Secret moments from the show you've never heard before. We kick off with some hardware hurdles, then dive into the news and share a few surprising stories.

Sponsored By:

• Core Contributor Membership: Take $1 a month of your membership for a lifetime!
• Tailscale: Tailscale is a programmable networking software that is private and secure by default - get it free on up to 100 devices!

Support LINUX Unplugged

Links:

• 💥 Gets Sats Quick and Easy with Strike
• 📻 LINUX Unplugged on Fountain.FM

Rust meets Linux in a clash of coding cultures. Why some developers are resisting, and where things go from here.

Sponsored By:

• Core Contributor Membership: Take $1 a month of your membership for a lifetime!
• Tailscale: Tailscale is a programmable networking software that is private and secure by default - get it free on up to 100 devices!

Support LINUX Unplugged

Links:

• 💥 Gets Sats Quick and Easy with Strike
• 📻 LINUX Unplugged on Fountain.FM
• Berlin with Brent: September Meetup @ Nextcloud Conference, Sat, Sep 14, 2024
• Berlin Buds on Matrix
• Linus Torvalds talks AI, Rust adoption, and why the Linux kernel is 'the only thing that matters'
• KubeCon + CloudNativeCon + Open Source Summit + AI_Dev China 2024
• Rust for filesystems — At the 2024 Linux Storage, Filesystem, Memory Management, and BPF Summit, Wedson Almeida Filho and Kent Overstreet led a combined storage and filesystem session on using Rust for Linux filesystems.
• Filesystem in Rust - Kent Overstreet and Wedson Almeida Filho
• Asahi Lina: "I think people really don't appreciate just how incomplete Linux kernel API docs are, and how Rust solves part of the problem."
• One Of The Rust Linux Kernel Maintainers Steps Down - Cites "Nontechnical Nonsense" — One of the several Rust for Linux kernel maintainers has decided to step away from the project. The move is being driven at least in part due to having to deal with increased "nontechnical nonsense" raised around Rust programming language use within the Linux kernel.
• [PATCH 0/1] Retiring from the Rust for Linux project - Wedson Almeida Filho
• On Rust, Linux, developers, maintainers — There's been a couple of mentions of Rust4Linux in the past week or two, one from Linus on the speed of engagement and one about Wedson departing the project due to non-technical concerns. This got me thinking about project phases and developer types.
• The revival of the Linux C++ discussion
• Membership Summer Discount — Take $1 a month of your membership for a lifetime!
• Thank you Core Contributors
• BrewHouse by the Lake – Amsterdam Brewery Shop
• BITCOIN WELL — The fastest and safest way to buy bitcoin in Canada
• The new JB server - KTZ systems — Join Alex, Chris, and Brent as we fly to Toronto to deploy our shiny new colo server in Canada. We'll be deploying the 45homelab HL15 server.
• Projectivy Launcher
• Aerial Views Screensaver
• OpenEBS — OpenEBS is a modern Block-Mode storage platform, a Hyper-Converged software Storage System and virtual NVMe-oF SAN (vSAN) Fabric that is natively integrates into the core of Kubernetes.
• oppy1984's Satoshi Survey
• Coder Radio 582
• Keybase Filesystem Storage Limits
• I Don't Care for Gnome
• DAVx5 — DAVx⁵ DAVx⁵ – CalDAV / CardDAV / WebDAV for Android
• Flock 2024 Universal Blue: Building the Future using Fedora Atomic
• Pick: Shotcut - New Version 24.08
• Install Shotcut on Flathub — Shotcut supports many video, audio, and image formats via FFmpeg and screen, webcam, and audio capture. It uses a time-line for non-linear video editing of multiple tracks that may be composed of various file formats. Scrubbing and transport control are assisted by OpenGL GPU-based processing and a number of video and audio filters are available.
• Bonus Pick: Butler — Access your Home Assistant dashboard from a native companion UI, integrating better with your OS.
• Butler on GitHub
• Rust for Linux revisited
• Redox OS — Redox is a Unix-like general-purpose microkernel-based operating system written in Rust, aiming to bring the innovations of Rust to a modern microkernel, a full set of programs and be a complete alternative to Linux and BSD.

Sixty vulnerabilities and exposures disclosed in one week sounds like a lot. We'll explain why it's just business as usual.

Sponsored By:

• Core Contributor Membership: Take $1 a month of your membership for a lifetime!
• Tailscale: Tailscale is a programmable networking software that is private and secure by default - get it free on up to 100 devices!

