My Imaginary issues with Whonix Forums
Apart from passion (as I said on my todays post on Whonix Forums) I have scarse resources of my own to do much in the FOSS, but I believe my uncenz program-idea, coupled with the tshark-streams pulling exact (or all, or doing other things) streams out of a network trace, by simpler and faster way to explain than the (of course otherwise irreplaceable) Wireshark's GUI way, is a good thing.
Just as the post a few days ago (and sadly that one didn't get a reply from T-cogne's programmers, and I'll need to tell more there...), this one is for programmers too, but these are FOSS programmers, and it's not likely that I'll need to tell much, but just give the evidence of the minor issues with the Forums that I had. All will be understood, no silly, no idiotic games will be played, like in that other one uncenz page...
(Late note: No it wasn't an issue, I understood while preparing this page... Read on.)
Here is, first, just the last 5 minutes where the error occurs:
While working on this, and only when taking snapshots, one needed for every video, I noticed that in bottom of the screen, upon my pressing of the Esc button this happened, at this stretch from the beginning (you should should open another window with this link):
The post draft in progress. Select to resume.... And it's, believe you me or not, my poor eyesight, coupled with only 800x600 15-years old monitor display... the reason for my understanding of this only now...
Generally, when it comes to what happened on the network this tells the most --but to the knowledgeable only--, the network trace:
To get the text that you can see on 4m 20s from start (as in the link), you could run:
tshark-streams.sh -r dump_161124_1303_g0n.pcap -k \ dump_161124_1303_g0n_SSLKEYLOGFILE.txt -Y "tcp.stream==26"
And that would get you the binary plain and SSL, and the text plain and SSL stream.
From the plain streams it would be impossible to recover anything at all of the payload. But from the, I went for text (but binary would have been fine too), [from the] text SSL stream, with minor editing in Vim (it's called urlencoded text, I think), I got (anybody can, with little effort, if they are familiar enough with FOSS GNU Linux, only my files that I'm posting are necessary) this text:
[quote="Hulahoop, post:2, topic:3188, full:true"] Hi Miroslav. (I think I saw you on grsec forums?) [/quote] Yes, I have posted a lot on grsec (I try wrestling with issues, and if I figure something out, I like telling people, but I'm not very good so often...). But I don't recall any username like yours there ;-) ... [quote="Hulahoop, post:2, topic:3188, full:true"]Thanks for reporting this upstream. Its likely you ran into it before any of us because Gentoo has bleeding egde packages. [/quote] I'll try and do what I can... Often I'm too slow to do much... [quote="Hulahoop, post:2, topic:3188, full:true"]accel2d and accel3d I changed these settings in the XML settings and should be available next release. [/quote] It's great to know! [quote="Hulahoop, post:2, topic:3188, full:true"] (and it's very hard posting on an 800x600 monitor display in a fraction of the screen only...) Yes that too is a bug but in KDE it turns out. We've reported it upstream and its been reproduced and fixed. Expect the patch to be backported to KDE 5.8.4 in the future. and I don't know what the Gentoo equivalent is for The bug tracker categories are confusing indeed. Just try opening the tickets with an approximation of the affected component and let upstream sort it out. [/quote]
I thought this would show a bug, but it does not... However, it is a good practice to someone who wants to learn to read the network. So if you are trying to run the command above, the SSL text stream 26 that I edited into the text above, should be exactly (or not diverge much at all) like the file I include here:
But, this effort of mine wasn't necessary... Not even in my case, where I didn't notice the text in the status bar... Because the text could still be recovered in other, simple GUI ways:
The files necessary for this study are listed in: ls-1
dump_161124_1303_g0n.pcap dump_161124_1303_g0n_s026.txt dump_161124_1303_g0n_SSLKEYLOGFILE.txt index.php Screen_161124_1303_g0n.png Screen_161124_1303_g0n.webm Screen_161124_1342_g0n.png Screen_161124_1342_g0n.webm
and verify to: ls-1.sum signed by: ls-1.sum.asc
And if you are an Unix-like OS user, you can use my dump_dLo.sh script to download them, currently only in the develop branch, so you need to:
git clone -b develop https://github.com/miroR/uncenzfrom, obviously, https://github.com/miroR/uncenz
