The officially official Devuan Forum!

You are not logged in.

#101 Re: Off-topic » Firefox Quantum » 2017-11-27 14:37:17

Pulseaudio support is just the "default", it's still possible to build without it.  You could try pulling down the Debianised source and changing the 'mozconfig' options (build flags):

# Uncomment the following option if you have not installed PulseAudio
#ac_add_options --disable-pulseaudio
# and uncomment this if you installed alsa-lib instead of PulseAudio
#ac_add_options --enable-alsa

(source: http://linuxfromscratch.org/blfs/view/s … efox.html)

Then remove pulseaudio dependencies from the control file and rebuild the package.  Obviously not tried it myself, but I can't see why it wouldn't work...

#102 Re: Other Issues » [SOLVED] <Ascii> xfce4-terminal; No Scroll bar » 2017-11-21 21:59:23

Right click in the terminal window and select "show menu bar" if it's not already enabled.  Then from the menu bar select 'edit', 'preferences'.  You can then configure it to your liking...

Or find the related dotfile in ~/.config/xfce4/terminal/terminalrc

Three possible states for the scroll bar:

1.

ScrollingBar=TERMINAL_SCROLLBAR_LEFT

2.

ScrollingBar=TERMINAL_SCROLLBAR_NONE

3.
Unspecified (default position on the right)

And if you mess it up, just rm ~/.config/xfce4/terminal/terminalrc and start afresh.

Self explanatory?

#103 Re: Other Issues » [SOLVED] <Ascii> xfce4-terminal; No Scroll bar » 2017-11-20 16:34:41

It's years since I've used it, but it's highly configurable from the menu.  e.g. you can enable the scrollbar change the colours, fonts and set it up as a login shell, etc.

You can also scroll any terminal emulator in the same way as a VT (usually by SHIFT+PgUp/PgDn).

Finally, for commands which spit out many lines, you may not have a large enough scroll back buffer, so either increase it or just pipe your command output to a pager such as less, e.g:

$ ls -al|less

#104 Re: Other Issues » Firefox goes to be just title bar with a thin grey line just below » 2017-11-20 14:31:11

It sounds like the window could be getting accidentally "shaded" via a mouse action.

As I recall, double left clicking or scrolling the scroll wheel on the window title bar causes the window to roll/up down.  You could also temporarily switch to window decorations which support the shade button for a while and see how it goes.

#105 Re: Hardware & System Configuration » Kept back packages when updating » 2017-11-16 15:29:26

kernels usually don't get removed due to no packages actually depending on them.

With other packages, particularly in unstable, some major ABI change can result in apt-get wanting to remove half the system when you issue a dist-upgrade.  Not running a dist-upgrade regularly on an unstable system usually results in the system getting further and further behind, until it's no longer easily upgradeable.

#106 Re: Hardware & System Configuration » Kept back packages when updating » 2017-11-16 11:41:10

That's not quite how it works.

Despite it's name, "dist-upgrade" won't upgrade the system to a newer release.

Normal 'upgrade' upgrades packages without removing anything. (it will "hold back" on upgrading packages which could result in removals)

dist-upgrade will aggressively remove packages to ensure it fully upgrades all other packages to the latest version in the repositories.  This is why dist-upgrade is used for the "second phase" oldstable to stable upgrade.  Every upgrade in unstable is pretty much a major upgrade, hence why dist-upgrade is the preferred method.

Refer to apt-get(8)

dist-upgrade
In addition to performing the function of upgrade, this option also intelligently handles changing dependencies with new versions of packages; apt-get has a "smart" conflict resolution system, and it will attempt to upgrade the most important packages at the expense of less important ones, if necessary.

The next step is when everything breaks...

#107 Re: Hardware & System Configuration » Kept back packages when updating » 2017-11-16 09:53:11

TwistedFate wrote:

I am using Devuan Ceres if it matters

It does.  Running the unstable distribution assumes that you know what you're doing.  If you don't know the basics, it's best to run the stable distribution.

If you run a dist-upgrade instead of an upgrade, that will be the next step, but not necessarily the end of your problems.

#108 Re: Documentation » Grsecurity/Pax installation on Devuan GNU/Linux » 2017-11-16 09:37:43

I'm still not sure if grsec is actually worth the effort these days, especially in view of this: https://grsecurity.net/passing_the_baton.php

i.e. in the future you'll have to pay for it...

