From b499d40848c7699b32e26744efacc1f17417076e Mon Sep 17 00:00:00 2001 From: Ken Fallon Date: Wed, 6 Sep 2023 09:39:38 +0200 Subject: [PATCH] 2023-09-06_07-39-38Z_Wednesday database changed --- sql/hpr.sql | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sql/hpr.sql b/sql/hpr.sql index a949690..d05fa0b 100644 --- a/sql/hpr.sql +++ b/sql/hpr.sql @@ -20015,7 +20015,7 @@ INSERT INTO `eps` (`id`, `date`, `title`, `duration`, `summary`, `notes`, `hosti (3684,'2022-09-15','Wake on Lan',602,'Wake on Lan mother board feature','

WakeOnLAN (WOL)

\n

From wiki.wireshark.org

\n
\n

WakeOnLAN is the protocol name given to the so-called Magic Packet technology, developed by AMD and Hewlett Packard for remotely waking up a remote host that may have been automatically powered-down because of its power management features. Although power management allows companies and individuals to cut power usage costs, it presents a problem for IT departments especially in being able to quickly and efficiently remotely manage PC\'s, especially during off-hours operation when those PC\'s are most likely to be in a suspended or standby state, assuming power management features are enabled.

\n
\n',129,0,0,'CC-BY-SA','Wake on Lan, wol',0,0,1), (3686,'2022-09-19',' Followup for HPR3675: Clarifications on the path traversal bug',2335,'installing a plan 9 cpu+web server, namespaces to the rescue, web app security models and more','

Followup for HPR3675: Installing a Plan 9 CPU server, Plan 9 web server, clarifications on the path traversal bug, private namespaces to the rescue, web application security models

\n
\n

Installing Plan 9 with libvirt

\n
[root@localhost]# virt-install -n 9pwn \\\n--description "pre-patched rc-httpd" \\\n--osinfo=unknown \\\n--memory=4096 \\\n--vcpus=4 \\\n--disk path=/var/lib/libvirt/images/9pwn.qcows,bus=virtio,size=10 \\\n--graphics spice \\\n--cdrom ~/Downloads/9front-8593.acc504c319a4b4188479cfa602e40cb6851c0528.amd64.iso \\\n--network bridge=virbr0\n\n[root@localhost]# virt-viewer 9pwn\n
\n

How I find the IP of my guests and add it to my /etc/hosts for faster access.

\n
[root@localhost]# virsh domiflist 9pwn\n Interface   Type     Source   Model   MAC\n----------------------------------------------------------\n vnet3       bridge   virbr0   e1000   52:54:00:43:8a:50\n\n[root@localhost]# arp -e | grep 52:54:00:43:8a:50\n192.168.122.20           ether   52:54:00:43:8a:50   C                     virbr0\n\n[root@localhost]# echo cirno 192.168.122.20 >> /etc/hosts\n
\n

Proceed as normal with a 9 installation

\n
\n

Set up CPU server with rc-httpd and werc

\n

I wrote about configuring a CPU server and also mirrored the notes at my 9front webserver containing a mirror of my plan 9 related things (using self-signed certs but it\'s fine) I\'ve snarfed+pasted it here for the sake of completeness and modified it slightly so that it\'s more accessible for other people. I\'ve also revised these notes so that they\'re less-broken. I may or may not update them.

\n

I\'m using 9front for this. It has more secure authentication protocols when it comes to remotely connecting.

\n

Configuring a CPU server

\n

Add users to file server

\n

Connect to the file server and add a new user called <ExampleUser> who is in the groups sys, adm, and upas

\n
term% con -C /srv/cwfs.cmd\nnewuser <ExampleUser>\nnewuser sys +<ExampleUser>\nnewuser adm +<ExampleUser>\nnewuser upas +<ExampleUser>\n
\n

Reboot and set user=<ExampleUser> when prompted at boot time.

\n

Configure user\'s environment

\n

This is similar to cp -r /etc/skel /home/<ExampleUser> on a UNIX system.

\n
/sys/lib/newuser\n
\n

Configure headless booting

\n

Mount the boot partition:

\n
term% 9fs 9fat\n
\n

edit the boot config, /n/9fat/plan9.ini

\n
bootfile=9pc64\nnobootprompt=local!/dev/sdC0/fscache\nmouseport=ps2\nmonitor=vesa\nvgasize=1024x768x14\nuser=<ExampleUser>\ntiltscreen=none\nservice=cpu\n
\n

Add hostowner info to nvram

\n

Hostowner is similar to root but not quite. In our configuration, hostowner is close to being equivalent to a root user. The user= line in our bootprompt sets the hostowner.

