Discuss June 2016

discuss@lists.centos.org

114 participants
100 discussions

Re: [CentOS] https and self signed
by James B. Byrne 21 Jun '16

21 Jun '16

On Sat, June 18, 2016 18:39, Gordon Messmer wrote: > On 06/18/2016 02:49 PM, James B. Byrne wrote: >> On Fri, June 17, 2016 21:40, Gordon Messmer wrote: >>> https://letsencrypt.org/2015/11/09/why-90-days.html >> With respect citing another person's or people's opinion in support >> of >> your own is not evidence in the sense I understand the word to mean. > > I'm not interested in turning this in to a discussion on epistemology. > This is based on the experience (the evidence) of some of the world's > foremost experts in the field (Akamai, Cisco, EFF, Mozilla, etc). Really? Then why did you forward your reply a private message to a public mailing list if not to do exactly what you claim you wish to avoid? > >> The assertion expressed in the link given above that 90-day >> certificate lives will serve to increase certificate renewal >> automation is at best a pious hope. > > You are ignoring the fact that the tool used to acquire letsencrypt > certificates automates the entire process. They're not merely hoping > that users will automate the process, they're automating it on behalf > of users. They've done everything but schedule it for their users. > >> One that is unlikely to be >> realised in my opinion for the simple reason that automated and >> therefore mostly unobserved security systems are a primary target >> for tampering. > > For someone who wants "evidence" you make a lot of unsupported > assertions. You do see the irony, don't you? The difference is that I state this is my opinion and I do not claim it as a fact. Your statement claimed a factual basis. I was naturally curious to see what evidence supported your claim. > >> Likewise the authors' opinion that pki certificates are in >> general just casually left laying around to be compromised displays >> a >> certain level of what reasonably could be considered elitist >> contempt >> for the average human's intelligence. > > Or, you know, a review of actual security problems in the real world. > >> Even as arguments I find these two positions are less than >> compelling. >> And in no respect could either opinion be considered evidence. > > That's fine. I don't really need to convince you, personally, of > anything. But for the security of the internet community in general, > I'll continue to advocate for secure practices, including pervasive > security (which means reducing barriers to the use of encryption at > all points along the process of setup). > > I know, and we put infants on no-fly lists for essentially the same religious beliefs. The benefit of so-called general security for the rest of us who do not have to bear its individual specific cost. The is no evidence that this sort of stuff works. It is just done so that if anything bad happens the authorities can claim that they did something preventative which they can point to. Regardless of how ineffectual it was. Automated security is BS. It has always been BS and it always will be BS. That is my OPINION. It may not be a fact for I lack empirical evidence to support it. However, it has long been my observation that when people place excessive trust in automation they are are eventually and inevitably betrayed by it. Often at enormous cost. Let me give you an example of stupidity in action with respect to signed certificates. I have a MacBookPro c. early 2009. There have been five or six major releases of OSX since then. Being a cautious type I download the upgrade installer apps and archive them before installing and upgrading. Over this past weekend my MB stopped booting. It would get to the Apple symbol and go black. Much trial, error, and research later I discover that this is sometimes occurs when a MB has been repeatedly upgraded and that a clean install is the recommended cure. Oh, by-the-way, if you ever have to do this then do not use the Apple Migration Assistant app when you are done. You will be sorry. So, I get out my archived Installer app, go to install it and BANG! My MB proclaims that "Somebody has tampered with the application or it is corrupted!". OH NO! This impediment however is strictly an artefact of signing code with short term certificates. I simply had to reset the date on my MB back to some future date when the certificate was valid and everything worked fine. Of course this took me a great deal of frustrating effort to discover what had happened to all of my archived copies and how to fix it. In the middle of a system recovery I might add. But hey, what is my time worth in comparison to the security those certificates provided? SECURITY that was trivially evaded in the end. Exactly what mindless person or committee of bike-shedders decided that software should be distributed so that copies of it expire? What security issue was addressed by this decision? What benefit to the public was achieved? When real people suffer real inconvenience and real loss of productive effort because of mindless adhesion to bromide based cures that are blandly offered for ills that mostly exist in the imagination of the ignorant then yes; I require evidence of their efficacy. And lining up a bunch of band-wagon pundits chanting the same vacuous refrains is not evidence. And this one is going to the list. -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3 -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

4 3

why gstreamer can't use ffmpeg on centos?
by qw 21 Jun '16

21 Jun '16

Hi, I have one question about gstreamer. Why gstreamer can't use ffmpeg on centos? is there some patent issue related to ffmpeg and gstreamer? Thanks! B.R. Andrew

