April 8, 2020
Sudoed podman cannot listen to privileged ports
Edit: This issue is possibly a known one: see "Podman can not create containers that bind to ports < 1024"
It's impossible to reach any exposed privileged port from external net when running podman
sudo podman run -p 80:80 -it nginxSetup: dedicated Centos 8, clean install + docker, no firewalld, iptables at "allow-all" default ruleset. With docker however it works without problem.
What I was trying to run which needed to listen to privileged ports is a certbot inside docker. Motivation is to avoid installing python dependencies or else downloading and running unknown binary.
Labels: centos, centos8, certbot, docker, letsencrypt, linux, opensource, podman
April 4, 2020
Fresh centos8 podman/buildah issues related to alpine
Lately I'm trying out Centos 8 and move to openshift with podman and buildah as docker replacements. So far not without interesting problems!
In a freshly installed updated centos8 it's impossible to build any alpine-based repo or even pull alpine itself:
$ podman pull alpine ... Error committing the finished image: error adding layer with blob "sha256:aad63a9339440e7c3e1fff2b988991b9bfb81280042fa7f39a5e327023056819": Error processing tar file(exit status 1): there might not be enough IDs available in the namespace (requested 0:42 for /etc/shadow): lchown /etc/shadow: invalid argument
The following solution is mentioned in libpod issue 2788:
# dnf reinstall shadow-utilsI did not investigate this deep down, however seem capabilities are set wrong for shadow-utils with yum installation (yum reinstall does not fix this):
$ getcap /usr/bin/newuidmap /usr/bin/newgidmapHere's expected output for the command above:
/usr/bin/newuidmap = cap_setuid+ep /usr/bin/newgidmap = cap_setgid+ep
Labels: buildah, centos, centos8, dnf, opensource, podman, yum
August 2, 2019
Debian Buster (10) no Java 8 support
I installed Debian 10 onto X220 laptop and discovered that it's no official support for Java 8 according to debian mailing list. Also an installation of recommended PPA containing Java 8 which requires adding gpg keys via apt-key fails. Little disappointed by the keys shit. I'm looking for some other options, as Java 8 is critical for me and I really don't wanna mess up with unofficial openjdk builds.
This resembles me a lot this almost comedian video on how hard to describe the life of sysadmin to non-it people. Palm, palm, palm.
Video link
So no Debian 10 for my X220. Thinking about arch (used it for some years, with some luck of failing video drivers - I don't have a good feeling about it being on laptop) or centos (happy with it on server, not sure about client). Also maybe a Debian 9 is a logical choice as seems like it has Java 8 supported by default.
This resembles me a lot this almost comedian video on how hard to describe the life of sysadmin to non-it people. Palm, palm, palm.
Video link
So no Debian 10 for my X220. Thinking about arch (used it for some years, with some luck of failing video drivers - I don't have a good feeling about it being on laptop) or centos (happy with it on server, not sure about client). Also maybe a Debian 9 is a logical choice as seems like it has Java 8 supported by default.
Labels: arch, centos, debian, java, java 8, laptop, linux, openjdk, opensource, x220
June 11, 2019
An "Ungoogled" Chromium: how to move from Chrome
In light of google disabling adblocking-related API parts for Chrome extensions and lots of other shit about Chrome I started to look for an alternative.
What I came into is "ungoogled chromium" which can be downloaded as many other chromium variants from here. Not sure on next step, can possibly compile it myself with importing latest patches or reverting patch related to API cut (I'm sure they'll make it impossible. though).
There're some challenges in process of moving to Chromium from Chrome, though. Copying profile is not enough ;)
What I came into is "ungoogled chromium" which can be downloaded as many other chromium variants from here. Not sure on next step, can possibly compile it myself with importing latest patches or reverting patch related to API cut (I'm sure they'll make it impossible. though).
There're some challenges in process of moving to Chromium from Chrome, though. Copying profile is not enough ;)
- If you want to move to Chromium smooth and save your opened tabs, the trick is to copy user profile while Chrome is opened (as Chromium resets some of settings while opening newly copied profile it starts with "Open with new tab" option effectively forgetting all your tabs
- In Chromium passwords cannot be imported. At all. Or saved. Until you delete "Login Data*" files (DB itself and -journal).
