HomeSearchPrevious dayNext day

00:05:43Arcorann (Arcorann) joins
00:14:49DogsRNice_ joins
00:17:26<nukke>when is ArchiveTeam Inc LLC GmbH happening
00:17:50DogsRNice quits [Ping timeout: 240 seconds]
00:18:08<nukke>cant wait for fireonlive to ask me to come into his office if you know what I'm saying
00:18:16<nukke>(he's gonna fire me for slacking off)
00:20:58<fireonlive>test post, please ignore
00:32:56<fireonlive>nukke: :P
00:33:45<fireonlive>fireonlive's office: the only one with blacked out windows
00:33:48<fireonlive>🤔
00:40:03jasons (jasons) joins
00:46:36qwertyasdfuiopghjkl quits [Remote host closed the connection]
00:47:11<nukke>"hey why are there so many empty Kleenex boxes in here?"
01:02:45DogsRNice__ joins
01:04:25qwertyasdfuiopghjkl (qwertyasdfuiopghjkl) joins
01:06:47DogsRNice_ quits [Ping timeout: 272 seconds]
01:19:28Mateon2 joins
01:21:21Mateon1 quits [Ping timeout: 272 seconds]
01:21:21Mateon2 is now known as Mateon1
01:35:55jasons quits [Ping timeout: 272 seconds]
02:05:36HackMii quits [Remote host closed the connection]
02:06:07HackMii (hacktheplanet) joins
02:13:35<nicolas17>JAA: can't you just set max_retries to a high enough number?
02:15:09<@JAA>nicolas17: Probably, yeah, but I'm also curious to hear about any direct experience with it.
02:16:09<nicolas17>samsung still hates me
02:18:31<fireonlive>imer?
02:24:45<nicolas17>what
02:25:04<nicolas17>tor still works, it would just be more convenient if I didn't have to :P
02:37:52<fireonlive>oh re: loki/promtail
02:39:18jasons (jasons) joins
02:45:35Naruyoko5 quits [Ping timeout: 272 seconds]
03:08:14Naruyoko joins
03:10:50<Terbium>JAA: hmm that's an option I haven't configured yet as most of my stuff *knocks* on wood have decently reliable connections.
03:10:57<Terbium>I also keep a local copy of my logs any way
03:11:13<Terbium>I.e. built in caching mechanism
03:11:37<@JAA>Right, but eventually, log rotation kicks in, I imagine. Or do you keep logs locally forever?
03:12:01<Terbium>I have max compression turned on and I reserve quite a lot of space for log rotation
03:12:56<Terbium>there is a retention limit, but long enough that I probably would realize log shipping is broken before any local logs are deleted before I can re-ship them once the issue is fixed
03:14:29<Terbium>They have a native Docker logging driver which I don't use, instead keep promtail to read the docker logs and raise my docker log retention really high
03:14:51<@JAA>I see.
03:14:53<Terbium>if you have a really reliable network and don't need local caching, you can use the docker logging driver plugin
03:15:07<Terbium>to ship directly and avoid local writes to disk
03:15:44<Terbium>Loki supports S3 compat storage if you need bulk storage which is one if it's main benefits
03:16:12<Terbium>it's oriented more for high compression/density logging storage to slow storage like remote NFS/S3/FTP etc
03:16:19<Terbium>but also works well on local SSD
03:16:45<Terbium>in either case, it's not meant for super powerful indexing, just basic indexing capabilities
03:18:15fuzzy8021 quits [Read error: Connection reset by peer]
03:19:29<Terbium>ELK is too fat
03:19:52<Terbium>if you're fancy you can use fluentd
03:20:17<Terbium>did i mention ELK is fat?
03:20:31<fireonlive>did it eat too many foods
03:20:32fuzzy8021 (fuzzy8021) joins
03:20:49<Terbium>Yeah, it ate too much Java Heap
03:21:10fuzzy8021 quits [Read error: Connection reset by peer]
03:21:36fuzzy8021 (fuzzy8021) joins
03:22:11<fireonlive>java should be illegal
03:22:18<fireonlive>java--
03:22:18<eggdrop>[karma] 'java' now has -1 karma!
03:22:23<Terbium>> Oracle heard that
03:22:32<fireonlive>😱
03:22:40<Terbium>Congrats, you have won 1 year of free lawsuits
03:22:43fireonlive hides
03:24:02<@JAA>Lightweight is perfect, yeah. I just want a central log storage that isn't a total mess. I won't even query it regularly anyway.