\n

For automatic booting (aka not entering a password at the physical machine every time we power it in), we need to add the hostowner\'s key to nvram.

\n
term% nvram=/dev/sdF0/nvram auth/wrkey\nbad nvram des key\nbad authentication id\nbad authentication domain\nauthid: <ExampleUser>\nauthdom: cirno\nsecstore key: <press the return key if you do not want to type this at boot time>\npassword: <make it 8 chars>\n
\n

Configure auth server

\n

In order to connect to the system over the network, the new user must be added to the auth server.

\n
term% auth/keyfs\nterm% auth/changeuser <ExampleUser>\nPassword: <what you put earlier>\nConfirm password:\nAssign new Inferno/POP secret? [y/n]: n\nExpiration date (YYYYMMDD or never) [never]: never\nPost id:\nUser's full name:\nDepartment #:\nUser's email address:\nSponsor's email address:\nuser <ExampleUser> installed for Plan 9\n
\n

Configure permissions

\n

/lib/ndb/auth is similar to a /etc/sudoers. This configuration for the new user allows him to execute commands as other users except for the sys and adm users (but sys and adm are more like groups but who cares).

\n

append to /lib/ndb/auth

\n
hostid=<ExampleUser>\n    uid=!sys uid=!adm uid=*\n
\n

then reboot

\n

Test if it worked with drawterm

\n

The 9front version of drawterm must be used as it supports the better crypto in 9front. Other drawterm versions probably won\'t work.

\n
$ /opt/drawterm -u <ExampleUser> -h example.com -a example.com -r ~/\n
\n

Configure rc-httpd

\n

edit /rc/bin/rc-httpd/select-handler

\n

this file is something like /etc/httpd.conf on a UNIX system.

\n
#!/bin/rc\nPATH_INFO=$location\n\n        switch($SERVER_NAME) {\n        case example.com\n               FS_ROOT=/sys/www/$SERVER_NAME\n               exec static-or-index\n\n        case *\n              error 503\n}\n
\n

To listen on port 80 and run the handler on port 80:

\n
cpu% cp /rc/bin/service/!tcp80 /rc/bin/service/tcp80\ncpu% chmod +x /rc/bin/rc-httpd/select-handler\n
\n

Reboot and test.

\n

SSL

\n

I will never give money to the CA racket. Self-signed is the way to go on systems that don\'t support acme.sh, the only ACME client I use for obtaining free SSL certs.

\n

Generate and install:

\n
cpu% ramfs -p\ncpu% cd /tmp\ncpu% auth/rsagen -t 'service=tls role=client owner=*' > key\ncpu% chmod 600 key\ncpu% cp key /sys/lib/tls/key\ncpu% auth/rsa2x509 'C=US CN=example.com' /sys/lib/tls/key | auth/pemencode CERTIFICATE > /sys/lib/tls/cert\ncpu% mkdir /cfg/$sysname\ncpu% echo 'cat /sys/lib/tls/key >> /mnt/factotum/ctl' >> /cfg/$sysname/cpustart\n
\n

Now add a listener in /rc/bin/service/tcp443:

\n
#!/bin/rc\nexec tlssrv -c /sys/lib/tls/cert -l /sys/log/https /rc/bin/service/tcp80 $*\n
\n

And make it executable:

\n
cpu% chmod +x /rc/bin/service/tcp443\n
\n

Install and configure werc

\n
cpu% cd\ncpu% mkdir /sys/www && cd www\ncpu% hget http://werc.cat-v.org/download/werc-1.5.0.tar.gz  > werc-1.5.0.tgz\ncpu% tar xzf werc-1.5.0.tgz\ncpu% mv werc-1.5.0 werc\n\n# ONLY DO THIS IF YOU *MUST* RUN THE THINGS THAT ALLOW WERC TO WRITE TO DISK\n# EG. DIRDIR, BLAGH, ETC\n# DON'T DO THIS, JUST USE DRAWTERM OVER THE NETWORK\n# HTTP CLIENTS SHOULD NEVER BE ALLOWED TO WRITE TO DISK\n# PLEASE I BEG YOU\ncpu% cd .. && for (i in `{du www | awk '{print $2}'}) chmod 777 $i\n\ncpu% cd werc/sites/\ncpu% mkdir example.com\ncpu% mv default.cat-v.org example.com\n
\n

now re-edit /rc/bin/rc-httpd/select-handler

\n
#!/bin/rc\nWERC=/sys/www/werc\nPLAN9=/\nPATH_INFO=$location\nswitch($SERVER_NAME){\ncase cirno\n        FS_ROOT=$WERC/sites/$SERVER_NAME\n        exec static-or-cgi $WERC/bin/werc.rc\ncase *\n        error 503\n}\n
\n

Test the website. Werc is fiddly. Werc is archaic. Werc is fun.

