/srv/irclogs.ubuntu.com/2023/11/09/#lubuntu-devel.txt

tewardarraybolt3: only your system is attempting to connect to iv[.]ggtyler[.]dev, docs[.]invidious[.]io, and linux.org from Discourse00:06
tewardso either you or Vivaldi have some weird crap it's trying to do00:07
arraybolt3that's... really weird00:07
arraybolt3how on earth were you able to find that out?00:07
arraybolt3I didn't send you a screenshot of Vivaldi's guts AFAIK00:07
lubot[telegram] <teward001> arraybolt3: your system isn't blocking Content-Security-Policy reports00:07
arraybolt3is this from the Chrome screenshot I sent earlier?00:08
lubot[telegram] <teward001> those report to my Sentry instance for analysis and helps me ID if someone's breaking the site, or such00:08
lubot[telegram] <teward001> arraybolt3: it's from whenever you connected to Discourse before the screenshot00:08
arraybolt3oh, you have Sentry telling you what's happening, ok00:08
lubot[telegram] <teward001> hence why i asked for your IP address so i can see if it came from you or not00:08
lubot[telegram] <teward001> and it did so00:08
arraybolt3so yeah, that was Vivaldi00:08
arraybolt3hang on one sec, can you see if I connect to Discourse again real quick?00:08
lubot[telegram] <teward001> ye, Sentry reports when Content-Security-Policy headers are violated or not00:08
lubot[telegram] <teward001> if you connect again and it triggers the same issue it'll update the timestamp on the observations in sentry es00:09
lubot[telegram] <teward001> yes*00:09
arraybolt3ok, just did so from Chrome00:09
arraybolt3anything pop up?00:09
lubot[telegram] <teward001> yup00:09
arraybolt3if you see crud related to ggtyler or invidious again, it's not Vivaldi's fault and I can rest easy00:09
lubot[telegram] <teward001> but do ctrl+shift+f5 or such to refresh00:09
arraybolt3I just did a ctrl+shift+r00:09
lubot[telegram] <teward001> i see a connect failure for browser.sentry-cdn.com but the error it triggered is already added in the CSP header00:09
lubot[telegram] <teward001> known issue of discourse-cdn.lubuntu.me00:10
arraybolt3if you don't see that in the most recent connection, then perhaps Vivaldi is doing something creepy in which case... sigh... then what?00:10
lubot[telegram] <teward001> the other errors didn't come up again00:10
lubot[telegram] <teward001> ye Vivaldi's doing SOMETHING with your request00:10
lubot[telegram] <teward001> this is how CSP can be helpful on my end to determine if something is browser-based or site-based00:10
arraybolt3great, the whole reason I switched to Vivaldi was just so that I could evade Chrome's invasive "privacy" practices00:10
lubot[telegram] <teward001> do me a favor though `curl -I https://discourse.lubuntu.me` and DM me the Content-Security-Policy header.00:11
arraybolt3and now it's connecting to creepy sites in the background00:11
lubot[telegram] <teward001> send it via pastebin if you have to00:11
arraybolt3one moment00:11
lubot[telegram] <teward001> arraybolt3: i can set up a Vivaldi in a sandbox and poke it but i want to make sure you're seeing the CSP header up-to-date00:11
lubot[telegram] <teward001> the browser.sentry-cdn.com error is fixed yet yours complained so Chrome doesn't have the right header00:11
arraybolt3teward: if there's some way you could try Vivaldi in a sandbox, that would be much appreciated. I really don't want to take all of the measures involved in a full malware cleanup unless I really have to00:12
lubot[telegram] <teward001> ok ye so Chrome is ignoring connect-src for some reason and triggering a 'regression' where there isn't one (it reopens issues if a regression happens)00:12
lubot[telegram] <teward001> i'll have ot set up a system to test with (read: VM)00:12
lubot[telegram] <teward001> there's one thing I can fix now but it doesn't explain the odd connects00:13
arraybolt3(i.e., changing tons of passwords, replacing SSH and GPG keys, reinstalling Kubuntu, etc., etc., ad nauseum)00:13
lubot[telegram] <teward001> you use kubuntu.  ok.00:13
lubot[telegram] <teward001> *installs Ubuntu since he has that around*00:13
arraybolt3Vivaldi was popular enough I trusted it...00:14
lubot[telegram] <teward001> rule 1 of software: never "trust software" blindly00:14
lubot[telegram] <teward001> rule 1 of security: you're likely to screw yourself at some point, and learn from it00:14
lubot[telegram] <teward001> but lets see what happens after I spin the sandbox00:14
arraybolt3I didn't trust it blindly though :P00:14
lubot[telegram] <teward001> by "blindly" i mean without auditing source ,etc.00:15
lubot[telegram] <teward001> BUT WE'LL SEE WHAT I FIND00:15
lubot[telegram] <teward001> and if i find it's replicated behavior, then I get to file a security bug!00:15
arraybolt3if they are running some sort of malware racket it's the most intricate one I've ever seen, going so far as to set up an entire Mastodon server, forums, an email client, Android and iOS apps, etc., etc., to advertise their stuff00:16
arraybolt3hopefully it'll just be some sort of security misconfiguration and we'll be able to move on, and then I'll use nothing but Chrome and Firefox for the rest of my life and maybe even switch to Qubes OS00:17
lubot[telegram] <teward001> you don't have any plugins installed do you :P00:18
arraybolt3nope00:18
arraybolt3there's a built-in adblocker, that's it00:18
arraybolt3(well, built-in ad and tracker blocker which I enabled, but no, I don't use any plugins)00:18
lubot[telegram] <teward001> *waits for sandbox to build*00:18
arraybolt3teward: I think I only just now figured out what you were saying - Vivaldi is leaking info about what it's doing in the background to you. Granted I didn't know that Vivaldi was accessing some random person's YouTube frontend (Invidious) in the background, so why that was happening is a bit of a mystery, but I'm no longer so paranoid :P00:23
lubot[telegram] <teward001> well that sounds like a security flaw00:23
lubot[telegram] <teward001> if i can reproduce i'll report a bug00:24
lubot[telegram] <teward001> they won't like me when i do though00:24
arraybolt3right, but if it's a security flaw I can be like "meh, bad developers! oh well". As opposed to thinking Vivaldi is itself malware which is an "oh great, now what?" scenario00:24
lubot[telegram] <teward001> well it's still technically a security issue but i'll deep dive00:25
arraybolt3thanks :)00:26
arraybolt3and I'll be extra-careful what links I click on in the mean time00:26
arraybolt3teward: to be clear, what does a content-security-policy report even do?00:29
arraybolt3is it basically just reporting what things the browser is fetching code from?00:30
arraybolt3potentially leaking across websites?00:30
tewardhttps://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy00:30
tewardReporting directives control the reporting process of CSP violations. 00:30
tewardSee also the Content-Security-Policy-Report-Only header. (Same site)00:30
tewardCSP allows us to limit cross site script attacks or embedding attacks00:30
arraybolt3If so, I probably know where the weird Invidious thing is coming from - I have Mastodon open in another tab and I'm subscribed to a ton of hashtags related to Linux, so probably someone linked their Invidious instance on Mastodon, and then somehow that info got leaked through a CSP report.00:31
teward"The HTTP Content-Security-Policy response header allows website administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks"00:31
tewardyeah what i think is happening is there's data leakage00:31
tewardwhich IS a security concern00:31
tewardbut i'm going to confirm it on my end00:31
tewardsend me privately a list of pages so i can populate examples on my end00:31
arraybolt3sure00:31
tewardi have a sandbox VM to not pollute my main system ;)00:31
arraybolt3but real quick, do me a favor and tell me if those weird things are showing up in the latest access of Discourse from my IP00:31
arraybolt3I just closed all tabs except Discourse and then did a full refresh of that same page again00:32
tewardwas it 30 seconds ago?00:32
arraybolt3somewhere around that yeah00:32
arraybolt3fifteen or thirty seconds00:32
tewardye the other URLs aren't showing up in the reports00:32
arraybolt3YAY00:32
tewardonly the stuff Discourse and Sentry plugin reports to00:32
arraybolt3so it's just content leakage.00:32
teward(Sentry plugin is on our DIscourse)00:32
arraybolt3Thanks for catching that :)00:32
tewardyes, but i want to reproduce and show reproduction steps BEFORE throwing a security flaw warning out there00:32
arraybolt3agreed00:33
tewardbecause if I do *that* I'm going the CVE route00:33
tewardand submitting the security flaw to MITRE00:33
arraybolt3heh, sounds fun00:33
tewardok so00:36
tewardi would suggest nuking Vivaldi and doing a new install/update00:36
tewardbecause I can't reproduce this on latest Vivaldi stable00:36
arraybolt3hmm, make one of the tabs Mastodon maybe?00:37
arraybolt3I mean I'm on the latest Vivaldi Stable and I didn't tweak any weird settings that I know of00:37
arraybolt3I did enable the built-in mail client00:37
arraybolt3who knows, maybe I accidentally hit a keyboard shortcut that made things go berzerk :P00:38
=== arraybolt31 is now known as arraybolt3_wc
arraybolt3_wcswitching to WeeChat since I'm using IRC via The Lounge via Vivaldi00:38
tewardye no worries it could be a weird leak issue00:39
tewardbut i can't replicate with a few different pages open00:39
arraybolt3_wcmeh, if it only happens sometimes, I don't want to use Vivaldi anymore :P00:40
arraybolt3_wcjust finished nuking it, going back to Chrome and Thunderbird I guess00:40
lubot[telegram] <teward001> *sips coffee*00:40
arraybolt3_wcdid anything get leaked that could be password-related?00:40
lubot[telegram] <teward001> Vivaldi has some good things going for it but00:40
lubot[telegram] <teward001> arraybolt3: not from the CSP no00:41
arraybolt3_wcgood, then I don't have to go through and change all my passwords \o/00:41
* genii twitches00:41
lubot[telegram] <teward001> but i can't guarantee something else was leaked00:41
lubot[telegram] <teward001> genii: go make me coffee damn it!00:41
geniihehe00:41
lubot[telegram] <teward001> you did the evil of showing up, now you must pay me in coffee xD00:41
teward*hisses*00:41
tewardANYWHO00:41
arraybolt3_wcteward: well obviously not, but... gah, I should just stop being lazy and do a full password overhaul just in case.00:41
teward*continues sipping on the deliciousness*00:41
arraybolt3_wcat least I didn't open any private keys so my GPG and SSH keys should be OK00:42
geniiteward: Actually I'm drinking beer now and watching hockey, I just have "coffee" on my highlight list of course...00:42
tewardgenii: i know you do00:42
tewardcoffee for me is an all-the-time drink xD00:42
tewardespecially on this upcoming Friday00:42
tewardit's veterans day but i must work i3wqngt98q43bq4htq348thq3tq43ht3[hg43q[g\00:42
* arraybolt3_wc runs that through uudecode00:42
arraybolt3_wchmm, teward wants some pancakes and eggs00:43
* arraybolt3_wc makes a note of that00:43
arraybolt3_wcalright, wish me luck, I now have to reset every single password in both KeePassXC and in Chrome itself and migrate them all to KeePassXC00:43
* arraybolt3_wc tries to not get a headache00:44
lubot[telegram] <tsimonq2> https://matterbridge.lubuntu.me/071bd31d/noo_god_no.mp400:46
lubot[telegram] <tsimonq2> https://matterbridge.lubuntu.me/71de51ef/you_sure_about_that_i_think_you_should_leave_with_tim_robinson.mp400:46
arraybolt3_wcwell hey, at least my migration to KeePassXC will be complete after this :D00:51
lubot[telegram] <tsimonq2> /me takes a shot every time arraybolt3 changes his nickname00:55
lubot[telegram] <tsimonq2> Jk... does that fit in IRC rules XD00:56
lubot[telegram] <tsimonq2> !language00:56
lubot[telegram] <teward001> you mean a shot to the nuts right?  :P00:56
lubot[telegram] <teward001> *cracks knuckles*00:56
lubot[telegram] <tsimonq2> hahahahah yeah sure if it lets me skirt right around that one 😆00:56
lubot[telegram] <teward001> :P00:57
tewardbetter to have a bruised groin than being hospitalized with booze poisoning :P00:58
arraybolt3_wcwhy does Discourse *require* that you use a password reset email to change your password *grumble*01:00
lubot[telegram] <teward001> i can force it if i have to :P01:01
arraybolt3_wcnot our instance01:01
lubot[telegram] <teward001> ah01:01
arraybolt3_wcI'm signed up for at least three Discourse instances01:01
lubot[telegram] <teward001> because Discourse01:01
arraybolt3_wcKDE, GNOME, and Lubuntu01:01
lubot[telegram] <tsimonq2> and Ubuntu01:01
lubot[telegram] <tsimonq2> so four01:01
arraybolt3_wcright01:01
arraybolt3_wcthough technically that uses my Ubuntu One account so :P01:01
lubot[telegram] <tsimonq2> and probably LXQt back in the day, so maybe even 5 😆01:01
lubot[telegram] <tsimonq2> ~ federation time ~01:02
arraybolt3_wcLXQt has a Discourse?01:02
lubot[telegram] <tsimonq2> had :)01:02
arraybolt3_wcah01:04
arraybolt3_wcyeah I don't think I ever used that01:04
arraybolt3_wcthanks KeePassXC for stealing focus so now I just typed *something* into it, no clue what01:04
arraybolt3_wcand now I get to think of a new Google password. Yay.01:22
arraybolt3_wcsigh, I have a decent passphrase memorized but it will take way too long to type on my Chromebook's touchscreen01:22
lubot[telegram] <teward001> password is "ItIsS1monsFault@lw@y$!", FIDO U2F 2FA key01:23
arraybolt3_wclol, I actually have a 2FA key...01:23
arraybolt3_wcand it's applied...01:23
arraybolt3_wcbut the idea of leaving the password unchanged is a bit worrying01:24
arraybolt3_wcalright, came up with a new password that was better than my old one01:28
arraybolt3_wcso that's good01:28
arraybolt3_wcsomewhat ironic that the account I need to stay secure the most is the only one using a memorized password which is by nature less secure than the monsters KeePassXC comes up with01:29
arraybolt3_wcbut that's what U2F is for I guess01:30
arraybolt3_wcteward: change my password on notes.lubuntu.me and DM it to me if you would please, thanks and here have some coff ee01:49
lubot[telegram] <Roberalz> Ouch I dont have a password for notes.. :p01:51
lubot[telegram] <tsimonq2> Looks like @teward001 fixes everything now :P01:58
Eickmeyer*cough* ^ Amy's account btw, setting it up for her, but bringing her here because  ¯\_(ツ)_/¯01:59
arraybolt3_wcEickmeyer: I thought she had just shown up and was excited for a bit :)02:00
EickmeyerShe's prepping dinner.02:00
arraybolt3_wc*sigh* you don't realize just how many accounts you have until you have to change the passwords for all of them02:00
