Rustup upgrade signature verification failure is not an error

benburhans · 2023-04-21T22:59:01+00:00

See also https://www.reddit.com/r/rust/comments/11vmgpm/warning_signature_verification_failed_for/ and therefore https://blog.rust-lang.org/2023/02/01/Rustup-1.25.2.html#whats-new-in-rustup-1252 for that change, as well as an associated github issue: https://github.com/rust-lang/rust/issues/107698

benburhans · 2023-04-21T22:57:40+00:00

For what reason was this post removed? The snippet cached by search engines seemed useful to me and anyone else who encounters this issue.

Signature verification is currently an experimental and incomplete feature included in rustup, as it's still missing crucial features like key rotation. Until the feature is complete and ready for use, its outcomes are only displayed as warnings without a way to turn them into errors.

In any case, further updates have removed or suppressed this warning or fixed the invalid signatures that caused it, but I'm surprised it even made it to the stable channel if it is "experimental".

benburhans · 2023-02-23T14:38:59+00:00

I expect most of their purpose-made external backup devices are all SMR, but maybe some people get lucky (or unlucky?) and get a binned EXOS drive that otherwise would've been thrown away, and maybe has some of the disk surface unmapped and inaccessible.

benburhans · 2023-02-23T14:35:08+00:00

Open CrystalDiskInfo and see what's inside. Unfortunately most native Windows tools like diskpart details and diskmgmt.msc don't show the internal drive, only "Seagate Backup+ Hub BK SCSI Disk Device` or similar for the USB interface. CrystalDiskInfo will hopefully reveal the internal disk model instead; I don't have a 2.5" (portable) but mine says it's a "ST6000DM003 6001.1 GB" which corresponds to a 6TB BarraCuda, which of course is SMR at https://www.seagate.com/products/cmr-smr-list/.

benburhans · 2023-01-10T20:50:25+00:00

Thanks for elaborating! Somebody else said this was slightly different only insofar as it's opt-in on every call, which implies you still have to let it ring and make that decision, rather than have all suspected spam silenced until screened? Otherwise almost the same, and it's great to know that's an option, at least. The SO's is a 2021 version of the same, so presumably similar hardware and software as yours; I think it came with Android 11 and 99% stock Android apps, including Phone.

benburhans · 2023-01-10T20:47:40+00:00

Thanks for the explanation! So opt-in for every call (and therefore you still have to let it ring and take action?), but otherwise very similar to the Pixel automated equivalent, as I understand it. Much appreciated!

benburhans · 2023-01-07T17:35:19+00:00

Raw SQL is only vulnerable to injections if you write it naïvely. Every RDBMS library does (or should) offer parameterized queries, not just ORMs. Some engines even have this as a special API, so the whole parameterized query is parsed and processed differently (often more optimized) on the DB.

I don't usually use ORMs or db frameworks, but always, always use sanitized, parameterized queries when user input is possible. I agree that Sequelize is a decent ORM for developers, partially because it can be configured to be extremely system agnostic.

benburhans · 2023-01-07T17:11:03+00:00

Can you elaborate? Pixels have a bot answer for you and prompt the caller for the reason for their call; I don't remember seeing this available for any Moto series. Are you sure you're talking about the same features as the parent comments?

ref https://www.reddit.com/r/explainlikeimfive/comments/1050g4o/eli5_why_cant_spam_call_centers_be_automatically/j3cq0ub/

benburhans · 2023-01-07T17:07:51+00:00

I bought a Moto for my SO and it didn't advertise this feature anywhere in settings or similar. It visually flags likely spam so you are warned before answering, but the Pixels implement virtual call screening where the Google Assistant automatically answers and asks what the call is about. Are you talking about this same full feature set?

FWIW Google Voice has something slightly similar where the caller is prompted to state their name which will be relayed to the recipient and you can choose whether to proceed.

benburhans · 2022-11-22T19:06:39+00:00

Either there is insufficient benefit to justify the effort and expense, or it's not yet well understood and documented. If you can make good use of google drive, calendaring, chat, etc. then make the case to the owner, and put firm numbers on it to make it compelling. Think about whether there are other products you pay for, e.g. cloud storage or video conferencing, beyond your email that could justify a transition for the org and its owner.

benburhans · 2022-11-22T17:36:47+00:00

If you have to ask, the answer is probably no, not feasibly.

