Puli 3.8.3 bark 6, released Nov 2014

[gjuhasz]

Hi,

This is the time to proudly announce Puli 3.8.3 bark 5

Many unique features, see details on the first page.

Have fun!

Regards,

gjuhasz

[gjuhasz]

This is the time

Yeah, thanks to Microsoft, this (was) the best time to refactor Puli.
Now, Skype is available as an auto-loadable sfs. Runs either by root (with sound) or by spot (in silent mode)
Re-tested, uploaded again to http://www.smokey01.com/gjuhasz with the same 'bark5' name.

Regards,

gjuhasz

[gjuhasz]

Dear Puli users,

Some bugs were discovered in the last few weeks that may affect your daily work with Linux.
Please note that Puli can defend most of them due to its nature. Please ensure that the boot device (pendrive) is removed from the USB slot as soon as Puli recommends that. Also, consider using the Riforous or Crazy profiles while booting Puli on an unknown machine or visit suspicious websites.

I will patch Puli as soon as the official fix(es) arrive.

Have fun!

Regards,

gjuhasz

[gjuhasz]

Dear Puli users,

The patch for the newly discovered bash bug

Bash Code Injection Vulnerability via Specially Crafted Environment Variables (CVE-2014-6271, CVE-2014-7169)

is available for Puli at

http://www.smokey01.com/gjuhasz/Puli_ba ... al_Aug2014

Download the patch folder to your USB boot device then boot Puli normally. That's all.

Bash upgraded to 4.2.25(1)-i686.

Verify the fix based on this article:

https://access.redhat.com/articles/1200223


Have fun!

gjuhasz

[gjuhasz]

That's all.

In the meantime, some new vulnerabilities were detected, thus I updated the patch accordingly. Apply as described in the previous post.

A complete install package is downloadable either as

http://www.smokey01.com/gjuhasz/sfs/bash-4.3.29-1.pet

or as

http://www.smokey01.com/gjuhasz/sfs/bas ... 1-i486.pet

See the test result attached.

Have fun!

gjuhasz

[gjuhasz]

In the meantime, the Poodle vulnerability was detected, thus I patched Puli again.

To apply, visit

http://www.smokey01.com/gjuhasz/Puli_ba ... al_Aug2014

Download the patch folder to your USB boot device (or merge your existing patch folder with the downloaded files). Then boot Puli normally any time.

Test the effectiveness of the patch at:

https://zmap.io/sslv3/

Note that this fix provides a cure only for your (client) browser. You may test your favorite servers at

https://www.tinfoilsecurity.com/poodle

to know whether they have patched their services, too.

(The Links 2 browser is not affected because Poodle uses javascript.

Open http://javatester.org/javascript.html in Links2 to verify.)

Have fun!

gjuhasz

[gjuhasz]

In the meantime, new vulnerability (CVE-2014-4877) was detected, thus I patched Puli again.

To apply, visit

http://www.smokey01.com/gjuhasz/Puli_ba ... al_Aug2014

Download the patch folder to your USB boot device (or merge your existing patch folder with the downloaded files). Then boot Puli normally any time.

I uploaded a couple of pet packages that have backported the CVE-2014-4877 patch to

http://www.smokey01.com/gjuhasz/sfs

folder such as:

wget_1.13-1_precise_i386.pet for Upup Precise v3.8.3.1,
wget_1.15-1_trusty_i386 for tahrpup 6.0 CE


Have fun!

gjuhasz

[gjuhasz]

Just to summarize what I fixed in bark 5 simply by populating the patch folder:

http://www.smokey01.com/gjuhasz/Puli_ba ... 2014/patch

• * Bash "Shellshock" Vulnerability (CVE-2014-6271, 6277, 6278, 7169. 7186, 7187, ////) fixed. Bash upgraded to bash-3.0.22.

• * Poodle bugfix included for Chrome (Links2 not affected)

• * wine collides with Chrome - fixed by uploading new wine package

• * shrink provides buggy result (typo fixed in remove_builtin script)

• * no default codec defined for mplayer (now vo=xv)

• * (workaround) 32-bit PepperFlash in Chrome v38 and above manifests 64-bit fixed (in the updated petget script)

• * Heartbleed vulnerability fixed (by updating openssl and also by upgrading LibreOffice to v4.3.2)

• * wget ftp symlink vulnerability (CVE-2014-4877) fixed.

Have fun!

gjuhasz

[gjuhasz]

Hi all,

I decided to publish a new release that not only does include the fixes summarized in the previous post but has many new features.

So, bark 6 is on horizon!

Have fun!

gjuhasz

[gjuhasz]

Hm.

There is an interesting discussion here:

http://www.murga-linux.com/puppy/viewtopic.php?t=96210

I am wondering if I introduce update notifications (or even automatic updates, both based on user settings) in Puli because Puli is prepared for this by design.

Why not?

I do not suspend uploading Puli bark 6, of course. The auto-update feature will be tested by itself . Soon.


Have fun!

gjuhasz

[gjuhasz]

Hi,

Let me proudly announce the new Puli 3.8.3 bark 6

Many unique and tricky features. See details on the first page.

Have fun!

Regards,

gjuhasz

[gjuhasz]

Let me proudly announce Puli 3.8.3 bark 6

Have fun!

Regards,

gjuhasz

[Dpup]

Installed bark 6 to USB flash boot, works fine, however noticed that the versions of openssl and bash are not current. Are there patch files or updates that can or should be installed?

I think the openssl update is probably the most critical if computer is going to be used for online banking or shopping.

Thanks for all the work on this release !!!

