Pablo Bianchi's questions

WebP image files are becoming more and more common on the web. Eye of GNOME (eog) doesn't support it out-of-the-box. Some browsers do, and ImageMagick just installing webp package (magick/convert -list format).

A simple search let you to webp-pixbuf-loader but might be not that easy for beginners.

Reference

• Old issue on Bugzilla: Bug 700751 – Support of images in format "WebP" in EOG.

• Newer issue on GitLab: Cannot open WebP file.

  eog uses GDK-PixBuf, which does not provide support for most formats itself (due to maintainability), but instead has support for formats added by the libraries that actually implement the image format. Currently libwebp, the library in question, does not provide any loader for GDK-PixBuf, but the linked repository (https://github.com/aruiz/webp-pixbuf-loader) provides one.

• Downstream on Launchpad on gdk-pixbuf (duplicated on libwebp) and eog.

• On Debian

  • David Heidelberg / webp-pixbuf-loader · GitLab.
  • #907306 - configure: error: gdk-pixbuf-query-loaders not found in path - Debian Bug report logs.

With COVID-19 pandemic there was a boom of video conferencing. Although there are good free and open source alternatives like Jitsi (with e2ee coming soon), Zoom became popular. Is not a secret that have some privacy issues (EFF, ProtonMail Blog, The Guardian, The Verge).

For the ones forced to install it, it would be nice to have a friendly way to install it and run it without giving up privacy so easily. Maybe using it inside a sandbox like firejail (there is a zoom profile), selecting file system access.

If installed using snap package: It's worth noting that even removing "Play and record sound" from Permissions on Ubuntu software it's still can play and record sound. IMO a serious security bug on snapd/snappy/snap-store. Maybe this wouldn't happen on Wayland?

Also, audio-record connection (AKA interface) shouldn't auto-connect, but people behind snap store override this rule on purpose.

This article expose how around 18% of HTTPS connections are being detected as intercepted by MITM proxies. As the great related paper states:

To circumvent this validation, local software injects a self-signed CA certificate into the client browser’s root store at install time.
[...]
Contrary to widespread belief, public key pinning [19]— an HTTPS feature that allows websites to restrict connections to a specific key— does not prevent this interception. Chrome, Firefox, and Safari only enforce pinned keys when a certificate chain terminates in an authority shipped with the browser or operating system. The extra validation is skipped when the chain terminates in a locally installed root (i.e., a CA certificate installed by an administrator) [34].

Is pretty common on companies, desktop antivirus and malware/adware to add a root CA. Sometimes even with honest reasons. But to make the situation more clear: SSL web browsing is exactly as strong as the weakest CA (this includes DNS, if DNS-over-HTTPS).

I want to check if my HTTPS traffic is intercepted at least in three aspects (better if just with CLI):

• Google Chrome/Chromium
• Firefox (Red Hat equivalent?)
• Ubuntu official repos/Snap (See ca-certificates & ca-cacert. Red Hat equivalent?)

So the real questions are:

• How to list unofficially installed CA certificates (doesn't come with Ubuntu/Firefox/Chrome) to avoid MITM attacks/HTTPS interception?
• How to reset trusted certificates stores to its default?

Some research and related questions

• checkmyhttps seems old and not trustworthy

• Chrome: chrome://settings/certificates.
  This is a subset of what return some of these commands?

  # System wide (I)
  awk -v cmd='openssl x509 -noout -subject' '/BEGIN/{close(cmd)};{print | cmd}' < /etc/ssl/certs/ca-certificates.crt
  
  # System wide (II) (`p11-kit` package)
  trust list
  

• Firefox

  certutil -L -d ~/.mozilla/firefox/*.default*/
  

• I already sudo update-ca-certificates -v -f. This just updates without removing any sneaky already installed certificate?

Reference

• Chromium - Root Certificate Policy
• Firefox: How to audit & reset the list of trusted servers/CAs
• How can I protect myself against software installing insecure root certificates?
• Who your browser trusts, and how to control it
• All root certificates that Firefox trusts for SSL/TLS (from)

I have this command (for pomodoros):

play -n synth 25:00 pinknoise

I don't want to silent completely the output (-q option), just the header (grep don't work).

Normal output:

File Size: 94.3T     
 Encoding: n/a           
 Channels: 1 @ 32-bit   
Samplerate: 48000Hz      
Replaygain: off         
 Duration: unknown      

In:0.00% 00:00:01.02 [00:00:00.00] Out:49.2k [======|======] Hd:1.3 Clip:0 

Desire filtered output: 01.02 (this number is updated, like in a cURL or pv progress bar)

How can I grep just that part of the output?

So far:

• For some reason the output is sent to stderr, like with "Permission denied" from find. An easy way to test is to add at the end 2> /dev/null.

  Maybe the reason why sox/play output to stderr is because it supports writing the output to standard output (stdout) using the special filename - (see sox man page).

• But |& grep "^In" won't work. Using |& tee log.txt it seems uses the delete character to update the last line.

