Updating and keeping your Gentoo non-poetterized

miroR · l33t Joined: 05 Mar 2008 Posts: 826

Continuing the midori-won't-compile issue.

And the one that there was no reason for it to be blacklisted along with the poetterware, the flag previously `-introspection' allowed in with changing it to `introspection' in the `USE=' flags of /etc/portage/make.conf, that use flag called for these changes in my system:

emerge -tuDN world

miroR · l33t Joined: 05 Mar 2008 Posts: 826

And I know what happened here, thanks to the good leadership of Gentoo Foundation (

but I have to say: pls. inventor of Gentoo, Daniel Robbins, come back, not to rule, but to contribute, esp. by merging Funtoo with Gentoo, back to where that grand knowledge from both belongs: together; but haven't studied that issue, so I have to express reserve for my wish here, in case things are out of hand for that to become true

), [thanks to the good leadership of Gentoo Foundation] that gives us grsecurity-hardened kernel and such great hardened toolchain to compile all packages for hardened, the Gentoo Foundation that gives grsecurity-hardened to the lean but mean numbers of FOSS Linux users worldwide (Gentoo is probably the hardest to learn for a FOSS Linux newbie),

and thanks to grsecurity developers, Bradley spender Spengler and PaX Team (he remains anonymous; has a Hungarian email), who fix what [the little god of the Linux kernel] (read now the continuation in the quote)

miroR · l33t Joined: 05 Mar 2008 Posts: 826

I have also notified the grsecurity devs. So we can have a fine confirmation on this.

I want to add, that I am willing to provide further info on this matter, to Gentoo higer ranking members, just, I would like it to be openly discussed further, and not, if this is what I think it is, attempted to hide under the rug.

([openly discussed further], such as: give us here the lines from the source of that webkit-gtk that hide the code from the syslog, thanks in advance!)

Don't disenpower us, poor users!

However, probably not much more information is needed. It's net-libs/webkit-gtk-2.4.8-r200 which is in everybody's portage, and esp. in those who use, like I do, signed portage snapshots.

(But I'd almost bet that the package will very soon be disappearing from mirrors! --just my guess though--.... )

And all the procedure to replicate what happened on my system, has been described in my posts above.

If anybody has any suggestion what might be missing, do tell.

Also, in circumstances like this, I don't like neither correcting my typoes nor improving my wordage used, other then one thing...

Other then one thing. dillo, which I used, has a little problem with cache, that can be easily circumvented, but the user needs to remember to refresh the page, and I inadvertently lost a little text...

EDIT START Tue 10 Mar 17:04:35 CET 2015:

Couldn't find it, screencasts are much harder to search then electronic text, but I corrected/completed most of the text, many of the more than dozen of my posts of this topic.

(While I could, very probably, find exactly what I typed and lost, just a sentence or two, because I always run my uncenz-1st from the:
https://github.com/miroR/uncenz when online, the detailed research of it I spare for scoops such as the linked previously in this topic, Google and Yahoo intrusions and such, or other important cases; wasn't so much lost here.)

EDIT END

miroR · l33t Joined: 05 Mar 2008 Posts: 826

I kindly ask everybody, if I may, to try and understand, that some customs and promises of FOSS behavior, of the OSI, of GNU/Linux generally, I believe have been grossly harmed, and not just neglected here, in this secret compilation that the user wasn't supposed to ever know about, as I explained above, pretty completely, and everybody can find out, and if they reproduce if with that webkit-gtk package on a grsec-hardened kernel, they can figure out all the details.

So I hereby kindly ask that contributors to topic on what has too little to do with non-poetterized Gentoo, id est too little to do with this topic, such as technical details about the googleized Firefox, let's move that discussion over to the topic where I already posted a lot:

Google - can not open any link - malware ??
https://forums.gentoo.org/viewtopic-t-912056.html#7714186

And I'll move this content, which was here, now to the new post in bottom.

Princess Nell · l33t Joined: 15 Apr 2005 Posts: 916

OCSP: https://en.wikipedia.org/wiki/Ocsp. The problem with it is: you use https as much as possible to stop 3rd parties from learning URLs and contents, and then your browser contacts a 3rd party every time you use https. That's just crazy.

"Safe browsing", yes, that's phishing and malware protection. I was just going by the corresponding about.config entries (browser.safebrowsing prefix). https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work makes it clear this is a Google service.

Princess Nell · l33t Joined: 15 Apr 2005 Posts: 916

I've run a little experiment here.

Set up a test user with a completely new firefox profile. Just change it so that the home page points to www.gentoo.org. Disable all daemons that listen to or create network traffic (ntp, ssh etc.). Then run a network dump and start firefox, close it when the page has loaded completely. Result is around 3.5k packets.

Now run the same experiment again with my normal browser settings, ie. about:config variables relating to OCSP, safe-browsing etc. disabled, and all add-ons disabled. The result is some 150 packets. Enabling add-ons adds some 70 more packets, but I didn't check in detail which add-on causes which traffic. More importantly, other than DNS and certain multicast stuff, I see no traffic not relating to the loading of www.gentoo.org.

This is sobering. The vast majority of the difference is traffic going into Google. But it also shows that a good configuration can go a long way to protect your privacy. This is quite different from e.g. https://en.wikipedia.org/wiki/Google_Chrome#User_tracking.

