[00:01] <RenatoSilva> any suggestion about the merge question? Should I create anotehr branch or just update the one merged and propose it again?
[00:02] <lifeless> RenatoSilva: going back to the 'why keypair' question
[00:02] <wgrant> Aha, somebody who knows!
[00:02] <lifeless> https gives a halfduplex connection
[00:02] <lifeless> ssh gives a full duplex connection which can be more powerufl
[00:02] <lifeless> also
[00:02] <lifeless> historically we started with just sftp
[00:03] <lifeless> and no write-over-http support at all
[00:03] <wgrant> LP has no write-over-http even now.
[00:03] <Laibsch> Hi, not sure this is the best channel, but packages.ubuntu.com is down
[00:03] <lifeless> wgrant: it doesn't, but the bzr client does now
[00:03] <wgrant> Laibsch: Try #canonical-sysadmin
[00:03] <wgrant> lifeless: Right.
[00:03] <lifeless> now, we could have done password auth over sftp
[00:04] <lifeless> but that meant letting one server in the dc get the password out of the db; prior to the time we were designing *no* servers ever get the password once its set
[00:04] <RenatoSilva> lifeless: you mean ssh is more performatic than https, right?
[00:04] <lifeless> RenatoSilva: very much so
[00:05] <lifeless> this isn't set in stone; I'm sure that it can be revisited. OTOH hand it works pretty well at the moment and is a well known protocol amongst open source developers.
[00:06] <RenatoSilva> lifeless: so that was my doubt, it's not because of key-pair-is-more-secure-than-website's-password, just because of performance, right?
[00:06] <lifeless> key-pair isn't intrinsically more secure; key-pair is rather like OAuth in fact
[00:07] <lifeless> in that you setup credentials that are attached to your account for programs to use
[00:08] <lifeless> there is one way in which key-pair is more secure, which is that it can't be brute forced as easily as password systems
[00:08] <wgrant> lifeless: It's a lot harder to brute-force a private key.
[00:08] <wgrant> Right.
[00:08] <RenatoSilva> key-pair is not more secure _in launchpad_ right? because they's protected by a single lp password. By more secure I mean it's almost impossible to guess your private key
[00:08] <wgrant> And I can easily revoke a single keypair without disrupting all of my things that log into Launchpad.
[00:08] <lifeless> but given we use passphrase authentication on the website, its hard to argue that other parts of the system should be held to a higher standard
[00:09] <wgrant> RenatoSilva: Well, bruteforcing your Launchpad password over HTTPS is probably impractical too, if only because the web UI is *so damn slow to respond*.
[00:09] <lifeless> wgrant: Thats more to do with the separate set of credentials aspect
[00:09] <ajmitch> at least GPG keys require validation from launchpad for you to attach them to your account
[00:09] <wgrant> lifeless: That's what I meant.
[00:09] <lifeless> RenatoSilva: it *is* more secure in launchpad
[00:09] <wgrant> ajmitch: Only to an address on the key, not one of your existing addresses, IIRC>
[00:09] <ajmitch> wgrant: ah well
[00:10] <lifeless> RenatoSilva: unless you mean 'if the password is compromised the list of keys can be altered'
[00:10] <RenatoSilva> wgrant: maybe you don't need a brute-force attack to find out website's password
[00:10] <RenatoSilva> wgrant: it's essentially fragile compared to the private pey
[00:10] <RenatoSilva> key
[00:10] <wgrant> RenatoSilva: Right.
[00:11] <wgrant> I'm not quite sure how LP has got away with this, given the immense power that some Launchpad accounts wield.
[00:12] <RenatoSilva> lifeless: unless you mean 'if the password is compromised the list of keys can be altered' ---> yes that's what I mean
[00:12] <lifeless> so, yes thats a vulnerability
[00:12] <lifeless> its the key exchange vulnerability in fact
[00:14] <wgrant> The most sane fix I can think of is to require all Launchpad authentication token changes (passwords, OpenPGP, SSH) to require OpenPGP-signed confirmation.
[00:14] <RenatoSilva> lifeless: people may think, "oh I'm using ssh key pair authentication, really nice, no one will guess my private key". However it's a false sense of security, because that super-powerfull private key is protected by a simple common password.
[00:14] <lifeless> RenatoSilva: uhm
[00:15] <lifeless> RenatoSilva: lp doesn't hold the private key
[00:15] <lifeless> RenatoSilva: if the lp password is guessed, the private key is *still* secure
[00:15] <RenatoSilva> lifeless: I know
[00:15] <wgrant> lifeless: They don't have to. They can replace it.
[00:15] <lifeless> wgrant: yes, I know, see above.
[00:15] <RenatoSilva> lifeless: I mean the authentication
[00:16] <lifeless> RenatoSilva: I think its important that all credentials are protected appropriately
[00:16] <lifeless> same goes for OAuth etc
[00:16] <RenatoSilva> lifeless: people may think "impersonating me in Launchpad is as hard as guessing my private key", but it's not. It's as easy as guessing website password.
[00:17] <lifeless> RenatoSilva: thats true, they may think that. Do you have evidence that they do?
[00:18] <lifeless> RenatoSilva: I doubt that they do, because they still use a password to login to the website
[00:21] <RenatoSilva> lifeless: I thought that that's why an ssh key pair is required, because is more secure than single passwords. Then I thought a bit more and came here to ask you :)
[00:21] <RenatoSilva> lifeless: I wonder what launchpad's wiki stands about it tough
[00:23] <RenatoSilva> wgrant: I don't think it would be a full solution, but Launchpad could send a confirmation email when altering the keys...
[00:23] <srid> launchpad is not loading at all on Opera. is this a known issue?
[00:24] <wgrant> RenatoSilva: An unauthenticated confirmation email is almost useless.
[00:24] <RenatoSilva> wgrant: so that someone would need to get not only lp password but the one from your email
[00:25] <RenatoSilva> wgrant:  An unauthenticated confirmation email is almost useless. --> ?
[00:25] <wgrant> RenatoSilva: Not cryptographically authenticated, that is.
[00:26] <RenatoSilva> wgrant: you mean to ensure that it was lp who sent the confirmation email?
[00:26] <wgrant> RenatoSilva: No - to ensure it was the user who received it.
[00:27] <RenatoSilva> wgrant: sorry I don't get what you mean
[00:27] <wgrant> RenatoSilva: The confirmation email needs to be sent encrypted, or it's easily interceptible in transit.
[00:27] <RenatoSilva> wgrant: you mean to avoid someone else reading the email?
[00:27] <wgrant> Yes
[00:27] <RenatoSilva> k
[00:28] <RenatoSilva> ok
[00:29] <lifeless> wgrant: I don't think it would matter if someone saw 'your keys have been changed'
[00:29] <lifeless> wgrant: an attacker that can prevent mail delivery would just block all encrypted mail from lp
[00:29] <wgrant> lifeless: Of course - that's why the email has a confirmation link.
[00:30] <lifeless> RenatoSilva: I think lp could increase its documentation about this on the person edit page perhaps
[00:30] <lifeless> wgrant: once someone has your password and your email, they are you, unless we build the whole system out of gpg
[00:31] <lifeless> wgrant: which would make it extremely hard to use
[00:31] <wgrant> lifeless: Which was exactly why I suggested we build the whole system out of GPG...
[00:31] <wgrant> lifeless: Well, the current situation is completely unacceptable.
[00:31] <lifeless> wgrant: it is?
[00:32] <wgrant> lifeless: Given the privileges that several community accounts have acquired over the past 18 months, yes.
[00:32] <wgrant> And some other issues.
[00:32] <lifeless> I'm sorry, I'm completely failing to track the logic chain from 'allows password authentication' to 'it is unacceptable that people in the community can have lots of access'
[00:33] <RenatoSilva> well, even your OpenPGP keys are protected by a single password right?
[00:33] <lifeless> Note that most (all?) of the largest web services around use password authentication
[00:34] <wgrant> lifeless: No other well-known web service allows one to push out software to millions of machines within hours, with the click of a button.
[00:34] <wgrant> (well, it requires a key too, but that's easy now)
[00:35] <lifeless> wgrant: oauth key?
[00:35] <wgrant> lifeless: OpenPGP key, to upload the package.
[00:35] <RenatoSilva> lifeless: I think the point is: your password is the only thing protecting your lauchpad account. The SSH keys are just for convenience, for use in bzr+ssh because it is faster than https
[00:35] <wgrant> But that requirement will go away soon.
[00:36] <lifeless> RenatoSilva: wgrant is talking about a whole other things now
[00:36] <wgrant> lifeless: It's very much related - all of these credentials are protected solely by a password.
[00:36] <wgrant> But yes, it has drifted.
[00:36] <lifeless> wgrant: to be precise, the selection of credentials are protected by a password.
[00:37] <lifeless> wgrant: I suggest precision, because pgp keys and ssh keys are *not at risk*.
[00:37] <wgrant> lifeless: Right.
[00:37] <lifeless> and if folk get confused and start to think they are, the conversation will be muddy
[00:37] <lifeless> so lets examine the basis of soyuz and gpg stuff
[00:38] <lifeless> we don't require a web of trust; rather we require one working email account
[00:38] <lifeless> and a gpg key for that account
[00:40] <lifeless> ever since soyuz was created this has been the case; and adding a mail account with gpg key has been easily doable if you compromise the password
[00:40] <wgrant> Right.
[00:41] <wgrant> But there were previously barriers which meant that just getting access to a Launchpad account or OpenPGP key were not fatal.
[00:41] <lifeless> wgrant: there were?
[00:41] <lifeless> wgrant: are you referring to needing shell access to a dc machine to do archive admin?
[00:41] <wgrant> lifeless: There were. Only the development series can be uploaded to directly. That mitigates a lot of the damage, although it's still pretty awful.
[00:42] <wgrant> Any other series has to go through the queue, which was previously administrable only with shell access.
[00:45] <lifeless> so now lets compare the access levels
[00:45] <lifeless> ssh keys are protected by a passphrase, but you need physical access to attempt attack
[00:45] <lifeless> e.g. UDS
[00:45] <lifeless> ditto gpg keys
[00:46] <srid> hmm, launchpad form POST is screwed up. some fields are not saved at all. (or, is it my browser fooling?)
[00:46] <lifeless> OTOH lp passphrases are on the web, but arguably we can do a better job of detecting attacks
[00:46] <lifeless> srid: what page?
[00:46] <wgrant> lifeless: LP accounts are also accessible with one of several cookies.
[00:46] <srid> lifeless: bug page. I changed importance from 'Undecided' to 'Low' (along with other changes), but the importance field was not changed at all. (browser -- safari on macosx)
[00:46] <lifeless> (an offline dictionary attack on your gpg keys are not accessible)
[00:47] <lifeless> wgrant: currently, the cookies are end to end encrypted
[00:47] <lifeless> wgrant: but I'm guessing you're arguing that physical access may permit copying a cookie
[00:47] <lifeless> srid: try refereshing it?
[00:48] <wgrant> lifeless: Physical access makes that easy, yes. But there are others ways.
[00:48] <wgrant> Practical ways.
[00:48] <srid> hmm. didn't. will try next time.
[00:48] <srid> but this is not supposed to be cached. damn.
[00:48] <srid> besides, why would one field have old values .. while others not. strange indeed.
[00:48] <lifeless> wgrant: I may be missing something, but https <-> https means you need either a xss attack (and we're very vigilant about those), or physical access to the source or target
[00:48] <wgrant> srid: Some browsers do strange things with caching form values.
[00:49] <lifeless> srid: we use AJAX
[00:49] <lifeless> srid: for an increasing number of things
[00:50] <wgrant> lifeless: There are other ways. People do not protect their cookies well.
[00:50] <wgrant> It is entirely the user's fault, but it still happens.
[00:51] <Daviey> lifeless: MITM is still viable with https <-> https.
