On installing the latest version of Calibre (7.17.3) I get this error:
$ calibre Traceback (most recent call last): File "/usr/bin/calibre", line 21, in <module> sys.exit(calibre()) ^^^^^^^^^ File "/usr/lib64/calibre/calibre/gui_launch.py", line 73, in calibre main(args) File "/usr/lib64/calibre/calibre/gui2/main.py", line 547, in main run_main(app, opts, args, gui_debug, si, retry_communicate=True) File "/usr/lib64/calibre/calibre/gui2/main.py", line 559, in run_main return run_gui(opts, args, app, gui_debug=gui_debug) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib64/calibre/calibre/gui2/main.py", line 397, in run_gui run_gui_(opts, args, app, gui_debug) File "/usr/lib64/calibre/calibre/gui2/main.py", line 407, in run_gui_ from calibre.gui2.ui import Main File "/usr/lib64/calibre/calibre/gui2/ui.py", line 26, in <module> from calibre.customize.ui import available_store_plugins, interface_actions File "/usr/lib64/calibre/calibre/customize/ui.py", line 28, in <module> from calibre.customize.builtins import plugins as builtin_plugins File "/usr/lib64/calibre/calibre/customize/builtins.py", line 731, in <module> from calibre.devices.kobo.driver import KOBO, KOBOTOUCH File "/usr/lib64/calibre/calibre/devices/kobo/driver.py", line 24, in <module> from calibre.devices.kobo.books import Book, ImageWrapper, KTCollectionsBookList File "/usr/lib64/calibre/calibre/devices/kobo/books.py", line 14, in <module> from calibre.ebooks.metadata.book.formatter import SafeFormat File "/usr/lib64/calibre/calibre/ebooks/metadata/book/formatter.py", line 9, in <module> from calibre.utils.formatter import TemplateFormatter File "/usr/lib64/calibre/calibre/utils/formatter.py", line 23, in <module> from calibre.utils.formatter_functions import StoredObjectType, formatter_functions, function_object_type, get_database File "/usr/lib64/calibre/calibre/utils/formatter_functions.py", line 29, in <module> from calibre.db.notes.exim import expand_note_resources, parse_html File "/usr/lib64/calibre/calibre/db/notes/exim.py", line 7, in <module> from html5_parser import parse File "/usr/lib64/python3.12/site-packages/html5_parser/__init__.py", line 30, in <module> raise RuntimeError( RuntimeError: html5-parser and lxml are using different versions of libxml2. This happens commonly when using pip installed versions of lxml. Use pip install --no-binary lxml lxml instead. libxml2 versions: html5-parser: (2, 12, 8) != lxml: (2, 10, 3)
I hesitate to run 'pip install ...' as suggested, and I already have lxml:
$ rpm -qi python3-lxml Name : python3-lxml Version : 5.1.0 Release : 7.fc40 Architecture: x86_64 etc.
Do I need to contact the Calibre package maintainer? I normally install Calibre directly from the website, but that also has an (unrelated) problem.
poc
On 9/1/24 2:11 PM, Patrick O'Callaghan wrote:
On installing the latest version of Calibre (7.17.3) I get this error:
RuntimeError: html5-parser and lxml are using different versions of libxml2. This happens commonly when using pip installed versions of lxml. Use pip install --no-binary lxml lxml instead. libxml2 versions: html5-parser: (2, 12, 8) != lxml: (2, 10, 3)
I hesitate to run 'pip install ...' as suggested, and I already have lxml:
$ rpm -qi python3-lxml Name : python3-lxml Version : 5.1.0 Release : 7.fc40 Architecture: x86_64 etc.
Do I need to contact the Calibre package maintainer? I normally install Calibre directly from the website, but that also has an (unrelated) problem.
Why would you contact the package maintainer if you're using a version of Calibre that's not from Fedora? The latest version in Fedora is calibre-7.17.0-3 and it runs fine.
I don't know why you're getting that error since the packaged version of python3-lxml uses the installed version of libxml2 which is libxml2-2.12.8-1.fc40 if you're up to date. So your wrong version is coming from somewhere else. Maybe you've pip installed something.
