[00:37] <wxl[m]> So on bug 2064909 they manually set up a single ext4 partition mounted to / with a boot flag and with the encryption box checked and the end result: wrong passphrase. Any clues?
[00:37] -Ubottu[m]:#lubuntu-devel- Launchpad Bug #2064909 (https://bugs.launchpad.net/bugs/2064909) in calamares "Lubuntu and Kubuntu 24.04 fail to decrypt on boot when installed on encrypted partition" [Undecided, New]
[00:40] <AaronRainbolt> oof, he's circumventing the "always leave /boot unencrypted" changes we made
[00:41] <wxl[m]> right so really he should have a separate partition for boot then, eh?
[00:41] <AaronRainbolt> that's specifically not supported by Canonical.
[00:41] <AaronRainbolt> according to mkukri
[00:42] <AaronRainbolt> so yes, he should be making a separate /boot partition. Why this broke is anyone's guess, but this isn't something that probably should be fixed I don't think.
[00:44] <wxl[m]> i don't think we can limit what people can do with manual partitioning, right?
[00:44] <AaronRainbolt> Correct.
[00:45] <wxl[m]> So there's no way to prevent this other than mentioning it in the manual
[00:46] <AaronRainbolt> right
[00:46] <wxl[m]> ^ there's a fun one for you lynorian
[00:46] <AaronRainbolt> I'm going to give him a workaround that might let him do this anyway, and also warn him that this is a bad idea.
[00:48] <wxl[m]> oh i was going to reply and mark it won't fix
[00:49] <AaronRainbolt> ope, I just replied...
[00:49] <AaronRainbolt> I think what broke his stuff was that I changed us from using LUKS1 to using LUKS2 when we changed to unencrypted /boot.
[00:50] <AaronRainbolt> Pretty sure GRUB doesn't support LUKS2 (yet).
[02:26] <wxl[m]> I think it’s best to just stick with unencrypted /boot anyways if not for any other reason but because we can’t ever have an encrypted EFI partition from what I understand
[02:27] <arraybolt3> true
[02:28] <arraybolt3> *if* you have Secure Boot set up and *if* it works right for your system and *if* there isn't some catastrophic vulnerability that lets you bypass it and *if* the user doesn't scream at the sight of the words "Secure" and "Boot" next to each other and turn it off, you can theoretically/hopefully keep tampering of /boot/efi from being a problem.
[02:28] <wxl[m]> As for LUKS, it’s apparent to me that 2 is more secure
[02:29] <arraybolt3> If any of those fail (like on my system where Secure Boot is off and I like it that way), then there's really not much point in encrypted /boot from a theoretical standpoint - getting the key from the user and exfiltrating it becomes harder but not impossible at all.
[02:29] <wxl[m]> ⚠ if-count level high
[02:30] <arraybolt3> really, if someone malicious gets physical access to your computer for more than a few seconds, you should just reinstall from scratch and restore from backups. Some people can do a lot of damage even in just a few seconds.
[02:30] <arraybolt3> So IMO the security benefits of LUKS2 are worth the problems with unencrypted /boot (not to mention the fact that encrypted /boot is a security *hazard* according to Canonical, so probably there's some way to bypass Secure Boot with a specially crafted passphrase or some other insanity there)
[02:31] <wxl[m]> But we really should put something in the manual about this. Namely:... (full message at <http://localhost:8008/_matrix/media/v3/download/chat.staging.ubuntu.com/uRgTxsTndUWyrGgmsGQnbLlt>)
[02:32] <AaronRainbolt> That seems like a good idea to me.
