| 00:06.59 | DocScrutinizer | OT factoid about McGee: his sister is actually his stepsister in RL. Miss Bellisario. Nice family cronyism |
| 00:08.15 | DocScrutinizer | idly wonders if producer Mr Bellisario has some special appearances like Hitchcock |
| 00:22.13 | *** join/#harmattan FACEFOX (~facefox@pool-74-111-197-200.lsanca.fios.verizon.net) |
| 00:25.55 | *** join/#harmattan acidjunkie (~acidjunki@ne18108.nerionics.de) |
| 00:28.08 | *** join/#harmattan risca (~risca@206.220.196.50.in-addr.voinetworks.net) |
| 00:29.36 | beford | :| |
| 00:31.09 | beford | help itsnotabigtruck |
| 00:31.18 | beford | I forgot the lock code damn XD |
| 00:48.15 | DocScrutinizer | or you are using open mode which causes lockcode to go invalid |
| 00:49.28 | DocScrutinizer | actually it's allegedly causing CAL aka config mtd partition to become read-only, which somehow renders all lockcode access attempts to err out |
| 00:50.02 | *** join/#harmattan AndrewX192 (~andrew@002369d5e799.click-network.com) |
| 00:50.02 | *** join/#harmattan AndrewX192 (~andrew@unaffiliated/andrewx192) |
| 00:50.31 | beford | no .. I was changing it |
| 00:50.41 | beford | but I do not remember finishing to change it |
| 00:50.54 | beford | like I was on the 'change lock code' screen |
| 00:51.37 | beford | and went to do something else and it locked it self .. now the old password is not working, and I cant remember if I set something new :/ |
| 00:53.14 | beford | :| |
| 00:53.25 | beford | woah. I remembered it |
| 00:53.51 | beford | now I will need to get some memory pills or something. jesus. |
| 01:51.23 | *** join/#harmattan n9appscom (~n9appscom@85-23-13-196.bb.dnainternet.fi) |
| 01:52.06 | *** join/#harmattan diorahman (~diorahman@202.152.194.142) |
| 01:57.40 | itsnotabigtruck | beford: hey, still there? |
| 01:57.48 | itsnotabigtruck | oh, you got it sorted |
| 01:58.03 | itsnotabigtruck | DocScrutinizer: well, have you tested that read-only thing? |
| 01:58.40 | itsnotabigtruck | i believe i mentioned before, that the cal thing is second-hand info from rainisto - if you want to be sure, test it |
| 01:59.29 | itsnotabigtruck | the lock code is probably erroring out due to unrelated reasons, namely the whole omap security being deactivated thing |
| 02:02.10 | *** join/#harmattan delphi (~ns-team@93.87.57.125) |
| 02:05.14 | *** join/#harmattan diorahman_ (~diorahman@202.152.204.202) |
| 02:13.50 | *** join/#harmattan vLassi (~lassi@jarru.tontut.fi) |
| 02:17.26 | beford | hey ieatlint |
| 02:17.28 | beford | er |
| 02:17.29 | beford | itsnotabigtruck |
| 02:29.11 | itsnotabigtruck | beford: for reference if you forget it again, you reset it by zeroizing |
| 02:30.06 | itsnotabigtruck | hopefully not too many thieves will pick up on that, though the sort of people who steal phones are mostly morans anyway |
| 02:30.54 | itsnotabigtruck | petteri: i think your n9-apps.com entry for pinkit's missing a description |
| 02:33.28 | beford | itsnotabigtruck, like using WinFlasher? |
| 02:35.20 | itsnotabigtruck | beford: yeah |
| 02:35.29 | itsnotabigtruck | 'zeroize' is the word i used in my guide, because it's awesome |
| 02:35.46 | itsnotabigtruck | https://en.wikipedia.org/wiki/Zeroisation |
| 02:35.46 | beford | ah right, erase user data |
| 03:16.52 | beford | thanks itsnotabigtruck I'll try to not forget my lock code again anyway xD |
| 03:58.39 | *** join/#harmattan oberling (~oberling@brln-4d0c384f.pool.mediaWays.net) |
| 04:06.16 | *** join/#harmattan hiemanshu (~quassel@fedora/hiemanshu) |
| 04:22.47 | *** join/#harmattan vincent87 (~vincent87@95-26-103-123.broadband.corbina.ru) |
| 04:33.10 | *** join/#harmattan diorahman (~diorahman@202.152.205.238) |
| 05:07.10 | *** join/#harmattan sigmaorion (bebce48f@gateway/web/freenode/ip.190.188.228.143) |
| 05:07.45 | sigmaorion | hi there!! |
| 05:20.05 | *** join/#harmattan Natunen (nalle@213-186-240-19.bb.dnainternet.fi) |
| 05:37.33 | *** join/#harmattan dymaxion (~dymaxion@unaffiliated/dymaxion) |
| 05:55.39 | *** join/#harmattan niqt (~quassel@host234-219-dynamic.252-95-r.retail.telecomitalia.it) |
| 07:39.04 | *** join/#harmattan vLassi (~lassi@jarru.tontut.fi) |
| 07:53.11 | petteri | itsnotabigtruck: i think you are right. I'll add one :) |
| 08:51.31 | *** join/#harmattan NIN101 (~NIN@206.253.166.69) |
| 09:31.24 | *** join/#harmattan blueslee (~blueslee@ip-109-90-73-55.unitymediagroup.de) |
| 09:32.51 | *** join/#harmattan cvaldemar (~cvaldemar@1385167366.dhcp.dbnet.dk) |
| 09:34.56 | *** join/#harmattan rlinfati (~rlinfati@adsl-ull-37-140.42-151.net24.it) |
| 09:39.45 | blueslee | DocScrutinizer: ping |
| 09:41.45 | *** join/#harmattan M4rtinK (~M4rtinK@mail.melf.eu) |
| 09:51.27 | *** join/#harmattan trx (~ns-team@93.87.57.253) |
| 10:02.56 | auenf | honeycomb takes too many downloads to root |
| 10:03.36 | *** join/#harmattan Saviq_ (~Saviq@91.90.163.138) |
| 10:09.35 | *** join/#harmattan auenf (David@171.72.233.220.static.exetel.com.au) |
| 10:41.44 | *** join/#harmattan DocScrutinizer (~halley@openmoko/engineers/joerg) |
| 10:42.17 | *** join/#harmattan heymaster (~heymaster@78.61.212.188) |
| 11:39.33 | *** join/#harmattan djszapi (~lpapp@kde/developer/lpapp) |
| 11:55.45 | *** join/#harmattan diorahman (~diorahman@202.152.205.111) |
| 11:56.02 | diorahman | helllo!!!! |
| 11:56.13 | *** part/#harmattan djszapi (~lpapp@kde/developer/lpapp) |
| 11:59.25 | *** join/#harmattan Anssi138 (~ae@a88-113-110-44.elisa-laajakaista.fi) |
| 12:07.06 | macmaN | sup peeps |
| 12:07.26 | macmaN | how to turn off the massively annoying "switch internet connection on" prompt? |
| 12:07.39 | macmaN | i'd like to *never* see it again |
| 12:07.54 | macmaN | i have PSM forced on, doesnt help |
| 12:08.01 | macmaN | i have internet switch off, doesnt help |
| 12:08.35 | macmaN | internet apps should not be able to constantly annoy me with a full screen modal dialog, wtf |
| 12:24.13 | *** join/#harmattan djszapiN9 (~djszapiN9@81-197-25-147.elisa-mobile.fi) |
| 12:32.38 | Velmont | macmaN: Agree. I want it to always be 3G connected. |
| 12:33.02 | macmaN | hm |
| 12:33.05 | Velmont | I think I had that working before, -- but then I had to disconnect once,and now it's constantly nagging me for internet :-) |
| 12:33.08 | macmaN | isnt that possible? |
| 12:33.29 | Velmont | Yes, -- but not very obvious at least. I've made it once, but can't find out how to do it again. |
| 12:33.43 | macmaN | i think you have to go to Edit Networks |
| 12:33.47 | macmaN | and allow your 3G to be auto-used |
| 12:33.55 | macmaN | i think 3G is set to no-auto by default |
| 12:34.15 | Velmont | Ah, -- found it. |
| 12:34.16 | *** join/#harmattan sp3001 (~chatzilla@cs78207043.pp.htv.fi) |
| 12:35.19 | macmaN | well im living internet off. dont want to charge battery every 2 hours. |
| 12:35.43 | macmaN | but "no" definitely doesnt mean "no" to nokia developers |
| 12:36.04 | macmaN | it acts more like a horny boyfriend |
| 12:40.14 | *** part/#harmattan djszapiN9 (~djszapiN9@81-197-25-147.elisa-mobile.fi) |
| 12:42.02 | rZr | Sazpaimon: pong |
| 12:45.02 | *** join/#harmattan djszapiN9 (~djszapiN9@81-197-25-147.elisa-mobile.fi) |
| 12:45.54 | djszapiN9 | is there a ctrl+f-like search functionality in grob for finding a dedicated content on a webpage ? |
| 12:50.49 | rZr | not i am aware of |
| 12:55.02 | djszapiN9 | bad grob :p |
| 13:20.27 | *** join/#harmattan infobot (~infobot@rikers.org) |
| 13:20.27 | *** topic/#harmattan is A place for harmattan device and development discussions | Customers help customers on #N9, hurry and you're the senior member | Please stay on topic and no NDA stuff here | Developers : http://library.developer.nokia.com/ | http://wiki.meego.com/N950_landing_page | logs: http://mg.pov.lt/harmattan-irclog/ | ~aegis-no-thanks | LATEST ~update |
| 13:20.27 | *** mode/#harmattan [+v infobot] by ChanServ |
| 13:20.31 | *** join/#harmattan eman (~eman@202.4.232.249) |
| 13:21.51 | *** join/#harmattan damaltor (sbnc@h1889977.stratoserver.net) |
| 13:28.06 | *** join/#harmattan FACEFOX (~facefox@pool-74-111-197-200.lsanca.fios.verizon.net) |
| 13:32.29 | djszapiN9 | interesting why a link does not work for clicking in grob, but works fine if i type it out in the url bar. |
| 13:35.54 | *** join/#harmattan Sazpaimon (wat@138.199.65.8) |
| 14:04.12 | *** join/#harmattan diorahman_ (~diorahman@202.152.202.95) |
| 14:07.59 | *** join/#harmattan piggz (~piggz@host-92-29-15-193.as13285.net) |
| 14:10.31 | *** join/#harmattan blueslee (~blueslee@ip-109-90-73-55.unitymediagroup.de) |
| 14:12.57 | *** join/#harmattan GeneralAntilles (~ryan@Maemo/community/contributor/GeneralAntilles) |
| 14:14.14 | blueslee | can someone tell me if the openmode for n9/pr1.2 is full working. what are the (dis)advantages of openmode compared to inception |
| 14:16.20 | *** join/#harmattan arcean (~arcean@aaeo49.neoplus.adsl.tpnet.pl) |
| 14:16.32 | blueslee | openmode is running harmattan without aegis, right? who build the corresponding kernel? i will see a warning when booting and i can install packages from harmattan devel repo via apt-get not running into signature issues, right? |
| 14:18.03 | *** join/#harmattan divan (~divan@89.209.253.77) |
| 14:18.51 | blueslee | and what will happen when pr.1.3 arrives? do i need to reflash everything? |
| 14:20.02 | *** join/#harmattan kakashi__ (~kakashi_@nltk/kakashi) |
| 14:20.11 | *** join/#harmattan n9appscom (~n9appscom@85-23-13-196.bb.dnainternet.fi) |
| 14:23.09 | Tronic | blueslee: Depends on how Nokia responds. Quite possibly you can simply uninstall inception, do the upgrade and then reinstall (new version of) inception. |
| 14:24.25 | Tronic | The right thing for Nokia to do would be not to patch the inception hole at all or even provide such functionality by default in PR1.3. It is not like any content providers actually cared about Harmattan at this point. |
| 14:27.04 | blueslee | Tronic: okay, thats about inception. i am tending to enter the openmode but i am not sure about it, the kernel for pr1.2 is there for one week or so |
| 14:28.25 | blueslee | Tronic: its sounds simpler to install just the inception package but the repository/signature issue will stay or not? |
| 14:36.14 | *** part/#harmattan koe (ujhvbh@94.180.133.247) |
| 14:44.08 | hiemanshu | Tronic: not patching a hole in aegis that can be expoilted by malcious software? LOL, right |
| 14:44.23 | hiemanshu | malicious** |
| 14:44.51 | Tronic | hiemanshu: OMGWTF |
| 14:45.02 | Tronic | N900 *never* had any sort of platsec. |
| 14:45.06 | qronic | woohoo, seeing malicious software for hamattan would be so exciting. another new software for n9, wow! |
| 14:45.28 | Tronic | Exactly how many malware apps did you ever see for Maemo (inlc. Harmattan)? |
| 14:46.36 | Tronic | Linux/Maemo - security by platform obscurity. |
| 14:46.46 | *** part/#harmattan djszapiN9 (~djszapiN9@81-197-25-147.elisa-mobile.fi) |
| 14:48.05 | *** join/#harmattan Saviq_ (~Saviq@91.90.163.138) |
| 14:48.45 | hiemanshu | Tronic: they are going to do the obvious thing and fix the hole, and its not about how many, its about the idea of being able to do it that scares most people away |
| 14:49.40 | Tronic | Btw, is disk encryption already available for Harmattan? |
| 14:50.23 | Tronic | I would like to have some security for my personal information in case the phone is stolen or examined by border control or whatnot. |
| 14:51.51 | Tronic | hiemanshu: I am not exactly sure what you mean by people (content providers or users) but for starters, regular users mostly have no idea what platsec even is and most of those who do prefer not to have it. |
| 14:52.24 | *** join/#harmattan decibyte (~mmm@gateway/tor-sasl/decibyte) |
| 14:52.44 | Tronic | It does not protect the user against malware because it doesn't actually provide useful access control (e.g. against recording audio and phone calls and streaming them to the eavesdropper). |
| 14:53.04 | Tronic | The only reason why it is there is to "protect" some content providers who still think that DRM is a must-have. |
| 14:53.47 | hiemanshu | sure, but nokia isnt going to leave it open just like that |
| 14:54.04 | Tronic | You are probably right. |
| 14:54.54 | Tronic | However, Nokia has been firing Harmattan developers and moving them to new tasks (Windows Phone) at such rate that I must wonder how much maintenance they are going to be doing anymore. |
| 14:55.15 | jonni | Tronic: thats what lock code is for, so your data wont leak if your phone is stolen, as they need to do erase-user-data=secure in order to use it. |
| 14:56.55 | Tronic | jonni: Not quite as secure as I'd prefer (because it relies on the platform being secure) but maybe it is good enough. |
| 14:57.30 | jonni | it relies that you dont use 12345 as a lock code |
| 14:58.29 | Tronic | jonni: Considering that I don't give out the code to the TSA agent, I wonder whether he can or will bother to (a) use a government-enforced built-in backdoor, (b) circumvent the security system in some other way (e.g. read directly from the flash chip). |
| 15:00.45 | jonni | a no, b yes if some goverment has flash chip readers. If you want to secure some of your data, then you can make an application that uses aegisfs to secure it really. |
| 15:00.50 | Tronic | Fortunately I don't have secrets of such level stored on my device to warrant all the effort. |
| 15:01.40 | *** join/#harmattan javispedro (~javier@Maemo/community/contributor/javispedro) |
| 15:01.43 | Tronic | jonni: Why no to a? I would think that this is the most straight-forward way to go. |
| 15:02.05 | Tronic | Well, Harmattan is not officially sold in the US, so possibly they don't have that backdoor, but I wouldn't count on it. |
| 15:02.06 | jonni | there is no back door, we dont live in america |
| 15:05.05 | jonni | kernel is open source so you can hunt your backdoor in there. :) |
| 15:08.37 | Corsac | jonni: btw it's a bit sad the whole stuff is not encrypted, but eh :) |
| 15:09.17 | jonni | Corsac: well then bootup time to start the device would be 15+ minutes, and imho that is a bit slow :) |
| 15:12.34 | jonni | if you are really an internation spy agent, then there is no phone secure enough for you, and you should use some laptop that you encrypt the stuff yourself :) |
| 15:13.36 | Tronic | jonni: The backdoor could be in many other places than the kernel, and also we cannot really verify that the binaries provided by Nokia actually come from that source code. |
| 15:14.00 | Tronic | (have fun trying to replicate the exact same binary even when your source code is exactly the same) |
| 15:15.44 | Corsac | jonni: what are you talking about? |
| 15:15.56 | Tronic | But yes, you are right, cannot really trust such specialized hardware in any case, if the security really matters. |
| 15:16.02 | *** join/#harmattan kakashi___ (~kakashi_@80.174.136.87.dyn.user.ono.com) |
| 15:16.02 | *** join/#harmattan kakashi___ (~kakashi_@nltk/kakashi) |
| 15:16.26 | *** join/#harmattan liar (~liar@clnet-p09-185.ikbnet.co.at) |
| 15:16.32 | jonni | well you can compile the sources, and do diff to files, and you can also disassemble with ida pro to see that its really that source which matches. As only difference there is the timestamps. |
| 15:19.47 | Corsac | jonni: where exactly did you get the impression that encrypting stuff would result in 15m boot time? |
| 15:20.32 | Tronic | aegisfs does a full-fs verification on boot? |
| 15:20.32 | *** join/#harmattan NIN101 (~NIN@206.253.166.69) |
| 15:21.32 | *** join/#harmattan hardaker (~hardaker@mail.hardakers.net) |
| 15:24.35 | SpeedEvil | No. |
| 15:24.43 | SpeedEvil | It verifies signatures at load-time only |
| 15:37.29 | jonni | SpeedEvil: and you are sure that you are not mixing aegis refhaslist to aegisFS? :). Well anyways aegisFS use FUSE and its notoriously slow on each syscall. But if you are app developer make an app which stored data you want to be secure, you can always write your data to /home/user/private/ http://harmattan-dev.nokia. |
| 15:37.30 | jonni | com/docs/library/html/guide/html/Developer_Library_Developing_for_Harmattan_Harmattan_security_Security_guide_Using_Harmattan_security_features.html#Protecting_the_server.27s_data_by_storing_it_in_.2Fhome.2Fuser.2Fprivate |
| 15:40.52 | *** join/#harmattan NIN101 (~NIN@206.253.166.69) |
| 15:49.47 | *** join/#harmattan liar (~liar@clnet-p09-185.ikbnet.co.at) |
| 15:50.31 | *** join/#harmattan bradfo_ (~bfo@216.68.191.46) |
