libera/#devuan-dev/ Monday, 2019-07-08

agrisOMG01:11
agrisbuster released01:11
golinuxYesterday.01:13
golinuxIt seems to be breaking stuff01:13
agrisIsn't Debian supposed to... ya know; not break stuff?01:14
golinuxhttps://lists.dyne.org/lurker/message/20190707.142939.b233b63b.en.html01:15
agrisWhat if I consider Microsoft a malware distributor01:17
agrisI totally get the point of secureboot (although it's really not the best solution compared to things like CB) It should not be 'enroll additional keys' into secureboot01:18
agrisrather have the ability to remove M$'s keys from the secureboot rom completely01:19
kilobytethere is no reason _ever_ to use Microsoft keys01:19
golinuxThese days, Debian is broken by design but that's not a discussion for this channel01:19
agrisalso, why in the hell are we treating M$ like a certificate authority?01:19
agrisNow competitors will have to go through M$ to get their keys signed01:19
agrisor why using an X509 like authentication scheme for hardware is a good idea in the first palce01:20
agris*place01:20
agrisThat's too bad. I was really looking forward to Debian potentially turning things around with their new release01:20
agrisomg and they are pulling an ubuntu here and switching to wayland early01:21
kilobytepossible attackers: 1. state or well-connected level: will get a valid M$ signature, 2. data thief: can just boot any signed OS release with any ring 0 vulnerability (including those in _any_ driver), 3. hardware thief: a fence will install Windows, while the thief enjoys his booze/drugs01:22
kilobyteI have yet to see a machine without a "reset CMOS" button, be it via a hash(date) password (Asus, you set date to any publicly known value and that's it) or a switch on the motherboard -- so there's no protection against Evil Maid01:24
kilobyte(assuming you're a hard target who enrolls your own keys; for 99.99% of people the Evil Maid will just boot a M$-signed OS)01:26
kilobyteand there are downsides: no hibernation, many other restrictions01:29
palinurothe only safe secure-boot computer is the one that allows only one CA to sign updates, where you are the creator of that CA, and the only signed kernels are those you have manually signed and approved01:30
kilobyteexactly01:30
palinuroany other way to use secure-boot seems to be just flawed at its core01:30
kilobytebut, because of "reset CMOS" you can't do that because manufacturers won't allow their hardware to be brickable by a stupid user and/or a virus01:32
kilobyte(unless you're big enough to specifically buy hardware permanently tied to your CA key and no other)01:32
palinuroas far as i know i can delete all the certificates from my secure boot configuration and make manual approval operations like adding a specific key, a whole CA or blacklist something01:35
agriskilobyte, you can still replace your system firmware with coreboot01:36
palinuroi can protect the bios with a boot password and add my signed kernel to the approved keys01:36
palinuroif i loose access to the system, i can still open the bios and approve a new key or CA01:36
agrisalthough most of the time your going to have to physically attach or remove the flash chip01:36
agrisI'd like to see PGP signed kernels and CB/grub2 in the firmware an industry norm01:37
palinuroagris how many coreboot computers do you know? how many of them cost less than $500 more than any other equivalent piece of hardware around?01:37
palinuropeople tend to hate overpriced shit01:37
kilobyteagris: coreboot works for a tiny percentage of machines01:37
agriswere talking about workstations here right?01:37
agrisand embedded computers01:38
agrisnot cheap-as-possible consumer facebook browsers01:38
kilobytemy cheap-as-possible consumer laptop has its ME-equivalent entirely user-replaceable, and will boot from a SD card if one is inserted without reading any mutable storage at all01:40
agrisyou can still load me-firmware (even neutered) on CB01:42
agrisI've got a few machines like that01:42
agrisHow can Devuan take advantage of Debian's botched Buster release?01:45
kilobyteI wouldn't speak loudly against systemd-caused breakage (that's obvious by now, and not going to convince anyone who hasn't already made up his mind) -- but _well-researched_ "Secure" Boot education would work nicely01:47
kilobyteas SecureBoot support is outright sabotage of user rights, even for people who don't care about privacy politics -- you lose actual capabilities01:48
agriswhat about wayland01:48
kilobytewayland has some stupid decisions, but nothing unfixable01:49
kilobytethey fixed primary selection, re-add network transparency, etc01:49
agristhey re-added network transparency or they will read it?01:50