[02:32] <wxl[m]> Yeah the security issues with encrypted /boot are not intuitive. Again, it may be worthwhile to explain
[02:32] <AaronRainbolt> Also, welcome to my chat system straddling again
[02:33] <wxl[m]> It might also be a good addition to the manual to warn people against using manual partitioning, namely that there are no mechanisms in place to keep the user from doing something that just doesn’t work
[02:34] <wxl[m]> Shoot we might even want to provide some examples. Maybe we could do this in the doc section of discourse and link to it
[02:36] <wxl[m]> Speaking of discourse, I really wish we could move to the main one. The support issue is a sticky wicket, though. I see why they want to promote askubuntu but it’s really got poor categorization. I almost feel like there should be an askbuntu for every flavor
[02:36] <AaronRainbolt> askbuntu - for those who can't be bothered to hit u three times
[02:36] <wxl[m]> s//\*/, s//\*/
[02:37] <AaronRainbolt> but yeah I see what you're saying
[02:37] <wxl[m]> Discourse is just so much more powerful. That’s why we keep wanting to jam everything in there
 "So there's no way to prevent..." <- We could always create a page on Lubuntu discourse in the documentation section...   I've been wondering about that since I read Aaron's reply (Thanks arraybolt3  for reply on bug report by the way)
[02:52] <ChrisGuiver[m]> (I don't think many users will encounter it, thus I see discourse.doco as suitable.. but that's just me)
[03:08]  * ChrisGuiver[m] catches up on reading and finally noticed Walter already suggested ^
[03:12] <ChrisGuiver[m]> Thanks too to wxl
 "catches up on reading and..." <- > * <@guiverc:ubuntu.com> catches up on reading and finally noticed Walter already suggested ^
[06:41] <wxl[m]> Great minds think alike 🤣
 "according to mkukri" <- and the Ubuntu Security Team if that helps your case in the future :P
 "Pretty sure GRUB doesn't support..." <- It does, it just isn't secure
[17:17] -Ubottu[m]:#lubuntu-devel- Builds: Lubuntu Desktop amd64 [Jammy 22.04.4] has been updated (20240508)
[18:11] <AaronRainbolt> Simon Quigley: I guess you got tired of the methodical bootstrapping and decided "meh, throw it all at the archive" :P
[18:11] <tsimonq2[m]> AaronRainbolt: precisely 😛
[18:12] <AaronRainbolt> Maybe you can assign me something I should actually be working on when I have free time. It feels a bit bad to think that syncing things bit by bit was my job and then every morning to wake up and it's already been done or the plan changed :P
[18:16] <tsimonq2[m]> AaronRainbolt: did the Matrix update eat my PM
[18:16] <AaronRainbolt> looks like it
[18:16] <tsimonq2[m]> Well, this was the easy part
[18:16] <tsimonq2[m]> Next step is no-change rebuilds, and getting it to migrate
[18:17] <tsimonq2[m]> I planned on letting you do that part completely - this will be the easiest Qt 6 transition we'll ever do
[18:17] <tsimonq2[m]> get you some practice for when we get to a million rdeps
[18:21] <tsimonq2[m]> apologies for pulling the rug out from under you more than once during this thing... heh
[18:23] <AaronRainbolt> np
[21:11] <tsimonq2[m]> Aaron Rainbolt: welp, we're waiting on binNEW
[21:12] <tsimonq2[m]> You're welcome to strategically NCR only those reverse dependencies that do not need something from binNEW
[21:15] <AaronRainbolt> sounds good
[21:40] <AaronRainbolt> Attempting my first ncr using doko's rebuild-for script
[21:41] <AaronRainbolt> fcitx-qt5
[21:42] <AaronRainbolt> which I always assumed was called fctix rather than fcitx, so :P
[21:43] <wxl[m]> "Flexible Context-aware Input Tool with eXtension support"
[21:43] <wxl[m]> aka stupid name
[21:45] <AaronRainbolt> that's a long name
[21:46] <wxl[m]> acronyms over three words long tend to be kind of problematic
[21:47] <wxl[m]> and even five word long ones (SCUBA) are ok, as long as there aren't words in it that aren't part of the acronym
[21:53] <tsimonq2[m]> Aaron Rainbolt: looks like binNMU has been cleared, the baton is yours 🙂
[21:53] <AaronRainbolt> neato!
[21:53] <AaronRainbolt> ooooh, qcoro just went belly-up on symbols
[21:54] <AaronRainbolt> oh lots and lots of symbols!
[21:54] <AaronRainbolt> cracks knuckles and prepares for a painful update session
[21:54] <AaronRainbolt> nice thing is I already uploaded to the archive so I don't need to upload to a PPA to get all the symbols. Just throw a new upload at the archive with the symbols fixes.
