f.zz.de
archives / 2017 /

06

Security <here>

Posted Thu 01 Jun 2017 09:33:07 AM CEST Florian Lohoff in

Es ist schon schön wenn ein Security Advisory in 4 Zeichen passt.

Ziviler Ungehorsam

Posted Thu 01 Jun 2017 04:37:26 PM CEST Florian Lohoff in

Ich finde ja die Abschiebepraxis nach Afghanistan dramatisch. Solange unsere MinisterInnen so wie die Flintenuschi in Afghanistan sich aus dem Humvee nur mit Splitterschutzwesten raustrauen ist das definitiv kein sicheres Drittland.

Dazu ist es eigentlich eine Verletzung des Artikel 3 Satz 1 (Alle Menschen sind vor dem Gesetz gleich) des Grundgesetzes wenn wir für die eigenen Bürger eine Reisewarnung aussprechen, aber dann Afghanische Mitbürger abschieben.

Bombenanschläge, bewaffnete Überfälle und Entführungen gehören seit Jahren in allen Teilen von Afghanistan zum Angriffsspektrum der regierungsfeindlichen Kräfte. Sie richten sich auch gegen die Verbündeten der afghanischen Regierung, darunter Deutschland, und deren Staatsangehörige.

Da macht es wirklich Hoffnung wenn 300 Schüler einer Berufsschule in Nürnberg einen von Abschiebung bedrohten Mitschüler vor der Staatsmacht beschützen. Hochachtung.

Stretch - i am coming

Posted Tue 06 Jun 2017 05:22:03 PM CEST Florian Lohoff in
2957 upgraded, 966 newly installed, 275 to remove and 6 not upgraded.
Need to get 4,710 MB of archives.
After this operation, 2,527 MB of additional disk space will be used.

bye bye ROXTerm

Posted Thu 08 Jun 2017 04:16:31 PM CEST Florian Lohoff in

After upgrading to Debian/Stretch my MAJOR point of annoyance was the brokenness of ROXTerm. I have been using ROXTerm for years because gnome-terminal was a major PITA for me. I am heavily using ctrl++ and ctrl+- for changing font sizes. The brokenness in gnome-terminal starts in that font sizes are per TAB and not per window - but - gnome-terminal resizes the window when changing font size. So it is an inconsistent usage which is a major PITA when having a very small font in a vi/development tab so get a huge function on your screen, and a large font mutt/email tab. Switching between those mangles the window size only one way so you very quickly end up grabbing your mouse to again resize the window. Other issues were the character stoplist on double click marking (Which is only configurable by dconf/gsettings) etc etc etc ...

So - I was using ROXTerm. Now ROXTerm has been removed from Stretch because of some GTK3 breakage. I am left with a ROXTerm which when startet opens a 2x20 Window.

Looking for reasons i stumbled on the last message of Tony Houghon mentioning the Death of ROXTerm.

Now i am with sakura because Enrico Zini mentioned it. The only thing missing is beeing able to drag a tab from an existing window to create a new one or better - full drag and drop support for tabs.

I guess thats of a smaller annoyance than ROXTerm breakage and gnome-terminal broken font/view zoom concepts.

Waschbären

Posted Mon 12 Jun 2017 04:45:18 PM CEST Florian Lohoff in

Heute auf dem Weg zur Arbeit liegen mit einem mal am Rande des Asphalts 2 kleine Wollknäule. Aus dem Augenwinkel war klar - Das waren keine Katzen oder Kaninchen. Das war was anderes.

Schnell mal rangefahren und ein paar Meter zurück gelaufen.

2 kleine Waschbärkinder tummelten sich da im Straßengraben. Natürlich wurde ich mit fauchen begrüßt. Mama war nirgends zu sehen.

Supermicro IPMIView and passwords

Posted Tue 27 Jun 2017 02:06:19 PM CEST Florian Lohoff in

Supermicro did a "wonderful" job in making it hard for people to create automatic configs for IPMIView. You can enter username, password and ip address and IPMIView will store it, but for additional security it will "encrypt" the password. They wont tell you how to do it, but will offer a tool to encrypt the password as a java jar file. With some java decompiler and debug code i rewrote it in perl. In the end Supermicro uses the Hostname truncated and padded to 16 bytes as the AES CBC 128 key to encrypt the password.

sub encryptpasswd {
        my ($hostname, $password) = @_;

        # Key is the hostname truncated to 16
        # Padded with NUL to 16 bytes (AES128)
        my $key = substr($hostname,0,16);
        $key.= "\0" x (16 - length($key));

        my $cbc = Crypt::CBC->new(
                -cipher=>'Cipher::AES',
                -padding => "null",
                -keysize => 16,
                -literal_key=>1,
                -header => "none",
                -key=>$key,
                -iv => "\0" x 16);

        my $ciphertext = $cbc->encrypt($password);

        return hexstring($ciphertext);
}

Unexpected perl

Posted Fri 30 Jun 2017 11:26:07 AM CEST Florian Lohoff in

I always thought that perl sort function variables $a and $b where completely of local scope - Today i was told a different story.

The error message was:

Can't call method "id" on an undefined value at ./genconf line 1442.

I was trying to sort an array of objects with something like

foreach my $obj ( sort { $a->id() cmp $b->id() } @$objarrayref

The cause of the error message was trivial - 1000 lines down i used $a as an dummy variable

my $a=afunctionwhosereturnidontwant();

Which overided my $a in the sort function - Unexpected.