  I tried grep --line-buffered, unbuffer and stdbuf (after reading this and this) with some great progress:

    play -n synth 25:00 pinknoise  2>&1 | stdbuf -oL tr '\r' '\n' | grep -o '[0-9][0-9]*\.[0-9][0-9] '
  

That's very close!

Is possible to get only just one updated line like was on the original output? Maybe like this loop with echo -ne.

I'm not sure why something like | grep --line-buffered . doesn't work, neither removing trailing newline: | tr -d '\n'. I need something like tail -f -n 1.

I wish to install MarcEdit.

MarcEdit is a closed source app build with .NET that runs over mono. Is usually used on libraries, where MARC records is a common format.

To install security updates automatically I use unattended-upgrade:

$ sudo unattended-upgrade -d | tail -1
No packages found that can be upgraded unattended and no pending auto-removals

I also tried another tool called debsecan (homepage, currently on official repos) to list all packages with any vulnerability of CVE database. On a recently updated Ubuntu 18.04 LTS it returns 967 "remotely exploitable, high urgency" vulnerabilities on 220 packages (7 times more in total):

$ debsecan | grep "remotely exploitable, high urgency" | wc -l
967
$ debsecan | grep "remotely exploitable, high urgency" | col2 | uniq | wc -l
220
$ debsecan | grep -o "CVE-20[0-2][0-9]" | sort | uniq -c
    3 CVE-2007
    2 CVE-2008
    8 CVE-2009
    3 CVE-2012
   14 CVE-2013
    9 CVE-2014
   42 CVE-2015
  173 CVE-2016
  948 CVE-2017
 3616 CVE-2018
 4158 CVE-2019
 3540 CVE-2020
    1 CVE-2021

1. Am I missing something?
2. There is any tool to check for vulnerabilities, maybe a debsecan for Ubuntu, like Red Hat's OpenSCAP (now available! See below). Any other beside OpenVAS or Nessus?

Updates

• 2019: Answer from someone on Ubuntu Security Team:

  In Ubuntu, landscape is the preferred solution for checking security update status.

  We would certainly like for someone to contribute the modifications required to get debsecan working. Here is the bug about debsecan.

  debsecan should be either adjusted (for ubuntu) or removed

• Seems debsecan read this file:

  curl -s https://security-tracker.debian.org/tracker/debsecan/release/1/GENERIC | zlib-flate -uncompress | less
  

  AFAIK (please correct me) since there is no API for Ubuntu Security Advisory (USN), the data from CVE-tracking page or USN (or maybe easier from here, everything on bazaar.launchpad.net seems removed) should be merged [into a JSON and] there.

• 2020-05: UST2DSA

  We've just finished a tool to build debsecan suitable databases from the Ubuntu CVE Tracker data.
  It is open source under Apache 2.0 and it is available here: https://github.com/BBVA/ust2dsa
  Using Github's CI we rebuild the databases every 6 hours for them to contain the latest vulnerability information.
  If anybody want to test the result you just have to run this command in your current Ubuntu installation:
  debsecan --suite $(lsb_release --codename --short) --source https://raw.githubusercontent.com/BBVA/ust2dsa/data/

• 2021-11: Ubuntu’s OVAL data using OpenSCAP

  sudo apt install libopenscap8  # Install OpenSCAP base
  
  wget https://security-metadata.canonical.com/oval/com.ubuntu.$(lsb_release -cs).usn.oval.xml.bz2
  bunzip2 com.ubuntu.$(lsb_release -cs).usn.oval.xml.bz2
  oscap oval eval --report report.html com.ubuntu.$(lsb_release -cs).usn.oval.xml
  xdg-open report.html
  

Trying to learn more about Kubernetes I tried to install a standalone instance. If you try to run minikube terminal? suggest installing it through snap.

sudo snap install minikube kubectl

• snap info minikube

  Minikube is a tool that makes it easy to run Kubernetes locally. Minikube runs a single-node Kubernetes cluster inside a VM on your laptop for users looking to try out Kubernetes or develop with it day-to-day.

• snap info kubectl

  kubectl is a command line interface for running commands against Kubernetes

But that let me with this error:

$ minikube start
There is a newer version of minikube available (v0.32.0).  Download it here:
https://github.com/kubernetes/minikube/releases/tag/v0.32.0
To disable this notification, add WantUpdateNotification: False to the json config file at /home/pablo/snap/minikube/4/.minikube/config
(you may have to create the file config.json in this folder if you have no previous configuration)
Starting local Kubernetes cluster...
E0113 21:27:07.861621   12532 start.go:83] Error starting host: Error creating new host: dial tcp: missing address. Retrying.
E0113 21:27:07.876969   12532 start.go:83] Error starting host: Error creating new host: dial tcp: missing address. Retrying.
E0113 21:27:07.892771   12532 start.go:83] Error starting host: Error creating new host: dial tcp: missing address. Retrying.
E0113 21:27:07.892806   12532 start.go:89] Error starting host:  Error creating new host: dial tcp: missing address
Error creating new host: dial tcp: missing address
Error creating new host: dial tcp: missing address

I tried:

• Almost all suggestions on Github issues: 278, 867, 927, 2294, 2424.
• Installing (already there) libvirt-bin (libvirt-clients libvirt-daemon)
• sudo virsh -c qemu:///system net-start default

Maybe not ready for prime time?