| 15:54.24 | *** join/#harmattan FACEFOX (~facefox@pool-74-111-197-200.lsanca.fios.verizon.net) |
| 15:58.16 | SpeedEvil | Ok - yes, I knew that - just different context |
| 16:12.28 | *** join/#harmattan franz2k (internet@adsl-99-155-149-60.dsl.klmzmi.sbcglobal.net) |
| 16:13.07 | *** part/#harmattan franz2k (internet@adsl-99-155-149-60.dsl.klmzmi.sbcglobal.net) |
| 16:26.54 | *** join/#harmattan jaywink (~jaywink@cs181137044.pp.htv.fi) |
| 16:29.17 | javispedro | grrrr https://meego.gitorious.org/meegotouch/meegotouch-applauncherd/blobs/master/src/launcherlib/daemon.cpp#line961 |
| 16:34.24 | itsnotabigtruck | Tronic Corsac: i don't know about a backdoor, but none of the secure storage facilities provided with the os are secure |
| 16:34.51 | itsnotabigtruck | maybe if you set up a password-based full-flash encryption arrangement |
| 16:36.04 | *** join/#harmattan admiral0 (973d87ad@gateway/web/freenode/ip.151.61.135.173) |
| 16:36.09 | admiral0 | hello |
| 16:36.39 | itsnotabigtruck | hey admiral0 |
| 16:36.51 | admiral0 | itsnotabigtruck: hey dude |
| 16:36.58 | admiral0 | how are you? |
| 16:37.21 | *** join/#harmattan piggz (~piggz@host-92-29-15-193.as13285.net) |
| 16:37.49 | itsnotabigtruck | alright |
| 16:38.11 | admiral0 | i need help with qml maps... |
| 16:38.49 | admiral0 | is there an easy way to populate with mapobjects with coordinates i supply from C++? |
| 16:39.20 | admiral0 | i mean without going through "My mind is full of fuck and Models" |
| 16:40.11 | admiral0 | as i saw i can't even implement landmarkmodel in C++ |
| 16:40.12 | admiral0 | ... |
| 16:41.07 | admiral0 | ~update |
| 16:41.08 | infobot | it has been said that update is http://www.developer.nokia.com/Community/Blogs/blog/n9-developer/2012/01/25/harmattan-1.2-beta-now-available-as-ocf-for-nokia-n950 |
| 16:41.31 | admiral0 | ~aegis-no-thanks |
| 16:41.31 | infobot | hmm... aegis-no-thanks is http://maemo.cloud-7.de/HARM/N9/openmode_kernel_PR1.1/ |
| 16:42.32 | M4rtinK | admiral0: no idea about the default maps, I'm using AGTL's PinchMap instead |
| 16:42.50 | M4rtinK | it's quite usable |
| 16:43.02 | *** join/#harmattan Free-MG (~test@p4FFE6D7B.dip.t-dialin.net) |
| 16:43.08 | admiral0 | AGTL? |
| 16:43.10 | admiral0 | link? |
| 16:43.49 | admiral0 | come on guys, it'll be a free app for all of you |
| 16:43.51 | admiral0 | :D |
| 16:44.24 | admiral0 | (yes, it will be _Free_ in the store) |
| 16:44.38 | M4rtinK | https://github.com/webhamster/advancedcaching/blob/master/files/advancedcaching/qml/PinchMap.qml |
| 16:44.56 | itsnotabigtruck | admiral0: publish it to appsformeego |
| 16:45.04 | itsnotabigtruck | in fact you should publish lps2 there too |
| 16:45.20 | M4rtinK | just gut out some of the AGTL/geocaching specific things and you are good to go |
| 16:45.30 | itsnotabigtruck | M4rtinK: why not use the stock maps? |
| 16:46.10 | admiral0 | oh, lps2... i have to work on that |
| 16:46.10 | admiral0 | it's quite reaady |
| 16:46.13 | Free-MG | how can i connect to WLAN / 3G from command line? |
| 16:46.20 | M4rtinK | I wan't a more low-level access to it |
| 16:47.33 | M4rtinK | didn't really study the default one though :) |
| 16:47.41 | admiral0 | Free-MG: explore dbus with qdbus |
| 16:47.51 | itsnotabigtruck | admiral0: make sure to run it by me before releasing so i can package-nazi it :p |
| 16:48.07 | admiral0 | itsnotabigtruck: package-nazi? |
| 16:48.18 | admiral0 | it should be in system bux |
| 16:48.19 | *** join/#harmattan adlan_ (~adlan@175.136.189.51) |
| 16:48.24 | admiral0 | ah, you are the human version of namcap in archlinux |
| 16:48.28 | admiral0 | i see |
| 16:48.29 | itsnotabigtruck | lol |
| 16:48.46 | itsnotabigtruck | hm, i guess namcap is like lintian on debian |
| 16:48.52 | admiral0 | yea |
| 16:49.00 | admiral0 | or perl_critic for perl |
| 16:50.02 | itsnotabigtruck | anyway, i'm just worried about things like the handling of the css patching/unpatching |
| 16:50.25 | itsnotabigtruck | need to make sure it won't asplode when users upgrade to 1.3 |
| 16:50.28 | admiral0 | i imagine those thingies with this face http://www.talyarkoni.org/blog/wp-content/uploads/2011/02/y_u_no_report.jpg |
| 16:50.57 | admiral0 | trololololo |
| 16:50.57 | admiral0 | :D |
| 16:51.12 | itsnotabigtruck | http://fc05.deviantart.net/fs71/f/2010/290/9/5/your_head_a_splode_by_yourheadasplodeplz-d30yz29.png |
| 16:51.34 | admiral0 | also i have quite an idea of replacing meteo widget with a secondary part for lpsmagic |
| 16:51.59 | admiral0 | who needs *current* weather? captain obvious? |
| 16:53.05 | admiral0 | i find this more useful and entertaining: http://www.dyrmdaily.com/wp-content/themes/lcp_blu/images/garys-weather-stone-dyrmdaily-pic-of-the-day-570x426.jpg |
| 16:56.22 | Tronic | Current weather is useful for not having to open the curtains and actually look outside, or even worse, opening the window to find out how warm it is. |
| 16:57.46 | admiral0 | use gary's forecasting stone you dummy |
| 17:02.38 | *** join/#harmattan niqt (~quassel@host135-106-dynamic.183-80-r.retail.telecomitalia.it) |
| 17:02.54 | *** join/#harmattan TNZ (~quassel@2a01:e35:2e0e:3290:2e0:81ff:fe57:73d7) |
| 17:03.37 | itsnotabigtruck | it would be nice if meecast would get with the program and use the right fonts |
| 17:03.41 | Corsac | itsnotabigtruck: I didn't really look at how the secure storage facilities worked, but what makes you say that? |
| 17:03.44 | itsnotabigtruck | typography matters, sheesh :p |
| 17:04.21 | itsnotabigtruck | Corsac: well, one of a zillion ways to get into your locked phone would be: |
| 17:04.55 | itsnotabigtruck | connect to the flash chips, put a payload in and get it to run during the boot sequence |
| 17:05.02 | itsnotabigtruck | disconnect and boot it up |
| 17:05.14 | itsnotabigtruck | and then use your payload to siphon off all the data |
| 17:05.57 | itsnotabigtruck | and that's just the naive way, there's no doubt simpler solutions |
| 17:06.01 | DocScrutinizer | meh, when you already have access to raw storage, then why not simply dump it to the in circuit debugger right away? |
| 17:06.19 | itsnotabigtruck | DocScrutinizer: i think the assumption is that the data is in aegisfs |
| 17:06.30 | itsnotabigtruck | so the phone has to be online and pwned to get the data |
| 17:06.38 | DocScrutinizer | meh |
| 17:06.41 | itsnotabigtruck | but if you can get a shell on the phone, you can get into any aegisfs, so yeah |
| 17:06.42 | DocScrutinizer | ok |
| 17:07.30 | DocScrutinizer | the concept of "secure" storage that'S not unlocked by a password you have to enter each boot is broken by design |
| 17:09.19 | DocScrutinizer | the aegisfs idea of "secure" storage is just the augmentation of credentials per process to storage and files |
| 17:09.47 | SpeedEvil | It has some usages, if your attacker does not have root, and if your system is secure. |
| 17:10.01 | SpeedEvil | And your attacker can't do advanced ICD |
| 17:10.16 | DocScrutinizer | exactly, and that's about the only usage I could figure |
| 17:11.26 | DocScrutinizer | however this would be a simple matter of proper setting of permissions and ACLs in a regular aegis-free linux^Wunix |
| 17:12.13 | DocScrutinizer | so aegis is 99% about reinventing the wheel, to cope with problems we wouldn'T have without aegis |
| 17:14.47 | SpeedEvil | I suspect it may have been more interesting if finished. |
| 17:15.06 | SpeedEvil | For example - protected storage appears under a known per-app directory |
| 17:15.18 | SpeedEvil | they just have to treat it like normal files |
| 17:28.08 | virtuald | <3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3 |
| 17:33.24 | *** join/#harmattan rlinfati (~rlinfati@adsl-ull-37-140.42-151.net24.it) |
| 17:33.28 | DocScrutinizer | s/99/100/ |
| 17:33.28 | *** join/#harmattan djszapiN9 (~djszapiN9@81-197-25-147.elisa-mobile.fi) |
| 17:34.11 | DocScrutinizer | there's not a single evidence or instance where we missed aegis on fremantle |
| 17:34.43 | DocScrutinizer | so all it implements is for made up scenarios invented by platsec |
| 17:35.46 | DocScrutinizer | even the core reasoning which got conceniently quoted in |
| 17:35.52 | DocScrutinizer | ~aegis |
