All Jupiter Broadcasting Shows

Latest Episodes:

The Story Behind Self Hosted | Jupiter Extras 8 Aug 29, 2019

Show notes

Brent joins Alex and Chris to discuss the origins of Jupiter Broadcasting new selfhosted.show. It's a casual chat about a project in the making for two years, hit play and the drinks are on us.

Links:

Self Hosted - Subscribe — Get the latest episodes of Self Hosted automatically
Brunch with Brent: Meet Alex from Self Hosted
Brunch with Brent: A Chat with Chz Bacon
LinuxServer.io — We are a group of like minded enthusiasts from across the world who build and maintain the largest collection of Docker images on the web, and at our core are the principles behind Free and Open Source Software. Our primary goal is to provide easy-to-use and streamlined Docker images with clear and concise documentation.
The Perfect Media Server - 2019 Edition — Storage should be boring. Boring is reliable. Reliable means you don't lose data. And that's exactly what the MergerFS + Snapraid combo I first wrote about in 2016 has provided. A solid, boring and reliable way of storing multiple TBs of data with little fuss.
Smart RGB LED strips with Home Assistant — 2019 is the year I am taking back control of my smart devices by bringing as much 'smarts' back inside my LAN as possible. To do this I've recently been experimenting with Home Assistant which I have running in a docker container on my media server.
Thievery Corporation — Thievery Corporation performing live in the KEXP studio.
Home Automation with Linux that Doesn't Rely on the Cloud — Alex's talk at LinuxFest Northwest 2019.

In-Kernel TLS | BSD Now 313 Aug 28, 2019

Show notes

OpenBSD on 7th gen Thinkpad X1 Carbon, how to install FreeBSD on a MacBook, Kernel portion of in-kernel TLS (KTLS), Boot Environments on DragonflyBSD, Project Trident Updates, vBSDcon schedule, and more.

Headlines

OpenBSD on the Thinkpad X1 Carbon 7th Gen

Another year, another ThinkPad X1 Carbon, this time with a Dolby Atmos sound system and a smaller battery.
The seventh generation X1 Carbon isn't much different than the fifth and sixth generations. I opted for the non-vPro Core i5-8265U, 16Gb of RAM, a 512Gb NVMe SSD, and a matte non-touch WQHD display at ~300 nits. A brighter 500-nit 4k display is available, though early reports indicated it severely impacts battery life.
Gone are the microSD card slot on the back and 1mm of overall thickness (from 15.95mm to 14.95mm), but also 6Whr of battery (down to 51Whr) and a little bit of travel in the keyboard and TrackPoint buttons. I still very much like the feel of both of them, so kudos to Lenovo for not going too far down the Apple route of sacrificing performance and usability just for a thinner profile.
On my fifth generation X1 Carbon, I used a vinyl plotter to cut out stickers to cover the webcam, "X1 Carbon" branding from the bottom of the display, the power button LED, and the "ThinkPad" branding from the lower part of the keyboard deck.

See link for the rest of the article

How To Install FreeBSD On A MacBook 1,1 or 2,1

FreeBSD Setup For MacBook 1,1 and 2,1

FreeBSD with some additional setup can be installed on a MacBook 1,1 or 2,1. This article covers how to do so with FreeBSD 10-12.

Installing

FreeBSD can be installed as the only OS on your MacBook if desired. What you should have is:

A Mac OS X 10.4.6-10.7.5 installer. Unofficial versions modified for these MacBooks such as 10.8 also work.
A blank CD or DVD to burn the FreeBSD image to. Discs simply work best with these older MacBooks.
An ISO file of FreeBSD for x86. The AMD64 ISO does not boot due to the 32 bit EFI of these MacBooks.
Burn the ISO file to the blank CD or DVD. Once done, make sure it's in your MacBook and then power off the MacBook. Turn it on, and hold down the c key until the FreeBSD disc boots.
- See link for the rest of the guide