[21:54] <AaronRainbolt> or maybe even sync from Debian if they have it fixed already
[21:55] <tsimonq2[m]> I doubt it heh
[21:55] <tsimonq2[m]> We're actually doing this transition before Debian, so all the FTBFS you are seeing is probably unique
[21:56] <AaronRainbolt> probably fix symbols in Debian first and then sync for least effort?
[21:56] <AaronRainbolt> I'll need help with that
[21:58] <tsimonq2[m]> Either solution works, if you're asking for my opinion let's do Ubuntu first then sync whatever necessary changes up to Debian, iff it can be reproduced with an unstable chroot + 6.6.2 from experimental
[21:58] <tsimonq2[m]> sometimes we do carry a delta just for symbols changes... although that's fairly rate
[21:58] <tsimonq2[m]> s/rate/rare/
[21:59] <tsimonq2[m]> Either way, if the package in question is either in Debian Qt/KDE or in Debian KDE Extras, just ping me, I'll do a team upload to experimental
[21:59] <AaronRainbolt> kk
[21:59] <AaronRainbolt> I'll do Ubuntu then since I lack many needed powers in Debian
[21:59] <AaronRainbolt> and you have things like porterboxes for working on that
[22:00] <tsimonq2[m]> "bah, just iterate in experimental" 😛
[22:01] <AaronRainbolt> haha, yeah that too
[22:02] <AaronRainbolt> just upgraded my build system VM to Oracular
[22:47] <teward> arraybolt3 / Aaron: how goes the universe?  Anything interesting that isn't on Simon's plate as a "don't touch it"?
[22:48] <arraybolt3> teward: Things seem OK on my end, waiting for a couple more qcoro builds to hurry up and crash so I can get the symbols logs for them.
[22:48] <teward> nice
[22:48] <arraybolt3> I could start NCR'ing some more things in the mean time
[22:49] <teward> yeah if you need NCRs queued I'd queue those up earlier than later if you need nochange rebuilds because that's coming
[22:49] <arraybolt3> btw is it generally a good idea to NCR in a PPA and *then* throw it at the archive, or is simply hurling things at the builders at Mach speeds and fixing the fallout thereafter acceptable?
[22:49] <teward> i mean
[22:49] <teward> it depends?
[22:49] <teward> reducing initial fallout is best
[22:49] <teward> but since we're in the Debian Sync states and stuff we're probably going to be having a lot of things in the builders
[22:50] <arraybolt3> it's going to result in an FTBFS with loooooong riscv64 builds either way
[22:50] <teward> so i always NCR in local sbuild just to make sure there isn't any major nasty hardcrashes I don't expect but
[22:50] <teward> yeah riscv64 is evilpain
[22:50] <arraybolt3> makes sense
[22:53] <arraybolt3> and the last of the qcoro builds finally went up in flames so I can start fire extinguishing now.
[22:54] <arraybolt3> now I get to enjoy the mental gymnastics of remembering the right syntax for pkgkde-symbolshelper
[22:56]  * AaronRainbolt sent a code block: http://localhost:8008/_matrix/media/v3/download/chat.staging.ubuntu.com/QQhkSmsBisMYjcNdXwnhHJUk
[22:58] <AaronRainbolt> I think time_t64 may be rearing its head again
[22:58] <AaronRainbolt> or the archive is messed up
[23:07] <AaronRainbolt> looks like a combination of a messed up archive plus bad pinning settings.


[00:40] <johnhaitas> cyberanger: ping
[00:43] <johnhaitas> wrst: you here?
[00:44] <wrst> well barely johnhaitas thunderstorm and server issues :)
[00:47] <johnhaitas> wrst: you know of a reasonably priced CA? or how to self-sign ssl certs in a legit way?