| 17:35.52 | infobot | http://www.developer.nokia.com/Community/Wiki/Harmattan:Developer_Library/Developing_for_Harmattan/Harmattan_security/Security_guide , or "The purpose of this framework is: ... to make sure that the platform meets the requirements set by third party software that requires a safe execution environment.", or http://en.wikipedia.org/wiki/Trusted_Computing#Criticism, or http://en.qi-hardware.com/w/images/1/10/ME_382_LockedUpTechnology2.gif |
| 17:36.05 | DocScrutinizer | is never really happening |
| 17:36.32 | DocScrutinizer | as there simply is no such 3rd party app, and never will be |
| 17:38.53 | DocScrutinizer | nota bene "safe execution environment" simply means "user got no means to run gdb or strace or whatever against the process, to crack any secret CSS keys or whatever" |
| 17:41.45 | *** join/#harmattan vLassi_ (~lassi@jarru.tontut.fi) |
| 17:43.07 | DocScrutinizer | security as defined by aegis never been about *your* security, it's always been about security of apps *from* you messing with them |
| 17:45.10 | DocScrutinizer | it's really brilliant how TrustedComouting apologetics and proponents managed to suggest to joe average user that it's not like that |
| 17:45.47 | DocScrutinizer | even 75% of platsec folks themselves believe in that lie |
| 17:47.10 | Corsac | DocScrutinizer: well, some people /do/ care about trusted computing for other stuff than drm |
| 17:47.15 | Corsac | DocScrutinizer: including people at TCF |
| 17:47.17 | Corsac | TCG* |
| 17:48.00 | DocScrutinizer | TC by design is at least not needed for anything except DRM in a broader sense |
| 17:48.35 | DocScrutinizer | usually it's even useless for anything but exactly DRM and "ensuring safe environment" |
| 17:49.50 | DocScrutinizer | there have been working security solutions for all the supposed other usecases of TC since ages |
| 17:50.12 | DocScrutinizer | so it's fair to say TC got invented and is useful for DRM only |
| 17:51.29 | MohammadAG | why the fuck does the dorm table fuck the iPhone's and N950's screens |
| 17:52.38 | *** join/#harmattan gabriel9 (~gabriel9@83-71-246-188-bl.cable.dyn.broadband.blic.net) |
| 17:53.53 | DocScrutinizer | MohammadAG: ??? |
| 17:54.59 | MohammadAG | DocScrutinizer, double tapping the N950 doesn't work |
| 17:55.07 | MohammadAG | and the sliding gesture sometimes fails midway |
| 17:55.10 | DocScrutinizer | seen here as well |
| 17:55.10 | MohammadAG | till I ground the device |
| 17:55.34 | DocScrutinizer | I always thought it's caused by RF interference from nearby LCD screens, PSUs etc |
| 17:55.39 | MohammadAG | ah, removing the iPhone from the metallic charger case fixes it |
| 17:56.33 | javispedro | the problem is clearly that you are holding them wrong |
| 17:56.39 | DocScrutinizer | and yes, I also could fix the issue by "grounding" the device by holding it with my other hand |
| 17:56.48 | DocScrutinizer | javispedro: exactly ;-D |
| 17:57.39 | DocScrutinizer | the electric design of the touchpanel controler/sensor is meant for a "touching object" that is connected to controller's GND |
| 17:58.24 | DocScrutinizer | random arbitrary isolatedobjects tend to not work correctly when tuching the screen |
| 17:59.24 | itsnotabigtruck | imo aegis would have been useful if it implemented role based access control |
| 17:59.41 | itsnotabigtruck | but there's existing rbac systems for linux that could have been used instead of setting up this new system |
| 17:59.47 | itsnotabigtruck | ones that are more proven security-wise |
| 18:00.13 | itsnotabigtruck | in a functioning security arrangement, methods of elevating privilege are kept to an absolute minimum |
| 18:00.25 | SpeedEvil | The autogeneration of credentials is in principle interesting. |
| 18:00.27 | itsnotabigtruck | e.g. only a tiny number of security-aware binaries are made setuid root on a normal linux system |
| 18:00.41 | SpeedEvil | If combined with a fine enough grained permission architecture, and sane permission review. |
| 18:00.54 | itsnotabigtruck | so in order to be secure, aegis should have been based around restricting credentials from those already there |
| 18:01.00 | itsnotabigtruck | instead of granting credentials out of thin air |
| 18:01.03 | itsnotabigtruck | which is just asking for insecurity |
| 18:01.15 | itsnotabigtruck | almost everything on harmattan is a p/e hole of some sort |
| 18:01.27 | SpeedEvil | I do not ever want a calculator program to be able to access the internet. It can have a small sandbox for storage - and that's it. |
| 18:01.38 | itsnotabigtruck | the package based policy generation is a cool idea, that no other distribution has picked up afaik |
| 18:02.22 | itsnotabigtruck | it's why selinux is so difficult to deal with, because you have to deal with this gigantic monolithic policy that's not integrated with anything and isn't very complete |
| 18:03.15 | MohammadAG | android does it best tbh |
| 18:03.39 | MohammadAG | iOS comes next when talking about location |
| 18:03.46 | DocScrutinizer | itsnotabigtruck: well that are implementation details simple to solve with a subdir structure like seen in /etc/*.d/* |
| 18:03.54 | MohammadAG | Apple knowing your location doesn't count |
| 18:04.12 | MohammadAG | but they failed with contacts |
| 18:04.33 | MohammadAG | Path and Twitter were both copying contacts server side with no prompt |
| 18:04.46 | MohammadAG | and Apple approved them |
| 18:04.57 | itsnotabigtruck | nice |
| 18:05.00 | MohammadAG | Apple's approval process is there for a reason, protecting Apple, not the user |
| 18:05.21 | DocScrutinizer | itsnotabigtruck: sudo had same issues until they came up with /etc/sudoers.d/$randomfilename |
| 18:05.30 | itsnotabigtruck | with something like selinux, the contacts data could be labeled contacts_t and the data could only go where the policy says the data can go |
| 18:05.46 | itsnotabigtruck | aegis completely ignores protecting the filesystem |
| 18:06.05 | DocScrutinizer | that's why they need aegisfs |
| 18:06.08 | itsnotabigtruck | and on a system like linux that is all about the filesystem |
| 18:06.10 | itsnotabigtruck | that's a grave mistake |
| 18:06.19 | MohammadAG | itsnotabigtruck, with android you get a list of what the app does |
| 18:06.20 | itsnotabigtruck | but aegisfs is only used for few and small things |
| 18:06.23 | DocScrutinizer | like tracker ;-P |
| 18:06.36 | djszapiN9 | rotlf-ing at the many security experts from out of the thin air |
| 18:06.39 | MohammadAG | with iOS (for location and soon contacts), you get a prompt saying "App would like to use your location" |
| 18:06.51 | DocScrutinizer | tracker as well is about abandoning unix fs hierarchy |
| 18:07.01 | MohammadAG | djszapiN9, clearly Aegis's devs weren't one of them |
| 18:07.20 | javispedro | MohammadAG: IOS has the least granularity of all (same as webos) |
| 18:07.21 | MohammadAG | itsnotabigtruck, http://www.theverge.com/2012/2/7/2782947/path-ios-app-user-information-collected-privacy |
| 18:07.27 | MohammadAG | iOS* |
| 18:07.35 | MohammadAG | in any way |
| 18:07.42 | javispedro | basically the same security than on any average desktop |
| 18:07.44 | MohammadAG | this should be implemented API wise |
| 18:08.00 | MohammadAG | not with a lame security system |
| 18:08.10 | djszapiN9 | MohammadAG, android, meego etc replicated aegis in a way or other |
| 18:08.14 | javispedro | tbh |
| 18:08.18 | MohammadAG | if app uses location_get_current_location(), prompt the user, block the code |
| 18:08.29 | MohammadAG | djszapiN9, android replicated aegis? |
| 18:08.36 | djszapiN9 | so it does not seem too bad. |
| 18:08.36 | djszapiN9 | yes |
| 18:08.44 | javispedro | tbh I feel that if I had to "build" a security system with the same goals as aegis, I'd end up replicating aegis. |
| 18:09.03 | javispedro | wins most obvious sentence of the day award |
| 18:09.04 | MohammadAG | javispedro, aegis's roles are? |
| 18:09.04 | DocScrutinizer | meh, and aegis replicated what? UNIX of 1948? Dang I have to tweak my ignore list |
| 18:09.48 | MohammadAG | I don't see android having the same crap as Aegis |
| 18:09.51 | javispedro | MohammadAG: minimal intrusiveness to existing apps, for example |