[00:51] <RenatoSilva> I just don't see many sense of the ssh keys, it would be better if you could just type your password in bzr+ssh
[00:52] <RenatoSilva> *sense on
[00:52] <RenatoSilva> *much
[00:52] <lifeless> RenatoSilva: ssh is much more convenient
[00:52] <lifeless> RenatoSilva: it allows cron jobs and other things without putting my password in plain text
[00:53] <wgrant> It means I can keep my Launchpad password off all those remote machines entirely.
[00:53] <RenatoSilva> lifeless: I mean the authentication, ok use ssh for transport, but use your lp password to authenticate instead of a key pair. I don't know if the ssh protocol allows you to do this tough.
[00:54] <lifeless> RenatoSilva: I know wha you meant
[00:54] <RenatoSilva> lifeless: isn't your private key kept plain-text in memory anyway?
[00:54] <lifeless> RenatoSilva: no, its not.
[00:54] <lifeless> depending on your config
[00:55] <lifeless> at worst its protected and locked to prevent paging to swapfile
[00:55] <lifeless> you can also have multiple keys, one per machine
[00:55] <RenatoSilva> the same could be done with lp password
[00:55] <lifeless> it could
[00:55] <wgrant> It's also only there for a tiny period, and an SSH key is a lot less powerful than your Launchpad password.
[00:56] <lifeless> however passwords are bruteforcale
[00:56] <lifeless> and theres no need for that when the password prompt can be done locally on the users machine using keys
[00:56] <micahg> lifeless: that depends on what safeguards are built in to whatever you're logging in to
[00:57] <lifeless> micahg: whether it can be successfully bf'd - yes.
[00:57] <lifeless> whether you allow the possibility - no
[00:57] <lifeless> and whether we need to deal with people trying - no
[00:57] <lifeless> and whether the owner of the credentials is inconvenienced when someone is trying - no
[00:57] <micahg> lifeless: the possibility depends on the safeguards
[00:58] <lifeless> maybe I can put it this way:
[00:58] <lifeless> keys: very small surface area. passwords: large surface area
[00:58] <RenatoSilva> lifeless: bzr could act as a browser, you log in to lp site, then every time bzr sends a request, lp site checks if the mentioned user is authenticated
[00:59] <lifeless> can you put a lot of effort in and get maybe the same thing with passwords? yes. But why would you give yourself that headache.
[00:59] <lifeless> RenatoSilva: thats roughly what oauth is
[00:59] <lifeless> RenatoSilva: however, what compelling advantage does that have over ssh?
[00:59] <RenatoSilva> oauth?
[00:59] <lifeless> RenatoSilva: oauth
[01:00] <RenatoSilva> lifeless: the advantage of not using a non-sense key pair
[01:00] <RenatoSilva> lifeless: non sense in the sense of security
[01:00] <lifeless> wgrant: I'd be delighted to talk about your concerns more, but this forum is going sideways too often
[01:00] <lifeless> wgrant: perhaps drop me a mail
[01:00] <wgrant> lifeless: It is. OK.
[01:00] <RenatoSilva> google oauth
[01:01] <lifeless> RenatoSilva: we discussed the security aspects earlier; you're recapping the prior conversation or something. ssh keys are demonstrably more secure than passphrases.
[01:01] <lifeless> their lower bound is approximately the same as the upper bound you can reach with passphrases
[01:01] <lifeless> and yes, the vulnerability of passphrases does allow the key list to be changed
[01:01] <lifeless> that isn't a reason to use a weaker auth for another component
[01:03] <RenatoSilva> .
[01:09] <RenatoSilva> compromise website pwd is a disaster anyway, so let's stand this will never happen. Now add to this scenario the ssh key. If you somehow get the private key, you can push code to lp as if you were the owner of the key. Now imagine there's no ssh key, you need to type lp password (like bzr is a browser using https only for auth). As previously standed, the password is never compromised. Therefore it is more secure :)
[01:11] <wgrant> RenatoSilva: But the password *is* compromisable, and LP authentication will hopefully be stronger than just password auth eventually. There's no point reducing SSH security to the current awful state of web auth.
[01:14] <micahg> which is the appropriate project for filing a request regarding blueprints
[01:14] <wgrant> micahg: blueprint
[01:15] <micahg> :)
[01:15] <RenatoSilva> wgrant: compromise website pwd is a disaster _anyway_, so _let's stand_ this will never happen
[01:15] <lifeless> RenatoSilva: do you mean 'the website password database being exposed'?
[01:16] <spm> RenatoSilva: err what? that's *not* how you do risk analysis.
[01:16] <wgrant> RenatoSilva: But the website password can and will be compromised. It won't be so much of a disaster when there is additional protection in front of auth settings.
[01:16] <lifeless> RenatoSilva: or 'a single account being compromised'?
[01:17] <RenatoSilva> ssh keys act as a "second" password with less privileges, but protected by the first password. Two passwords are two ways of impersonating you in some level. And that "second" credential _is protected by the first one_, which means that compromising the first password is the same as compromising the second. So losting the master password is a disaster _anyway_, with or without shh keys. The difference is that with ssh keys you open a second door to y
[01:17] <lifeless> RenatoSilva: if what you really mean is 'I don't like having to fiddle with ssh keys', then I suggest you file a bug asking to make that easier to work with.
[01:20] <RenatoSilva> lifeless: I don't want anything. I'm just talking at a bazaar.
[01:21] <lifeless> you seem to be arguing a particular case though. LP *wants* to support multiple credentials for people, because that meets some very important use cases, such as running programs without disclosing the users primary credentials.
[01:21] <lifeless> The use case you are arguing for, of using passwords for things other than access to the website is *not desirable* in launchpad, because its less secure.
[01:22] <lifeless> It's less secure because it leads to the users credentials being stored in plaintext across multiple machines
[01:23] <RenatoSilva> plaintext even if bzr acts as browser?
[01:23] <micahg> lifeless: are you assuming passwords are stored in plain text?
[01:24] <RenatoSilva> that is bzr connects through https with lp, then sends the typed password and starts a session with the website
[01:24] <wgrant> RenatoSilva: As lifeless said, that's basically what OAuth does.
[01:24] <lifeless> micahg: that is the proposition being argued
[01:24] <lifeless> RenatoSilva: that doesn't work from cron
[01:24] <RenatoSilva> then when you run bzr <command> it first checks if you're authenticated in the website, if so then it performs the actual operation through bzr+ssh
[01:25] <lifeless> RenatoSilva: unless the password is stored
[01:25] <micahg> hmm, maybe I shouldn't jump in in the middle, but that seems disasterous
[01:25] <lifeless> micahg: I agree completely.
[01:25] <micahg> I don't store passwords in cleartext anywhere if I can avoid it
[01:25] <lifeless> exactly.
[01:25] <micahg> I think I'll stay out of this though
[01:25] <lifeless> this is what alternate credentials are for
[01:25] <lifeless> oauth is a key based system
[01:25] <lifeless> as is ssh
[01:25] <lifeless> and gpg
[01:26] <lifeless> the specifics are different in each case
[01:26] <micahg> sorry, I'll back out of this discussion
[01:26] <RenatoSilva> lifeless: ok cron is a problem is this case
[01:26] <micahg> too much to do
[01:29] <RenatoSilva> lifeless: if you're not using cron and other automated stuff, then IMHO I'd preffer typing my password (only one door)
[01:29] <RenatoSilva> lifeless: I'm just saying my opinion, I'm not telling that lp should do this or that
[01:32] <lifeless> RenatoSilva: you can have the same password on your ssh keys as you do for lp, or no password at all if you trust that noone else has physical access to your machine
[01:33] <lifeless> RenatoSilva: I think it would be ok to *allow* the use of passphrases for bzr+ssh://bazaar.l.n/
[01:33] <lifeless> in fact, I filed a but about that some time back
[01:35] <kub1> is keyserver.ubuntu.com down??? Will you please check right now? Thx. I haven´t been able to access it ever - meaning for the past 18 hours.  I´d greatly appreciate data if it is working, so i´d know if the problem is with it, or at my end. Thanks, & awaiting your confirmation...
[01:35] <wgrant> lifeless: ubuntu-dev-tools developers were recently forbidden from allowing users to enter their Launchpad passwords into anything other than their web browser.
[01:35] <wgrant> kub1: It's not.
[01:35] <RenatoSilva> lifeless: I don't know how secure is a password/phrase encryption algorithm. I mean, wouldn't it be easy (or not that hard) if you get local access to the private key file, to decrypt it using brute force attack?
[01:36] <wgrant> kub1: As I suggested earlier, you're very probably behind a restrictive firewall.
[01:36] <wgrant> kub1: I believe TCP port 11371 is the one in question.
[01:36] <RenatoSilva> s/phrase/phase-based
[01:37] <RenatoSilva> phrase
[01:37] <wgrant> RenatoSilva: It's of course possible to brute-force the passphrase on a key if you have the key.
[01:37] <lifeless> wgrant: ah yes; its a social defense.
[01:37] <lifeless> wgrant: so that we can tell people 'never put your password in except on the website'
[01:37] <wgrant> lifeless: Yep.
[01:38] <wgrant> Not unreasonable.
[01:38] <lifeless> RenatoSilva: the way passphrases work is that they are transformed into a symmetric key and used to decrypt the stored ssh keys
[01:39] <lifeless> RenatoSilva: they are reasonably secure as long as they aren't machine guessable
[01:39] <RenatoSilva> wgrant: possible but easy, hard? if is possible and very easy, then why put a passphrase on the private key? I imagine it is not that easy, I just don't know _how much_ secure. I couldn't find docs in the web about it
[01:41] <RenatoSilva> lifeless: I need to read more to learn how this kind of encryption works and how much secure it is exactly...
[01:42] <wgrant> RenatoSilva: It's just boring old brute force. Difficulty revolves entirely around the complexity of your passphrase.
[01:43] <lifeless> and local physical access :P
[01:43] <wgrant> That too.
[01:44] <spm> a gun to the head is a very effective 'brute force' password cracker
[01:44] <lifeless> indeed
[01:45] <lifeless> it also breaks gpg etc ;P
[01:45] <spm> :-)
[01:45] <RenatoSilva> I have branch X merged with branch Y. I have branch Y locally, then I add a new revision and push to branch _X_, I thought this would lead to a branch conflict, but it didn't. It was like branch X was totally overwritten by branch Y...
[01:48] <RenatoSilva> wgrant: so that a good passphrase is as secure as e.g. RSA itself? I mean, not even all computers in the world could decrypt the private key by brute-force attack, just like it can't be done with RSA-encrypted messages.
[01:49] <wgrant> RenatoSilva: It all depends on the complexity of the passphrase.
[01:49] <spm> RenatoSilva: I think you're missing the point. if decryption is $$$, then I (the attacker) will find a more cost effective way to access your data. Hopefully comiserate with the value of your data. eg Hold a gun to your head. think *outside* the square.
[01:50] <lifeless> where is that xkcd when you need it
[01:50] <wgrant> lifeless: I was looking for that one :(
[01:51] <wgrant> http://xkcd.com/538
[01:51] <RenatoSilva> spm: I'm not reffering to other ways of getting access. Putting a shotgun in your head is _obviously_ a good way
[01:52] <spm> heh. was a common problem in my defence security days - crypto folk get so caught up in their magic, they forget that to someone who has root access on the servers on either end of the secured pipe, that said pipe is irrelevant.
[01:52] <spm> RenatoSilva: that you aren't referring to other ways is the problem. they're *ALL* related. you can't simply ignore those bits you don't care about.
[01:53] <RenatoSilva> spm: I can't?