kilobytethere's some serious effort, I don't know how good it is at the moment01:50
kilobyte(I didn't have the tuits to look at Wayland recently.)01:51
kilobytecompared to X11's baggage of 1980s design, Wayland might be actually a good thing once it matures01:51
agristhat's the thing kilobyte01:52
agristhe whole thing Debian (used to) stand for. Waiting "till it's ready" for new releases01:52
agrisas in waiting for something to mature before including it in the next release01:53
kilobyteyou need to switch at _some_ point01:53
agrisnot if wayland doesn't mature, or goes in the wrong direction01:53
kilobyteonly GNOME has switched, and that's a lost cause usability-wise01:53
kilobytegoing in the wrong direction is a concern, yeah01:53
kilobyteCSD being the biggest offender at the moment.  It ignores decades of UI research just to make some "app" (as opposed to program) developers happy01:55
agristhat's a HUGE concern of mine as well01:56
kilobytean "app" is there to bolster some "UX designer"'s ego, build "brand awareness" -- while a program is to obey user's wishes and optimize for common workflows, which the program's author can't fully know beforehand01:57
kilobytethat "don't theme our apps" campaign from GNOME folks, or "Material Design".  There are some interesting research papers about that.01:58
kilobytepoorly-marked buttons/etc (the big name is "lacking strong signifiers") make the user take a much longer to do a given task, looking at the interface that much longer vs if the program obeyed some reasonable design02:00
kilobytesame for title bar that places maximize/close/etc buttons in random places02:00
fsmithredit's a plot to get old people off the computer02:01
agrisI think it's a side effect of lowering the bar due to the massive need and lack of skilled programmers02:02
kilobytethe real plot here is to have the user stick with the app ("user engagement") for as long as possible02:02
agriswhere web developers are put into program development roles02:02
kilobyteyeah02:02
agrisand where people who only ever worked with/developed for windows are suddenly told they need to program for UNIX too02:03
kilobytethat's why they're fighting so hard against streamlined, consistent interfaces02:03
agriswithout learning the completely different set of skills and style UNIX programming requires02:03
agrisI'm reading this https://www.debian.org/releases/buster/amd64/release-notes/ch-information.en.html and I feel thoroughly disappointed and let down02:05
agrisIt concerns me if this is going to present much additional baggage for the development of devuan. Especially with them now completely removing all sysvinit leftovers02:06
agrisand how a lot of the Debian documentation is now being replaced with systemd specific documentation02:07
agris>Hidepid mount option for procfs unsupported because systemd doesn't support it02:10
agrisare you kidding me02:11
agrisnetwork interface names no longer supported by systemd or udev so now you have to use the wlp2324u280ry2389fh34 names02:12
kilobyteyes, both of these are worthy talking points02:12
kilobyteeasiest way to get _predictable_ interface names is appending net.ifnames=0 to kernel's cmdline02:14
kilobytethere's a concern about possible reorders, but those are mostly theoretical: not a single x86 machine I own or admin has only a single ethernet interface, yet grepping through logs I did not notice even a single reorder (as opposed to disks which get reordered a good part of the time)02:15
kilobyte"consumer" laptops or desktops have a single ethernet interface, while servers have (or are supposed to have) a competent admin, so you give interfaces meaningful names like lan0 or out0 anywa02:16
agrisok02:18
Centurion_Danagris: Devuan uses eudev, and we have maintained the old network device naming schemes by default.  So you need not worry about that issue.02:18
agrisHow close to Debian's base install do we need to make Devuan?02:18
agrisCan we make some improvements?02:18
plasma41kilobyte: I have 4 ethernet interfaces on my computer and interface name assignments are a race condition every boot. I have a panel widget that displays traffic load on a given interface. I have to change the interface it's tracking about half the time I boot.02:19
agrisLike for a local mailer daemon instead of using Postfix can we use OpenSMTPd?02:19
kilobyteplasma41: USB?02:19
agrisand using sysklogd instead of rsyslog or syslog-ng by default02:19
plasma41Onboard02:19
Centurion_DanWe have tried to keep changes from debian at the minimum required with some exceptions that avoid specific poetteringisations that have leaked into debian.02:19
plasma41I'm using an old server board02:20
