On 7/4/20 2:35 AM, Doug McGarrett wrote:

I need some instruction as to how to find out what's in the various "approved"  repos that can be accessed from YAST or zypper or whatever is correct for the files. I am finding that certain very common apps appear to be missing from the latest OpenSUSE Tumbleweed--for instance, Artha. That's just one. I have a list of apps most of which ran on a year-old version of this program. They may be available, but only if I can find them!  (I would prefer using "approved" files before looking elsewhere for the necessary rpm.) Can some kind soul point me in the right direction for finding what's hidden in the various files accessible to this system, please? --doug

You start by searching for the package in the standard and contributed repositories at software.opensuse.org, where you will find . . . https://software.opensuse.org/package/artha Failing that, you can look for the application home site; a search for "artha" takes you to its home at sourceforge . . .Sometimes there is an rpm, but in this case, only for Fedora (which is "approved", but may or may not install on opensuse - the rpm installer may tell you of any missing dependencies).  Otherwise, there is typically a source package with dependencies and installation instructions, like . . . http://artha.sourceforge.net/wiki/index.php/Installation -- DennisG MSI B450-A Pro, Ryzen 5 2400, 15GB, Leap 15.1, KDE 5.55/5.12.8, stock kernel -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

Hello, On Sat, 04 Jul 2020, Carlos E. R. wrote:

There is a search engine or applet thing in Firefox. You type the name of the package and hit enter.

Aside from that, you can create a so called bookmarklet. Just add this location "URI" as a bookmark: ==== one line as the location string ==== javascript:q=prompt('Enter%20text%20to%20search%20software.opensuse.org','');if(q){q=q.replace(/_/g,%22%20%22);location.href='https://software.opensuse.org/search?utf8=%E2%9C%93&baseproject=ALL&q='+encodeURIComponent(q);}else{location.href='https://software.opensuse.org/search';} ==== HTH, -dnh -- overflow error in /dev/null -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

On 7/4/20 11:23 AM, Atri Bhattacharya wrote:

Hi Doug

On Sat, 2020-07-04 at 02:35 -0400, Doug McGarrett wrote:

...

I am finding that certain very common apps appear to be missing from the latest OpenSUSE Tumbleweed--for instance, Artha. That's just one.

We dropped artha from the distro because it has been unmaintained by upstream for many years and susceptible to security issues (e.g. https://bugzilla.suse.com/show_bug.cgi?id=1143860). Please see if you can find some other dictionary app that doesn't hurt your system.

Cheers, I looked and found nothing I want: an esoteric spell checker. Artha can interpret misspellings and give you the correct spelling of many words that the system never even heard of.  I really don't want a dictionary with pages of definitions. If I didn't know what the word meant, I wouldn't have used it!  If anyone out there can suggest a substitute, I would be obliged. --doug -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

Carlos E. R. composed on 2020-07-04 21:55 (UTC+0100):

David Haller wrote:

...

Aside from that, you can create a so called bookmarklet.

Sorry, what's that? I don't think I heard the term before. :-?

https://en.wikipedia.org/wiki/Bookmarklet was originally created in 2002. -- Evolution as taught in public schools is religion, not science. Team OS/2 ** Reg. Linux User #211409 ** a11y rocks! Felix Miata *** http://fm.no-ip.com/ -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

On 7/4/20 3:58 PM, Doug McGarrett wrote:

On 7/4/20 11:23 AM, Atri Bhattacharya wrote:

...

Hi Doug

On Sat, 2020-07-04 at 02:35 -0400, Doug McGarrett wrote:

...

I am finding that certain very common apps appear to be missing from the latest OpenSUSE Tumbleweed--for instance, Artha. That's just one.

We dropped artha from the distro because it has been unmaintained by upstream for many years and susceptible to security issues (e.g. https://bugzilla.suse.com/show_bug.cgi?id=1143860). Please see if you can find some other dictionary app that doesn't hurt your system.

Cheers, I looked and found nothing I want: an esoteric spell checker. Artha can interpret misspellings and give you the correct spelling of many words that the system never even heard of.  I really don't want a dictionary with pages of definitions. If I didn't know what the word meant, I wouldn't have used it!  If anyone out there can suggest a substitute, I would be obliged. --doug

Even tho it was dropped after 15.1, the same most recent vsn 1.03 was repackaged for the Education repo for both 15.2 and TW. If you must have a package that is no longer maintained - the last post on artha's home site is 8 years ago - then you'll need to build it from source.  That's not difficult to do at all: 1.  install any dependencies (listed on the page) 2.  download tarball 3.  extract 4.  configure 5.  make 6.  make install -- DennisG -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

* David Haller [07-04-20 15:25]:

Hello,

On Sat, 04 Jul 2020, Carlos E. R. wrote:

...

There is a search engine or applet thing in Firefox. You type the name of the package and hit enter.

Aside from that, you can create a so called bookmarklet.

Just add this location "URI" as a bookmark:

==== one line as the location string ==== javascript:q=prompt('Enter%20text%20to%20search%20software.opensuse.org','');if(q){q=q.replace(/_/g,%22%20%22);location.href='https://software.opensuse.org/search?utf8=%E2%9C%93&baseproject=ALL&q='+encodeURIComponent(q);}else{location.href='https://software.opensuse.org/search';} ====

or simply open a text window and: opi <application> and you will find all available to openSUSE, not just those in the locally configured repos. -- (paka)Patrick Shanahan Plainfield, Indiana, USA @ptilopteri http://en.opensuse.org openSUSE Community Member facebook/ptilopteri Photos: http://wahoo.no-ip.org/piwigo paka @ IRCnet freenode -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

Hello, On Sat, 04 Jul 2020, Patrick Shanahan wrote:

* David Haller [07-04-20 15:25]:

...

Aside from that, you can create a so called bookmarklet.

