Color me shocked...

Posted Jul 18, 2022 1:17 UTC (Mon) by mirabilos (subscriber, #84359)
In reply to: Color me shocked... by dskoll
Parent article: Garrett: Responsible stewardship of the UEFI secure boot ecosystem

Well yeah, not surprising.

I can’t read the article though. Cloudflare is blocking lynx. Can someone copy/paste it into here?

Color me shocked...

Posted Jul 18, 2022 8:46 UTC (Mon) by pabs (subscriber, #43278) [Link] (6 responses)

The copy in archive.org works for me if I accept the cert (not sure why lynx can't auto-validate it):

https://web.archive.org/web/https://mjg59.dreamwidth.org/...

Color me shocked...

Posted Jul 18, 2022 10:55 UTC (Mon) by mirabilos (subscriber, #84359) [Link] (5 responses)

Oh, that works here. It doesn’t for other sites hit by Cloudflare/hCAPTCHA’s willful incompetence.

The answer to your parenthesised question is ECMAscript, and that people consider it a “hacking[sic!] tool” ☹ the lynx mailing list is full of visually impaired people reporting troubles.

Color me shocked...

Posted Jul 19, 2022 4:19 UTC (Tue) by pabs (subscriber, #43278) [Link] (4 responses)

My question was about lynx not accepting the TLS certificate of web.archive.org, not about JavaScript. lynx seems to use GnuTLS for accessing TLS websites, but gnutls-cli accepts the cert just fine, while lynx does not. Other text based and graphical browsers seem to accept the cert fine too.

Color me shocked...

Posted Jul 19, 2022 14:34 UTC (Tue) by mirabilos (subscriber, #84359) [Link] (3 responses)

> My question was about lynx not accepting the TLS certificate of
> web.archive.org

Huh? Works for me…

Color me shocked...

Posted Jul 20, 2022 0:55 UTC (Wed) by pabs (subscriber, #43278) [Link] (2 responses)

This is with the versions of lynx/GnuTLS in Debian bookworm, probably something changed that broke it.

Color me shocked...

Posted Jul 21, 2022 17:20 UTC (Thu) by mirabilos (subscriber, #84359) [Link] (1 responses)

Interesting. I just did this in a cowbuilder chroot (apt-get install lynx ca-certificates) and it works: lynx https://web.archive.org/web/20220717155444/https://mjg59....

Maybe your CA bundle has something disabled or so? Also, (non)gnuTLS tends to use the batch file /etc/ssl/certs/ca-certificates.crt instead of individual files like OpenSSL, which is generated, and I had cases where it was out of date. (The file in sid is 195453 bytes.)

Color me shocked...

Posted Jul 22, 2022 0:02 UTC (Fri) by pabs (subscriber, #43278) [Link]

Turns out the problem was caused by setting LYNX_CFG to an empty file, I guess the global config file in /etc is required for proper TLS support :)