fsmithredplasma41, boot with net.ifnames=102:20
agrisalso, do we /have/ tp ship pulseaudio and avahi in the default install02:20
Centurion_Danfsmithred: we shouldn'02:20
Centurion_Danshoudln '02:20
agristhose are usually some of the first things I uninstall and replace02:20
fsmithredCenturion_Dan, it would solve his problem02:21
plasma41fsmithred: do I specify that in grub?02:21
fsmithredyeah, and you'll get the enps... names02:21
Centurion_Danfsmithred: how?  it should be stable with the old names because it should be saving them after first seeing them.02:22
fsmithredplasma41 said his names change every boot02:22
plasma41Is there any way to manually bind the eth0 through eth3 names to the individual hardware interfaces?02:22
fsmithredudev rules02:23
plasma41Alias, basically02:23
Centurion_Danthat said I install ifrename and setup iftab to define special use related interface names bound by the mac addresses.02:23
Centurion_Danplasma41: install ifrename02:23
Centurion_Danand create an /etc/iftab with the name to mac mapping.... but don't use ethX names...02:24
agrisplasma41, with eudev you can actually specify static interface names per mac-address02:24
agrisfor example in my system I have the following: /etc/udev/rules.d/70-net-name-use-custom.rules02:25
plasma41Why not use ethX? Can I not manually bind to those names?02:25
kilobyteplasma41: I no longer work as a sysadmin thus the list is short, but: box 1: 2× "Intel Corporation I211 Gigabit Network Connection" (onboard) + 2× iwlwifi (onboard), box 2: 2× "Intel Corporation I210 Gigabit Network Connection" (onboard), box 3: dual "Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller" (PCIe) + ancient RTL8169 (PCI) for WoL only + an USB02:25
agrisSUBSYSTEM=="net", ACTION=="add", ATTR{address}=="b8:97:5a:XX:XX:XX", NAME="eth0"02:25
kilobytedongle; box 4: onboard + USB dongle02:25
agrisadd that line in and change the mac address to reflect the interface for every interface you need static02:26
kilobyteCenturion_Dan: not using ethX deserves a big paragraph in in-your-face documentation02:26
kilobytebox 5, 6 (hosted): something dual, etc02:26
agrisI have 3 ethernet interface on the box i'm on right now02:27
xrogaanpulseaudio is a godsend. I really do not want to deal with audio issues as I did 10 years ago.02:30
Centurion_Danplasma41: I've had problems binding ethX names in the past if they've already been bound to other interfaces.  It may work but I've not tested lately and instead use more descriptive names like lanX wanX dmzX etc02:30
kilobytexrogaan: yes, the usual fix for audio issues is "apt purge pulseaudio" :)02:31
agriskilobyte, so many times headphones were ruined and ears were ringed because of pulseaudio02:33
agriseven on Devuan ASCII02:33
agrisDidn't realize pulseaudio was installed until that happened again02:33
agris>plug in headphones. somehow audio magically turned itself to 200% on the headphone port02:34
agris>start music synth, unable to initialize audio backend02:34
palinurois there any way to make pulseaudio work on devuan? or to make pulseaudio-addicted applications work properly?02:34
kilobyteit works well on my current desktop; on three of my previous hardware it was a crapshot with on-board hardware02:34
xrogaansounds like user error to me.02:35
kilobytepalinuro: perhaps you hit the autospawn error?  The version is buster is sabotaged to work around a systemd bug.02:35
agrisI know this is not likely to ever happen, but it would be nice if we could replace ALSA and pulseadio with SNDIO http://www.sndio.org/02:36
palinurowtf02:36
kilobytepalinuro: https://bugs.debian.org/92320302:36
agrisYou can find patches to port to sndio already in the OpenBSD ports tree02:36
xrogaanyou guys make great suggestions for the next april fool joke.02:38
palinurokilobyte do you want me to work on it? i have never played with pulseaudio before02:38
plasma41agris: Disable flat volumes in pulseaudio https://www.reddit.com/r/linux/comments/2rjiaa/horrible_decisions_flat_volumes_in_pulseaudio_a/02:38
agrisIs that why pulseaudio does that? because Windows does that?02:39
plasma41:-/ Maybe?02:39
kilobytepalinuro: just delete the file in /etc/pulse/client.conf.d/ (forgot the name) -- its only contents is disabing autospawn in favour of systemd user session02:39
kilobytepalinuro: (if this is the bug I'm thinking of, you may suffer from something else)02:40
agrisor I could just apt purge pulseaudio, and not have a single audio problem in the future like I already did02:41
palinurodoesn't pulseaudio depend on libsystemd0, udevsomething and other systemd dependencies? i see they are in the Depends field, not the Recommends field02:41
palinurohow does it affect devuan if the package doesn't seem to be installable at all?02:42