\n
\n

Path traversal vulnerabilities in old versions of rc-httpd

\n

Using release COMMUNITY VS INFRASTRUCTURE, an old release with old rc-httpd, I have done the above steps. In current releases this bug no longer exists. Use current releases.

\n

The vulnerability

\n
# get list of werc admin users\n[root@localhost]# curl http://cirno/..%2f..%2f/etc/users/admin/members\npwn\n# get that werc user's password\n[root@localhost]# http://cirno/..%2f..%2f/etc/users/pwn/password\nsupersecret\n
\n

Wait, the passwords for werc are stored in plain text? Let\'s log in

\n
[root@localhost]# firefox http://cirno/_users/login\n
\n

Now let\'s see if any of the werc users are also system users:

\n
# let's enumerate users\n[root@localhost]# curl http://cirno/..%2f..%2f..%2f..%2f..%2f..%2f/adm/users\n-1:adm:adm:glenda,pwn\n0:none::\n1:tor:tor:\n2:glenda:glenda:\n3:pwn:pwn:\n10000:sys::glenda,pwn\n10001:map:map:\n10002:doc::\n10003:upas:upas:glenda,pwn\n10004:font::\n10005:bootes:bootes:\n
\n

Let\'s hope that no one is re-using credentials. Let\'s check just to be sure

\n
$ PASS=supersecret /opt/drawterm -u pwn -h cirno -a cirno -G\ncpu% cat /env/sysname\ncirno\ncpu%\n
\n

This is what happens when you have path traversal vulnerabilities, an authentication vulnerability in your CMS, and share login/passwords

\n

How the static-or-cgi handler works

\n

rc-httpd calls various handler scripts that decide what to do with requests. In the example configuration for werc, rc-httpd is instructed to call the static-or-cgi script.

\n

I will compile these archaic rc scripts into pseudo code for the listener.

\n

The static-or-cgi handler (the handler specified in the httpd config) is simple:

\n
#!/bin/rc\ncgiargs=$*\n\nfn error{\n    if(~ $1 404)\n        exec cgi $cgiargs\n    if not\n        $rc_httpd_dir/handlers/error $1\n}\n\nif(~ $location */)\n    exec cgi $cgiargs\nif not\n    exec serve-static\n
\n
    \n
  1. If the requested file exists, call the cgi handler and pass it arguments.
    2. \n
  2. If the requested file does not exist, call the serve-static handler.
    3. \n
\n

How the serve-static handler works

\n

The problem lies in the serve-static handler:

\n
#!/bin/rc\nfull_path=`{echo $"FS_ROOT^$"PATH_INFO | urlencode -d}\nfull_path=$"full_path\nif(~ $full_path */)\n    error 503\nif(test -d $full_path){\n    redirect perm $"location^'/' \\\n        'URL not quite right, and browser did not accept redirect.'\n    exit\n}\nif(! test -e $full_path){\n    error 404\n    exit\n}\nif(! test -r $full_path){\n    error 503\n    exit\n}\ndo_log 200\nswitch($full_path){\ncase *.html *.htm\n        type=text/html\ncase *.css\n        type=text/css\ncase *.txt *.md\n        type=text/plain\ncase *.jpg *.jpeg\n        type=image/jpeg\ncase *.gif\n        type=image/gif\ncase *.png\n        type=image/png\ncase *\n        type=`{file -m $full_path}\n}\nif(~ $type text/*)\n    type=$type^'; charset=utf-8'\nmax_age=3600    # 1 hour\necho 'HTTP/1.1 200 OK'^$cr\nemit_extra_headers\necho 'Content-type: '^$type^$cr\necho 'Content-length: '^`{ls -l $full_path | awk '{print $6}'}^$cr\necho 'Cache-control: max-age='^$max_age^$cr\necho $cr\nexec cat $full_path\n
\n
    \n
  1. encode the full file path into a url
    2. \n
  2. if the url points to a file outside of \'*/\', the document root, error 503
    3. \n
  3. if the url is broken, exit
    4. \n
  4. if the url points to a file that neither exists nor is readable, error 503
    5. \n
  5. if you haven\'t exited by now, serve the file
    6. \n
\n

The problem is no sanitization. The script checks for files in the current directory BUT NOT BEFORE ENCODING THE URL STRING.

\n

The urlencode command works by decoding encoded characters.

\n
cpu% echo 'http://cirno/..%2f' | urlencode -d\nhttp://cirno/../\n
\n

Does ../ exist in */ ? the answer is yes.

\n

.. is a directory contained inside of */

\n

*/../ is the current working directory.

\n

How they fixed it

\n

Adding a sanitizer. By comparing the encoded url against an actual hypothetical file path and exiting if there is a mismatch, all %2f funny business is avoided.

\n
\n

Other (optional) bad config options in werc

\n

rc-httpd aside, a bad werc config can still lead to website defacement if your non rc-httpd webserver has a path traversal vulnerability.

\n

Additionally I have modified the DAC for /sys/www to allow werc, a child process of rc-httpd to write to disk. rc-httpd runs as the none user so it\'s not typically allowed to write to disk unless explicitly permitted. I do not allow this on my 9 webserver because it\'s the worst idea in the history of all time ever.

\n

I enabled the dirdir and blagh modules as if I were the type of admin who does a chmod -R 777 /var/www/htdocs because that\'s what the wordpress installation guide told me to do so I could have a cool and easy way to modify my website from the browser.

\n

Let\'s pretend that I\'m not the admin of this system and scrape the werc config just to see if the hypothetical badmin has these modules enabled.

\n
# get config\n[root@localhost]# curl http://cirno/..%2f..%2f/sites/cirno/_werc/config\nmasterSite=cirno\nsiteTitle='Werc Test Suite'\nconf_enable_wiki\nwiki_editor_groups admin\n
\n

Hmmm, looks like these modules are enabled so we can assume that httpd is allowed to write to disk. Let\'s modify cirno/index.md to warn the admin. As a funny joke. Totally not a crime under the Computer Fraud and Abuse Act. Totally not an inappropriate way to warn admins about a vulnerability.

\n
[root@localhost]# curl -s cirno | pandoc --from html --to plain\nquotes | docs | repo | golang | sam | man | acme | Glenda | 9times |\nharmful | 9P | cat-v.org\n\nRelated sites: | site updates | site map |\n\nWerc Test Suite\n\n-   › apps/\n-   › titles/\n\nSECURITY ADVISORY:\n\nlol this guy still hasn't figured out the ..%2f trick\n\nPowered by werc\n
\n

Modifying werc to support password hashing

\n

Adding password hashes isn\'t too difficult. Being constrained by time, I have not done this quite yet. Reading the source code, all it takes is modifying 2 werc scripts: bin/werclib.rc and bin/aux/addwuser.rc

\n
% echo 'supersecret' | sha1sum -2 512\n
\n
\n

Private namespaces to the rescue

\n

Luckily enough, the webserver runs as the none user with it\'s own namespace.

\n

Comparing the hostowner\'s namespace and none user\'s namespace

\n

I grab the namespace from the system console (ie not from drawterm) and from the listen command, then run a diff (unix style) to show the differences.

\n
cpu% ns | sort > cpu.ns\ncpu% ps -a | grep -e 'listen.*80' | grep -v grep\nnone            355    0:00   0:00      132K Open     listen [/net/tcp/2 tcp!*!80]\ncpu% ns 355 | sort > listen.ns\ncpu% diff -u listen.ns cpu.ns\n--- listen.ns\n+++ cpu.ns\n@@ -6,17 +6,29 @@\n bind  /amd64/bin /bin\n bind  /mnt /mnt\n bind  /mnt/exportfs /mnt/exportfs\n+bind  /mnt/temp/factotum /mnt/factotum\n bind  /n /n\n bind  /net /net\n bind  /root /root\n+bind -a '#$' /dev\n bind -a '#I' /net\n+bind -a '#P' /dev\n+bind -a '#S' /dev\n bind -a '#l' /net\n+bind -a '#r' /dev\n+bind -a '#t' /dev\n+bind -a '#u' /dev\n+bind -a '#u' /dev\n bind -a '#¤' /dev\n bind -a '#¶' /dev\n+bind -a '#σ/usb' /dev\n+bind -a '#σ/usbnet' /net\n bind -a /rc/bin /bin\n bind -a /root /\n+bind -b '#k' /dev\n bind -c '#e' /env\n bind -c '#s' /srv\n+bind -c /usr/pwn/tmp /tmp\n cd /usr/pwn\n mount -C '#s/boot' /n/other other\n mount -a '#s/boot' /\n@@ -26,4 +38,4 @@\n mount -a '#s/slashmnt' /mnt\n mount -a '#s/slashn' /n\n mount -aC '#s/boot' /root\n-mount -b '#s/factotum' /mnt\n+mount -b '#s/cons' /dev\n
\n

The major difference is that the hostowner (equivalent to root user) has a lot more things bound to his namespace:

\n\n

The listen process in question is fairly well isolated from the system. Minimal system damage can be caused by pwning a process owned by none.