On Sun, 2024-09-01 at 14:35 -0700, Samuel Sieb wrote:
On 9/1/24 2:11 PM, Patrick O'Callaghan wrote:
On installing the latest version of Calibre (7.17.3) I get this error:
RuntimeError: html5-parser and lxml are using different versions of libxml2. This happens commonly when using pip installed versions of lxml. Use pip install --no-binary lxml lxml instead. libxml2 versions: html5-parser: (2, 12, 8) != lxml: (2, 10, 3)
I hesitate to run 'pip install ...' as suggested, and I already have lxml:
$ rpm -qi python3-lxml Name : python3-lxml Version : 5.1.0 Release : 7.fc40 Architecture: x86_64 etc.
Do I need to contact the Calibre package maintainer? I normally install Calibre directly from the website, but that also has an (unrelated) problem.
Why would you contact the package maintainer if you're using a version of Calibre that's not from Fedora? The latest version in Fedora is calibre-7.17.0-3 and it runs fine.
I would only contact the package maintainer about the error with the Fedora version, which you have now said doesn't happen on your system.
[I merely mentioned the other version as it's the one I would normally use (simply because in the past it has often been more up to date than the repo version), but can't in this case. That version is now completely uninstalled.]
I don't know why you're getting that error since the packaged version of python3-lxml uses the installed version of libxml2 which is libxml2-2.12.8-1.fc40 if you're up to date. So your wrong version is coming from somewhere else. Maybe you've pip installed something.
I do have that version of libxml2:
$ rpm -q libxml2-2.12.8-1.fc40 libxml2-2.12.8-1.fc40.x86_64 libxml2-2.12.8-1.fc40.i686
However I also have mingw64-libxml2-2.12.7-1.fc40.noarch, which was installed together with Wine. I assume that's the root of the problem, but I can't solve it without uninstalling Wine.
poc
On 9/1/24 3:02 PM, Patrick O'Callaghan wrote:
On Sun, 2024-09-01 at 14:35 -0700, Samuel Sieb wrote:
On 9/1/24 2:11 PM, Patrick O'Callaghan wrote:
On installing the latest version of Calibre (7.17.3) I get this error:
RuntimeError: html5-parser and lxml are using different versions of libxml2. This happens commonly when using pip installed versions of lxml. Use pip install --no-binary lxml lxml instead. libxml2 versions: html5-parser: (2, 12, 8) != lxml: (2, 10, 3)
I hesitate to run 'pip install ...' as suggested, and I already have lxml:
$ rpm -qi python3-lxml Name : python3-lxml Version : 5.1.0 Release : 7.fc40 Architecture: x86_64 etc.
Do I need to contact the Calibre package maintainer? I normally install Calibre directly from the website, but that also has an (unrelated) problem.
Why would you contact the package maintainer if you're using a version of Calibre that's not from Fedora? The latest version in Fedora is calibre-7.17.0-3 and it runs fine.
I would only contact the package maintainer about the error with the Fedora version, which you have now said doesn't happen on your system.
You said you got that error running "the latest version of Calibre (7.17.3)" which is not the Fedora version.
[I merely mentioned the other version as it's the one I would normally use (simply because in the past it has often been more up to date than the repo version), but can't in this case. That version is now completely uninstalled.]
I don't know why you're getting that error since the packaged version of python3-lxml uses the installed version of libxml2 which is libxml2-2.12.8-1.fc40 if you're up to date. So your wrong version is coming from somewhere else. Maybe you've pip installed something.
I do have that version of libxml2:
$ rpm -q libxml2-2.12.8-1.fc40 libxml2-2.12.8-1.fc40.x86_64 libxml2-2.12.8-1.fc40.i686
However I also have mingw64-libxml2-2.12.7-1.fc40.noarch, which was installed together with Wine. I assume that's the root of the problem, but I can't solve it without uninstalling Wine.
That won't be a problem because those libraries are only for wine.
Look in .local/lib/python3.12/site-packages/ (I really hope you didn't pip install anything as root), and see what's in there.
On Sun, 2024-09-01 at 15:19 -0700, Samuel Sieb wrote:
However I also have mingw64-libxml2-2.12.7-1.fc40.noarch, which was installed together with Wine. I assume that's the root of the problem, but I can't solve it without uninstalling Wine.
That won't be a problem because those libraries are only for wine.
