written a malware software for it, please ask me .. I filed it as a non-public bug #43328 [10:52] pvanhoof: please subscribe me to the bug [10:52] I'm certain I can cook a prove of concept for this one. For any gtk+ (or maybe even x11) developer this wouldn't be very hard at all [10:52] s/prove/proof [10:54] pvanhoof: The builtin terminal is intenationally not read-only for the (now rare, but still real) case where a maintainer script will prompt on stdout/stdin without using debconf. [10:54] pvanhoof: Currently, the assumption is that people running update-manager have full admin rights, so it's not really a security bug. [10:55] infinity, shall I prove it by writing a little tool that listens for the user-passwords? [10:55] I can do this in 50 minutes [10:55] pvanhoof: I'm not sure what that would prove. [10:55] pvanhoof: Being able to listen for user passwords is an inherent problem with sudo and friends in general. [10:55] pvanhoof: as soon as you write a tool that listens for passwords, there'd be millions of ways you can get root on a system [10:56] that I can run the tool and get it to become root, then only thing I'd have to do is sending keytrokes to it. I'm certain the terminal widget has security issues [10:56] pvanhoof: There's not much you can do to fix that except to never allow a user to escalate their privileges. === ssam [n=ssam@82-32-64-153.cable.ubr01.bath.blueyonder.co.uk] has joined #ubuntu-devel [10:56] pvanhoof: It's assumed that users who have sudo privileges also practice reasonably safe software practices. If that's not the case for you, you're handing out sudo to the wrong users. [10:57] look, first of all it's absolutely not good to run a gtk+ application as root .. but lets say that's okay [10:57] (For instance, you do NOT give sudo to everyone in a university computer lab so they can use update-manager, you just do updates remotely via SSH behind their backs) [10:57] then second of all .. the program (written with gtk+ libraries) that runs as root has a terminal which gives access to send characters to a root-console [10:58] and that terminal isn't set read-only [10:58] and I can make the tool being run in that terminal interrupt by sending ctrl+c [10:58] Yes, but the root console is started by someone who HAS ROOT PRIVILEGES. [10:58] This is no different than you typing "sudo su - root" in a gnome-terminal. [10:58] the password I have to enter is the same as the password of my user [10:59] I don't understand why ubuntu doesn't develop a helper program for this [10:59] and pipes that output to a read-only widget [10:59] how would using a helper program help? [10:59] that would be perfectly secure [10:59] Because if it's read-only, how do you interact with the terminal? [10:59] because that way the gtk+ application wouldn't have to be root Mithrandir [11:00] (Note that sometimes, you WILL need to interact with the terminal, that's one reason why it's there) [11:00] you'd still have your user password, you could just open a terminal and type sudo su -, like infinity pointed out :) so how would it be more secure? [11:00] The fact that Ubuntu has tried really really hard to remove al postinst prompting may have spoiled you a bit, but plenty of .deb packages still prompt in maintainer scripts. [11:00] then patch the apt-get libraries so that you never have to interact with the terminal? the fact that you have to interact with the temrinal simply tells me the complete design is wrong [11:00] pvanhoof: if you can interact with a user's X session, you can listen for any keystrokes. How's that news? [11:01] highvoltage, using a helper tool you wouldn't have to use sudo [11:01] pvanhoof: it's not apt, it's not dpkg, it's maintainer scripts. [11:01] pvanhoof: apt-get has nothing to do with a PACKAGE using the maintainer scripts to interact with the user. [11:02] don't allow such scripts in your packages? It's ubuntu people who maintain the packages [11:02] pvanhoof: And as pointed out, if you have sudo access and you ever intend to use it at all, for anything, if I'm running an application in your X session, I can snarf your password. [11:02] this is silly finger pointing. If you create a distro, you are responsible for the packages [11:02] pvanhoof: This is why you don't run untrusted software on a trusted account. [11:02] yes, so why do you guys allow this ?! [11:03] infinity: not only that, you can drive more or less any application too. [11:03] people do run untrusted software on trusted accounts [11:03] pvanhoof: Then they shouldn't. This is inherent in how X works. === ploum [n=Ploum@ubuntu/member/ploum] has joined #ubuntu-devel [11:03] I don't think we'll rework X today at least. [11:03] again, finger pointing. If you'd simply use a