\n
\n

Closing

\n

An argument could be maid that the rc-httpd vulnerability was \"not a bug\" because \"namespaces are supposed to segregate the system\".

\n

I disagree on this point. Namespaces are good and all but security is a multi-layer thing. Relying on a single security feature to save your system means relying on a single point of failure. Chroot escapes, namespace escapes, container escapes, and VM escapes are all things we need to be thinking about when writing software that touches the internet. Although unlikely, getting pwnd in spite of these security methods is still possible; all user input is dangerous and all user input that becomes remote code execution always results in privilege escalation no matter how secure you think your operating system is. Each additional layer of security makes it harder for attackers to get into the system.

\n

For example, when I write PHP applications, I consider things in this order:

\n
    \n
  1. don\'t pass unnecessary resources into the document root via symlinks, bind mounts, etc.
    2. \n
  2. never ever use system() in a context where user input can ever be passed to the function in order to avoid shell escapes
    3. \n
  3. sanitize all user input depending on context. Ex: if the PHP program is directly referencing files, make a whitelist and compare requests to this whitelist. If the PHP process is writing to a database, use prepared statements.
    4. \n
  4. fire up a kali linux vm and beat the test server half to death
    5. \n
  5. iterate upon my ignorance
    6. \n
  6. doubly verify DAC just to be sure
    7. \n
  7. re-check daemon configs to make sure I\'m not doing anything stupid
    8. \n
  8. FINALLY: rely on SELinux or OpenBSD chroots (depending on prod env) to save me if all else failed
    9. \n
\n

And of course the other things like firewalls (with whitelists for ports and blacklists for entire IP address blocks), key based ssh authentication, sshd configurations that don\'t make it possible to enumerate users, rate limiters, etc.

\n

Each layer of security is like a filter. If you have enough layers of filters it would take an unrealistic amount of force to push water through this filter. Although no system is perfectly safe from three letter agencies, a system with multiple layers of security is typically safe from drive-by attacks.

\n

Final exercise: intentionally write a php script that does path traversal. Run this on a system with SELinux. Try to coax /etc/passwd out of the server. Now try php-fpm instead of mod_php or vice-versa. You\'ll be surprised when even MAC doesn\'t protect your system.

\n

Even now, after spending almost a month and a half worth of after work hacker hours almost exclusively on 9, I enjoy it more than when I began and even more than when using it in semi-regular spurts in years past. The purpose of research operating systems is to perform research, be it about the design of the system otherwise. Where would we be without private namespaces? How can I use this idea in the real world? What would the world look like if we had real distributed computing instead of web browsers (which are the new dumb terminal)? Is there a use case for this in the real world? What can we learn from single layer security models? What can we do to improve the system?

\n

Plan 9 is perfect for this type of research. I\'m considering writing an httpd in C and a werc-like (minus the parts I don\'t like) in C and modifying the namespace for the listener so that I can run a webserver on 9 without pulling in /bin in order to reduce the possibility of a shell escape.

\n

I think that in order to improve ourselves, we must be critical of ourselves. We must be critical of the things we enjoy in order to improve them and learn something new in the process. For software especially, there is no such thing as perfection, only least bad. And my final thought:

\n
\n

Criticism: This program/OS/whatever sucks

\n
\n
\n

Response: I know, help me fix it.

\n
\n',406,0,1,'CC-BY-SA','Plan 9, private namespaces, security, research operating systems',0,0,1), (3695,'2022-09-30','How I watch youtube with newsboat',663,'Using youtube\'s channel RSS feeds to watch youtube from the command line','

How I watch youtube with newsboat

\n

I find that the youtube web ui is designed to keep users on the site by feeding them an unending stream of information. Bright colors, distracting thumbnails, peanut galleries, etc. I prefer to consume my videos in the same way I consume everything else: via RSS.

\n

RSS is my favorite way of aggregating things that other people have made because it allows me, the user, to interact with their things

\n

The only dependencies not on a standard UNIX system are newsboat and a video player. I also use yt-dlp to download videos for later viewing. I like mpv but you can substitute your own.