03:24:58<Terbium>Grafana and Loki is a bit dumb sometimes when you make large queries (which I often do) you'll likely need to raise the API limits on Loki
03:25:03<Terbium>if you make big queries in Grafana
03:25:25<Terbium>otherwise Grafana will freak out and throw timeout or rate limit errors at you
03:27:48<fireonlive>rate limit errors!
03:27:52<fireonlive>but i own you!
03:28:02<fireonlive><howdareyou.gif>
03:28:32<Terbium>Loki has it quite low, so I increase it like crazy, now I happily get to watch my CPU and IO go to up 100% each time I ask it to search 90 days of logs
03:28:49<Terbium>downsides of not having everything fully indexed :P
03:31:34<fireonlive>:D
03:37:20jasons quits [Ping timeout: 240 seconds]
04:02:26<fireonlive>https://dl.fireon.live/irc/225cf3a0ae71440e/mushrooms.png
04:02:29<fireonlive>interesting ad
04:40:47jasons (jasons) joins
04:59:36DogsRNice__ quits [Read error: Connection reset by peer]
05:16:45BlueMaxima quits [Client Quit]
05:31:15<fireonlive>+rss- ICANN picks the domain it will never, ever release: https://domainincite.com/29381-icann-picks-the-domain-it-will-never-ever-release https://news.ycombinator.com/item?id=39152306
05:31:18<fireonlive>.internal
05:31:55<fireonlive>>when it makes it to the ICANN reserved list all confusingly similar strings will also be banned, under the current draft of the Applicant Guidebook
05:31:57<@JAA>What a stupid title.
05:32:02<fireonlive>yeah...
05:32:04<fireonlive>'the domain'
05:32:05<fireonlive>lol
05:32:11<fireonlive>also just.. the whole thig
05:32:12<@JAA>It's just another private use TLD.
05:32:30<fireonlive>it's .local w/o the 'it's for mDNS' thing
05:32:32<@JAA>Er, 'special use' is the official term, I think.
05:32:34<fireonlive>and also not .invalid
05:33:06<fireonlive>or .example :3
05:33:09<fireonlive>i think that's it
05:33:11<fireonlive>hm
05:33:44<@JAA>.test, .localhost
05:33:57<@JAA>.onion is a bit of a special case but also in that category.
05:35:25<fireonlive>ah ye
05:35:39<fireonlive>they had to register .onion so certificates could be issued for it i believe
05:36:08<fireonlive>that was many moons and many cabforum discussions ago though
05:36:44<@JAA>Not *that* long ago though, only happened in 2015.
05:37:07<fireonlive>when every day fee-<monologue>
05:37:09<fireonlive>lol
05:37:10<@JAA>Although certificates are kind of silly on Tor.
05:37:13<fireonlive>but yeah not too long ago
05:37:20<fireonlive>yeah indeed
05:37:20jasons quits [Ping timeout: 240 seconds]
05:37:35<fireonlive>it was mainly 'the only possibly valid use for EV certificates ever holy shit we finally found one'
05:37:48<@JAA>Indeed :-)
05:37:51<fireonlive>:)
05:38:30<@JAA>I guess it was nice for that green padlock when you were connecting to one of the few popular sites that also have a hidden service.
05:38:35<@JAA>But now the padlock is gone, so...
05:39:07<fireonlive>i celebrated the death of 'the green bar'
05:39:13<fireonlive>(EV display)
05:39:25<fireonlive>was meh on the loss of the padlock/purse
05:39:48<fireonlive>but yeah.. now a days.. why? lol
05:39:58<@JAA>It's all a bit ridiculous with 200-ish CAs in the trust store.
05:40:11<fireonlive>mm
05:40:25<fireonlive>i guess if we learned anything with symantec's demise it's 'because they'll pay for it'
05:40:56<fireonlive>or 'snakeoil salespeople very effective'
05:41:01<fireonlive>lol
05:41:04<@JAA>And nobody uses CAA.
05:41:17<@JAA>Yeah, lol
05:41:37<fireonlive>more people should :D
05:41:58<@JAA>The xmpp.ru MITM was also interesting.
05:42:28<@JAA>Very tough to mitigate that if you use ACME.
05:44:01<fireonlive>ah right the HTTP challenge one
05:44:07<fireonlive>you can restrict acme to DNS only
05:44:29<fireonlive>and hope no one MITMs your nameservers lol
05:44:54<@JAA>Also via CAA?