Look in .local/lib/python3.12/site-packages/ (I really hope you didn't pip install anything as root), and see what's in there.
I find:
$ ls .local/lib/python3.12/site-packages/ configparser-7.0.0-py3.12.egg lxml-4.9.4.dist-info numpy.libs pillow.libs _webrtcvad.cpython-312-x86_64-linux-gnu.so easy-install.pth numpy PIL protonup-0.1.5-py3.12.egg webrtcvad.py lxml numpy-2.0.1.dist-info pillow-10.4.0.dist-info __pycache__ webrtcvad_wheels-2.0.11.post1.dist-info
If I move that directory to one side, Calibre does start. However there are things there (e.g. Proton) that I want to keep.
I'm not aware of installing anything with pip as root.
poc
On Mon, 2 Sept 2024 at 10:21, Patrick O'Callaghan pocallaghan@gmail.com wrote:
On Sun, 2024-09-01 at 15:19 -0700, Samuel Sieb wrote:
However I also have mingw64-libxml2-2.12.7-1.fc40.noarch, which was installed together with Wine. I assume that's the root of the problem, but I can't solve it without uninstalling Wine.
That won't be a problem because those libraries are only for wine.
Look in .local/lib/python3.12/site-packages/ (I really hope you didn't pip install anything as root), and see what's in there.
I find:
$ ls .local/lib/python3.12/site-packages/ configparser-7.0.0-py3.12.egg lxml-4.9.4.dist-info numpy.libs pillow.libs _webrtcvad.cpython-312-x86_64-linux-gnu.so easy-install.pth numpy PIL protonup-0.1.5-py3.12.egg webrtcvad.py lxml numpy-2.0.1.dist-info pillow-10.4.0.dist-info __pycache__ webrtcvad_wheels-2.0.11.post1.dist-info
If I move that directory to one side, Calibre does start. However there are things there (e.g. Proton) that I want to keep.
I'm not aware of installing anything with pip as root.
If you pip install stuff in a Python virtual environment, that can help isolate custom modules further from your normal/system Python runtimes.
https://docs.python.org/3/library/venv.html https://realpython.com/python-virtual-environments-a-primer/
On Mon, 2024-09-02 at 11:32 +0100, Will McDonald wrote:
$ ls .local/lib/python3.12/site-packages/ configparser-7.0.0-py3.12.egg lxml-4.9.4.dist-info numpy.libs pillow.libs _webrtcvad.cpython-312-x86_64-linux-gnu.so easy-install.pth numpy PIL protonup-0.1.5-py3.12.egg webrtcvad.py lxml numpy-2.0.1.dist-info pillow-10.4.0.dist-info __pycache__ webrtcvad_wheels-2.0.11.post1.dist-info
If I move that directory to one side, Calibre does start. However there are things there (e.g. Proton) that I want to keep.
I'm not aware of installing anything with pip as root.
If you pip install stuff in a Python virtual environment, that can help isolate custom modules further from your normal/system Python runtimes.
https://docs.python.org/3/library/venv.html https://realpython.com/python-virtual-environments-a-primer/
Yes, I'm vaguely aware of that possibility though I've never had to use it up to now, i.e. everything has "just worked".
For example, Proton is normally invoked by Steam or Wine, so does this mean I have to change those as well?
poc
On 2 Sep 2024, at 12:13, Patrick O'Callaghan pocallaghan@gmail.com wrote:
Yes, I'm vaguely aware of that possibility though I've never had to use it up to now, i.e. everything has "just worked".
Usually on Fedora it has just worked in the past. But there are too many edge cases where pip installing a module can break system tools. You would be unhappy if dnf broke.
What I do is create one venv that I put the tools I pip install into then symlink the tools into my ~/bin.
On 2 Sep 2024, at 12:13, Patrick O'Callaghan pocallaghan@gmail.com wrote:
For example, Proton is normally invoked by Steam or Wine, so does this mean I have to change those as well?
Proton and Wine are not python modules so the python venv is not involved.
Barry
On Mon, 2024-09-02 at 14:07 +0100, Barry Scott wrote:
On 2 Sep 2024, at 12:13, Patrick O'Callaghan pocallaghan@gmail.com wrote:
Yes, I'm vaguely aware of that possibility though I've never had to use it up to now, i.e. everything has "just worked".
Usually on Fedora it has just worked in the past. But there are too many edge cases where pip installing a module can break system tools. You would be unhappy if dnf broke.
What I do is create one venv that I put the tools I pip install into then symlink the tools into my ~/bin.
OK
On 2 Sep 2024, at 12:13, Patrick O'Callaghan pocallaghan@gmail.com wrote:
For example, Proton is normally invoked by Steam or Wine, so does this mean I have to change those as well?
Proton and Wine are not python modules so the python venv is not involved.
I must have been thinking of 'protonup', a script I found somewhere that updates the version of Proton. I might just remove it, or use venv as you suggest.
poc
On Mon, Sep 2, 2024 at 7:33 AM Will McDonald wmcdonald@gmail.com wrote:
If you pip install stuff in a Python virtual environment, that can help isolate custom modules further from your normal/system Python runtimes.
https://docs.python.org/3/library/venv.html https://realpython.com/python-virtual-environments-a-primer/
Before retiring I worked in an environment where multiple "mission critical " python packages were needed, often running on different python versions and OS's. Colleagues at other labs used different linux distros, and most users were required by their employers to have Windows. Conda environments provide a cross-platform way to deal with the diverse application requirements and host OS's. Many application developers also adopted conda.
Calibre is available as flatpaks.
On Tue, 2024-09-03 at 08:37 -0300, George N. White III wrote:
On Mon, Sep 2, 2024 at 7:33 AM Will McDonald wmcdonald@gmail.com wrote:
If you pip install stuff in a Python virtual environment, that can help isolate custom modules further from your normal/system Python runtimes.
https://docs.python.org/3/library/venv.html https://realpython.com/python-virtual-environments-a-primer/
Before retiring I worked in an environment where multiple "mission critical " python packages were needed, often running on different python versions and OS's. Colleagues at other labs used different linux distros, and most users were required by their employers to have Windows. Conda environments provide a cross-platform way to deal with the diverse application requirements and host OS's. Many application developers also adopted conda.
Calibre is available as flatpaks.
I prefer to avoid flatpaks where possible, and Calibre is in the Fedora repo. I've experimented a bit with venv so I'll be using that for pip installation now.
poc
On 2024-09-03 04:37, George N. White III wrote:
On Mon, Sep 2, 2024 at 7:33 AM Will McDonald <wmcdonald@gmail.com mailto:wmcdonald@gmail.com> wrote:
If you pip install stuff in a Python virtual environment, that can help isolate custom modules further from your normal/system Python runtimes. https://docs.python.org/3/library/venv.html <https://docs.python.org/3/library/venv.html> https://realpython.com/python-virtual-environments-a-primer/ <https://realpython.com/python-virtual-environments-a-primer/>Before retiring I worked in an environment where multiple "mission critical " python packages were needed, often running on different python versions and OS's. Colleagues at other labs used different linux distros, and most users were required by their employers to have Windows. Conda environments provide a cross-platform way to deal with the diverse application requirements and host OS's. Many application developers also adopted conda.
Calibre is available as flatpaks.
The Fedora packaged Calibre works fine. The issue here is a pip installed library overriding the system one.
On Tue, Sep 3, 2024 at 3:57 PM Samuel Sieb samuel@sieb.net wrote:
On 2024-09-03 04:37, George N. White III wrote:
Calibre is available as flatpaks.
The Fedora packaged Calibre works fine. The issue here is a pip installed library overriding the system one.
Flatpaks should not be affected by such misconfiguration. It may be easier to switch Calbre to the flatpak than to unwind pip installs.
On Thu, 2024-09-05 at 08:04 -0300, George N. White III wrote:
On Tue, Sep 3, 2024 at 3:57 PM Samuel Sieb samuel@sieb.net wrote:
On 2024-09-03 04:37, George N. White III wrote:
Calibre is available as flatpaks.
The Fedora packaged Calibre works fine. The issue here is a pip installed library overriding the system one.
Flatpaks should not be affected by such misconfiguration. It may be easier to switch Calbre to the flatpak than to unwind pip installs.
Fortunately I only had one such install so it wasn't a problem. YMMV of course.
