<gemlog>
I thought they were certs from globalsign. I like your version of things better
<geofft>
"Your private key is on your machine and never leaves."
<geofft>
a cert is a signature
<geofft>
the standard process of getting an SSL cert (this is not Sandstorm-specific) is to generate a private key, and then ask a CA for a signature of the public key
<gemlog>
ah
<geofft>
a cert is a signed document from the CA saying "I've been convinced that this public key belongs to the person who owns this domain name"
<gemlog>
like someones pgp key
<geofft>
yeah
<geofft>
_very_ similar to a signature on a PGP key, yes
<geofft>
so the only things government coercion, a malicious employee, a hacker, etc. could do is sign a cert for a key that doesn't belong to you, or refuse to sign a cert for a key that does belong to you (DoS)
<gemlog>
ok, so I'm no more vulnerable than when I generate ssh keys for myself, except someone vouched for me
<gemlog>
thx
<geofft>
there isn't a good answer for the first case right today, but Certificate Transparency is getting there
<gemlog>
I wasn't clear on ssl
<gemlog>
obviously :-)
<gemlog>
so how did the big thing with ssl keys being backdoored come to pass then (with the nsa)
<geofft>
which thing?
<gemlog>
I'll go look
<geofft>
there was a thing in the news a year back about a random-number algorithm that was backdoored, but that's not directly relevant to SSL keys
<geofft>
(it could be used to compromise SSL _connections_, except that just about no one actually used that algorithm)
<gemlog>
could have been that
<geofft>
the only other thing I can think of was the Debian thing, which was an honest mistake -- someone commented out a line of code they didn't understand, Debian OpenSSL only generated 65536 possible private keys
<geofft>
so you could just run Debian's OpenSSL in a loop and generate all possible private keys pretty quickly.
<gemlog>
I remember that. just an oops.
<gemlog>
I'm completely comfortable using ssh, which is basically the same math. It would be nice to integrate. ssh now does this.
<gemlog>
use pgp/gpg keys
<gemlog>
so why can't I auth to https with my pgp/gpg/ssh key
<gemlog>
I know I can't, I'm just asking how hard it would be to implement.
<gemlog>
would need a new protocol
<gemlog>
and would just end up with bots signing keys for other bots....
jadewang has joined #sandstorm
jadewang has quit [Ping timeout: 240 seconds]
saneki has quit [Ping timeout: 264 seconds]
saneki has joined #sandstorm
jparyani_letscha has quit [Ping timeout: 264 seconds]
mort___ has joined #sandstorm
jadewang has joined #sandstorm
mort___ has quit [Quit: Leaving.]
jadewang has quit [Ping timeout: 244 seconds]
xet7 has joined #sandstorm
xet7 has quit [Quit: Leaving]
xet7 has joined #sandstorm
jadewang has joined #sandstorm
jadewang has quit [Ping timeout: 240 seconds]
jadewang has joined #sandstorm
jadewang has quit [Ping timeout: 264 seconds]
mort___ has joined #sandstorm
mort___ has quit [Quit: Leaving.]
mort___ has joined #sandstorm
jadewang has joined #sandstorm
_whitelogger has quit [Remote host closed the connection]
_whitelogger_ has joined #sandstorm
cbaines has joined #sandstorm
jadewang has joined #sandstorm
jadewang has quit [Ping timeout: 256 seconds]
mort___ has joined #sandstorm
rustyrazorblade has quit [Quit: rustyrazorblade]
mort___ has quit [Quit: Leaving.]
spangattack has quit [Ping timeout: 240 seconds]
jadewang has joined #sandstorm
keturn has joined #sandstorm
jadewang has quit [Ping timeout: 260 seconds]
mort___ has joined #sandstorm
xet7 has quit [Ping timeout: 244 seconds]
xet7 has joined #sandstorm
mort___ has quit [Quit: Leaving.]
isd has joined #sandstorm
mort___ has joined #sandstorm
jadewang has joined #sandstorm
mcpherrin has left #sandstorm [#sandstorm]
nander has quit [Ping timeout: 246 seconds]
spangattack has joined #sandstorm
<gemlog>
So, I'm having a lot of fun running the new ssl install script behind a nat! :-)
<gemlog>
No, oauth still doesn't work and I can't gain admin, but I noticed that I could invite from the :6080 console, so I invited myself with another email address.
<gemlog>
:-)
<gemlog>
using passwordless login.
<gemlog>
Now I'm thinking I could probably do the same to gain admin
<gemlog>
?
<gemlog>
I think that the common need to run behind a nat is important. Not business model important, but philosophically important.
<gemlog>
I was showing some teenagers this morning and they were all over it with enthusiasm.
<gemlog>
Should mention, the ssl bit /is/ working fine.
<gemlog>
oh, I did have to start/stop the sandstorm service to make the invite work
<gemlog>
so it's not just oauth, but auth in general
<ckocagil>
"Your app ID is actually its public key. The private key was placed in your keyring"
<ckocagil>
I don't see any sandstorm key in my keyring...
<dwrensha>
ckocagil: in ~/.sandstorm or ~/.sandstorm-keyring ?
<dwrensha>
see also `spk getkey` and `spk listkeys`
<ckocagil>
dwrensha: ah, it's under ~/.sandstorm
<ckocagil>
I thought it'd imported to the system keyring
<gemlog>
More clues.
<gemlog>
immaculata 09-2025 ~> spk listkeys
<gemlog>
*** Uncaught exception ***
<gemlog>
sandstorm/util.c++:48: failed: open(name.cStr(), flags, mode): No such file or directory; name = /home/gemlog/.sandstorm-keyring
<ckocagil>
"spk getkey out.spk: key not found in keyring"
<gemlog>
I'm going to log out now. Ping gemlog at gemlog dot ca if any of that was useful for the nat problem
gemlog has left #sandstorm ["Konversation terminated!"]
<dwrensha>
ckocagil: it's `spk getkey <appid>`
jadewang has quit [Remote host closed the connection]
nander has joined #sandstorm
nander has quit [Changing host]
nander has joined #sandstorm
achernya_ is now known as achernya
xet7_ has joined #sandstorm
ocdtrekkie_ has joined #sandstorm
xet7 has quit [*.net *.split]
ocdtrekkie has quit [*.net *.split]
neynah has joined #sandstorm
pcuci has joined #sandstorm
Pistachette has joined #sandstorm
<pcuci>
Hi there, I'm trying to setup sandstorm, I picked up dev env setup for my local Ubuntu box option [2]
<paulproteus>
Hi pcuci
<paulproteus>
Cool
<neynah>
@pcuci is from Meteor's hackathon so please help him asap. :D
<neynah>
Time is of the essence
<paulproteus>
pcuci: Tell me more about why you're trying to set up Sandstorm, btw
<paulproteus>
I ask because if you're setting up Sandstorm for the purpose of packaging an app, by far the easiest way to do that is to follow the docs on packaging an app rather than the "install Sandstorm" docs.
<zarvox>
but hopefully working through the tutorial is straightforward!
acous has quit [Ping timeout: 265 seconds]
acous has joined #sandstorm
chris_severs_ has joined #sandstorm
saneki_ has joined #sandstorm
gwollon has joined #sandstorm
dlitz_ has joined #sandstorm
gwollon has joined #sandstorm
gwollon has quit [Changing host]
ecloud_ has joined #sandstorm
jjb has joined #sandstorm
saneki has quit [*.net *.split]
dlitz has quit [*.net *.split]
chris_severs has quit [*.net *.split]
ecloud has quit [*.net *.split]
gwillen has quit [*.net *.split]
oao has quit [*.net *.split]
kxra has quit [*.net *.split]
chris_severs_ is now known as chris_severs
mort___ has quit [Quit: Leaving.]
kxra has joined #sandstorm
KaZeR has quit [Ping timeout: 250 seconds]
jacksingleton has joined #sandstorm
<pcuci>
zarvox: ok, I get a hand of it, it's like a Tomcat container, but for any kind of app, and handles SSO
<pcuci>
cool, do I need to set it up locally, or can I deploy directly to sandstorm.io like I do to meteor.com?
home_ has joined #sandstorm
<zarvox>
pcuci: You'll need to set up locally for development, but you can make a .spk and redistribute it, or submit it to the app market
<zarvox>
People can also try out your app on demo.sandstorm.io
<pcuci>
zarvox:cool, looks like I need to update my .bashrc to get the ~/bin path working, brb
<zarvox>
pcuci: to get vagrant-spk on your PATH? yeah, you can either add the path in your .bashrc, or specify the full path to the vagrant-spk binary in your commands; either will do
<rpersaud>
is that the best way to deploy meteor app on sandstorm hosting?
<pcuci>
zarvox: meteor-spk init - I ran this at the same level with .meteor - it created a file it tells me I should keep secret, but I keep my code in GitHub. Another best practice?
<zarvox>
pcuci: ahhh, if you're already on Linux, that'll do (though it's less documented). If you're on OSX or Windows, you'll need to use vagrant-spk.
<pcuci>
zarvox:any idea why the seg fault?
<pcuci>
meteor-spk: line 67: 28723 Segmentation fault (core dumped)
luckre has joined #sandstorm
<zarvox>
pcuci: hmmm, that's weird. Do you have an LD_LIBRARY_PATH set or something, that might be overriding a library?
<zarvox>
You might also consider doing the vagrant-spk tutorial, which will do the work in a virtual machine, which is a much more controlled/likely-to-work-the-first-time environment :)
<pcuci>
npm ERR! Please try running this command again as root/Administrator.
<zarvox>
that's not right; you should own your .npm folder, not root :/
<zarvox>
try taking ownership with "sudo chown -R paul:paul ~/.npm"
<pcuci>
sandstorm/run-bundle.c++:978: failed: You do not have permission to read the pidfile directory. Perhaps your user account is not a member of the server's group?
<pcuci>
zarvox:did the chown -R thing, now this ^
<zarvox>
okay, so it got farther - it got to the part where (under the hood) it runs "spk dev"
<pcuci>
I remember reading sandstorm user should've been added to sudoers?
<zarvox>
the user you're running as should be added to the group the sandstorm server is running as
<zarvox>
usually you install sandstorm with the "curl | sudo bash" as the user you're going to be doing development as, and then the permissions should work right out of the box
<zarvox>
pcuci: which user owns /opt/sandstorm/var/pid, and which group?
<pcuci>
-rw-rw---- 1 root sandstorm 6 Oct 10 17:03 sandstorm.pid
<pcuci>
-rw-rw---- 1 sandstorm sandstorm 2 Oct 10 17:03 mongo.pid
<pcuci>
zarvox: ^
<zarvox>
okay, so things are running as sandstorm - is your user in the sandstorm group?
<zarvox>
"groups" will print the groups you're a member fo
<zarvox>
s/fo/of/
<pcuci>
paul : paul adm cdrom sudo dip plugdev lpadmin sambashare libvirtd