02:14:52 <lhtoklrtj> I can tell you why you can't stop the 'spam'. You are thinking in cult doctrine. If it was real spam, and I was selling Viagra for example - you could easily ban keywords and urls. Instead, stop being a sheep, think like a cult leader. Recoginse that this 'spam' is just some bullshit that you tell to the sheep.
02:14:52 <lhtoklrtj> When you do that, solution will present itself. Observe. 'spam' -> 'FUK talks bad things about Monero on our IRC' (Don't say that out loud obviously, that will get you excommunicated) Solution? Get off-the-shelf sentiment analyser, detect anyone who 'talks bad things about Monero' and ban them.
11:30:23 <eryziyvlwhhb> Word of guys running Monero community should be BELIEVED. Why would anyone that stole money and laughed at the losers that took the bait ever have a reason to lie to you? www.reddit.com/r/Monero/comments/6d6okb/what_fluffypony_just_did_is_not_ok/
12:34:50 <binaryFate> v0.17.2.0 binaries are now available at getmonero.org, great job everyone
12:52:04 <binaryFate> I need testers to check how the content of the sources tarball put on the website can be automatically checked when I commit a new release to the website (just like the hashes are currently checked withhttps://github.com/selsta/monero-site/blob/715eab2cd10c770f6f814e40d0885068392e03a3/.github/workflows/hashes.yaml)
12:53:45 <binaryFate> the job should be able to recreate the tarball from the github repo in the same way as I do, and then compare content to check there are no differences
12:55:10 <binaryFate> but weirdly selsta has one line that is changing in one file when he's reproducing the exact same workflow. I'd like to know if there can be even more differences (and if so where they are coming from)
12:55:47 <binaryFate> If you want to help can you run this https://paste.debian.net/1193199 and report the result of the "diff" commands at the end
13:00:18 <binaryFate> I expect the diff results to be empty (directories to be exactly the same)
13:06:34 <moneromooo> Connecting to dlsrc.getmonero.org (dlsrc.getmonero.org)|172.67.14.95|:443... connected.
13:06:37 <moneromooo> HTTP request sent, awaiting response... 403 Forbidden
13:06:51 <moneromooo> For https://dlsrc.getmonero.org/gui/monero-gui-source-v0.17.2.0.tar.bz2
13:09:09 <binaryFate> works for me right now
13:09:15 <binaryFate> try https://downloads.getmonero.org/gui/monero-gui-source-v0.17.2.0.tar.bz2 ?
13:09:49 <moneromooo> Works.
13:10:33 <moneromooo> That one is 157.185.165.36 though, different IP.
13:10:46 <selsta> dlsrc works here too
13:10:51 <binaryFate> it's CDN
13:11:40 <moneromooo> Maybe they don't like tor.
13:12:11 <binaryFate> yes possible that you're hitting cloudflare and they didn't like you
13:13:00 <moneromooo> I don't like cloudflare so fair game.
13:13:23 <binaryFate> :)
13:13:32 <kayront> captchaflare
13:13:44 <moneromooo> People who say they don't hate tor but make it so easy for others to block it.
13:13:58 <selsta> afaik dlsrc is not a cdn
13:14:37 <fluffypony> dlsrc -> CloudFlare
13:14:39 <binaryFate> I think that's the direct but still through CF
13:14:42 <fluffypony> downloads -> dlsrc -> CloudFlare
13:14:53 <moneromooo> whois says cloudflare here.
13:15:12 <kayront> the one that crack me up the most is exchanges/web wallets that use CF .. yes, very sensible idea
13:16:04 <fluffypony> kayront: I don't think it's any different from running an F5 WAF in front of it
13:16:11 <fluffypony> or a virtual appliance WAF on AWS
13:16:21 <fluffypony> the WAF could be compromised in subtle ways
13:16:32 <moneromooo> Do you give F5 WAF your SSL keys too ?
13:17:02 <fluffypony> moneromooo: yes, otherwise it's a pretty useless WAF
13:17:26 <kayront> fluffypony: i get your point, but i think it is, though. people have a valid expectation that they are connecting e2e to a certain server from a certain organization, and instead they end up connecting to an american megacorp and probably without realizing
13:17:39 <moneromooo> A third party you have to give your keys to for security is also pretty useless by definition.