If you just want to know what's going on, looking at the DNS queries seems to be quite sufficient. In my case, 50% of all the recorded DNS packets were related to safebrowsing.google.com (and varieties).

miroR · l33t Joined: 05 Mar 2008 Posts: 826

This post was in the place of my previous post to this one in this topic, posted originally when that post, that is now there instead of this one, has the timestamp for. I've only cut'n'pasted it over here, and added this in the top, and the NOTE in the bottom
---
I certainly hope that higher ranking Gentoo members, particularly Moderators and Administrators, will hold to the:

http://www.gentoo.org/main/en/contract.xml

wherefrom I take opportunity to cite in particular this line:

steveL · Posted: Mon Mar 09, 2015 3:10 pm Post subject:

I hope you are aware that there are a myriad of logging settings for portage.

So just because everything that appears in a 2>&1 output does not appear in your portage logfile, or heaven forfend, your syslog, does not mean that you've been cracked.

miroR · l33t Joined: 05 Mar 2008 Posts: 826

steveL · Posted: Tue Mar 10, 2015 9:56 am Post subject:

miroR · l33t Joined: 05 Mar 2008 Posts: 826

I did not write my post previous to this one with even a shade of malicious intent, steveL.

Be so kind and tell, me and the readers; this:

( this same topic we are at )
https://forums.gentoo.org/viewtopic-t-1012022.html#7713038

miroR · l33t Joined: 05 Mar 2008 Posts: 826

So, for almost two days, (see the timestamp of my `backdoorish behavior of webkit-gtk discovery', which to me shows:
Posted: Sun Mar 08, 2015 2:30 pm
), I believed I found a huge inconsistency.

But now, upon studying what I posted, while cleaning the text as I in the end decided to do...

But now, I realize there isn't anything wrong, in this cas, not with the system logging, and there is no discrepancy btwn what the system logged in /var/log/portage nor what I logged outside the system. Those logs actually correspond.

It is also obvious from what I posted, of course, if one takes care to look into it more carefully.

I must first post this, so that no confusion remain as to the existence of the `backdoorish behavior' that I described above.

There is none. Sadly, it took me more than two days to understand those logs... and realize that I was wrong.

In what I posted since the abovementioned post of, what appears to me timestamped: Sun Mar 08, 2015 2:30 pm

(For comparison, this one has just been timestamped, in this timezone of the worldk, the CET:
Posted: Tue Mar 10, 2015 6:41 pm
)

Then I will explain.

Really sorry about that.

steveL · Posted: Tue Mar 10, 2015 6:36 pm Post subject:

No worries; at least you admit the mistake and apologise, so we can all just move on. Everybody else makes mistakes too.

No, gdbus was not a typo; IDK what thread I got the info from, but that was starting to pull in gtk-3, which was the real concern, that I recall.

Welcome to the wonderful world of "gentle" persuasion via self-inflicted dependency-hell.

Still, no one will ever be able to take package.mask away, as it's essential for any sort of distro, or any build setup to make stages etc.
At some point, things have to get done, even when that's obfuscated for political purpose.

miroR · l33t Joined: 05 Mar 2008 Posts: 826

Thank you, steveL, this last post of yours is a real relief in this ugly
situation I'm in.

But I prepared the explanaion.
---
Explanation.

From:
( this same topic you are at )
https://forums.gentoo.org/viewtopic-t-1012022.html#7713452
Posted: Sat Mar 07, 2015 8:29 pm
( while double-checking and posting this, I see the same post timestamped: Posted: Sat Mar 07, 2015 7:29 pm, and understanding that is beyond me; same page in dillo, viewed offline 8:29, now new instance of dillo open that same page: 7:29, Explaining that too, just in case, and not changing my prepared text.)

( All timespamps show to me in Central European Time, my time zone )

NeddySeagoon · dev-libs/glib-2.42.2 (>=sys-apps/dbus-1.2.14)

miroR,

steveL · Posted: Wed Mar 11, 2015 3:36 am Post subject:

miroR · l33t Joined: 05 Mar 2008 Posts: 826

miroR · l33t Joined: 05 Mar 2008 Posts: 826

Princess Nell · l33t Joined: 15 Apr 2005 Posts: 916

Fitzcarraldo

Using about:config or directly editing prefs.js to change the user preferences in Firefox is laborious, so I created a Bash script edit_firefox.sh to toggle the relevant user preferences I am interested in making secure:

miroR · l33t Joined: 05 Mar 2008 Posts: 826

While I like to see you in my topics, Fitzcarraldo, and Princess Nell...

I really do... But I begged so kindly to put what relates Firefox and Google, in this other topic:

Google - can not open any link - malware ??
https://forums.gentoo.org/viewtopic-t-912056-start-25.html#7715646

as you are now completely out of topic with this...

Can I reply to you there? And, can you say your advice, or your script (saying upfront, will eat my hat if it does)

rid me of that harvesting,

which I sure hope you can find there?

I'd really like this topic to be about what I meant it for.

Please! Thank you!

miroR · l33t Joined: 05 Mar 2008 Posts: 826

Princess Nell, especially you, and Fitzcarraldo (but he might have posted here without enough consideration of the topic),
we're at an enpasse here, as I explain in:

Google - can not open any link - malware ??
https://forums.gentoo.org/viewtopic-t-912056-start-25.html#7715894

and I will not be to blame if some of you really decide and fully hijack this topic of mine which is meant to be about:

Updating and keeping your Gentoo non-poetterized

If you feel my contribution with the demonstration over there might be of some use, as I feel your possible solutions might be worthy, pls I'll invest more of my time, as you did, but not here.

Thank you.

---

To this: