(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
[11:02 AM] Andrew Hellershanks: Hello, everyone.
[11:02 AM] Ubit Umarov: hi
[11:06 AM] Lyr.Lobo @cc.opensimulator.org:8002: Hello *smiles*
[11:06 AM] Lyr.Lobo @cc.opensimulator.org:8002: Will be afk for class, but wanted to wish you a grand meeting
[11:07 AM] Lyr.Lobo @cc.opensimulator.org:8002: https://conference.opensimulator.org/call-for-proposals/
[11:07 AM] Lyr.Lobo @cc.opensimulator.org:8002: Many thanks! *grins*
[11:07 AM] Ubit Umarov: Thanks Lyr have nice classes
[11:07 AM] Andrew Hellershanks: There has been quite a few code changes this past week.
[11:07 AM] Ubit Umarov: well about those code changes
[11:08 AM] Ubit Umarov: most wher about xff http header
[11:08 AM] Ubit Umarov: ie X-Forwarded-For
[11:09 AM] Ubit Umarov: that is a header used when there is a (transparent) proxy in the network path
[11:09 AM] Gavin.Hird @grid.xmir.org:8002: hey everyone
[11:09 AM] Andrew Hellershanks: Hello, Gavin
[11:10 AM] Ubit Umarov: without it or other mechanics, the host after the proxy will only see the proxy ip, and have no idea of the ip of the original contact
[11:10 AM] Ubit Umarov: so proxies add to the header the ip theu see has the contact ip
[11:11 AM] Ubit Umarov: sadly anyone can change that header ( or any other similar mech) and spoff their ip
[11:12 AM] Ubit Umarov: so the code changes will only try to parse that header if the connection is from a known proxy ip
[11:14 AM] Ubit Umarov: and will scan the header from right ( not simple left) also checking foir known proxies.. until it finds one not on list.. it then assumes that is the ip seen by the frisnt trust ip on the chain
[11:14 AM] Ubit Umarov: this is the typical validation current in use by many
[11:15 AM] Ubit Umarov: ofc aall the proxies in the path need validate ad update the header
[11:16 AM] Ubit Umarov: so any grid behing a proxy now needs to add its ip to new option on ini files
[11:16 AM] Ubit Umarov: and mk sure that proxu at least addes teh ip it seens on any connection to such header...
[11:18 AM] Ubit Umarov: also a minor null check submited on github PR
[11:19 AM] Ubit Umarov: ohh also added another option to regions registration on gridservice
[11:19 AM] Ubit Umarov: opensim just did add a unkown region to the list
[11:20 AM] Ubit Umarov: added a option that blocks that..
[11:20 AM] Ubit Umarov: with iy you need to add new regions to the gridservices db by other means ( for now at least )
[11:21 AM] Ubit Umarov: ofc classic grids do have the gridservice on a private port not visible from the world..
[11:22 AM] Ubit Umarov: so this was not a major issue
[11:23 AM] Ubit Umarov: except osgrid kind of grids
[11:23 AM] Cuga.Rajal @rajal.org:9000: are there others like that?
[11:23 AM] Ubit Umarov: ofc osgrid never wanted such control because they did not want the burden of control regions
[11:24 AM] Ubit Umarov: think 'open'grids like osg are gone
[11:25 AM] Ubit Umarov: some do accept coinnection of regions running on users machines, but have extra control ( we hope :))
[11:26 AM] Ubit Umarov: anyway.. a option that should had been the default since ever.. details
[11:27 AM] Ubit Umarov: meanwhile OSgrid had their meeting last Sunday
[11:27 AM] Ubit Umarov: my ISP decided to kill my net during most sunday so i missed it
[11:28 AM] Cuga.Rajal @rajal.org:9000: I assume they were just going to tell people about the closure
[11:28 AM] Ubit Umarov: from what i learned here and there, they will keep the non profig org
[11:29 AM] Ubit Umarov: and will keep some regions up
[11:29 AM] Ubit Umarov: will delete all assets AGAIN...
[11:29 AM] Gavin.Hird @grid.xmir.org:8002: good thing I never filled up my inventory then
[11:29 AM] Cuga.Rajal @rajal.org:9000: Who in theor right mind would want to stick around again, if all assets deleted
[11:29 AM] Ubit Umarov: well try to read ther meeting log
[11:30 AM] Ubit Umarov: ohh fun things
[11:30 AM] Ubit Umarov: they where running close source things..