News Roundup

Patch for review: Kernel portion of in-kernel TLS (KTLS)

One of the projects I have been working on for the past several months in conjunction with several other folks is upstreaming work from Netflix to handle some aspects of Transport Layer Security (TLS) in the kernel. In particular, this lets a web server use sendfile() to send static content on HTTPS connections. There is a lot more detail in the review itself, so I will spare pasting a big wall of text here. However, I have posted the patch to add the kernel-side of KTLS for review at the URL below. KTLS also requires other patches to OpenSSL and nginx, but this review is only for the kernel bits. Patches and reviews for the other bits will follow later.

https://reviews.freebsd.org/D21277

DragonFly Boot Enviroments

This is a tool inspired by the beadm utility for FreeBSD/Illumos systems that creates and manages ZFS boot environments. This utility in contrast is written from the ground up in C, this should provide better performance, integration, and extensibility than the POSIX sh and awk script it was inspired by. During the time this project has been worked on, beadm has been superseded by bectl on FreeBSD. After hammering out some of the outstanding internal logic issues, I might look at providing a similar interface to the command as bectl.

See link for the rest of the details

Project Trident Updates

19.08 Available

This is a general package update to the CURRENT release repository based upon TrueOS 19.08.
Legacy boot ISO functional again
This update includes the FreeBSD fixes for the “vesa” graphics driver for legacy-boot systems. The system can once again be installed on legacy-boot systems.

PACKAGE CHANGES FROM 19.07-U1
- New Packages: 154
- Deleted Packages: 394
- Updated Packages: 4926
12-U3 Available

This is the third general package update to the STABLE release repository based upon TrueOS 12-Stable.

PACKAGE CHANGES FROM STABLE 12-U2
- New Packages: 105
- Deleted Packages: 386
- Updated Packages: 1046

vBSDcon

vBSDcon 2019 will return to the Hyatt Regency in Reston, VA on September 5-7 2019. ***

Beastie Bits

The next NYCBUG meeting will be Sept 4 @ 18:45

Feedback/Questions

Tom - Questions
Michael - dfbeadm
Bostjan - Questions

Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv

Self Hosted Secrets | LINUX Unplugged 316 Aug 27, 2019

Show notes

Safely host your own password database using totally open source software. We cover BitWarden, our top choice to solve this problem.

Plus we announce a new show we're super proud of, and chat with Dan Lynch from OggCamp.

Special Guests: Alan Pope, Alex Kretzschmar, Brent Gervais, Dan Lynch, and Ell Marquez.

Links:

