Was one of you able to solve (i.e. permanently) the fact that Mate calculator is/was not providing currencies conversion as it was before ?
i.e. without having to download the link to database each time (which is cumbersome… better go with a web based FX page (like XE) instead.
Actually, I believe @Watford is talking about the problem for which he had opened the following discussion topic, in the “Ubuntu MATE Community”, about a year go (on 23rd February 2025):
Thanks. Here’s my workaround by putting this at the end of $HOME/.profile :
# wait 4 minutes after login
sleep 240 &&
# Check if there is an internet connection
if (wget -q --spider http://google.com); then
# workaround for currency update
wget -q "http://www.imf.org/external/np/fin/data/rms_five.aspx?tsvflag=Y" -O "$HOME/.cache/mate-calc/rms_five.xls"
wget -q "http://www.ecb.europa.eu/stats/eurofxref/eurofxref-daily.xml" -O >"$HOME/.cache/mate-calc/eurofxref-daily.xml"
fi
And @Watford apparently was so happy with that (nice) workaround, that he closed the issue himself, on that same day (15th June 2025)!
So, @Watford, let me humbly suggest that you comment again, on that same issue in “GitHub”, and explain that - while the workaround that nazarux has provided does work and is nice and is appreciated - you’re reopening the issue to kindly ask that the “MATE Calculator” developers fix the underlying problem.
I will need to look at that to see if I can avoid rebuilding my own iptables firewall and IP-blocklist scripts, which I will need to do sometime this year given the industry move to nftables.
iptables (and nftables for that matter) works at most on protocol level and can not see which application uses that protocol.
That means that you can, for instance, block certain protocols, IP-addresses and ports, but you can not block applications individually.
opensnitch is an application level firewall.
It can not do what iptables can do, but it can block applications from networking based on their identity (name/path whatever)
Application firewalls are reasonably new (and hard to find) for Linux although for MS-Windows there were several for many decades. (I used ‘outpost’ in my (hated) windows years and that was 25 years ago).
Even the standard windows-10 firewall can filter based on application and asks you permission if a new application wants to use the network. It keeps a whitelist for allowed applications.
It turns out that the architecture of UNIX derivatives is actually not suitable to accommodate application firewalls, so it is quite a challenge to design one.
I only know of two attempts to create an application firewall for Linux.
Those are Douane! and Open Snitch(github)
It turns out that opensnitch is in the standard repository of Ubuntu
So I immediately installed it and it works like a charm.
I’m a happy camper since
But wouldn’t it be possible to set up a password Group that controls internet access for applications, and only allow applications that are member of that group to have access to the internet, using the appropriate rule of course?
On the commercial side, there was a company called Trustifier Inc. which had built and deployed a Kernel Security System, basically a wrapper intercepting all Linux Kernel calls and passing them thru a customized security filter which encompassed
person-based
position-based
role-based
location-based, and
customized rule-based
privilege assignment, escalation, demotion or rejection.
I know for a fact that it had passed US DOD testing (which also considered it for their “Army of One” program, circa 2007-2008) during which it was subjected to RED-Team attacks, which all failed. I can’t remember whether that involved a Honeypot setup as well, and whether the RED-Team was able to discern, or not, that it was a honeypot.
It kind of disappeared after that, with the company folding, so I don’t know what happened to the technology. Given the above results, we can make a conjecture as to what happened.
BTW, if you are ever trying to identify if any particular systems have been Certified agains Common Criteria Protection Profiles (PPs, TOEs, EALs), you can perform a seach on their website here:
‘No’ because:
It means; creating a ‘network’ user that owns all network capable applications with permission 550.
If you are added to the group, that means that you, including everything you start, will have network permission, so that won’t work out as planned.
You’l have to ‘su network’ which opens another can of worms.
‘In a way’ because:
An orthogonal permission system is doable on a server for packets that are not part of the repositories. I’ve done that for a server application I wrote, the application worked under its own useraccount with very very strict permissions and was started by the system (not by me) using su
(b.t.w. If you look at the ‘users’ in /etc/passwd you can see that this idea of giving applications their own useraccount is being used in some form or another for some daemons.)
EDIT: SE-Linux and AppArmor can do the job because they manage capabilities of applications. In the past months we’ve seen many bugreports of applications not running or doing their job because their AppArlor settings were not properly set.