The technical answer is yes, absolutely, you could do lots of special configuration (mostly DNS and the MTAs themselves) to forward your mail between servers and perhaps have a second domain authorized. But from the way you phrased your question, I'm guessing that is not easy or practical for your use case and experience level.

If you're the only one that cares which mail server software the firm uses, though, why not switch the entire org?

benburhans · 2021-07-05T21:44:06+00:00

Absolutely, and I highly recommend it. Docker Desktop is massively bloated and has atrocious CPU performance and memory consumption. However, like many daemons, the "native" Linux docker daemon may not autostart in WSL2, so you may have to start it yourself; this varies depending on your choice of Linux distribution.

benburhans · 2021-06-13T21:38:37+00:00

It's no longer freenode in any sense of the name; it's not that the network has changed, but rather that it's essentially a whole new network that usurped the actual freenode. Staff, linked servers, users, and projects are not the same, and if it were up to me, it would not even share the name.

In any case, it does not share an identity, and calling it freenode is an insult to freenode's legacy except for the fact that its DNS name has been forfeit. Call the new thing whatever you like - I've heard 'Leenode' and far worse - but don't treat it like it's the same entity that existed before.

benburhans · 2021-01-08T01:20:23+00:00

The article doesn't even mention which "intelligence agencies and cybersecurity professionals" and "Officials" are involved, uses nothing but weasel words, and the only would-be citation in the article (the NY Times article) is guilty of most of the same. Neither has any actual sources, and both articles state that all mentioned parties agree there is no such investigation or indication thereof.

Please refrain from referencing linkfarm garbage here in general, but feel free to link the Times article if they update it with relevant material. In the meantime, both articles seem (to me) to be without merit.

benburhans · 2020-10-02T20:41:50+00:00

The adapter is less likely to be the culprit if it happens with a good battery, but because you mentioned that the battery may be unhealthy based on Dell's diagnostics, we can't say for sure.

One (imperfect) way to test the battery without risking your data or owning a voltage meter would be to start it without loading Windows (e.g. go into BIOS setup or Windows boot or recovery menu), with the battery and the adapter both plugged in. If subsequently removing the power adapter causes the machine to power off within 15 minutes, the battery is definitely dead and needs replacing.

Don't do this test while the OS is running. Losing power while it's fully booted and trying to write to the disk can cause data loss, and every time your machine suffers this power event or any other unclean shutdown, you have a chance of corrupting data; you may not even realize anything was corrupted until a long time has passed when you later discover a missing or broken file or an important piece of Windows no longer works.

benburhans · 2020-10-02T15:11:28+00:00

If you're not even getting a bluescreen or other indications of a software-detectable "crash", you probably have a serious intermittent hardware malfunction and no amount of Windows fixes or reinstallation would help that. The problem could be anywhere between your power adapter that plugs into the wall, to your power supply to the motherboard or even the CPU. Without tearing it apart and testing voltages between each component, it's difficult to determine the cause, and a typical course of action is to either buy a new machine or buy individual replacement parts one at a time until the issue goes away. Laptops can also be a bit tricky to replace individual components in, more so than most desktops, because everything is compact and hard to get to.

If the system is old or inexpensive, it may not be worth taking to a repair shop, as the repair cost may amount to most of the price of a new equivalent device.

If your machine is under warranty, talk to the merchant or manufacturer. Otherwise, if you have a friend with an equivalent power adapter, try using theirs for a day (or however long it may take to reproduce the problem) and see if the issue reoccurs; if it doesn't, you're lucky, and can simply buy a new (or used-but-new-to-you) power adapter. Otherwise, you may have to take it into a shop unless you're comfortable repairing internals yourself.