I also wonder what exactly KSPP are trying to achieve, it seems like a talking shop at this stage.

And the attitudes of certain people, mean kernel security is never going to be anything more than a retroactive approach anyway: http://lkml.iu.edu/hypermail/linux/kern … 06228.html (nothing unusual there, it's just the usual dismissive disdain for "security people")

I also wonder what exactly KSPP are trying to achieve, it seems like a talking shop at the moment...

#109 Re: Installation » [Solved] How to install the new version of Firefox on Devuan? » 2017-11-13 23:24:59

Otter Browser (Opera 12 style) is nicer than "Opera": https://otter-browser.org/

Webkit engine again though (but original webkit rather than blink/chromium).

There is also Vivaldi, which is closed source, but from one of the original Opera software founders.

#110 Re: Other Issues » Wicd not auto connecting.. - Have to turn of/on/refresh to get list » 2017-11-13 14:13:19

Still not clear on what you're trying to achieve here.

From your second post it's clear that you have stanzas in /etc/network/interfaces for a wlan0 device and it's all configured to connect to the access point using wpa_supplicant configuration?  Then you've installed wicd as well and setting that to run as a daemon?  wicd won't be able to claim the wlan0 device and manage the connection as you've already configured and connected it in /etc/network/interfaces

The best way to stop wicd running on startup is to just remove the package, which will disable and remove it's rc scripts automatically.

#111 Re: Other Issues » Wicd not auto connecting.. - Have to turn of/on/refresh to get list » 2017-11-11 18:49:42

It was always better to configure via wpa_supplicant / /etc/network/interfaces

https://wiki.debian.org/WiFi/HowToUse#wpa_supplicant

(wicd and networkmanager are turds)

#112 Re: Off-topic » lol! » 2017-11-10 17:08:12

fungus is my alt account...

Really, do you need the [funny][/funny] tags extension installed?

#113 Re: Off-topic » lol! » 2017-11-10 16:28:48

golinux wrote:

@fungus . . . I give up[etc]

Stop being so anti-fungal!

#114 Re: Off-topic » lol! » 2017-11-10 11:56:04

There is the approach of "proactive security", code auditing and general "code correction" principles as embraced by the OpenBSD project.  The general principle of "if there are too many lines to audit the code is garbage and needs to go" holds sway here rather than just piling on more and more raw functionality in a scenario of continual code bloat, while just pretending it's all ok.  Those submitting crap are pretty much told as such.  Theo de Raadt, the lead developer was once described by Linux Torvalds as "difficult".  Unlike many, Theo is into what he does best and is not some corporate whore in the pockets of big business.

The Linux kernel is about 25 million lines of code.  The whole of OpenBSD, kernel + userland is only about 3 million, as I recall.  Security is the main focus with OpenBSD and new security features are being constantly developed.  With this attitude "that the OS is still not secure enough", it can only improve rather than stagnating as some others have.  I can only say good things about it, having used it for a few years, but it's not for the fainthearted "Linux desktop user".  YMMV.

#115 Re: Off-topic » lol! » 2017-11-10 11:03:46

I have no real opinion, it's a FreeBSD based "desktop oriented" OS as far as I'm aware?

I'm not sure of how it differs in implementation or goals to others such as TrueOS (formerly PC-BSD).  My experience is limited to OpenBSD, FreeBSD, Dragonfly BSD and very little with NetBSD.  Zero with all others.

#116 Re: Off-topic » lol! » 2017-11-10 10:12:38

fungus wrote:

It is a bit out of my water and knowledge base.  Some people swear by the importance of open source.
I sit down and write some clean good code and you review it and say it is great.  Then you run it through a compiler and produce a nice speedy binary package.  How safe is this binary.  How reliable are available compilers.  Can we know?

They can be safe, we can know that, but it's whether we choose to know or not.

Originally, projects such as GNU and BSD, etc were written by "hackers for hackers" at UC Berkeley and MIT and some other academic institutions.  The originally BSD style "permissive" licences were very simple in that they basically allowed code to be used for anything, without any real restriction so long as a copy of the licence was included.