13:18:05 <kayront> ofc you could make the same point about AWS, but in theory is seems easier to exfiltrate from CF instead of AWS. although probably both are happening pretty regularly :D
13:18:18 <fluffypony> was about to make the AWS argument lol
13:18:33 <fluffypony> you're either leveraging CF or similar for scale, or you're leveraging AWS / Azure / similar
13:18:42 <kayront> no, i agree. i prefer to self-host as a matter of pricniple because of that & more
13:18:56 <moneromooo> Sounds a lot like "this is not perfect either so we might as well go for the shittest".
13:18:58 <kayront> might be a bit more expensive, but my dignity remains
13:18:58 <kayront> lo
13:19:47 <moneromooo> At least if people use cloud servers the enemy has to pwn lots of different places to slurp 50% of the whole internet.
13:20:07 <fluffypony> moneromooo: or just pwn one datacenter :-P
13:20:09 <moneromooo> Not just one (if they're actually different from NSA, which I hav emy doubts about).
13:20:29 <moneromooo> Are you claiming all hosting companies are basically brands of a single one ?
13:20:40 <fluffypony> https://www.bleepingcomputer.com/news/security/fbi-arrests-man-for-plan-to-kill-70-percent-of-internet-in-aws-bomb-attack/
13:20:45 <kayront> something tells me AWS has tools at the dom0/hypervisor to read process tables of guest OSes, dump process memory, exfiltrate passwords, and all that. it only makes sense
13:21:01 <moneromooo> Should have gone for the DNS root servers and get 99%.
13:21:01 <fluffypony> kayront: yeah pretty sure they do
13:21:19 <fluffypony> otoh if it's physical tin it's not like the DC does a good job of protecting cages
13:21:22 <kayront> something also tells me that data gets fed directly to our favorite 3 letter agencies
13:21:35 <fluffypony> unless you have a really good relationship with them and you put your own cage in, but nowadays that's infrequent
13:21:56 * moneromooo quite likes the idea of putting cloudflare in a cage...
13:22:01 <fluffypony> lol
13:22:15 <kayront> i'd liek to put the FATF in a cage
13:22:21 <kayront> and throw away the key
13:22:41 <fluffypony> anyway, I think that it's largely a losing battle on clearnet - if you want e2e straight to the server you need an overlay network like Tor or i2p
13:23:09 <moneromooo> Except if all the nodes are MITMed by cloudflare.
13:23:13 <kayront> coming up next: CF Tor Onion Accelerator™
13:23:35 <kayront> something pretty cool that never got much traction is onioncat. do you guys know it?
13:23:51 <fluffypony> the VPN thing?
13:23:52 <moneromooo> Never heard, but it evokes interesting images.
13:23:59 <kayront> haha moneromooo
13:24:03 <kayront> yeah fluffypony, in some sense
13:24:15 <kayront> https://github.com/rahra/onioncat
13:24:19 <fluffypony> aiui it's a VPN overlay for Tor
13:25:05 <kayront> quick reading the readme tells me they never found a good solution for V3 addresses, whcih is a shame
13:25:43 <kayront> the length of v2 addrs used to match perfectly for the scheme, not so much anymore.. manual configuration for every single host kind of (but not entirely, depending on use case) defeats the purpose
13:28:10 <fluffypony> ah yeah
13:33:03 <kayront> i used to daydream how cool it could be to offer onioncat-only hosting for people at home - the main reason i wouldn't rent zones/jails/containers/vms right now is all the liability that could bring, not unlike running a tor exit in a way .. but if everything (and I mean everything, like onioncat pkg servers, etc) was going over tor, then yolo
13:33:18 <kayront> xmr accepted there ofc
13:33:19 <kayront> :p
13:34:22 <fluffypony> nice
13:34:55 <moneromooo> binaryFate: empty diffs after changing dlsrc to downloads.
13:35:52 <selsta> moneromooo: is the hash reproducible?
13:36:16 <moneromooo> Of what excatly ?
13:36:23 <moneromooo> I don't see an obvious hash displayed.
13:36:32 <binaryFate> ok good
13:36:43 <selsta> I mean do you get the same source tarball hash as on getmonero.org
13:36:55 <hyc> you could set up trustworthy hosting with AMD Epyc servers. hardware-encrypted VM RAM that the host can't decrypt
13:36:58 <binaryFate> unfortunately git-archive is not deterministic apparently because it embeds the PID into the archive
13:37:19 <binaryFate> moneromooo linux or macos?
13:37:32 <selsta> doubt that mooo would use macos :D
13:37:48 <binaryFate> right, I retract that question ^^
13:38:30 <moneromooo> It did not create compressed tarballs here, so does not apply.
