Latest posts for tag rant
New laptop, has a touchscreen, can be folded into a tablet, I heard gnome-shell would be a good choice of desktop environment, and I managed to tweak it enough that I can reuse existing habits.
I have a big problem, however, with how it encourages one to download random
extensions off the internet and run them as part of the whole desktop
environment. I have an even bigger problem with
gnome-core having a hard
chrome-gnome-shell, a plugin
which cannot be disabled without root editing files in
/etc, which exposes
parts of my destktop environment to websites.
Visit this site and it will know which extensions you have installed, and it will be able to install more. I do not trust that, I do not need that, I do not want that. I am horrified by the idea of that.
How can one do the same for firefox?
chrome-gnome-shell is a hard dependency of gnome-core, and it installs a browser plugin that one may not want, and mandates its use by system-wide chrome policies.
I consider having chrome-gnome-shell an unneeded increase of the attack surface of my system, in exchange for the dubious privilege of being able to download and execute, as my main user, random unreviewed code.
This package satifies the chrome-gnome-shell dependency, but installs nothing.
Note that after installing this package you need to purge chrome-gnome-shell if it was previously installed, to have it remove its chromium policy files in /etc/chromium
apt install equivs equivs-build contain-gnome-shell sudo dpkg -i contain-gnome-shell_1.0_all.deb sudo dpkg --purge chrome-gnome-shell
Ansible's default output, including the
stderr of failed commands, is JSON
encoded, which makes reading Jenkins' output hard.
Ansible however has Callback plugins that could be used. In that page it says:
Ansible comes with a number of callback plugins that you can look at for examples. These can be found in lib/ansible/plugins/callback.
That is a link to a git repo with just a pile of Python sources and no, say
README.md index to what they do. Hopefully they have some docstring with a short description of what they do?
debian eng pdo rant
I clicked on a random link and I found myself again in front of a wired.com popup that wanted to explain to me what I have to think about adblockers.
This time I was convinced, and I took my wallet out.
I finally donated $35 to AdBlock.
(And then somebody pointed me to uBlock Origin and I switched to that.)eng pdo rant
Sometimes I am in an airplane, and I just want to write code and compile it.
Sometimes I am playing a game in full screen, and I don't want it to lag.
Lynoure suggested this simple one-liner which helps immensely, to a point that I have turned it into a habit:
pkill -STOP chromium
When I want to use the browser again:
pkill -CONT chromium
I wish web browsers would stop running anything when unfocused, unless asked otherwise on a site by site basis.
Update: Johannes Schauer blogged more than a year ago about how to automate this in awesome.debian eng pdo rant
I have been hit by #643726 again.
I was happily working on a terminal while an
apt upgrade was running on
another, and suddenly
kbuildsycoca4 started vomiting on my command line
because I had run okular once on that terminal last tuesday.
Among the possible workarounds, one can run
kdebugdialog from package
kde-runtime and check the "Disable all debug output" button.
This is the output of
kdebugdialog when run on a terminal after enabling
"Disable all debug output":
$ kdebugdialog QDBusConnection: session D-Bus connection created before QCoreApplication. Application may misbehave. QDBusConnection: session D-Bus connection created before QCoreApplication. Application may misbehave.
I see it as debugging output turned into an art performance, and I have an
appreciation for this kind of things.
kdebugdialog, my hat's off to you.
This morning I woke up. Bad idea.
I find in the work mail a compiler error that I cannot reproduce, so I need to log into a machine at work. But #809195.
I decided to downgrade network-manager. I recall there was a tool to download packages from snapshots.debian.org, I discussed it recently on IRC, let's sync the IRC logs from my server. Or not (#810212).
After some help from
#debian-devel (thanks jcristau and LebedevRI), here is
how to downgrade network-manager:
# echo "deb http://snapshot.debian.org/archive/debian/20151125T155830Z/ sid main" >> /etc/apt/sources.list.d/tmp-downgrade-nm.list # apt -o Acquire::Check-Valid-Until=false update # apt -o Acquire::Check-Valid-Until=false install network-manager=1.0.6-1 # rm /etc/apt/sources.list.d/tmp-downgrade-nm.list # service network-manager restart
And as user:
$ killall nm-applet $ nm-applet &
The yak is now nice and shaved, I can now go and see what those compiler errors are all about.
Actually, no, there was still an unshaved patch on the yak, and now we have a debcya script.debian eng pdo rant sw
Bug severity: seriously ruining my life.
Try to use korganizer to create a calendar entry when the server is not reachable (say, you are offline, or you typed the wrong password), and you may find that you end up with no error messages, an entry that shows up perfectly fine, but that will never be synced to the server, ever again.
I use korganizer, radicale and caldav for important things. The practical ramifications of me inserting entries in korganizer, seeing that everything looks ok, and then not finding them on my phone while on the go, are scary.
Think of things like importing
.ics files with flight schedules, entering tax
deadlines, time and places for customer meetings, time and places of arrival of
loved ones I'm supposed to pick up.
I spent time setting up my own infrastructure for this exactly because I care that all of this works reliably.
And now I urgently took a morning off work to find a way to detect those entries that Akonadi is refusing to update,
The whole thing is cumbersome to run, but if you are using kdepim-based tools to manage your calendars and sync them across devices, you may want to give it a go every once in a while.
You can find the script and the notes I took so far on the issue at https://github.com/spanezz/akonadi-workarounds.eng pdo rant sw
I have had some success signing an Italian fattura elettronica with OpenSSL.
I am amazed to realise that the software they gave me to do the job is of such bad quality that I felt like spending a few hours trying to do the same thing with OpenSSL instead.eng pdo rant sw
This system does not even export to PDF. In order to provide my accountant with something better than a DER-encoded file with a random-looking name stored inside a zipfile, here is a script that at least extracts the unsigned XML payload out of a saved Fattura Elettronica.
If you're giving a python course in Italy, this sounds like a nice early programming assignment.eng pdo rant sw
Here's a simple guide for how I managed to bill one of my customers as is now mandated by law in Italy.
Create a new virtualbox machine
I would never do any of this to any system I would ever want to use for anything else, so it's virtual machine time.
- I started virtualbox, created a new machine for *buntu 32bit, 8Gb disk, 4Gb RAM, and placed the .vdi image in an encrypted partition. The web services of Infocert's fattura-pa requires "Java (JRE) a 32bit di versione 1.6 o superiore".
- I installed *buntu 12.04 on it: that is what dike declares to support.
- I booted the VM, installed virtualbox-guest-utils, and de sure I also had virtualbox-guest-x11
- I restarted the VM so that I could resize the virtualbox window and have *buntu resize itself as well. Now I could actually read popup error messages in full.
- I changed the desktop background to something that gave me the idea that this is an untrusted machine where I need to be very careful of what I type. I went for bright red.
Install smart card software into it
apt-get install pcscd pcsc-tools opensc
- In virtualbox, I went to Devices/USB devices and enabled the smart card reader in the virtual machine.
- I ran
pcsc_scanto see if it could see my smart card.
- I ran Firefox, went to preferences, advanced, security devices, load. Module
name is "CRS PKCS#11", module path is
- I went to https://fattura-pa.infocamere.it/fpmi/service and I was able to log in. To log in, I had to type the PIN 4 times into popups that offered little explanations about what was going on, enjoying cold shivers because the smart card would lock itself at the 3rd failed attempt.
- Congratulations to myself! I thought that all was set, but unfortunately, at this stage, I was not able to do anything else except log into the website.
Descent into darkness
Set up things for fattura-pa
- I got the PDF with the setup instructions from here. Get it too, for a reference, a laugh, and in case you do not believe the instructions below.
- I went to https://www.firma.infocert.it/installazione/certificato.php, and saved the two certificates.
- Firefox, preferences, advanced, show certificates, I imported both CA certificates, trusted for everything, all my base are belong to them.
apt-get install icedtea-plugin
- I went to https://fattura-pa.infocamere.it/fpmi/service and tried to sign. I could not: I got an error about invalid UTF8 for something or other in Firefox's stdandard error. Firefox froze and had to be killed.
Set up things for signing locally with dike
- I removed icedtea so that I could use the site without firefox crashing.
- I installed DiKe For *buntu 12.04 32bit
- I ran dikeutil to see if it could talk to my smart card
- When signing with the website, I chose the manual signing options and downloaded the zip file with the xml to be signed.
- I got a zip file, unzipped it.
- I loaded the xml into dike.
- I signed it with dike.
- I got this error message: "nessun certificato di firma presente sul dispositivo di firma" and then this error message: "Impossibile recuperare il certificato dal dispositivo di firma". No luck.
Set up things for signing locally with ArubaSign
- I went to https://www.pec.it/Download.aspx
- I downloaded ArubaSign for Linux 32 bit.
- Oh! People say that it only works with Oracle's version of Java.
sudo add-apt-repository ppa:webupd8team/java
apt-get install oracle-java7-installer
- During the installation process I had to agree to also sell my soul to Oracle.
tar axf ArubaSign*.tar*
java -jar ArubaSign.jar
- I let it download its own updates. Another time I did not. It does not seem to matter: I get asked that question every time I start it anyway.
- I enjoyed the fancy brushed metal theme, and had an interesting time navigating an interface where every label on every icon or input field was truncated.
- I downloaded https://www.pec.it/documenti/Manuale_ArubaSign2_firma%20Remota_V03_02_07_2012.pdf to get screenshots of that interface with all the labels intact
- I signed the xml that I got from the website. I got told that I needed to really view carefully what I was signing, because the signature would be legally binding
- I enjoyed carefully reading a legally binding, raw XML file.
- I told it to go ahead, and there was now a
.p7mfile ready for me. I rejoiced, as now I might, just might actually get paid for my work.
Try fattura-pa again
Maybe fattura-pa would work with Oracle's Java plugin?
- I went to https://fattura-pa.infocamere.it/fpmi/service
- I got asked to verify java at www.java.com. I did it.
- I told FireFox to enable java.
- Suddenly, and while I was still in java.com's tab, I got prompted about allowing Infocert's applet to run: I allowed it to run.
- I also got prompted several times, still while the current tab was not even Infocert's tab, about running components that could compromise the security of my system. I allowed and unblocked all of them.
- I entered my PIN.
- Congratulations! Now I have two ways of generating legally binding signatures with government issued smart cards!
I shut down that virtual machine and I'm making sure I never run anything important on it. Except, of course, generating legally binding signatures as required by the Italian government.eng pdo rant sw