GNU/Linux changed this in that it created a launch platform for Stallman's GPL and ideology.  GNU/Linux displaced BSD as the main contender for a free UNIX-like OS, not because it was superior, but because at the time FreeBSD, NetBSD and proprietary BSD/OS were still encumbered with AT&T code and BSDi were facing the USL lawsuit.

The Berkeley hackers who worked on BSD (which was originally based on licensed AT&T UNIX code) were not really motivated by Stallmanist ideology or corporate gain but by wanting to hack and by pragmatism - i.e. make something which works, works better than the alternatives and let others use it and appreciate that.

The current state of affairs is very different indeed - in that "Linux" (as a catch all) is not being "produced" for hackers by hackers, but by "developers" for consumers.

A quick comparison of the Linux Foundation and FreeBSD foundation websites will give at least an idea of what has come to be.  On the former we see paid employees of IBM, HP, Red Hat, Samsung, etc - in short "corporate reps".  On the latter we see that the majority are much the same types of academics as they have always been.

When the end user, even if they weren't a hacker, even if they were merely a tinkerer or someone with 15% understanding of a given system, even as someone who could and was prepared to actually configure their own system or submit a bug or patch something and rebuilt it from source, surrenders into becoming a "consumer", they effectively give up all the real benefits of FOSS and may as well switch to a proprietary product and be treated like a consumer.

With this in mind, the compiler being trusted, poisoned, etc becomes irrelevant (and by the way it's entirely possible to compromise a compiler so that it "poisons" specific code) as the "consumer" only wants a working end product.

When you consider that Linus Torvalds has publicly stated that he doesn't actually care about security and that the kernel is too big to audit, the compiler also seems irrelevant.

fungus wrote:

If after all this trouble, struggle, to learn and operate a linux system, we end up just like running w10 (in terms of privacy and security) I would rather shoot my better leg.  The more I learn the less likely it seems that the trip is worth it.  I may sound just like one of those systemd trolls, that win10 is not that bad after all, but I can't help it.

We hear it often:

" $LINUX_SOFTWARE_XYZ works for me"

MS Windows also "works for me".  As hard as it may be for some to grasp: Yes it really does just work - I can testify to that.  It may have some serious shortcomings, but it certainly works and works very well.  Do I like it?  No.  I use it at work, no choice, but wouldn't have it in my home.

As most people seem to miss or choose to ignore.  The world of GNU/Linux, the major distributions and the big software projects are now very much in the hands of corporations.  In my opinion Stallman's approach failed because the corporations simply bought off or employed the individuals involved in these projects, making them "free" only in licence, not in spirit.

fungus wrote:

Now, in the same poor excuse of a state, they are making it necessary to get a permanent ID for mass transit by in-person registration that has to be used as a sliding a card in every bus and metro/rail thing you enter, even if the charge is a single trip.  This is like having an antenna on your butt what time you went where.  At some point you start doubting whether it was you deciding to go somewhere and do something or you are part of a remote control system executing orders.

This has been the case in London for many years.  All tube and bus travel is "cashless" and RFID based technology is used.  This means that every person and their movements within the public transport system are traceable.

#117 Re: Off-topic » lol! » 2017-11-09 17:10:30

fungus wrote:

Horrific but expected, and that is half the story we do know.

We're sleep walking into this and the options are fast running out for those who don't want this crap.

This is far worse that UEFI/Secureboot (but doesn't get even 1% of the press that got).  Secureboot at least had some focus among Linux and other *nix users before it all died down and there was also coverage of the likes of Red Hat and Canonical bending over and accepting it and using the MS signing key.  Compared to this, IME and later PSP has flown under the radar.  From what I have read, PSP appears to be an even worse implementation of the same scumware.  It cannot be disabled (easily if at all) and is a far worse situation that secureboot.

If we look at the whole picture, x86 currently has UEFI, secureboot, IME/PSP and proprietary firmware blobs being loaded into, or already resident in, CPUs and other hardware devices.  We have "vendor lock in" and "remote management" (understatement) built in as standard, being bankrolled by consortiums of the big x86 "PC" vendors and MS and it's all being marketed as "security features" or some such bullshit.

IME/PSP has been very "clandestine" in it's roll out, using secret proprietary firmware for the OS, protected by NDAs and using marketing terms to describe the different (and confusing) parts of the technology.  There is also a severe lack of information as to which CPUs actually have it and which don't.  But you can assume that after a certain date/core revision, they do.

