Follow-up: MFS Meeting. Tue, 21 August. "Avahi Zeroconf. Software Freedom Day. Libre 5. Foreshadow; SegmentSmack+FragmentSmack"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============2650112873718461105==
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="1SrJk7BrMgybNusTtphNHdaAk6E9i8I0T"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--1SrJk7BrMgybNusTtphNHdaAk6E9i8I0T
From: Michael Dorrington <[email protected]>
To: Manchester Free Software <[email protected]>
Cc: Free Software and the United Kingdom <[email protected]>
Message-ID: <[email protected]>
Subject: Follow-up: MFS Meeting. Tue, 21 August. "Avahi Zeroconf. Software
 Freedom Day. Libre 5. Foreshadow; SegmentSmack+FragmentSmack"
References: <[email protected]>
In-Reply-To: <[email protected]>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Follow-up from the meeting; if you need any additional help then please
reply to the list.


Foreshadow and Foreshadow-NG do have kernel updates such as those to Linu=
x:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit=
/?id=3D958f338e96f874a0d29442396d6adf9c1e17aa2d

so installing the security updates from your distro should help.
However, you may wish to tighten up on the new kernel parameter
defaults, see the above link or local kernel documentation.  And you
might want to disable Hyperthreading in the BIOS; this is what Theo de
Raadt of OpenBSD recommends:

https://marc.info/?l=3Dopenbsd-tech&m=3D153504937925732

As discussed before, you can run the spectre-meltdown-checker to detect
earlier disclosed, and related, speculative execution vulnerabilities.
Work to check for Foreshadow and Foreshadow-NG is being added:

https://packages.debian.org/spectre-meltdown-checker


As discussed in the meeting, you may or may not want mDNS when on a
trusted network but less so on public Wi-Fi.  The issue of disabling
Avahi has confused other users, an internet search reveals.

The following command will: stop the Avahi daemon and associated
services; stop them restarting either on system boot or manually:

systemctl --now mask avahi-daemon

To revert:

systemctl unmask avahi-daemon
systemctl start avahi-daemon

and see the manual page of systemctl for more help (`man systemctl`).

Another option is to uninstall the "avahi-daemon" (or similar) package
but make sure you know what you are doing before doing this.

You might also want to do a belt & braces and not allow destination 5353
UDP in nor destination 5353 UDP out using a firewall/ACL.

Always remember to confirm by testing.


Post to the list if you want to know more or need help.

Regards,
Mike.
MFS Chair


On 18/08/18 13:28, Michael Dorrington wrote:
> Please forward this notice to those that would welcome it.
>=20
> You can subscribe to the Manchester Free Software mailing list at:
> https://lists.nongnu.org/mailman/listinfo/fsuk-manchester
>=20
> * Event: Manchester Free Software's August Meeting
>=20
> * 45 minute slot: Avahi zero-configuration networking
> * 15 minute slot 1: Software Freedom Day 2018 in Manchester
> * 15 minute slot 2: Libre 5 progress
> * 15 minute slot 3: Security - Foreshadow; SegmentSmack+FragmentSmack
>=20
> * Date: Tuesday, 21st August 2018 (3rd Tuesday of the month)
> * Start time: 19:00
> * Finish time: 21:00
>=20
> * Location: PLANT NOMA
>   -
> https://madlab.org.uk/2018/04/madlab-and-plant-noma-announce-new-collab=
oration/
>   - https://www.plantnoma.com/
> * Address: Redfern, Dantzic Street, NOMA, M60 0AE.
>   - Near Shudehill Interchange and not far from original Madlab.
>   - https://www.openstreetmap.org/#map=3D19/53.48668/-2.23934
>=20
>=20
> =3D=3D Details =3D=3D
>=20
> =3D=3D=3D Introduction =3D=3D=3D
>=20
> The purpose of Manchester Free Software is to promote the Free Software=

> philosophy.
>=20
> Every meeting we start with an opportunity for informal key signing.
> For an explanation of what this is about see:
> https://en.wikipedia.org/wiki/Key_signing_party
>=20
>=20
> =3D=3D=3D Schedule =3D=3D=3D
>=20
> 19:00-19:05 Introduction and key signing
> 19:05-19:20 Software Freedom Day 2018 in Manchester
> 19:20-19:25 Short Break (5 minutes)
> 19:25-20:10 Avahi zero-configuration networking
> 20:10-20:25 Long Break (15 minutes)
> 20:25-20:40 Libre 5 progress
> 20:40-20:45 Short Break (5 minutes)
> 21:45-21:00 Security - Foreshadow; SegmentSmack+FragmentSmack
>=20
>=20
> =3D=3D=3D Topic details =3D=3D=3D
>=20
>=20
> =3D=3D=3D=3D Software Freedom Day 2018 in Manchester =3D=3D=3D=3D
>=20
> Software Freedom Day 2018 is on Saturday, 15th September.  Software
> Freedom Day is a world-wide celebration and promotion of Software
> Freedom.  We'll discuss our event in Manchester which are doing with Ma=
nLUG.
>=20
> * https://www.softwarefreedomday.org/
>=20
>=20
> =3D=3D=3D=3D Avahi zero-configuration networking =3D=3D=3D=3D
>=20
> This will be a talk and demo on Avahi, the zero-configuration networkin=
g
> software.  Avahi is generally installed by default on GNU/Linux desktop=