Support LINUX Unplugged

Links:

• 💥 Gets Sats Quick and Easy with Strike
• 📻 LINUX Unplugged on Fountain.FM
• Toronto Meetup — Thursday, Aug 29, 2024
• Berlin with Brent — September Meetup @ Nextcloud Conference, Saturday, Sep 14, 2024
• Check out Alex’s “Building a Colo Server” video
• Microsoft’s latest security update has ruined dual-boot Windows and Linux PCs — The cause: an update Microsoft issued as part of its monthly patch release. It was intended to close a 2-year-old vulnerability in GRUB, an open source boot loader used to start up many Linux devices.
• What the f*** is an SBAT and why does everyone suddenly care — This update was not supposed to apply to dual-boot systems, but did anyway.
• SBAT Revocations: Boot Process - Ubuntu Community Hub
• “Something has gone seriously wrong,” dual-boot systems warn after Microsoft update
• Ubuntu Will Be Skipping Non-Critical Linux Kernel Updates For September - Phoronix
• SRU Mailing List Annoucement
• Canonical Moves To Shipping Very Latest Upstream Kernel Code For Ubuntu Releases
• Kernel Version Selection for Ubuntu Releases - Kernel - Ubuntu Community Hub
• Linus Torvalds Begins Expressing Regrets Merging Bcachefs — The bcachefs patches have become these kinds of "lots of development during the release cycles rather than before it", to the point where I'm starting to regret merging bcachefs.
• Re: [GIT PULL] bcachefs fixes for 6.11-rc5 - Linus Torvalds — No one is being jerks here, Linus and I are just sitting in different places with different perspectives. He has a resonsibility as someone managing a huge project to enforce rules as he sees best, while I have a responsibility to support users with working code, and to do that to the best of my abilities.
• LINUX Unplugged 545: 3,062 Days Later — Kent Overstreet, the creator of bcachefs, helps us understand where his new filesystem fits, what it's like to upstream a new filesystem, and how they've solved the RAID write hole.
• Linux is a CNA — As was recently announced, the Linux kernel project has been accepted as a CNA as a CVE Numbering Authority (CNA) for vulnerabilities found in Linux.
• The Linux security team issues 60 CVEs a week, but don't stress. Do this instead
• What is a "good" Linux Kernel bug?
• Keynote: Linux Kernel Security Demystified - Greg Kroah-Hartman - YouTube
• Membership Summer Discount — Take $1 a month of your membership for a lifetime!
• added pihole nix module by Tdback · Pull Request #3 · JupiterBroadcasting/nixconfigs — Recently, I wanted to start 'nixifying' some of my docker-compose setup. I've created a simple module for spinning up a podman container running pihole as a systemd service, so that way I can just stick it on any NixOS machine and easily make it my DNS server.
• NetworkManager cli (nmci) wrapper to easily create a new network connection
• Distrohopper Wheel
• No idea where to distrohop next? Let the ultimate distrohopper decide for you!
• Proxmox Virtual Environment - NixOS Wiki
• Pick: SaunaFS is a distributed file system — A robust distributed POSIX file system meticulously designed to revolutionize your storage solutions by offering unmatched efficiency, security, and redundancy. At its core, SaunaFS is a distributed file system primarily written in C++, inspired by the pioneering concepts introduced by Google File System.
• Google File System - Wikipedia
• saunafs/INSTALL.md

We reveal how we turned our humble LAN into a public server farm, all while keeping our IP address under wraps and our ISP blissfully unaware.

Sponsored By:

• Core Contributor Membership: Take $1 a month of your membership for a lifetime!
• Tailscale: Tailscale is a programmable networking software that is private and secure by default - get it free on up to 100 devices!

Support LINUX Unplugged

Links:

• 💥 Gets Sats Quick and Easy with Strike
• 📻 LINUX Unplugged on Fountain.FM
• Toronto Meetup — Thursday, Aug 29, 2024
• Berlin with Brent — September Meetup @ Nextcloud Conference, Saturday, Sep 14, 2024
• Check out Alex's "Building a Colo Server" video — Building a colo server for Jupiter Broadcasting using the 45Homelab HL15 server.
• Firewall - NixOS Wiki
• nftables wiki
• The netfilter.org "nftables" project
• Gentoo Nftables Examples
• networking/nftables: add .tables property and disable ruleset flushing by default by mkg20001
• Example nftables config
• Olympia Mike on "verified only Flatpaks" — I'm curious your take on a recent update that happened in Linux Mint, and the possible knock on effect of it.
• Incus is a next generation system container and virtual machine manager.
• Incus - NixOS Wiki
• Moving from Proxmox to Incus
• Membership Summer Discount — Take $1 a month of your membership for a lifetime!
• Referral Code eXchange
• auto-tab-discard
• tab-session-manager
• OneTab extension for Google Chrome and Firefox
• Tubular — A fork of NewPipe that implements SponsorBlock and ReturnYouTubeDislike.