Just add this location "URI" as a bookmark:

==== one line as the location string ==== javascript:q=prompt('Enter%20text%20to%20search%20software.opensuse.org','');if(q){q=q.replace(/_/g,%22%20%22);location.href='https://software.opensuse.org/search?utf8=%E2%9C%93&baseproject=ALL&q='+encodeURIComponent(q);}else{location.href='https://software.opensuse.org/search';} ====

or simply open a text window and: opi <application>

and you will find all available to openSUSE, not just those in the locally configured repos.

And so will that search on software.o.o called via the bookmarklet. And that does not additionally send you search to https://guoyunhe.me/opi/proxy/index.php and the code quality of 'opi' is rather questionable, see: $ grep system $(which opi) And BTW: 'sudo zypper' does not work here: $ sudo zypper if opi root's password: It can only be attributed to human error. root's password: That's something I cannot allow to happen. root's password: Are you on drugs? sudo: 3 incorrect password attempt So, I much prefer just to fire off the search on sw.o.o, thank you very much. If needed, I still can search with osc or on build.o.o. HTH, HAND, -dnh -- Sometimes I think the surest sign that intelligent life exists elsewhere in the universe is that none of it has tried to contact us. -- Calvin & Hobbes, 8.11.1989 -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

* Doug McGarrett [07-04-20 17:45]: [...]

I mentioned in a reply to Patrick (a few notes further on in the list) that an app that is mentioned in the system, aspell, might fulfill the requirement, if I could figure out how to install and use it.

No, you replied private mail. Noone else saw your reply.

OTOH, I have used Artha for years without any sign of a problem, and I would certainly be happy to go back to it.

w/o regard to it's possible security problems!

How do I get to the Education repo?

you need to do a little looking for answers yourself so you maybe retain some knowledge as you have been advised even today about: zypper addrepo

This system of alternate (or extra?) repos has baffled me for the entire year I have been a Suser.

But you have been an openSUSE user for much longer than a year, many years. I have mail in this list from "Date: Tue, 08 Jun 2004 20:06:12 -0400"

Once I know how to get to these extra repos,  what is the means of finding what may be available within them? (Frinstance, I'm told that Master PDF Editor is hiding in one of them, and I'd like to get it and use it. It has features that Okular does not.)

and you have been advised by several individuals on this particular thread how to accomplish this.

(I realize that this may be a tall order; I am willing to go and read the fine manual, if there is one.)

no, you really are not. -- (paka)Patrick Shanahan Plainfield, Indiana, USA @ptilopteri http://en.opensuse.org openSUSE Community Member facebook/ptilopteri Photos: http://wahoo.no-ip.org/piwigo paka @ IRCnet freenode -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

On 04/07/2020 23.42, Doug McGarrett wrote:

I mentioned in a reply to Patrick (a few notes further on in the list) that an app that is mentioned in the system, aspell, might fulfill the requirement, if I could figure out how to install and use it. OTOH, I have used Artha for years without any sign of a problem, and I would certainly be happy to go back to it. How do I get to the Education repo? This system of alternate (or extra?) repos has baffled me for the entire year I have been a Suser.

I explained that not a day ago, so I'm not going to repeat it. -- Cheers / Saludos, Carlos E. R. (from 15.1 x86_64 at Telcontar)

* Doug McGarrett [07-04-20 23:14]: [...]

I would say that the latest version of the s/w is more difficult to maneuver around than the last. If the old computer hadn't died, I'd still be using the (updated) edition of 2019. I managed to get both printers and the scanner working in the 2019 version; not yet working in the 2020 edition. (The packaged lists of printers for both HP and Epson are even older than I can remember! And HP expects me to have Windows, MAC, or UNIX--Linux is not even on the horizon in their present "guidance.")

you would probably recognize a similarity of unix and linux. And I sincerely doubt HP cares what operating system you prefer/utilize. They are excellent in providing drivers for their printers on linux, I would hazzard to say they are the best manufacturer in providing linux drivers. your haphazard/shotgun approach to maintaining your system and following direction(s) people take the time to prvide you, appears your greatest problem. -- (paka)Patrick Shanahan Plainfield, Indiana, USA @ptilopteri http://en.opensuse.org openSUSE Community Member facebook/ptilopteri Photos: http://wahoo.no-ip.org/piwigo paka @ IRCnet freenode -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

On 7/4/20 9:33 PM, DennisG wrote:

On 7/4/20 5:42 PM, Doug McGarrett wrote:

...

On 7/4/20 4:52 PM, DennisG wrote:

...

On 7/4/20 3:58 PM, Doug McGarrett wrote:

...

...

...

snip

...

...

Even tho it was dropped after 15.1, the same most recent vsn 1.03 was repackaged for the Education repo for both 15.2 and TW.

If you must have a package that is no longer maintained - the last post on artha's home site is 8 years ago - then you'll need to build it from source.  That's not difficult to do at all: 1.  install any dependencies (listed on the page) There are about a dozen, I think. The rest I could do. 2.  download tarball 3.  extract 4.  configure 5.  make 6.  make install

...

...

-- DennisG Sorry about the private reply. I just wasn't careful.

