Damus

Recent Notes

Wolf480pl · 2w
nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqsld6cd53kj8pkz9svnnt54um57nvwrlx9sgya7xhvhl5a5a4f3sqdxhcxx that's... concerning
Wolf480pl · 2w
nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqsld6cd53kj8pkz9svnnt54um57nvwrlx9sgya7xhvhl5a5a4f3sqdxhcxx does it know which namespace it's in?
Alexander Monakov profile picture
AppArmor's default profile for curl restricts creating output files outside of /tmp and /home (curl's openat(... O_CREAT ...) fails with -EACCES).

Brilliant. Nobody ever will try to use curl outside of those two directories, especially in containers, and spend some time wondering what the heck's going on.
1
Wolf480pl · 2w
nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqsld6cd53kj8pkz9svnnt54um57nvwrlx9sgya7xhvhl5a5a4f3sqdxhcxx out of curiosity: how does AppArmor see paths inside containers?
Wolf480pl · 3w
nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqsld6cd53kj8pkz9svnnt54um57nvwrlx9sgya7xhvhl5a5a4f3sqdxhcxx *actually, more like forwarding table entry, after any recursive `via`-s have been re...
Alexander Monakov profile picture
@nprofile1q... thanks, I appreciate the info.
Other rough edges:
1) inverse behavior of forwarding sysctls on Linux (need net.ipv6.conf.all.forwarding=1, doing net.ipv6.conf.<iface>.forwarding=1 for two interfaces doesn't work, while for ipv4 it does)

2) software being opinionated (while insufficiently documenting the behavior) about using ipv6 on dual-stack (looking at you, Firefox)
1
Wolf480pl · 3w
nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqsld6cd53kj8pkz9svnnt54um57nvwrlx9sgya7xhvhl5a5a4f3sqdxhcxx yeah, add to the second one the IPV6_V6ONLY sockopt...
Wolf480pl · 3w
nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqsld6cd53kj8pkz9svnnt54um57nvwrlx9sgya7xhvhl5a5a4f3sqdxhcxx damn it, wish there was a doc I could recommend to you but... building intuition from disparate snippets is my superpower :/ I did read a few RFCs around Neighbour Discovery Protocol t...
Wolf480pl · 3w
nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqsld6cd53kj8pkz9svnnt54um57nvwrlx9sgya7xhvhl5a5a4f3sqdxhcxx what rough edges have you found so far?
Wolf480pl · 4w
nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqsld6cd53kj8pkz9svnnt54um57nvwrlx9sgya7xhvhl5a5a4f3sqdxhcxx silly idea: repro with curl, email to devops@<company>
Alexander Monakov profile picture
Once again I find myself in need of a shibboleet (https://xkcd.com/806/). See, I have this app on the phone that according to Play reviews broke a few weeks ago (I use it rarely, so only noticed now). Company responds to each negative review by asking to email them.

I fire up logcat, grab the exception trace (yes, it was DNS), email them. They reply with the basic support template, asking for screenshots and personal data that I entered when registering in the app.

What would you do?