[01:53] <RenatoSilva> spm: so if I want to specifically study brute-force attack
[01:53] <RenatoSilva> spm: forget it
[01:54] <spm> RenatoSilva: bit hard to forget it - been doing it security gumpf for waaaay too long ;-)
[01:54] <RenatoSilva> spm: I asked a technical specific question
[01:54] <RenatoSilva> spm: wgrant: so that a good passphrase is as secure as e.g. RSA itself? I mean, not even all computers in the world could decrypt the private key by brute-force attack, just like it can't be done with RSA-encrypted messages
[01:55] <spm> RenatoSilva: sure. and that's the problem. you're focusing on one specific part. you can't do that. ever. it's just one issue in thousands.
[01:55] <RenatoSilva> spm: it's a technical question, I'm not talking about security in general
[01:55] <wgrant> RenatoSilva: Your definition of 'good' is probably wrong.
[01:55] <RenatoSilva> spm: problem???
[01:55] <RenatoSilva> spm: ??????????
[01:55] <RenatoSilva> wgrant: I didn't even defined 'good'
[01:55] <RenatoSilva> define
[01:55] <wgrant> RenatoSilva: I know.
[01:55] <spm> RenatoSilva: you're trying to argue if XYZ is secure or not. irrelevant. I'd attack a weaker point.
[01:55] <wgrant> But any definition you could come up with is wrong.
[01:56] <RenatoSilva> spm: argue?
[01:56] <RenatoSilva> spm: it's just a question
[01:56] <spm> discuss/ whatever :-)
[01:56] <kub1> I am unable to access keyserver.ubuntu.com through my isp, & someone just checked & told me it is working cause they can access it.  My isp blocks most ports except for http.  Is there any way i can get the key through https?, and manually add it to the appropriate apt control file?
[01:56] <kub1> How do i access it via a proxy site?  which proxy site?
[01:57] <RenatoSilva> spm: I'm interested in how password-based encryption works. that's it
[01:58] <RenatoSilva> wgrant: ok, I'm just curious about _how much_ secure they are ^
[01:58] <lifeless> RenatoSilva: generally the passphrase is hashed, often with a salt, and the hash is the actual key
[01:58] <RenatoSilva> wgrant: understand how it works etc
[01:58] <wgrant> RenatoSilva: As secure or insecure as you want.
[01:58] <RenatoSilva> wgrant: by secure I mean technically
[01:58] <wgrant> For your average passphrase, incredibly insecure.
[01:58] <wgrant> RenatoSilva: So do I.
[01:58] <lifeless> depending on what you're encrypting that then becomes the source for a psuedo OTP
[01:58] <spm> RenatoSilva: "how much secure" is the wrong question :-) secure for what purpose. eg a MS-DOS PC can be secure enough to hold TopSecret information. see?
[02:00] <RenatoSilva> lifeless: oh hashes....
[02:04] <RenatoSilva> spm: I just mean understand all the theory behind it. Of course you can use very bad RSA key pair, and you can use a shortgun, social engineering etc. but that's not what I meant
[04:19] <nivekc1> hello, i have a problem with launchpad and would appreciate some assistance.. I created an account some time ago and i know the email address i used but do no know the password i used.. the email is no longer active so i cant log into it to reset my launchpad password.. the reason i want to login is to remove or edit my account since when i google my screen name my last name shows up in the first hit and i don't like that at all. If there is some way i c
[04:23] <mwhudson> nivekc1: you got cut off there
[04:24] <mwhudson> nivekc1: but i suggest you email<EMAIL_ADDRESS>with the details
[04:24] <nivekc1> mwhudson what do you mean by cutoff
[04:25] <nivekc1> my post was as follows: hello, i have a problem with launchpad and would appreciate some assistance.. I created an account some time ago and i know the email address i used but do no know the password i used.. the email is no longer active so i cant log into it to reset my launchpad password.. the reason i want to login is to remove or edit my account since when i google my screen name my last name shows up in the first hit and i don't like that at all.
[04:26] <mwhudson> nivekc1: irc limits the length of messages
[04:57] <poolie> spm, are you back?
[04:57] <spm> poolie: yup
[04:58] <poolie> spm, bug 253788 is bugging me
[04:58] <spm> pun intended?
[04:58] <poolie> it sounds like there's an option in the db for which there's no ui to turn it off
[04:58] <poolie> mm
[05:00] <poolie> are you able to see this in the db? could you in principle turn it off for ~bzr and ~bzr-core?
[05:00] <spm> poolie: could be, it's not like we have any shortage of those. /bitter_and_twisted. ping gmb directly perhaps? he may be able to let us know what to zot. ??
[05:00] <spm> poolie: no idea. would barely even hesitate to guess.
[05:01] <poolie> k, i'll open a question
[05:03] <spm> in principle tho. if such does exist, and we get a more or less ok that it's safe and sane from gmb, I have no problem toggling accordingly - so long as we get the sql to do so. I'm reluctant to just tweak stuff in the DB with zero idea of the consequences of doing so.
[05:03] <lifeless> spm: live life!
[05:03] <poolie> :)
[05:03] <spm> heh. something like that. :-)
[05:04] <wgrant> You could safely enough check that ~bzr-core's verbose_bugnotifications is true, though...
[05:04] <poolie> yeah, that would help
[05:04] <poolie> good idea
[05:05] <poolie> i filed https://answers.edge.launchpad.net/malone/+question/76825
[05:05] <poolie> i agree with waiting for guidance from the malone team but just having a peak as wgrant says would be nice
[05:06] <wgrant> Certainly, flicking the switch without confirmation from a Bugs person is probably not a good idea.
[05:07] <wgrant> We've not even had a Bugs person confirm that my suspicion was right, although it makes sense.
[05:10] <spm> poolie: select verbose_bugnotifications from person where name='bzr-core'; ==> 't'. no idea what that means tho.
[05:10] <poolie> k thanks
[05:10] <poolie> that seems to confirm william's theory
[05:11] <poolie> t meaning true
[05:11] <spm> fwiw, your settings is 'f' - so yeah true false sounds good
[05:11] <wgrant> Aha, so some part of Launchpad does make sense.
[05:11] <lifeless> you have no idea ;P
[05:11] <spm> wgrant: NO! it's lies!!!!
[05:44] <wgrant> spm: What's wrong with edge? It hasn't updated in like three days.
[05:44] <wgrant> Which is annoying lots of people, as a core Soyuz API is broken.
[05:44] <spm> wgrant: the updates have been stopped
[05:45] <wgrant> Is this for the same reason that staging's build broke around the same time, or something else?
[05:46] <spm> not sure. I was away all last week, so only have sketchy details at this stage
[05:46] <wgrant> Ah.
[05:47] <spm> aiui, we're waiting on a CP'd fix from last week to land in stable - then edge can be updated again
[05:49] <spm> ... which far as I can see, hasn't landed yet.
[05:58] <thumper> :(
[07:27] <micahg> wgrant: it seems that attachments can exists for longer than 24 hours after being deleted
[07:28] <wgrant> micahg: Disappointing. You might have to ask a Bugs person later.
[08:43] <noodles775> wgrant: were you able to view the screenshots linked from bug 386355 as well (I know it requires LP auth, but not sure what the restrictions there are... I was hoping it allows any LP user)
[08:45] <wgrant> noodles775: Waiting for it to load, but I'm guessing it's devpad? That requires one to be a Canonicalite.
[08:46] <wgrant> Ah, chinstrap. No access to that.
[08:46] <noodles775> wgrant: I specifically put it on chinstrap...
[08:46] <noodles775> thinking that would allow access... uploading 5 images to the bug generates lots of spam.
[08:46] <noodles775> Hmph.
[08:53] <mwhudson> noodles775: you can upload to rookery which is the same machine as people.ubuntu.com
[08:54] <noodles775> mwhudson: Ah, great thanks!
[09:02] <wgrant> "Optional notes about this access" seems wrong.
[09:04] <wgrant> And Person:+archivesubscriptions seems like it should have the PPA name linked, rather than an additional "(i) View" link.
[09:10] <noodles775> wgrant: do you mean the link from the email should go directly to the subscription?
[09:11] <noodles775> If so, it "would be difficult"... (the initial 'view' link is actually a submit button that posts a form, as it's creating the pwd....
[09:11] <wgrant> Ah, yes, I remember that now.
[09:12] <noodles775> but I agree, that would be better for the user (once we can collect stats some other way)
[09:13] <wgrant> In the new access email, is the registrant referring to the subscription creator, or the archive owner?
[09:16] <noodles775> wgrant: the subscription creator (ie. an individual)
[09:16] <noodles775> (I think... quickly checking)
[09:16] <noodles775> yes.
[09:17] <wgrant> Why would I want to find out more about them?
[09:17] <wgrant> It might be nice to tell me who they are, but I need to know the owner of the archive more.
[09:18] <noodles775> wgrant: in case you don't know who they are... click on their profile...
[09:18] <noodles775> hmmm.
[09:19] <wgrant> A large majority of P3As will be owned by teams, I suspect. Your emails seem to be tailored to the case that the owner is an individual.
[09:19] <noodles775> wgrant: I don't think so... it's just trying to tell you *who* was responsible for creating your subscription...
[09:20] <wgrant> noodles775: Why do I care about that?
[09:20] <wgrant> They're probably not the engineer behind the software.
[09:20] <noodles775> wgrant: because you may not be able to view the owning team (could be private) or the ppa page itself.
[09:21] <wgrant> Argh.
[09:21] <noodles775> (and yes, we do want to reconcile these ;) ).
[09:21] <noodles775> So the person who added you is someone that you can contact if you've got questions about it.
[09:21] <wgrant> Do you have to confirm the subscription before you can see the PPA page?
[09:22] <noodles775> wgrant: even then you won't be able to see the PPA page unless you are a member of the owning team (currently)
[09:22]  * wgrant cries.
[09:22]  * noodles775 put his arm around wgrant in support.
[09:22] <wgrant> Now I see why it is how it is.
[09:22] <wgrant> But... ew.
[09:22] <noodles775> As I said, we do want to reconcile these, but it's not trivial.
[09:24] <wgrant> So private teams (not PMTs!) can have PPAs?
[09:26] <noodles775> wgrant: I don't know, all I know is that archive subscriptions currently have nothing to do with access to the PPA page.
[09:26] <bigjools> PMs can have PPAs
[09:26] <bigjools> PMTs cannot
[09:26] <bigjools> P3As I mean
[09:27] <bigjools> acronym overload
[09:27] <wgrant> I would have thought the opposite would make more sense.
[09:27] <wgrant> So I can have a subscription to an archive in a person that doesn't exist?
[09:28] <bigjools> urgh I haven't woken up yet
[09:28] <bigjools> let me start again
[09:28] <bigjools> Private Teams can have Private PPAs
[09:29] <bigjools> Private Membership Teams cannot
[09:30] <wgrant> Right. Very odd, that is.
[09:30] <bigjools> why?
[09:30] <wgrant> It really doesn't seem like a good idea to send out those emails with no information about the actual archive.
[09:31] <james_w> hi all
[09:31] <bigjools> hi there james_w
[09:31] <noodles775> wgrant: the name of the archive is included (always was in the subject, but now also in the body as per your recommendation)
[09:31] <james_w> I'm still getting the OOPS from getPublishedSources, has edge been updated since we spoke on Friday?
[09:31] <wgrant> edge updates have been disabled, apparently :(
[09:32] <noodles775> james_w: nope :/
[09:32] <bigjools> no :(
[09:32] <james_w> damn
[09:32] <bigjools> it's a pain
[09:32] <wgrant> noodles775: Right, but that doesn't give me much information.
[09:32] <bigjools> I am going to get my fix cherrypicked
[09:32] <wgrant> noodles775: How do I verify who the owner is?
[09:32] <wgrant> I can't see that team.
[09:32] <noodles775> wgrant: no, but as much information as you can have about a private PPA right?
[09:33] <noodles775> (well, there are other public tid-bits I think, but nothing more relevant than the name)
[09:33] <wgrant> But I have a subscription. Why can't I see the archive?
[09:33] <noodles775> wgrant: you have a subscription (or access) to download software from that archive...
