LINUX Unplugged

Latest Episodes:

576: The Secret Server Aug 18, 2024

Show notes

We reveal how we turned our humble LAN into a public server farm, all while keeping our IP address under wraps and our ISP blissfully unaware.

Sponsored By:

Core Contributor Membership: Take $1 a month of your membership for a lifetime!
Tailscale: Tailscale is a programmable networking software that is private and secure by default - get it free on up to 100 devices!
1Password Extended Access Management: 1Password Extended Access Management is a device trust solution for companies with Okta, and they ensure that if a device isn't trusted and secure, it can't log into your cloud apps.

Support LINUX Unplugged

Links:

💥 Gets Sats Quick and Easy with Strike
📻 LINUX Unplugged on Fountain.FM
Toronto Meetup — Thursday, Aug 29, 2024
Berlin with Brent — September Meetup @ Nextcloud Conference, Saturday, Sep 14, 2024
Check out Alex's "Building a Colo Server" video — Building a colo server for Jupiter Broadcasting using the 45Homelab HL15 server.
Firewall - NixOS Wiki
nftables wiki
The netfilter.org "nftables" project
Gentoo Nftables Examples
networking/nftables: add .tables property and disable ruleset flushing by default by mkg20001
Example nftables config
Olympia Mike on "verified only Flatpaks" — I'm curious your take on a recent update that happened in Linux Mint, and the possible knock on effect of it.
Incus is a next generation system container and virtual machine manager.
Incus - NixOS Wiki
Moving from Proxmox to Incus
Membership Summer Discount — Take $1 a month of your membership for a lifetime!
Referral Code eXchange
auto-tab-discard
tab-session-manager
OneTab extension for Google Chrome and Firefox
Tubular — A fork of NewPipe that implements SponsorBlock and ReturnYouTubeDislike.

575: Brent's Busted Builds Aug 11, 2024

Show notes

Brent's computer pulls an all-nighter at the worst possible moment, and the hits keep coming for open-source Android distributions and our new 2FA tool.

Sponsored By:

Support LINUX Unplugged

Links:

💥 Gets Sats Quick and Easy with Strike
📻 LINUX Unplugged on Fountain.FM
Toronto Meetup — Thursday, August 29, 2024 from 6:00 PM to 8:00 PM EDT
Sacramento LUG Meetup — Saturday September 7th, 2024 from 10:00 AM to 2:00 PM PDT
Anker PowerConf S330 USB Speakerphone
Corsair Void RGB Elite Wireless Premium Gaming Headset
Loss of popular 2FA tool puts security-minded GrapheneOS in a paradox
GrapheneOS on X — Google can either permit GrapheneOS in the Play Integrity API in the near future
GrapheneOS on X — If Authy insists on using it, they should use the standard Android hardware attestation API to permit using GrapheneOS too. Banning 250k+ people with the most secure smartphones from using your app is anti-security, not pro-security.
GrapheneOS on X — Authy simply delegated checking device integrity to Google. It's Google choosing to block GrapheneOS users from using Authy. Google chooses to allow using a device with no security patches for the past 8 years but bans using an OS much more secure than the stock Pixel OS.
Twilio kills off Authy for desktop, forcibly logs out all users
GrapheneOS on X — Our latest release with prevention for most VPN app DNS leaks is currently available in our Alpha and Beta channels. We need more feedback from testing VPN apps and services with leak blocking toggled on, which GrapheneOS already enables by default.
GrapheneOS on X — Our current approach to DNS leak blocking appears to work well without breaking compatibility. We've made progress towards fixing a related issue for some VPN apps where rare connections are made to VPN DNS outside of the tunnel. We can hopefully ship stricter enforcement soon.
GrapheneOS on X — We've become aware of another company selling devices with GrapheneOS while spreading harmful misinformation about it to promote insecure products. We're making our usual attempt at resolving things privately. However, we need to quickly address what has been claimed regardless.
Membership Summer Discount — Take $1 a month of your membership for a lifetime!
How You Guys Expect to Beat Me?
Blue Iris Container
netbird — Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.
netbird on GitHub
OpenZiti — Open Source Zero Trust Networking
OpenZiti on GitHub
Collapse OS — Bootstrap post-collapse technology
Docker-OSX — Run macOS VM in a Docker! Run near native OSX-KVM in Docker! X11 Forwarding! CI/CD for OS X Security Research! Docker mac Containers.

574: COSMIC Encounter Aug 04, 2024

Show notes

The COSMIC desktop is just around the corner. We get the inside scoop from System76 and go hands-on with an early press build.

