[lubuntu-users] Privacy and security - Was: Lubuntu's repository

[Ralf Mardorf]

Hi,

to grant privacy and security it's important to check the ISO against a
signed checksum by a trusted key.

If this isn't done in the first place, all following efforts to grant
protection could be futile.

So for Tails read
https://tails.boum.org/install/download/openpgp/index.en.html .

To get 64 bit architecture Ubuntu desktop flavours including an
automatically check against a signed checksum, I wrote the attached
script.

After saving the attached script as

  luamd64_1610.sh

change to the directory were you saved it by running

  cd /path/to/the/script/

then run

  chmod a+x luamd64_1610.sh

and after that e.g. run

  ./luamd64_1610.sh lubuntu 17.10

Note, still one issue remains when using this script
https://en.wikipedia.org/wiki/Web_of_trust .

Regards,
Ralf

-- 
Guerilla Open Access Manifesto:
https://archive.org/stream/GuerillaOpenAccessManifesto/Goamjuly2008_djvu.txt


luamd64_1610.sh
Description: application/shellscript
-- 
Lubuntu-users mailing list
Lubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/lubuntu-users

Re: [lubuntu-users] Lubuntu's repository

[Ralf Mardorf]

On Sat, 11 Nov 2017 20:14:20 -0600, Israel wrote:
>If you wanted privacy because you were in an oppressive country trying
>to have more freedom of information I would give you names of programs
>you could use to help, as well as specific distributions which would
>make your internet activity less easy to track.  

Hi,

don't pussyfoot around.

Noobs should consider to use

https://tails.boum.org/

since it helps top avoid some mistakes.

However, inform yourself about issues by reading

https://www.torproject.org/docs/faq.html.en#AmITotallyAnonymous
https://www.torproject.org/docs/faq.html.en#AttacksOnOnionRouting

and other information provided by the TOR project.

I dislike criminals and I much more dislike the media claiming that TOR
is much misused for illegal activities. Those claims are bullshit,
since only a criminal idiot would use TOR and care about the pitfalls of
TOR.

https://www.torproject.org/docs/faq.html.en#Criminals

"Doesn't Tor enable criminals to do bad things?

Criminals can already do bad things. Since they're willing to break
laws, they already have lots of options available that provide better
privacy than Tor provides. They can steal cell phones, use them, and
throw them in a ditch; they can crack into computers in Korea or Brazil
and use them to launch abusive activities; they can use spyware,
viruses, and other techniques to take control of literally millions of
Windows machines around the world.

Tor aims to provide protection for ordinary people who want to follow
the law. Only criminals have privacy right now, and we need to fix
that." - https://www.torproject.org/docs/faq-abuse.html.en

Regards,
Ralf

-- 
Lubuntu-users mailing list
Lubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/lubuntu-users

Re: [lubuntu-users] Lubuntu's repository

[Israel]

Hi again.
On 11/11/2017 08:01 PM, Joe Smith wrote:
> Hi y'all,
>
> Yes I was the one at IRC and asked this question. Thanks for letting
> me know :) Are there other repositories that are free as in freedom
> that allow any users to upload content directly to it, even if it
> contained illegal stuff (such as connecting users to blackmarkets
> (such as drugs and ammunition stores etc)), not that I plan to off
> course download such content but was rather curious if such a
> repository exists?
>
You should use your own server for that.

The things you describe sound like websites, rather than Debian apt
packages (compiled programs/scripts/etc...).
Lubuntu is a set of programs to give you freedom on your computer to use
it directly, without giving up your freedom to a proprietary OS.

There are a variety of web browsers you can use to connect to websites,
though I would *strongly advise* against your mentioned usage.  If you
wanted privacy because you were in an oppressive country trying to have
more freedom of information I would give you names of programs you could
use to help, as well as specific distributions which would make your
internet activity less easy to track.
> Regards
> Joe

-- 
Regards

-- 
Lubuntu-users mailing list
Lubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/lubuntu-users

Re: [lubuntu-users] Lubuntu's repository

[Israel]

Hi (inline below)
On 11/11/2017 12:43 PM, Simon Quigley wrote:
> Hello,
>
> A couple corrections here.
>
> On 11/11/2017 12:23 PM, Israel wrote:
> 

> We have some differences, for example, Ubuntu extends Debian's Britney
> tool to provide extra verification such as running autopkgtests and
> installability tests before releasing for general installability. This
> is done via use of a -proposed partial suite, and then when ready, it
> migrates for people to install. Debian is different in that once
> something is uploaded to Unstable, binaries become available as soon as
> they are done building, so stability is not guaranteed.
I did not realize this, thanks for the extra information here.  That is
even more robust than I initially realized!
>> They use lintian for the Debian package lint checks,and
>> pbuilber to compile it
> Actually, this is incorrect. Launchpad uses sbuild to build the
> packages, then once that is done, the binaries get published to the
> -proposed pocket. Then from there, in this order, package suitability
> for general installation is determined:
>  1. If the package has autopkgtests, run them. If any of the package's
> binaries have reverse dependencies with autopkgtests, run those too
> against the new binaries. All tests must either pass or be "hinted"
> (failures are OK) by a member of the release team.
>  2. Run installation tests with the binaries into the release pocket. If
> the package isn't installable, it doesn't migrate. This avoids broken
> systems on major library transitions.
>  3. Make sure there are no bugs filed against the package with the
> "block-proposed" tag.
>
> More documentation is available here:
> https://wiki.ubuntu.com/ProposedMigration
>
Ahh good to know this, I was just (incorrectly apparently) assuming this
is how the servers worked, based on the prescribed way you build them
locally to test them prior to uploading them to Launchpad (at least for
a PPA).  This is much more robust than I realized, thanks so much for
the clarification here.
>> and make the packages which does some pretty
>> strict checking of the the packaging.  This is all validated via APT.
> Well, not directly by apt. Checksumming of the binaries is done on
> Launchpad and after apt downloads the packages, it verifies the
> integrity of the binaries.
Thanks for making this more clear here, I meant to reference the gpg key
of the repository being imported into apt (in this case the Ubuntu keys)
so that apt will know the source is trusted when communicating with it,
at least this is how I understand the process.
>> there may be a GTK app written in Vala for something, but I
>> may be mistaken.
> Right, gilir might know more about that but for right now we don't have
> any programs we wrote ourself.
Yeah, I think gilir wrote the program used for configuring the session,
that is what I was remembering.
> ...
>
> I hope this clears up any confusion.
>
Yes, thanks for bringing the extra information here it is very
educational, and I really appreciate you taking the time to expand and
also to correct my misconceptions.

-- 
Regards


-- 
Lubuntu-users mailing list
Lubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/lubuntu-users

Re: [lubuntu-users] Lubuntu's repository

[Walter Lapchynski]

On Sun, Nov 12, 2017 at 10:53:26AM +1100, Joe Smith wrote:
> On Sun, Nov 12, 2017 at 1:05 AM, Walter Lapchynski  wrote:
> On November 11, 2017 12:23:47 AM PST, Joe Smith 
> wrote:
> >Does Lubuntu have its own repository, or does it use Github as its
> >repository for its programs
> Do you mean source code or binary releases?
> Both I am referring to?*
 
Israel and Simon pretty much answered all your questions. One thing to
be really clear is that there's Lubuntu and then there's the components
that make up Lubuntu. The upstream developers of the included software
(mostly LXDE/Qt, but also Abiword, Firefox, etc.) all have their own
systems for handling both source code and binary release. Lubuntu does
not pull directly from these. Instead, Debian packages the released
source code, which is synced to Ubuntu's repositories, and ends up
providing binaries.