low-memory-monitor: new project announcement — low-memory-monitor, as its name implies, monitors the amount of free physical memory on the system and will shoot off signals to interested user-space applications, usually session managers, or sandboxing helpers, when that memory runs low, making it possible for applications to shrink their memory footprints before it's too late either to recover a usable system, or avoid taking a performance hit.
Fedora Switching To The BFQ I/O Scheduler For Better Responsiveness & Throughput - Phoronix — Following Chromebooks switching to BFQ and other distributions weighing this I/O scheduler for better responsiveness while maintaining good throughput capabilities, beginning with Fedora 31 there will be BFQ used as well.
Pinebook Preorders — Public #Pinebook Pro pre-orders start in the morning PDT (California, USA Time) August 25. The NEXT pre-order window will be mid-September; so don't worry if you won't get a pre-order now, it won't be a long wait for the next pre-order window.
LINUX Unplugged - Blog - Summer Sprint 2019 — Working remotely certainly has its advantages and I love the ability to sit in the comfort of my own home doing work I’m passionate about. That being said, I think it’s equally important to spend time together in meat space. There really is nothing like looking across the table at your co-workers while you try to flush out new ideas, make important decisions, or just share a meal. Not to mention, Washington is beautiful this time of the year...
Subscribe to Self Hosted — Discover new software and hardware to get the best out of your network, control smart devices, and secure your data on cloud services. Self Hosted is a chat show between Chris and Alex two long-time "self hosters" who share their lessons and take you on the journey of their new ones.
Self Hosted Coming Soon — Self Hosted Teaser
OGGCAMP 19 - OggCamp 19 — We’re at The Manchester Conference Centre in the Pendulum Hotel near Picadilly Station the weekend of October 19th and 20th 2019.
Jupiter Extras — New ideas, great interviews, events, and other content you will love. We bring you the Extras.
Texas Cyber Summit — October 10th-12th, 2019 at the Grand Hyatt in San Antonion
Kyle Spearrin's GitHub
Behind the scenes with the Bitwarden password manager | Opensource.com — I've used password management tools for years. I became frustrated by the complexity and barrier to entry many of the existing solutions offered. There was also a lack of quality, open source solutions available. I thought things could be done better and that there was great value in doing so.
Install Bitwarden for Linux using the Snap Store | Snapcraft — Bitwarden is the easiest and safest way to store all of your logins and passwords while conveniently keeping them synced between all of your devices.
bitwarden/cli: The command line vault (Windows, macOS, & Linux). — The Bitwarden CLI is a powerful, full-featured command-line interface (CLI) tool to access and manage a Bitwarden vault. The CLI is written with TypeScript and Node.js and can be run on Windows, macOS, and Linux distributions.
bitwarden/mobile: The mobile app vault (iOS and Android). — The Bitwarden mobile application is written in C# with Xamarin Android, Xamarin iOS, and Xamarin Forms.
Bitwarden on F-Droid
‎Bitwarden Password Manager on the App Store
Bitwarden Password Manager - Apps on Google Play
Bitwarden—Linux Apps on Flathub
Import your data from LastPass | Bitwarden Help & Support
Why should I trust Bitwarden with my passwords? | Bitwarden Help & Support
What are organizations? | Bitwarden Help & Support
dani-garcia/bitwardenrs: Unofficial Bitwarden compatible server written in Rust — This is a Bitwarden server API implementation written in Rust compatible with upstream Bitwarden clients*, perfect for self-hosted deployment where running the official resource-heavy service might not be ideal.
Starting a Container · dani-garcia/bitwardenrs Wiki
Manage your passwords with Bitwarden and Podman - Fedora Magazine — You can also sync your passwords across devices if you have a cloud-based password manager like LastPass, 1Password, or Dashlane. Unfortunately, none of these products are open source. Luckily there are open source alternatives available.
Installing and deploying | Bitwarden Help & Support
Bitwarden Completes Third-party Security Audit - Bitwarden Blog
Wayland Buddies | LINUX Unplugged 315 : linuxunplugged — A lot of the "Wayland is really smooth" talk really means "Mutter is really smooth", since it's gnome-shell's compositor Mutter that has to implement everything which Xorg used to do.
aguinet/usbtop: usbtop is a top-like utility that shows an estimated instantaneous bandwidth on USB buses and devices.

Meet Alex from Self Hosted | Jupiter Extras 7 Aug 27, 2019

Show notes

Brent welcomes Alex into the podcast family and discusses his long journey from Apple to Red Hat, and London to Raleigh. Plus some tidbits about the new show he's co-hosting on Jupiter Broadcasting and spending time with the crew.

Self Hosted Coming Soon | Self Hosted 0 Aug 27, 2019

Show notes

A new show all about taking control of your data, hosting it your self, and taking advantage of the cloud when it's a good fit.

Join Alex and Chris on their journey through hosting all the things, building systems that last, and leverage the cloud smarter than the average bear.

Links:

Crystal Clear | Coder Radio 372 Aug 26, 2019

Show notes

We're back and going crazy about Crystal, a statically typed language that's as fast as C and as slick as ruby.

Plus an update on Rails 6, Intel's growing adoption of Rust, and the challenge of making breaking changes.