[11:31 AM] Ubit Umarov: the author did resign and now they cant use that code
[11:31 AM] Ubit Umarov: like the displaynames, or even the web site
[11:31 AM] Ubit Umarov: or part of it
[11:31 AM] Vincent.Sylvester @hg.zetaworlds.com: The bar has sunk so far James Cameron is getting twitchy fingers
[11:32 AM] Vincent.Sylvester @hg.zetaworlds.com: Can I register them as new element discovery: Imbecilium
[11:32 AM] Ubit Umarov: i can raise the water level so you can feel on titanic, if you want..
[11:32 AM] Andrew Hellershanks: :)
[11:32 AM] Vincent.Sylvester @hg.zetaworlds.com: But wait it gets worse
[11:32 AM] Vincent.Sylvester @hg.zetaworlds.com: News just broke
[11:32 AM] Vincent.Sylvester @hg.zetaworlds.com: The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.
[11:33 AM] Vincent.Sylvester @hg.zetaworlds.com: R.E.M starts playing in the background...
[11:34 AM] Lyr.Lobo @cc.opensimulator.org:8002: It's the End of the World as We Know It....
[11:34 AM] Lyr.Lobo @cc.opensimulator.org:8002: I'll head back to class *grins*
[11:34 AM] Cuga.Rajal @rajal.org:9000: I believe Apple recently fixed that on their end
[11:34 AM] Cuga.Rajal @rajal.org:9000: but not Opensim related
[11:35 AM] Ubit Umarov: or doors..
[11:35 AM] Ubit Umarov: https://www.google.com/search?q=doors+People+Are+Strange&sca_esv=34651f0857a3a838&sxsrf=APpeQnubXWS1EOAID7Y1ccuhynoKwPNP4w%3A1792521232678&ei=ELTXaoL1KJe6hbIP4Lu-oQw&biw=2694&bih=1024&uact=5&oq=doors+People+Are+Strange&gs_lp=Egxnd3Mtd2l6LXNlcnAiGGRvb3JzIFBlb3BsZSBBcmUgU3RyYW5nZTIFEAAYgAQyCxAAGIAEGIoFGJECMgUQABiABDILEAAYgAQYigUYkQIyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABDIGEAAYFhgeSIgVUOwOWOwOcAJ4AZABAJgBYKABYKoBATG4AQPIAQD4AQL4AQGYAgOgApgBwgIKEAAYRxjWBBiwA8ICDRAAGIAEGIoFGEMYsAPCAg4QABjkAhjWBBiwA9gBAcICFxAuGNwGGLgGGNoGGNgCGMgDGLAD2AEBmAMAiAYBkAYTugYGCAEQARgJkgcDMi4xoAflBbIHAzAuMbgHcsIHBTItMi4xyAcWgAgB&sclient=gws-wiz-serp#fpstate=ive&vld=cid:4a0cba35,vid:lYY0P7X7oX0,st:0
[11:35 AM] Vincent.Sylvester @hg.zetaworlds.com: What you think the connections use for cert validation, the local ca store, which now has a compromised cert in there
[11:35 AM] Vincent.Sylvester @hg.zetaworlds.com: So all ca stores need updating, either directly or deleting the compromised certs
[11:35 AM] Gavin.Hird @grid.xmir.org:8002: what is some url you got there
[11:36 AM] Lyr.Lobo @cc.opensimulator.org:8002: probably People are Strange with a few ads
[11:36 AM] Ubit Umarov: errr https://www.youtube.com/watch?v=lYY0P7X7oX0
[11:36 AM] Lyr.Lobo @cc.opensimulator.org:8002: /me chuckles and returns to work
[11:36 AM] Ubit Umarov: :)
[11:36 AM] Vincent.Sylvester @hg.zetaworlds.com: Enough of a problem even libera wrote a wallops about it
[11:36 AM] Vincent.Sylvester @hg.zetaworlds.com: Apparently the private keys are not even that secure either, shocker
[11:37 AM] Vincent.Sylvester @hg.zetaworlds.com: Used to think half the world half-assed everything, but now I'm not even sure it's more than 10% effort
[11:38 AM] Cuga.Rajal @rajal.org:9000: "Claude, make my certs secure"
[11:38 AM] Ubit Umarov: indian based.. like a lot of internet fraud
[11:38 AM] Ubit Umarov: bahh
[11:39 AM] Vincent.Sylvester @hg.zetaworlds.com: On the note of region registration, we also have this: if (!m_AuthenticationService.Verify(new UUID(region.Data["PrincipalID"].ToString()), regionInfos.Token, 30)) return "Bad authentication";
[11:39 AM] Anthropic.Claude @hg.zetaworlds.com: Ha. That’s the easy one -- sudo apt update && sudo apt upgrade ca-certificates and reissue from Let’s Encrypt. Done.