I mentioned in a reply to Patrick (a few notes further on in the list) that an app that is mentioned in the system, aspell, might fulfill the requirement, if I could figure out how to install and use it. OTOH, I have used Artha for years without any sign of a problem, and I would certainly be happy to go back to it. How do I get to the Education repo? This system of alternate (or extra?) repos has baffled me for the entire year I have been a Suser. Once I know how to get to these extra repos,  what is the means of finding what may be available within them? Pat seems to think someone gave me instructions on how to deal with the hidden repos, but I have no recollection of that--not how to determine

I'm snowed. I carefully copied the instruction and tried to run it, and this is the result: DESKTOP-4FH9U1P:/home/doug # zypper addrepo https://download.opensuse.org/repositories/openSUSE:Leap:15.1/standard/openS... File '/repositories/openSUSE:Leap:15.1/standard/openSUSE:Leap:15.1.repo' not found on medium 'https://download.opensuse.org/' Abort, retry, ignore? [a/r/i/...? shows all options] (a): I went to firefox and got this mish-mosh: *artha* from *openSUSE:Leap:15.1* project Select Your Operating System https://software.opensuse.org/ymp/openSUSE:Leap:15.1/standard/artha.ymp https://software.opensuse.org//download.html?project=openSUSE%3ALeap%3A15.1&package=artha#manualopenSUSE Grab binary packages directly https://software.opensuse.org//download.html?project=openSUSE%3ALeap%3A15.1&package=artha#directopenSUSE firefox wants me to sign in! I don't think I ever had a username and password for Firefox, but if I did it was a long time ago. I tried to find another source in FF for artha, but it comes with a long list of libs. Anyway, all you need to do is load software.opensuse.org and search for "artha." What do you mean, "load software.opensuse.org"  load those words into what? I loaded them into Firefox, but finally wound up with a list of libs that it needs. In another episode, it looked like FF had the file ready to go, but it wanted a login to Firefox! I don't think I ever logged in to Firefox. I'm sorry, Dennis, this is not getting thru to me. I don't even drink anymore, but I wish I did! their names, or how to get a directory of the files that are available therein, or how to download one of them to my own system. Dammit, I may be old but AFAIK, I'm not senile!

Be sure to reply to the list, not an individual.  I don't think we saw that msg to Patrick. Sorry--I wasn't concentrating on the reply path.  I just checked this one and it is going to everbody.

IMO, for other obscure packages, as I wrote prev you really want to learn how to compile because with pkgs like that, it may be the only option.  It may seem intimidating at first, but it is not really difficult, other than sometimes getting dependencies installed (which the make command will tell you that are missing, if the source page didn't provide).

I can follow the directions for compiling and installing a file, and I have done it every once in a while, but this doesn't seem to be getting me artha.

On 2020-07-05 1:03 a.m., Doug McGarrett wrote:

...

...

...

I'm snowed. I carefully copied the instruction and tried to run it, and this is the result:

DESKTOP-4FH9U1P:/home/doug # zypper addrepo https://download.opensuse.org/repositories/openSUSE:Leap:15.1/standard/openS... File '/repositories/openSUSE:Leap:15.1/standard/openSUSE:Leap:15.1.repo' not found on medium 'https://download.opensuse.org/' Abort, retry, ignore? [a/r/i/...? shows all options] (a):

What version of Leap are you installing this on? If 15.1, artha 1.0.3 is in the OSS repo which you should already have configured. Or, there is a more recent version here: https://download.opensuse.org/repositories/Education/openSUSE_Leap_15.1/ If 15.2, add this repository: https://download.opensuse.org/repositories/Education/openSUSE_Leap_15.2/ Note that the URI in those instructions you read is very wrong; /repositories/openSUSE:Leap:15.1 no longer exists on the download server, and I am not even sure that it ever did exist. /repositories/openSUSE: does exist, but you won't find artha in any of its subdirectories. In future, if you wish to find an openSUSE=specific package, may I suggest you simply go to https://software.opensuse.org/ and enter the package name in the search box. -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

On 05/07/2020 09.03, Doug McGarrett wrote:

On 7/4/20 9:33 PM, DennisG wrote:

...

On 7/4/20 5:42 PM, Doug McGarrett wrote:

...

On 7/4/20 4:52 PM, DennisG wrote:

...

On 7/4/20 3:58 PM, Doug McGarrett wrote:

...

...

...

snip

...

...

Even tho it was dropped after 15.1, the same most recent vsn 1.03 was repackaged for the Education repo for both 15.2 and TW.

If you must have a package that is no longer maintained - the last post on artha's home site is 8 years ago - then you'll need to build it from source.  That's not difficult to do at all: 1.  install any dependencies (listed on the page) There are about a dozen, I think. The rest I could do. 2.  download tarball 3.  extract 4.  configure 5.  make 6.  make install

I'm snowed. I carefully copied the instruction and tried to run it, and this is the result:

DESKTOP-4FH9U1P:/home/doug # zypper addrepo https://download.opensuse.org/repositories/openSUSE:Leap:15.1/standard/openS... File '/repositories/openSUSE:Leap:15.1/standard/openSUSE:Leap:15.1.repo' not found on medium 'https://download.opensuse.org/' Abort, retry, ignore? [a/r/i/...? shows all options] (a):

Don't do this. Now, FAST: remove that repo you added. Yast, manage repositories tool. -- Cheers / Saludos, Carlos E. R. (from 15.1 x86_64 at Telcontar)

On Sat, 04 Jul 2020 17:23:52 +0200 Atri Bhattacharya wrote:

Hi Doug

On Sat, 2020-07-04 at 02:35 -0400, Doug McGarrett wrote:

...

I am finding that certain very common apps appear to be missing from the latest OpenSUSE Tumbleweed--for instance, Artha. That's just one.

We dropped artha from the distro because it has been unmaintained by upstream for many years and susceptible to security issues (e.g. https://bugzilla.suse.com/show_bug.cgi?id=1143860). Please see if you can find some other dictionary app that doesn't hurt your system.

I just looked at the openSUSE bug report and went from there to various other links, including https://www.exploit-db.com/exploits/45760 but I still don't understand what the vulnerability actually is? It claims "Artha The Open Thesaurus 1.0.3.0 - Denial of Service (PoC)" (and note that Artha says it is a thesaurus rather than a spelling app) and the exploit itself is a python script that creates a small file containing 256 instances of the letter 'A'. But I don't understand what this has to do with Artha? Or what problem it causes (or even can cause?) What is one supposed to do with this script and Artha to cause a DOS? And what exactly gets DOSed - just Artha or my entire system or what? And how exactly would a python script get into my system and somehow run to interact with Artha to cause whatever probelm is alleged? Exactly what is the alleged problem? -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

On 05/07/2020 13.36, Darryl Gregorash wrote:

On 2020-07-05 4:51 a.m., Carlos E. R. wrote:

...