\n
$ sudo $pkgmrg install newsboat mpv yt-dlp
\n

Getting RSS feeds from youtube

\n

Youtube (currently) provides RSS feeds for channels.

\n

Finding Youtube channel ID

\n

Sometimes channels have vanity URLs that can make it difficult to find the channel ID. Other times, the URL contains the channel ID. All youtube channel IDs start with the string UC so we can easily grep for them.

\n
$ curl https://www.youtube.com/c/RMCRetro | grep --color "href=\\"https://www.youtube.com/channel/UC\\""\n[ lots of nonsense ]\nhref="https://www.youtube.com/channel/UCLEoyoOKZK0idGqSc6Pi23w"\n[ lots of nonsense ]
\n

In order to turn this channel ID into something useful, we create the following URL:

\n
https://www.youtube.com/feeds/videos.xml?channel_id=UCLEoyoOKZK0idGqSc6Pi23w
\n

Google takeout can also be used to export youtube subscriptions.

\n

The export format is a CSV that contains the channel IDs for all of our subscriptions.

\n
Channel Id,Channel Url,Channel Title\nUCLEoyoOKZK0idGqSc6Pi23w,http://www.youtube.com/channel/UCLEoyoOKZK0idGqSc6Pi23w,RMC - The Cave
\n

Newsboat url list

\n

Newsboat reads it’s list of URLs from ~/.config/newsboat/urls. Every url we add to this list will be automaticlly fetched. You can make separate URL lists for your list of videos and list of standard text based RSS feeds

\n

If you have an exported CSV, you can easily modify it so that newsboat will accept it as a list of URLs by deleting row 1, column 1+comma, and replacing the comma between the URL and channel name with a tab character. Doing a sed \'s/channel\\//feeds\\/videos.xml?channel_id=/g\' on the file is an easy way to replace the website URL with the feed url. Newsboat only reads the first field of every row so the channel name can be kept for easier subscription management.

\n
http://www.youtube.com/feeds/videos.xml?channel_id=UCLEoyoOKZK0idGqSc6Pi23w     RMC - The Cave
\n

Newsboat config

\n

In order to play videos, we need to add some macros to the newsboat config file at ~/.config/newsboat/config

\n

Mine looks like this.

\n
# load URLS on launch\nauto-reload  yes\n\n# vim binds\nbind-key j down\nbind-key k up\nbind-key j next articlelist\nbind-key k prev articlelist\nbind-key J next-feed articlelist\nbind-key K prev-feed articlelist\nbind-key G end\nbind-key g home\nbind-key d pagedown\nbind-key u pageup\nbind-key l open\nbind-key h quit\nbind-key a toggle-article-read\nbind-key n next-unread\nbind-key N prev-unread\nbind-key D pb-download\nbind-key U bashow-urls\nbind-key x pb-delete\n\n# macro setup\nbrowser linkhandler\nmacro , open-in-browser\n\n# launch video player\nmacro v set browser "setsid -f mpv" ; open-in-browser ; set browser linkhandler\n\n# download video\nmacro d set browser "yt-dlp"; open-in-browser ; set browser linkhandler\n\n# download audio only\nmacro a set browser "yt-dlp --embed-metadata -xic -f bestaudio/best" ; open-in-browser ; set browser linkhandler
\n

Video demo

\n

This is a demo of using newsboat with videos. In order to execute the macros, you type , then v or whatever other letter you set the macro to.

\n

video in webm format your web browser or operating system does not support free video codecs :(