#118 Re: Off-topic » lol! » 2017-11-09 16:30:21

fungus, my typo error - "thousands" should have been "hundreds" (I went to school, studied "history" and read the odd book as well, but as one ages the "think one thing, type something else" starts to creep in more and more.)

Regarding "design" of course there is no design as such.  A better phrasing would have been "by it's very nature".

The (gradual) formulation of neoliberalism doesn't really afford a "design" to capitalism either.  These systems evolve as a patchwork, unlike socialism which is usually born out of some kind of "ideology" and includes "a plan".

And personally I think "ideology" in itself (freedom of thought/speech included) is what's under attack from "the establishment", not just radical or hostile ideologies, but anything resembling free thought or formulation of opinion.

I've debated with people in the past on similar subjects and for the most part you get word for word repetition of this expert, or that politician or some newspaper columnist, you don't get the sense that people actually think about what's going on.  They say what they believe they are allowed to say, what they're expected to say, within certain (politically correct limits).  No one wants to deviate from the billions of smartphone addicted clones, in case they are lumped in with the lunatic fringe, oddballs or social misfits.

Pretty much agreed on all other points.

#119 Re: Off-topic » lol! » 2017-11-09 12:29:30

If you haven't read about Intel IME/AMD PSP, which I mentioned earlier in the thread with reference to the OP, this is worth a look:

EFF piece on the subject:
https://www.eff.org/deeplinks/2017/05/i … disable-it

Libreboot's FAQ:
https://libreboot.org/faq.html#intel
(a bit "foaming at the mouth" Stallmanist in places, but still factually correct and worth a read.)

Coreboot's classification of the types of firmware involved and perceived threat level
https://www.coreboot.org/Binary_situation

What you will get from this is, that if you want a secure computer system without an "out of band" processor running a subliminal, closed source clandestine OS with a built in back door, as far as amd64 architecture goes, you're restricted to 'ancient' (pre Core microarchitecture) Intel CPUs or AMD CPUs/APUs up to the steamroller core.

#120 Re: Off-topic » lol! » 2017-11-09 12:10:37

I think if we look at capitalism from a purely pragmatic point of view - it has got us "here".  We can call that good/bad.

Genocide, ethnic cleansing, colonialism, etc have also got us "here".  The US for example, like so many former colonies, was initially built upon massacre of the indigenous people and slave labour.  We don't celebrate those as a means to an end, so it may seem unclear as to why capitalism is "the only answer" for some.  The answer of course is cold war era propaganda, the collapse of the soviet block, fall of the Berlin Wall the state of China and more.  There are people who suffered under those regimes, who would probably slap you in the face if you happened to think socialism/communism was a good idea.

But over thousands of years capitalism has followed similar patterns:

1) The rich get richer, the poor get poorer
2) A less privileged, less educated work force have traditionally been needed to "fuel the machine".  Without this, without poverty in fact, capitalism begins to erode and the privileged life styles of the few "living the dream" (at the expense of the many) collapses.  Thus:
3) There cannot, by design, be prosperity for all, or even the majority.
4) In the modern "global economy", the better standards of living enjoyed by working classes in the west is mainly facilitated by exploitation of cheap labour elsewhere in the world.
5) The "Military Industrial Complex" - short version: war is good for the economy (so long as it's not fought in your back yard).

We could conclude that we are living through the inevitable "conclusion", or near enough, of capitalism as it too evolves into a totalitarian state, effectively run (by proxy) by global big business / the social elites / super rich.  It could be argued that it's in its final "highly evolved" state or close.  My point is that it can never evolve into a fairer, juster society, free of poverty and corruption - only the reverse until it's final implosion.

Other systems were tried and failed, but of course dismissed by "the establishment" of the time, because of course the establishment would dismiss them.  Socialism in various forms has been tried, but snapped back to the opposite extreme in most cases.  Capitalism has been around universally for centuries in varied forms and has ultimately failed the many and enriched the select few.  If you're the few, capitalism is a success, if you're the vast majority of the world's population it's not.

#121 Re: Off-topic » lol! » 2017-11-08 15:41:24

It's very easy to just give up the "power of the people" or the idea of a "republic".

For the most part democracy in much of the world is a token thing.  The idea of a "state within a state" is a controversial one, but not an impossible, out of this world theory.

A lot of what we know points to this, but of course there is no conclusive evidence (as there wouldn't be).  Just as trading cartels are extremely secretive and literally put nothing in writing, a subliminal state, would operate in a similar manner.

It's rather catch 22 to dismiss the "masses" or whatever you want to call them for their lack of knowledge or interest in the situation.  The average person grows up within the confines of the societal structure of the country they live in, reading the mainstream newspapers, watching the mainstream news - it's hard for them to question and turn their comfortable world upside down, than it is to just accept the status quo, keep their head down and live life.  Even those who have the smallest inkling of what is afoot, will simply shrug and get on with life.  They're essentially powerless and they know - that's despite being in a "democracy" where they elect people to represent them in government.  In the last 30 or so years most people have simply become disenfranchised with politics (and especially politicians) and have simply thrown in the towel and allowed opportunist fat cat crooks and by extension their cronies in big business, to run their country.

While the power and influence of the masses is dismissed and devalued, 'the power' is gifted to this same privileged minority again and again.  And while we live in a society where in addition to this, 99% of the wealth is held by 1% of the population, this doesn't look set to change anytime soon.

#122 Re: Off-topic » lol! » 2017-11-08 12:40:39

1.  I never spoke of capitalism.  Perhaps globalisation in a round about way, but not captalism.  I tend not to get into purely political debates.  History will be the best judge of capitalism, not some posts in a Linux forum.

2. Of course.

3. I disagree.  There is the need to spread the word and keep people informed 'in the know'.  Above all, people need to start thinking for themselves again.  Even if it's just passing onto family members, it might be the 'spark' which brings about change.  Whatever your political leanings, "the state" should not be prying into your personal life, either directly or by proxy.

Most recent revolutions have not been "Red October" style uprisings, many have been the mobilisation of discontent which started as a murmur and rose to a crescendo - it's this which "the establishment" are afraid of.  Organised opposition with a hierarchical structure and comprised of people who are not anonymous, can be disrupted, divided and infiltrated as were the various Trotskyite movements in western Europe during the classic "cold war" era (before the existence of the WWW).

We saw from the recent Catalonia situation - and whether that was right or wrong is immaterial here - that visible and numerous demonstrators on the streets counts for absolutely nothing.  "The Media (tm)" have the means to portray demonstrators in any way they choose (and in fact the various media outlets, central government and regional government all had wildly differing estimates of the numbers actually on the streets).

4. In my opinion "protest" has, for the most part become token, along with strike action.  In the UK in the 1980s, people went on strike and went without, until they got the hard earned rights they were fighting for.  Nowadays strike action has been "watered down" to planned walkouts of a day or two.  The media portray the strikers as lazy and greedy who are already overpaid, etc.  Unions are being undermined, not just by the regime, but from within.  Demonstrations are also portrayed as the actions of the idle and privileged with little else to do with their time.  This has socially engineered the population as a whole to avoid getting involved.  There is also the "fear" factor - i.e. if you're seen at a demonstration, it may affect your career prospects.  You are effectively held to ransom and kept "in line" by social pressures.  It's about momentum, there needs to be momentum to bring about change, but the system is geared towards ensuring that there is social and political restraint.

Regarding activists on the web - keeping them on controlled media, means that they can be easily monitored and hindered/undermined if necessary.  The paradox is that in order to reach the people they want to reach, they need the exposure and reach those sites/applications afford them...

#123 Re: Off-topic » lol! » 2017-11-08 10:52:33

fungus wrote:

The suspicion again is not so much in what is communicated but who it is that is communicating.  You can see light in the fog but a radio beacon is sending a signal telling you who it is sending the light.  Freedom of speech when your individual identity must be clarified before you speak is not much of an individual freedom, except for the very naive.

"Fingerprinting" is the big threat to privacy and civil liberty.  When we have corporations like google who have made billions, by mining data and profiling, for whatever purpose, there is really no limit to what they can do and it's almost impossible to break their stranglehold over the WWW.  Even before google chrome came about, google bankrolled the firefox browser and installed their spyware in it, which remains today.  Safe Browsing is marketed under the pretence that it protects you from undesirable or dangerous websites.  It is on by default and relies on the end user's lack of knowledge on how to configure the browser to turn it off.  The reality is that it's just a link in the "connect the dots" infrastructure google uses to track individuals.  Unless you avoid their services and use tor or i2p 100% of the time you have some trace-ability.