Links:

Feedback: Academia and Industry — Do either of you have any insights as to how the software development community would view someone with a math PhD, but no industry coding experience as a job applicant? Any advice would be appreciated.
Feedback: Absurd Abstractions — FYI about wanting interface in Python: they are called abstract base classes. Check out the standard library module, abc for that and collections.abc some useful predefined container interfaces.
Feedback: Breaking Changes — I developed a niche Python package that has some user following in the network security realm. I’m at a crossroads though as a change I want to make will subtly break scripts that worked in previous/current versions. The end result of my pending change is good for the project but I fear I’ll ruin the workflow of my users. Other than my github page I don’t know how to query/inform my users of this pending change. What should I do?
Ruby on Rails 6.0 Release Notes — Make Webpacker the default JavaScript compiler for Rails 6
Intel and Rust: the Future of Systems Programming: Josh Triplett — Hear about how Intel is working to bring Rust to full parity with C, building the future of systems programming.
Altruism Still Fuels the Web. Businesses Love to Exploit It | WIRED — The original well-meaning, geeky architects of the web believed that there was an abundance of altruism in human nature—and they were more correct on this count, it turns out, than many esteemed social philosophers were. But they were too optimistic in overlooking the possibility that corporations would exploit and colonize this new realm. If only we had all seen it coming.
The Crystal Programming Language — Crystal is statically type checked, so any type errors will be caught early by the compiler rather than fail on runtime. Moreover, and to keep the language clean, Crystal has built-in type inference, so most type annotations are unneeded.

Linux Action News 120 Aug 25, 2019

Show notes

More tools to keep your Linux box and cloud servers secure this week, OpenPOWER responds to Risc-V competition, and we ponder the year-long open-source supply chain attacks.

Plus our reaction to Android dropping dessert names, the Confidential Computing consortium, and more.

Links:

Today, 28 years ago Linus Torvalds announced Linux on comp.os.minix. — I'm doing a (free) operating system (just a hobby, won't be big and professional like gnu) for 386(486) AT clones.
System76 announce new firmware updater — We’ve been working on the Firmware Manager project, which we will be shipping to all Pop!_OS users, and System76 hardware customers on other Debian-based distributions. It supports checking and updating firmware from LVFS and system76-firmware services, is Wayland-compatible, and provides both a GTK application and library.
The Next Step in the OpenPOWER Foundation Journey — The OpenPOWER Foundation will now join projects and organizations like OpenBMC, CHIPS Alliance, OpenHPC and so many others within the Linux Foundation.
IBM is moving OpenPower Foundation to The Linux Foundation
Confidential Computing Consortium — Confidential computing focuses on securing data in use. Current approaches to securing data often address data at rest (storage) and in transit (network)but encrypting data in use is possibly the most challenging step to providing a fully encrypted lifecycle for sensitive data.
Confidential Computing Consortium Takes Shape
The year-long rash of supply chain attacks against open source is getting worse — Backdoors snuck into 12 OSS packages were downloaded hundreds of thousands of times.
Android to drop dessert names — So, this next release of Android will simply use the version number and be called Android 10. We think this change helps make release names simpler and more intuitive for our global community. And while there were many tempting “Q” desserts out there, we think that at version 10 and 2.5 billion active devices, it was time to make this change.

A Chat with Chz Bacon | Jupiter Extras 6 Aug 23, 2019

Show notes

A revealing conversation with Jupiter Broadcasting's designer Mr. Chz Bacon. We discuss his Linux roots, design philosophies, community involvement, and a lot more.

Epyc Encryption | TechSNAP 410 Aug 23, 2019

Show notes

It's CPU release season and we get excited about AMD's new line of server chips. Plus our take on AMD's approach to memory encryption, and our struggle to make sense of Intel's Comet Lake line.

Also, a few Windows worms you should know about, the end of the road for EV certs, and an embarrassing new Bluetooth attack.

Links:

A detailed look at AMD’s new Epyc “Rome” 7nm server CPUs | Ars Technica — The short version of the story is, Epyc "Rome" is to the server what Ryzen 3000 was to the desktop—bringing significantly improved IPC, more cores, and better thermal efficiency than either its current-generation Intel equivalents or its first-generation Epyc predecessors.
AMD Rome Second Generation EPYC Review: 2x 64-core Benchmarked — Ever since the Opteron days, AMD's market share has been rounded to zero percent, and with its first generation of EPYC processors using its new Zen microarchitecture, that number skipped up a small handful of points, but everyone has been waiting with bated breath for the second swing at the ball. AMD's Rome platform solves the concerns that first gen Naples had, plus this CPU family is designed to do many things: a new CPU microarchitecture on 7nm, offer up to 64 cores, offer 128 lanes of PCIe 4.0, offer 8 memory channels, and offer a unified memory architecture based on chiplets.
AMD EPYC Rome Still Conquering Cascadelake Even Without Mitigations - Phoronix — Out of curiosity, I've run some unmitigated benchmarks for the various relevant CPU speculative execution vulnerabilities on both the Intel Xeon Platinum 8280 Cascadelake and AMD EPYC 7742 Rome processors for seeing how the performance differs.
Intel’s line of notebook CPUs gets more confusing with 14nm Comet Lake | Ars Technica — Going by Intel's numbers, Comet Lake looks like a competent upgrade to its predecessor Whiskey Lake. The interesting question—and one largely left unanswered by Intel—is why the company has decided to launch a new line of 14nm notebook CPUs less than a month after launching Ice Lake, its first 10nm notebook CPUs.
A look at the Windows 10 exploit Google Zero disclosed this week | Ars Technica — On Tuesday, Tavis Ormandy of Google's Project Zero released an exploit kit called ctftool, which uses and abuses Microsoft's Text Services Framework in ways that can effectively get anyone root—er, system that is—on any unpatched Windows 10 system they're able to log in to
Patch new wormable vulnerabilities in Remote Desktop Services (CVE-2019-1181/1182) – Microsoft Security Response Center — Today Microsoft released a set of fixes for Remote Desktop Services that include two critical Remote Code Execution (RCE) vulnerabilities, CVE-2019-1181 and CVE-2019-1182. Like the previously-fixed ‘BlueKeep’ vulnerability (CVE-2019-0708), these two vulnerabilities are also ‘wormable’, meaning that any future malware that exploits these could propagate from vulnerable computer to vulnerable computer without user interaction.
KNOB Attack — TL;DR: The specification of Bluetooth includes an encryption key negotiation protocol that allows to negotiate encryption keys with 1 Byte of entropy without protecting the integrity of the negotiation process. A remote attacker can manipulate the entropy negotiation to let any standard compliant Bluetooth device negotiate encryption keys with 1 byte of entropy and then brute force the low entropy keys in real time.
Troy Hunt: Extended Validation Certificates are (Really, Really) Dead — With both browsers auto-updating for most people, we're about 10 weeks out from no more EV and the vast majority of web users no longer seeing something they didn't even know was there to begin with! Oh sure, you can still drill down into the certificate and see the entity name, but who's really going to do that? You and I, perhaps, but we're not exactly in the meat of the browser demographics.
Google wants to reduce lifespan for HTTPS certificates to one year | ZDNet — Scott Helme argues that the security benefits of shorter SSL certificate lifespans have nothing to do with phishing or malware sites, but instead with the SSL certificate revocation process. Helme claims that this process is broken and that bad SSL certificates continue to live on for years after being mississued and revoked.

The Enthusiast Trap - Office Hours with Chris | Jupiter Extras 5 Aug 22, 2019

Show notes

What is the enthusiast trap, and why does it seem to ensnare every successful open source project? Also, some excellent listener power user tips for NextCloud.

Links: