N0x0n

joined 1 year ago
[–] N0x0n@lemmy.ml 1 points 6 months ago (4 children)

Hello !

Version 6.1.1 (250) arm64-v8a https://f-droid.org/en/packages/chat.simplex.app/ https://f-droid.org/repo/chat.simplex.app_250.apk

Here's the analysis: https://www.hybrid-analysis.com/sample/9b14b4f80b479a7eb2a5e9fb22ad3f5d547690f4e30da6b5c6f0e9ed8d4039da/672727b3fd3db6063b002513

Same exact result:

  • Pattern match: "https://android.googlesource.com/toolchain/llvm-project"
  • Pattern match: "https://developers.google.com/protocol-buffers///"
  • Pattern match: "https://issuetracker.google.com/issues/new?component=618491&template=1257717"

Dunno if this is something we should worry about or not ? Maybe OP and myself are not educated enough to interpret the results, however I'm also not very comfortable seeing those Found potential URL in binary/memory from SimpleX's APK. Do you have any further thoughts?

Thanks.

[–] N0x0n@lemmy.ml 1 points 6 months ago (6 children)

For using Obtainium, how do you avoid or block all apps from Github that depend on GCM, Firebase, or Google services?

You do have a point though, but how does that even comes into the mix? Obtainium fetches directly from the source (api.github.com).

But to answer your question, it's blocked at the DNS level with RethinkDNS. Blocking all requests, except those explicitly allowed by myself.

This seems more like hardcoded into the .APK or that we can't correctly interpret the results or something is wrong in the analysis. And I'm also curious to get more Info's from someone.

[–] N0x0n@lemmy.ml 3 points 6 months ago* (last edited 6 months ago) (10 children)

I tried it with the official github .apk and same result. I have no idea what it means though maybe someone could chime in?

Found potential URL in binary/memory:

  • Pattern match: "https://issuetracker.google.com/issues/new?component=618491&template=1257717"
  • Pattern match: "https://android.googlesource.com/toolchain/llvm-project"
  • Pattern match: "https://developers.google.com/protocol-buffers///"

Except that they need something to make an android application (android SDK) and somehow to get issuetracker feedbacks, there's nothing to worry about ? I guess? I don't know.

[–] N0x0n@lemmy.ml 2 points 6 months ago

Haha! Seriously? This works? I mean they will probably just disable your account that's all, but that's a neat trick if it works !

[–] N0x0n@lemmy.ml 2 points 6 months ago

This is a neat workaround !! Still, for privacy reason I keep my addons to a strict minimum.

However I save your comment as emergency workaround ! Thanks for the tip !

[–] N0x0n@lemmy.ml 2 points 6 months ago* (last edited 6 months ago) (1 children)

While I do get most of them, I'm really confused by NOR and XNOR.

Why is there suddenly and out of bound mask outside the circles? (If that does make sense :/)

PS: sorry for the serious question XD I probably don't get the joke?

[–] N0x0n@lemmy.ml 6 points 6 months ago (1 children)

Not sure if this is what happend, but there is a sync option in samba where you can sync your samba user password with login user password.

However this needs explicitly be stated in the samba.conf and needs some further configuration. It could be possible that the installation fuckedup something with passwd.

Just guessing here, I played a bit arround with samba and password syncing.

[–] N0x0n@lemmy.ml 8 points 6 months ago* (last edited 6 months ago)

From another poster above, it seems only Windows machines are affected.

[–] N0x0n@lemmy.ml -3 points 6 months ago* (last edited 6 months ago) (6 children)

I get your feeling :) Don't worry the silent majority is on your side. However they won't comment because they fear from being banned or backslashed....

While It can't be proven or disapproved, I also had my share of strange coincidence where my mind goes "Huh? How is that even possible?"... Kinda strange feeling! But that feeling gave me the push to the privacy route maybe in a rather to extreme direction? Always follow your guts when there's to much noise to make a clear decision.

  • RethinkDNS (block every in/out request except those manually allowed)
  • Degoogles android (Shizuku+canta, magisk, debloater)
  • Only open source apps and delete everything else (no exceptions here) -....

You will never get full 100% privacy or anonymity, however you can make your data as much as difficult to get and waste some of their resource and time :).

Good luck !

[–] N0x0n@lemmy.ml 4 points 6 months ago

Yeah... This was probably intentional. Now we get why ! They didn't put to much effort for the self-hosted version, because they didn't want you to self-host.

[–] N0x0n@lemmy.ml 29 points 6 months ago (1 children)

Hummm... Guess you're to sensible? I mean I'm die hard linux lover for 3 years now and will never switch back to Windows... EVER!

However, I found some of those posts quite funny !

[–] N0x0n@lemmy.ml -1 points 6 months ago* (last edited 6 months ago)

I think it was... Cyberwar/crime is the new kind of war, it can be deadly and put a whole country/system on halt with a lot of consequences (human and resources).