UPDATE 11/12/14 afternoon...
I looked some more, modified /profiles/common/loadsfs to install bash 4.2.53 and openssl 1.0.1j build of Oct 16. Both appear to load fine.

I thought that the update patches were already installed as part of the new bark 6 release.

Any additional comments are welcome. Very different than anything I have seen to date.

[gjuhasz]

Dpup wrote:
Installed bark 6 to USB flash boot, works fine, however noticed that the versions of openssl and bash are not current. Are there patch files or updates that can or should be installed?

I think the openssl update is probably the most critical if computer is going to be used for online banking or shopping.

Thanks for all the work on this release !!!

UPDATE 11/12/14 afternoon...
I looked some more, modified /profiles/common/loadsfs to install bash 4.2.53 and openssl 1.0.1j build of Oct 16. Both appear to load fine.

I thought that the update patches were already installed as part of the new bark 6 release.

Any additional comments are welcome. Very different than anything I have seen to date.


Dear Dpup,

Thanks for interesting in Puli.

About security patches: Puli bark 6 is still based on Ubuntu Precise Pangolin LTS, kernel 3.8.3 thus I applied those security updates Ubuntu published for Precise. (Be sure they responded to all discovered vulnerabilities in time.) So, the concerned modules in Puli are up-to-date, despite of (according to Ubuntu's patching conventions,) they manifest their "old" version number.
To prevent incompatibilities, i did not upgrade to a newer kernel version in bark 6. The existing v3.01 is patched, of course.

For details, please take a look in the posts above where I listed the patches available for bark 5 (in the patch folder at www.smokey01.com/gjuhasz/Puli_bark5_final_Aug2014).
The same set is built into bark 6 along with many new features. Don't hesitate to visit the above referenced or other testing sites to verify.

I decided to apply security patches in the future for Puli bark 6, too, until the official (Canonical) support for Precise LTS expires.

I would appreciate if you could share your experience with me.

FYI: I am writing this from a new Puli based on Trusty Tahr, kernel 3.14.20. Beta will be uploaded soon. Final version arrives by Christmas Eve.

Have fun!

Regards,

gjuhasz

[Dpup]

Thanks for your reply. Tested and confirmed that recent patches are installed in the previous version numbers.

Now testing using Puli Bark 6 on multiple computers, Laptop HP6833US, Acer D150 netbook, Asus 1000HD netbook, Asus 1000HE netbook etc... All on a single USB boot thumb drive, Multiple full backups, multiple secure wifi routers used at different physical locations. I boot from USB thumb drive restore from backup for the computer being used, then select the desired secure router. All working well, and most amazing is the very tiny amount of space used on the thumb drive for all those full backups, Puli is unique in this regard.

Thanks again for making and sharing such a remarkable and useful Puppy derivative.

Dpup

[gjuhasz]

I am writing this from a new Puli based on Trusty Tahr, kernel 3.14.20. Beta will be uploaded soon. Final version arrives by Christmas Eve.

As promised, the new Puli 6.0 is available. See the new thread among Puppy Projects at http://murga-linux.com/puppy/viewtopic.php?t=96964

I plan to continue supporting Puli 3.8.3 until Dec 31, 2015.

Merry Christmas and Happy New Year!

Regards,

gjuhasz

[Pelo]

puli 3.8.3 not stored in smokey repository. Precise version should be kept available, would it possible to provide it again.
don't do it for me, wait more demands. It's an idea (FFMPEG Included free of charge, no need to take corrective actions with precise version)
As i have tahrpup in my multiboot pendrive, puli would be the Puppy precise player.
Netsurf downloaded for a try with Puli 6.0.4 ( where link is dead)
Netsurf always ask me if i agree, i don't know, i don't understand what Netsurf asks. Yes i want Google, it's simple, isn'it ? kicked out

[Robert123]

https://archive.org/details/Puppy_Linux_Puli

[Pelo]

Read the topic, to know how to set well puli.
Audio master is deactivated, capture too. microphone too. that has to be known. open retrovol, and make the necessary change.
Puli was supported by gjuhasz up to 2015 and replaced by a Tahr version.Robert 123 gives the link to load it however. Personaly i decide to run precise puppies beside tahrpup versions, because in fact in my computer that make a difference, more apps are available with precise (more apps where available with DPUP Exprimo too) and that is what i am looking for.
Precise is the version still in use for most of our french Puppies (ToopPy, Triton, and ASRI EDU 310). I will get help in my native language near the devs, is needed.
Puli 3.8.3 is easy to install, and pupsaves are running well, however saving in puli is a different process, that is what i am going to learn, to use it as a puli.
PPM is working well. Wireless is easy using SNS. French keyboard, once choosen, kept active at reboot.
I use laptops, because you can move in the house, our outside. Wireless then can be weak, i bought a dongle to be able to compute outside; i will check if a driver is available for puli.
Elinks for me is not a browser easy. I loaded on the fly a Seamonkey version but i was told not to use Seamonkey. I installed Firefox on a new pupsave.
I am use to usb pendrives, so i installed puli as multiboot beside Tahr and Xenial puppies. Devs need help from users for and feed back for these just released versions.
3.8.3 provides Abiword and Gnumeric included, that is enough for me; i was working for the boss with EXCEL and Word. I am not loose with these too. I don't worlk typing at home, Puppy is just for pleasure, no need of Libre office.

[Pelo]

b. The network_tray icon becomes red while suspicious connections are active. They are logged in /var/log/suspicious_connections file.
bark bark ok

a. According to the profile name, Puli makes hackers crazy. It disables the network periodically to prevent their session become effective.
Crazy would be too much
Does that mean that other Puppies are not secured ???