agrisnone of my machines have pulseaudio on them at all, and only 1 application had problems. A proprietary game called Duskers02:42
Centurion_Danagris, we shall work to make the installation of pulseaudio opt in rather then opt out for beowulf.02:42
kilobyteCenturion_Dan: too much work mucking with Firefox and the like02:42
plasma41agris: Purging pulseaudio is, of course, a perfectly valid option.02:43
agrisand you can still build firefox & clones with ac_add_options --enable-alsa02:43
fsmithredchoice is good02:43
fsmithredff-esr works with alsa02:43
kilobyteCenturion_Dan: and for a lazy or dumb user, putting some sound to speakers while others go to headphones is nice via pulseaudio02:43
Centurion_Danfirefox currently works without pulseaudio - as debian had been persuaded to build it with --enable-alsa02:43
Centurion_Danoops, ff esr that is.02:44
kilobyte(the bare alsa way requires editing a conf file or per-program cmdline args)02:44
xrogaanThe only issue I ever had with pulseaudio, of recent memory, is the order in which it loads my sound cards. Which got fixed by manually writing down the default card it should use.02:46
xrogaanset-default-sink somethingsomething_alsa_output02:46
xrogaanI had none of the issues listed earlier in this channel. I don't even have a /etc/pulse/client.conf.d/02:47
kilobytethe default should be fit for the dumb user, as the likes of us know where to change them.  Thus, pulseaudio is greatly preferred even if it has bugs and downsides.02:47
palinuro<fsmithred "ff-esr works with alsa"> ESR 50 series or the new 60 one?02:47
agriskilobyte, that's not actually true. ALSA-mixer as a setting called automute, where when you plug in headphones the main speakers go on mute until you unplug them02:47
agrisno user-interaction required for that02:47
Centurion_Danpalinuro ff-esr 60.72 supports alsa02:48
palinuroand the latest non-esr version?02:48
kilobyteagris: I want to use both at the same time02:48
palinurodoes it have a build flag for alsa?02:49
agriswhat?02:49
xrogaanwell, gee, if firefox supports it then we're all safe!02:49
kilobyteagris: I mean, I don't actually play sound on both, but my headphones are permanently plugged in, and I wear them when doing particular tasks (speakers being mostly for music, notifications and so on)02:49
kilobytes/play sound on/play sound simultaneously on/02:50
agriskilobyte, https://0x0.st/zLeK.png02:51
Centurion_Danpalinuro: that is the latest version in beowulf too..02:52
agrisanother issue is if you've ever done audio production work on linux02:52
agrisor used  a midi keyboard02:53
agristhe first thing you have to do before doing ANY professional audio work on Linux is uninstall pulseaudio02:53
agrisyou have horrible latency issues, lock contention issues with jackaudio, midi mapping,02:53
xrogaanYeah, what about everybody else?02:54
agriseven if your not going to use alsa and use something like JackAudio you need to uninstall pulse because pulse will fight jack for lock of the sound card02:54
Centurion_Danagris: agreed... pulseaudio is a toy sound daemon that needs to be evicted before doing professional audio work.02:54
agristhe ONLY thing it has over ALSA for consumer use is a built-in per-application mixer. But It's a horrible implementation of it and you can live without it02:55
agrisotherwise applications need their own volume control02:55
agrisand the reason we aren't doing jack by default for general usage in the linux work is ONLY because some applications don't implement it correctly and copypasta pulseadio code for jack code02:56
agriswhich leads to buffer problems02:56
agrislike in Mumble VoIP02:56
agrisor firefox02:56
agrisnot a limitation in jack02:57
fsmithredWas gnupg always Priority: optional, or is that new in Buster?02:57
xrogaanBecause supporting 30 sound API is a ridiculous prospect and devs are fine with just one or two.02:57
agrisxrogaan, you know what was ridiculous? dropping OSS from the kernel way back for licensing issues02:58
agristhat worked02:58
agrisand FreeBSD still uses it02:58
agrisalso piping to /dev/dsp worked02:58
agrislike back in Linux 2.6 days02:58
kilobytefsmithred: you don't need gnupg anymore on most installs02:59
fsmithredwell, I needed it to get the devuan-keyring02:59
fsmithredtrying buster to beowulf migration02:59
agrisaudio on linux is a dilemma03:00
xrogaanagris: back in those days I sometimes couldn't play 2 audio at the same time. And sometimes the audio wouldn't work because of, well I don't know. I don't want to go back to figure out « what went wrong with the audio *this time*. »03:00
agrisit really surprises me audio is still an issue in linux after all these years03:01