- Extensions cannot be set up from chrome store. Download process is manual using download URL below or here with pictures (if you don't mind some Japanese).
- Look through
https://clients2.google.com/service/update2/crx?response=redirect&prodversion=[PRODVERSION]&acceptformat=crx2,crx3&x=id%3D[EXTENSIONID]%26ucPS Speaking of privacy and adblock-related extensions, I'm using uBlock origin (gorhill's one) and Tampermonkey with some Medium-related scripts. Cannot imagine browsing without them - internet is just hell (from my point of view I can compare it with popups and blinking banners of 90s).
Labels: chrome, chromium, extensions, google, opensource, privacy, security, ublock
April 18, 2017
Wrong frameworks?
The story is very short. Some modern apps are just a resource vampires. Like for example Slack (which I don't regularly use) or Telegram (which I do). Let's see idle use:
- Telegram consumes 1% CPU time (14 minutes in total for 3 days) and 68Mb RAM
- WinWord with 2 docs opened consumes 0% CPU (0 (zero) minutes 34 seconds in total for 3 days) and 43Mb RAM
- Telegram consumes 1% CPU time (14 minutes in total for 3 days) and 68Mb RAM
- WinWord with 2 docs opened consumes 0% CPU (0 (zero) minutes 34 seconds in total for 3 days) and 43Mb RAM
What. the. hell.?
P.S. Just compare it to now RIP Google Talk app which consumed 1-3 Mb RAM (and had voice calls!).
Labels: cpu, memory, opensource, ram, resources, telegram, winword, word
April 14, 2017
Patch to stop video autoplay in Chrome
I don't like an annoying videos crying out loud on me from respectful web sites (mostly ads). Also I don't want to setup another one Chrome extension (230000 users using that). I already have too much of them. And yes, uBlock Origin cannot stop them all.
So I've patched Chrome (chromium actually) source code and compiled it for myself from source. Voila, it works! Patch is below just to know how simple the change (that is being discussed for 2 years with no effect, while the problem itself exists for much more than 5 years) is.
And yes, I don't mind pressing manually for video to start every time. Also I don't mind stop wasting my data plan and draining laptop battery. Thanks Google for being unfriendly and not having any user settings for this ;-)
Disclaimer: published under MIT License. That is, simply: "as-is", no guarantees, by downloading this patch you know what are you doing.
So I've patched Chrome (chromium actually) source code and compiled it for myself from source. Voila, it works! Patch is below just to know how simple the change (that is being discussed for 2 years with no effect, while the problem itself exists for much more than 5 years) is.
And yes, I don't mind pressing manually for video to start every time. Also I don't mind stop wasting my data plan and draining laptop battery. Thanks Google for being unfriendly and not having any user settings for this ;-)
Disclaimer: published under MIT License. That is, simply: "as-is", no guarantees, by downloading this patch you know what are you doing.
PS. How for Google is that possible to build such an unrelevant ads platform on a base of such modern data analysis techniques and so many context-related ads? I just don't see any relevant video or text ads for the last few years.
Labels: ads, autoplay, chrome, chromium, linux, opensource, patch, video, webkit
April 13, 2017
Notes on Brave browser
Just a few notes for myself. Took a minute to look through Brave(.com) browser and stuck upon mention that it uses NaCl in Crypto. Why the hell to use NaCl? I get used to disable NaCl in Chrome when I could - until chrome:plugins control was removed. I just believe that crypto must be as close to CPU as possible, as native as possible (no JavaScript crypto code) and HW accelerated on CPU level. The lesser layers the safer it is, cause so no secret keys could be left in memory to be read by some other process.
Second thing (which could be not relevant, but looks strange anyways), is that it used npm as package manager in previous days.
Second thing (which could be not relevant, but looks strange anyways), is that it used npm as package manager in previous days.