[09:34] <noodles775> not necessarily to see the builds etc. for that archive.
[09:34] <wgrant> But that is insane.
[09:35] <noodles775> Again, we do want to reconcile the two, but it's not straight-forward to do so (I've got a bug somewhere... one tick, then you can comment there :) ).
[09:38] <bigjools> wgrant: why is it insane?
[09:38] <noodles775> wgrant: bug 336779
[09:39] <wgrant> bigjools: What privileged information is there in a build log? As long as you're not leaking P3A buildd keys again...
[09:40] <bigjools> why, as someone who wants to download software from your repo, would I want to look at your PPA index page?
[09:40] <bigjools> it's a developer page
[09:40] <bigjools> not a user page
[09:40] <wgrant> So I can see who is giving me this software.
[09:40] <wgrant> And what is available.
[09:40] <bigjools> no
[09:41] <bigjools> you get to download what you're told you can download
[09:41] <wgrant> And I'm expected to add this invisible archive to my sources.list?
[09:41] <bigjools> depends how much you trust them
[09:42] <wgrant> Trust who?
[09:42] <wgrant> All I know is whoever created my subscription.
[09:43] <bigjools> it's an interesting point
[09:45] <wgrant> What happens if I am evil, buy a P3A, and give it a display name the same as some other very popular one.
[09:45] <wgrant> I then fill it with malware of the purest variety.
[09:45] <wgrant> I then invite lots of people.
[09:46] <wgrant> How do the users of the other one distinguish it from mine?
[09:47] <bigjools> I don't necessarily think the right answer is to let you see his ppa index page
[09:47] <wgrant> Right, it's possibly to see the team.
[09:47] <wgrant> But that seems even less possible.
[09:47] <bigjools> it might help you, as someone who is technical enough to understand it
[09:49] <wgrant> Where do I actually find my password? I have no access to a P3A, so I'm sort of guessing how things work.
[09:50] <bigjools> the subscription page shows you when you get access
[09:50]  * wgrant remembers and find the screenshots.
[09:50] <bigjools> I will give you access to soyuz team if you want
[09:50] <wgrant> That would be even better.
[09:52] <bigjools> the email is heading your way
[09:56] <wgrant> Hmm.
[09:58] <wgrant> noodles775: Um, the cancellation of access email links me to the PPA owner. Isn't that impossible?
[10:01] <noodles775> wgrant: not impossible, but might not be possible...
[10:01] <wgrant> noodles775: Well, yes.
[10:02] <noodles775> bigjools: ^^^ perhaps we should use cancelled_by there.
[10:03]  * noodles775 wonders if we should move this kind of conversation to lp-dev so lp stays a bit more friendly :)
[10:03] <bigjools> noodles775: yes probably
[10:03] <noodles775> k. I'll include it in this change.
[10:03] <bigjools> I was thinking of -dev as well
[10:03] <wgrant> noodles775: Oops, yes, we can do that now.
[11:10] <qball> hi I am getting this error when trying to import from git: http://launchpadlibrarian.net/28956734/gmpc-main-log.txt
[11:10]  * bigjools looks
[11:11] <bigjools> qball: I think you need to file a bug about that
[11:11] <mwhudson> ah, i know that one
[11:11] <bigjools> aha code people are still awake
[11:12] <mwhudson> barely
[11:12] <mwhudson> qball: i need to kill the import and restart it
[11:12] <qball> mwhudson: I clicked restart when I did this..
[11:12] <bigjools> mwhudson: is it a bug or something else CHR people need to be aware of?
[11:13] <huats> does anyone can help me to understand why something builds fine on my ppa and not on my local pbuilder ?
[11:13] <mwhudson> qball: a more comprehensive restart than that :)
[11:13] <qball> how do I do that
[11:14] <mwhudson> qball: you don't; i do
[11:14] <qball> owh ok
[11:14] <qball> sorry
[11:14] <bigjools> huats: not really a question for this channel, but paste me your output and I will take a look
[11:14]  * qball busy :(
[11:14] <mwhudson> bigjools: we should fix all branches that have this problem
[11:14] <mwhudson> qball: np, it's our bug!
[11:14]  * qball should not do multiple things
[11:14] <huats> bigjools: hum the output from my pbuilder ?
[11:14] <mwhudson> qball: i've restarted the import now
[11:14] <bigjools> huats: yes please
[11:14] <qball> mwhudson: thanks!
[11:14] <mwhudson> qball: should be ready in a few minutes
[11:14] <bigjools> mwhudson: is there a bug open?
[11:15] <mwhudson> qball: https://code.edge.launchpad.net/~vcs-imports/gmpc/main, you might want to subscribe
[11:15] <mwhudson> bigjools: no
[11:15] <huats> bigjools: in fact I'd like to figure out if it is related to sbuild vs pbuilder...
[11:15] <huats> bigjools: I am pasting the outputs
[11:15] <mwhudson> bigjools: i should spend a while with spm fixing this tomorrow
[11:16] <bigjools> mwhudson: ok.
[11:16]  * mwhudson writes this down on a piece of paper
[11:16] <bigjools> or better, file a bug ;)
[11:16] <mwhudson> not sure that's better, but it probably is
[11:21] <qball> another question, is it possible to (if code is in launchpad bzr natively) to "auto commit" translations?
[11:21] <qball> https://edge.launchpad.net/gpx-viewer I would like todo that for this project
[11:23] <mwhudson> i believe that's very much in progress
[11:23] <mwhudson> (but could be wrong)
[11:23] <qball> owh last question, I made tags (in gpx-viewer) for releases..  but they don't show up under code?
[11:24] <qball> what is the best (visible) way to mark release then?
[11:24] <huats> bigjools: http://paste.ubuntu.com/216813/
[11:24] <wgrant> huats: Run away.
[11:25] <wgrant> Very, very fast.
[11:25] <wgrant> This is maxima!
[11:25] <bigjools> heh :)
[11:25] <huats> so ?
[11:25] <huats> :)
[11:25] <wgrant> We've tried to get that to build with gcl for a year now.
[11:25] <huats> wgrant: ok I was not aware of that :)
[11:25] <huats> you should comment the bugs ;)
[11:25] <wgrant> I thought I had.
[11:25] <huats> may be I haven't seen your comment :)
[11:26] <wgrant> But you say you managed to get it to build locally?
[11:26] <bigjools> make[2]: *** [gcl-depends.mk] Segmentation fault
[11:26] <bigjools> nice!
[11:26] <huats> wgrant: actually not
[11:26] <wgrant> bigjools: Eeeehyes. It doesn't do it in Debian, and we can't work out what's wrong.
[11:26] <huats> wgrant: it builds fine on LP butnot on my pbuilder
[11:26] <bigjools> wgrant: but he said it built in a ppa ...
[11:26] <wgrant> Huh.
[11:26] <bigjools> huats: which series, karmic?
[11:26] <wgrant> It didn't build for me in sbuild a month or two ago.
[11:27] <huats> have a look at https://edge.launchpad.net/~christophe.sauthier/+archive/ppa
[11:27] <qball> mwhudson: imported correctly, thanks
[11:27] <mwhudson> qball: woo
[11:27] <bigjools> huats: what series are you building on with pbuilder?
[11:27] <huats> bigjools: I have tried both karmic and jaunty for the same result
[11:27] <bigjools> weird!
[11:28] <mwhudson> qball: now, will a subsequent import work?
[11:28] <mwhudson> that was the problem before
[11:28] <qball> let me try
[11:28] <mwhudson> qball: yes, hooray
[11:29] <qball> neat,t hanks
[11:30] <mwhudson> bigjools: i filed https://bugs.edge.launchpad.net/launchpad-code/+bug/398722, thanks for the prod
[11:31] <bigjools> mwhudson: don't mention it, thanks :)
[11:32] <flixr> hi, can I drop a VCS import somehow and reset it with a new one?
[11:32] <huats> wgrant: actually it says seg fault
[11:33] <huats> but when I run it step by step
[11:33] <huats> I get : http://paste.ubuntu.com/216816/
[11:33] <huats> don't know if it helps...
[11:34] <bigjools> flixr: you would need to file a question and someone can do that for you (the question verifies your identity)
[11:35] <flixr> bigjools, I already did that: https://answers.edge.launchpad.net/launchpad-code/+question/74491
[11:35] <flixr> but then it was suggested that I can do that by myself
[11:36] <bigjools> let me check
[11:36] <bigjools> mwhudson: is that possible? --^
[11:37] <wgrant> A user can request a new one, but not delete an old one.
[11:37] <mwhudson> right
[11:38] <flixr> right, that's what I though
[11:39] <bigjools> mwhudson: it's assigned to you, I'll just leave you with it then
[11:39] <mwhudson> flixr: i requested a new import: https://code.edge.launchpad.net/~vcs-imports/paparazzi/trunk
[11:39] <flixr> great, thanks a lot!
[11:40] <mwhudson> sorry this took so long to sort out
[11:41] <flixr> no worries
[11:41] <Nafallo> that has to be an application to control remote cameras!
[11:41] <Nafallo> like the small spy cameras...
[13:01] <fta2> while discussing with some upstream, we were wondering how accurate the popcon stats are. some say there's a factor 10, i really doubt it. could we use launchpad data to check that? i mean, using a well kwnow PPA, if popcon says 5000, and lp stats 50000, that would confirm the factor 10.
[13:55] <VK7HSE> is there a known time delay from when a source file is uploaded ? as when I run uscan the current source that I have just uploaded isn't picked up ?
[13:56] <bigjools> VK7HSE: yes, the scanner runs about every 5 minutes
[13:57] <VK7HSE> Ahh cool thanks...
[13:57]  * VK7HSE needs to be more patient !!!
[14:14] <huats> wgrant: i just did the merge for maxima (and build it on my ppa) : works great.... So I'll upload it like this in universe....
[15:58] <geser> bigjools: do you know if updating edge will be enabled soon again?
[15:58] <bigjools> geser: we're working on it right now
[15:58] <bigjools> there was a problem
[17:22] <micahg> ping sinzui
[17:22] <sinzui> hi micahg
[17:22] <micahg> hi sinzui
[17:22] <micahg> I was looking at bug 73890
[17:23] <micahg> is it still the intention to remove the whiteboards
[17:23] <sinzui> yes
[17:23] <micahg> will it be replaced with something more trackable?
[17:23] <sinzui> blueprints should have comments like bugs
[17:23] <micahg> with a master description as well?
[17:24] <sinzui> probably
[17:25] <micahg> ok, is there a master bug I can subscribe to?
[17:25]  * sinzui looks
[17:28] <sinzui> micahg: bug 49698
[17:29] <micahg> I have a comment about comments
[17:30] <micahg> There should be a way to lock a spec so only approved people can comment
[17:30] <micahg> otherwise it might get out of hand
[17:30] <micahg> would that be a new bug
[17:30] <micahg> or a comment on this one?
[17:31] <sinzui> micahg: I don't think we would implement that or accept someone's submission for that. We allow everyone to comment on bugs and questions
[17:31] <micahg> or and edit on the whiteboard
[17:31] <sinzui> micahg: There is a feature I want o implement that makes comments for trusted project members very visible
[17:31] <sinzui> s/for trusted/from trusted/
[17:33] <micahg> I guesss as long as tehre's a changelog or we're e-mailed a changelog of changes to the master description, it would be ok
[17:33] <micahg> I just don' tlike the idea of a spec being hijacked
[17:33] <sinzui> micahg: right. We need better activity reporting in launchpad
[17:34] <sinzui> micahg: That has yet to be seen as an issue. Ubuntu  is massive, and they have not reported a problem with this
[17:35] <micahg> yes, but I don't think the blueprints are as highly used as the bug tracker
[17:36] <sinzui> Bug are and that is not a problem with bugs
[17:36] <micahg> right, but bugs are very targetted in scope
[17:36] <sinzui> Nor is it a problem with answers. In general, we do design for features that may not ever be needed
[17:37] <micahg> occasionally we have people troll in bugs
[17:37] <micahg> but whatever, that's fine
[17:37] <micahg> you answered my original Q and I subscribed to the bug and blueprint
[17:37] <micahg> thanks sinzui
[18:55] <MT-> Is anyone aware of an issue where I get getting duplicate email?