[00:48] <johnhaitas> wrst: stay safe ;)
[00:49] <Unit193> We had a storm, but not big
[00:52] <johnhaitas> we have rain
[00:53] <johnhaitas> i think i was programming during the storm
[00:53] <johnhaitas> i went outside and it was cold and wet
[00:53] <johnhaitas> it was warm and dry when i started
[00:56] <Unit193> curl or wget
[01:01] <johnhaitas> curl
[01:01] <johnhaitas> depends
[01:01] <johnhaitas> but generally curl
[01:03] <Unit193> Both work for this, just didn't want to decide :P
[01:04] <Unit193> Not I have expand \o/
[01:13] <cyberanger> johnhaitas: pong
[01:14] <cyberanger> that storm seems to have made it here, just thunder & lightning, no rain yet
[01:14] <cyberanger> so I'm seeing 30-60 miles out maybe
[01:15]  * Unit193 wonders why he's still in Freenode
[01:18] <johnhaitas> cyberanger: you know the best way to produce/get a legit ssl cert?
[01:20] <cyberanger> johnhaitas: define legit
[01:20] <johnhaitas> will not be flagged by software as untrusted
[01:20] <johnhaitas> like web browsers
[01:20] <johnhaitas> or jabber
[01:21] <cyberanger> ah, so not legit, in a crypto sense, but a dumb software sense (self-signed is legit from a crypto perspective, but nothing to authenticate it's genuine except for the fingerprint)
[01:22] <johnhaitas> right
[01:22] <johnhaitas> or rather ... how does one become a CA? ;)
[01:22] <cyberanger> gonna cost time, money or both, it's gotta go through a Certificate Authoritiy
[01:23] <cyberanger> johnhaitas: there's already so many, and it's gotta be trusted in each machine, now if this were a company, one could make an internal, corprate CA, but really sounds like you need to look at verisign, godaddy, startssl
[01:24] <cyberanger> the very companies I never recommend (partially due to the flawed CA design)
[01:26] <cyberanger> startssl has some sort of a free tier, they do aim to be good at what they do
[01:26] <Unit193> cacert
[01:27] <cyberanger> Unit193: not an option, due to johnhaitas' requirement it be recognizied in jabber clients & web browsers (they're better than most CA's though, they really aim to follow the proper model)
[01:27] <Unit193> cyberanger: Some have it, but yeah, not all
[01:28] <cyberanger> johnhaitas: http://www.startssl.com/
[01:28] <cyberanger> Unit193: too few for the requirements
[01:28] <Unit193> Aye
[01:28] <cyberanger> it's disabled in ubuntu even
[01:29] <Unit193> Annoyingly, yes
[01:29] <binarymutant> don't you have to pay for ssl certs?
[01:30] <cyberanger> mozilla ignores it, apple too, can't see the status of microsoft, but come on, it's microsuck
[01:30] <binarymutant> http://www.debian-administration.org/articles/284
[01:30] <cyberanger> binarymutant: eh, few exceptions for that rule, but yeah
[01:31] <cyberanger> binarymutant: and self signed fails to meet johnhaitas' requirement of passing a CA check
[01:31] <binarymutant> ah bc clients have to accept it?
[01:31] <binarymutant> complicated process :/
[01:32] <cyberanger> binarymutant: well, pretty much, not just accept it, but accept it without user intervention
[01:32] <binarymutant> ya that's what I meant. Actually click a button or two
[01:33] <cyberanger> I could see doing that process though binarymutant if it were a company and IT were capabile enough to deploy & secure crypto (only seen fortune 500 companies & the DoD do that, or the little guy with an obsession for crypto)
[01:33] <binarymutant> debian does it
[01:34] <binarymutant> it is annoying though to accept them :D
[01:43] <cyberanger> I've done it with the DoD's Common Access Card
[01:43] <binarymutant> ^^ too scary for me
[01:43] <cyberanger> accept three CA's, then thousands of sites are verified against the Dod's certs
[01:44] <binarymutant> with debian all the different internal machine have to be accepted individually, quite annoying
[01:44] <cyberanger> the dod is a two-factor mutual system though, and they verify the CA's by the fingerprints
[01:45] <binarymutant> fingerprints??