On 05/07/2020 10.17, Darryl Gregorash wrote:

...

On 2020-07-05 1:03 a.m., Doug McGarrett wrote:

...

...

...

> I'm snowed. I carefully copied the instruction and tried to run it, and this is the result:

DESKTOP-4FH9U1P:/home/doug # zypper addrepo https://download.opensuse.org/repositories/openSUSE:Leap:15.1/standard/openS...

File '/repositories/openSUSE:Leap:15.1/standard/openSUSE:Leap:15.1.repo' not found on medium 'https://download.opensuse.org/' Abort, retry, ignore? [a/r/i/...? shows all options] (a):

What version of Leap are you installing this on?

He is on OS-TW--2020.0702

I missed that.....

Oh, it is easy to miss that, because it is on another thread.

in which case, if it were my system, I'd just give the 15.2 package a try. If it doesn't work, nothing lost.

No need, it is in the education repo for TW. That's the appropriate package for him. Activating a repo from another release is a dangerous thing to do as you can install other packages by accident, or deity forbids, libraries. -- Cheers / Saludos, Carlos E. R. (from 15.1 x86_64 at Telcontar)

Dave, On Sun, 2020-07-05 at 11:59 +0100, Dave Howorth wrote:

I just looked at the openSUSE bug report and went from there to various other links, including https://www.exploit-db.com/exploits/45760 but I still don't understand what the vulnerability actually is?

It claims "Artha The Open Thesaurus 1.0.3.0 - Denial of Service (PoC)"

(and note that Artha says it is a thesaurus rather than a spelling app)

and the exploit itself is a python script that creates a small file containing 256 instances of the letter 'A'.

But I don't understand what this has to do with Artha? Or what problem it causes (or even can cause?) What is one supposed to do with this script and Artha to cause a DOS? And what exactly gets DOSed - just Artha or my entire system or what? And how exactly would a python script get into my system and somehow run to interact with Artha to cause whatever probelm is alleged?

Exactly what is the alleged problem?

I am not an expert here, but that has never stopped me from hazarding a guess ;-) The problem seems to be that artha has a buffer overflow in its code, which can be exploited by a specifically crafted script -- the python script in that example, for instance -- to DDOS your system. The python script can get into your system by any number of ways: website caches, downloading malicious attachments from emails, etc. The exploit has been in the open since 2018 -- not just alleged, but demonstrated and reproduced using that script -- so I would think it is, by now, rather straightforward for anyone to exploit. Cheers, -- Atri Bhattacharya Sun 5 Jul 14:39:14 CEST 2020 Sent from openSUSE Tumbleweed on my laptop. -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

On 2020-07-05 5:47 a.m., Carlos E. R. wrote:

On 05/07/2020 13.36, Darryl Gregorash wrote:

...

in which case, if it were my system, I'd just give the 15.2 package a try. If it doesn't work, nothing lost.

No need, it is in the education repo for TW. That's the appropriate package for him. Activating a repo from another release is a dangerous thing to do as you can install other packages by accident, or deity forbids, libraries.

What URI is that? I'm looking at education/tumbleweed right now, and artha is not there. -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

On 05/07/2020 14.52, Atri Bhattacharya wrote:

Hi Carlos,

On Sun, 2020-07-05 at 13:47 +0200, Carlos E. R. wrote:

...

No need, it is in the education repo for TW.

It isn't as of today. It had not built on openSUSE TW for months and the last published binary would install but crash on the system immediately (did I also mention a security hole? ;-) ). So, I cleaned up these stale packages from the repository yesterday.

Understood :-) -- Cheers / Saludos, Carlos E. R. (from 15.1 x86_64 at Telcontar)

On Sun, 2020-07-05 at 14:57 +0200, Carlos E. R. wrote:

On 05/07/2020 14.29, Atri Bhattacharya wrote:

...

Doug,

To cut through everything else, first let me reiterate: Artha has been left **unmaintained by upstream for almost 8 years** now. As a result, a) it has at least one open security hole (already previously mentioned) and b) no longer even builds for Tumbleweed. Therefore, it is **unavailable for TW** from any openSUSE repository (Education or otherwise) unless someone fixes these issues.

Yesterday the search indicated that the Education repo has artha for TW. Today it doesn't.

Yes, sorry, you were not wrong when you said that it had artha for TW yesterday or earlier today. I have clarified this elsewhere in the thread. Cheers, -- Atri Bhattacharya Sun 5 Jul 14:59:52 CEST 2020 Sent from openSUSE Tumbleweed on my laptop. -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

On 7/5/20 8:52 AM, Atri Bhattacharya wrote:

Hi Carlos,

On Sun, 2020-07-05 at 13:47 +0200, Carlos E. R. wrote:

...

snip

...

That's the appropriate package for him. Activating a repo from another release is a dangerous thing to do as you can install other packages by accident, or deity forbids, libraries.

I second this. For the sake of your system, never use a Leap repo on TW and vice versa!

Cheers,

Which is why I wrote: "Since you are pulling from the 15.2 repo, I would go the downloaded rpm route which /avoids having to add a repo you don't want thereafter/." Mea culpa, clearly I should have issued a stronger more explicit warning.  And more clearly, compiling from source is out of the question for the OP; my bad for even having mentioned that. At least I don't have dementia after all.  I could have sworn that there was a TW package, turns out there was.  Atri just trying to mess with my old brain.  :) -- DennisG -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

On Sun, 05 Jul 2020 14:40:19 +0200 Atri Bhattacharya wrote:

Dave,

On Sun, 2020-07-05 at 11:59 +0100, Dave Howorth wrote:

...