05:45:14<fireonlive>hmm lemme double check
05:45:37<fireonlive>ah yes indeed
05:45:42<fireonlive>https://letsencrypt.org/docs/caa/ "validationmethods"
05:46:08<@JAA>Nice
05:46:11<fireonlive>you can also use accounturi if you have a fancy setup i guess, but validationmethods is an easier path
05:46:39<fireonlive>"this account can only issue certs for the domain"
05:46:47<fireonlive>probably the more secure option
05:47:22<fireonlive>and ye :3 its pretty nice
05:47:49<fireonlive>hopefully other CAs are following in let's encrypt's footsteps and enabling multi-view DNS lookups
05:49:12<fireonlive>hmm lame
05:49:20<fireonlive>dig CAA fireon.live
05:49:23<fireonlive>notice anything weird there
05:50:39<@JAA>I'm not really overly familiar with the details of CAA beyond its existence.
05:50:46<@JAA>Why four CAs?
05:50:53<fireonlive>porkbun forces them there :/
05:50:53<@JAA>And uh
05:50:55<@JAA>> issuewild ";"
05:51:18<@JAA>What does that mean?
05:51:47<fireonlive>oh
05:52:01<fireonlive>so you can seperately control wildcard issuance to seperate CAs/parameters/etc
05:52:21<fireonlive>a record with ; just means 'no one can issue wildcard certs'
05:53:12<fireonlive>(similarly a solo issue ";" means no certs)
05:53:14<@JAA>But there are four other 'issuewild' tags.
05:53:36<fireonlive>ye :(
05:53:49<fireonlive>not added by me; just found out porkbun adds them for you
05:53:57<fireonlive>because of their 'parking page' thing lol
05:54:14<fireonlive>and i don't see a way to remove them
05:54:23<fireonlive>so they kinda fucked it all up :|
05:54:30<@JAA>Still don't understand what it means though.
05:54:46<@JAA>A single semicolon = nobody can issue that type of cert (wildcard or regular).
05:55:45<fireonlive>oh, i tried to get no wildcard certs as per policy - but porkbun added the other CAs and I can't turn that off
05:55:47<@JAA>But does that negate the previous issuewild things?
05:55:59<fireonlive>i think they'd still be able to issue sadly
05:56:04<@JAA>:-/
05:56:14<fireonlive>just found out now they added those extras boo
05:56:40<@JAA>TIL DNSSEC is not required for CAA, only 'strongly *RECOMMENDED*'.
05:57:16<fireonlive>ah yeah, DNSSEC is always fun lol
05:57:23<fireonlive>let's encrypt does the 'multi view' thing
05:57:45<fireonlive>where they require a quorum of DNS lookups from different locations
05:57:57<fireonlive>if one of them doesn't match issuance is halted
05:58:18<fireonlive>(when validating the token, maybe also CAA)
05:58:30<@JAA>Looks like Porkbun's servers don't return DNSSEC data, even though it's enabled for the domain at the TLD level.
05:59:26<fireonlive>https://dl.fireon.live/irc/a77375c0725affb9/image.png not sure why but the switch on porkbun's side says cloudflare under dnssec lol
05:59:41<@JAA>Yeah, just found that as well: https://kb.porkbun.com/article/216-how-to-enable-porkbuns-cloudflare-dnssec
05:59:47<fireonlive>i should probably leave the godaddy-owned (😞) porkbun at some point
05:59:54<@JAA>No explanation there either.
06:00:08<fireonlive>hmm
06:00:08<fireonlive>oh
06:00:25<fireonlive>hmm
06:00:46<fireonlive>i seem to remember cloudflare rescuing someone's nameservers in the past
06:01:04<fireonlive>maybe they just have some service now that they offload to if you flip that on
06:02:14<@JAA>¯\_(ツ)_/¯
06:04:34<fireonlive>oh, a fun trick for CAA is you can make the records at any level
06:05:11<fireonlive>so issuewild ";" at the root; but say you want it for docker-container-subdomain.whatever.example you can add a CAA issuewild for a CA there
06:05:19<@JAA>Yeah
06:05:22<fireonlive>=]
06:06:47<fireonlive>https://securityheaders.com/?q=archivebot.com&hide=on&followRedirects=on
06:06:49<fireonlive>:(
06:06:55<fireonlive>i also have none lol
06:07:35<@JAA>F = full points, right?
06:07:49<fireonlive>totes!
06:07:51<fireonlive>:3
06:07:57<fireonlive>https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy < much fun
06:07:59<@JAA>You have HTTPS at least. :-P
06:08:33<fireonlive>:3
06:08:49<@JAA>> Ouch, you should work on your security posture immediately:
06:09:27<fireonlive>xD
06:09:29<fireonlive>rude
06:10:15<fireonlive>ivan ristic of ssllabs and the handbook fame also went on to build.....
06:10:16<fireonlive>uh
06:10:34<fireonlive>oh right
06:10:37<fireonlive>https://www.hardenize.com/
06:10:50<fireonlive>that thing i can never remember the name of
06:11:14<fireonlive>sorta an AIO test; though less detailed than the lovely https://www.ssllabs.com/ssltest/
06:11:50<@JAA>Try putting www.ssllabs.com into securityheaders.com. :-)
06:13:28<fireonlive>missing two! :p
06:13:47<@JAA>Oh, it works for you? I'm just getting a timeout error.
06:13:52<@JAA>> The target site took too long to respond and the connection timed out. Try again later.
06:13:54<fireonlive>is everyone excited for Cross-Origin-Embedder-Policy, Cross-Origin-Opener-Policy, and Cross-Origin-Resource-Policy?
06:13:57<fireonlive>ah! worked here
06:14:01<fireonlive>https://securityheaders.com/?q=https%3A%2F%2Fwww.ssllabs.com%2F&hide=on&followRedirects=on
06:14:18<fireonlive>ahh
06:14:23<fireonlive>no apex
06:14:23<@JAA>Ah, it defaults to HTTP.
06:14:56<fireonlive>indeed, how... not secure
06:15:36<@JAA>I guess it mimics how browsers mostly behave (for now).
06:15:58<fireonlive>ah ye
06:16:03<@JAA>Or has the HTTPS first mode been toggled anywhere yet?
06:16:14<fireonlive>hmm maybe chrome?
06:16:21<fireonlive>oh right
06:16:34<fireonlive>i do remember switching to firefox and being surprised/annoyed web.archive.org was always http
06:17:12<@JAA>Yeah, I added a fix for that in Redirector a long time ago.
06:17:57<fireonlive>https://blog.chromium.org/2023/08/towards-https-by-default.html
06:18:06<fireonlive>ah ok, so chrome does with silent fallback
06:19:43<fireonlive>nice change :3
06:25:39<pabs>going to be annoying for archiving, there are lots of sites with broken setups
06:28:44<fireonlive>hmm
06:28:55<fireonlive>our stuff can ignore such ye?
06:29:08<fireonlive>though i suppose discovery is harder
06:32:03<pabs>not being able to easily disable HSTS is already annoying for some sites
06:33:21<@JAA>Yeah, the client has to opt in to all of this stuff, so it's not a problem for our archival tools.
06:33:28<fireonlive>HN says 'home.arpa' is also reserved
06:34:14<fireonlive>https://www.rfc-editor.org/rfc/rfc8375.html
06:34:23<fireonlive>>The Home Networking Control Protocol (HNCP) is updated to use the 'home.arpa.' domain instead of '.home'.
06:34:26<pabs>yeah, but is for discovery, which is mostly done in the browser, at least for me
06:34:27<fireonlive>RIP .home
06:35:25<fireonlive>ah perfect: https://www.iana.org/assignments/special-use-domain-names/special-use-domain-names.xhtml
06:36:09<fireonlive>huh, .alt
06:38:56<fireonlive>if you use .local for anything but mDNS you are the problem sorry
06:40:06<fireonlive>;)
06:40:49jasons (jasons) joins
07:27:44parfait (kdqep) joins
07:36:50jasons quits [Ping timeout: 240 seconds]
07:56:33Ruthalas59 quits [Ping timeout: 272 seconds]
08:12:24qwertyasdfuiopghjkl quits [Remote host closed the connection]
08:15:06<eggdrop>[remind] fireonlive: {good night!}
08:15:38<fireonlive>i should....
08:40:26jasons (jasons) joins
09:04:30Ruthalas59 (Ruthalas) joins
09:35:50jasons quits [Ping timeout: 240 seconds]
09:45:18<flashfire42>aw shit something about to go down in #archiveteam
09:45:40<flashfire42>https://server8.kiska.pw/uploads/0300d7cce0f4d4b2/image.png
09:45:56<fireonlive>just saw that
09:46:10<fireonlive>was going to give his email then decided i didn't need the drama
09:46:36<flashfire42>LMFAO
09:46:42<fireonlive>:P
10:00:04Bleo18260 quits [Client Quit]
10:01:24Bleo18260 joins
10:39:21jasons (jasons) joins
10:42:24qwertyasdfuiopghjkl (qwertyasdfuiopghjkl) joins
11:06:50programmerq quits [Ping timeout: 240 seconds]
11:41:23jasons quits [Ping timeout: 272 seconds]
11:50:47driib quits [Quit: The Lounge - https://thelounge.chat]
12:02:57programmerq (programmerq) joins
12:10:01driib (driib) joins
12:21:49driib quits [Client Quit]
12:23:05driib (driib) joins
12:44:08jasons (jasons) joins
13:09:50Arcorann quits [Ping timeout: 240 seconds]
13:12:56h3ndr1k quits [Client Quit]
13:14:56h3ndr1k (h3ndr1k) joins
13:44:53jasons quits [Ping timeout: 272 seconds]
14:24:15Shjosan quits [Client Quit]
14:24:31Shjosan (Shjosan) joins
14:48:07jasons (jasons) joins
14:59:32Iki1 joins
15:03:25Iki quits [Ping timeout: 272 seconds]
15:07:03qwertyasdfuiopghjkl quits [Remote host closed the connection]
15:10:25qwertyasdfuiopghjkl (qwertyasdfuiopghjkl) joins
15:10:26qwertyasdfuiopghjkl quits [Excess Flood]
15:11:46qwertyasdfuiopghjkl (qwertyasdfuiopghjkl) joins
15:47:45jasons quits [Ping timeout: 272 seconds]
16:50:45jasons (jasons) joins
17:00:52<nicolas17>JAA: many newer web/JS features require TLS, not to mention http2, that's why .onion would need a certificate I guess
17:43:02Shjosan quits [Client Quit]
17:43:32Shjosan (Shjosan) joins
18:08:25<@JAA>nicolas17: Hmm, right, browsers don't support h2c.
18:08:35<@JAA>I wonder whether Tor browser does.
18:08:49<@JAA>It is available behind an about:config option in Firefox, I think.
18:14:22<nicolas17>JAA: https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts/features_restricted_to_secure_contexts
18:16:56<@JAA>All of which the Tor browser devs can change.
18:17:07<nicolas17>yes
18:17:12<@JAA>The question's just whether they do.
18:17:28<nicolas17>but people can use their own browser with a tor proxy right?
18:17:33<@JAA>They'd probably want to only allow it on hidden services, which makes it more complicated.
18:18:01<@JAA>It's not like we didn't already have an era of 'this website only works with that browser'. :-)
18:18:21<nicolas17>/o\
18:25:36Shjosan quits [Client Quit]
18:25:52Shjosan (Shjosan) joins
18:33:58<@JAA>I'm still getting the default nginx page on archive.ph, by the way.
18:34:12katia_ (katia) joins
18:34:49katia_ quits [Remote host closed the connection]
18:45:12katia_ (katia) joins
19:01:07decky_e_ quits [Read error: Connection reset by peer]
19:01:10katia_ quits [Remote host closed the connection]
19:01:26decky_e_ joins
19:02:34decky joins
19:03:22nyany_ quits [Quit: (516): and then you went into taco bell without pants...and surprisingly you weren't the only one there without pants]
19:03:32nyany (nyany) joins
19:05:50decky_e_ quits [Ping timeout: 240 seconds]
19:43:43alpine joins
19:44:02<alpine>Wii Shop Channel
19:44:50jasons quits [Ping timeout: 240 seconds]
19:45:05<alpine>WiiShopChannel.net
19:55:39alpine quits [Remote host closed the connection]
20:28:43DogsRNice joins
20:48:38jasons (jasons) joins
21:42:29BlueMaxima joins
21:45:20jasons quits [Ping timeout: 240 seconds]
22:13:12Arcorann (Arcorann) joins
22:17:56c3manu quits [Read error: Connection reset by peer]
22:18:02c3manu (c3manu) joins
22:49:15jasons (jasons) joins
23:46:20jasons quits [Ping timeout: 240 seconds]

HomeSearchPrevious dayNext day