I believe there is an ongoing discussion about how pip should be more integrated with packaging systems to avoid this kind of confusion.
poc
On 5 Sep 2024, at 12:15, Patrick O'Callaghan pocallaghan@gmail.com wrote:
I believe there is an ongoing discussion about how pip should be more integrated with packaging systems to avoid this kind of confusion.
Not sure what you are referring to, all discussion are long over.
The current state is that you MUST use a venv for all pip installed packages. That is the accepted solution.
Also pip was changed to prevent you installing outside a venv without explicit command option to override.
Barry
On Thu, 2024-09-05 at 14:48 +0100, Barry wrote:
On 5 Sep 2024, at 12:15, Patrick O'Callaghan pocallaghan@gmail.com wrote:
I believe there is an ongoing discussion about how pip should be more integrated with packaging systems to avoid this kind of confusion.
Not sure what you are referring to, all discussion are long over.
https://lwn.net/Articles/924104/
Admittedly this is from last year. I don't follow Python news very closely.
The current state is that you MUST use a venv for all pip installed packages. That is the accepted solution.
Also pip was changed to prevent you installing outside a venv without explicit command option to override.
That doesn't seem to correspond with the man page, which has:
--require-virtualenv Allow pip to only run in a virtual environment; exit with an error otherwise.
However there is no indication that this is the default, and when I run pip install I get no warning about it.
poc
On Thu, Sep 5, 2024 at 12:13 PM Patrick O'Callaghan pocallaghan@gmail.com wrote:
On Thu, 2024-09-05 at 14:48 +0100, Barry wrote:
On 5 Sep 2024, at 12:15, Patrick O'Callaghan pocallaghan@gmail.com wrote:
I believe there is an ongoing discussion about how pip should be more integrated with packaging systems to avoid this kind of confusion.
Not sure what you are referring to, all discussion are long over.
https://lwn.net/Articles/924104/
Admittedly this is from last year. I don't follow Python news very closely.
This made my radar today: https://jfrog.com/blog/revival-hijack-pypi-hijack-technique-exploited-22k-packages-at-risk/. It's like Peter Gutmann said: "A great many of today’s security technologies are “secure” only because no-one has ever bothered attacking them."
The current state is that you MUST use a venv for all pip installed packages. That is the accepted solution.
Also pip was changed to prevent you installing outside a venv without explicit command option to override.
That doesn't seem to correspond with the man page, which has:
--require-virtualenv Allow pip to only run in a virtual environment; exit with an error otherwise.
However there is no indication that this is the default, and when I run pip install I get no warning about it.
Jeff
On Thu, 2024-09-05 at 13:11 -0400, Jeffrey Walton wrote:
This made my radar today: https://jfrog.com/blog/revival-hijack-pypi-hijack-technique-exploited-22k-packages-at-risk/. It's like Peter Gutmann said: "A great many of today’s security technologies are “secure” only because no-one has ever bothered attacking them."
Few people seems to have any idea, or appropriate concern, about security. Including the people that ought to...
If you operate a website (talking about python hijacks, and the like), using unknown code from some external source, without you having any communication with the coder, you're mad. You don't know about it's current safety, the coders intentions, nor it's future prospects. And if you blindly apply updates, you're even more nuts. Especially with expensive professional sites (i.e. not a fill in the template vanity site).
If you're going to pay the exorbitant expenses demanded by website creators, then hire ones who'll actually code the thing from scratch, and not just cobble things together from other people's scripts like some amateur bedroom coder. It's only thanks to much faster modern computers, that such festering pools of over-scripted sites still manage to operate, rather than grind to a halt like they used to.
Yet day after day, we see sites in which just one page (never mind the whole site) is a conglomeration of dozens of scripts, content dragged in from dozens of sites, advertising that isn't under your control, cookies everywhere. There's no way the site managers can be aware of how they will all interact with each other.
The idea of some library, etc., suddenly getting replaced at some time in the future because the coder deleted it, and someone else inserted a new one using the same name is a complete absence of security. Relying on the package name, alone, is crazy. There should also be some kind of crypto key that identifies a project from the start, that every update must be signed with, preventing a simple substitution.
Security failures like this exist in many other things: You give up a telephone service, someone acquires your old number, people use your old phone number to exploit you. Likewise with email addresses. I've kept old email addresses just to stop someone else misusing them.
I gave up on an old website, kept the domain name for a while, left the site showing a site closed down notice, with a redirection to the new one. I eventually decided it was a waste of my money. The moment the domain expired, someone grabbed it, and filled it with junk that scrapes content from elsewhere hoping to get people reading it, hoping that it'll get former traffic to my site. Years later, it's still like that. I have a look from time to time. It contains nonsense, it's not any kind of service, it's just a domain squatting parasite. It's a shame that domain names became so expensive, it may have been worth a few dollars just to maintain ownership of the domain name, but there's a threshold to how much money you're prepared to waste. And you can also run afoul of rules about not hoarding domain names.
On Fri, Sep 6, 2024 at 12:04 AM Tim via users users@lists.fedoraproject.org wrote:
On Thu, 2024-09-05 at 13:11 -0400, Jeffrey Walton wrote:
This made my radar today: <
https://jfrog.com/blog/revival-hijack-pypi-hijack-technique-exploited-22k-pa...
. It's like Peter Gutmann said: "A great many of today’s security technologies are “secure” only because no-one has ever bothered attacking them."
Security failures like this exist in many other things: You give up a telephone service, someone acquires your old number, people use your old phone number to exploit you. Likewise with email addresses. I've kept old email addresses just to stop someone else misusing them.
I have an account on a community network that was the first public access to internet where I live. My extended family includes kids, and I have noticed increases in smap messages (currently running around 100 per day) when kids get internet access and also times when corresponding with friends and relatives after someone dies.
I gave up on an old website, kept the domain name for a while, left the site showing a site closed down notice, with a redirection to the new one.
Over the years I have purchased gear from businesses that have since failed. In many case their domains have been taken over by click-bait sites. There was also an incident where a small scientific NGO had some clone the site with the name changed by swapping underscore and dash. The new name came first in web searches.
I eventually decided it was a waste of my money. The moment the
domain expired, someone grabbed it, and filled it with junk that scrapes content from elsewhere hoping to get people reading it, hoping that it'll get former traffic to my site. Years later, it's still like that. I have a look from time to time. It contains nonsense, it's not any kind of service, it's just a domain squatting parasite.
They must have a way to monetize clicks that makes it worth maintaining the name.
It's a shame that domain names became so expensive, it may have been worth a few dollars just to maintain ownership of the domain name, but there's a threshold to how much money you're prepared to waste. And you can also run afoul of rules about not hoarding domain names.
AI seems to have been a big boost to clickbait sites. They can take the top 100 Windows questions and use AI to generate pages that claim to have the best answers.
On 9/6/24 06:28, George N. White III wrote:
On Fri, Sep 6, 2024 at 12:04 AM Tim via users users@lists.fedoraproject.org wrote:
On Thu, 2024-09-05 at 13:11 -0400, Jeffrey Walton wrote:
This made my radar today: <
https://jfrog.com/blog/revival-hijack-pypi-hijack-technique-exploited-22k-pa...
. It's like Peter Gutmann said: "A great many of today’s security technologies are “secure” only because no-one has ever bothered attacking them."
Security failures like this exist in many other things: You give up a telephone service, someone acquires your old number, people use your old phone number to exploit you. Likewise with email addresses. I've kept old email addresses just to stop someone else misusing them.
I have an account on a community network that was the first public access to internet where I live. My extended family includes kids, and I have noticed increases in smap messages (currently running around 100 per day) when kids get internet access and also times when corresponding with friends and relatives after someone dies.
Hi George,
How do you identify smap traffic? It's not listed in /etc/services and I can't find an assigned port number on the intertube ( actually, not much of anything except it being a way to pass SMS between computers and that was cursory ).
:m
On Sat, 2024-09-07 at 13:44 -0700, Mike Wright wrote:
On 9/6/24 06:28, George N. White III wrote:
On Fri, Sep 6, 2024 at 12:04 AM Tim via users users@lists.fedoraproject.org wrote:
On Thu, 2024-09-05 at 13:11 -0400, Jeffrey Walton wrote:
This made my radar today: <
https://jfrog.com/blog/revival-hijack-pypi-hijack-technique-exploited-22k-pa...