1 0

yum "Requires" yum-plugin-fastestmirror; why?
by Warren Young 20 Jun '16

20 Jun '16

In another recent thread,[1] someone was having trouble with the yum-plugin-fastestmirror feature, so I suggested he remove it, since it’s just a plugin and should therefore be optional. He reported that it couldn’t be removed due to package dependencies. I investigated further and found that this also affects CentOS 5.11 and CentOS 7.2. (The OP is on CentOS 6.8.) So, I reported it as a bug upstream, and they claim their yum package doesn’t do that, so they’re bouncing the problem back downstream. I checked, and they’re right insofar as CentOS’s current C7 yum.spec file has this on line 118: Requires: yum-plugin-fastestmirror I then tried to go get the RHEL SRPM for yum to compare its spec file to C7’s, but their download site just refers visitors to git.centos.org, and the yum repo there doesn’t seem to have an upstream RHEL7 branch. So, I started poking around in the yum.spec file history, and indeed, the oldest yum.spec file on the c7 branch doesn’t have that Requires line! It was introduced in checkin f1c1b982, which claims all it does is “debrand yum-3.4.3-132.el7”.[2] I realize it is in the CentOS project’s best interest if users always use the fastest mirror when downloading, but I claim that it is a bug to mark any plugin as Requires, particularly when upstream does not. [1]: https://lists.centos.org/pipermail/centos/2016-June/159933.html [2]: https://git.centos.org/blobdiff/rpms!yum/f1c1b9820b3d295cf5b44fa7fc8ff3673e…

4 4

Centos 7 install on dual SSD disk Asus
by Bachir Bachir 19 Jun '16

19 Jun '16

Dear all,I installed centos 7 on the second disk of my Asus laptop. The laptop i have has two SSD disks 240 G and 480G consecutively the fist disk (240) has already windows 10 installed on , the second disk now has Centos 7 installed on.while insalling Centos 7 i let the bootloader part and because i can see only the centos disk not the windowsWhen i turn on my pc the windows part does not boot but the linux i boot on Centos disk and it run as on normal.what would be the best way to add the windows disk so that i can boot it using the bootloader?Any help will be much more appreciated Thanks muchRegards

2 1

AAC in .m4a command line tagging ???
by Alice Wonder 19 Jun '16

19 Jun '16

Hi All, Software patents suck but but unfortunately for speech, MP3 (also still patented until end of next year) also sucks - for html5 audio served to iPhones where Safari doesn't support Ogg Opus and where bandwidth may be limited, AAC is a very attractive option. I have an AAC encoding solution for Linux but I don't have a way to tag them. Anyone know of Linux command-line tagger for .m4a files that produces tags that will work in iTunes? Preferably one that allows addition of album art as well as text tags. Something like eyeD3 (python script) would be great. Has to be command line so it can be automated on a server that does the transcoding. Thanks for suggestions.

1 1

Re: [CentOS] https and self signed
by Gordon Messmer 19 Jun '16

19 Jun '16

On 06/18/2016 02:49 PM, James B. Byrne wrote: > On Fri, June 17, 2016 21:40, Gordon Messmer wrote: >> https://letsencrypt.org/2015/11/09/why-90-days.html > With respect citing another person's or people's opinion in support of > your own is not evidence in the sense I understand the word to mean. I'm not interested in turning this in to a discussion on epistemology. This is based on the experience (the evidence) of some of the world's foremost experts in the field (Akamai, Cisco, EFF, Mozilla, etc). > The assertion expressed in the link given above that 90-day > certificate lives will serve to increase certificate renewal > automation is at best a pious hope. You are ignoring the fact that the tool used to acquire letsencrypt certificates automates the entire process. They're not merely hoping that users will automate the process, they're automating it on behalf of users. They've done everything but schedule it for their users. > One that is unlikely to be > realised in my opinion for the simple reason that automated and > therefore mostly unobserved security systems are a primary target for > tampering. For someone who wants "evidence" you make a lot of unsupported assertions. You do see the irony, don't you? > Likewise the authors' opinion that pki certificates are in > general just casually left laying around to be compromised displays a > certain level of what reasonably could be considered elitist contempt > for the average human's intelligence. Or, you know, a review of actual security problems in the real world. > Even as arguments I find these two positions are less than compelling. > And in no respect could either opinion be considered evidence. That's fine. I don't really need to convince you, personally, of anything. But for the security of the internet community in general, I'll continue to advocate for secure practices, including pervasive security (which means reducing barriers to the use of encryption at all points along the process of setup).