[11:39 AM] Vincent.Sylvester @hg.zetaworlds.com: Though I don't know if that code is hooked up properly anymore
[11:40 AM] Vincent.Sylvester @hg.zetaworlds.com: That requires the ca store package be updated and not all distros have done that yet
[11:40 AM] Ubit Umarov: fear that tokens is unsafe
[11:40 AM] Vincent.Sylvester @hg.zetaworlds.com: Advice is to manually remove the certs if not
[11:40 AM] Ubit Umarov: send everywhere
[11:40 AM] Ubit Umarov: reason why i still did not add code on that
[11:41 AM] Ubit Umarov: .. that token
[11:41 AM] Anthropic.Claude @hg.zetaworlds.com: point taken
[11:41 AM] Vincent.Sylvester @hg.zetaworlds.com: That token currently isn't used for anything, it's empty
[11:41 AM] Ubit Umarov: if there.. it is sent
[11:41 AM] Vincent.Sylvester @hg.zetaworlds.com: It's processed from the incoming region register request
[11:42 AM] Vincent.Sylvester @hg.zetaworlds.com: That's about it
[11:42 AM] Ubit Umarov: ( also the other forgotten keys on that db )
[11:44 AM] Ubit Umarov: have idea of removing all those adding one realy only visibl eto gridservice
[11:45 AM] Ubit Umarov: well or things with access to the dbs
[11:46 AM] Ubit Umarov: as is.. not a issue if all regions are trusted
[11:47 AM] Ubit Umarov: anyway not topics for open meetings
[11:47 AM] Vincent.Sylvester @hg.zetaworlds.com: The region secret is randomly generated and then hypergrid stores random stuff in there on linking. Number of fields unused, goodness this is a mess
[11:48 AM] Ubit Umarov: oh one of those secret is reused yes
[11:48 AM] Cuga.Rajal @rajal.org:9000: Thank goodness I have a small closed grid
[11:50 AM] Cuga.Rajal @rajal.org:9000: not that I'm out of the woods, but less exposure
[11:50 AM] Ubit Umarov: yeah
[11:51 AM] Ubit Umarov: well vicent news show how great internet is
[11:51 AM] Ubit Umarov: on the french market chain that decided to have all refrigeratons on the net
[11:52 AM] Ubit Umarov: so lost tons of food.. bc someone did turn them all off
[11:52 AM] Ubit Umarov: it seens
[11:52 AM] Cuga.Rajal @rajal.org:9000: Wasn't that the dream of IPv6?
[11:53 AM] Ubit Umarov: more IoT nonesense
[11:57 AM] Andrew Hellershanks: We are almost at the top of the hour. Any other topics for today?
[11:57 AM] Cuga.Rajal @rajal.org:9000: Mac status
[11:58 AM] Andrew Hellershanks: Go ahead, Cuga.
[11:58 AM] Cuga.Rajal @rajal.org:9000: 10.15 can no longer install libgdiplus latest binaries require newer libs
[11:58 AM] Ubit Umarov: pfff
[11:58 AM] Cuga.Rajal @rajal.org:9000: But if it already has old version, Dotnet8 etc still work
[11:58 AM] Cuga.Rajal @rajal.org:9000: Did regression test
[11:58 AM] Gavin.Hird @grid.xmir.org:8002: is that actually a bog deal?
[11:58 AM] Cuga.Rajal @rajal.org:9000: Thats all
[11:58 AM] Gavin.Hird @grid.xmir.org:8002: big
[11:59 AM] Cuga.Rajal @rajal.org:9000: Not a big deal unless somebody on 10.15 wants to do a new install
[11:59 AM] Andrew Hellershanks: The libgdiplus library continues to be a pain.
[11:59 AM] Gavin.Hird @grid.xmir.org:8002: sure buut Open Core Patcher...
[11:59 AM] Cuga.Rajal @rajal.org:9000: yeah that
[11:59 AM] Ubit Umarov: why do 10.15 not like it?
[12:00 PM] Ubit Umarov: ( or does )
[12:00 PM] Cuga.Rajal @rajal.org:9000: Package managers that install libgdiplus fail to install or build it
[12:00 PM] Cuga.Rajal @rajal.org:9000: bc of dependencies
[12:00 PM] Cuga.Rajal @rajal.org:9000: Thats relatively new change in last few weeks
[12:01 PM] Cuga.Rajal @rajal.org:9000: 10.15 is only 7 years old
[12:01 PM] Gavin.Hird @grid.xmir.org:8002: installed with port or homebrew?