April 12, 2017
Arch with mate: cannot lock screen with mate-screensaver, had to move to xscreensaver
I rarely pay much attention to opensource software bugs, but this regression is kind of severe as it touches security of desktop system.
I use Arch as desktop OS, with mate. After latest update pacman -Syu I noticed that I can lock screen only once after restart or so. It works like this: when selecting "Lock screen" from menu it just does nothing, and it's nothing also in .xsession-errors. So screen remains unlocked.
When I (maybe mistakenly) try to manually execute mate-screensaver it says like "screensaver is already running for this session".
So I took way of getting rid of mate-screensaver and installing and using xscreensaver instead (pacman -S xscreensaver). It works just fine.
I use Arch as desktop OS, with mate. After latest update pacman -Syu I noticed that I can lock screen only once after restart or so. It works like this: when selecting "Lock screen" from menu it just does nothing, and it's nothing also in .xsession-errors. So screen remains unlocked.
When I (maybe mistakenly) try to manually execute mate-screensaver it says like "screensaver is already running for this session".
So I took way of getting rid of mate-screensaver and installing and using xscreensaver instead (pacman -S xscreensaver). It works just fine.
Labels: arch, linux, mate, mate-scresnsaver, opensource, screensaver, xscreensaver
April 5, 2017
ag regex syntax
Here's how to find the regexp syntax for 'ag' - the silver searcher:
man pcrepattern
Labels: ag, linux, man, opensource
February 26, 2017
SSH SHA-256 fingerprint is not human readable
I'm not sure when this was changed, but now ssh server key fingerprint is human unreadable. Why is this a serious problem? SSH works like any other public key crypto: to execute key exchange one needs to verify other party's public key. If one doesn't do that, no crypto as man-in-the-middle attack could be executed to catch password. The common use-case makes this attack even more probable: even though people frequently uses key auth, the first login after remote VM setup usually takes place using password. So it's very important to verify server's identity which is done usually using server key fingerprint human comparison like here:
hash trash because it's not easy readable and for sure not so easily memorable as hex format.
Compare that with SHA-1 fingerprint (actually connecting to the same SSH server):
$ ssh ... The authenticity of host '... (...)' can't be established. RSA key fingerprint is SHA256:qSj/We80nmhTc8Pc4XPazxlpGrnv95EZNXSZB1YsGl0.Looks like
Compare that with SHA-1 fingerprint (actually connecting to the same SSH server):
The authenticity of host '...' can't be established. RSA key fingerprint is 77:5f:3b:1f:84:eb:d2:0c:ca:bd:b3:5d:f7:3c:c3:6f
Grouped hex digits, no trash.
Maybe I'm wrong, but it looks for me that ssh maintainers in this case are blindly following a modern fashion to use sha256 instead of considering which UX leads to less human errors.
I'm not sure if that's somehow connected to using ECDSA keys or not. Anyway this change to sha256 increases human mistakes in using crypto tools like SSH which is very bad.
November 10, 2014
Openfire installation bugs
This is my experience while installing .tar.gz onto centos.
1. Automated redhat init.d and user script openfire/bin/extra/redhat-postinstall.sh has bug on line 27: it states wrong openfire.sh filename (really no ".sh"). WTF?
solution: open redhat-postinstall.sh and remove .sh on line 27
2. after going through install web guide I cannot log in to admin console. (now it reminded me how much sometimes I hate opensource).
solution: username IS NOT admin@domain as you typed in. username = admin without any @domain. f%%ck you.
3. openfire cannot live behind non-root web context (in my case it's proxypass of /openfire through https apache vhost).
solution: no?
1. Automated redhat init.d and user script openfire/bin/extra/redhat-postinstall.sh has bug on line 27: it states wrong openfire.sh filename (really no ".sh"). WTF?
solution: open redhat-postinstall.sh and remove .sh on line 27
2. after going through install web guide I cannot log in to admin console. (now it reminded me how much sometimes I hate opensource).
solution: username IS NOT admin@domain as you typed in. username = admin without any @domain. f%%ck you.
3. openfire cannot live behind non-root web context (in my case it's proxypass of /openfire through https apache vhost).
solution: no?