The days of MS and the desktop x86 PC/laptop are fading fast.  The future seems to be google (for now) and the omnipresent android based arm devices (appliances), locked into using at least some google products and services (including the "free" OS itself - the irony should not be lost).  There are now far more people online and "logged in" reporting their every move (literally as that's what geolocation is for) to google via these google controlled devices.  The software which runs on the devices or elsewhere is "free", but not "free" as we would understand it here.  google has completed data mining under a pretence before - streetview in fact was just the gloss or the (free) "product" which was used to gather data from wireless access points.  It goes back to the old adage "if the data can be gathered, assume it will be".

fungus wrote:

We may have enjoyed a brief period, a window of opportunity, to understand the potential of the internet, but by the time we did it was taken away again.

As with anything else, the mainstream has been seized by corporate (fortune 500) entities.  The same is true of Linux and associated projects.  Red Hat, IBM, HP, Oracle, Intel, even MS have their fingers in that pie - hence why you get poorly coded and overly complex shitware like systemd, etc.  Linux is simply a free and cheap alternative to produce what used to be produced by in house and highly paid developers in a closed environment (e.g. Windows, AIX, HP-UX, Solaris, etc).  Compared to the running costs of that, Linux is peanuts and it "works".

fungus wrote:

Most people don't email each other any longer, they "im" in social media.  If you are not "in" social media you don't actually exist, let alone have a voice.

It all boils down to one thing - money.  If you want private email, you have to pay for it and it has to be end-to-end encrypted.  Any "free" email such as gmail is part of the same big data mining and profiling infrastructure.  It's not "free".

The same with the instant messaging programmes - I don 't use these, but there is one hilariously insecure example which had more security holes than a swiss cheese and was bought out by faecebook (can't remember what it was called).  People use it because it's 'free shit', they know absolutely zero about how it works - it "just works" and of course that's precisely how corporations like MS, faecebook, google, etc have thrived - keeping the end user as ignorant and dependent as possible.  The quality of the software itself is irrelevant - it's profitable and security/privacy concerns are just shrugged off.  The average person has to lose big, very big, before they realise how important security and privacy is - like having their bank account rinsed.  Until such a shock is delivered, the sleep walk continues.  Even after such as shock, you can bet it's someone elses fault and they will fall back to their old habits.  This is partly due to a lack of information and awareness and "tech press" and mainstream news being dominated by pseudo experts.

I see often see news reports where the term "hacker" is used and an individual in a hood in a darkened room is sat in front of a laptop with some console text.  90% of this time this is just boot messages from some kind of *nix (likely Linux), it is not "hacking", but the average uninformed person it's a "hacker" in the process of "hacking"...  It's utter bilge.

People are simply being misled wholesale when it comes to this technology.  It's the equivalent to the mechanic servicing your car telling you there is "magic" under the bonnet and you should not open it.

fungus wrote:

How does a woman flipping off the president on the street with a bicycle get fired the next day?
Are there more people in the US being affected by a gag-order or journalists in prison in Turkey?

Sadly because we live in a politically correct society where it's all about imaginary "offence", hypocrisy and double standards.

From politicians, i.e. those who are supposed to represent you and lead by example, even a token apology is enough to save their skins and 6 figure salary (e.g: "I'm very sorry for $OFFSHORE_INVESTMENTS, it was a mistake [getting caught]").  We all know what happened and what has been going on, but it's irrelevant, it's obvious that their true nature and gross hypocrisy has exposed, but an apology an "official story" is ok and good enough for PR purposes (a good old fashioned cover-up would have worked, but if it's too late a token apology will suffice) - it will soon blow over and be forgotten by the fickle masses after all.  Working man/woman (and taxpayer) on the street?  "Yer fired! get out!".

And remember it's all about you privacy and your security.  The people making this legislation want to spy on you and allow (lobbying) corporations to infringe on your privacy, while they are in no shape or form transparent.

(apologies, quite a few edits and no doubt violated golinux's post length guidelines)

#124 Re: Off-topic » lol! » 2017-11-07 15:39:32

fungus wrote:

The other paranoia I have is based on the technology used to utilize the main/ac circuit in a building as a network cable to extend your physical lan from a router.  What-If, the intels and amds of the world, have utilized this technology and have extended this capability through the power supply.  Then your lan goes at least out to the electric pole. Possible?  Probable?

Well it seems possible at least, but not probable.  You would need a powerline adaptor built into the motherboard and directly accessing the mains AC rail, not via any internal circuitry.  This would mean that the motherboard and PSU vendors would have to be complicit.  So while much of this could be concealed in the "out of band" processor, there would still be physical and visible bits to give it away.

fungus wrote:

What about the cheap generic boxes (usually wifi capable) ISPs supply their customers.  Could they have audio/visual capabilities?  They never sell those, they lend them to you.  Legally they are not owned by the customer to dissect and investigate.  Why not sell them, even for $0.01?

SOHO devices, particularly DSL or cable routers are already a complete disaster of, usually, out of date Linux based, firmware with a plethora of security concerns.  The hardware is usually a simple SoC with, dsl or cable modem, ethernet controller, switch and 802.11 access point.

It works differently here in the UK.  The cost of the box is included in the contract, so you do own it when the contract ends or when you pay it off.  It would not be cost effective for them to retrieve the things.  The best approach is to buy hardware which supports open fimware or just use a standard dumb DSL or cable 'modem', connect that to you own router and AP running something you can actually maintain.  More hassle than the convenient SOHO box, but it will be more secure.

fungus wrote:

I read from reliable sources that Motorola engineers have whispered that the devices that android runs on are 100% bugged.  It doesn't matter what you may run on them.

I don't know about Motorola, but I don't trust google or their products.

fungus wrote:

The hypothesis is that controlling information is equivalent of social control.  I believe only manpower on the ground, organized and armed, is the ultimate social control.

In general, there are multiple forces at work here, but mainly global multi-nationals, "spycos" and government agencies.  History has proven again and again that controlling information is important to maintaining a particular regime or social order.  This is why we have brazenly partisan newspapers aligned to a particular political party and pushing that party's agenda.  In general people (from all parts of the political spectrum) don't question this, they just lap up whichever rag serves up what they choose to believe.

The WWW blew this old structure out of the water, in that people could watch, listen to and read a lot more things $THE_STATE doesn't want them to.  And this is what WWW censorship, "snooper charters", anti-encryption legislation and various restrictions on your privacy and civil liberty are really all about.  They're to ensure that fringe political movements never get off the ground and that the status quo is maintained.

#125 Re: Off-topic » lol! » 2017-11-07 09:11:03

fungus wrote:

What if some kind of rogue code withing the "good" code is reversing its function from output to input.  It may not be able to record hi-fi live music but after some cleaning of the waves a human voice can be decoded to analog speech.

Every speaker can be a microphone, so that's a valid point.  However most internal speakers are connected via an amp which kind of negates this.  If you plugged a passive speaker into a microphone jack, you might just about pick up some distorted sound, but an already poor sample cannot really be cleaned or improved if the original data isn't there (that's the realms of sci-fi / daytime TV in fact).

To actually rewrite the device driver to turn an analogue output jack into a microphone jack, on demand, is not easy however and probably not worth doing as the application would be so limited.  You'd need to hide the exploitable code within the in tree device driver of the Linux kernel - it's actually possible, but it's hard to say how long it would remain undetected.  There are easier methods of course.  It's known that Intel IME can control input devices and audio for example - and with regards to that, the OS is irrelevant.  Vulnerabilities have been found in it and if an attacker were to exploit those, thy may achieve the same.  In fact due to IME/PSP, amd64 hardware can be considered "compromised" from a security perspective.

But your speaker/microphone example can apply to anything and we could come to the conclusion that security/privacy is just not worth considering.  An exploitable bit of code to enable a key-logger could also be hidden in the usb hid driver, that would be far more dangerous and far reaching than someone listening in on your barely audible distorted chat.

Personally, from a security perspective, IoT is a disaster waiting to happen.  When Orwell wrote 1984, he could never have envisaged the internet (or even TV), but much that was written in that book has come to be today, just in a very different form.  Orwell did correctly predict that the population would be socially engineered into voluntarily giving up their privacy.

Board footer

Forum Software