[gentoo-dev] Lastrites: app-misc/secure-delete, app-misc/ccal, www-apache/mod_vhs, app-portage/epm, www-apps/online-bookmarks, sys-apps/i2c

[gentoo-dev] Lastrites: app-misc/secure-delete, app-misc/ccal, www-apache/mod_vhs, app-portage/epm, www-apps/online-bookmarks, sys-apps/i2c

[Pacho Ramos]

[-- Attachment #1: Type: text/plain, Size: 880 bytes --]

# Pacho Ramos <pacho@gentoo.org>
# Dead since 2003, doesn't work with journaling filesystems.
# Also collides with dev-util/smem (#288721). Removal in a month.
app-misc/secure-delete

# Pacho Ramos <pacho@gentoo.org>
# No upstream, doesn't work well (#350559). Removal in a month.
app-misc/ccal

# Pacho Ramos <pacho@gentoo.org>
# Upstream dead for a long time, broken php support (#356841).
# Removal in a month.
www-apache/mod_vhs

# Pacho Ramos <pacho@gentoo.org>
# Multiple bugs (#449458). No maintained at all and upstream
# dead. Removal in a month.
app-portage/epm

# Pacho Ramos <pacho@gentoo.org>
# Still uses depend.php (#449820), upstream dead for ages and 
# newer versions don't work. Removal in a month.
www-apps/online-bookmarks

# Pacho Ramos <pacho@gentoo.org>
# It's for kernel-2.4 only (#450594). Removal in a month.
sys-apps/i2c



[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-dev] Lastrites: app-misc/secure-delete, app-misc/ccal, www-apache/mod_vhs, app-portage/epm, www-apps/online-bookmarks, sys-apps/i2c

[Maxim Kammerer]

On Thu, Jan 17, 2013 at 9:21 PM, Pacho Ramos <pacho@gentoo.org> wrote:
> # Pacho Ramos <pacho@gentoo.org>
> # Dead since 2003, doesn't work with journaling filesystems.
> # Also collides with dev-util/smem (#288721). Removal in a month.
> app-misc/secure-delete

Is this a good enough reason for removal? There are no open bugs
besides the collision one (easy to solve with a rename?), and issues
with journaling filesystems / wear leveling / whatnot are generic
problems with secure deletion that can't be solved in userspace
anyway.

-- 
Maxim Kammerer
Liberté Linux: http://dee.su/liberte

Re: [gentoo-dev] Lastrites: app-misc/secure-delete, app-misc/ccal, www-apache/mod_vhs, app-portage/epm, www-apps/online-bookmarks, sys-apps/i2c

[Pacho Ramos]

[-- Attachment #1: Type: text/plain, Size: 806 bytes --]

El jue, 17-01-2013 a las 22:25 +0200, Maxim Kammerer escribió:
> On Thu, Jan 17, 2013 at 9:21 PM, Pacho Ramos <pacho@gentoo.org> wrote:
> > # Pacho Ramos <pacho@gentoo.org>
> > # Dead since 2003, doesn't work with journaling filesystems.
> > # Also collides with dev-util/smem (#288721). Removal in a month.
> > app-misc/secure-delete
> 
> Is this a good enough reason for removal? There are no open bugs
> besides the collision one (easy to solve with a rename?), and issues
> with journaling filesystems / wear leveling / whatnot are generic
> problems with secure deletion that can't be solved in userspace
> anyway.
> 

He, I thought this would occur:
https://bugs.gentoo.org/show_bug.cgi?id=288721#c6

In summary, what does occur when people try to use it with journaling
systems?

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-dev] Lastrites: app-misc/secure-delete, app-misc/ccal, www-apache/mod_vhs, app-portage/epm, www-apps/online-bookmarks, sys-apps/i2c

[Maxim Kammerer]

On Thu, Jan 17, 2013 at 10:34 PM, Pacho Ramos <pacho@gentoo.org> wrote:
> In summary, what does occur when people try to use it with journaling
> systems?

The journal is not cleared. On ext3/4, this usually means metadata —
see [1] for more details. All in all, secure-delete has its uses. What
are people supposed to use instead, dd if=/dev/zero
of=/media/sdcard/naked_gf_0001.jpg? Besides, there are complementary
tools in the package, like sfill.

[1] http://ubuntuforums.org/showthread.php?t=1202656

-- 
Maxim Kammerer
Liberté Linux: http://dee.su/liberte

Re: [gentoo-dev] Lastrites: app-misc/secure-delete, app-misc/ccal, www-apache/mod_vhs, app-portage/epm, www-apps/online-bookmarks, sys-apps/i2c

[Michael Weber]

On 01/17/2013 11:42 PM, Maxim Kammerer wrote:
> The journal is not cleared. On ext3/4, this usually means metadata —
> see [1] for more details. All in all, secure-delete has its uses. What
> are people supposed to use instead, dd if=/dev/zero
> of=/media/sdcard/naked_gf_0001.jpg? Besides, there are complementary
> tools in the package, like sfill.
++ for the VFAT/non-ext[34]/ argument

Personally I use shred from sys-apps/coreutils,

  shred -uvxz /mnt/cf/naked_gf_0001.jpg

which might qualify for an alias, but it's good.

I'd grab this package, if thats the point.

-- 
Michael Weber
Gentoo Developer
web: https://xmw.de/
mailto: Michael Weber <xmw@gentoo.org>

[gentoo-dev] Re: Lastrites: app-misc/secure-delete, app-misc/ccal, www-apache/mod_vhs, app-portage/epm, www-apps/online-bookmarks, sys-apps/i2c

[Paul Arthur]

On 2013-01-17, Maxim Kammerer <mk@dee.su> wrote:

> All in all, secure-delete has its uses. What are people supposed to
> use instead, dd if=/dev/zero of=/media/sdcard/naked_gf_0001.jpg?

Perhaps 'shred', which is part of coreutils?  Also, it might be
enlightening to read the epilogues that Gutmann has added to his
original paper:
http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html#Epilogue

-- 
Having to infer what Unix is solely from a copy of the GNU Manifesto is
not really an exercise you want to undertake.
    --AdB

Re: [gentoo-dev] Re: Lastrites: app-misc/secure-delete, app-misc/ccal, www-apache/mod_vhs, app-portage/epm, www-apps/online-bookmarks, sys-apps/i2c

[Peter Stuge]

Paul Arthur wrote:
> On 2013-01-17, Maxim Kammerer <mk@dee.su> wrote:
> 
> > All in all, secure-delete has its uses. What are people supposed to
> > use instead, dd if=/dev/zero of=/media/sdcard/naked_gf_0001.jpg?
> 
> Perhaps 'shred', which is part of coreutils?

From man shred:

       CAUTION: Note that shred relies on a very  important  assumption:  that
       the  file system overwrites data in place.  This is the traditional way
       to do things, but many modern file system designs do not  satisfy  this
       assumption.   The following are examples of file systems on which shred
       is not effective, or is not guaranteed to be effective in all file sys-
       tem modes:

       * log-structured or journaled file systems, such as those supplied with
       AIX and Solaris (and JFS, ReiserFS, XFS, Ext3, etc.)

In addition, pretty much every flash media that exists today does flash
translation *and* has spare unaddressable flash for error correction.

The best software can do is to repeatedly overwrite the flash with
random bytes. (Don't use /dev/zero because clever translation sees
that other pages already have the same contents, and thus does not
overwrite any flash cells.)


//Peter

[gentoo-dev] Re: Lastrites: app-misc/secure-delete, app-misc/ccal, www-apache/mod_vhs, app-portage/epm, www-apps/online-bookmarks, sys-apps/i2c

[Paul Arthur]

On 2013-01-18, Peter Stuge <peter@stuge.se> wrote:
> Paul Arthur wrote:
>> On 2013-01-17, Maxim Kammerer <mk@dee.su> wrote:
>> 
>> > All in all, secure-delete has its uses. What are people supposed to
>> > use instead, dd if=/dev/zero of=/media/sdcard/naked_gf_0001.jpg?
>> 
>> Perhaps 'shred', which is part of coreutils?
>
> From man shred:
>
>        CAUTION: Note that shred relies on a very  important  assumption:  that
>        the  file system overwrites data in place.  This is the traditional way
>        to do things, but many modern file system designs do not  satisfy  this
>        assumption.   The following are examples of file systems on which shred
>        is not effective, or is not guaranteed to be effective in all file sys-
>        tem modes:
>
>        * log-structured or journaled file systems, such as those supplied with
>        AIX and Solaris (and JFS, ReiserFS, XFS, Ext3, etc.)

Yes. This is the exact same issue secure-delete has, since it uses
the same approach. shred is just as useful as srm (in fact it's more
useful, since it doesn't mandate the full, useless run of 38 passes
that srm does.)

-- 
The testicle that can be seen, felt, kicked, is not the true testicle. The true
testicle... why, it's in your heart, as long as you can keep the magic of death
energy and hatred of life alive in your soul.
    --Random Nerd on RPGnet

Re: [gentoo-dev] Re: Lastrites: app-misc/secure-delete, app-misc/ccal, www-apache/mod_vhs, app-portage/epm, www-apps/online-bookmarks, sys-apps/i2c

[Rich Freeman]

On Thu, Jan 17, 2013 at 10:58 PM, Peter Stuge <peter@stuge.se> wrote:
>        CAUTION: Note that shred relies on a very  important  assumption:  that
>        the  file system overwrites data in place.  This is the traditional way
>        to do things, but many modern file system designs do not  satisfy  this
>        assumption.

Whether the time for these utilities has fully come or not I won't
comment on, but they're already obsolete, at least the way they
operate.

Really the only way to do secure deletion of data is to support it at
the filesystem level, and make it an ioctl or whatever.  And if you're
going to do that you might as well encrypt all the data in the first
place with file/block-specific keys that change on
overwrites/deletes/etc).

The sorts of things that make shred possible are the same sorts of
things that tend to shred your data when you don't want to lose it.
This is really beyond the realm of userspace as a result, now.

Rich

Re: [gentoo-dev] Re: Lastrites: app-misc/secure-delete, app-misc/ccal, www-apache/mod_vhs, app-portage/epm, www-apps/online-bookmarks, sys-apps/i2c

[Maxim Kammerer]

On Fri, Jan 18, 2013 at 6:13 AM, Paul Arthur
<junk+usenet@flowerysong.com> wrote:
> Yes. This is the exact same issue secure-delete has, since it uses
> the same approach. shred is just as useful as srm (in fact it's more
> useful, since it doesn't mandate the full, useless run of 38 passes
> that srm does.)

"srm" doesn't mandate rewrites either.

Anyway, I actually forgot about "shred", so I remove my objection.
Other utilities in secure-delete are either simple wrappers of
rarely-used functionality ("sfill", "sswap"), or essentially useless
for modern kernels ("smem" — good luck clearing free RAM in userspace,
been there, tried that).

Some comments on replies in this thread:

1. Multiple rewrites are indeed useless for modern media, see [1].
2. So journal metadata is not cleared. BFD. If you need 100%
guarantees, drop media in acid.
3. Wear leveling on flash media is rarer than you think, and most
likely doesn't do what you think, see [2].
4. Wear leveling is irrelevant for the usual attack vectors, which is
a technician copying your naked gf photos. You need special hardware
to access hidden sectors. If you are worried about that, see (2).

[1] C. Wright et al., “Overwriting Hard Drive Data: The Great Wiping
Controversy”, http://dx.doi.org/10.1007/978-3-540-89862-7_21
[2] E. Gal and S. Toledo, “Algorithms and Data Structures for Flash
Memories”, http://dx.doi.org/10.1145/1089733.1089735

-- 
Maxim Kammerer
Liberté Linux: http://dee.su/liberte

[gentoo-dev] Re: Lastrites: app-misc/secure-delete, app-misc/ccal, www-apache/mod_vhs, app-portage/epm, www-apps/online-bookmarks, sys-apps/i2c

[Paul Arthur]

On 2013-01-18, Maxim Kammerer <mk@dee.su> wrote:
> On Fri, Jan 18, 2013 at 6:13 AM, Paul Arthur
><junk+usenet@flowerysong.com> wrote:
>> Yes. This is the exact same issue secure-delete has, since it uses
>> the same approach. shred is just as useful as srm (in fact it's more
>> useful, since it doesn't mandate the full, useless run of 38 passes
>> that srm does.)
>
> "srm" doesn't mandate rewrites either.

Ah, right, I missed a qualification in the README and didn't actually
look at the man page.  Sorry for posting misinformation.

-- 
[T]he only virtue it had was that the CD-ROM did not generally on physical
contact explode to drive high-velocity metallic shards laden with radioactive
weaponized anthrax spores through the local postal code.
    --Joseph Nebus in RASFW, on SimCity 3000

Re: [gentoo-dev] Lastrites: app-misc/secure-delete, app-misc/ccal, www-apache/mod_vhs, app-portage/epm, www-apps/online-bookmarks, sys-apps/i2c

[Doug Goldstein]

On Thu, Jan 17, 2013 at 1:21 PM, Pacho Ramos <pacho@gentoo.org> wrote:
> # Pacho Ramos <pacho@gentoo.org>
> # Dead since 2003, doesn't work with journaling filesystems.
> # Also collides with dev-util/smem (#288721). Removal in a month.
> app-misc/secure-delete
>

FWIW, we also have app-misc/scrub in the tree which likely does similar things.

http://code.google.com/p/diskscrub/

-- 
Doug Goldstein

Re: [gentoo-dev] Lastrites: app-misc/secure-delete, app-misc/ccal, www-apache/mod_vhs, app-portage/epm, www-apps/online-bookmarks, sys-apps/i2c

[Doug Goldstein]