agristhe only people that seems to have fixed it is OpenBSD03:01
agrisI can't remember a single time I had an audio problem on that OS03:01
agrisWindows isn't innocent here either03:02
agrisif your doing audio work on WIndows you have to replace windows sound api with ASIO03:02
xrogaanI don't really care.03:02
fsmithredMigration of Buster (standard system utils only) to Beowulf was easy except for the part where I installed sysvinit-core and elogind in debian and rebooted to no inittab.03:03
agrisyou have to be careful with that. systemd deprecated inittab for systemd-something03:06
plasma41agris: Wat?03:06
agrisI remember when I was programming a kiosk for a company, and was trying to start a web browser and x on one of the TTYs03:06
agrisplasma41, systemd does it's own thing rather then defining a getty in /etc/inittab03:07
plasma41*facepalm*03:08
agrisI don't remember what. I stopped basing the kiosk around debian after I encountered that issue after also fighting with systemd replacing automount03:08
agrisand x-system-automount not being reliable03:08
agrisfor network shares03:08
agristhere was a huge debacle about "not being able to debug the system back into a sane state over the last remaining serial port" when they removed inittab03:10
fsmithredOK, I didn't do 'apt autoremove' after installing sysvinit-core and elogind the first time. Second attempt I did that and rebooted to sysvinit no problem.03:12
fsmithredI won't get to doing this with a DE tonight.03:13
agrishttps://forums.opensuse.org/showthread.php/475468-In-search-for-a-inittab-entry-replacement-for-systemd03:18
agrishttps://bugzilla.redhat.com/show_bug.cgi?id=81718603:18
fsmithredoh, I just needed to complete the install of the necessary packages.03:23
gnu_srsHello again: Need help to get Beowulf released? which packages are not Devuanized yet?09:04
gnu_srsSince Debian has released Buster, their packages will not change much for some time (except for security issues)09:04
Centurion_Danhi  gnu_srs!09:22
LeePen Centurion_Dan: Hi! Any chance you can move slim-1.3.6-5.1+devuan4 in10:38
LeePen ceres to beowulf?10:38
Centurion_Danoh, that didn't happen?10:39
Centurion_Danwill take a look...10:39
LeePenNot AFACS on pkginfo. Thanks10:39
Centurion_Danok.   pushed to beowulf and building now.  keep an eye on #devuan-ci10:45
Centurion_DanLeePen, build failed .... missing dep libck-connector-dev - aka consolekit2 hasn't been built for beowulf...10:57
LeePenCenturion_Dan: Thanks. I see you are building consolekit2 now.11:01
jaromilpalinuro: what is your assessment of the new d-i ?14:37
jaromilshould we try to spin a build?14:37
jaromilpalinuro: for grub2 to build please create a branch suites/beowulf-proposed14:50
palinuroi have an exam tomorrow (databases), but i would like to start working on d-i  within this week16:38
palinuro<jaromil "palinuro: for grub2 to build ple"> doing it right now16:38
palinurogrub2 branched and mirror-pushed16:39
palinurohttps://git.devuan.org/palinuro/grub2/tree/suites/beowulf-proposed16:40
palinurolast question before i go: does devuan tightly follow the debian development? do we have any chance to backport some additional software from testing not backported by debian?16:45
palinuroi mean, do we have enough freedom in such kind of decisions?16:45
Evilhamyup, if it makes sense, yes16:46
Evilhamideally it should stay close to debian16:46
Evilhambut that's just my opinion :-)16:46
Evilhambut that "stay close to debian" is not an end-goal itself, just something beneficial for everyone16:47
palinurojust to make an exapmle16:49
palinurodebian stretch has never tried to backport docker.io to stretch-backports even if it was a very easy task to do without any change to both stretch or docker16:49
jaromilthe main goal of forking is to keep devuan systemd free17:04
jaromili am wary of any other change to occur on devuan17:05
jaromilrather would recommend doing a derivative17:05
jaromilesp. for software that is directly provided by third-parties and works, why add a burden of maintaining a package to the base system? docker.io has packages they distribute on their own and work great on beowulf17:43
Centurion_Danpalinuro, I agree generally with jaromil.  Although I would say that on a case by case basis we might consider adding packages if there was a utility value to Devuan, and there was a commitment by the proposer to maintain the package throughout a release cycle.22:03
Centurion_Dan... at least.  And by maintain, that means track the upstream for security issues and ensure any critical security issues are attended too.22:04

Generated by irclog2html.py 2.17.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!