\n

A url list to get you started

\n
https://www.youtube.com/feeds/videos.xml?channel_id=UC3ts8coMP645hZw9JSD3pqQ        Andreas Kling\nhttps://www.youtube.com/feeds/videos.xml?channel_id=UC9-y-6csu5WGm29I7JiwpnA        Computerphile\nhttps://www.youtube.com/feeds/videos.xml?channel_id=UC15BJjhPr4d5gTClhmC4HRw        Elliot Coll\nhttps://www.youtube.com/feeds/videos.xml?channel_id=UCxQKHvKbmSzGMvUrVtJYnUA        Learn Linux TV\nhttps://www.youtube.com/feeds/videos.xml?channel_id=UCm9K6rby98W8JigLoZOh6FQ        LockPickingLawyer\nhttps://www.youtube.com/feeds/videos.xml?channel_id=UCl2mFZoRqjw_ELax4Yisf6w        Louis Rossmann\nhttps://www.youtube.com/feeds/videos.xml?channel_id=UC2eYFnH61tmytImy1mTYvhA        Luke Smith\nhttps://www.youtube.com/feeds/videos.xml?channel_id=UC7YOGHUfC1Tb6E4pudI9STA        Mental Outlaw\nhttps://www.youtube.com/feeds/videos.xml?channel_id=UCjFaPUcJU1vwk193mnW_w1w        Modern Vintage Gamer\nhttps://www.youtube.com/feeds/videos.xml?channel_id=UCLEoyoOKZK0idGqSc6Pi23w        RMC - The Cave\nhttps://www.youtube.com/feeds/videos.xml?channel_id=UC4rqhyiTs7XyuODcECvuiiQ        Scott The Woz\nhttps://www.youtube.com/feeds/videos.xml?channel_id=UC5I2hjZYiW9gZPVkvzM8_Cw        Techmoan\nhttps://www.youtube.com/feeds/videos.xml?channel_id=UCy0tKL1T7wFoYcxCe0xjN6Q        Technology Connections\nhttps://www.youtube.com/feeds/videos.xml?channel_id=UC8uT9cgJorJPWu7ITLGo9Ww        The 8-Bit Guy\nhttps://www.youtube.com/feeds/videos.xml?channel_id=UC5UAwBUum7CPN5buc-_N1Fw        The Linux Experiment\nhttps://www.youtube.com/feeds/videos.xml?channel_id=UCFMx-JitepTttWc-ABHhu8A        This Week in Retro\nhttps://www.youtube.com/feeds/videos.xml?channel_id=UCsnGwSIHyoYN0kiINAGUKxg        Wolfgang's Channel\nhttps://www.youtube.com/feeds/videos.xml?channel_id=UCJ8V9aiz50m6NVn0ix5v8RQ        decino
\n',406,0,1,'CC-BY-SA','newsboat, RSS, youtube',0,0,1), -(3956,'2023-10-02','HPR Community News for September 2023',0,'HPR Volunteers talk about shows released and comments posted in September 2023','\n\n

New hosts

\n

\nWelcome to our new host:
\n\n Noodlez.\n

\n\n

Last Month\'s Shows

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
IdDayDateTitleHost
3935Fri2023-09-01Server build retrospectiveDaniel Persson
3936Mon2023-09-04HPR Community News for August 2023HPR Volunteers
3937Tue2023-09-05Adventures in Pi-HoleNoodlez
3938Wed2023-09-06An open directory of web audio streamdnt
3939Thu2023-09-07How I got into tech and hackingTrixter
3940Fri2023-09-08Equipment MaintenanceAhuka
3941Mon2023-09-11Interview with Yosef Kerzneroperat0r
3942Tue2023-09-12RE: How to make friends.Some Guy On The Internet
3943Wed2023-09-13Why my Dell does it better on Linux.knightwise
3944Thu2023-09-14Race for the Galaxytuturto
3945Fri2023-09-15My chrome pluginsDaniel Persson
3946Mon2023-09-18Planning for a planner, part 02.Some Guy On The Internet
3947Tue2023-09-19Archiving Floppy DisksSteve Saner
3949Thu2023-09-21How I use virtualisation to tame my Social Media addiction.knightwise
3950Fri2023-09-22Sid Meiers\' Alpha CentauriAhuka
3951Mon2023-09-25Cell Phone Screen Protectorsoperat0r
3955Fri2023-09-29airgradient measurement stationDaniel Persson
\n\n

Comments this month

\n\n\nThere were no comments this month.\n\n

Mailing List discussions

\n

\nPolicy decisions surrounding HPR are taken by the community as a whole. This\ndiscussion takes place on the Mail List which is open to all HPR listeners and\ncontributors. The discussions are open and available on the HPR server under\nMailman.\n

\n

The threaded discussions this month can be found here:

\nhttps://lists.hackerpublicradio.com/pipermail/hpr/2023-September/thread.html\n\n\n

Events Calendar

\n

With the kind permission of LWN.net we are linking to\nThe LWN.net Community Calendar.

\n

Quoting the site:

\n
This is the LWN.net community event calendar, where we track\nevents of interest to people using and developing Linux and free software.\nClicking on individual events will take you to the appropriate web\npage.
\n\n

Any other business

\n\n\n\n',159,47,1,'CC-BY-SA','Community News',0,0,1), +(3956,'2023-10-02','HPR Community News for September 2023',0,'HPR Volunteers talk about shows released and comments posted in September 2023','\n\n