13:39:03 <binaryFate> it shoud have, and then uncompressed them
13:39:14 <moneromooo> bzip2 foo.tar sounds inherently non deterministic since small changes in bzip2 would cause different output (ie, slightly better compression).
13:39:39 <moneromooo> Right, I see bunzip2 in the script. I'll re-run and not delete.
13:43:39 <binaryFate> mistery is that selsta does the exact same workflow on macos and one line in one file ends up changed in his tarballs
13:44:11 <moneromooo> Is that... a puzzling fog ?
13:45:45 <binaryFate> ?
13:46:30 <moneromooo> Nevermind. Mistery.
13:46:45 * moneromooo likes puns a bit too much
13:48:13 <binaryFate> I have to google that sort of stuff to check if it's not an expression with a specific meaning that I don't know
13:48:50 <moneromooo> The hashes are different.
13:49:05 <binaryFate> yes, but the diff is empty?
13:49:10 <moneromooo> Yes.
13:49:36 <kayront> hyc: I did not know about that. looks pretty cool on first read. what guarantees do we have in terms of auditability (that it does what it says it does), or, how is it different than SGX or a hw RNG in terms of trusting its magic?
13:49:40 <binaryFate> ok so that workflow can be used to check tarball is ok. Except for the mistery.
13:53:43 <hyc> kayront: no guarantees that there is no NSA-sponsored backdoor. but AMD has a pretty good track record on this feature.
13:54:03 <hyc> https://www.amd.com/en/processors/amd-secure-encrypted-virtualization
13:54:45 <hyc> it is quite different from SGX. Every VM has its own AES key, handled internally by the CPU itself, never visible to user code
13:54:50 <moneromooo> selsta: what is the line/file that's different ?
13:55:33 <binaryFate> moneromooo line 35 of cmake/Version.cmake
13:55:53 <binaryFate> the $Format:$ becomes an empty string
13:56:16 <moneromooo> Do other $Format:$ in other files (if you add them) also do the same ?
13:57:07 <selsta> can try
13:58:08 <binaryFate> I don't see what in that workflow can evaluate anything
13:58:30 <binaryFate> maybe you have some local hooks interacting on git-archive
13:58:51 <moneromooo> Sounds like CVS, but... should be long dead.
14:00:24 <selsta> 15:56 <+moneromooo> Do other $Format:$ in other files (if you add them) also do the same ? <-- yes
14:01:40 <binaryFate> try to set Format="foo" in your shell and redo?
14:03:47 <moneromooo> Next step is to add xterm -e sh between each step, so you can grep to see when it changes :)
14:04:39 <moneromooo> Maybe "$Version:$" would also cause the culprit to identify itself.
14:06:46 <selsta> don't have xterm here
14:07:07 <moneromooo> Just sh will do, if it's not redirected.
14:07:22 <moneromooo> Or any windowed tty program.
14:07:30 <selsta> ../git-archive-all.sh: line 214: [: -eq: unary operator expected
14:07:36 <selsta> not sure if that is related
14:12:20 <moneromooo> If you replace with "$Format:%H$", do you get a hash instead of empty ?
14:18:35 <moneromooo> If yes, I think the fix might be to add a .gitattributes file in the monero root directory with "* -export-subst" in it.
14:19:14 <moneromooo> (alternatively, check your global git settings for export-subst)
14:20:07 <selsta> no, it just also is gone
14:20:08 <selsta> no hash
14:20:56 <moneromooo> Including the %H ?
14:21:03 <selsta> yes
14:21:37 <selsta> hmm wait
14:22:33 <dEBRUYNE> Release available -> https://www.reddit.com/r/Monero/comments/mor649/cli_gui_v01720_oxygen_orion_released/
14:23:49 <moneromooo> Could try $Format:%Credfoo%Creset$
14:24:01 <moneromooo> If it doesn't display foo in red, then it's not export-subst for sure.
14:24:06 <selsta> ok so git-archive-all undoes my changes
14:24:15 <selsta> might have to commit them
14:27:41 <selsta> 15:56 <+moneromooo> Do other $Format:$ in other files (if you add them) also do the same ? <-- after commiting the changes, no
14:27:48 <selsta> I added it to the readme and it stayed there
14:28:05 <selsta> that's... weird
14:28:50 <moneromooo> Do you have a .gitattributes file in ~ ?
14:29:07 <selsta> no
14:29:08 <moneromooo> Or wherever you might have user or system config
18:29:12 <jlpfosfqeqxs> Will you HODL XMR or dump it for Tari when it comes out? Will others?
21:06:11 <gingeropolous> congrats on the synchronous CLI and GUI releases y'all!