Lubuntu takes all of its components from Ubuntu's repositories, which is
entirely composed of released upstream software as described above. That
means the kernel, the window manager, the applications, everything.
Lubuntu is a flavor of Ubuntu, which is to say it's a different spin on
the basic Ubuntu infrastructure. Lubuntu uses all of Ubuntu's resources,
including its own binary package repositories.

There was someone who showed up on IRC by the nick of Joe__ that asked a
similar question as you and they asked about having their own server. If
you want to provide packages, it's usually best to go through Debian,
but if you want something quick and dirty that you can support yourself,
you have two choices:

 1. Set up your own repository, using your own resources
 2. Use a Launchpad PPA

Any other questions?
-- 
   @wxl | polka.bike
C563 CAC5 8BE1 2F22 A49D 
68F6 8B57 A48B C4F2 051A

-- 
Lubuntu-users mailing list
Lubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/lubuntu-users

Re: [lubuntu-users] Lubuntu's repository

[Simon Quigley]

Hello,

A couple corrections here.

On 11/11/2017 12:23 PM, Israel wrote:
> On 11/11/2017 02:23 AM, Joe Smith wrote:
>> Hi there,
>>
>> I wanted to know about Lubuntu's repository out of curiosity.
>>
>> Does Lubuntu have its own repository, or does it use Github as its
>> repository for its programs, if Lubuntu uses Github as their
>> repository then does Lubuntu validate all the programs or does Github?
>>
>> Kind regards
>> Joe Smith
>>
>>
> Hi,
> 
> Lubuntu uses Launchpad to host the code for building the packages
> (desktop meta package, artwork, etc..) on Ubuntu's servers.  The Ubuntu
> build servers use the normal Debian way for checking and validating
> things.

We have some differences, for example, Ubuntu extends Debian's Britney
tool to provide extra verification such as running autopkgtests and
installability tests before releasing for general installability. This
is done via use of a -proposed partial suite, and then when ready, it
migrates for people to install. Debian is different in that once
something is uploaded to Unstable, binaries become available as soon as
they are done building, so stability is not guaranteed.

> They use lintian for the Debian package lint checks,and
> pbuilber to compile it

Actually, this is incorrect. Launchpad uses sbuild to build the
packages, then once that is done, the binaries get published to the
-proposed pocket. Then from there, in this order, package suitability
for general installation is determined:
 1. If the package has autopkgtests, run them. If any of the package's
binaries have reverse dependencies with autopkgtests, run those too
against the new binaries. All tests must either pass or be "hinted"
(failures are OK) by a member of the release team.
 2. Run installation tests with the binaries into the release pocket. If
the package isn't installable, it doesn't migrate. This avoids broken
systems on major library transitions.
 3. Make sure there are no bugs filed against the package with the
"block-proposed" tag.

More documentation is available here:
https://wiki.ubuntu.com/ProposedMigration

> and make the packages which does some pretty
> strict checking of the the packaging.  This is all validated via APT.

Well, not directly by apt. Checksumming of the binaries is done on
Launchpad and after apt downloads the packages, it verifies the
integrity of the binaries.

> Lubuntu packages are directly included in the Ubuntu repositories (not a
> PPA)

Correct, and for any Ubuntu flavor as well as Ubuntu itself, all of the
packages are in one central archive.

> LXDE/Qt hosts their code on Github.  I am not sure what they use for
> their builds.  But this is the compiled code (the panel, filemanager,
> etc...), Lubuntu doesn't really write many compiled programs/packages,
> though IIRC there may be a GTK app written in Vala for something, but I
> may be mistaken.

Right, gilir might know more about that but for right now we don't have
any programs we wrote ourself.

We also do nothing on GitHub, although with the new work done by the
Ubuntu Server Team, packaging might be available on Git, and we might be
able to mirror the packaging which goes into the archive on GitHub. More
information on the development of this tooling is available here:
https://insights.ubuntu.com/2017/07/24/developing-ubuntu-using-git/

I hope this clears up any confusion.