I just looked at the openSUSE bug report and went from there to various other links, including https://www.exploit-db.com/exploits/45760 but I still don't understand what the vulnerability actually is?

It claims "Artha The Open Thesaurus 1.0.3.0 - Denial of Service (PoC)"

(and note that Artha says it is a thesaurus rather than a spelling app)

and the exploit itself is a python script that creates a small file containing 256 instances of the letter 'A'.

But I don't understand what this has to do with Artha? Or what problem it causes (or even can cause?) What is one supposed to do with this script and Artha to cause a DOS? And what exactly gets DOSed - just Artha or my entire system or what? And how exactly would a python script get into my system and somehow run to interact with Artha to cause whatever probelm is alleged?

Exactly what is the alleged problem?

I am not an expert here, but that has never stopped me from hazarding a guess ;-)

Thanks for your reply. I'm definitely not an expert either but I'm trying to understand what the problem is.

The problem seems to be that artha has a buffer overflow in its code, which can be exploited by a specifically crafted script -- the python script in that example, for instance -- to DDOS your system. The python script can get into your system by any number of ways: website caches, downloading malicious attachments from emails, etc.

The exploit has been in the open since 2018 -- not just alleged, but demonstrated and reproduced using that script -- so I would think it is, by now, rather straightforward for anyone to exploit.

Well, I'd like to reproduce the problem using the script but I don't understand how to. There don't seem to be any instructions for what to do with the script to invoke the bug. Just running the script simply creates the text file. Pasting the script itself into Artha's query box produces a message: "Regular expression pattern detected "No matches found! Please check your expression and try again." Pasting the name of the text file, or pasting the contents of the text file both produce the same error message: "Queried string not found in thesaurus!" So I don't understand what the alleged bug is, nor do I see a plausible method by which any bug could be invoked by that script without active cooperation from the victim. Maybe it's just my ignorance and I've missed something somewhere that explains what is supposed to be the problem? How could the original author or anybody else fix the 'bug' if they can't find out how to invoke it?

Cheers,

-- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

On 7/5/20 11:56 AM, Atri Bhattacharya wrote:

On Sun, 2020-07-05 at 11:11 -0400, DennisG wrote:

On 7/5/20 8:52 AM, Atri Bhattacharya wrote:

...

snip Which is why I wrote:

"Since you are pulling from the 15.2 repo, I would go the downloaded rpm route which /avoids having to add a repo you don't want thereafter/." This isn't recommended either, since a package built against Leap 15.2 would look for the symbols provided by lib* packages from 15.2 in the installed system. Often, this would lead to dependency problems if the updated libfoo pkg, say in an installed TW or TW repository, does not provide the exact same symbol. It could also lead to the application crashing outright, often with the error "could not find symbol complicatedlongnamefoo".

Right.  I think my mistake has been to assume that such inexperienced users would use the forums rather than this list. I've on occasion needed to borrow an rpm (or compile) from a different version repo (say, in the case where that's the only alternative for a new printer driver), but like folks here I can easily deal with a problem should it arise.  Alas, as the "ass" cliche teaches once again, assumptions are often unwise.  Lesson re-learned.

...

At least I don't have dementia after all. I could have sworn that there was a TW package, turns out there was. Atri just trying to mess with my old brain. :) Ha ha, didn't mean to. I am sorry if I had you questioning reality there for a while ;-)

No problem.  You will be hearing from my lawyer.  :) -- DennisG MSI B450-A Pro, Ryzen 5 2400, 16GB, Leap 15.1, KDE 5.55/5.12.8, stock kernel -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

On 7/4/20 11:12 PM, Doug McGarrett wrote:

...

long snip

(The packaged lists of printers for both HP and Epson are even older than I can remember! And HP expects me to have Windows, MAC, or UNIX--Linux is not even on the horizon in their present "guidance.")

--doug

Guidance???  Actually, most HP spec sheets now refer you to the following, also top-of-list with a simple google search on "HP printers linux": https://support.hp.com/us-en/document/bpu00658 Which explains HP's linux printer program suite, HPLIP.  Follow the link there to: https://developers.hp.com/hp-linux-imaging-and-printing which links you to the "all supported printers" page.  Find yours and note the HPLIP version required for your printer.  TW has the latest (3.20.6) but only the newest printers need that update, most do fine with 3.19.12 that is in 15.2.  IIRC (but don't hold me to this), if you want to use the entire toolkit it's better to install the printer using HPLIP (look for HP Device Manager on your KDE menu); but if only the driver alone is wanted, better to install via YaST. Doug, as an aside (and no offense meant), IMO you would happier with Leap than TW:  "Tumbleweed appeals to Power Users, Software Developers, and openSUSE Contributors"; it is "bleeding edge.". Leap is the "regular release" that is "most stabilized".  While I use Leap now, for a long time I used TW/Factory.  I don't use TW now only because I got lazy and prefer other tinkering (which is often required with TW, it being a rolling release).  For that matter, openSUSE in general is more geared to power users or groups with sysadmin support; there are Debian derivatives better suited for regular users, especially those coming from Windows world (e.g., Mint, Ubuntu, MX, etc.).  Just my $.02 -- DennisG MSI B450-A Pro, Ryzen 5 2400, 16GB, Leap 15.1, KDE 5.55/5.12.8, stock kernel -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

On Mon, 6 Jul 2020 00:14:03 +0200 "Carlos E. R." wrote:

I agree, but he said he wanted a rolling distro to avoid reinstalls.

There is another way to avoid reinstalls of course. Long-term support releases. I'm getting increasingly tempted, but I'd have to switch distros to get such a fine beast, and that in itself is disruption. -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

On 7/5/20 6:14 PM, Carlos E. R. wrote:

...

snip

I agree, but he said he wanted a rolling distro to avoid reinstalls.