EickmeyerI figured I'd bring her in here for familiar face reasons, namely tsimonq2 and teward (to a lesser extent, only because she's seen him on the screen).02:01
lubot[telegram] <tsimonq2> Eickmeyer: Where's her Membership app? Surely the head of Edubuntu should have membership already 😁02:10
lubot[telegram] <tsimonq2> After dinner, right? ;)02:10
arraybolt3_wcmembership... app?02:10
arraybolt3_wcI think you mean cloak :P02:10
lubot[telegram] <tsimonq2> Application02:10
arraybolt3_wcoh right02:10
* Eickmeyer bonks @tsimonq2 with a mallet02:10
lubot[telegram] <tsimonq2> this is true :P02:10
arraybolt3_wcI heard "app" and thought "since when is there an app involved in applying for Ubuntu Membership? Where do you install it from?"02:11
EickmeyerShe has a life you know.02:11
arraybolt3_wcunlike us02:11
lubot[telegram] <tsimonq2> I know, I know XD02:11
arraybolt3_wc/s02:11
lubot[telegram] <tsimonq2> LMFAO02:11
lubot[telegram] <tsimonq2> Okay okay let's be fair, some of us have lives ;)02:11
EickmeyerAnd we did only get back from Riga yesterday evening.02:12
arraybolt3_wcseriously though, most of my life is working on the computer, whether I'm doing some Bible related project, packaging, coding, chatting, technical support, whatever. I think I probably type more than I talk in real life.02:12
arraybolt3_wcand my keyboard shows it :P I'm wearing through the top layer of black... stuff... on my laptop keyboard02:13
arraybolt3_wc(dunno what coating it is but it's partially missing on my E, S, D, C, and N keys)02:13
tewardits called "paint"02:13
tewardlol02:13
arraybolt3_wcbingo02:13
Eickmeyer😂02:13
* arraybolt3_wc grabs a vial of acrylic and fixes the problem02:14
EickmeyerSometimes it's epoxy, but you're not so lucky.02:14
arraybolt3_wchy why dosn't my ai ky prss anymor02:14
EickmeyerSounds like a hardware problem to me.02:14
arraybolt3_wcthat's a joke02:14
arraybolt3_wcas if I painted my keys and got some stuck under the key02:15
EickmeyerI know.02:15
EickmeyerI know.02:15
arraybolt3_wclol, you take jokes very matter-of-fact'ly.02:15
EickmeyerI know.02:15
* arraybolt3_wc removes the record from the record player02:15
tewardthats erich :P02:15
tewardgrumpy just like me xD02:15
EickmeyerMore just dry than grumpy.02:16
arraybolt3_wcalright, password fixing complete.02:24
arraybolt3_wcgah, and I have a headache.02:24
guivercno fallback numbat pictures available at nosplash...07:51
lubot[telegram] <tsimonq2> So, I actually brought this point up at the Ubuntu Summit, and we should address this here as well.10:42
lubot[telegram] <tsimonq2> 10:42
lubot[telegram] <tsimonq2> Last cycle, we received SVGs from the Community Team only two weeks before UI freeze. This isn't an issue for a team our size, after actually realizing this weekend we're one of (if not the largest) current active flavor contributor teams. I worry about the smaller flavors, the ones who don't really have the time to make a cool wallpaper with the design. Sure, they could always use some default, but it should have a little flavor10:42
lubot[telegram] <tsimonq2> 10:42
lubot[telegram] <tsimonq2> They agree that it should be pushed back quite a bit, so we get the wallpapers early. Additionally, there seems to be a little early support for a unified cross-flavor support team to help with artwork. 10:42
lubot[telegram] <tsimonq2> 10:42
lubot[telegram] <tsimonq2> We shouldn't worry as much about the wallpaper quite yet, I'd say. If it were solely up to me, I'd say throw in a classic LXDE wallpaper just to troll. I'll keep you posted, but I don't see myself -1ing any rational placeholder wallpaper.10:42
lubot[telegram] <tsimonq2> Also, we should be very intentional about what the final wallpaper should be, and fix whatever wallpaper caching issues exist, because this is the face of Lubuntu for the next two years10:43