3 3

Centos update 6.8 to 7
by Bachir Bachir 19 Jun '16

19 Jun '16

I downloaded Centos 7 and i want to update from local usb i created using dd if=cenots7 of=/dev/sdc i dont want to reinstall, i need just to update.What would be the best way to do so pleaseThanks muchBachir

2 1

Re: [CentOS] [Fwd: Re: https and self signed]
by James B. Byrne 18 Jun '16

18 Jun '16

On Fri, June 17, 2016 13:08, Valeri Galtsev wrote: > > We do not expire accounts until the person leaves the Department > and grace period passes. Then we do lock account and after some > time person's files are being deleted. This is the policy, and > this is what we do. The only time when account expiration is being > set is for undergraduate students who temporarily work with some > professor. For them expiration is being changed when the continue > to work with the professor next academic year. > > Is this not what everybody does? > Every end-user account, including my own, is given an expiry date six to twelve months in the future and that is extended at intervals as needed. The only exception to this are the root users which have no expiry date set. A forgotten and disused user account that retains access to your system is a significant risk in my opinion. -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

Re: [CentOS] https and self signed
by James B. Byrne 18 Jun '16

18 Jun '16

On Fri, June 17, 2016 11:06, Walter H. wrote: > On 17.06.2016 16:46, James B. Byrne wrote: >> On Thu, June 16, 2016 13:53, Walter H. wrote: >>> On 15.06.2016 16:17, Warren Young wrote: >>>> but it also affects the other public CAs: you canât get a >>>> publicly-trusted cert for a machine without a publicly-recognized >>>> and -visible domain name. For that, you still need to use >>>> self-signed certs or certs signed by a private CA. >>>> >>> A private CA is the same as self signed; >>> >> No it is not. A private CA is as trustworthy as the organisation >> that >> operates it. No more and not one bit less. >> >> We operate a private CA for our domain and have since 2005. We >> maintain a public CRL strictly in accordance with our CPS and have >> our >> own OID assigned. > for your understanding: every root CA certificate is self signed; > any SSL certificate that was signed by a CA not delivered as built-in > token in a browser is the same as self-signed; > > > For your understanding, a self-signed certificate is one that has been signed by itself. Naturally ALL root certificates are self-signed. The self-signed root cert is then used to sign a subordinate CA issuing cert and that issuing cert is used to sign other subordinate CAs and / or end-user certs depending upon the permissions given it by the original signing certificate. This establishes the certificate trust chain. If website presents an actual self-signed cert to Firefox for example, it will refuse it. I suppose there is a way to circumvent this behaviour but I am not aware of it. If you present a certificate that is not self-signed but is signed by an authority whose root certificate chain is not in the trusted root store then Firefox gives you a warning -- as given in a preceding message 'net::ERR_CERT_AUTHORITY_INVALID' -- but it none-the-less allows you to accept the certificate as an exception and proceed to the website. If you do not want to get warnings and you trust the issuer then you can add their issuing CA cert chain to your trusted root certificate store. -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

yum timeout ... (CentOS 6.8)
by Walter H. 18 Jun '16

18 Jun '16

Hello, the last times, when I tried to update, it get time outs; even when 'yum list' [root@host ~]# yum list Loaded plugins: fastestmirror, security Determining fastest mirrors epel/metalink | 13 kB 00:00 * base: centos.den.host-engine.com * epel: mirror.steadfast.net * extras: centos.den.host-engine.com * updates: centos.den.host-engine.com http://centos.den.host-engine.com/6/os/x86_64/repodata/repomd.xml: [Errno 12] Timeout on http://centos.den.host-engine.com/6 /os/x86_64/repodata/repomd.xml: (28, 'Operation too slow. Less than 1 bytes/sec transfered the last 30 seconds') Trying other mirror. base | 3.7 kB 00:00 base/primary_db | 4.7 MB 00:03 epel | 4.3 kB 00:00 epel/primary_db | 5.8 MB 00:04 http://centos.den.host-engine.com/6/extras/x86_64/repodata/repomd.xml: [Errno 12] Timeout on http://centos.den.host-engine.c om/6/extras/x86_64/repodata/repomd.xml: (28, 'Operation too slow. Less than 1 bytes/sec transfered the last 30 seconds') Trying other mirror. extras ... how or where can I reset this behavour, to have the really fastest mirros used? Thanks in advance, Walter

6 12

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss June 2016