| 18:10.01 | MohammadAG | NoLED allows you to light up the screen, control brightness etc |
| 18:10.11 | javispedro | hmpf |
| 18:10.14 | MohammadAG | it's in the android market, tokens aren't denied |
| 18:10.22 | javispedro | policy, policy... |
| 18:10.28 | MohammadAG | whereas Aegis decides lighting up the LED blows up the user |
| 18:10.29 | itsnotabigtruck | imo just replicating the capability setups in android, symbian, whatever isn't good enough |
| 18:10.35 | MohammadAG | well yeah, Nokia's Aegis policy |
| 18:10.44 | itsnotabigtruck | i want to control exactly has access to what data |
| 18:10.47 | itsnotabigtruck | that means filesystem labeling |
| 18:10.48 | MohammadAG | javispedro, Apple has a sandbox |
| 18:10.55 | MohammadAG | you can't access contacts outside the Apple API |
| 18:11.00 | javispedro | (and webos, fwiw) |
| 18:11.01 | MohammadAG | not without using private headers I guess |
| 18:11.06 | itsnotabigtruck | that means not what android/harmattan/iphone/symbian/anything else have |
| 18:11.17 | javispedro | but what use is a sandbox if dialing numbers is public API |
| 18:11.42 | MohammadAG | javispedro, well, on iOS, not modifying filesystem files |
| 18:11.45 | djszapiN9 | itsnotabigtruck, wrong, we did such a thing in meego |
| 18:11.57 | MohammadAG | javispedro, on iOS you can't dial number unless you use openURL or whatever the method's called |
| 18:12.03 | javispedro | so you can =) |
| 18:12.07 | MohammadAG | and that opens the UI |
| 18:12.13 | MohammadAG | there's no way the user can't know |
| 18:12.16 | itsnotabigtruck | djszapiN9: in meego = in mssf2? |
| 18:12.19 | itsnotabigtruck | i haven't looked into mssf2 |
| 18:12.27 | djszapiN9 | no |
| 18:12.27 | javispedro | MohammadAG: not modifying system files sounds to me like usual root vs user separation, not sandboxing. Not modifying other app's files might be. |
| 18:12.28 | itsnotabigtruck | mssf2 uses smack and smack has labeling, right? |
| 18:12.37 | djszapiN9 | meego is upstream linux |
| 18:12.38 | MohammadAG | javispedro, no, iOS is like Symbian |
| 18:12.46 | DocScrutinizer | ACL |
| 18:12.49 | MohammadAG | every app has its private folder to write in, it can't access anything outside that |
| 18:13.12 | MohammadAG | whether it's another app's folder, or the filesystem itself |
| 18:13.13 | MohammadAG | javispedro, ^ |
| 18:13.15 | DocScrutinizer | lrn2ACL |
| 18:13.19 | DocScrutinizer | !!! |
| 18:13.23 | javispedro | so, not modifying each other app's files. |
| 18:13.27 | itsnotabigtruck | DocScrutinizer: linux ACLs aren't exactly a winning strategy |
| 18:13.34 | javispedro | in webos, they do this by basically just chroot apps |
| 18:13.37 | javispedro | *chrooting |
| 18:13.47 | MohammadAG | javispedro, not sure how Apple does |
| 18:13.48 | MohammadAG | it |
| 18:13.55 | MohammadAG | but basically, jailbreaking is breaking the sandbox |
| 18:13.55 | itsnotabigtruck | i guess you could build a system based around linux ACLs but as it stands hardly anything is ACL-aware |
| 18:14.09 | MohammadAG | and running unsigned code |
| 18:14.18 | DocScrutinizer | ooh but everything is aegis aware, right? |
| 18:14.18 | MohammadAG | sandboxed apps are still sanboxed though |
| 18:14.53 | djszapiN9 | DocScrutinizer, architecture wise, yes. |
| 18:14.54 | DocScrutinizer | why would I need to sign my code? |
| 18:15.59 | DocScrutinizer | damn, where are those ignore lists in this client? |
| 18:16.58 | DocScrutinizer | hope this "*" fixed the issue |
| 18:17.13 | itsnotabigtruck | DocScrutinizer: well, since aegis doesn't have any kind of file permission scheme, things generally don't need to be aegis-aware |
| 18:17.30 | itsnotabigtruck | aegis doesn't have that problem because it doesn't address that part of security |
| 18:17.40 | itsnotabigtruck | well, it sort of does, through regular unix permissions, but that doesn't count |
| 18:19.05 | *** join/#harmattan piggz (~piggz@host-92-29-15-193.as13285.net) |
| 18:19.39 | djszapiN9 | is proud of the aegis team's work. |
| 18:19.49 | DocScrutinizer | apps in OVI store are under Nokia control, no need to sign them. If I don't install any app from outside OVI, I have no potentially dangerous apps on my system. When all apps are properly installed under root-only-writable perms, no rogue app can alter code of installed apps... I really fail to see the whole purpose, for anything except "3rd party software that needs a 'secure evironment' to run" - read things like MP3 players that don' |
| 18:19.50 | DocScrutinizer | t allow to copy or re-record your music you paid for |
| 18:20.57 | itsnotabigtruck | aegis would have been a lot more useful if a) it provided more comprehensive protection, b) everything was comprehensively audited, c) it was used for things beyond just keeping 3rd party apps from doing certain things |
| 18:21.40 | itsnotabigtruck | it's not a bad concept, but i don't think it turned out the way it could have |
| 18:21.51 | SpeedEvil | Iut was planned for a billion phones. |
| 18:22.07 | djszapiN9 | interesting that certain person(s) have the same lack of understanding as one year ago. |
| 18:23.17 | itsnotabigtruck | DocScrutinizer: well, *in theory* it allows ovi qa to assume that an app is only capable of doing things in a bounded set |
| 18:23.28 | itsnotabigtruck | so if the program doesn't declare it can send text messages, it can't send text messages |
| 18:23.38 | DocScrutinizer | so what? |
| 18:23.40 | itsnotabigtruck | which means there isn't a risk of a logic bomb that goes and sends premium text messages to russia or whatever |
| 18:23.53 | itsnotabigtruck | but really, this is a problem with auditing programs without the source code |
| 18:24.01 | DocScrutinizer | this is done by madde or whatever now, and could be done as well on ovi store evaluation |
| 18:24.12 | DocScrutinizer | no friggin need to sign anything |
| 18:24.20 | itsnotabigtruck | but i'd bet most commercial developers wouldn't be too happy with sending all teh source to ovi to have it audited and built on their side |
| 18:24.37 | itsnotabigtruck | but if you're dead serious about screening apps that's what would have been needed |
| 18:24.55 | djszapiN9 | *rotfl* |
| 18:25.13 | DocScrutinizer | itsnotabigtruck: that's about proper dropping of posix credentials |
| 18:25.27 | DocScrutinizer | not about an idiotic signing scheme |
| 18:25.31 | djszapiN9 | yes sure, commercial companies like rovio gives out their value for fun.... |
| 18:25.41 | itsnotabigtruck | DocScrutinizer: posix capabilities don't do anything about tasks like text messages |
| 18:25.50 | DocScrutinizer | oopsa capas, yes |
| 18:26.00 | javispedro | no |
| 18:26.02 | javispedro | I mean |
| 18:26.05 | javispedro | Doc is right |
| 18:26.23 | itsnotabigtruck | djszapiN9: well, i did just say that i doubt many commercial outfits would go along with it :p |
| 18:26.24 | javispedro | if by "posix credentials" you mean gids, etc. |
| 18:28.30 | javispedro | hrmpf, left the N950 GPS for a 10 minutes, in stable position, got ~500 points, bounding box area around 0.3 square frigging _KM_ |
| 18:28.42 | DocScrutinizer | well, maybe posix capas are not as finegrained as you'd wnat them to be. So what? Go improve / augment them. You don't need any signing of pkgs to do so |
| 18:29.07 | itsnotabigtruck | DocScrutinizer: the thing is that posix capabilities are exclusively about administrative tasks |
| 18:29.15 | SpeedEvil | javispedro: Extreme solutions happen. |
| 18:29.26 | djszapiN9 | why wouldn't you ? |
| 18:29.27 | itsnotabigtruck | if you're not root, you normally don't have any capabilities, and that's how it should be |
| 18:29.37 | itsnotabigtruck | it should be extremely rare for a user app to assert posix capabilities |
| 18:29.38 | javispedro | itsnotabigtruck: DocScrutinizer: that's why I said that Doc was right in saying "credentials", not capas |
| 18:29.56 | javispedro | itsnotabigtruck: DocScrutinizer: credentials include pid, uid, gids, etc. |
| 18:30.12 | DocScrutinizer | :nod: so I was right :-) |
| 18:30.28 | SpeedEvil | javispedro: http://wiki.maemo.org/N900_Hardware_GPS - 100m errors occurred about every 2000th sample on average. |
| 18:30.29 | djszapiN9 | no he was wrong |
