Re: Using festival in Orca (opens a shell)

--ccwFct8TKGStw6pf
Content-Type: text/plain; protected-headers=v1; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Date: Fri, 23 Jan 2026 07:20:36 +0100
From: Carles Pina i Estany <[email protected]>
To: [email protected]
Subject: Re: Using festival in Orca (opens a shell)


Hi again,

On 23 Jan 2026 at 07:09:07, Carles Pina i Estany wrote:

> > The systemd unit recently introduced at least shrinks down the
> > permissions to the dynamic user permissions, so it actually reduces
> > the concern to "somebody that has localhost tcp access has access as
> > anonymous user", which is way better than "somebody that has localhost
> > tcp access has access as whatever user who happened to start festival."
>=20
> Well, this is thanks to the "festival --server" rejecting connections
> from outside localhost.
>=20
> If I enable the socket activation and *after* "festival --server" runs:
> festival is reachable from outside localhost. But it drops the
> connections. I see the clients reaching it via:
>=20
> carles@pinux:~$ sudo journalctl -u festival -f
>=20
> I'll check how to make festival binding only to localhost (I think that
> some options could be passed to "festival --server" but I don't know if
> this is possible...)

I think that this was a PEBKAC (bad testing).

When using the festival.socket, I cannot reach festival from outside
localhost.

--=20
Carles Pina i Estany
https://carles.pina.cat | [email protected] | [email protected]

--ccwFct8TKGStw6pf
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEth6/Zob9uGYomaJ+qAKIT2ClX4EFAmlzEzQACgkQqAKIT2Cl
X4FhUA/+IwydZr0lPxAMIaqwIvCt7621bCufkYmu0rG7nxZtXZ82HFCjq/iKwJix
mg8Xm/GZ5078yvER5X5h72Uid84yGW5lkvQxyUyVxNz/th+esO+M5Ll8LcsSinCI
WX/OxbSW1cDfX2waXeshCt0KuOmpFn2mXVIS/P6gbnBH5BqSyLN2An/cK7bYYL16
BCmPXPLtRC36nsn6Z/moKbOTbS2KBJbkRO3Sl9HrpoG59SmdaWLsybG7yCu1tgt0
6ZJ8rwvfvFy12ORJnyIGT37ylua6Wy5kZKoU0J4ii7CGFSo4T0yGwfwRZluYDuhi
j1FFWNfE6ODbv/pehFQtvh4Obsy0EBKNckl2riLZ/ugRbX4B7L7v8kYJ9yzPVRCd
yoyzr5pCBuD44R5aNTDZdJhSWm9yV/argHczaWzYUMh2j+o6OWE31XdGQ4hrpPu3
5qnHwTZBx8hO5gPRFQf0nZ6GZxARGyhFYJEITh5afwIwZco9ZyT1i6AHbNwTG2b9
Fg/zAHkSaJycyBsxpjrXVxPWnuu7wpD82JJI6FKEvHeOlKL7iLBi/pNSJdX9Qdwr
4kAL+NisXarmXbsNMgqpioBJydXvJ5ObVNcadcDYLIihs7/22XFCxqefMGB3r+S/
vtbgHz32qYexuzOUvHGDDbkTNs0eDxgkQAtPZz5oiaCCdYKOpuk=
=0XIA
-----END PGP SIGNATURE-----

--ccwFct8TKGStw6pf--