[01:45] <binarymutant> wowza
[01:45] <cyberanger> binarymutant: like one should do with ssh, DoD tries to keep good crypto protocalls
[01:46] <cyberanger> verisign, comodo, idk what they do, I don't trust them for it (little choice though, widely used)
[01:46] <binarymutant> everyone uses verisign
[01:47] <binarymutant> it's like ~50$ though
[01:48] <cyberanger> yep, despite the fact there is little public scrutiny to how they operate
[01:48] <binarymutant> well like all security, they've been broken before
[01:48] <binarymutant> <-- isn't down with the security loop though
[01:48] <cyberanger> binarymutant: thing is, people have blind faith now, when the model is broken now
[01:49] <cyberanger> ssl & tls are fine, but the CA model is shot to .... yeah
[01:50] <binarymutant> all ssl has been broken too, security is loop. Break&fix&repeat
[01:50] <binarymutant> md5 collision or something idk
[01:57] <cyberanger> well, enough effort & time, resources, you can brute force anything
[01:58] <cyberanger> but that's beyond the NSA on a wide scale even
[01:58] <cyberanger> not aware of any attacks that work in a reasonable timeframe when everything is done correctly
[02:01] <binarymutant> idk I stray from sec.
[02:10] <cyberanger> I run headfirst into it with a tinfoil hat & a midevil javlin shouting charge
[02:10]  * cyberanger has the bruises to prove it
[03:55] <chris4585> I really wish my laptop wasn't a laptop
[03:56] <chris4585> I hooked all my desktop peripherals up to my laptop (28" monitor too) and it runs better than my desktop :/
[03:58] <binarymutant> :D
[03:58] <binarymutant> but it's a travelling desktop
[03:59] <chris4585> lol, basically but it puts my desktop to shame
[03:59] <chris4585> runs ubuntu smoother anyway
[04:00] <binarymutant> same here, but I <3 my laptop
[04:13] <Juzzy> man
[04:13] <Juzzy> i gotta hand it to apple
[04:13] <Juzzy> they really got their shiz together
[04:13] <Juzzy> so we stuck an apple TV on the end of our projector
[04:14] <Juzzy> now i can take my ipad, load my VDI client
[04:14] <Juzzy> and take control of the project with any app i need from anywhere
[04:14] <Juzzy> it's pretty sick
[04:26] <chris4585> my laptop also seems to last way longer using only external monitor
[04:26] <chris4585> so I'm happy
[04:30] <vychune> <.<
[04:30] <vychune> >.>
[04:30] <vychune> o.o
[04:31] <vychune> anybody round these parts?
[04:32] <cyberanger> vychune: perhaps somebody is round, think I'm more of a stick figure
[04:32] <vychune> LOL
[04:32] <vychune> sup cyberanger
[04:33] <cyberanger> one horrible looking sky
[04:33] <cyberanger> ok, first one was better
[04:33] <cyberanger> not too much
[04:35] <vychune> hmm i hear that
[04:35] <vychune> rain just stopped here a while ago
[04:35] <vychune> the cold still looms
[04:37] <vychune> how was work?
[04:39] <chris4585> I wish it was cold here
[04:39] <cyberanger> same
[04:40] <vychune> chris4585: where are ya?
[04:41] <chris4585> florida
[04:41] <chris4585> its slowly getting comfortable now
[04:41] <chris4585> but still in the 80's :|
[04:42] <cyberanger> vychune: I want it cold enough to bring out the ice skates & snowboards
[04:42]  * cyberanger was a yankee, hockey hockey, go penguins
[04:42] <vychune> i have a friend at Florida Christain College there
[04:43] <vychune> cyberanger: i heard that
[04:43]  * vychune wants to learn snowboarding
[04:43] <chris4585> I just want it 45F year round
[04:43] <vychune> go Predators
[04:43] <vychune> ?!?!??!?!?
[04:43] <vychune> 45?