| 18:30.44 | DocScrutinizer | we'd not need a restok and other shit to get there |
| 18:31.02 | javispedro | SpeedEvil: I am trying to deduce if sw is filtering or not |
| 18:31.03 | djszapiN9 | actually quite wrong |
| 18:31.09 | DocScrutinizer | and for sure we'd not need any hashes |
| 18:31.20 | DocScrutinizer | and signatures |
| 18:31.39 | djszapiN9 | please note that it is called capabilities.h, and not just for fun |
| 18:32.07 | *** join/#harmattan piggz (~piggz@host-92-29-15-193.as13285.net) |
| 18:32.33 | djszapiN9 | anyway, i so not see the point in this discussion |
| 18:32.53 | djszapiN9 | i do not see any fruit of it just randomly training minds. |
| 18:32.56 | *** join/#harmattan MohammadAG (~MohammadA@Maemo/community/contributor/MohammadAG) |
| 18:33.47 | djszapiN9 | feel free to send me the architecture from a-z for a full replacement. |
| 18:33.50 | itsnotabigtruck | yeah...the last thing we need is another endless back and forth about aegis |
| 18:33.56 | djszapiN9 | that would be fruitful. |
| 18:34.06 | itsnotabigtruck | djszapiN9: well, the problem isn't coming up with one, it's pulling it off |
| 18:34.24 | djszapiN9 | ... |
| 18:34.34 | itsnotabigtruck | since aegis is part of everything it's not like it's easy to swap something else in |
| 18:34.49 | djszapiN9 | nah, you do not listen |
| 18:35.07 | djszapiN9 | come up with an architecture which would be sensible. |
| 18:35.23 | djszapiN9 | and try to make it work on mer eg. |
| 18:36.38 | djszapiN9 | wr have heard enough guys saying "the big things" |
| 18:36.54 | djszapiN9 | i would like to see an architecture proposal. |
| 18:37.59 | djszapiN9 | swearing randomly is possible any architecture and implementation. |
| 18:38.24 | itsnotabigtruck | djszapiN9: well, one approach would be to use selinux, and implement something like aegis-install that produces policy at install time |
| 18:38.40 | djszapiN9 | about*, let us make it fruitful and get a proposal with an overthought architecture. |
| 18:38.42 | itsnotabigtruck | the problem is that selinux is complicated and that means defining policy is complicated |
| 18:38.54 | djszapiN9 | hahahaha |
| 18:39.03 | itsnotabigtruck | but the complication could be simplified from the pov of app packagers |
| 18:39.06 | javispedro | so, what does selinux have that aegis doesn't? |
| 18:39.10 | djszapiN9 | you seem to be a new guy in security altogether |
| 18:39.14 | itsnotabigtruck | javispedro: file labeling |
| 18:39.23 | itsnotabigtruck | roles |
| 18:39.28 | DocScrutinizer | credibility |
| 18:39.34 | itsnotabigtruck | right, it's well analyzed |
| 18:39.38 | djszapiN9 | javispedro, overcomplexity |
| 18:39.53 | itsnotabigtruck | djszapiN9: a lot of the complexity is due to the "reference policy" |
| 18:39.58 | itsnotabigtruck | this would be something different |
| 18:40.16 | djszapiN9 | turning into useless category just as linus torvalds and others wrote.... |
| 18:40.25 | javispedro | is yet to see a "security paradigm" that cannot be implemented by traditional users and groups |
| 18:40.42 | DocScrutinizer | exactly |
| 18:40.54 | DocScrutinizer | except DRM signing TC shit |
| 18:41.10 | djszapiN9 | javispedro, no security system is implemented luke that for obvious reasons |
| 18:41.21 | djszapiN9 | especially for mobile. |
| 18:41.44 | itsnotabigtruck | here's the problem: aegis could be the best shit ever, and you guys would still complain about it endlessly because it's not what you're used to (classic linux permissions) |
| 18:41.59 | DocScrutinizer | no |
| 18:42.00 | javispedro | itsnotabigtruck: no |
| 18:42.08 | *** join/#harmattan arcean_ (~arcean@aadb253.neoplus.adsl.tpnet.pl) |
| 18:42.16 | djszapiN9 | ...and this swearing i do not need about our job. |
| 18:42.19 | javispedro | If classic unix users and groups were to be used to lock me out of my device, I would still complain. |
| 18:42.23 | DocScrutinizer | I would ask why the fsck we *need* it first instance |
| 18:42.31 | djszapiN9 | good luck with swearing guys |
| 18:42.44 | djszapiN9 | and with the time wasting :d |
| 18:43.45 | itsnotabigtruck | DocScrutinizer: because classic linux users and groups are extremely difficult to use for anything more than simple access control |
| 18:43.45 | DocScrutinizer | as elaborated above there's nothing in aegis that can't be done (better) in any of the already known concepts like SElinux etc - except that deprivation of root rights from user |
| 18:43.55 | itsnotabigtruck | like keeping users separate, and only letting root change the system |
| 18:44.30 | itsnotabigtruck | but the goal here is to allow applications to be confined to precisely what the user is comfortable with allowing and absolutely no more |
| 18:44.40 | itsnotabigtruck | and to prevent applications from wreaking havok if they get exploited |
| 18:44.45 | itsnotabigtruck | for example, the web browser should be extremely confined |
| 18:44.48 | DocScrutinizer | sigh yeah, it never worked for the last 40 years, we needed aegis to finally come up with a solution to this age old problem :-P |
| 18:45.10 | *** join/#harmattan djszapi (~lpapp@kde/developer/lpapp) |
| 18:45.14 | djszapi | kernel.org was hacked recently. |
| 18:45.17 | djszapi | how does it work ? |
| 18:45.33 | itsnotabigtruck | DocScrutinizer: you're being facetious but - you're right, it did never work for the last 40 years |
| 18:45.45 | DocScrutinizer | BWAHAHA |
| 18:45.49 | javispedro | djszapi: one could argue that aegis has been cracked numerous times. I'm not counting implementation bugs towards the quality of the design of a security software. |
| 18:45.50 | itsnotabigtruck | it worked for what it's for, but it doesn't work for the level of sandboxing i'm describing |
| 18:45.58 | itsnotabigtruck | that's precisely why mandatory access control exists |
| 18:46.34 | djszapi | javispedro: you propose that once I get the root password I can do anything on your system ? |
| 18:46.40 | itsnotabigtruck | javispedro: the problem is that aegis has a security model that lends itself to being cracked, because almost everything that requires permissions has to be trusted to be perfectly secure |
| 18:46.48 | DocScrutinizer | we're spinning in circles here, I'm off |
| 18:46.51 | djszapi | seriously, kernel.org -> yay linux security \o/ |
| 18:48.03 | djszapi | very proven.... |
| 18:48.45 | itsnotabigtruck | djszapi: well...that was just due to not following good server security practices |
| 18:48.56 | djszapi | hahahaha |
| 18:49.27 | djszapi | surely, the kernel.org server was maintained by graduated students having zero knowledge. |
| 18:49.28 | javispedro | itsnotabigtruck: "almost everything that requires permissions has to be trusted to be perfectly secure" I fail to understand how any security system in the world could fix this. |
| 18:49.58 | djszapi | nothing can fix that, obviously. |
| 18:50.42 | itsnotabigtruck | javispedro: but the thing is that aegis centers around granting privileges to processes when they're launched from something unprivileged |
| 18:50.45 | djszapi | is amazed this time the kernel.org server maintainers made a crappy job according to itsnotabigtruck |
| 18:50.49 | itsnotabigtruck | it's like a system where half of everything is setuid root |
| 18:51.00 | djszapi | funny to hear everybody is getting crappy, quite funny really :) |
| 18:51.33 | itsnotabigtruck | djszapi: i think you're taking what i said the wrong way... |
| 18:51.37 | itsnotabigtruck | i mean obviously we all have the benefit of hindsight |
| 18:51.45 | itsnotabigtruck | if somebody got hacked, then they were doing something wrong |
| 18:51.50 | djszapi | no, you always call everybody crappy |
| 18:51.55 | djszapi | last time our job about the standard... |
| 18:51.59 | djszapi | I am quite tired of it... |
| 18:52.11 | Tronic | Seriously, everything of interest will get hacked, sooner or later. |
| 18:52.12 | itsnotabigtruck | sure, it's bloody hard to anticipate exactly what you could be doing wrong until something bad happens |
| 18:52.17 | itsnotabigtruck | i didn't say locking things down was easy |
| 18:52.28 | djszapi | but also the json guysmaking the official page etc, they did not know what they wrote about etc |