Brent's computer pulls an all-nighter at the worst possible moment, and the hits keep coming for open-source Android distributions and our new 2FA tool.

Sponsored By:

• Core Contributor Membership: Take $1 a month of your membership for a lifetime!
• Tailscale: Tailscale is a programmable networking software that is private and secure by default - get it free on up to 100 devices!

Support LINUX Unplugged

Links:

• 💥 Gets Sats Quick and Easy with Strike
• 📻 LINUX Unplugged on Fountain.FM
• Toronto Meetup — Thursday, August 29, 2024 from 6:00 PM to 8:00 PM EDT
• Sacramento LUG Meetup — Saturday September 7th, 2024 from 10:00 AM to 2:00 PM PDT
• Anker PowerConf S330 USB Speakerphone
• Corsair Void RGB Elite Wireless Premium Gaming Headset
• Loss of popular 2FA tool puts security-minded GrapheneOS in a paradox
• GrapheneOS on X — Google can either permit GrapheneOS in the Play Integrity API in the near future
• GrapheneOS on X — If Authy insists on using it, they should use the standard Android hardware attestation API to permit using GrapheneOS too. Banning 250k+ people with the most secure smartphones from using your app is anti-security, not pro-security.
• GrapheneOS on X — Authy simply delegated checking device integrity to Google. It's Google choosing to block GrapheneOS users from using Authy. Google chooses to allow using a device with no security patches for the past 8 years but bans using an OS much more secure than the stock Pixel OS.
• Twilio kills off Authy for desktop, forcibly logs out all users
• GrapheneOS on X — Our latest release with prevention for most VPN app DNS leaks is currently available in our Alpha and Beta channels. We need more feedback from testing VPN apps and services with leak blocking toggled on, which GrapheneOS already enables by default.
• GrapheneOS on X — Our current approach to DNS leak blocking appears to work well without breaking compatibility. We've made progress towards fixing a related issue for some VPN apps where rare connections are made to VPN DNS outside of the tunnel. We can hopefully ship stricter enforcement soon.
• GrapheneOS on X — We've become aware of another company selling devices with GrapheneOS while spreading harmful misinformation about it to promote insecure products. We're making our usual attempt at resolving things privately. However, we need to quickly address what has been claimed regardless.
• Membership Summer Discount — Take $1 a month of your membership for a lifetime!
• How You Guys Expect to Beat Me?
• Blue Iris Container
• netbird — Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.
• netbird on GitHub
• OpenZiti — Open Source Zero Trust Networking
• OpenZiti on GitHub
• Collapse OS — Bootstrap post-collapse technology
• Docker-OSX — Run macOS VM in a Docker! Run near native OSX-KVM in Docker! X11 Forwarding! CI/CD for OS X Security Research! Docker mac Containers.

The COSMIC desktop is just around the corner. We get the inside scoop from System76 and go hands-on with an early press build.

Sponsored By:

• Core Contributor Membership: Take $1 a month of your membership for a lifetime!
• Tailscale: Tailscale is a programmable networking software that is private and secure by default - get it free on up to 100 devices!

Support LINUX Unplugged

Links:

• 💥 Gets Sats Quick and Easy with Strike
• 📻 LINUX Unplugged on Fountain.FM
• System76 tips Fedora Cosmic spin for 2025 release with Fedora 42 — It looks like System76's exciting new Rust-based Cosmic DE will get an official Fedora spin in the upcoming Fedora 42, potentially giving Linux users with bleeding-edge hardware an official way to try Cosmic.
• Pop!_OS Mattermost — An excellent place to engage if you want to bring COSMIC to a distro near you.
• iced — A cross-platform GUI library for Rust
• Smithay — A smithy for rusty wayland compositor
• Testing COSMIC — The easiest way to test COSMIC DE currently is by building a systemd system extension.
• Membership Summer Discount — Take $1 a month of your membership for a lifetime!
• Portal:Kalpa - openSUSE Wiki — openSUSE MicroOS Desktop Gnome was renamed to openSUSE Aeon, and the Plasma Desktop version is being renamed to openSUSE Kalpa.
• pop-os/kernelstub: A simple EFI boot manager manager for Linux
• Alpaca — GTK App to Chat with local AI models
• Alpaca on FlatHub

Think Silverblue, but with cloud-native tooling used to build it. From Aurora to Bazzite, our impressions of the ambitious Universal Blue project.

Sponsored By:

• Core Contributor Membership: Take $1 a month of your membership for a lifetime!
• Tailscale: Tailscale is a programmable networking software that is private and secure by default - get it free on up to 100 devices!

Support LINUX Unplugged

Links:

• 💥 Gets Sats Quick and Easy with Strike
• 📻 LINUX Unplugged on Fountain.FM
• Universal Blue — The Universal Blue project builds a diverse set of continuously delivered operating system images using Fedora Atomic Desktop's support for OCI/Docker containers.
• Universal Blue Architecture Diagram
• Aurora — Aurora is a clean and reliable desktop operating system for every type of user. Many batteries included.
• Bluefin — Bluefin is a custom image of Fedora Silverblue offering the best of both worlds: The reliability and ease of use of a Chromebook and the power of a GNOME desktop.
• Bazzite — The next generation of Linux Gaming for all of your devices - including your favorite handheld.
• uCore — An OCI base image of Fedora CoreOS with batteries included; a lightweight server image including most used services or the building blocks to host them.
• Bazzite Desktop Environment Tweaks - Bazzite - Docs - Universal Blue
• Installing and Managing AppImages on Bazzite - Bazzite - Docs - Universal Blue
• Universal Blue Contributing Guide
• Jazz up your Bluefin command line with some bling! [YouTube]
• Jorge Castro on YouTube
• Membership Summer Discount — Take $1 a month of your membership for a lifetime!
• zap.store — a permissionless app store.
• Asking AI To Make A Caveman Rock Song - Me Like Rock
• winapps — Run Windows applications (including Microsoft 365 and Adobe Creative Cloud) on GNU/Linux with KDE, GNOME or XFCE, integrated seamlessly as if they were native to the OS.
• The Mooltipass Hardware Authenticator — A Simple Hardware Authenticator
• ptyxis — Ptyxis is a terminal for GNOME with first-class support for containers.
• Gearlever — Manage AppImages with ease 📦

Wes' self-decrypting bcachefs disk and a GrapheneOS twist that'll make you ditch your iPhone.

Sponsored By:

• Core Contributor Membership: Take $1 a month of your membership for a lifetime!
• Tailscale: Tailscale is a programmable networking software that is private and secure by default - get it free on up to 100 devices!

Support LINUX Unplugged

Links:

• 💥 Gets Sats Quick and Easy with Strike
• 📻 LINUX Unplugged on Fountain.FM
• clevis — Clevis is a pluggable framework for automated decryption. It can be used to provide automated decryption of data or even automated unlocking of LUKS volumes.
• bcachefs Encryption
• What measured boot and trusted boot means for Linux
• Automatically decrypt your disk using TPM2 — Entering the passphrase to decrypt the disk at boot can become quite tedious. On modern systems a secure hardware chip called “TPM” (Trusted Platform Module) can store a secret and automatically decrypt your disk. This is an alternative factor, not a second factor. Keep that in mind.
• Use systemd-cryptenroll with FIDO U2F or TPM2 to decrypt your disk
• Automatic LUKS 2 disk decryption with TPM 2 on Fedora
• Safe automatic decryption of LUKS partition using TPM2 | 221b
• FOSDEM 2024: Clevis/Tang - unattended boot of an encrypted NixOS system
• Clevis & Tang on NixOS Slides
• Decrypt LUKS volumes with a TPM on Fedora Linux
• Self-Hosted 127: Can't Fix What You Don't Track
• Garmin Forerunner 265 — Forerunner 265 is a running smartwatch with a touchscreen AMOLED display, training metrics, phone-free music, & up to 13 days of battery life in smartwatch
• HRV Status
• Garmin Sleep Tracking
• Nap Detection
• Garmin Pay
• Tribit Stormbox Micro 2 Wireless Portable Speaker: 10W
• USB-C Charging Converter for Garmin Watch Without Charger Cable
• Obtainium — Obtainium allows you to install and update apps directly from their releases pages, and receive notifications when new releases are made available.
• Managing your personal access tokens
• Membership Summer Discount — Take $1 a month of your membership for a lifetime!
• Iotas — Iotas aims to provide distraction-free note taking with optional speedy sync with Nextcloud Notes.
• LINUX Unplugged 567: So Long sudo
• Celeste — GUI file synchronization client that can sync with any cloud provider
• vt52's Blog: Migrating from NixOS channels to Flakes
• FUTO Keyboard
• autossh
• LINUX Unplugged 570: RegreSSHion Strikes
• Aeon — The Linux Desktop for people who want to "get stuff done"
• Aeon: openSUSE for lazy developers
• Grayjay — Follow Creators Not Platforms
• Grayjay on GitLab
• CrowdSec
• Bustle — Bustle draws sequence diagrams of D-Bus activity. It shows signal emissions, method calls and their corresponding returns, with time stamps for each individual event and the duration of each method call. This can help you check for unwanted D-Bus traffic, and pinpoint why your D-Bus-based application is not performing as well as you like. It also provides statistics like signal frequencies and average method call times.
• open-and-shut — Type in Morse code by repeatedly slamming your laptop shut

Wes reports from the Skunkworks lab, and Brent tells us about his new computing lifestyle.

Sponsored By:

• Core Contributor Membership: Take $1 a month of your membership for a lifetime!
• Tailscale: Tailscale is a programmable networking software that is private and secure by default - get it free on up to 100 devices!

Support LINUX Unplugged

Links:

• 💥 Gets Sats Quick and Easy with Strike
• 📻 LINUX Unplugged on Fountain.FM
• Nix Nerds Matrix Room
• Beelink SER5 Mini PC
• Minisforum UM690 Pro
• pyenv-flake: experimental nix flake that can build pyenv pythons
• dotenvx-flake: A nix flake for dotenvx
• auto-patchelf.sh - NixOS/nixpkgs
• Packaging/Binaries - NixOS Wiki
• Membership Summer Discount — Take $1 a month of your membership for a lifetime!
• Try the JB Test Gathio Instance hosted by HybridSarcasm
• Berlin with Brent: September Meetup at Nextcloud Conference · JB Events
• Fix Kate sudo saves - use Plasma 6 version of Kate by MarkSort · Pull Request #3 · ChrisLAS/nix
• Running OpenBSD 7.5 on your laptop is really hard (not) — I couldn't use OpenBSD exclusively; there's software that I need/want which isn't available. But I do appreciate certain of OpenBSD's qualities: it's a simple, ultra-lightweight, traditional UNIX. I have an ancient ThinkPad running OpenBSD configured as a minimalist desktop: it's nice for focused work. Sure, it can't run Steam or play Netflix, but sometimes that's a plus...
• @fabean's NixOS configs
• IBM Classroom LAN Administration System V 1.30 User Guide
• 0xchat: Secure chat built on Nostr
• Get NIP-05 verified
• Pick: termscp — 🖥 A feature rich terminal UI file transfer and explorer with support for SCP/SFTP/FTP/S3/SMB
• Learn Nix The Fun Way — Sure, it’s sort of portable, if you tell the person running it to have curl and jq. What if you relied on a specific version of either though? Nix guarantees portability.

We dig into the RegreSSHion bug, debate it's real threat and explore clever tools to build a tasty fried onion around your system.

Sponsored By:

• Core Contributor Membership: Take $1 a month of your membership for a lifetime!
• Tailscale: Tailscale is a programmable networking software that is private and secure by default - get it free on up to 100 devices!

Support LINUX Unplugged

Links:

• 💥 Gets Sats Quick and Easy with Strike
• 📻 LINUX Unplugged on Fountain.FM
• Spokane Meetup - No-Li Brewhouse · JB Events on Gathio
• Plasma/Krunner Docs — Brent's tip: 'https://search.nixos.org/options?query=\{@}' (the '\{@}' is the magic sauce)
• autossh — Automatically restart SSH sessions and tunnels
• autossh on GitHub
• Spokane Meetup — No-Li Brewhouse, Sat, Jul 13, 2024, 4:00 PM
• RegreSSHion — Remote Code Execution Vulnerability In OpenSSH Server
• regreSSHion — Remote Unauthenticated Code Execution Vulnerability in OpenSSH server.
• NixOS Security advisory: OpenSSH CVE-2024-6387 “regreSSHion” – update your servers ASAP
• Nasty regreSSHion bug affects around 700K Linux systems
• Qualys CVE-2024-6387 Write-up
• Letmein: Authenticating port knocker - Written in Rust — Letmein is a simple port knocker with a simple and secure authentication mechanism. It can be used to harden against pre-authentication attacks on services like SSH, VPN, IMAP and many more.
• fwknop: Single Packet Authorization > Port Knocking — fwknop stands for the "FireWall KNock OPerator", and implements an authorization scheme called Single Packet Authorization (SPA). This method of authorization is based around a default-drop packet filter
• Membership Summer Discount — Take $1 a month of your membership for a lifetime!
• Jeff links: How to run non-nix executables?
• pick: stu — TUI (Terminal/Text UI) application for AWS S3