[20:52] <SiDi> Hello. Does anyone know if there are irc commit bots that can watch changes on LP bzr branches ?
[20:58] <racecar56> anyone here?
[21:01] <maxb> racecar56: Just ask. If there's someone who's able to help, they'll answer,
[21:01] <racecar56> maxb: kk
[21:02] <racecar56> im going to make some modifications with kblocks (which is in kdegames), should i get the bzr version or the one you get with apt-get source? (i don't know if this is actually related to here...)
[21:02] <racecar56> the one from bzr is from launchpad but the apt-get source one is from the ubuntu repos
[21:03] <maxb> #launchpad is for Launchpad the service - for questions about projects that simply *use* Launchpad, use a project specific IRC channel.
[21:03] <racecar56> oh, then it's #ubuntu
[21:03] <racecar56> ill be there
[21:28] <smo_> hi, i created a ppa some days ago, yesterday i uploaded my packages, dput is ok.. but i still have the message , no packages in this ppa... and no dir in ppa.launchpad.net, our project is launchpad.net/ubukey, how can i know what s wrong please ?
[21:28] <smo_> oups, hi first ^^
[21:34] <maxb> smo_: You should have received email confirmation after uploading packages
[21:35] <maxb> usually within 5 minutes of uploading
[21:36] <maxb> If you receive no email at all the usual cause is either your uploaded .changes file was improperly signed, or you haven't bound the signing key to a launchpad account
[21:37] <maxb> either of those problems stops launchpad being able to tell who did the upload, so it has no way to tell you about the problem
[21:38] <aboSamoor> I want to translate reddit, how can I do that using the launchpad facilities ?
[22:39] <aboSamoor> I want to mirror git repository but I get this message "This branch may be out of date, as Launchpad was not able to access it 18 minutes ago. (Not a branch: "http://code.reddit.com/repo/reddit.git/".) Launchpad will try again in 5 hours. If you have fixed the problem, please ask Launchpad to try again. "
[22:47] <AnMaster> how do I change https://code.launchpad.net/~anmaster/cfunge/main to a hosted branch, my hosting went down forever.
[22:47] <AnMaster> I used mirrored before
[22:47] <AnMaster> same for all my other branches
[23:05] <mwhudson> aboSamoor: did you request the import at https://code.edge.launchpad.net/+code-imports/+new
[23:05] <mwhudson> ?
[23:06] <aboSamoor> mwhudson, no
[23:08] <mwhudson> aboSamoor: well you should have, i guess
[23:08] <mwhudson> AnMaster: ask a question please
[23:08] <AnMaster> mwhudson, in which project?
[23:08] <mwhudson> AnMaster: launchpad-code
[23:08] <AnMaster> thanks
[23:08] <aboSamoor> mwhudson, I think it is working, how should found that, it think it is not clear !
[23:09] <mwhudson> aboSamoor: it's not very clear no,
[23:11] <AnMaster> mwhudson, should I list the affected branches or?
[23:12] <mwhudson> that would be useful
[23:12] <AnMaster> right
[23:12] <AnMaster> mwhudson, anyway there should be a way for users to convert them. :)
[23:12] <mwhudson> yes
[23:12] <mwhudson> i think there's already a bug for this
[23:13] <AnMaster> mwhudson, https://answers.launchpad.net/launchpad-code/+question/76897
[23:14]  * mwhudson on the phone now sorry
[23:14] <qball> "no you hang up"
[23:15] <AnMaster> no rush
[23:39] <smo__> hi
[23:40] <smo__> i need help with ppa repository on launchpad please
[23:40] <wgrant> smo__: What is the problem that you're having?
[23:40] <smo__> first, do i must sign my packages or not ?
[23:41] <wgrant> smo__: You must sign anything that you upload, yes.
[23:41] <smo__> so it s maybe my problem
[23:41] <smo__> in my dput.cfg
[23:42] <smo__> i have allow_unsigned_uploads = 1
[23:42] <smo__> so if packages are not signed, is it normalthat i still have the message : This PPA does not contain any packages yet. Find more information about how to upload packages in the PPA help page
[23:42] <smo__> ?
[23:44] <wgrant> smo__: If you uploaded something and didn't get an email saying it was accepted, I would indeed expect your PPA to say it didn't have any packages.
[23:45] <smo__> what s the validating process?
[23:45] <wgrant> As maxb said earlier, you are not uploading to the right place, or you're not signing the package with a key that Launchpad knows about.
[23:45] <smo__> i created my key
[23:45] <smo__> it s on the lp servers
[23:45] <wgrant> Have you attached it to your Launchpad account?
[23:45] <smo__> yes
[23:46] <wgrant> And did you sign the package?
[23:46] <smo__> no ^^
[23:46] <smo__> i m searching howto do that
[23:46] <wgrant> There's your problem.
[23:46] <wgrant> debsign blah_source.changes
[23:46] <smo__> the whole process is very complicated (for me)
[23:47] <smo__> so i sign the .changes .dsc .deb ....
[23:47] <wgrant> You just debsign the .changes. It will do everything else for you.
[23:47] <smo__> nice
[23:48] <smo__> have a fast exemple? (or i ll search np..)
[23:48] <smo__> gpg --sign-key keyID
[23:49] <smo__> gpg --sign-key F378FBB4
[23:49] <smo__> for me , right ?
[23:49] <wgrant> I gave one above: 'debsign package_version_source.changes'
[23:49] <smo__> ok thx, i try
[23:50] <smo__> gpg: [stdin]: clearsign failed: la clé secrète n'est pas disponible
[23:50] <smo__> secret key not available
[23:50] <smo__> ...
[23:52] <wgrant> smo__: Your key obviously doesn't match the name in your package changelog. Give debsign your key id with '-kKEYID'
[23:52] <smo__> ok i try
[23:53] <smo__> Successfully signed dsc and changes files
[23:53] <smo__> ^^
[23:54] <wgrant> Now, try dputting!
[23:54] <smo__> it will overwrite ?
[23:54] <wgrant> There's nothing there, so it doesn't have to.
[23:55] <smo__> Already uploaded to ppa on ppa.launchpad.net
[23:55] <wgrant> Ah, that's a local thing. Give dput '-f'.
[23:56] <smo__> nice
[23:56] <smo__> thx a lot ^^
[23:56] <wgrant> np
[23:56] <smo__> works
[23:57] <wgrant> We'll see in three minutes if it actually did work.


[05:11] <StevenK> wgrant: https://code.launchpad.net/~stevenk/launchpad/switch-to-processor/+merge/187441
[05:12] <StevenK> Oh
[05:12] <StevenK> Right
[05:12] <wgrant> 31 minutes ahead of you there.
[05:13] <StevenK> Hm yeah.
[05:13] <StevenK> I either need to revert the getRestrictedFamilies() bits, or forward-port the changes from the later branch
[06:40] <StevenK> wgrant: I've reverted the getRestrictedFamilies bit
[10:42] <stub> Is the 3-clause BSD licence missing from LP deliberately?


[00:00] <udsbotu> uds-room-201: This session has ended.
[00:00] <dmj726> bilal: of course I'm actually in the opposite boat with a free as in libre but not gratis app
[00:00] <bilal> ha :)
[00:01] <dmj726> ZHackers: Volume One being cc-by-sa but costing 3 bucks
[00:54] <udsbotu> uds-room-201: 5 minutes left in this session!
[00:55] <udsbotu> uds-room-201: 4 minutes left in this session!
[00:56] <udsbotu> uds-room-201: 3 minutes left in this session!
[00:57] <udsbotu> uds-room-201: 2 minutes left in this session!
[00:58] <udsbotu> uds-room-201: 1 minute left in this session!
[00:59] <udsbotu> uds-room-201: This session has ended.
[17:02] <bilal> Anybody listening on IRC?
[17:06] <tgm4883> bilal, I'm connecting now
[17:07] <csmith> hi all, so currently you're looking over http://unity.ubuntu.com/ -> Get Involved?    I'm attached to this session just to learn where to start w/ Unity docs.
[17:09] <bilal> Yeah
[17:09] <bilal> http://unity.ubuntu.com/getinvolved/development/unity/
[17:10] <csmith> roger thanks.
[17:12] <daker> where can we file bugs for unity.ubuntu.com content ?
[17:13] <mhall119> https://launchpad.net/unity-website
[17:16] <csmith>  +1 on a screen shot image map or something comparable
[17:16] <csmith> jsut for newbies to learn the vocabulary
[17:21] <daker> ツ
[17:22] <csmith> we can hear okay :)
[17:40] <udsbotu> uds-room-201: 5 minutes left in this session!
[17:41] <udsbotu> uds-room-201: 4 minutes left in this session!
[17:42] <udsbotu> uds-room-201: 3 minutes left in this session!
[17:43] <udsbotu> uds-room-201: 2 minutes left in this session!
[17:44] <udsbotu> uds-room-201: 1 minute left in this session!
[17:45] <udsbotu> uds-room-201: This session has ended.
[18:05] <xnox> anyone participating remotely?
[18:05] <wookey_> I'm listening
[18:06] <wookey_> but don't have strong opinions as I know bugger all about upstart
[18:07] <wookey_> it'll still be busybox, not coreutils
[18:10] <wookey_> making core stuff busybox-0compatible is useful in other areas too
[18:11] <wookey_> i.e so we still use the same stuff in main system and initramfs
[18:16] <wookey_> pango is 1Mb
[18:16] <wookey_> well, 900K
[18:16] <wookey_> sorry no 300K.
[18:17] <wookey_> 360K. (I suck at reading the right thing)
[18:18] <xnox> ttf-fonts, freetype, and etc which is brought in by pango
[18:19] <wookey_> right
[18:19] <wookey_> libthai
[18:19]  * xnox tasty
[18:49] <udsbotu> uds-room-201: 5 minutes left in this session!
[18:50] <udsbotu> uds-room-201: 4 minutes left in this session!
[18:51] <udsbotu> uds-room-201: 3 minutes left in this session!
[18:52] <udsbotu> uds-room-201: 2 minutes left in this session!
[18:53] <udsbotu> uds-room-201: 1 minute left in this session!
[18:54] <udsbotu> uds-room-201: This session has ended.
[19:10] <nxvl> is the mic on?
[19:11] <nxvl> yes i can hear you now
[19:11] <nxvl> so, re-scheduled?
[19:12] <nxvl> ok, will keep an eye, thanks
[19:55] <udsbotu> uds-room-201: 5 minutes left in this session!
[19:56] <udsbotu> uds-room-201: 4 minutes left in this session!
[19:57] <udsbotu> uds-room-201: 2 minutes left in this session!
[19:58] <udsbotu> uds-room-201: 1 minute left in this session!
[19:59] <udsbotu> uds-room-201: This session has ended.
[22:12] <wookey_> this is metadata in the packages rather than in launchpad?
[22:13] <wookey_> Is there any real advantage to that?
[22:14] <wookey_> I find the PTS diff info and launchpad links to work well.
[22:14] <wookey_> I guess a page summarising all the PTS deltas might be interesting to see where to target effort
[22:19] <wookey_> hey that patch-tracker thing is nifty :-)
[22:20] <wookey_> OBS - Open Build System
[22:21] <wookey_> they dropped the 'suse' part
[22:21] <wookey_> It's supposed to be for everyone
[22:21] <wookey_> even though it is run by suse people
[22:30] <wookey_> making all these lists available online is good so that anyone who wants to help can. Is it there already?