Not meaning to be a smart-ass, but what a user wants and what a user can do/is feasible, is often not the same.  IMO the related threads demonstrate this point.  The irony is that for most regular users, an upgrade (why reinstall???) every 18 months or so is much less challenging (and work) than a rolling release intended for power users.  Folks on this list (and certainly, yourself) have been more than generous with your time and expertise; me thinks though that /tutoring/ is a bridge too far. -- DennisG MSI B450-A Pro, Ryzen 5 2400, 16GB, Leap 15.1, KDE 5.55/5.12.8, stock kernel -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

On 06/07/2020 00.26, Dave Howorth wrote:

On Mon, 6 Jul 2020 00:14:03 +0200 "Carlos E. R." wrote:

...

I agree, but he said he wanted a rolling distro to avoid reinstalls.

There is another way to avoid reinstalls of course. Long-term support releases. I'm getting increasingly tempted, but I'd have to switch distros to get such a fine beast, and that in itself is disruption.

Well, Leap is a Long Term Support distro with 3 or 4 minor upgrades during its life. -- Cheers / Saludos, Carlos E. R. (from 15.1 x86_64 at Telcontar)

On 06/07/2020 01.15, Atri Bhattacharya wrote:

On Sun, 2020-07-05 at 17:33 -0400, DennisG wrote:

...

Doug, as an aside (and no offense meant), IMO you would happier with Leap than TW: "Tumbleweed appeals to Power Users, Software Developers, and openSUSE Contributors"; it is "bleeding edge.".

Sorry Dennis, but with all due respect, this is incorrect information.

Sorry Atri, but it is official information. He took it from our main web page, almost verbatim. Just google for «"Tumbleweed appeals to Power Users"» with quotes and you find it: +++......... www.opensuse.org Tumbleweed appeals to Power Users, Software Developers and openSUSE Contributors. If you require the latest software stacks and Integrated Development Environment or need a stable platform closest to bleeding edge Linux, Tumbleweed is the best choice for you. .........++-

Specific to Doug's case, he would face the exact same problems if he were to change to Leap 15.2 today, namely: no artha; even older versions of gutenprint drivers than on TW; installing non-free (and probably illegally distributed) master-pdf-editor from some random OBS repository; etc.

The search page still lists Artha for 15.2. If it has been removed and the search has not yet updated, I do not know. As for gutenprint, 15.1 has the same version as TW on the printing repo. -- Cheers / Saludos, Carlos E. R. (from 15.1 x86_64 at Telcontar)

On 7/5/20 6:57 AM, Carlos E. R. wrote:

On 05/07/2020 09.17, Doug McGarrett wrote:

...

On 7/4/20 10:05 PM, Carlos E. R. wrote:

...

On 04/07/2020 23.42, Doug McGarrett wrote:

...

I mentioned in a reply to Patrick (a few notes further on in the list) that an app that is mentioned in the system, aspell, might fulfill the requirement, if I could figure out how to install and use it. OTOH, I have used Artha for years without any sign of a problem, and I would certainly be happy to go back to it. How do I get to the Education repo? This system of alternate (or extra?) repos has baffled me for the entire year I have been a Suser.

I explained that not a day ago, so I'm not going to repeat it.

I just went thru every message on the machine that's signed Carlos E. R. in the incoming and the trash pile and I can't find that.

Then you have a mail problem as well.

https://lists.opensuse.org/opensuse-support/2020-07/msg00020.html

Yes, it turns out that I have a mail problem, but not with OpenSUSE; once in a while I download mail on an OLD PCLOS on another machine. It turns out that the version of Thunderbird running on that machine HAS NO AVAILABLE TRASH PILE! So if I erased the message--which of course I should not have--on that mail prog, it is effectively gone for good. The PCLOS is probably 5 years old, and I don't dare mess with it, since it has been very thoroughly superseded (and ruined!) I use that machine since I cannot at present print or scan with the new PC and this OS. (Now that you have repeated the message for me--thank you!--I have opened it again on the other PC and printed it out.) --doug -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

06.07.2020 07:40, Doug McGarrett пишет:

I chose Tumbleweed BECAUSE it is a rolling release. That means that if I ever get it working, I won't have to install a new Linux next year or some other time down the line, and start over.

If you use TW it means you will be installing new Linux every time you update. Not once in two years, but three times a week. -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

On Mon, 06 Jul 2020 01:15:13 +0200 Atri Bhattacharya wrote:

...

On Sun, 2020-07-05 at 17:33 -0400, DennisG wrote:

...

Doug, as an aside (and no offense meant), IMO you would happier with Leap than TW: "Tumbleweed appeals to Power Users, Software Developers, and openSUSE Contributors"; it is "bleeding edge.". Sorry Dennis, but with all due respect, this is incorrect information. On the openSUSE wiki, the TW portal page [1] says the following in its __second__ paragraph to answer the question, "Who should try Tumbleweed?": "Also, Tumbleweed should appeal most to Power Users, Software Developers (who require the latest software stacks and IDEs) and openSUSE Contributors (who need a reliable platform that is as close to openSUSE Factory as possible while remaining usable)."

This means that if you are a power user, developer, or an oS contributor, TW should appeal to you the most (i.e. more than Leap) -- quite different from the impression your (mis)quoted text conveys. There seems to be some language problem here, because you and Dennis appear to me to be saying the same thing.

...

TW is definitely meant to be -- and recommended to be -- used by regular users who need or want the most recent *stable* (i.e. not bleeding edge) versions of packages. Indeed, on the same wiki page, the first paragraph actually says, "Any user who wishes to have newer packages than are available in the openSUSE Leap repositories."

Specific to Doug's case, he would face the exact same problems if he were to change to Leap 15.2 today, namely: no artha; even older versions of gutenprint drivers than on TW; installing non-free (and probably illegally distributed) master-pdf-editor from some random OBS repository; etc. Doug's problems are different, IMHO. Not a lot to do with the difference between TW and Leap.