| 18:52.50 | itsnotabigtruck | djszapi: that isn't what i said, you keep twisting my words and turning everything into a black and white matter |
| 18:52.51 | djszapi | cannot take comments too seriously after "everybody is making wrong" :) |
| 18:52.54 | itsnotabigtruck | there is no such thing as black or white |
| 18:52.56 | Tronic | They have hacked aircraft carriers, FBI and plenty of other very safety-critical systems already. |
| 18:53.17 | dm8tbr | could you just stop trolling each other? KTX |
| 18:53.36 | Tronic | kernel.org is obviously a high-profile target and it is astonishing that they managed to hold it that far. |
| 18:54.01 | djszapi | exactly, especially with the Linux stuff |
| 18:54.01 | itsnotabigtruck | Tronic: safety critical usually = hesitant to apply security updates |
| 18:54.07 | itsnotabigtruck | and no one wants to touch it |
| 18:54.31 | djszapi | though, "hold it that far" is not quite right since it was not the first. |
| 18:54.35 | itsnotabigtruck | but yeah, if you want something to be secure, airgap it |
| 18:54.45 | itsnotabigtruck | or better yet, encase it in concrete and drop it in the ocean ;) |
| 18:55.06 | djszapi | quite frankly, I listen to this conversation, and I do not see outcome. |
| 18:55.10 | djszapi | no any fruit. |
| 18:55.43 | djszapi | random ideas around without anybody making an architecture documentation and at least draft. |
| 18:56.00 | djszapi | so that we could study the "big things". |
| 19:00.01 | *** join/#harmattan Anssi138 (~ae@a88-113-110-44.elisa-laajakaista.fi) |
| 19:00.22 | djszapi | it is not accident nobody used ACL out of the known linux mobile distributions. |
| 19:00.58 | djszapi | I know, Google, Nokia, Intel etc sucked as the usual saying here... :) |
| 19:01.42 | itsnotabigtruck | djszapi: well, it's not like anyone sets out to make something that doesn't work...everybody's talking about everything with the benefit of hindsight |
| 19:02.03 | djszapi | benefit of what ? |
| 19:02.13 | itsnotabigtruck | it's not like any of these things that "sucked" (your turn of phrase, not mine) were built by idiots |
| 19:02.32 | djszapi | you did not listen to others |
| 19:02.37 | djszapi | Doc* said many times we were idiots |
| 19:02.41 | itsnotabigtruck | hindsight, as in, looking back at how something turned out, with the lessons learned since |
| 19:02.44 | djszapi | retarded idiots or something like that |
| 19:02.48 | djszapi | it is /not/ my turn |
| 19:03.13 | djszapi | I have been told word by word that way. |
| 19:03.15 | djszapi | many times. |
| 19:03.23 | *** join/#harmattan hhartz (~hhartz@241.149.34.95.customer.cdi.no) |
| 19:03.26 | itsnotabigtruck | how something is intended to be, and how it ends up being, are very different things, and it's easy to criticize after the fact |
| 19:03.48 | djszapi | I see zero technical critizising. |
| 19:03.53 | itsnotabigtruck | but criticism is still important since that's how you avoid the same problems again |
| 19:04.01 | djszapi | since I have not still received a better architecture idea |
| 19:04.03 | djszapi | or implementation. |
| 19:04.19 | itsnotabigtruck | well, i made my fair share of technical criticisms just now |
| 19:04.23 | itsnotabigtruck | well, 15 mins ago |
| 19:04.33 | djszapi | where is the architecture documentation ? |
| 19:04.35 | djszapi | from A-Z ? |
| 19:05.02 | *** mode/#harmattan [+o dm8tbr] by ChanServ |
| 19:05.04 | itsnotabigtruck | that's a rather ridiculous demand |
| 19:05.12 | itsnotabigtruck | love aegis, or write a zillion page manual about an alternative? |
| 19:05.25 | djszapi | itsnotabigtruck: no, you can copy the same architecture and fix up parts. |
| 19:05.27 | *** mode/#harmattan [+q djszapi!*@*] by dm8tbr |
| 19:05.31 | *** mode/#harmattan [+q itsnotabigtruck!*@*] by dm8tbr |
| 19:05.36 | dm8tbr | I asked kindly |
| 19:06.19 | javispedro | can I talk about my stupid GPS things no one is interested in now? :D KTHXBYE! |
| 19:08.29 | dm8tbr | javispedro: you've got a GPS thingy? is that contagious? ;) |
| 19:09.22 | *** mode/#harmattan [-qq djszapi!*@* itsnotabigtruck!*@*] by dm8tbr |
| 19:09.39 | itsnotabigtruck | heh |
| 19:10.02 | itsnotabigtruck | javispedro: gps things? like the waas business from the other day? |
| 19:10.32 | javispedro | nah, just kidding, still doing accuracy tests |
| 19:11.06 | dm8tbr | just GPS or against the whole positioning thing in harmattan? |
| 19:12.04 | javispedro | just GPS, although I have to let the data go through positioningd because I don't know how to speak the raw GPS proto |
| 19:12.36 | javispedro | and I suspect it is doing Kalman or similar filtering |
| 19:12.50 | dm8tbr | ic |
| 19:13.18 | djszapi | dm8tbr: please write into the topic, if security cannot be discussed. I would be the happiest. |
| 19:13.22 | *** join/#harmattan teleshoes (~wolke@pool-74-108-147-150.nycmny.fios.verizon.net) |
| 19:13.34 | djszapi | there was no "trolling", at least I did not get itsnotabigtruck that way. |
| 19:13.40 | djszapi | not sure what he thinks. |
| 19:14.16 | dm8tbr | djszapi: at least he got the clue, you apparently didn't. now be a good boy and shut up. |
| 19:14.16 | itsnotabigtruck | well, i don't think it was trolling, but i can see why everyone's tired of more aegis back-and-forths |
| 19:14.24 | javispedro | /join #harmattan-security :D |
| 19:14.37 | djszapi | itsnotabigtruck: exactly, that is why I suggested the topic extension. |
| 19:14.58 | itsnotabigtruck | djszapi: but banning security talk would be strange, for one this is the main place people ask for help from with aegis |
| 19:14.58 | djszapi | it was way unhealthy topic many times already last summer. |
| 19:15.00 | itsnotabigtruck | bbiaf |
| 19:15.04 | itsnotabigtruck | aww, no one there @javispedro |
| 19:15.21 | djszapi | help is okay, but not arguing and calling others' job shit or retarded itiots. |
| 19:15.24 | djszapi | idiots* |
| 19:15.28 | dm8tbr | djszapi: you already have your special bit especially for you in the topic. one per person, sorry. |
| 19:15.35 | *** mode/#harmattan [+q djszapi!*@*] by dm8tbr |
| 19:15.51 | dm8tbr | I can also make you shut up if I have to... |
| 19:15.57 | *** join/#harmattan gabriel9 (~gabriel9@83-71-246-188-bl.cable.dyn.broadband.blic.net) |
| 19:16.31 | dm8tbr | and apparently I do have to :( |
| 19:33.18 | *** join/#harmattan risca (~risca@wi-secure-5192.cc.umanitoba.ca) |
| 19:33.19 | Anssi138 | damn i missed good old fashioned security discussion. |
| 19:33.32 | itsnotabigtruck | lol |
| 19:33.56 | matrixx | just got some popcorn but the show was already over :( |
| 19:35.42 | Anssi138 | <- likes aegis. |
| 19:36.08 | javispedro | ~lart Anssi138 |
| 19:36.08 | infobot | DoSes Anssi138 |
| 19:36.39 | itsnotabigtruck | lol |
| 19:36.56 | matrixx | :D |
| 19:37.42 | javispedro | dm8tbr: unmute djszapi already, the discussion can continue on #harmattan-security |
| 19:37.59 | *** part/#harmattan djszapi (~lpapp@kde/developer/lpapp) |
| 19:38.15 | *** mode/#harmattan [-q djszapi!*@*] by dm8tbr |
| 19:39.01 | dm8tbr | javispedro: the guy sadly doesn't get a clue, even if it comes as a 2x4 |
| 19:39.04 | javispedro | .oO(doh) |
| 19:39.37 | Anssi138 | 8 ? |
| 19:39.42 | Anssi138 | but yep. |
| 19:40.00 | SpeedEvil | javispedro: ?Has someone suggested that it might be cell-positions ? |
| 19:40.41 | javispedro | SpeedEvil: technically I've tried to configure it to avoid cell positions; also, cell positioning would be more accurate |
| 19:40.46 | javispedro | than the readings I'm getting |
| 19:40.54 | javispedro | in any case it seems like it does not like this place |
| 19:41.44 | javispedro | curses that the qt-sdk updater umask seems to be 0077 |
| 19:54.17 | MohammadAG | oooh, my hard drive clicked again |
| 19:58.10 | gabriel9 | i just buyed xbox 360 |
| 19:58.25 | gabriel9 | and now i don't know what to do with it :/ |
| 19:58.33 | gabriel9 | i can't install Linux on it |
| 19:58.37 | DocScrutinizer | MohammadAG: clicking HDD shouldn't concern you |
| 19:58.57 | DocScrutinizer | hdparm -S $yourdrive will cause that |
| 19:58.58 | mgedmin | MohammadAG, because you have up-to-date backups, right? ;) |
| 19:58.59 | javispedro | gabriel9: you can pair it with lumia |