[04:44] <vychune> have fun with that lol
[04:44] <vychune> or learn to say eh? and move to northern Canada
[04:45] <chris4585> lol
[04:46] <chris4585> 45 is great weather, I don't like waking up and sweating
[04:46] <chris4585> if not 45 then 55 is good too
[04:46] <cyberanger> vychune: sorry vychune I like a team that knows what snow & ice is, without importing it
[04:47] <vychune> LOL
[16:45] <xpistos> \join #libreoffice
[16:52] <wrst> ha ha xpistos :)
[16:54] <johnhaitas> at least he didn't do the following
[16:55] <johnhaitas> \msg NickServ identify passwordForXpistos
[16:55] <wrst> oh i have came close a time or two
[16:55] <wrst> and hello johnhaitas and xpistos :)
[16:55] <xpistos> Hey
[16:56] <xpistos> my brain is frzzeld
[16:56] <wrst> join the club my friend ;)
[16:56] <xpistos> I can figure out how to append something to a column in libreoffice
[16:56] <xpistos> I wouild think that would be the easiest thing in the world
[16:56] <xpistos> but I keep cutting off the last character to add what I want
[16:57]  * wrst has much more experience on the dark side of office software
[16:58] <johnhaitas> hola wrst
[16:58] <johnhaitas> and xpistos
[16:58] <johnhaitas> :)
[16:58] <johnhaitas> xpistos: in the new job yet
[16:58] <xpistos> Monday
[17:45] <xpistos> A-Holes at Libre office ignored me
[17:46] <xpistos> finally I just concatenated what I needed copied it to note pad and pasted it back
[17:46] <xpistos> done
[19:16] <vychune> hey guys
[19:16] <vychune> forgot this was open
[19:17] <vychune> lol
[19:21] <cyberanger> wrst: you use Lotus Symphony?
[19:21] <cyberanger> hey vychune
[19:22] <vychune> sup cyberanger
[19:22] <cyberanger> not much
[19:22] <wrst> cyberanger: I have before i found it a couple of years ago to be kinda slow
[19:22] <wrst> and bulky
[19:23] <vychune> like lotus notes?
[19:25] <wrst> vychune: IMB'S take on open office
[19:25] <wrst> more or less, pretty neat just a little slow
[19:25] <vychune> oh ok
[19:26] <vychune> like openoffice?
[19:27] <wrst> yes but slicker appearance but slow as christmas
[19:27] <wrst> or *was*
[19:30] <cyberanger> wrst: you did say dark side of office suites
[19:30] <cyberanger> lol
[19:30] <wrst> well i was referring to the darker side cyberanger MS Office :)
[19:30] <wrst> I would say IBM is friendly towards open source atleast not a jerk :)
[19:30] <cyberanger> that's not dark, that's as bright as a fire in hell
[19:32] <wrst> ha ha
[19:33] <vychune> lol
[19:35] <vychune> getting off need the bandwitdh
[19:35] <vychune> brb
[19:56] <cyberanger> chatzilla eh, forgot that client existed
[19:56] <Unit193> Eh, can be helpful
[22:09] <johnhaitas> xpistos: good luck monday :)
[23:14] <binarymutant> Deep Space Window Manager = sweet name for a wm
[23:16] <Unit193> I would guess it's not as awesome as it's name though, am I right?
[23:19] <binarymutant> it might be, I don't like {{{lisp}}}{{{{though}}}}{and it's based}{{on stumpwm}}
[23:21] <binarymutant> so I haven't tried it
[23:24] <binarymutant> oh it's (((((lisp)))) not {{lisp}} oops :D
[23:30] <chris4585> nvidia 7025 or radeon 2100, which is better or are they equal crapola?
[23:31] <binarymutant> what's their speeds?
[23:31] <chris4585> thats the problem I can't really find specs lol
[23:31] <chris4585> one guy suggested the radeon
[23:32] <binarymutant> http://en.wikipedia.org/wiki/Comparison_of_Nvidia_graphics_processing_units
[23:34] <binarymutant> radeon one came out later...
[23:35] <binarymutant> http://en.wikipedia.org/wiki/Comparison_of_AMD_graphics_processing_units and the radeon is faster
[23:36] <binarymutant> by 75mhz
[23:45] <chris4585> ah thanks binarymutant
[23:45] <chris4585> well I'm glad I got that one then
[23:45] <chris4585> thanks to rush shipping I have a whopping $0.02 on my card lawl
[23:46] <chris4585> well regardless it'll be better than my old crappy nvidia 6150