One of the alternatives to work with ESP8266 Wi-Fi microcontroller is using the Arduino IDE. By default, it doesn't come with this board features. Arduino package is too old and doesn't have Board Manager, which is necessary to add ESP8266 add-on.

How should it be added?

Sometimes I need to search files with accented characters (diacritic in general), usually with locate/mlocate. I wish to setup (maybe in /etc/updatedb.conf) so it let me search for this special characters using a certain language mapping, for example:

a == âàáäÂÀÂÄ
e == êèéëÊÈÉË
i == îïíÎÏ
o == ôöóÔÖ
u == ûùüÛÜÙ
c == çÇ
n == ñ

So locate -i liberación also should search for file names with string liberacion and even liberaciòn.

Notes and assumptions

• And maybe others: ÂÃÄÀÁÅÆ ÇÈÉÊËÌÍÎÏ ÐÑÒÓÔÕÖØÙÚÛÜÝÞ ßàáâãäåæç èéêëìíîïðñòóôõö øùúûüýþÿ.
• This is a common situation on romance languages like Spanish, French and German.
• I'm always using a locale 100% UTF-8.
• I would rather not have to use regular expressions.
• A patch might use ASCII transliterations of Unicode as Unidecode/cUnidecode does. Most of mlocate is written on C.

Related

• Similar question but using find
• Miloslav Trmač (mlocate developer) say here that the official source code is on pagure.io (and a fork on Github).
• I file an issue on mlocate repo at Pagure.io to add this feature.
  • Update 2018-02: This can be fixed with this pull request by marcotrevisan. Will add a -t/--transliterate support using iconv to match accented.
  • Update 2018-03: mlocate with support for --transliterate is now included in Ubuntu 18.04 LTS Bionic Beaver (v2 and v3.1).

When double-clicking any video (I tried different formats) VLC just open and close again after around 14 seconds:

It works fine if I:

• Open VLC from terminal or any other way and then open the same file.
• killall nautilus, run nautilus and double-clic the file (that surprise me).
• Use Nemo, Double-commander or other file manager and double-clic the file.

Last think make me think is a nautilus bug, but doesn't happen with any other program.

I tried:

• Bizarre things like tring to fetch stdout/stderr with strace -p`pgrep -l '^vlc$' | col1 | head -1` -s9999 -e write with watch. I couldn't do it.
• On Exec parameter of /usr/share/applications/vlc.desktop I have /usr/bin/vlc --started-from-file %U. Without luck, I tried changing to:
  • /usr/bin/vlc
  • xterm -e "vlc"
  • gnome-terminal -e "vlc". In this last case before previous behavior I get this window:

File format is correctly associated with VLC. If I associate it with other program everything goes fine.

I believe this is a different situation than this one. I already read this, this and this.

Maybe a related useful question could be: How exactly Nautilus run associated program of double-clicked file?

Update 2018-02-12

This happened with Unity, on Ubuntu 16.04. Now with VLC 2.2.2-0-g6259d80 and GNOME nautilus 3.14.3 I don't have this problem anymore. So probably it was a bug on nautilus (since is the same version of VLC).

I write in Spanish and sometimes I use diacritics (ie multi-byte chars) with dead keys, for example "liberación" ("liberation" in Spanish). Usually I don't have any problem, but when the GUI freeze or for any reason it can't handle more input, when the text shows up the diacritic char jump to the first position on the/a keyboard buffer, displaying something like "óliberacin", which is very annoying since occur very often while chatting or writing an email (easier to test: aaaá→áaaa). GNOME/Unity/Hardware couldn't be. Maybe a xserver or libinput or a kernel bug?

I have this problem since more than four years now, with several kernels, Ubuntu versions, hardware and versions of Firfeox and Chorme. I couldn't find any pattern neither something strange on dmesg/journalctl//var/log files...

Setup: This happened to me since Ubuntu 16.04 LTS fresh install, kernel 4.4.0-62-generic; and even recently with 18.04 and 4.15.0-134-generic, GNOME Shell 3.28.4.

$ locale
LANG=en_US.UTF-8
LANGUAGE=en_US
LC_CTYPE="en_US.UTF-8"
LC_NUMERIC=es_AR.UTF-8
[...]
$ im-config -l
ibus xim
$ im-config -m
default
missing
ibus 

ibus
$ env | grep "XMODIFIERS\|IM_"
XMODIFIERS=@im=ibus
CLUTTER_IM_MODULE=xim
QT_IM_MODULE=ibus
IM_CONFIG_PHASE=1
QT4_IM_MODULE=xim
GTK_IM_MODULE=ibus

How can I debug to find where the problem might be?

Update 2021-01-23

I didn't cross with this issue for a while, until today, typing from Desktop to Android (GSconnect → KDE Connect Keyboard). The lagginess due to the info sent to the phone make the UI stall. This could be a good way to reproduce the issue.