lubot[telegram] <tsimonq2> I actually like this a lot as a placeholder, thoughts? : https://matterbridge.lubuntu.me/62833895/file_10093.jpg10:46
lubot[telegram] <tsimonq2> This is my ironic pick, our first wallpaper for our first release XD : https://matterbridge.lubuntu.me/e0657486/file_10094.jpg10:48
lubot[telegram] <tsimonq2> wxl: https://git.launchpad.net/ubuntu/+source/lubuntu-artwork/tree/src/usr/share/lubuntu/wallpapers?h=applied/ubuntu/xenial10:49
lubot[telegram] <tsimonq2> Votes on whether we should package those old wallpapers in its own binary start now :P10:50
lubot[telegram] <kc2bez> That is a bunch to digest this early in the morning :P11:15
lubot[telegram] <kc2bez> I like the idea of a separate binary. `lubuntu-classic-wallpaper` or something.11:16
lubot[telegram] <kc2bez> The LTS seems like a good time to be retrospective.11:17
lubot[telegram] <kc2bez> Your suggestion for a placeholder is a good one and one of my all-time favorites. There are a couple of others that are not release specific that could also serve in the placeholder position.11:19
lubot[telegram] <Roberalz> https://github.com/AzumaHazuki/lxqt-themes-lubuntu-box (re @tsimonq2: This is my ironic pick, our first wallpaper for our first release XD)14:22
lubot[telegram] <Roberalz> Ironic lxqt theme :p14:24
arraybolt3I was just going to take the photo of a numbat from Wikipedia, blow it up with Upscayl, and use that as the placeholder :P17:27
arraybolt3The photo is CC-BY-SA(?) 3.0. (Can't remember if it's SA or not)17:28
arraybolt3Roberalz: hah, that theme is awesome17:28
arraybolt3tsimonq2: I like the idea of a retro-looking wallpaper, but don't like the idea of a 4:3 wallpaper (top and bottom will get cut off once wallpaper scaling is fixed), and don't like the idea of reusing an older wallpaper. If there was a 16:9 edition of the second one you linked, that would be awesome.17:30
arraybolt3Also I found the option to fix our scaling issues 😎17:30
arraybolt3oh, lol, I didn't realize the second one was the first wallpaper we ever used17:35
arraybolt3that might not be a bad idea if we could remake it in full HD or better17:36
lubot[matrix] <arraybolt3> https://matterbridge.lubuntu.me/8bae5123/image.png17:42
arraybolt3teward: ^ IRC bridge bot built without Unicode support?17:43
tewardno, it has unicode support17:44
tewardi might have to tell it to enforce UTF but one thing to keep in mind though is not all platforms are UTF-enabled17:44
arraybolt3🤷17:44
tewardso you might be seeing a transcoding error17:44
tewardesp. when using EMOJI keyboards17:44
tewardbecause that's like UTF-16 or such that a lot of things don't support yet17:44
arraybolt3oh maybe, the second emoji went through but the first one came in corrupted.17:44
arraybolt3Weird, nvm17:45
tewardi mean i don't *see* a second or third emoji here17:45
tewardonly one17:45
tewardthat might've come throug hweird because UTF-16 -> UTF-8 and such is pain17:45
=== teward changed the topic of #lubuntu-devel to: Lubuntu Development | Current dev version: Noble Numbat (24.04) | Schedule: https://ubottu.com/y/mm | Testing: http://iso.qa.ubuntu.com/qatracker | Support: #lubuntu | Offtopic: #lubuntu-offtopic | Telegram: https://telegram.lubuntu.me/development | Discourse back online, expect bumps as it restabilizes.
arraybolt3bleh, guess I should use a real computer and IRC client rather than a tablet and The Lunch17:46
arraybolt3*Lounge17:46
arraybolt3(though an IRC client that came with free food might not be a bad idea)17:46

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!