[22:31] <tumbleweed> wookey_: http://qa.ubuntuwire.org/oldmerges/
[22:31] <geofft> wookey_: see the gmane link in the etherpad, also, for nhandler's list from last year
[22:31] <geofft> and discussion of it
[22:44] <wookey_> what about encouraging more ubuntu devs to become DDs and upload stuff themselves, or sponsor uploads?
[22:44] <xnox> https://launchpad.net/ubuntu/quantal/+uniquepackages
[22:44] <wookey_> There is quite a lot of useful stuff that should be uploaded...
[22:44] <micahg> http://qa.ubuntuwire.org/mdt/all.html#notinA
[22:45] <wookey_> glad some is language packs - 2300 packages is a lot!
[22:49] <wookey_> now should be the time of minimum delta, right?
[22:50] <xnox> wookey_: not really. Ubuntu will be droping lts->lts upgrade delta's; Yet debian is about to freeze and they will remove squeeze->wheezy upgrade code after wheeze release.
[22:50] <xnox> we are comming up to a time (from the day debian freezes) of rapid increase of the delta
[22:54] <wookey_> yes. OBS is good stuff. Somone needs to volunteer to help them out with debian stuff
[22:54] <xnox> OBS currently sequentially executes dpkg for every single package
[22:55] <xnox> instead of resolving all build-deps and doing it in one go
[22:55] <udsbotu> uds-room-201: 5 minutes left in this session!
[22:55] <wookey_> how....efficient
[22:56] <udsbotu> uds-room-201: 4 minutes left in this session!
[22:57] <udsbotu> uds-room-201: 3 minutes left in this session!
[22:58] <udsbotu> uds-room-201: 2 minutes left in this session!
[22:59] <udsbotu> uds-room-201: 1 minute left in this session!
[23:00] <udsbotu> uds-room-201: This session has ended.
[23:00] <wookey_> we should encourage that outlook
[23:01] <wookey_> Well I learned lots of useful new URLs today :-)
[23:02] <geofft> Same here!
[23:54] <udsbotu> uds-room-201: 5 minutes left in this session!
[23:55] <udsbotu> uds-room-201: 4 minutes left in this session!
[23:56] <udsbotu> uds-room-201: 3 minutes left in this session!
[23:57] <udsbotu> uds-room-201: 2 minutes left in this session!
[23:58] <udsbotu> uds-room-201: 1 minute left in this session!
[23:59] <udsbotu> uds-room-201: This session has ended.


[00:32] <MiC> Can anyone help me upgrade xubuntu 12 to 15.04 through Internet?
[00:46] <daykiller> hi
[00:47] <daykiller> Is there a way to back up xubuntu ?
[00:55] <bazhang> !sbackup | daykiller
[01:03] <daykiller> thank guys , it looks like it will do the job. :)
[02:20] <daykiller> how is everyone
[02:27] <holstein> daykiller: why dont you /join #xubuntu-offtopic and we can discuss our personal states of being there :)
[02:41] <namreeb> is there something special i need to do to enable vmware's "unity mode" with xubuntu/
[03:01] <xangua> unity mode¿ never heard of it namreeb
[03:01] <holstein> AFAIK, its like the integrated mode in virtualbox..
[03:02] <namreeb> yeah
[03:05] <bynarie> its like making the windows part of your desktop from the VM
[03:05] <namreeb> yeah
[03:05] <bynarie> pretty cool feature
[03:06] <bynarie> i keep getting this dam software updates screen - https://bynarie.com/update.png but there is NOTHING to install. i keep hitting install and it just goes back to the screen again
[03:07] <bynarie> of course i have also used update &&upgrade from shell
[03:07] <bynarie> but this bitch keeps poppin up getting on my last nerve
[03:07] <holstein> i close that, and open a terminal, and run "sudo apt-get update && sudo apt-get dist-upgrade" and address any errors
[03:07] <bynarie> anyone ever seen this before or know how to maybe remedy?
[03:07] <holstein> if i have 3rd party sources that are causing issues, for example
[03:07] <bynarie> holstein, done that several times
[03:08] <bynarie> ive cleaned, updated upgraded dist-upgraded autoremove clean etc etc
[03:08] <holstein> bynarie: cool.. its working here, so, i cant really tell whats up without looking first hand.. i would see if i could replicate the issue as another user
[03:08] <bynarie> i guess im not sure what could be causing the problem.. holstein when u say 3rd party, do you mean like PPAs ive added?
[03:09] <cfhowlett> bynarie, run it from terminal for more details: sudo apt-get update && sudo apt-get upgrade && sudo apt-get dist-upgrade
[03:09] <holstein> i would look for a bug, and join.. or stat a new ont
[03:09] <holstein> !bug
[03:09] <holstein> bynarie: yes.. PPA's are unsupported, so, they can cause issues like that
[03:09] <bynarie> oh ok... i wasnt aware they were technically unsupported
[03:09] <holstein> !ppa
[03:09] <bynarie> i guess i could go through and disable one by one and see if it changes
[03:10] <bynarie> !addppa
[03:10] <bynarie> ah, yea
[03:10] <holstein> disabling wont likely address it.. since, the packages will still be there from the sources
[03:10] <holstein> and, im not saying thats the issue.. just something to be aware of, if we are playing "one of these things is not like the other"..
[03:11] <bynarie> one thing to mention.. for a specific package i did put a version lock on it, do you think that could possibly be the culprit (hexchat specefically)
[03:11] <bynarie> thanks holstein and cfhowlett
[03:11] <cfhowlett> bynarie, best of luck.
[03:11] <bynarie> thanks much
[03:12] <bynarie> one more thing, anyone had any problems in the last couple of days with the official repos? specifically when using ipv6.. ?
[03:12] <holstein> no
[03:13] <bynarie> hm ok
[03:13] <bynarie> could be my provider messing up
[03:13] <holstein> im updating now, and they are working  as expected..
[03:13] <bynarie> ok thanks fellas
[03:20] <daykiller_> How long will there be support and updates for xubuntu ?
[03:20] <holstein> daykiller: depends on the version you have
[03:20] <holstein> !15.04
[03:20] <holstein> !14.04
[03:21] <holstein> the 14.04 LTS's repos are "up" for 5 years. with 3 years promised support for xubuntu.. otherwise, 9 months for the "normal" releases
[03:21] <cfhowlett> daykiller, YMMV but I've found that using LTS only has resulted in a whole lot less stress and install angst.
[03:23] <daykiller_> where can i find out what version i am using ?
[03:24] <cfhowlett> daykiller, open a terminal:  lsb_release -a
[03:26] <daykiller_> cfhowlett thanks . 15.04
[03:27] <holstein> so, you get updates for 9 months.. and the 15, in 15.04, is the year.. so, 2015.. and the 04 is the month.. april.. its the latest release..
[03:27] <cfhowlett> daykiller, right.  so you are not using LTS. 15.04 is supported for 9 months.  My suggestion: upgrade to 15.10 in a few months then 16.04 LTS.  After that, LTS only
[03:27] <cfhowlett> OR install 14.04 LTS now then move to 16.04
[03:33] <daykiller_> cfhowlett , i am download 14.04 . i am Going try on usb first then i like in install it .
[03:33] <cfhowlett> daykiller, sounds like a plan  :)
[03:35] <holstein> its quite similar..
[03:39] <daykiller_> Is there way to keep my setting ?
[03:40] <cfhowlett> daykiller, do not format your /home partition.  settings should stay.
[03:40] <cfhowlett> or restore from the backup you ARE going to do.
[03:42] <daykiller_> ok
[03:42] <daykiller_> thanks
[03:45] <bynarie> silly question but what is the package name of Software Updater?
[03:47] <bynarie> n/m
[07:17] <Guest29778> Hello? Anyone?
[07:18] <Guest29778> Anyone online?
[07:26] <Guest29778> Hello Ad1
[07:30] <Guest29778> dreamon?
[07:31] <Guest29778> Why can't I use the windows key to open applications menu?
[07:47] <nomic> cos its not linked
[07:51] <nomic> cos its not windows
[07:51] <nomic> http://ubuntuforums.org/showthread.php?t=1754221  Thread: Make Windows key open Applications Menu
[07:54] <Rrjj> Oh at last!
[08:28] <nomic> lol
[09:33] <Rrjj> Is it really necessary to install a firewall for Xubuntu?
[09:33] <Rrjj> I'm currently using the LTS version.
[09:46] <knome> Rrjj, http://docs.xubuntu.org/1504/C/guide-keeping-safe.html#firewalls
[09:48] <nick2> i
[09:48] <knome> you
[09:49] <nickmh2> heh you joined in a typo :-)
[09:50] <nickmh2> that was supposed to be for vi in the other window
[11:13] <Rrjj> Anyone using QuiteRSS?
[11:16] <bekks> Rrjj: What if?
[11:17] <Rrjj> Where does its data stored? From our main drive?
[11:18] <Rrjj> Like when I paste the rss feed from websites and it displays the articles from that site.
[11:18] <Rrjj> So are those data fetch from websites are store from local drive?
[11:20] <knome> Rrjj, most likely, but you would have to ask the developer for details
[11:21] <Rrjj> Fair enough. Thank you.
[11:25] <Rrjj> Why I can't play Facebook videos but videos on YouTUbe plays normally.
[11:25] <Rrjj> ?
[11:49] <Rrjj> ?
[11:54] <Rrjj> My splash screen messed up after installing nvidia driver
[11:59] <onlymrleo> Hello, I have some problems with ttf-mscorefonts-installer EULA on console, when I press <Tab> key or some direction key, the button OK is not selected.
[12:00] <knome> onlymrleo, i don't remember what the installer is like, but have you tried pressing the arrow keys (or in other words, how do you deduce it is tab that should work?)
[12:01] <knome> Rrjj, have you installed xubuntu-restricted-extras?
[12:03] <Rrjj> nope. I have not.
[12:03] <Rrjj> Should I install it?
[12:03] <knome> ok, try installing that and see if the facebook videos work after that
[12:03] <Rrjj> OKay.
[12:04] <Rrjj> Also, my splash screen was gone after install nvidia driver
[12:04] <knome> that's known, we can't fix problems in the proprietary drivers
[12:05] <knome> some users have reported there are workarounds for that, but i haven't tried them personally, so i don't know if they work
[12:05] <knome> or how they should work, or what the exact steps to achieve the workaround are
[12:05] <onlymrleo> knome, I'm trying to install wine, in some part of this process, the console show a message for agree EULA Terms
[12:06] <Rrjj> I see.. hmmm
[12:06] <Rrjj> The xubuntu splash screen is nicer than the big nvidia logo.
[12:06] <Rrjj> I'll try to search instead.
[12:08] <knome> onlymrleo, i understand what you are talking about, but i'm not sure if tab is supposed to work - have you tried something else?
[12:13] <onlymrleo> knome, yes, I tried pressing intro, tab, the arrow keys any key in my keyboard, but nothing works, not even Ctrl+C
[12:13] <onlymrleo> knome, I have the same problem accepting the terms of use for Popcorn-time
[12:18] <knome> onlymrleo, which xubuntu version?
[12:18] <knome> onlymrleo, do you have some very uncommon hardware?
[12:22] <onlymrleo> knome, I'm using xubuntu 14.04 fully updated and my hardware is normal, some old (processor AMD Athlon X2 64 bits, graphics NVIDIA GeForce 6 Series, USB ports 2.0, nothing unusual)
[12:35] <onlymrleo> knome, thanks, It's worked using the ubuntu software center to install this package.
[15:47] <xubuntu60i> hello
[16:07] <Cypi> Hy. I have a slight problem on a fresh Xubuntu 15.04 installation on a laptop: if I lock the screen (Ctrl+Alt+Del) and then close the lid, then when I try to unlock it, everything just freezes (I get the password input, but I cannot input anything). What could I do?
[16:07] <Cypi> Hi*
[16:10] <Cypi> Also, might be related or not: the tty are very...fuzzy. By that I mean that they blink around the screen very rapidly.
[17:49] <ibouvousaime> Ive tried to boot from an ISO file and I got "Error 60: File for drive emulation must be in one contiguous disk area".  as an error any idea to fix it ?
[18:24] <nomic> if thats a ripped cd (iso) then there is a serious problem
[18:24] <nomic> "from an iso file"
[18:24] <nomic> its obviously more complex than an iso "drive emulation"
[18:24] <nomic> you are booting this from a PC reboot
[18:24] <nomic> a cd or what
[18:24] <nomic> "from an iso file"
[18:25] <nomic> http://reboot.pro/topic/14285-error-60-contiguous-isos/
[18:25] <nomic> (let me google that for you)
[18:40] <kozukumi> hi all
[18:40] <kozukumi> anyone here running xubuntu 15.04 on a thinkpad t420s? or any thinkpad i guess.
[20:46] <daykiller> Can xubuntu get viruses ?
[20:52] <xangua> !virus
[20:56] <SonikkuAmerica> Wellllllllllllll... that's only because all 6 of us who use Linux all write for Linux
[20:56] <SonikkuAmerica> :)


[13:36] <gigix> hi everyone, shall I report dead links here ?
[13:47] <gigix> FIXME: https://help.ubuntu.com/community/PythonRecipes, link for Dive Into Python moved to http://www.diveintopython.net/
[13:59] <jbicha> gigix: that's part of the community help wiki, you're welcome to fix itself if you like
[13:59] <jbicha> just log in with your Launchpad/Ubuntu One account and click Edit
[14:03] <gigix> thanks jbicha, could you gimme a little more details, maybe a howto link or something ?
[14:09] <jbicha> gigix: do you have a Launchpad account or a Ubuntu One account?
[14:10] <jbicha> Click the Login to edit button at the top of that page
[14:13] <gigix> I am logging in with my launchpad
[14:28] <gigix> jbicha, done thanks for your help
[14:30] <jbicha> gigix: thanks for fixing it!


[01:09] <hads-test> Yay, laptop arrived.
[18:45] <mwhudson> morning
[18:58] <ibeardslee> morning
[18:58] <chilts> morning
[19:11] <olly> morning
[19:24] <ajmitch> morning
[22:29] <hads-test> morning
[23:46] <ibeardslee> hads-test: what are you testing?
[23:47] <hads-test> IRCCloud
[23:47] <hads-test> Fancy web based IRC client


[13:27] <BluesKaj> Hi all
[17:48] <mparillo> Nice review: https://www.zdnet.com/article/kubuntu-23-10-strikes-a-perfect-balance-of-form-and-function/
[22:11] <valorie> mparillo: very nice.
[22:11] <valorie> thanks for sharing


[00:00] <sleepee> oh..  and the kvm host runs CentOS7
[00:01] <sleepee> thing is, virt-install works just fine when creating a CentOS vm.  But with Ubuntu vm's, the --extra-args option seems to get ignored.
[00:02] <sleepee> and from what i can tell, i'm not the only one in this boat.
[00:02] <sleepee> https://unix.stackexchange.com/questions/428858/warning-did-not-find-console-ttys0-in-extra-args
[00:02] <sleepee> ^that guy seems to have a suspiciously similar problem as me.
[00:03] <rbasak> virt-install is not the preferred way to run Ubuntu VMs. It's long and convoluted to run an installer designed for bare metal in a VM. We left that method behind years ago.
[00:03] <sleepee> not sure if it's an Ubuntu issue, but it works fine with CentOS, so i figured I'd ask
[00:04] <rbasak> You should just be able to download and run an Ubuntu cloud image. On any distro.
[00:05] <rbasak> To bootstrap it with a ssh key so you can get in is a little tedious without tooling, but it's still honestly easier than messing with driving an installer.
[00:06] <rbasak> By all means use virt-install, and even fix it - it's a Free Software world after all :)
[00:06] <sleepee> makes sense.  does multipass suport other os'es like CentOS or is it just for Ubuntu?
[00:06] <rbasak> But you won't get much help from Ubuntu people with that method because it's not 2008 any more :)
[00:06] <sleepee> sorry if it's a dumb question. i've never heard of multipass before
[00:06] <rbasak> I'm not sure. multipass is distributed as a snap so I think that means it'll work anywhere snaps do.
[00:06] <sleepee> i'm just starting out in this world
[00:07] <rbasak> Looks like you should be able to build it from source without too much difficulty though.
[00:07] <sleepee> sorry.  i meant are there other images i can install other than ubuntu
[00:08] <sleepee> you know what.  im just going to go ahead and google multipass.  it seems like i need to do a bit of research on that.
[00:08] <sleepee> thanks!
[00:23] <rbasak> sleepee: nothing to apologise for. Sorry if my tone was a bit harsh.
[00:24] <sleepee> nah.  It's just that we've been doing it for a long time in Ubuntu - longer than everyone else even I think, and it makes life sooo much easier that doing things the old fashioned way seems extra backwards to us.
[00:24] <rbasak> sleepee: same with containers.
[00:25] <rbasak> sleepee: if I want to reproduce a bug report in Ubuntu, for example on 14.04, I type "lxc launch ubuntu:14.04" and can have a shell prompt about three seconds later, on something that looks exactly like a fully operational fresh Ubuntu 14.04 sytsem.
[00:26] <sleepee> Yeah.  It actually makes sense that Canonical put out a tool to make it easier/quicker to deploy Ubuntu vm's.  I know Ubuntu's huge in the cloud.
[00:27] <rbasak> Using virt-install seems as backwards to me as perhaps ordering bare metal hardware to get an instance seems to you :)
[00:27]  * sarnold quickly hides his CPU "product brief" tabs from rbasak
[00:29] <genii> heh
[00:33]  * teward hides sarnold's internet browser from everyone including sarnold.  :P
[06:02] <cpaelzer> mdeslaur: I would not mind, ahasenack was working (or planngin to work) on it but these weeks are rather busy
[06:03] <cpaelzer> mdeslaur: if you have pg-10.6 ready and it tests fine feel free to release it
[06:03] <cpaelzer> ahasenack: ^^
[06:03] <cpaelzer> ahasenack: for the ssh review - as discussed in standup I'll take a look at that
[08:52] <patz0r> hey all, does anyone have an updated guide for creating a raid1 mdadm array during OS installation?
[08:52] <patz0r> i'm trying to follow this but doesn't seem current
[08:52] <patz0r> https://help.ubuntu.com/lts/serverguide/advanced-installation.html.en
[09:05] <patz0r> i'm trying to create a raid1 mirror to install my OS on but i must be doing something wrong as it's not working
[09:05] <patz0r> i'm using the 18.04.1 live installer
[09:08] <patz0r> i'm going to try the alternate debian installer...
[11:03] <Slashman> I dunno if it's been reported but there is an issue with "http://fr.archive.ubuntu.com/ubuntu", I have several hash mismatch, switching to "http://de.archive.ubuntu.com/ubuntu" solves the issue
[11:03] <lotuspsychje> Slashman: report this in #ubuntu-mirrors please
[11:04] <Slashman> lotuspsychje: sure, I didn't know where to report this exactly, thanks
[11:08] <ahasenack> good morning
[11:12] <tomreyn> good morning
[11:13] <tomreyn> is it normal that proposed is enabled by default on daily server-live images?
[11:15] <ahasenack> I would think not, and would also ask about it
[11:16] <tomreyn> i don't think i did it manually, but i'll re-check just to be sure.
[11:18] <lotuspsychje> tomreyn: the #ubuntu-release guys might know that1
[11:20] <tomreyn> lotuspsychje: thanks. i think the server team (here) would know, but let me double-check first.
[11:26] <ahasenack> it's a funny situation, because even though it's called the server installer, we don't code it
[11:33] <tomreyn> so yes, proposed is enabled by default on the bionic server-live amd64 daily images. on both the Nov 12 (af59b87edf6ef02d230d94b87312c0255dead3bda399588cba44d83a0bda1180) and Nov 14 (403059a8fd19da81b1561970f859cf92aa74950ed91a809ae27d89cb4df3379e) one.
[11:33] <tomreyn> do i report a bug against subiquity, curtin, the one in ubuntu or 'upstream'? something else?
[11:36] <ahasenack> subiquity please
[11:36] <ahasenack> they can sort it out if it's curtin/cloud-init or subiquity
[11:36] <TJ-> tomreyn: sounds like that might be an artifact of the disco images
[11:36] <ahasenack> like that other one where only main was enabled
[11:36] <ahasenack> TJ-: is it the same for cloud images?
[11:36]  * ahasenack checks lxd
[11:37] <ahasenack> lxd image is fine, no proposed
[11:39] <ahasenack> tomreyn: do you have a url to the iso at hand?
[11:40] <ahasenack> ah, found it
[11:40] <ahasenack> n/m
[11:40] <tomreyn> ahasenack: http://cdimage.ubuntu.com/ubuntu-server/bionic/daily-live/current/bionic-live-server-amd64.iso - i downloaded from 2001:67c:1360:8001::1d
[11:51] <tomreyn> bug 1803338
[11:52] <ahasenack> tomreyn: I just installed in a vm from that iso (same hash), I don't see proposed in /etc/apt/sources.list
[11:52] <ahasenack> ah, it's in a sources.list.d
[11:53] <ahasenack> wtf
[11:57] <tomreyn> correct, it's in a sources.list.d/
[12:13] <mdeslaur> cpaelzer: thanks!
[12:15] <lotuspsychje> ahasenack: can you also add yourself affected to the bug?
[12:16] <ahasenack> lotuspsychje: the one from tomreyn?
[12:16] <lotuspsychje> yeah
[12:16] <lotuspsychje> the more, the better for attention/solving
[12:17] <lotuspsychje> ahasenack: tnx mate
[12:57] <samba35> i am using updated kernel of 18.04.1 do i require intel acs patch ? as i can't see patch for this version ?
[12:57] <samba35> is any one using pci-passthrough ?
[13:00] <ahasenack> what is that about? intel acs?
[13:02] <samba35> yes
[13:03] <tomreyn> https://wiki.archlinux.org/index.php/PCI_passthrough_via_OVMF#Bypassing_the_IOMMU_groups_(ACS_override_patch)
[13:05] <samba35> yes i check this page but i could not find patch here
[13:05] <tomreyn> i just posted this url to explain what you're inquiring about
[13:06] <samba35> ok
[13:08] <tomreyn> the patch seems to be https://lkml.org/lkml/2013/5/30/513
[13:09] <tomreyn> (it won't apply to current kernel versions without further modifications)
[13:10] <tomreyn> updated patch https://aur.archlinux.org/cgit/aur.git/tree/add-acs-overrides.patch?h=linux-vfio
[13:11] <samba35> let me check links
[13:13] <samba35> is patching kernel os version specific and distro specific ?
[13:14] <tomreyn> potentially both, most likely distro specific at least
[13:15] <samba35> ok
[13:34] <jamespage> coreycb: doing oslo bumps, poking at glance and keystone snapshots with a switch to py3 as the default
[13:35] <coreycb> jamespage: alrighty! good bye py2!
[13:36] <coreycb> jamespage: are we keeping the py2 packages around as an alternative?
[13:36] <jamespage> dunno
[13:36] <jamespage> coreycb: what do you think? maybe we should just drop them
[13:37] <jamespage> thus avoiding any confusion
[13:37] <coreycb> jamespage: i wouldn't mind maintaining just one version
[13:37] <coreycb> jamespage: let's drop them
[13:37] <jamespage> coreycb: agreed, it will cut down build times
[13:37] <jamespage> and reduce complexity
[13:37] <coreycb> jamespage: yes
[13:38] <jamespage> coreycb: that said we may want to either update openstack-pkg-tools to be py3 only friendly or switch everything over to pybuild
[13:39] <coreycb> jamespage: it should be py3-only friendly, no?