> installs.  We'll explore the components, uses, the good and the bad.
>=20
> * https://en.wikipedia.org/wiki/Avahi_%28software%29
> * https://packages.debian.org/avahi
>=20
>=20
> =3D=3D=3D=3D Libre 5 progress =3D=3D=3D=3D
>=20
> A look at Libre 5, the freedom focused smart phone (aka pocket
> computer).  Libre 5 is being worked on by Manchester Free Software's
> very own Bob Ham.
>=20
> * https://puri.sm/posts/librem5-progress-report-17/
>=20
>=20
> =3D=3D=3D=3D Security - Foreshadow; SegmentSmack+FragmentSmack =3D=3D=3D=
=3D
>=20
> Security briefing covering 2 main topics with the level of detail
> determined by participants:
>=20
> 1. Foreshadow and Foreshadow-NG are yet more speculative execution
> attacks on Intel CPUs such as Meltdown and Spectre.
>=20
> * https://foreshadowattack.eu/
>=20
> 2. SegmentSmack and FragmentSmack are issues with how Linux (which is a=

> kernel) deals with network traffic.
>=20
> * https://access.redhat.com/articles/3553061
> * https://security-tracker.debian.org/tracker/linux
>=20
>=20
> =3D=3D Location =3D=3D
>=20
> The meeting will take place at the usual PLANT NOMA, details above.
>=20
>=20
> =3D=3D Transport =3D=3D
>=20
>=20
> =3D=3D=3D Parking =3D=3D=3D
>=20
> Around the venue there are parking meter bays that become zero cost
> after 8pm on Tuesday so you will have to pay up until then and the
> maximum stay is 2 hours BUT MAKE SURE YOU VERIFY ALL THIS on parking.
>=20
> There are paid parking lots around the venue, they are marked by a blue=

> P in this OpenStreetMap centred on PLANT NOMA
> <https://www.openstreetmap.org/#map=3D15/53.48668/-2.23934>.  Most of
> those parking lots are owned by NCP <http://www.ncp.co.uk/>.
>=20
> If you can't decide otherwise then park in Manchester Arndale
> <https://www.manchesterarndale.com/visiting/directions>.
>=20
>=20
> =3D=3D=3D Public Transport =3D=3D=3D
>=20
> Manchester Victoria (MCV) train station, Shudehill tram and bus station=
,
> and Manchester Piccadilly bus station are all fairly close to PLANT
> NOMA, see OpenStreetMap centred on PLANT NOMA
> <https://www.openstreetmap.org/#map=3D15/53.48668/-2.23934>.
>=20
> Manchester Piccadilly (MAN) train station and Manchester Central Coach
> Station are not too far away either.
>=20
>=20
> =3D=3D More Information =3D=3D
>=20
> Information about Manchester Free Software can be found on the
> Manchester Free Software pages on LibrePlanet
> <https://libreplanet.org/wiki/Manchester>.
>=20
> Regards,
> Mike.
> MFS Chair.
>=20


--=20
FSF member #9429
http://www.fsf.org/register_form?referrer=3D9429
http://www.fsf.org/about
"The Free Software Foundation (FSF) is a nonprofit with a worldwide
mission to promote computer user freedom and to defend the rights of all
free software users."



--1SrJk7BrMgybNusTtphNHdaAk6E9i8I0T
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQJWBAEBCABAFiEEymnV/lrtCqpNhpze13JsPqr44+8FAluFmYUiHG1pY2hhZWwu
ZG9ycmluZ3RvbkBtZW1iZXIuZnNmLm9yZwAKCRDXcmw+qvjj78o3D/9wYtQDIb+Y
Psth7pozyk9+1mG1seuy+nHg5ZmwmPDV1699cMtwr6XH0/qy6GByAkAXyXAjhVj4
/Hiqkav0d4eHQIUWvz0GZ+A62Iy2XfKgeFobhyWZnwPe510fsWTG7ZqbgygPuk0s
/QVMYxd+MVXdzjxilnroqQnimg9vHF+D3Z54jHXHdfkvy5/b2Axq/KDwLCLortIQ
p/k6qcPXuO+dFcNi20mVb6egG+j3JBpnvyIeHYv0EqaiQmeF+NRX0dn9OcKbGgEe
bE406nw4khpXdborX7oAi3vzhNVsvYCaczFhaCsXUydFmLNJYKrefuHIbw5fTwUn
b6nuPfr+V8877sWEy2FuA12/5qJvtm2sd0OpFR5V6yZjI2aR9fi5rRRj1BENwPMg
w/ytA0mljKlk1WdCrbwrwU80VuWmVYVFMpunZv0UcV3BUeDNE9C/Mll1JTCiM8d/
ZsuyD4mWX20IUGOag9qbs85WH6xixUaPbbIR5aZ8yl2hUmCflCqkjJy3iOdq/AIm
GgEUGeTVh+U4t4RZycZnivNGpYuccbQtzHVxMshxcEd+ZAbxGYWf5TAVvvvbuzqX
kUFYbYaNpZXyy6oDAKqIRl/DBloB6bdVMbzmwi39U0ggSFF3WQv1MuZAVC0o4RJK
DWTFHldOddh/K3SWhODu7rDDcNWhnZhOsA==
=kG7c
-----END PGP SIGNATURE-----

--1SrJk7BrMgybNusTtphNHdaAk6E9i8I0T--


--===============2650112873718461105==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Fsfe-uk mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/fsfe-uk

--===============2650112873718461105==--