. It's like Peter Gutmann said: "A great many of today’s security technologies are “secure” only because no-one has ever bothered attacking them."
Security failures like this exist in many other things: You give up a telephone service, someone acquires your old number, people use your old phone number to exploit you. Likewise with email addresses. I've kept old email addresses just to stop someone else misusing them.
I have an account on a community network that was the first public access to internet where I live. My extended family includes kids, and I have noticed increases in smap messages (currently running around 100 per day) when kids get internet access and also times when corresponding with friends and relatives after someone dies.
Hi George,
How do you identify smap traffic? It's not listed in /etc/services and I can't find an assigned port number on the intertube ( actually, not much of anything except it being a way to pass SMS between computers and that was cursory ).
This seems to be getting way off-topic for the thread. I suggest that interested parties start a new thread focussed on these security issues, which is not what I was originally asking about.
poc
On Thu, Sep 5, 2024 at 9:49 AM Barry barry@barrys-emacs.org wrote:
On 5 Sep 2024, at 12:15, Patrick O'Callaghan pocallaghan@gmail.com wrote:
I believe there is an ongoing discussion about how pip should be more integrated with packaging systems to avoid this kind of confusion.
Not sure what you are referring to, all discussion are long over.
The current state is that you MUST use a venv for all pip installed packages. That is the accepted solution.
For sites under my control, pip is banned. Developers are free to install a package via dnf, or build the package from source against the distro sources. In either case, there are no problems traditionally caused by pip and its inability to manage python packages.
We banned pip years ago after pip made a mess of one of our web servers, and the pip developers told us we were on our own to fix it.
Also pip was changed to prevent you installing outside a venv without explicit command option to override.
Jeff
On 9/2/24 2:20 AM, Patrick O'Callaghan wrote:
On Sun, 2024-09-01 at 15:19 -0700, Samuel Sieb wrote:
However I also have mingw64-libxml2-2.12.7-1.fc40.noarch, which was installed together with Wine. I assume that's the root of the problem, but I can't solve it without uninstalling Wine.
That won't be a problem because those libraries are only for wine.
Look in .local/lib/python3.12/site-packages/ (I really hope you didn't pip install anything as root), and see what's in there.
I find:
$ ls .local/lib/python3.12/site-packages/ configparser-7.0.0-py3.12.egg lxml-4.9.4.dist-info numpy.libs pillow.libs _webrtcvad.cpython-312-x86_64-linux-gnu.so easy-install.pth numpy PIL protonup-0.1.5-py3.12.egg webrtcvad.py lxml numpy-2.0.1.dist-info pillow-10.4.0.dist-info __pycache__ webrtcvad_wheels-2.0.11.post1.dist-info
If I move that directory to one side, Calibre does start. However there are things there (e.g. Proton) that I want to keep.
I see lxml in there. That's probably the issue.
On Mon, 2024-09-02 at 10:40 -0700, Samuel Sieb wrote:
On 9/2/24 2:20 AM, Patrick O'Callaghan wrote:
On Sun, 2024-09-01 at 15:19 -0700, Samuel Sieb wrote:
However I also have mingw64-libxml2-2.12.7-1.fc40.noarch, which was installed together with Wine. I assume that's the root of the problem, but I can't solve it without uninstalling Wine.
That won't be a problem because those libraries are only for wine.
Look in .local/lib/python3.12/site-packages/ (I really hope you didn't pip install anything as root), and see what's in there.
I find:
$ ls .local/lib/python3.12/site-packages/ configparser-7.0.0-py3.12.egg lxml-4.9.4.dist-info numpy.libs pillow.libs _webrtcvad.cpython-312-x86_64-linux-gnu.so easy-install.pth numpy PIL protonup-0.1.5-py3.12.egg webrtcvad.py lxml numpy-2.0.1.dist-info pillow-10.4.0.dist-info __pycache__ webrtcvad_wheels-2.0.11.post1.dist-info
If I move that directory to one side, Calibre does start. However there are things there (e.g. Proton) that I want to keep.
I see lxml in there. That's probably the issue.
Very likely.
poc
-
Barry -
Barry Scott
-
George N. White III -
Jeffrey Walton -
Mike Wright -
Patrick O'Callaghan -
Samuel Sieb -
Tim -
Will McDonald