Most people would call out conspiracy theory, but I do firmly believe that those higher ups are doing WAY more bad things behind our backs than we can imagine.

But hey we have no proofs, except those lost trails left by good people who need to hide their own asses because the government are looking for them for crime against the government?

That's exactly why I value privacy and doing everyday my best to leave as less information about me as possible. Sure they have the mean/money to find where I live in seconds but they won't get that information without a fight ! F#CK big corporations !

 

Hello again :)

I'm not talking about a broken wg connection, everything works as expect through the CLI and systemctl.

But the NetworkManger GUI in Gnome shows my Wireguard connection as it was "not connected" and when I click on the switch it actually disconnects my wg interface.

Also when I try to edit my connection through

nmcli connection modify wg0 connection.autoconnect yes

and restart my wireguard connection with

systemctl restart wg-quick@wg0

It recreates a new wireguard interface.

While everything works as expected with the usual tools (wg-quick, systemctl...) the GUI seems "broken".

Someone else noticed or is this somehow related to my setup?

Debian 12 bookworm
Gnome 
nmcli tools 1.42.4
 

Solved

After interesting/insightful inputs from different users, here are the takeaways:

  • It doesn't have some critical or dangerous impact or implications when extracted
  • It contains the tared parent folder (see below for some neat tricks)
  • It only overwrites the owner/permission if ./ itself is included in the tar file as a directory.
  • Tarbombs are specially crafted tar archives with absolute paths / (by default (GNU) tar strips absolute paths and will throw a warning except if used with a special option –absolute-names or -P)
  • Interesting read: Path-traversal vulnerability (../)

Some neat trick I learned from the post

Temporarily created subshell with its own environment:

Let’s say you’re in the home directory that’s called /home/joe. You could go something like:

> (cd bin && pwd) && pwd
/home/joe/bin
/home/joe

source

Exclude parent folder and ./ ./file from tar

There are probably a lot of different ways to achieve that expected goal:

(cd mydir/ && tar -czvf mydir.tgz *)

find mydir/ -printf "%P\n" | tar -czf mytar.tgz --no-recursion -C mydir/ -T - source


~~The absolute path could overwrite my directory structure (tarbomb) source Will overwrite permission/owner to the current directory if extracted. source~~

I'm sorry if my question wasn't clear enough, I'm really doing my best to be as comprehensible as possible :/


Hi everyone !

I'm playing a bit around with tar to understand how it works under the hood. While poking around and searching through the web I couldn't find an actual answer, on what are the implication of ./ and ./file structure in the tar archive.

Output 1

sudo find ./testar -maxdepth 1 -type d,f -printf "%P\n" | sudo tar -czvf ./xtractar/tar1/testbackup1.tgz -C ./testar -T -
#output
> tar tf tar1/testbackup1.tgz 

text.tz
test
my
file.txt
.testzero
test01/
test01/never.xml
test01/file.exe
test01/file.tar
test01/files
test01/.testfiles
My test folder.txt

Output 2

sudo find ./testar -maxdepth 1 -type d,f  | sudo tar -czvf ./xtractar/tar2/testbackup2.tgz -C ./testar -T -
#output
>tar tf tar2/testbackup2.tgz

./testar/
./testar/text.tz
./testar/test
./testar/my
./testar/file.txt
./testar/.testzero
./testar/test01/
./testar/test01/never.xml
./testar/test01/file.exe
./testar/test01/file.tar
./testar/test01/files
./testar/test01/.testfiles
./testar/My test folder.txt
./testar/text.tz
./testar/test
./testar/my
./testar/file.txt
./testar/.testzero
./testar/test01/
./testar/test01/never.xml
./testar/test01/file.exe
./testar/test01/file.tar
./testar/test01/files
./testar/test01/.testfiles
./testar/My test folder.txt

The outputs are clearly different and if I extract them both the only difference I see is that the second outputs the parent folder. But reading here and here this is not a good solution? But nobody actually says why?

Has anyone a good explanation why the second way is bad practice? Or not recommended?

Thank you :)

 

Hello everyone !

I have no idea if I’m in the right community, because it’s a mix of hardware and some light code/command to extract the power consumption out of my old laptop. I need some assistance and if someone way more intelligent than me could check the code and give feedback :)

Important infos

  • 12 year old ASUS N76 laptop
  • Bare bone server running Debian 12
  • No battery (died long time ago)

Because I have no battery connected to my laptop It's impossible to use tools like lm-sensors, powerstat, powertop to output the wattage. But from the following ressource I can estimate the power based on the Energy.

time=1
declare T0=($(sudo cat /sys/class/powercap/*/energy_uj)); sleep $time; declare T1=($(sudo cat /sys/class/powercap/*/energy_uj))
for i in "${!T0[@]}"; do echo - | awk "{printf \"%.1f W\", $((${T1[i]}-${T0[i]})) / $time / 1e6 }" ; done

While It effectively outputs something, I'm not sure if I can rely on that to estimate the power consumption and if the code is actually correct? :/

Thanks :).