On Thu, Jan 17, 2013 at 1:21 PM, Pacho Ramos <pacho@gentoo.org> wrote:
> # Pacho Ramos <pacho@gentoo.org>
> # Dead since 2003, doesn't work with journaling filesystems.
> # Also collides with dev-util/smem (#288721). Removal in a month.
> app-misc/secure-delete
>

FWIW, we also have app-misc/scrub in the tree which likely does similar things.

http://code.google.com/p/diskscrub/

-- 
Doug Goldstein

Re: [gentoo-dev] Lastrites: app-misc/secure-delete, app-misc/ccal, www-apache/mod_vhs, app-portage/epm, www-apps/online-bookmarks, sys-apps/i2c

[Paul Varner]

On 01/17/13 13:21, Pacho Ramos wrote:
> # Pacho Ramos <pacho@gentoo.org>
> # Multiple bugs (#449458). No maintained at all and upstream
> # dead. Removal in a month.
> app-portage/epm

Peter Weilbacher has stepped up to maintain this package and I am acting
as his proxy.  app-portage/epm-1.40 has been added to the tree that
fixes most of the bugs.  I have removed the package mask entry and
updated metadata and bugzilla appropriately.

Regards,
Paul Varner
tools-portage lead

Re: [gentoo-dev] Lastrites: app-misc/secure-delete, app-misc/ccal, www-apache/mod_vhs, app-portage/epm, www-apps/online-bookmarks, sys-apps/i2c

[Amadeusz Żołnowski]

[-- Attachment #1: Type: text/plain, Size: 289 bytes --]

Quoting Pacho Ramos (2013-01-17 20:21:30)
> # Pacho Ramos <pacho@gentoo.org>
> # Still uses depend.php (#449820), upstream dead for ages and 
> # newer versions don't work. Removal in a month.
> www-apps/online-bookmarks

Is there any goog alternative?

-- 
Amadeusz Żołnowski

[-- Attachment #2: signature --]
[-- Type: application/pgp-signature, Size: 490 bytes --]

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)

iQEcBAABAgAGBQJRDOeqAAoJEPATRTHh2/q1p2kH/3IFqZ4RT+ANbhq+f84eK4yz
1MUDybNuBLBJK6b2MEzFxFZPPYB77NU7+RV/NHs62ZWQwkLsGNSc84ngEUJoQz5t
r2mIknYKwLoZybqPJ9l9k3YCgNj4ydI9+nXs8Zu3TJkJ1GXNNatC+ZOoAzNES9kU
0A1pE4I+2AVQj+4HhoH21mhb0Rq/fRJNRocMgTyQQ9E4tX91n5ESWeBViVLKGtXO
NTnpfEgNe5pQDBxdDT0x1UprkslNJSW+J9tHSP0SEClJvHbyK9UgrVGdulOB/6H0
sLmLuDB+vZdc/vafz7nIpx9MOmYAlKH9JhUKNelM7IgBf3oLjsvrMtZxMtfcqwY=
=+WKt
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Lastrites: app-misc/secure-delete, app-misc/ccal, www-apache/mod_vhs, app-portage/epm, www-apps/online-bookmarks, sys-apps/i2c

[Alec Warner]

On Sat, Feb 2, 2013 at 2:17 AM, Amadeusz Żołnowski <aidecoe@gentoo.org> wrote:
> Quoting Pacho Ramos (2013-01-17 20:21:30)
>> # Pacho Ramos <pacho@gentoo.org>
>> # Still uses depend.php (#449820), upstream dead for ages and
>> # newer versions don't work. Removal in a month.
>> www-apps/online-bookmarks
>
> Is there any goog alternative?

A goog alternative? Chrome Sync!
I assume you meant a good alternative though :/

-A

>
> --
> Amadeusz Żołnowski

Re: [gentoo-dev] Lastrites: app-misc/secure-delete, app-misc/ccal, www-apache/mod_vhs, app-portage/epm, www-apps/online-bookmarks, sys-apps/i2c

[Matti Bickel]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/02/2013 11:17 AM, Amadeusz Żołnowski wrote:
> Quoting Pacho Ramos (2013-01-17 20:21:30)
>> # Pacho Ramos <pacho@gentoo.org> # Still uses depend.php 
>> (#449820), upstream dead for ages and # newer versions don't 
>> work. Removal in a month. www-apps/online-bookmarks
> 
> Is there any goog alternative?

Maybe one of these?
http://lifehacker.com/5540019/five-best-bookmark-management-tools
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAlEOQ1YACgkQfNMcoUhJ7GzIXQCeMTohwB5Wv0UO5RfCAcqs+iC6
qSEAn0z9RKYR1kCmR1lEdbKdkVfGQyI0
=HQI6
-----END PGP SIGNATURE-----