New hosts

\n

\nWelcome to our new host:
\n\n Noodlez.\n

\n\n

Last Month\'s Shows

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
IdDayDateTitleHost
3935Fri2023-09-01Server build retrospectiveDaniel Persson
3936Mon2023-09-04HPR Community News for August 2023HPR Volunteers
3937Tue2023-09-05Adventures in Pi-HoleNoodlez
3938Wed2023-09-06An open directory of web audio streamdnt
3939Thu2023-09-07How I got into tech and hackingTrixter
3940Fri2023-09-08Equipment MaintenanceAhuka
3941Mon2023-09-11Interview with Yosef Kerzneroperat0r
3942Tue2023-09-12RE: How to make friends.Some Guy On The Internet
3943Wed2023-09-13Why my Dell does it better on Linux.knightwise
3944Thu2023-09-14Race for the GalaxyTuula
3945Fri2023-09-15My chrome pluginsDaniel Persson
3946Mon2023-09-18Planning for a planner, part 02.Some Guy On The Internet
3947Tue2023-09-19Archiving Floppy DisksSteve Saner
3948Wed2023-09-20Cleaning up my mancave and talking about Creativityknightwise
3949Thu2023-09-21How I use virtualisation to tame my Social Media addiction.knightwise
3950Fri2023-09-22Sid Meiers\' Alpha CentauriAhuka
3951Mon2023-09-25Cell Phone Screen Protectorsoperat0r
3955Fri2023-09-29airgradient measurement stationDaniel Persson
\n\n

Comments this month

\n\n

These are comments which have been made during the past month, either to shows released during the month or to past shows.\nThere is 1 comment in total.

\n

Past shows

\n

There is 1 comment on\n1 previous show:

\n

Updated on 2023-09-05 22:28:25

\n\n\n

Mailing List discussions

\n

\nPolicy decisions surrounding HPR are taken by the community as a whole. This\ndiscussion takes place on the Mail List which is open to all HPR listeners and\ncontributors. The discussions are open and available on the HPR server under\nMailman.\n

\n

The threaded discussions this month can be found here:

\nhttps://lists.hackerpublicradio.com/pipermail/hpr/2023-September/thread.html\n\n\n

Events Calendar

\n

With the kind permission of LWN.net we are linking to\nThe LWN.net Community Calendar.

\n

Quoting the site:

\n
This is the LWN.net community event calendar, where we track\nevents of interest to people using and developing Linux and free software.\nClicking on individual events will take you to the appropriate web\npage.
\n\n

Any other business

\n\n\n\n',159,47,1,'CC-BY-SA','Community News',0,0,1), (3691,'2022-09-26','Starship.rs the best prompt I don\'t use',1529,'Bash prompts','

Here\'s the snippets I use in my .bashrc file.

\n\n
RED='\033[0;31m'\nPLAIN='\033[0m' # No Color\nWHITE='\e[97m'\nGREEN='\e[0;32m'\nPURPLE='\e[35;35m'\nCYAN='\e[36;36m'\n\nJAVA_VERSION=`java --version | head -1 | cut -f2 -d' '`\n\nIP=$(hostname -I | awk '{print $1;}' )\nsource /usr/doc/git-2.35.1/contrib/completion/git-prompt.sh\nPS1='\! [\['$GREEN'\]$(hostname -s) $IP\['$PLAIN'\]] [\['$CYAN'\]$(pwd -P)\['$PLAIN'\]] $(__git_ps1 "[\['$PURPLE'\] %s\['$PLAIN'\]]")[☕ '$JAVA_VERSION']\n\['$GREEN'\]$\['$PLAIN'\] '
\n',78,0,0,'CC-BY-SA','bash,ps1,terminal,linux',0,0,1), (3698,'2022-10-05','Spectrogram',949,'Edit audio as a spectrogram','

Here\'s a view of my voice. The bright spots at the bottom of the image are my voice, and the bright burst at the top is a click caused by saliva.

\n\n

Here\'s me inhaling. Notice how sparse this is compared to my voice.

\n\n

One thing I fail to mention in the episode is that there are network monitors that render network activity as a spectrogram, too. If you don\'t have a Wi-Spy, it\'s worth looking at.

\n',78,0,0,'CC-BY-SA','audio',0,0,1), (3726,'2022-11-14','Breaches ever reaching',251,'A short episode about the reaching effects of breaches and forgotten accounts','

A short episode about the reaching effects of breaches and accounts you may have forgotten about.

\n\n',405,74,1,'CC-BY-SA','cybersecurity,security,EvilSteve,breach,data reduction,privacy',0,0,1), @@ -21199,4 +21199,4 @@ UNLOCK TABLES; /*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */; /*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */; --- Dump completed on 2023-09-05 6:36:04 +-- Dump completed on 2023-09-06 7:38:27