Edit:

My goal is to calculate the power drawn from my laptop without any electric appliance (maybe a worded my question/title wrong?). While It could be easily done with the top package or lm-sensors, this only work by measuring the battery discharge, which in my case is impossible because my laptop is directly connected to the outlet with his power cord (battery died years ago).

I dug a bit further through the web and found someone who asked the same question on superuser.com. While this gives a different reference point, nobody actually could answer the question.

This seems a bit harder than I though and is actually related to the /sys/class/powercap/*/energy_uj files and though someone could give me a bit more details on how this works and what the output actually shows.

This is also related to the power capping framework in the linux kernel? And as per the documentation this is representing the CPU packages current energy counter in micro joules.

So I came a bit closer in understanding how it works and what it does, even tough I’m still not sure what am I actually looking at :\ .

5
submitted 1 year ago* (last edited 1 year ago) by N0x0n@lemmy.ml to c/hardware@lemmy.ml
 

Edit:

Sorry for the bad posting :/. If someone is interested here is my actual post at https://lemmy.ml/post/12594067


Hello everyone !

I have no idea if I’m in the right community, because it’s a mix of hardware and some light code/command to extract the power consumption out of my old laptop. I need some assistance and if someone way more intelligent than me could check the code and give feedback :)

Important infos

  • 12 year old ASUS N76 laptop
  • Bare bone server running Debian 12
  • No battery (died long time ago)
  • Running a dozens docker containers.

Because I have no battery connected to my laptop I’m unable to use tools like lm-sensors, powerstat, powertop. But from the following ressource I can estimate the power based on the Energy.

time=1
declare T0=($(sudo cat /sys/class/powercap/*/energy_uj)); sleep $time; declare T1=($(sudo cat /sys/class/powercap/*/energy_uj))
for i in "${!T0[@]}"; do echo - | awk "{printf \"%.1f W\", $((${T1[i]}-${T0[i]})) / $time / 1e6 }" ; done

While It effectively outputs something, I'm not sure if I can rely on that to estimate the power consumption.

Thanks :).

 

Hi everyone :)

I'm slowly getting used on how to navigate and edit things in the terminal without leaving the keyboard and arrow keys. I'm getting faster and It improved my workflow in the terminal (Yeahhii).

ctrl + a e f b u k ...
alt + f b d ...

But yesterday I had such a bad experience while editing a backup bash script with nano. It took me like an hour to completely edit small changes like a caveman and always broke the editor when I used memory reflex terminal shortcuts.

This really pissed me... I know nano also has minimal/limited shortcuts but having to memorize and switch between different one for different purpose seems like a waste of time.

I think I tried emacs a few month ago but It didn't clicked. I didn't spend enough time though, tried it for a few minutes and deleted it afterwards. Maybe I should give it a second try?

I also gave Vim a try, but that session is still open and can't exit (😂 )! Vim seems rather to complex for my workflow, I'm just a self-taught poweruser making his way through linux. Am I wrong?

Isn't there something more "universal" ? That works everywhere I go the same? Something portable, so I can use it everywhere I go?

I'm very interested in everyone's thought, insight, personal experience and tip/tricks to avoid what happened yesterday !

Thanks !

 

First of all, thank you to all the amazing things you do for the self-hoster, FOSS comunity ! We won't be able to have those shiny things without you ! I'm not a dev and have just played arround with python (and I know how most of you feel about it 🤫) so I have very limited knowledge regarding programming languages.

I know whats a low level language (C, C#, rust?), general scripting tools and even heard about assembly. And it always baffles me how all those coding lines rule and make our microchips communicate and understand each other, but that's another story ! This is about golang !


As a self-hoster enthousiast, when I'm looking at a github repository, I always check the programing language used, even though I have no idea if those integrate well with each other or if it's the best programming language for that kind of application.

And everytime I see golang, It makes me smile and have a feeling it's going to be a good application. I know it also depends on the programmer skills and creativity, but all my self-hosted Go apps works like a charm.

Traefik is the best example, I never had any issue or strange behavior, except for wrong configuration files on my side,

Or navidrome a music server compatible with subsonic, also written in go, is working great and fast AF !

Or Vikunja, the todo app... and many more !

I'm probably biased because I have no idea of how the programing realm works, but I have the feeling that Golang is a certificate for good working and fast applications. Just to bad it's backed/supported by google (uuhhg)

Feel free to debate and give me your personal opinion of the Go language, if my feelings are right or Am I just beeing silly :).

Thanks for reading through 👋

view more: ‹ prev next ›