-- 
Simon Quigley
tsimo...@lubuntu.me
tsimonq2 on freenode and OFTC
5C7A BEA2 0F86 3045 9CC8
C8B5 E27F 2CF8 458C 2FA4

-- 
Lubuntu-users mailing list
Lubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/lubuntu-users

Re: [lubuntu-users] Lubuntu's repository

[Israel]

On 11/11/2017 02:23 AM, Joe Smith wrote:
> Hi there,
>
> I wanted to know about Lubuntu's repository out of curiosity.
>
> Does Lubuntu have its own repository, or does it use Github as its
> repository for its programs, if Lubuntu uses Github as their
> repository then does Lubuntu validate all the programs or does Github?
>
> Kind regards
> Joe Smith
>
>
Hi,

Lubuntu uses Launchpad to host the code for building the packages
(desktop meta package, artwork, etc..) on Ubuntu's servers.  The Ubuntu
build servers use the normal Debian way for checking and validating
things.  They use lintian for the Debian package lint checks, and
pbuilber to compile it and make the packages which does some pretty
strict checking of the the packaging.  This is all validated via APT. 
Lubuntu packages are directly included in the Ubuntu repositories (not a
PPA)

LXDE/Qt hosts their code on Github.  I am not sure what they use for
their builds.  But this is the compiled code (the panel, filemanager,
etc...), Lubuntu doesn't really write many compiled programs/packages,
though IIRC there may be a GTK app written in Vala for something, but I
may be mistaken.


-- 
Regards

-- 
Lubuntu-users mailing list
Lubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/lubuntu-users

Re: [lubuntu-users] Support

[Ian Bruntlett]

Hi All,

On 11 November 2017 at 15:56, Aere Greenway 
wrote:

> Does the system hang (can't move mouse pointer, or do other things), or
> does the browser crash, and appear to hang as the crash-reporter takes a
> long time (and system resources) to gather information about the crash?
>
> Are you updating to (or installing) 17.10?
>
> On 17.10 (as it was on 17.04), if you have a Pentium-3 machine, it will
> update to the new level just fine, and you can do other things, but every
> time you try to run an Internet browser (any Internet browser), the browser
> will crash.
>
That reminds me... Lucas Dias gave me this advice for running Firefox on
old computers...








*Do you trying to use Firefox ESR? There is a PPA for Firefox 52
ESR:https://launchpad.net/~jonathonf/+archive/ubuntu/firefox-esr
In:
https://support.mozilla.org/en-US/kb/your-hardware-no-longer-supported
*
HTH,


Ian

-- 
-- ACCU - Professionalism in programming - http://www.accu.org
-- My writing - https://sites.google.com/site/ianbruntlett/
-- Free Software page -
https://sites.google.com/site/ianbruntlett/home/free-software
-- 
Lubuntu-users mailing list
Lubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/lubuntu-users

Re: [lubuntu-users] Support

[Aere Greenway]

On 11/09/2017 07:03 PM, O Vagabundo wrote:
I need help in updating lubuntu today but when I try to open any 
browser the system hangs







O Vagabundo:

Does the system hang (can't move mouse pointer, or do other things), or 
does the browser crash, and appear to hang as the crash-reporter takes a 
long time (and system resources) to gather information about the crash?


Are you updating to (or installing) 17.10?

On 17.10 (as it was on 17.04), if you have a Pentium-3 machine, it will 
update to the new level just fine, and you can do other things, but 
every time you try to run an Internet browser (any Internet browser), 
the browser will crash.