helper application that can ONLY upgrade the system, you wouldn't have to put that sudo thing there [11:03] pvanhoof: is there any system in the world that doesn't let you run untrusted software on a trusted account? [11:03] this is why we need SEX - security-enhanced X [11:04] pvanhoof: And the any number of other things you may want to use sudo to do?.. [11:04] hehe [11:04] pvanhoof: ? only root can upgrade system [11:04] ivoks, correct, but now there's a ui tool that also runs root and to which I can send keystrokes .. and that tool even has a root terminal non read only [11:04] and it's predictable .. so it's ten times worse than running su - in a xterm [11:05] pvanhoof: and this is something you can do if you run apt-get dist-upgrade? [11:05] pvanhoof: s/can/can't/ [11:05] ivoks, no it's something I can invoke from another application [11:05] ivoks, right but that isn't invokable by an application, nor predicatable [11:05] this is [11:05] what's not invocable? === AnThOnYhO [n=anthonyh@218.104.248.126] has joined #ubuntu-devel [11:06] when I run a xterm and I do a su -, I know as an admin I might be in danger [11:06] thanks infinity [11:06] ok [11:06] but this tool , I can run it from an application [11:06] and I can send it keystrokes from that application [11:06] pvanhoof: And same for update-manager, which is WHY we only allow admin users to do it. [11:06] and once it runs, it has a writable terminal [11:06] pvanhoof: but when you run update-manager you know you run it as root [11:07] pvanhoof: so, again, you know you are in risk [11:07] pvanhoof: update-manager isn't SUID or anything. You're still being asked to authenticate with sudo (well, gksudo). [11:07] infinity, 99% of the desktop computers have one or two user accounts .. and the setup does not let you make user accounts that don't have this possibility [11:08] infinity, and since the password is the same as the one the user must enter, I can very easily know that password [11:08] pvanhoof: Erm, what? New users created with the GUI user admin tool, or from the CLI with adduser are NOT in the admin group. [11:08] most people will enter the same password for every question, and I can mimic the dialog box [11:08] pvanhoof: You're just talking about the inherent scariness of sudo in general here, this has nothing to do with update-manager at all. [11:08] <_ion> User stupidity cannot be fixed with software solutions. [11:08] for example I can replace a menu-item, mimic the dialog box and launch the original application and send the password to the gtkentry [11:09] all this can be done in a little script [11:09] pvanhoof: And it's an attack vector we're aware of, and one we really can't do anything about without going back to the days of pure user/root separation that pisses people off cause they can't get anything done. [11:09] pvanhoof: and you can't do this with a shell app? [11:09] and then I have an application with a root termal not being read-only [11:09] pvanhoof: sudo is a tradeoff, and we all know it. [11:09] pvanhoof: you still need to get your exploit onto the user's machine. [11:09] infinity, if you don't add that sudo entry .. and if you create a little helper tool that has SUID root priveledges but can ONLY upgrade the system [11:09] you wouldn't have this problem [11:10] and creating such a tool is not difficult [11:10] and you can pipe commands to such a tool, while it's being run as a suid tool [11:10] <_ion> Update/] ] [11:10] <_ion> Whoops. [11:10] and that pipe can be made VERY secure [11:10] <_ion> Update-manager isn't the only piece of software that needs root privileges. [11:11] _ion, then do that for all the softwares that need root priviledges [11:11] pvanhoof: This isn't the only reason users have sudo access. [11:11] pvanhoof: We made a conscious decision to give the first user sudo access and disable root's password. [11:11] <_ion> pvanhoof: I'm sure the Ubuntu folks appreciate your patches that make software more secure. [11:11] that is just telling me: because it's a lot of work: we prefer to introduce a security problem [11:11] pvanhoof: If you want it setup your way on your machines, set a password for root and remove the sudo config. [11:12] pvanhoof: suid isn't perfect solution either [11:12] infinity, I know I will not run untrusted softwares ... but common users will [11:12] pvanhoof: you would have to suid apt-get, or dpkg [11:12] update-manager isn't something that you'd want suid anyway [11:12] pvanhoof: and, again, you have security issue [11:12] infinity, for my system this isn't important, but for normal people (which is the target audience of ubuntu, right?) it is [11:13] ivoks, that is wrong, you probably do upgrades and etc using a apt-get library [11:13] or