[13:40] <coreycb> jamespage: but it doesn't default to py3-only. i think it probably could now if we were to make the switch.
[13:41] <jamespage> coreycb: the pkgos-dh_* commands do have some --no-py2 type options
[13:41] <jamespage> we may just need to review those
[13:41] <coreycb> jamespage: ok
[13:47] <coreycb> jamespage: i think we can drop the shebang dep8 tests if we drop the py2 packages
[13:47] <coreycb> jamespage: or may be useful to keep around to test upgrades to py4 :)
[13:49] <jamespage> coreycb: I'd be tempted to - we can drop all of the alterantives stuff as well
[13:55] <coreycb> jamespage: ok great
[14:12] <jamespage> coreycb: we need a tweak to pkg-tools to not do the python{vers}- prefixing for binaries if only py2 or py3 is being built - testing that now
[14:37] <cpaelzer> ahasenack: chrony now completed its test
[14:37] <cpaelzer> I'll tag and upload
[14:42] <ahasenack> cpaelzer: +1
[14:54] <ahasenack> rbasak: I gather you are not reviewing karl's branch about at?
[14:55] <coreycb> jamespage: ok thanks
[14:55] <rbasak> ahasenack: not right now.
[15:02] <jamespage> coreycb: ok tweaked openstack-pkg-tools uploaded
[15:09] <coreycb> jamespage: great, looks good. i'm wondering if we need to do anything for upgrades.
[15:10] <coreycb> jamespage: i think we're good because postinst scripts should be removing alternatives
[15:10] <coreycb> jamespage: postrm that is
[15:15] <jamespage> coreycb: yeah
[15:15] <jamespage> coreycb: lol - http://paste.ubuntu.com/p/C2MckBXMHK/
[15:15] <jamespage> nice little quick fix
[15:15] <jamespage> coreycb: OK going for an upload run on the oslo's
[15:15] <jamespage> they install and test ok
[15:16] <coreycb> jamespage: ok! :-)
[15:35] <lucidguy> Ok, I have a static ubuntu mirror, been loading servers for days with no issues.  All of a sudden an identical server is failing to install mailutils, dependency issues.  How is that possible?
[15:46] <coreycb> jamespage: shall i start on clients or is their stein uca opening i should focus on?
[15:47] <jamespage> coreycb: please do - UCA is a bit blocked until we get quota increased sorted out
[15:47] <coreycb> jamespage: ok clients it is then
[15:53] <jamespage> coreycb: openstack-pkg-tools (>= 85ubuntu3~) gives you the right behaviour with regards to no alternatives if you pass --no-py2 to pkgos-dh_auto_install and pkgos-dh_auto_test
[15:53] <coreycb> jamespage: ok great, thanks
[17:30] <TheHonorable> Good afternoon everyone, I need some help with scripting. I'm not a coder, but I'm alright with linux commands. I have a task I'm constantly doing which is running this command: iptables -I INPUT -s -IPADDRESS- -j DROP
[17:31] <TheHonorable> I would like to setup something where I just punch in something like: permaban -IPADDRESS- and done, can you help me do this?
[17:41] <TJ-> TheHonorable: "  echo -e "#!/bin/sh\n[ -n \"$1\" ] && /sbin/iptables -I INPUT -s $1 -j DROP\n" | sudo dd of=/usr/local/bin/permaban ; sudo chmod +x /usr/local/bin/permaban  "
[17:43] <TheHonorable> response: bash: !/bin/sh\n[: event not found
[17:43] <TJ-> TheHonorable: ahhh, sorry, I was trying to make it easy. Let me pastebin it for you instead!
[17:43] <TheHonorable> thanks TJ- :)
[17:46] <TJ-> TheHonorable: try this https://paste.ubuntu.com/p/ZjZZySSjZh/
[17:54] <TheHonorable> sweet, it works man :D
[17:55] <TheHonorable> I added in a new line " iptables-save " so that I know for certain they're perm banned. but when I do this, it gives me a huge feedback of the entire iptables file. any way how to snuff that and make it quiet?
[17:56] <TJ-> TheHonorable: that's what iptables-save does; it writes to standard output. If you want to save to a file you redirect the I/O to the file. The filename should be one that, at boot-time, iptables-restore is going to read.
[17:57] <TJ-> TheHonorable: are you already using a package that saves/loads the rules using iptables-{save,restore} ?
[17:57] <TJ-> TheHonorable: e.g. iptables-persistent ?
[17:57] <TheHonorable> i just run iptables-save so that when I reboot I don't lose all my bans
[17:58] <TJ-> TheHonorable: right, but to load those bans, at boot-time you also have to have iptables-restore /path/to/file run.
[17:58] <lordcirth> TheHonorable, have you considered using a tool made for automatic bans, like fail2ban?
[17:58] <TheHonorable> O.o didn't know that
[17:58] <lordcirth> You can totally do it with iptables, but there are tools for this too
[17:58] <TheHonorable> I do use fail2ban, but the command to utilize it is just as long and frustrating as the one I use straight wth iptables
[18:01] <compdoc> I use fail2ban to ban people from trying to guess email passwords. I love that program
[18:01] <TheHonorable> I'm literally just watching a wireshark feed of icmp requests and banning anyone who shows up as red at abuseipdb.com :D
[18:01] <TJ-> TheHonorable: if you install "iptables-persistent" it installs a system service via "netfilters-persistent" that loads/saves rules automatically at boot/shutdown, and you can also do "netfilter-persistent save" to save rules at any time
[18:02] <TheHonorable> that I'm going to do right now
[18:02] <TheHonorable> so I don't have to do iptables-save anymore, just run netfilter-persistent save and I'm good?
[18:03] <TJ-> TheHonorable: not even that if the PC always shutdowns cleanly because it runs that at shutdown
[18:03] <TJ-> TheHonorable: but if you want to be sure, then it won't hurt to run the command
[18:04] <TJ-> TheHonorable: once installed see "man netfilter-persistent" for more info
[18:05] <TheHonorable> got it!! :D
[18:09] <TheHonorableKitt> still here, just under my correct username ;)
[19:04] <cpaelzer> ahasenack: and chrony migrated
[19:05] <ahasenack> yay
[20:40] <openfire> TheHonorableKitt: Why don't you just use ufw?
[20:41] <openfire> TheHonorableKitt: That's my first question. My second question is "why are you doing that stuff at all?"
[20:41] <TheHonorableKitt> why am I banning hackers?? :thinking:
[20:42] <openfire> Every ICMP request that comes your way isn't a hacker, but nice try at sarcasm. Sadly, your attempt is woefully misdirected.
[20:42] <openfire> You're acting like random internet scans are a threat to you, and expending energy to stop what quite literally will never stop.
[20:44] <TheHonorableKitt> well, mr openfire, I always cross check icmp requests with https://www.abuseipdb.com, and if they show up red, they get banned, because they're obviously hackers. Let me do me, thanks :) :*
[20:45] <openfire> Um, no, they're not. You could be banning random grandmothers who don't realize their routers have been exploited. You have no idea, because you think you know what you're doing, and won't listen to anyone who knows better.  Please don't tell me how to run my damn server. Thank you, bye
[20:47] <sdeziel> exploited routed owned by a grandmother or not is a bad thing IMHO
[20:48] <sdeziel> hackers really have no sense of ethic
[20:48] <openfire> That's not the point.
[20:49] <openfire> The point is to actually determine if something is a threat. A threat is an entity that has both the capability and intent to cause damage in some way. Random ping scans show neither capability nor intent, and thus are not evidence of a threat.
[20:49] <TheHonorableKitt> if a known hacker is pinging my server, there's only one reason why: they're trying to find potential vulnerabilities to exploit. Period. Thereofre, banned. Period. If you don't like it, fine, enjoy your hacked server my friend
[20:50] <openfire> Therefore, they don't warrant some newb script-kiddie excuse for a sysadmin to add iptables DROP rules every time one pops up, and then get snappy with people that try to educate him.
[20:50] <TheHonorableKitt> no one wants unasked for advice ;)
[20:51] <openfire> TheHonorableKitt: Pings aren't vulnerability scans, child.  Could someone explain to me why the images at this page: http://nutrigold.info/flipbooks/turnjs4/samples/basic/ return a 403 forbidden when attempted to be fetched by jquery?
[21:26] <cyberspectre> It is ubuntu server 16.04 lts
[21:27] <sarnold> the system administrator either configured their webserver, a proxy in front of the server, filesystem permissions, or apparmor permissions on the server, in such a way to return that error code when those assets are requested
[21:28] <lordcirth> cyberspectre, that link loads a blank white rectangle for me
[21:28] <cyberspectre> lordcirth, check developer console
[21:29] <lordcirth> cyberspectre, are you hosting this website and trying to fix it?
[21:31] <lordcirth> <script src="../../lib/turn.js"></script> - ../.. seems likely to cause permission problems, depending on your directory layout
[21:31] <lordcirth> No, I can request http://nutrigold.info/flipbooks/turnjs4/lib/turn.js
[21:32] <lordcirth> Perhaps you should ask on a channel more dedicated to webservers
[21:36] <cyberspectre> lordcirth, so it's not likely a conf file I need to edit that doesn't allow this out of the box?
[21:37] <lordcirth> cyberspectre, webservers are complex, and while I have worked with them, I am not an expert.  Consider asking on #httpd or the equivalent for your webserver.
[21:37] <cyberspectre> Understood, thank you lordcirth
[21:37] <teward> what's the actual question?
[21:37]  * teward knows a bit about webservers
[21:37] <teward> usually 403s give you log data that can help to glean the problem, on the web server side
[21:38] <teward> (I would not be using `../../` in your requests by the way, I'd use a root-relative full path such as `/flipbooks/turnjs4/lib/turn.js`)
[21:38] <sdeziel> cyberspectre: looks like the web host doesn't want any Referer header
[21:38] <teward> also ^ that could be the problem
[21:38] <sdeziel> cyberspectre: I could fetch 11.jpg after dropping that header using the dev tools in Firefox
[21:39] <sdeziel> yep, they all load fine when stripping the referer
[21:42] <cyberspectre> sdeziel, I actually don't know what a referrer header is
[21:42] <cyberspectre> is that in the html?
[21:42] <teward> no...
[21:42] <teward> it's a request header
[21:42] <teward> you should probably read up on how web headers work
[21:42] <sdeziel> cyberspectre: no, it's a request header set by browsers
[21:42] <teward> ^ this
[21:43] <cyberspectre> sdeziel, brief explanation of how you disabled it in devtools? That will put me on the right trac
[21:43] <cyberspectre> k
[21:44] <sarnold> what web server are you using? what configuration have you done to it? are you using something like mod_security? etc
[21:44] <sdeziel> cyberspectre: this was just to confirm the weird behavior but I opened the devtools, clicked on a .jpg 403 and selected edit and resend
[21:44] <sarnold> sdeziel: jpw
[21:44] <sarnold> sdeziel: how did you think to remove a referer header? :)
[21:44] <sdeziel> cyberspectre: then you get to edit the set of headers your browser would like to send so you need to drop the Referer: line
[21:45] <sdeziel> sarnold: I tried fetching just an image without the JS code
[21:47] <sdeziel> and got lucky
[21:48] <sarnold> sdeziel: I'll say, removing a standard header wouldn't have been anywhere near my top list of things to try :) hehe
[21:49] <sdeziel> some web host filter on the referer to avoid image download "abuse" by other sites
[21:49] <sdeziel> this one apparently forgot to treat itself differently than other sites ;)
[21:51] <sarnold> :D
[21:52] <cyberspectre> Okay this is beyond me for the moment
[21:52] <cyberspectre> But thank you
[21:55] <sdeziel> cyberspectre: if you share your web host config, I'm sure someone will be able to assist
[22:29] <coreycb> jamespage: all the clients except python-neutronclient (still working on) are at upper-constraints now for disco