--
Sincerely,
Aere

-- 
Lubuntu-users mailing list
Lubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/lubuntu-users

Re: [lubuntu-users] Support

[Ralf Mardorf]

On Sat, 11 Nov 2017 15:25:50 +0100, Ralf Mardorf wrote:
>If you should use another browser, take a look at
>
>  name_of_the_browser --hel
   ^
   --help

FWIW if you shouldn't know the name of the browser's command you could
type the first letters of the name and then push the tab key

If I e.g. type

  google

and push the tab-key, I get recommendations

[rocketmouse@archlinux ~]$ google-
google-chrome-stable  google-earth

-- 
Lubuntu-users mailing list
Lubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/lubuntu-users

Re: [lubuntu-users] Support

[Ralf Mardorf]

On Sat, 11 Nov 2017 14:05:44 +, Ian Bruntlett wrote:
>If you get any error from the memory testing, you need to get someone
>to help you with your hardware

Not necessarily, Memtest could fail. If the installed Memtest should
show errors, I still would use an original Memtest live media and run it
again, even if it's the same version of Memtest. If it also should
fail, I would unplug the RAM bars and then mount them again and repeat
Memtest from the live media. If it still would fail, I would test one
RAM bar after another mounted to the computer only.

However, if the RAM should pass the tests it not necessarily is ok or if
it should fail the tests it not necessarily is broken.

That the computer does freeze or what ever "hangs" should be for, could
be caused by different culprits. More often a disk fails, than RAM.
Taking a look at the disks with smartctl could be helpful, but also
isn't without failure.

Does only the browser cause issues? If so, are there any error messages,
e.g. in

   ~/.xsession-errors*

Does Ctrl+Alt+F-keys work? E.g.

  Ctrl+Alt+F2

then e.g. run

  killall name_of_the_browser

e.g.

  killall firefox

You could go back with

  Ctrl+Alt+F7

and then open a terminal and run the browser from command line, to
probably get clear output.

E.g. run

  firefox --safe-mode

and after that run

  firefox

perhaps running it with a new profile does help

  firefox --ProfileManager

If you should use another browser, take a look at

  name_of_the_browser --hel

Regards,
Ralf

-- 
Lubuntu-users mailing list
Lubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/lubuntu-users

Re: [lubuntu-users] Support

[Ian Bruntlett]

Hi,

On 10 November 2017 at 02:03, O Vagabundo  wrote:

> I need help in updating lubuntu today but when I try to open any browser
> the system hangs
>

One thing to do is check for memory problems.

With lubuntu already installed,
* Switch computer on
* Press and hold down both SHIFT keys
* You should get a black and white menu.
* Use the down arrow key to select "Memory test (memtest86+)
* Press ENTER
* You should get a blue and white screen and the computer will start
testing memory
* If you get any error from the memory testing, you need to get someone to
help you with your hardware

HTH,


Ian

-- 
-- ACCU - Professionalism in programming - http://www.accu.org
-- My writing - https://sites.google.com/site/ianbruntlett/
-- Free Software page -
https://sites.google.com/site/ianbruntlett/home/free-software
-- 
Lubuntu-users mailing list
Lubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/lubuntu-users

Re: [lubuntu-users] Lubuntu's repository

[Walter Lapchynski]

On November 11, 2017 12:23:47 AM PST, Joe Smith  wrote:
>Does Lubuntu have its own repository, or does it use Github as its
>repository for its programs

Do you mean source code or binary releases? 

--
   @wxl | polka.bike
C563 CAC5 8BE1 2F22 A49D
68F6 8B57 A48B C4F2 051A

-- 
Lubuntu-users mailing list
Lubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/lubuntu-users

[lubuntu-users] Support

[O Vagabundo]

I need help in updating lubuntu today but when I try to open any browser
the system hangs
-- 
Lubuntu-users mailing list
Lubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/lubuntu-users

[lubuntu-users] Lubuntu's repository

[Joe Smith]

Hi there,

I wanted to know about Lubuntu's repository out of curiosity.

Does Lubuntu have its own repository, or does it use Github as its
repository for its programs, if Lubuntu uses Github as their repository
then does Lubuntu validate all the programs or does Github?

Kind regards
Joe Smith
-- 
Lubuntu-users mailing list
Lubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/lubuntu-users