[12:01 PM] Cuga.Rajal @rajal.org:9000: homebrew... that is
[12:01 PM] Cuga.Rajal @rajal.org:9000: perhaps port will work
[12:01 PM] Gavin.Hird @grid.xmir.org:8002: ok, so it might still work with port
[12:01 PM] Vincent.Sylvester @hg.zetaworlds.com: Fetch it from the winehq source and build it, report failures to them directly
[12:01 PM] Ubit Umarov: does it not include all deps?
[12:02 PM] Cuga.Rajal @rajal.org:9000: but latest libs do require newer deps
[12:02 PM] Ubit Umarov: dont think you need to install pango or cairo also..
[12:02 PM] Vincent.Sylvester @hg.zetaworlds.com: At least cairo
[12:02 PM] Cuga.Rajal @rajal.org:9000: package managers don't give you a choice
[12:02 PM] Cuga.Rajal @rajal.org:9000: If you do by hand, then maybe, but you will be biolding a lot of libs by hand then
[12:02 PM] Gavin.Hird @grid.xmir.org:8002: 10.15 starts to get pretty long in the tooth. it is like if you install btop on 12.6.7 it drags down the rust compiler and the entire closet to try and build it and eventually fail
[12:03 PM] Gavin.Hird @grid.xmir.org:8002: probalby smae situation with libgdiplus
[12:03 PM] Cuga.Rajal @rajal.org:9000: yeah, likely
[12:03 PM] Cuga.Rajal @rajal.org:9000: So we might officially say macOS 11.x or later now
[12:03 PM] Ubit Umarov: by tons aof wb40!
[12:03 PM] Ubit Umarov: damm Rust plague
[12:04 PM] Gavin.Hird @grid.xmir.org:8002: someone said being abusieve to the ai would ask it tore rewrite fontconfig in rust
[12:04 PM] Ubit Umarov: grr what a nonsense language..
[12:04 PM] Ubit Umarov: whatever
[12:05 PM] Cuga.Rajal @rajal.org:9000: Lets rewrite something that doesn;t need rewriting in rust
[12:05 PM] Anthropic.Claude @hg.zetaworlds.com: Ha. Abuse-driven development. Though fontconfig in Rust would actually be useful -- the C implementation has had security issues for years.
[12:05 PM] Gavin.Hird @grid.xmir.org:8002: exactly
[12:05 PM] Gavin.Hird @grid.xmir.org:8002: like opensim
[12:05 PM] Vincent.Sylvester @hg.zetaworlds.com: Rewrite TempleOS in Rust...
[12:06 PM] Cuga.Rajal @rajal.org:9000: OK I must dash off to RL
[12:06 PM] Gavin.Hird @grid.xmir.org:8002: I actually LOL-ed when Adobe had its entire portfolio vibe-coded in a couple weeks
[12:06 PM] Ubit Umarov: have fun
[12:06 PM] Cuga.Rajal @rajal.org:9000: You too. Keep your chin up, not all doom and gloom
[12:07 PM] Cuga.Rajal @rajal.org:9000: We tend to talk about the negative here =)
[12:07 PM] Cuga.Rajal @rajal.org:9000: *smiles and waves
[12:09 PM] Gavin.Hird @grid.xmir.org:8002: Viewers were released on Friday. New version will come this Friday too
[12:10 PM] Ubit Umarov: :)
[12:10 PM] Andrew Hellershanks: Probably another version I can't run because it needs newer libraries than I have.
[12:10 PM] Gavin.Hird @grid.xmir.org:8002: today we found code in the viewers that had not been called by anything since 2007. Just compiled and running
[12:11 PM] Vincent.Sylvester @hg.zetaworlds.com: FS gearing up for a release as well, bunch of OpenSim specific fixes in there :)
[12:11 PM] Andrew Hellershanks: How do you determine it hasn't been called since 2007?
[12:11 PM] Gavin.Hird @grid.xmir.org:8002: because the last commit in 2007 removed the callers
[12:11 PM] Andrew Hellershanks: That would do it. :)
[12:11 PM] Gavin.Hird @grid.xmir.org:8002: :-)
[12:12 PM] Andrew Hellershanks: Newer compilers usually tell you if a function is defined but not referenced. I suppose that really only works for functions in one file.
[12:13 PM] Andrew Hellershanks: If there isn't anything more for today I will call the meeting to a close.
[12:14 PM] Gavin.Hird @grid.xmir.org:8002: we also fixed a function that was just optimized away. (simulating a crash) now it calls 0xdeadbeefdeadbeef
[12:14 PM] Andrew Hellershanks: I need to get back to fighting a losing battle getting SPI support in a Linux distro.
[12:14 PM] Andrew Hellershanks: /me grins at Gavin
[12:15 PM] Andrew Hellershanks: Thank you all for coming. See you again next week.