Doug wanted to avoid the problems associated with upgrades from one Leap release to the next. Moving to TW would not be my choice to resolve that problem (if indeed it is capable of resolution).

...

Cheers,

[1] https://en.opensuse.org/Portal:Tumbleweed I think I should probably chime in here, since I am the object of the comments. First, I am grateful for those who have tried (and usually eventually) succeeded in dragging me into this future. I have never pretended that Linux is an easy route, altho in some respects it is a lot easier than Windows--usually

On 7/5/20 7:50 PM, Dave Howorth wrote: there is some way to get where you want to go, here, whereas in Windows there are certain things that are just not possible at all.  (As a frinstance, up until a couple of months ago, it was not possible to turn off hibernation in the latest edition of Win10. They finally fixed it so you can, now.) And Microsoft keeps throwing garbage in your face, along the way! Like, they would not allow me to create a recovery file on either of two flash-drives that I formatted to FAT32 on a Linux machine. Be that as it may, all of you here, unless you took computer courses in college, have gone thru the same learning curves as I am facing here. And I must say, this latest version of TW seems to be much more opaque than the version from last year. A lot of my previous Linux experience seemed to be applicable, whereas now things have changed in ways unexpected. Yes , I take notes, or at least I did when I had a printer working!  As of tonite, I am copying off useful information to my other machine, so as to print it out. (Printing and scanning will be my next hurdle here!) (Yes, I had some trouble with the 2019 version--it turned out that I had to reset the fixed ip to one of the printers. Never found out why, but it worked. Figured that out myself, btw.) So I hope that I am not proving to be an intractable burden on the inhabitants of this little corner of the computer world. I do appreciate the assistance, and perhaps I will be on the giving end also, one of these days. (I have contributed to these lists in areas that I am familiar with, like radio frequency equipment and design, rf components, propagation, antenna measurements, and so on.  And even computing: I have pointed out to the troglodytes on Microsoft that there is a COMPOSE program that they can use to get things like ₤, ¢, ß, ° ⅓, ö, ç, and so on. ) --doug -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

Le 06/07/2020 à 08:16, Doug McGarrett a écrit :

On 7/6/20 1:20 AM, Andrei Borzenkov wrote:

...

06.07.2020 07:40, Doug McGarrett пишет:

...

I chose Tumbleweed BECAUSE it is a rolling release. That means that if I ever get it working, I won't have to install a new Linux next year or some other time down the line, and start over. If you use TW it means you will be installing new Linux every time you update. Not once in two years, but three times a week.

But it will work. Remember I had this system functioning for a year, with uncounted upgrades, but they didn't modify the function in any way that I noticed. I used to run the upgrades when the number got above 1000. --doug

the problem is that it may stop working at any moment, not necessarily when you have time to fix the problem. In distro update you have 6 month to wait jdd -- http://dodin.org -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

On 06/07/2020 04.10, Doug McGarrett wrote:

On 7/5/20 6:52 AM, Carlos E. R. wrote:

...

...

DESKTOP-4FH9U1P:/home/doug # zypper addrepo https://download.opensuse.org/repositories/openSUSE:Leap:15.1/standard/openS...

File '/repositories/openSUSE:Leap:15.1/standard/openSUSE:Leap:15.1.repo' not found on medium 'https://download.opensuse.org/' Abort, retry, ignore? [a/r/i/...? shows all options] (a):

Don't do this.

Now, FAST: remove that repo you added. Yast, manage repositories tool. Opened up yast, but did not find a command to remove whatever repo might have been added. Anyway, since the choice was to abort, it would seem that no damage was done.

You are right, the abort cancelled the addrepo command. Anyway, the command is there. Start yast, type root password when asked, then on the search box "repo", and you should notice a module named "Software repositories". Or in YaST, start "Software management" module. Then, menu "configuration", option "repositories". Or in a terminal: su - yast2 --qt repositories & Common, you should know at least one of these methods. -- Cheers / Saludos, Carlos E. R. (from 15.1 x86_64 at Telcontar)

Right, let's draw a line under this thread now. This is a support channel, it is useful to have short focused back-and-forths answering specific support questions. This thread has more than run its course by now. Doug, if you have any other specific issues please feel free to raise each as a single message. General discussion about oS and TW vs Leap goes in the general opensuse list (not here). Dennis, if I offended you with my previous message, apologies. TW vs Leap is a discussion I am happy to have with anyone, but let's keep that out of the support ML. Thanks and best wishes. On Mon, 2020-07-06 at 01:53 -0400, Doug McGarrett wrote:

...

On Mon, 06 Jul 2020 01:15:13 +0200 Atri Bhattacharya wrote:

...

On Sun, 2020-07-05 at 17:33 -0400, DennisG wrote:

...

Doug, as an aside (and no offense meant), IMO you would happier with Leap than TW: "Tumbleweed appeals to Power Users, Software Developers, and openSUSE Contributors"; it is "bleeding edge.". Sorry Dennis, but with all due respect, this is incorrect information. On the openSUSE wiki, the TW portal page [1] says the following in its __second__ paragraph to answer the question, "Who should try Tumbleweed?": "Also, Tumbleweed should appeal most to Power Users, Software Developers (who require the latest software stacks and IDEs) and openSUSE Contributors (who need a reliable platform that is as close to openSUSE Factory as possible while remaining usable)."

This means that if you are a power user, developer, or an oS contributor, TW should appeal to you the most (i.e. more than Leap) -- quite different from the impression your (mis)quoted text conveys. There seems to be some language problem here, because you and Dennis appear to me to be saying the same thing.

...

TW is definitely meant to be -- and recommended to be -- used by regular users who need or want the most recent *stable* (i.e. not bleeding edge) versions of packages. Indeed, on the same wiki page, the first paragraph actually says, "Any user who wishes to have newer packages than are available in the openSUSE Leap repositories."

Specific to Doug's case, he would face the exact same problems if he were to change to Leap 15.2 today, namely: no artha; even older versions of gutenprint drivers than on TW; installing non-free (and probably illegally distributed) master-pdf-editor from some random OBS repository; etc. Doug's problems are different, IMHO. Not a lot to do with the difference between TW and Leap.

Doug wanted to avoid the problems associated with upgrades from one Leap release to the next. Moving to TW would not be my choice to resolve that problem (if indeed it is capable of resolution).

...

Cheers,

[1] https://en.opensuse.org/Portal:Tumbleweed I think I should probably chime in here, since I am the object of

On 7/5/20 7:50 PM, Dave Howorth wrote: the comments. First, I am grateful for those who have tried (and usually eventually) succeeded in dragging me into this future. I have never pretended that Linux is an easy route, altho in some respects it is a lot easier than Windows --usually there is some way to get where you want to go, here, whereas in Windows there are certain things that are just not possible at all. (As a frinstance, up until a couple of months ago, it was not possible to turn off hibernation in the latest edition of Win10. They finally fixed it so you can, now.) And Microsoft keeps throwing garbage in your face, along the way! Like, they would not allow me to create a recovery file on either of two flash-drives that I formatted to FAT32 on a Linux machine.

Be that as it may, all of you here, unless you took computer courses in college, have gone thru the same learning curves as I am facing here. And I must say, this latest version of TW seems to be much more opaque than the version from last year. A lot of my previous Linux experience seemed to be applicable, whereas now things have changed in ways unexpected. Yes , I take notes, or at least I did when I had a printer working! As of tonite, I am copying off useful information to my other machine, so as to print it out. (Printing and scanning will be my next hurdle here!)

(Yes, I had some trouble with the 2019 version--it turned out that I had to reset the fixed ip to one of the printers. Never found out why, but it worked. Figured that out myself, btw.)

So I hope that I am not proving to be an intractable burden on the inhabitants of this little corner of the computer world. I do appreciate the assistance, and perhaps I will be on the giving end also, one of these days. (I have contributed to these lists in areas that I am familiar with, like radio frequency equipment and design, rf components, propagation, antenna measurements, and so on. And even computing: I have pointed out to the troglodytes on Microsoft that there is a COMPOSE program that they can use to get things like ₤, ¢, ß, ° ⅓, ö, ç, and so on. )

--doug

-- Atri Bhattacharya Space sciences, Technologies and Astrophysics Research (STAR) Institute, Université de Liège, Bât. B5a, Sart Tilman, 4000 Liège, Belgium Phone: +32 4 366 36 38 http://www.theo.phys.ulg.ac.be/wiki/Bhattacharya_Atri Mon 6 Jul 12:55:57 CEST 2020 Sent from openSUSE Tumbleweed 20200701 on tp-yoga260. -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

Op maandag 6 juli 2020 13:30:30 CEST schreef Patrick Shanahan:

* Carlos E. R. [07-06-20 05:02]:

...

On 06/07/2020 06.40, Doug McGarrett wrote:

...

Thanx for the heads up on HP and printers. I'll follow that path and see what happens. I've heard the Leap commercial too many times. I chose Tumbleweed BECAUSE it is a rolling release. That means that if I ever get it working, I won't have to install a new Linux next year or some other time down the line, and start over. (And THIS start over has been a brute, compared to the start a year ago!) (If you've been reading the mail for a while, You know that my previous PC bit the dust big-time a couple of months ago.)

In TW you get updates every week. Usually small, but tons of them, instead of a relatively big controlled change once a year. Every change that hits Leap eventually, hits TW first. And hits people often unawares, because it is here that the experiments are done and solved.

You keep referring to Tw as expermental. Tw is not experimental, that is Factory. Everything in Tw has been tested in Factory and solved there, first.

...

And for the record, I have never /installed again/ openSUSE in my main machine since around year 2000, using what is now called Leap.

not so, you have "installed again" whenever you did a "zypper dup". It even advises such: "You are about to do a distribution upgrade with all enabled repositories." granted, it is not a "bare metal" install.

Please stop the confusion you generate about Tumbleweed. It is a solid and stable operating system. Can we please stop all confusion here, there's too much stuff here that's off- topic incl. the OP bringing in new, unrelated issues. Let's keep the chit-chat and debates off this list.

-- Gertjan Lettink a.k.a. Knurpht openSUSE Forums Team -- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org

On 7/6/20 5:12 AM, Carlos E. R. wrote: /snip/

I just went thru every message on the machine that's signed Carlos E. R. in the incoming and the trash pile and I can't find that.

...

...

Then you have a mail problem as well.

https://lists.opensuse.org/opensuse-support/2020-07/msg00020.html

Yes, it turns out that I have a mail problem, but not with OpenSUSE; once in a while I download mail on an OLD PCLOS on another machine. It turns out that the version of Thunderbird running on that machine HAS NO AVAILABLE TRASH PILE! So if I erased the message--which of course I should not have--on that mail prog, it is effectively gone for good. The PCLOS is probably 5 years old, and I don't dare mess with it, since it has been very thoroughly superseded (and ruined!) I use that machine since I cannot at present print or scan with the new PC and this OS. (Now that you have repeated the message for me--thank you!--I have opened it again on the other PC and printed it out.)

Then I suggest you never open email on that machine ever again.

And don't trash any messages, learn to handle email without trashing. Yes, absolutely! I don't normally trash messages of use; this one apparently slipped thru. As I mentioned earlier, I will only open messages on that machine which I have already read here on Suse, so as to print them out. Until I make the printers work here. --doug

-- To unsubscribe, e-mail: opensuse-support+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-support+owner@opensuse.org