Sponsored By:

Support LINUX Unplugged

Links:

💥 Gets Sats Quick and Easy with Strike
📻 LINUX Unplugged on Fountain.FM
System76 tips Fedora Cosmic spin for 2025 release with Fedora 42 — It looks like System76's exciting new Rust-based Cosmic DE will get an official Fedora spin in the upcoming Fedora 42, potentially giving Linux users with bleeding-edge hardware an official way to try Cosmic.
Pop!_OS Mattermost — An excellent place to engage if you want to bring COSMIC to a distro near you.
iced — A cross-platform GUI library for Rust
Smithay — A smithy for rusty wayland compositor
Testing COSMIC — The easiest way to test COSMIC DE currently is by building a systemd system extension.
Membership Summer Discount — Take $1 a month of your membership for a lifetime!
Portal:Kalpa - openSUSE Wiki — openSUSE MicroOS Desktop Gnome was renamed to openSUSE Aeon, and the Plasma Desktop version is being renamed to openSUSE Kalpa.
pop-os/kernelstub: A simple EFI boot manager manager for Linux
Alpaca — GTK App to Chat with local AI models
Alpaca on FlatHub

573: Universal Blue Man Group Jul 28, 2024

Show notes

Think Silverblue, but with cloud-native tooling used to build it. From Aurora to Bazzite, our impressions of the ambitious Universal Blue project.

Sponsored By:

Support LINUX Unplugged

Links:

💥 Gets Sats Quick and Easy with Strike
📻 LINUX Unplugged on Fountain.FM
Universal Blue — The Universal Blue project builds a diverse set of continuously delivered operating system images using Fedora Atomic Desktop's support for OCI/Docker containers.
Universal Blue Architecture Diagram
Aurora — Aurora is a clean and reliable desktop operating system for every type of user. Many batteries included.
Bluefin — Bluefin is a custom image of Fedora Silverblue offering the best of both worlds: The reliability and ease of use of a Chromebook and the power of a GNOME desktop.
Bazzite — The next generation of Linux Gaming for all of your devices - including your favorite handheld.
uCore — An OCI base image of Fedora CoreOS with batteries included; a lightweight server image including most used services or the building blocks to host them.
Bazzite Desktop Environment Tweaks - Bazzite - Docs - Universal Blue
Installing and Managing AppImages on Bazzite - Bazzite - Docs - Universal Blue
Universal Blue Contributing Guide
Jazz up your Bluefin command line with some bling! [YouTube]
Jorge Castro on YouTube
Membership Summer Discount — Take $1 a month of your membership for a lifetime!
zap.store — a permissionless app store.
Asking AI To Make A Caveman Rock Song - Me Like Rock
winapps — Run Windows applications (including Microsoft 365 and Adobe Creative Cloud) on GNU/Linux with KDE, GNOME or XFCE, integrated seamlessly as if they were native to the OS.
The Mooltipass Hardware Authenticator — A Simple Hardware Authenticator
ptyxis — Ptyxis is a terminal for GNOME with first-class support for containers.
Gearlever — Manage AppImages with ease 📦

572: Data Security Only a Maniac Could Love Jul 21, 2024

Show notes

Wes' self-decrypting bcachefs disk and a GrapheneOS twist that'll make you ditch your iPhone.

Sponsored By:

Support LINUX Unplugged

Links:

💥 Gets Sats Quick and Easy with Strike
📻 LINUX Unplugged on Fountain.FM
clevis — Clevis is a pluggable framework for automated decryption. It can be used to provide automated decryption of data or even automated unlocking of LUKS volumes.
bcachefs Encryption
What measured boot and trusted boot means for Linux
Automatically decrypt your disk using TPM2 — Entering the passphrase to decrypt the disk at boot can become quite tedious. On modern systems a secure hardware chip called “TPM” (Trusted Platform Module) can store a secret and automatically decrypt your disk. This is an alternative factor, not a second factor. Keep that in mind.
Use systemd-cryptenroll with FIDO U2F or TPM2 to decrypt your disk
Automatic LUKS 2 disk decryption with TPM 2 on Fedora
Safe automatic decryption of LUKS partition using TPM2 | 221b
FOSDEM 2024: Clevis/Tang - unattended boot of an encrypted NixOS system
Clevis & Tang on NixOS Slides
Decrypt LUKS volumes with a TPM on Fedora Linux
Self-Hosted 127: Can't Fix What You Don't Track
Garmin Forerunner 265 — Forerunner 265 is a running smartwatch with a touchscreen AMOLED display, training metrics, phone-free music, & up to 13 days of battery life in smartwatch
HRV Status
Garmin Sleep Tracking
Nap Detection
Garmin Pay
Tribit Stormbox Micro 2 Wireless Portable Speaker: 10W
USB-C Charging Converter for Garmin Watch Without Charger Cable
Obtainium — Obtainium allows you to install and update apps directly from their releases pages, and receive notifications when new releases are made available.
Managing your personal access tokens
Membership Summer Discount — Take $1 a month of your membership for a lifetime!
Iotas — Iotas aims to provide distraction-free note taking with optional speedy sync with Nextcloud Notes.
LINUX Unplugged 567: So Long sudo
Celeste — GUI file synchronization client that can sync with any cloud provider
vt52's Blog: Migrating from NixOS channels to Flakes
FUTO Keyboard
autossh
LINUX Unplugged 570: RegreSSHion Strikes
Aeon — The Linux Desktop for people who want to "get stuff done"
Aeon: openSUSE for lazy developers
Grayjay — Follow Creators Not Platforms
Grayjay on GitLab
CrowdSec
Bustle — Bustle draws sequence diagrams of D-Bus activity. It shows signal emissions, method calls and their corresponding returns, with time stamps for each individual event and the duration of each method call. This can help you check for unwanted D-Bus traffic, and pinpoint why your D-Bus-based application is not performing as well as you like. It also provides statistics like signal frequencies and average method call times.
open-and-shut — Type in Morse code by repeatedly slamming your laptop shut

571: Multi-Machine Lifestyle Jul 14, 2024

Show notes

Wes reports from the Skunkworks lab, and Brent tells us about his new computing lifestyle.

Sponsored By:

Support LINUX Unplugged

Links:

💥 Gets Sats Quick and Easy with Strike
📻 LINUX Unplugged on Fountain.FM
Nix Nerds Matrix Room
Beelink SER5 Mini PC
Minisforum UM690 Pro
pyenv-flake: experimental nix flake that can build pyenv pythons
dotenvx-flake: A nix flake for dotenvx
auto-patchelf.sh - NixOS/nixpkgs
Packaging/Binaries - NixOS Wiki
Membership Summer Discount — Take $1 a month of your membership for a lifetime!
Try the JB Test Gathio Instance hosted by HybridSarcasm
Berlin with Brent: September Meetup at Nextcloud Conference · JB Events
Fix Kate sudo saves - use Plasma 6 version of Kate by MarkSort · Pull Request #3 · ChrisLAS/nix
Running OpenBSD 7.5 on your laptop is really hard (not) — I couldn't use OpenBSD exclusively; there's software that I need/want which isn't available. But I do appreciate certain of OpenBSD's qualities: it's a simple, ultra-lightweight, traditional UNIX. I have an ancient ThinkPad running OpenBSD configured as a minimalist desktop: it's nice for focused work. Sure, it can't run Steam or play Netflix, but sometimes that's a plus...
@fabean's NixOS configs
IBM Classroom LAN Administration System V 1.30 User Guide
0xchat: Secure chat built on Nostr
Get NIP-05 verified
Pick: termscp — 🖥 A feature rich terminal UI file transfer and explorer with support for SCP/SFTP/FTP/S3/SMB
Learn Nix The Fun Way — Sure, it’s sort of portable, if you tell the person running it to have curl and jq. What if you relied on a specific version of either though? Nix guarantees portability.

570: RegreSSHion Strikes Jul 07, 2024

Show notes

We dig into the RegreSSHion bug, debate it's real threat and explore clever tools to build a tasty fried onion around your system.

Sponsored By:

Support LINUX Unplugged

Links:

💥 Gets Sats Quick and Easy with Strike
📻 LINUX Unplugged on Fountain.FM
Spokane Meetup - No-Li Brewhouse · JB Events on Gathio
Plasma/Krunner Docs — Brent's tip: 'https://search.nixos.org/options?query=\{@}' (the '\{@}' is the magic sauce)
autossh — Automatically restart SSH sessions and tunnels
autossh on GitHub
Spokane Meetup — No-Li Brewhouse, Sat, Jul 13, 2024, 4:00 PM
RegreSSHion — Remote Code Execution Vulnerability In OpenSSH Server
regreSSHion — Remote Unauthenticated Code Execution Vulnerability in OpenSSH server.
NixOS Security advisory: OpenSSH CVE-2024-6387 “regreSSHion” – update your servers ASAP
Nasty regreSSHion bug affects around 700K Linux systems
Qualys CVE-2024-6387 Write-up
Letmein: Authenticating port knocker - Written in Rust — Letmein is a simple port knocker with a simple and secure authentication mechanism. It can be used to harden against pre-authentication attacks on services like SSH, VPN, IMAP and many more.
fwknop: Single Packet Authorization > Port Knocking — fwknop stands for the "FireWall KNock OPerator", and implements an authorization scheme called Single Packet Authorization (SPA). This method of authorization is based around a default-drop packet filter
Membership Summer Discount — Take $1 a month of your membership for a lifetime!
Jeff links: How to run non-nix executables?
pick: stu — TUI (Terminal/Text UI) application for AWS S3

569: Our Plasma Panacea Jun 30, 2024

Show notes

Why we think Plasma 6.1 is the desktop for people who like to mess with computers.

Sponsored By:

Support LINUX Unplugged

Links:

💥 Gets Sats Quick and Easy with Strike
📻 LINUX Unplugged on Fountain.FM
Marknote - KDE Applications
Marknote 1.3 - KDE Blogs — Marknote lets you create rich text notes and easily organise them into notebooks. You can personalise your notebooks by choosing an icon and accent color for each one, making it easy to distinguish between them and keep your notes at your fingertips. Your notes are saved as Markdown files in your Documents folder, making it easy to use your notes outside of Marknote as well as inside the app.
Spokane Meetup - No-Li Brewhouse, Sat, Jul 13, 2024, 4:00 PM
No-Li Brewhouse Menu
10 best beer gardens in the US where you can quench your thirst
KDE Plasma 6.1 Desktop Environment Officially Released, Here's What's New
Plasma 6.1 - KDE Community — This release introduces explicit GPU synchronization support for NVIDIA users and triple buffering support on Wayland for smoother animations.
KDE Plasma 6.1.1 Desktop Environment Released with Various Bug Fixes
LUP 552 — Plasma 6 is out, and we've been giving it a go. What's new, our thoughts, and the lessons other desktops should learn.
KDE Plasma 6.1 Performing Much Better On Older Intel Integrated Graphics
Fixing KWin's performance on old hardware
plasma6-desktop package versions
plasma-desktop package versions
KRdp on GitLab — Currently, the main client that has been used for testing and is confirmed to work is the FreeRDP client.
Open KRdp Bugs
appiumtests: test adaptive panel opacity (!2324) · Merge requests · Plasma / Plasma Desktop · GitLab
Why the next GNOME Release will be one of the Best Ever
Membership Summer Discount — Take $1 a month of your membership for a lifetime!
Gathio
JB Events Gathio hosted by HybridSarcasm
GitHub Issue: Can't create events — An unexpected error has occurred. Please try again later.
Crossover: Run Microsoft Windows software on Mac and Linux | CodeWeavers
FUTO Keyboard — Your keyboard shouldn't connect to the internet.
FUTO Keyboard · Wiki

568: All Your Silos are Broken Jun 23, 2024

Show notes

Online identity is a ticking time bomb. Are trustworthy, open-source solutions ready to disarm it? Or will we be stuck with lackluster, proprietary systems?

Sponsored By:

Support LINUX Unplugged

Links:

💥 Gets Sats Quick and Easy with Strike
📻 LINUX Unplugged on Fountain.FM
Jupiter Broadcasting Meetups
XZ Utils Backdoor Vulnerability (CVE-2024-3094): Comprehensive Guide
The Mystery of ‘Jia Tan,’ the XZ Backdoor Mastermind
Who is ‘Jia Tan,’ the coder behind the XZ Utils Linux backdoor?
Reflections on Distrusting xz
The Linux kernel does not accept anonymous contributions due to legal reasons. — The Linux kernel does not accept anonymous contributions due to legal reasons.
Kernel.org Docs on contributions — It is imperative that all code contributed to the kernel be legitimately free software.
Elon Musk wants to ‘authenticate all real humans’ on Twitter.
Elon Musk claims alien identity, links human brain function to AI purpose
Elon Musk Finally Realizes That Verification Requires More Than A Credit Card, Planning To Make Users Upload Gov’t ID
Elon Musk can show the world how to really do ID
World ID
Nostr: All Your Silos Are Broken
Nostr Iceberg Meme
NIP-01
Mapping Nostr keys to DNS-based internet identifiers
Navigating the social graph — In this paper, you will find a definition of the social graph, principles for thinking about it, and practical ideas for using it for DoS prevention, social discovery, anti-impersonation, accurate ratings, and more.
Highlighter — Highlighter is like Substack & Patreon but on Nostr.
Satlantis — Satlantis is like Trip Advisor, meets Instagram and Google Places.
HiveTalk — Free Video Calls, Messaging and Screen Sharing
zap.stream — Twitch alt powered by value for value and Nostr
ostrGit — A truly censorship-resistant alternative to GitHub that has a chance of working.
Blogstack — Write decentralized blogs over relay using nostr w/ ⚡ lightning tips.
Ditto — Ditto is a Nostr community server. It has a built-in Nostr relay, a web UI, and it implements Mastodon's REST API.
UseNostr
awesome-nostr
Decentralized publishing for the web
Nostr Apps
Nosta — New to Nostr? You're in the right place. Here you can easily set up your profile, discover apps, and browse other profiles.
Amethyst
amethyst: Nostr client for Android
yana
Primal App
Dan's Nostr Relay
Membership Summer Discount — Take $1 a month of your membership for a lifetime!
SpeechNote — Speech Note let you take, read and translate notes in multiple languages. It uses Speech to Text, Text to Speech and Machine Translation to do so.
rhasspy/piper: — A fast, local neural text to speech system.
Starship — The minimal, blazing-fast, and infinitely customizable prompt for any shell!
starship on GitHub
ZSH Docs: ZDOTDIR
distrobox-assemble — distrobox-assemble takes care of creating or destroying containers in batches, based on a manifest file.
Pick: Gathio — Gathio is a simple, federated, privacy-first event hosting platform.

567: So Long sudo Jun 16, 2024

Show notes

Your Linux box is a-changin'. systemd has a huge new release; we'll get into the most impressive features, including the new sudo replacement. Plus, our thoughts on the new Linux Arm laptops that are just around the corner.

Sponsored By:

Support LINUX Unplugged

Links:

💥 Gets Sats Quick and Easy with Strike
📻 LINUX Unplugged on Fountain.FM
Announcing systemd v256 — In the weeks leading up to this release I have posted a series of serieses of posts to Mastodon about key new features in this release.
systemd changes with v2⁸:
systemd 256 Released With run0, systemd-vpick, importctl & Other New Features
Lennart on systemd-vpick — Basically, you can now place multiple versions of the same resource in some dir of your choice, suffix that dir's name with .v/ and the you get some basic version management in place: delete or add new versions by just removing/adding new files, and the tools will find the newest item dropped in automatically.
Introduction to Portable Services — “Portable services” do not provide a fully isolated environment to the payload, like containers mostly intend to. Instead, they are more like regular system services, can be controlled with the same tools, are exposed the same way in all infrastructure, and so on. The main difference is that they use a different root directory than the rest of the system.
Trying out systemd's Portable Services — All in all, the core pieces are already in place for a very promising new technology that should make it easier for 3rd parties to provide Linux system-level software in a safe and convenient way, well done to the systemd team for a well executed concept. All it lacks is some polish around the tooling and integration.
systemd sleep — Putting a PC to sleep is complicated business and there are different mechanisms available to achieve this on Linux.
Lennart on SSH and AF_VSOCK — This automatic ssh-via-AF_VSOCK logic is particularly useful
DDIs and systemd-nspawn — Or in other words: there's now unprivileged systemd-npsawn containers. Yay!
Lennart on systemd-vmspawn
Lennart on sd_notify
Lennart on dlopen
Lennart on run0 — There's a new tool in systemd, called run0. Or actually, it's not a new tool, it's actually the long existing tool systemd-run, but when invoked under the run0 name (via a symlink) it behaves a lot like a sudo clone. But with one key difference: it's not in fact SUID.
doas - dedicated openbsd application subexecutor
Doas - NixOS Wiki
Doas on Wikipedia
The Tragedy of systemd — Join me on a journey through the bootstrap process, the history of init, the reasons why change can be scary, and the discovery of a part of your OS you may not even know existed.
The Two Year Journey Funded By Arm/Qualcomm For Improving ARM Linux Laptop Support — ARM Kernel developers spent the last two years working on improving ARM Linux laptop support with a focus on the Lenovo ThinkPad X13s powered by a Qualcomm SoC.
Ubuntu 24.04 LTS support to the Lenovo ThinkPad x13s
Snapdragon 8cx
Ubuntu Asahi project
TUXEDO Working on Snapdragon X Elite Linux Laptop
Membership Summer Discount — Take $1 a month of your membership for a lifetime!
Spokane Meetup, Sat, Jul 13, 2024, 4:00 PM
Berlin with Brent: September Meetup @ Nextcloud Conference, Fri, Sep 13, 2024 | Meetup
A Nix Flake for Bitfocus Companion
ChrisLAS' Beelink NixOS Config
Bluetooth - NixOS Wiki
nix-direnv
xscreensaver on Android
Rainier cherry - Wikipedia
Pick: Iotas — Markdown notes that syncs with NextCloud Notes.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected