GitGud has joined #neo900
pabs3 has joined #neo900
<pabs3> someone on #debian-mobile said that firefox 48 (at least) blocks my.neo900.org, "inadequate level of security"
Defiant has quit [Read error: Connection reset by peer]
Defiant has joined #neo900
<DocScrutinizer05> duh!
<DocScrutinizer05> pabs3: confirmed, many thanks for letting us know
<DocScrutinizer05> Fehlercode: NS_ERROR_NET_INADEQUATE_SECURITY
<DocScrutinizer05> wtf?
<pabs3> no idea :/
<pigeons> name here on firefox 45.2.0
<pigeons> *same
<pabs3> 45 works for me
<DocScrutinizer05> 47 worked for me yesterday
<DocScrutinizer05> grrr
<DocScrutinizer05> http://neo900.org/ works
<pabs3> hmm, actually 45 doesn't work for me
<DocScrutinizer05> https://neo900.org/ doesn't, too
<pabs3> same here. I get no error, it just doesn't visit the page
<pabs3> works in Tor Browser though
<DocScrutinizer05> well, might be a problem with nginx which we use instead apache in new server
<pabs3> I found a message about it: NS_ERROR_NET_INADEQUATE_SECURITY means Server negotiated bad TLS for HTTP/2.
<pabs3> try disabling HTTP/2 in nginx
<DocScrutinizer05> I have no clue about nginx config
<DocScrutinizer05> hellekin did that
<DocScrutinizer05> and dos1
GitGud has left #neo900 [#neo900]
SylvieLorxu has quit [Quit: ZNC - http://znc.in]
MonkeyofDoom has joined #neo900
herpderphurr has joined #neo900
lkcl has quit [Ping timeout: 244 seconds]
<DocScrutinizer05> https://ssldecoder.org/?host=neo900.org:85.10.210.203&port=443&fastcheck=0 looks absolutely fine --- except >>HTTP Strict Transport Security not set.<< :-S
<DocScrutinizer05> [2016-08-05 Fri 04:06:37] <ksx4system> oh fuck HSTS
<DocScrutinizer05> [2016-08-05 Fri 04:07:52] <DocScrutinizer05> is FF48 gone mad?
<DocScrutinizer05> [2016-08-05 Fri 04:08:39] <DocScrutinizer05> http://wstaw.org/m/2016/08/05/plasma-desktopPq2277.png
<DocScrutinizer05> [2016-08-05 Fri 04:08:53] <ksx4system> yes!
<DocScrutinizer05> [2016-08-05 Fri 04:09:13] <ksx4system> Chromium 52 reports perfectly secure connection
<DocScrutinizer05> pabs3: pigeons: ^^^
<pabs3> try setting HSTS, but I don't think it is that
<pabs3> asked hellekin to join here
<pigeons> Server negotiated HTTP/2 with blacklisted suite: RSA 2048 (SHA256) | TLS 1.2 | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | ECDH secp256r1
<pigeons> for the Firefox 46 and Firefox 47 sections
<pabs3> is that SHA1?
<DocScrutinizer05> ARGGHH
<pabs3> hmm, it says SHA256 at the start
<pabs3> so, definitely a HTTP/2 issue
<pigeons> probably the CBC
<DocScrutinizer05> seems I need to deactivate a few ciphers, eh?
<pigeons> yes the CBC ones
<DocScrutinizer05> let's see if I can figure how to do that
<DocScrutinizer05> no faintest clue about nginx
<pigeons> ssl_ciphers section
<DocScrutinizer05> where, to start with :-)
<DocScrutinizer05> /etc/nginx.cfg ?
<pigeons> it could be. like apache you could have the config for that site in one of several places
<DocScrutinizer05> there's a truckload of /etc/nginx/*[/*...]
<DocScrutinizer05> none of them looks really like a good conf
<DocScrutinizer05> HMMMM /etc/nginx/includes/ssl.conf
<DocScrutinizer05> ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
<DocScrutinizer05> ssl_ciphers HIGH:!aNULL:!MD5;
<DocScrutinizer05> ssl_prefer_server_ciphers on;
<DocScrutinizer05> >>ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";<< says https://cipherli.st/
<DocScrutinizer05> let's try this
<pigeons> so in the way that you are excluding MD5 you need to also exclude CBC
<DocScrutinizer05> !CBC ?