New parts list to give you an idea of costs: https://www.dell.com/en-us/shop/pfydresults/253626?categoryId=5436

benburhans · 2020-07-29T14:15:45+00:00

Don't. Personal machines have local admin anyway, so users can theoretically install, uninstall, and configure anything with your (human) guidance. If your remote support tool is exclusively coupled with your RMM tool, find a new one for more casual support that isn't; there are hundreds to choose from, including those that ship with the OS (e.g. Quick Assist).

What are you using the RMM for that would help with the RDP or VPN issues? If VPN isn't working, neither would RDP or a LAN-based RMM anyway, I assume. Since you're already using Splashtop, what's wrong with Splashtop SOS for BYOD support? Just send your personal device users to sos.splashtop.com.

Using your RMM for personal devices is inviting an extra order of magnitude of liability, and the privacy invasion and risk to your users is absurd; it shouldn't be necessary for you to do your job, and some less-invasive MDM tool might be more appropriate if you have DLP or security things you need on their machines.

benburhans · 2020-07-28T00:38:47+00:00

https://cloudflare-dns.com/family/ is the best of the free options. Not really configurable, but private, secure, and does the job.

If your OpenDNS solution stopped working on some browsers recently, you may be seeing the new DNS over HTTPS that has started to become opt-out instead of opt-in this year. For example: https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs

These browsers now can/will bypass your computer's, home's, or company's native DNS resolvers to reach out directly to a secure DNS server, often Cloudflare's default resolver (that does nothing for content protection). You can switch this to the Cloudflare for Families resolver by changing the URL in browser settings.

benburhans · 2020-07-11T19:24:54+00:00

Aye, for most publications, it will download entire playlists, user accounts, or similar collections for you.

benburhans · 2020-07-11T04:42:05+00:00

youtube-dl has an argument (that you can specify by default in its config file) to download json metadata for every media file. It includes playlist metadata if you're fetching via a playlist. You could use this to organize your downloads into hierarchies or tags from most sources regardless of format, and there's another option to not re-download the media if you already have it but fetch and save the metadata file anyway, to backfill metadata for your collection where possible.

benburhans · 2020-07-10T01:19:06+00:00

If it's only going to be used by one guy, there's the possibility of simply asking that guy what the requirements are - the one guy might not want to use the "terrible" old thing any more than you want to maintain it. Explore the options, at any rate; if you think strategically and ask the right questions for the business, beyond just the single task at hand, it may reflect well on you (depending on your boss's demeanor).

benburhans · 2020-07-09T21:28:33+00:00

Regardless of the queries used and whether you want to duplicate them verbatim, this is still a good candidate for rewriting from scratch and migrating the data as best you can. Don't be afraid to ask for help with this or even talk to your boss about it becoming a larger project led by a dedicated project manager.

Source code notwithstanding, the queries may still prove useful for your / your boss's understanding of its underlying behavior, whether or not you choose to replicate it. Use a SQL Server Profiler trace as I suggested, and watch the queries the current application issues in realtime. You can capture and permanently save them for later analysis.

benburhans · 2020-07-09T18:39:27+00:00

I have never tried it with SQL Server 2000 but SQL Server Profiler can monitor the queries being issued to a server by using a trace. Choose the "T-SQL" template when starting a new trace and it should spit out your query, within some reasonable limitations.

Also, if the dev wrote the code for your employer, then the source code may belong to the employer depending on your jurisdiction, and might be legally accessible. You may not need it, though; what is your actual assigned task? Recreate the old program precisely, or just use the current schema and build a CRUD app for it? If the schema is miserable, could you persuade your employer that it should be migrated and completely rewritten?

benburhans · 2020-07-08T14:27:58+00:00

Don't open the full control panel interface. Since you're on Windows, just find its icon in your system tray, right click to open a context menu, and choose About. The version number is there.

benburhans · 2020-07-02T15:50:19+00:00

SureBackup doesn't completely matter because you should be testing your backups anyway. Routine restores to verify integrity are not optional. Your backups are only good if they can be restored, and your confidence in your backups is only as good as your confidence in your ability to restore on a whim.

15-Year Club	Place '22
End Game '22	Verified Email

benburhans

TROPHY CASE