Labels: centos, installation, openfire, opensource, shit, xmpp
January 10, 2014
no alt-tab in ubuntu 12.04
is that SO F%%G HARD to make QA for such thing as Ubuntu 12.04 LTS?!
migrating today from 10.04 to 12.04 LTS. Problem: Alt-Tab does not work any more out of the box in gnome classic.
edit:
bug in compiz: https://bugs.launchpad.net/ubuntu/+source/compiz/+bug/971051
Labels: opensource, shit, ubuntu
March 10, 2013
firefox default pdf viewer
so firefox 19 now have some inhouse built shitty default pdf viewer. shitty it is because it shows only the english text. also, because it is NOT an extention, it's extremely hard to find option to disable. WTF?!
Labels: firefox, opensource, pedofirefox, shit
April 13, 2012
solution: if linux (ubuntU?) freezes in boot (splash or log)
edit /etc/default/grub:
and possibly disable acpi 2.0 (not all acpi, 2.0 only) in BIOS
This problem seems to be frequent on AMD (I have AMD Phenom X6 1090T).
Bug exists at least in Ubuntu since 2008: bug on launchpad. Problem started to appear in 10.04, but exists even in Ubuntu 11.11. The bug on launchpad had been discussed in MANY comments from 2008 to May 2011, until in July 2011 it was AUTO CLOSED with resulution Confirmed->WON'T FIX. IDIOTS?
GRUB_CMDLINE_LINUX_DEFAULT="acpi_skip_timer_override"
and possibly disable acpi 2.0 (not all acpi, 2.0 only) in BIOS
This problem seems to be frequent on AMD (I have AMD Phenom X6 1090T).
Bug exists at least in Ubuntu since 2008: bug on launchpad. Problem started to appear in 10.04, but exists even in Ubuntu 11.11. The bug on launchpad had been discussed in MANY comments from 2008 to May 2011, until in July 2011 it was AUTO CLOSED with resulution Confirmed->WON'T FIX. IDIOTS?
April 10, 2012
binary logs?! go to hell!
read that systemd will soon use binary log (in russian), which of course does not yet support search. f%ck, people, this is late >10 years, because disk space is CHEAP today, we don't need to use smaller binary formats anymore! XML had such success because of human readability without any tools, in any editor, with grep, awk or something else. notepad :-)
Go to hell with that binary logs bullshit and code something really useful.
Go to hell with that binary logs bullshit and code something really useful.
Labels: binary logs, linux, logs, opensource, shit, systemd
April 3, 2012
Android: multiple logons breaks C2DM (android push)
If you have same main account on more than one android device, C2DM delivery will only work for last logged in device (seems that google acc logon happens on system restart). This is a problem for testing park devices for which is hard to create and support unique google accounts :-(
April 1, 2012
firefox 11 crashreporter privacy issues
submitting crash reports cannot be disabled. Even solution described in a comment to bugreport (solution is for version 10) does not work in current version 11. Seems they has "fixed a solution" :)
By the way, this bug exists starting from FF version 4!..
I wonder, is that possible to have clipboard info in a memory snapshot in firefox crashreport?
By the way, this bug exists starting from FF version 4!..
I wonder, is that possible to have clipboard info in a memory snapshot in firefox crashreport?
Labels: bug, firefox, opensource, shit
January 12, 2012
Ubuntu hanging during boot problem fix
This problem of freezing of ubuntu during boot (while udev is fighting for acpi control, actually) can be cured very easy: turn off ACPI 2.0 in BIOS.
May 31, 2011
FF4 sucks for lack of F6!!!
 | =>Перекрасился?!=> Changed color?! |  |
 | <=Смени название!<= Change name! |  |
Labels: firefox, firefox 4, opensource, pedofirefox, pedofox, shit
May 16, 2011
Firefox 4: usability regression (bug?)
The most disturbing 'feature' of new FF 4 is inability to use F6 to go to address bar field. Another one is inability for normal (me?) user to find 3rd version download, instead only 4th version.
Labels: firefox, opensource, shit