a dpkg library [11:13] and since you can specify which tools to run and how [11:13] even that wouldn't be a problem [11:13] pvanhoof: Actually, no. update-manager does some stuff as root that isn't directly apt-get related. [11:14] if I from a user tool pipe 'e' to a SUID application [11:14] (fiddling with sources.list, running dist-upgrade recipes, etc) [11:14] and cause of that 'e' the application will launch apt-get install bla [11:14] update-manager NEEDS root. [11:14] pvanhoof: but, what will prevent you from installing my .deb package wich will sniff your password? [11:14] Not everyone on a machine NEEDS to be able to run update-manager. [11:14] infinity, even updating such a text file can be made secure [11:14] If. You. Don't. Trust. Your. Users. Don't. Give. Them. A. Trusted. Account. [11:15] pvanhoof: If they have the privileges to update sources.list, they have the privileges to add a source to it and install malware. You lose. [11:15] ivoks, if you don't allow untrusted changes to the sources.list file, how can they isntall one? [11:15] pvanhoof: dpkg -i ? [11:15] infinity, then don't give the normal user account those privileges [11:15] ivoks, they are a user , they can't install using dpkg -i [11:15] pvanhoof: Now we're in circles. I just told you not to give them those privs. :) [11:15] only the suid root tool can do that [11:16] pvanhoof: OTOH, if you want them to be able to update the system, they need those privs. Catch-22. [11:16] infinity, you can allow the suid root tool to make specific changes, not any change [11:16] pvanhoof: There's no way to allow someone to do something without allowing them to do it. [11:16] pvanhoof: so, they won't be able to upgrade? [11:16] infinity, you could for example make a command like: "change mirror to Belgian" [11:16] pvanhoof: I'm sure, you understand, we are talking about admin user here? [11:16] infinity, and it would upgrade the sources.list file to the belgian mirrir [11:16] pvanhoof: uh, how about adding custom mirrors, which people tend to do? [11:16] pvanhoof: And why would a user who you don't trust to install new software NEED to change the mirror list at all? [11:16] ivoks, if you really need to trust an admin user, then the ubuntu installation should prompt and warn for that during the installation procedure [11:17] pvanhoof: Either you trust them to install software, and they have (transitive) root. Or you don't. [11:17] pvanhoof: it does [11:17] Mithrandir, that is something a person who knows how to use the root account should do [11:17] ivoks, howcome it didn't let me add more NORMAL users then? [11:17] pvanhoof: So, for the "regular home user with one user on the system", you're suggesting they should all employ someone (you?) to be root on their computer whenever they need it? [11:17] pvanhoof: it didn't, but it has a note that you should do that after install [11:17] or why wasn't that the default and the last account created, with a big fat warning, the admin account? [11:18] pvanhoof: Because they're too stupid to use their own computers? [11:18] pvanhoof: A compelling argument, but not one that users are likely to agree with. [11:19] well then, just wait for ubuntu to become more popular .. you'll see the malwares that abuse this with 1000ths [11:19] pvanhoof: i understand our concern, but people need a way to administer computers [11:19] eh... [11:19] ivoks, then stop finger pointing and make softwares in a secure way that do this [11:19] pvanhoof: you don't understand [11:19] I do [11:19] pvanhoof: malware would do harm in shell as in GUI [11:20] I'm one of the guys that make the ubuntu softwares. I TELL you it's NOT difficult and it IS possible [11:20] you can't force people not to install malware [11:20] pvanhoof: sure it's possible [11:20] pvanhoof: but you have to get user to install malware [11:20] so why don't you guys do it?! [11:20] pvanhoof: it won't install by it self [11:20] pvanhoof: if you can come up with a non-movie attack scenario and patches to fix it, I'm sure they'll be appreciated. [11:20] pvanhoof: you don't listen to anything other people tell you, right? [11:21] I am listening, but right now ubuntu implements the exact same type of security problems the windows platform has === sfllaw [i=sfllaw@206-248-133-167.dsl.teksavvy.com] has joined #ubuntu-devel [11:21] it's not malware, virus or worm if user has to install it [11:21] and ubuntu simply fingerpoints just like how microsoft fingerpoints [11:21] it is not the solution [11:21] pvanhoof: no, these two are not a like [11:22] pvanhoof: ubuntu starts all users apps with non-root privileges [11:22] pvanhoof: that's not something windows doo [11:22] pvanhoof: if you take a look at windows problems [11:22] pvanhoof: 99% of them aren't cause of instalation of programrs [11:22] pvanhoof: but holls in explorer, outlook, etc [11:22] pvanhoof: wich run as admin user [11:23] pvanhoof: this is not the case with ubuntu [11:23] percentages aren't very important for security issues. That one security problem, can be so major it will defect every ubuntu install [11:24] running gtk+ applications as root is not smart .. and putting a writable terminal inside that tool is , well , insane [11:24] pvanhoof: since you make Ubuntu, mind to tell me exactly what is your LP account? [11:24] so is there an analysis how many packages still use the terminal for i/o during installation? [11:24] pvanhoof: i am curious to see what you do for it [11:24] fabbione, I don't 'make ubuntu', I develop softwares, my gnome foundation e-mail is pvanhoof@gnome.org, feel free to mail me [11:24] I think OEM packagers should get told NOT to do this if they want their packages to work [11:25] fabbione, and I'm not into that type of discussions [11:25] fabbione: That would be https://launchpad.net/people/pvanhoof [11:25] eh, come on guys... [11:25] indeed, come on [11:25] infinity: thanks [11:25] 03:20 < pvanhoof> I'm one of the guys that make the ubuntu softwares. [11:25] Come on indeed. [11:25] azeem, indeed [11:25] Supporting your position with a (false, no less) power play is fun! [11:26] azeem, just tell the oem packagers not to do this [11:26] infinity: he said, he's one of the upstream GNOME people [11:26] :) [11:26] pvanhoof: did you come here to troll or something? [11:26] (thought it wasn't very clear) [11:26] pvanhoof, I came here to tell update-manager has a serious security issue [11:26] well, I didn't came here, I just mentioned it [11:27] and people started asking me about it [11:27] pvanhoof: ok, but with an attacking attitude [11:27] pvanhoof: the developers have analysed your report [11:27] ok. which is fine for me .. I was just responding the questions being thrown at me [11:28] and insted of translating desktop guide, i'm flamimng here :) === MagnusR [n=magru@c83-250-59-127.bredband.comhem.se] has joined #ubuntu-devel [11:35] pvanhoof: Can you actually obtain a root shell through update-manager itself? [11:35] pvanhoof: Ctrl-C shouldn't give you one, since it's not running an interactive shell in the first place. [11:35] I don't yet know that [11:35] pvanhoof: That will just cancel the current operation and leave you with a non-functional terminal. [11:36] but I'm more or less certain it would be possible. Also given the fact that there's a lot bugs in that widget [11:36] pvanhoof: So, your complain seems to be with gksudo itself, which one would hope invokes X tricks to block keyboard grabs. [11:36] and a lot known and unknown bugs in any gtk+ widget [11:36] gtk+ was never designed with security in mind [11:36] pvanhoof: Which then leaves us with the attack vector of "I can spoof a gksudo window to ask a user for their password" [11:37] pvanhoof: Which is a valid attack vector for ANYTHING, and also requires the user to INSTALL and RUN your spoofing app. [11:37] gksudo , because it only asks for the user-password, can be tricked .. and since its also a gtk+ application it can probably be cracked as well [11:37] pvanhoof: If the embedded terminal is insecure, that's a bug. [11:38] Anyhow, I'm done arguing. You can argue with mvo in the bug log instead, I guess. [11:38] sure .. but if ubuntu wouldn't use sudo, but a helper tool that runs with root priveledges but has a very limited interface (using stdin: a pipe): it wouldn't be a security problem [11:38] But without a proof of concept, this all seems rather vague and hand-wavey. [11:38] well, just wait for a buffer overflow or something like that in the terminal widget. Which isn't very hard to find [11:39] Yes, we have such bugs all the time, and we fix them. Oddly enough. [11:39] or in the application being launched in that terminal [11:39] Doesn't change the fact that you'd have to run something specifically designed to exploit it for the bug to be a problem. [11:40] you are done agruing about this, you said, infinity. If you want to do this in a constructive way .. I'm available [11:42] bye all [11:42] it's a security problem, and a proof of concept will probably some day be build. I have more important things (and certainly more interesting things) todo than to proof something which is basically .. basic knowledge [11:43] and something that is known for years .. perhaps check out the security warnings on a tool (which I once wrote) xsu, gnome superuser, etc [11:43] a long time ago when I was naive and yough [11:43] young [11:43] * Security [11:43] Gnome Xsu 2.0 uses the standard su binary to gain it's root access. This way, [11:43] all security issues should be solve [11:43] +d. [11:43] which wasn't true [11:44] and I don't recommend using gnome xsu 2.0 [11:44] it's what the description currently says. [11:44] I gave maintainership to Mark Finlay, who died a few years ago [11:44] and I stopped developing that little tool, for it shouldn't be used [11:45] the main security problem with gnome xsu is that is sends the password over a hidden vte terminal widget [11:45] and then of course it does try to clear that memory and destroy the widget asap, but still it's insecure (of course) [11:46] if you have access to a user's X terminal, you can find out what's going on there. It's really as simple as that. [11:46] I agree, but the update software does not need to run a tool using su or sudo [11:47] a tool that will do this can be developed, and put suid root. If that tool is secure (which is far more easy than making a sudo-entry in the sudoers file secure), there's no problem === fabbione [i=fabbione@gordian.fabbione.net] has joined #ubuntu-devel [11:48] you're aware that the first user is allowed to execute anything, right? [11:48] in that case it would only be allowed to execute that suid root application and feed it commands via the stdin, and those commands would always only cause upgrade procedures [11:49] which is legal for the first user [11:49] just don't introduce security problems in that tool, of course [11:49] that would be catastrophical of course [11:50] I still don't see why you think this is more secure as it doesn't address the real problem (X), but just changes one of many tools which require root to function properly. [11:50] because there's no more sudo or su which can run anything.. you can only run that tool (which is +s indeed) [11:51] and that tool (because it's programmed that way) can only run commands it is designed to run [11:51] or perform procedures or etcetera === Harti [n=Harti@unaffiliated/harti] has joined #ubuntu-devel [11:52] I see it as lots of complexity for not much gain -- you'll have a lot more applications which have to be run as root. [11:52] and whatever X tries .. only the commands being fed to that tool will be accepted. And those commands are not like: run this program [11:52] no the commands are: upgrade, switch mirror, install package x [11:53] Mithrandir, well, you gain not having to secure that first user cause of the sudoers file [11:53] which is far more complex it seems [11:53] because of X problems, indeed [11:53] uh, no. The first user still needs to be able to, say, run synaptic or network-admin [11:53] you can build-in such commands in the tool [11:53] synaptic can also instruct the same tool [11:54] you wouldn't run synaptic as root [11:54] synaptic is able to, and needs to be able to add any repositories. [11:54] so you've just abstracted the attack one step away. [11:54] well, I'd make selecting specific repo's possible, but not adding custom ones [11:54] if you want to add a custom one, I'd tell the user to gain real root priveledges [11:55] synaptic needs to be able to add custom ones. [11:55] and specific ones can have a public key etcetera [11:55] well, you'd loose that functionality .. [11:55] that's not acceptable. [11:55] but then again, I don't know a lot normal users who'd care [11:55] and the expert users know how to become root anyway [11:56] and face it, those people use apt-get from a terminal, not synaptic [11:56] some do, some don't. [11:56] sure but, making ubuntu insecure because some experts want to use synaptic to add a custom mirror? [11:57] It's not a valid reason anymore [11:57] saying that "since this functionality is impossible to secure, we'll remove it and force people who need it to use a terminal" is not acceptable. [11:57] synaptic can also work via that tool [11:57] well then, you could make it possible [11:57] by allowing the tool to accept a custom url [11:58] other examples are disk-conf or user-admin [11:58] but for example would the tool try to get a public key [11:58] and return a question to the user like: are you sure you want to accept this key [11:58] apt already does that, but that doesn't help you at all. [11:58] true [11:58] how many people would say "no"? [11:58] how many people do you know who checks SSL certs? [11:58] yes, I agree. which is why I wouldn't make that possible [11:58] but if its a key feature, even that would be possible [11:59] and it would be at least more secure [11:59] so you'll remove the ability to add system users, partition disks, change network settings, etc because you can't secure it? === popey [n=popey@84-45-197-14.no-dns-yet.enta.net] has joined #ubuntu-devel [11:59] all those features are features for the real administrator .. so [11:59] s/it/them/ [11:59]