<pigeons> ugh i'm not sure the syntax is it !MD5|CBC I don't know I'll look
<pigeons> so what you show above from cipherli.st should work because it will prefer the AESGCM
<pigeons> ssl_ciphers HIGH:!aNULL:!MD5:!CBC; should add additional exclusion of CBC suites to what you have
<DocScrutinizer05> it does :-)
<DocScrutinizer05> seems to work, please verify
<pigeons> yep looks good now
<DocScrutinizer05> I had done >>ssl_ciphers HIGH:!aNULL:!MD5:!CBC<< like you suggested, but maybe https://cipherli.st/ simply knows better
<pigeons> yes i see the cipherli.st list also reccomended here https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
<DocScrutinizer05> ok, so this seems to be sort of common sense. and works
<DocScrutinizer05> ticket closed - many thanks to you guys! :-)
<pigeons> it wasnt until IE added GCM supported that it became best practice to disable CBC, even though it was none to suck for a while, but it wasn't practical because there are a lot of IE users
<DocScrutinizer05> now I guess it's time to chill for me
lkcl has joined #neo900
<DocScrutinizer05> I just hear "doesn't work on IPv6" - if anybody could check I'd be greatful
<DocScrutinizer05> grateful*
<MonkeyofDoom> $ curl -6 https://neo900.org/
<MonkeyofDoom> curl: (7) Failed to connect to neo900.org port 443: Connection refused
<DocScrutinizer05> o.O
<MonkeyofDoom> ipv4 works, ipv6 ping works; I'm guessing the httpd isn't listening on :: or whatnot
<DocScrutinizer05> newbie:/etc/nginx/includes # netstat -tupla
<DocScrutinizer05> Active Internet connections (servers and established)
<DocScrutinizer05> Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
<DocScrutinizer05> tcp 0 0 *:smtp *:* LISTEN 665/master
<DocScrutinizer05> tcp 0 0 *:https *:* LISTEN 30711/nginx.conf
<pigeons> yes when i checked previously ipv6 wasn't working so it wasn't something you just did
<DocScrutinizer05> the IP in NS AAAA is also correct
<pigeons> 2a01:4f8:130:9353:0:0:0:2
<DocScrutinizer05> :nod:
<DocScrutinizer05> according to ifconfig
<pigeons> you should have tcp6 in your netstat
<DocScrutinizer05> hmm, nope
<DocScrutinizer05> that's missing
<pigeons> then its back to the nginx conf file, whichever one it is this time
<MonkeyofDoom> or "lsof -i6"
<MonkeyofDoom> mhm
<DocScrutinizer05> "lsof -i6" quite a few but no HTTP/nginx
<MonkeyofDoom> give it a good kick!
<DocScrutinizer05> nginx? yeah, with a heavy boot
<pigeons> something like listen [::]:443
<pigeons> in addition to the listen 443; or however the v4 is handled
<MonkeyofDoom> it's still "*:443" but another column lists v6, for lsof at least
<DocScrutinizer05> when you provide the syntax for the nginx config line, I'll fix it now. otherwise I go to sleep
<pigeons> listen [::]:443
<MonkeyofDoom> pigeons: oh, you meant in the file
<MonkeyofDoom> nvm me!
<pigeons> is the syntax. additional line to your existing likely listen 443;
<DocScrutinizer05> server {
<DocScrutinizer05> listen 80 default_server;
<DocScrutinizer05> listen 443 ssl http2 default_server;
<DocScrutinizer05> listen [::]:443 ssl http2 default_server;
<DocScrutinizer05> ?
<pigeons> yep
<DocScrutinizer05> same for 80ß
<DocScrutinizer05> ?
<pigeons> i don't know what 80ß is
<DocScrutinizer05> port 80
<DocScrutinizer05> first listen line
<pigeons> yes
<DocScrutinizer05> server {
<DocScrutinizer05> listen 80 default_server;
<DocScrutinizer05> listen 443 ssl http2 default_server;
<DocScrutinizer05> #JR20160805 next two for IPv6
<DocScrutinizer05> listen [::]:80 default_server;
<DocScrutinizer05> listen [::]:443 ssl http2 default_server;
<pigeons> yep
<DocScrutinizer05> please retry
<MonkeyofDoom> well, now I get a 404
<MonkeyofDoom> over both IP versions
<MonkeyofDoom> :D
<DocScrutinizer05> grrr so it's needed for all vhosts
<DocScrutinizer05> wut?
<MonkeyofDoom> er, nvm
<MonkeyofDoom> curl defaults to 6 here ;)
<MonkeyofDoom> so v4 is fine
<DocScrutinizer05> aah ok
<DocScrutinizer05> lemme try fix it for a few more vhosts
<DocScrutinizer05> Aug 05 05:05:01 newbie nginx[3665]: nginx: [emerg] a duplicate default server for [::]:80 in /etc/nginx/vhosts.d/neo900.org.conf:5
<DocScrutinizer05> :-/
<pigeons> your vhosts don't say default_server too right?
<DocScrutinizer05> I first edited default
<DocScrutinizer05> hoped it would catch all
<DocScrutinizer05> nfc what it actually does
<DocScrutinizer05> aaaah :oP
<DocScrutinizer05> please test neo900.org
<DocScrutinizer05> pigeons: you need to talk straight to me, I'm in zombie mode
<DocScrutinizer05> ;-)
<pigeons> i'm getting tired myself but don't want to leave you with something broken
<DocScrutinizer05> my vhosts did say default_server
<DocScrutinizer05> worked now
<pigeons> well now that we're getting some practice they will change the syntax next release for sure
<DocScrutinizer05> as far as restarting nginx
<DocScrutinizer05> please check
<DocScrutinizer05> MonkeyofDoom: ^^^
<MonkeyofDoom> :)
<pigeons> ok
<MonkeyofDoom> a-ok
<DocScrutinizer05> AAAA?
<MonkeyofDoom> gratz!
<pigeons> confirmed
<MonkeyofDoom> both v6 and v4 work
<DocScrutinizer05> ok, all vhosts patched, should work now. MANY THANKS!
<DocScrutinizer05> and n8 folks
<MonkeyofDoom> glad to help! nn
<pigeons> goodnight
Satyricon has quit [Ping timeout: 276 seconds]
Sicelo has quit [Ping timeout: 276 seconds]
Satyricon has joined #neo900
Sicelo has joined #neo900
DocScrutinizer05 has quit [Disconnected by services]
DocScrutinizer05 has joined #neo900
pabspabspabs has joined #neo900
pabs3 is now known as Guest82492
Guest82492 has quit [Killed (morgan.freenode.net (Nickname regained by services))]
pabspabspabs is now known as pabs3
Oksana has quit [Read error: Connection reset by peer]
Oksana has joined #neo900
arcean has joined #neo900
freemangordon_ has joined #neo900
illwieckz has joined #neo900
illwieckz has quit [Changing host]
illwieckz has joined #neo900
illwieckz has quit [Ping timeout: 276 seconds]
chainsawbike has quit [Ping timeout: 265 seconds]
chainsawbike has joined #neo900
ds2 has quit [Ping timeout: 244 seconds]
<enyc> DocScrutinizer05: err... unless you do the ipv6only=true thing or have set sysctl net.ipv6.bindv6only=0 listening on [::]:port listens for IPv6 AND IPv4 connections in a single socket
<enyc> i was aware of nginx having rubbish default config not listening for IPv6 ah all by default in debian but i think this has since been fixed
pagurus has joined #neo900
SylvieLorxu has joined #neo900
paulk-collins has joined #neo900
galiven_ has quit [Ping timeout: 260 seconds]
maddagaska has quit [Ping timeout: 264 seconds]
maddagaska has joined #neo900
ossguy has joined #neo900
xes has quit [Read error: Connection reset by peer]
xes_ has joined #neo900
illwieckz has joined #neo900
jonsger has joined #neo900
freemangordon_ has quit [Quit: Leaving.]
jonwil has joined #neo900
dos1 has quit [Ping timeout: 244 seconds]
dos1 has joined #neo900
<pigeons> thanks enyc
<pigeons> ah he's not here
<pigeons> ~later
<infobot> it has been said that later is now
<pigeons> ~tell
<pigeons> ~onjoin DocScrutinizer05 enyc points out you need to add ipv6only=true in each of your listen lines that have [::]:port or else nginx also listens on ipv4 on the same socket
<DocScrutinizer05> well, that's pretty much what I want, no?
<DocScrutinizer05> forget ~onjoin, won't work afaik
<pigeons> oh you are here
<DocScrutinizer05> and if it works, I hope you put your command onto a postit note, to revert it eventually, since onjoin is sticky forever
<DocScrutinizer05> ;-)
arcean has quit [Read error: Connection reset by peer]
<pigeons> so since it doesnt work i don't have to do anything?
<DocScrutinizer05> I'm not quite sure if it works
<DocScrutinizer05> prolly I just suck on the right syntax
<DocScrutinizer05> I made it work once, years ago
<DocScrutinizer05> for infobot in #maemo
<DocScrutinizer05> infobot told itself on joining: "docscrutinizer: infobot joined" and I had an autoresponder on that string setting infobot +V
<pigeons> as for the dual socket. I really don't know. also default is ipv6only=true aparently starting with nginx 1.3.4
<DocScrutinizer05> well, neo900.org works on IPv4 and 6 now
<pigeons> yes, that's the main goal
<DocScrutinizer05> so unless there are race conditions now, I think everything fine
<pigeons> oh and its =on not true
<DocScrutinizer05> ((onjoin)) the nasty part is: there's _no_ way tolist existing onjoins
<DocScrutinizer05> and you only can revert an onjoin when you know the exact parameters used to add it
<pigeons> the only caveat i find is ipv4 addreses are translated to ipv6 addresses with a mapping if its =off for log files and such which may allow blacklist evading and similar
<pigeons> ok well my onjoin add is logged just in case
DocScrutinizer05 has left #neo900 ["systemd breaking up recursion in dbus"]
DocScrutinizer05 has joined #neo900
<DocScrutinizer05> and seems it failed anyway. otherwise infobot should have said something, either in chan or in query
<DocScrutinizer05> I don't see a response in chan. Did it answer to your command in PM?
<pigeons> no
<DocScrutinizer05> then it got ignored
<DocScrutinizer05> ~+help onjoin
<infobot> Desc: get/set OnJoin message (needs chan option +OnJoin)
<infobot> Usage: onjoin [#chan|_default] [-]<nick> [message]
<infobot> Example: onjoin infobot Hey! It's another infobot!
<DocScrutinizer05> ~+chanset #neo900
<infobot> chan: #neo900 (see _default also)
<infobot> _time_added => 1382873955, autojoin => infobot, factoidSearch => $chan #maemo _default, sed => 0
<DocScrutinizer05> ~+chanset _default
<infobot> Default channel settings
<infobot> BZFlag => 1, Debian => 1, DebianExtra => 1, Dict => 1, Exchange => 1, Factoids => 1, HTTPDtype => 1, Kernel => 1, Math => 1, Plug => 1, Quote => 1, RootWarn => 1, Rss => 1, Search => 1, Topic => 1, Units => 1, Uptime => 1, UserInfo => 1, Weather => 1, Zippy => 1, addressCharacter => ~, allowConv => 1, allowTelling => 1, botmail => 1, case => 1
<infobot> chanlimitcheckPlus => 60, cookie => 1, countdown => 1, debian => 1, debianRefreshInterval => 7, dice => 1, dns => 1, exchange => 1, factoidArguments => 1, factoidDeleteDelay => 7, factoidPreventForgetLimit => 100, factoidPreventForgetLimitTime => 180000, factoidSearch => _default, floodMessages => 10:30, floodRepeat => 2:10, freshmeat => 1
<infobot> insult => 1, ircTextCounters => heh hah :) ? hi lol, joinfloodCheck => 1, karma => 1, lart => 1, limitcheckInterval => 60, limitcheckPlus => 60, log => 1, maxListReplyCount => 30, md5 => 1, minVolunteerLength => 50, newsDefaultExpire => 7, newsKeepRead => 1, newsNotifyAll => 1, nickometer => 1, pager => 1, piglatin => 1, randomFactoidInterval => 60, reverse => 1
<infobot> rss => 1, scramble => 1, sed => 1, seen => 1, seenFlushInterval => 120, seenMaxDays => 900, seenStats => 1, seenStoreAll => 1, sendPublicLimitBytes => 1000, slashdot => 1, spell => 1, tell => 1, translate => 1, upsidedown => 1, verstats => 0, wikipedia => 1, wtf => 1, zfi => 1, zsi => 1
<DocScrutinizer05> no +OnJoin in effect
<DocScrutinizer05> ~+ircstats
<infobot> Currently I'm hooked up to chat.freenode.net:6667 but only for 4d 1h 34m 1s. I had to reconnect 3 times. Connectivity: 100.00 %
<DocScrutinizer05> ~+stats
<infobot> Since Mon Aug 1 12:24:20 2016, there have been 1 modification, 98 questions, 0 dunnos, 0 morons and 65 commands. I have been awake for 4d 1h 34m 27s this session, and currently reference 119589 factoids. I'm using about 85592 kB of memory. With 0 active forks. Process time user/system 629.63/10.31 child 0/0
jnc has quit [Ping timeout: 258 seconds]
ceene has quit [Ping timeout: 258 seconds]
<DocScrutinizer05> ~piglatin many useless feature are to be found in this bot as well
<infobot> anymay uselessway eaturefay areway otay ebay oundfay inway isthay otbay asway ellway
ceene has joined #neo900
jonwil has quit [Quit: ChatZilla 0.9.92 [SeaMonkey 2.40/20160120202951]]
Satyricon has quit [Ping timeout: 265 seconds]
Satyricon has joined #neo900
Pali has joined #neo900
xes_ is now known as xes
Satyricon has quit [Excess Flood]
Satyricon has joined #neo900
herpderphurr has quit [Ping timeout: 258 seconds]
Satyricon has quit [Excess Flood]
Satyricon has joined #neo900
jnc has joined #neo900
Satyricon has quit [Ping timeout: 276 seconds]
Satyricon has joined #neo900
galiven has joined #neo900
Satyricon has quit [Ping timeout: 240 seconds]
Satyricon has joined #neo900
Wizzup has quit [Read error: Connection reset by peer]
xman has joined #neo900
ds2 has joined #neo900
paulk-collins has quit [Quit: Leaving]
Satyricon has quit [Ping timeout: 244 seconds]
Satyricon has joined #neo900
illwieckz has quit [Ping timeout: 240 seconds]
pabs3 has quit [Ping timeout: 250 seconds]
pabs3 has joined #neo900
jnc has quit [Ping timeout: 258 seconds]
tsuggs has quit [Quit: No Ping reply in 180 seconds.]
tsuggs has joined #neo900
tsuggs has quit [Ping timeout: 244 seconds]
tsuggs has joined #neo900
chomwitt has quit [Ping timeout: 260 seconds]
jonsger has quit [Ping timeout: 260 seconds]
chomwitt has joined #neo900
tsuggs has quit [Ping timeout: 260 seconds]
tsuggs has joined #neo900
Satyricon has quit [Ping timeout: 250 seconds]
Satyricon has joined #neo900
lobito has quit [Quit: Leaving.]
Satyricon has quit [Ping timeout: 244 seconds]
jnc has joined #neo900
Wizzup has joined #neo900
Satyricon has joined #neo900
tsuggs has quit [Quit: No Ping reply in 180 seconds.]
tsuggs has joined #neo900
Satyricon has quit [Ping timeout: 240 seconds]
lkcl has quit [Ping timeout: 240 seconds]
Satyricon has joined #neo900
paulk-aldrin has joined #neo900
jnc has quit [Ping timeout: 258 seconds]
xman has quit [Ping timeout: 276 seconds]
Satyricon has quit [Ping timeout: 258 seconds]
dal has quit [Ping timeout: 240 seconds]
Satyricon has joined #neo900
lkcl has joined #neo900
ravelo has joined #neo900
<ravelo> awesome work is happening
<ravelo> thanks also for the blogposts
<DocScrutinizer05> ravelo: welcome
<DocScrutinizer05> indeed particularly werner developed some groundbreaking new stuff unique to the world of EE and EDA
<DocScrutinizer05> graphical schematics diffs
<ravelo> wow
<ravelo> at our company we already thought about pdf diff
dal has joined #neo900
<ravelo> the short news are very important
<ravelo> i even thought about helping a bit
<ravelo> but now you started again
<ravelo> and i have no time
<ravelo> cya
ravelo has quit []
ksx4system has quit [Ping timeout: 240 seconds]
ksx4system_ has joined #neo900
ksx4system_ is now known as ksx4system
chomwitt has quit [Ping timeout: 244 seconds]
ossguy has quit [Quit: leaving]
chomwitt has joined #neo900
stefek99_ has joined #neo900
paulk-aldrin has quit [Remote host closed the connection]
dal has quit [Ping timeout: 240 seconds]
jonsger has joined #neo900
jonsger has quit [Ping timeout: 260 seconds]
dal has joined #neo900
dal has quit [Ping timeout: 240 seconds]
chainsawbike has quit [Quit: yep... i broke it good that time...]
chainsawbike has joined #neo900
tokage is now known as Muhammad
Muhammad is now known as tokage
SylvieLorxu has quit [Quit: ZNC - http://znc.in]
SylvieLorxu has joined #neo900
dal has joined #neo900
stefek99_ has quit [Quit: Connection closed for inactivity]
chainsawbike has quit [Ping timeout: 258 seconds]