| 19:59.08 | javispedro | gabriel9: though garbage+garbage is still garbage ;P |
| 19:59.15 | gabriel9 | i don't want to do that :D |
| 19:59.15 | MohammadAG | mgedmin, because I have no backups |
| 19:59.29 | MohammadAG | or a place to backup to |
| 19:59.35 | DocScrutinizer | clicking is caused by heads parking |
| 19:59.48 | MohammadAG | DocScrutinizer, that's normal clicking |
| 19:59.59 | MohammadAG | this is the clicking you hear when the power's out in a spinning disk |
| 20:00.01 | javispedro | you can also check SMART |
| 20:00.14 | MohammadAG | that can check my ass |
| 20:00.20 | DocScrutinizer | yu should check smart indeed |
| 20:00.21 | MohammadAG | only time it worked was when it was too late |
| 20:00.27 | MohammadAG | for me at least |
| 20:01.03 | javispedro | not saying that it will say "YOUR HDD WILL DIE IN 3 WEEKS, 1 DAY, 4 HOURS AND 57 MINUTES" but at least it will tell if it is the head parking or what |
| 20:01.30 | DocScrutinizer | well, any unusual clicking would mean heads running into a stopper, which implies positioning error that shall get noticed by smart |
| 20:02.09 | SpeedEvil | Or simply the head parking. |
| 20:02.23 | DocScrutinizer | I already mentioned that, yes |
| 20:02.51 | DocScrutinizer | [2012-03-18 20:59:48] <MohammadAG> DocScrutinizer, that's normal clicking |
| 20:03.06 | DocScrutinizer | which implies for me the clicking was not normal |
| 20:08.47 | MohammadAG | DocScrutinizer, javispedro SMART tests passed |
| 20:09.09 | javispedro | not the tests |
| 20:09.13 | javispedro | check the counters |
| 20:09.20 | javispedro | and compare after a few days |
| 20:09.26 | javispedro | specially after hearing one such click |
| 20:21.32 | RST38h | Meanwhile: Downloading music, movies, e-books and Apps could soon cost Connecticut residents more as lawmakers consider a tax on digital downloads. The bill, proposed by the General Assembly's Finance, Review and Bonding Committee, would have consumers pay the 6.35% sales tax on any electronic transfer. |
| 20:21.38 | RST38h | Moo, javispedro |
| 20:22.41 | itsnotabigtruck | MohammadAG: check the SMART statistics |
| 20:22.55 | itsnotabigtruck | oh, you already did |
| 20:23.36 | itsnotabigtruck | looks like i missed gabriel9, but...he could play games with it >_> |
| 20:24.08 | DocScrutinizer | RST38h: how much costs one byte? |
| 20:24.42 | RST38h | Doc: You can ask CT legislature |
| 20:25.02 | RST38h | But I suggest you ask them what "byte" is first. |
| 20:26.21 | itsnotabigtruck | i just realized why people are getting this "package syntax invalid" message |
| 20:26.26 | itsnotabigtruck | they're trying to wget my example url |
| 20:26.32 | itsnotabigtruck | http://awesome.tld/awesomeapp/install.deb |
| 20:26.34 | itsnotabigtruck | lol |
| 20:26.44 | itsnotabigtruck | which is producing a bogus file, which they then try to install with incept |
| 20:26.56 | RST38h | bad idea to create such urls |
| 20:27.38 | itsnotabigtruck | RST38h: but it's not even a valid domain name! |
| 20:27.56 | javispedro | why is it producing a bogusfail? |
| 20:27.58 | javispedro | *file |
| 20:28.09 | itsnotabigtruck | javispedro: i think wget sometimes writes error messages to the output file |
| 20:28.17 | javispedro | that's impossible |
| 20:28.23 | javispedro | unless .... |
| 20:28.37 | itsnotabigtruck | javispedro: nm, i was thinking of curl |
| 20:28.40 | itsnotabigtruck | it creates an empty file |
| 20:28.47 | itsnotabigtruck | *it = wget |
| 20:28.50 | javispedro | you are with one of those ISPs that hide NXDOMAIN failures and return a spam page |
| 20:28.56 | itsnotabigtruck | nah, it's not that |
| 20:29.05 | itsnotabigtruck | it's that wget opens the output file before trying to connect |
| 20:29.19 | itsnotabigtruck | curl actually does write error messages to the output file unless you tell it you want to actually fail on errors |
| 20:29.34 | itsnotabigtruck | so you'll end up with a file containing "file not found" or something |
| 20:31.07 | RST38h | found that Android users are unable to input series of numbers into their phones. Found it the hard way. |
| 20:31.30 | *** join/#harmattan piggz (~piggz@host-92-29-15-193.as13285.net) |
| 20:37.03 | RST38h | Which by the way created an interesting intellectual problem: how do you create UI for people who cannot folllow repeatedly given instructions. I am feeling like Steve Jobs tonight. |
| 20:45.36 | Piru | users are idiots |
| 20:52.58 | *** join/#harmattan ajalkane (~ajalkane@a88-115-212-112.elisa-laajakaista.fi) |
| 21:05.05 | *** join/#harmattan liar (~liar@clnet-p09-185.ikbnet.co.at) |
| 21:07.18 | *** join/#harmattan niqt (~quassel@host252-114-dynamic.59-82-r.retail.telecomitalia.it) |
| 21:13.18 | ajalkane | anyone know what I have to select from QtCreator's update tool, to get the harmattan APIs like "gconfitem" ? |
| 21:13.55 | ajalkane | There's in the Update tool "Harmattan development environment", which is installed, but also one in the "Experimental" section |
| 21:14.59 | *** join/#harmattan zk8 (~tester@bl7-45-209.dsl.telepac.pt) |
| 21:15.21 | *** join/#harmattan kakashi__ (~kakashi_@nltk/kakashi) |
| 21:18.49 | *** join/#harmattan tgalal (~tarekg@p54BEA010.dip.t-dialin.net) |
| 21:19.40 | tgalal | on scratchbox if I try to use the accounts API, as soon as I create a Manager instance I get "Manager could not be created. DB is locked". any idea ? |
| 21:21.59 | Anssi138 | is there manager already created? |
| 21:23.43 | tgalal | Anssi138: nope, not by me. It's very similar to this issue: http://www.developer.nokia.com/Community/Discussion/showthread.php?231594-Unable-to-use-accounts-qt-framework-in-scratchbox.-Accounts-DB-locked |
| 21:23.49 | Anssi138 | if you find the db, the "fuser" shows who is using it. |
| 21:24.40 | Anssi138 | oukkidoukki |
| 21:24.45 | tgalal | fuser is usable from scratchbox ? |
| 21:25.37 | *** join/#harmattan deimos (~deimos@host128-37-dynamic.24-79-r.retail.telecomitalia.it) |
| 21:27.40 | tgalal | Anssi138: nm, went through from outside and killed the process that was using .accounts/accounts.db, but the same error displays and nothing is using that db file |
| 21:27.55 | tgalal | I suppose that means there is another db |
| 21:28.41 | liar | does anybody of you develop for the nokia n9 on a x86_64 arch linux (or similar) system? |
| 21:29.01 | tgalal | liar: yeah me |
| 21:29.25 | liar | tgalal: can you help me setting it up? i've got a problem with qemu i think |
| 21:29.32 | Anssi138 | tgalal: maybe there is just something else then. |
| 21:29.59 | tgalal | liar: I couldn't run qemu, I'm using scratchbox. |
| 21:30.16 | liar | isnt scratchbox using qemu? |
| 21:30.47 | liar | i do get "Error -8 while loading /usr/bin/apt-get"... |
| 21:32.17 | tgalal | liar: I don't know lol. probably. |
| 21:32.50 | tgalal | not sure what that error means though |
| 21:33.27 | liar | i suppose its comming from qemu-armeb-sb and means "Exec format error" |
| 21:36.24 | liar | ah.. apparently i was using the wrong cpu-transparency method |
| 21:48.15 | *** join/#harmattan gabriel9 (~gabriel9@83-71-246-188-bl.cable.dyn.broadband.blic.net) |
| 22:23.13 | *** part/#harmattan deimos (~deimos@host128-37-dynamic.24-79-r.retail.telecomitalia.it) |
| 22:25.53 | *** join/#harmattan wirwe (~molenz@pool11.physik.hu-berlin.de) |
| 22:33.15 | gabriel9 | anyone play games? |
| 22:33.34 | gabriel9 | i did not play me3 but i just sow this and this is great :D |
| 22:33.40 | gabriel9 | http://www.youtube.com/watch?v=I_H3uWLW3N4&feature=player_embedded |
| 22:37.29 | itsnotabigtruck | gabriel9: hahaha |
| 22:38.38 | gabriel9 | :D |
| 22:38.46 | gabriel9 | it is great vid |
| 22:39.07 | gabriel9 | people are really upset becouse of end of the game |
| 22:47.39 | *** join/#harmattan diorahman (~diorahman@202.152.205.23) |
| 23:07.12 | *** join/#harmattan diorahman (~diorahman@202.152.202.93) |
| 23:12.21 | *** join/#harmattan diorahman_ (~diorahman@202.152.205.118) |
| 23:24.24 | *** join/#harmattan hardaker (~hardaker@mail.hardakers.net) |
| 23:37.50 | *** join/#harmattan hardaker2 (~hardaker@mail.hardakers.net) |
| 23:46.04 | *** join/#harmattan GeorgeH (~George@c-69-141-105-145.hsd1.nj.comcast.net) |
