LINUX Unplugged - 305: Resilience Is Futile

Episode Date: June 12, 2019

Is Resilient Linux truly an indestructible distro? Or is this our toughest distro challenge yet? Plus why openSUSE is looking at a renaming, and if we’d pay for Firefox Premium. Special Guest: Brent Gervais.

I got to imagine some of you out there are VLC users. I think it's important that everybody knows that VLC just released version 3.07, which is sort of a minor feature update, but the release is special in another way because it has the most security issues that have ever been fixed in any version of VLC ever. Yeah, that's right. And actually, it's kind of neat because this high number of security issues is due to the sponsoring of a bug bounty program funded

by the European Commission. The two most important issues are an out-of-bound write and a classic stack buffer overflow. And there's a couple of mediums in there and some low ones in there as well. A couple of them only affect actually version 4 of VLC, but either way

probably worth making sure you got the latest version because you don't want to download something. Yeah, especially if you happen to throw strange media files at that application. Yeah. You know, I also saw this week that Ubuntu Mate announced

they're switching to GNOME MPV for their media player. If you haven't tried out MPV, I mean, I love VLC, and it's great, and that's a super great project, but MPV is wonderful too. And GNOME MPV is simple.

Just a nice, easy wrapper on top. I love it. So if you haven't checked out MPV in wonderful too. And GNOME MPV is simple. Just a nice, easy wrapper on top. I love it. So if you haven't checked out MPV in a while, why not this week? Give it a go. This is Linux Unplugged, episode 305 for June 11th, 2019. Hello, friends, and welcome into your weekly Linux talk show that I'm pretty sure got trolled this week. My name is Chris. My name is Wes. And, I mean, if not that, then we might be kind of inadequate. Thanks, Wes.

At least as a team, though, right? So that's good. That's right. Yeah. We all got a little trolled this week. We'll tell you about our attempt at giving resilient Linux, the indestructible Debian-based Linux, a try. We only got so far, hence the trolling.

But we also have a bunch of community news, including OpenSUSE is looking at renaming. Firefox is considering a premium paid edition. Say what? But we also have a bunch of community news, including OpenSUSE is looking at renaming. Firefox is considering a premium paid edition. Say what? Yeah, I'm curious to see if you'd pay for that. Plus, we've got some feedback and we've got some picks this week. But before we get to any of that, Wes, we've got to bring in Cheese and Elle. Hello, Cheese and Elle.

How are you? Hey, hey. Hey, hey. Thank you for joining. We've got a lot to get to. So let's also bring in that virtual lug time. Appropriate greetings, Mumble Room. Hello. Hello.

Hello. Hello, it's so good to talk to you for the very first time right now. I have never talked to you before this very moment, obviously, of course. So it's good to see you in there, Brent and Bruce and Carl. Drew, Bert, Matt's in there, Minimex, Skull Leader took a break from leading all the skulls. And, of course, TechMav in there as well as Dave and Rotten and the bros up in Quiet Listening. Aren't we happy to see all of you? It is. It is really nice to see you. I'm really, I am.

It's a good crowd. It's a good crowd. So let's kick things off with something I just mentioned there. This seems like a big story that's unfolding. A lot is still up in the air. It's early days. And the takeaway headline that people are really talking about over at LWN is that OpenSUSE is looking at potentially renaming. Wes, you would agree that the hardest thing about a project, no matter if it's a software project or a media project, is the name? Oh, yeah. I mean, heck, I just struggle with variable names.

But, right, we want names to represent us. They're a big part of how we identify and how we present ourselves to the world. And that means everyone has to disagree. That's so true. That is really true. And when I heard this story first, my first reaction was, what? Like OpenSUSE, they're like established. It's not the first one I would have thought.

Why are they renaming? Well, this is actually all part of a larger conversation that's happening in OpenSUSE as they look to define their independence. And instead of us telling you about it, I thought we would just kind of go inside one of the board meetings. Richard Brown, the OpenSUSE chairman, breaks it down in a board meeting. Thankfully, they had audio recording. And so we're going to play that for you. Sort of conference board meeting. Last year, we had a whole bunch of topics and we kind of

rambled on about all of them for the better part of an hour and then had questions at the end. This one is a little bit different because if you've been kind of keeping up with the mailing lists, there's pretty much only one topic that's on the board's mind at the moment. This idea of a foundation or some legal structure. An open SUSE foundation. A need for a legal structure under the distribution. And you might wonder, what are some of the main drivers of that? Well, they'll tell you.

What we've noticed in organizing the last conferences, but as well in sponsoring other projects or receiving money from sponsors, it is an issue that the OpenSUSE community has no legal entity behind it. And if there is a company, for example, that wants to sponsor us, or we as a community think this project is beneficial and we want to donate some money for it, we just can't do it at the moment. Just for legal and as well for tax reasons. just for legal and as well for tax reasons. So the idea is now let's put a legal structure in behind of OpenSUSE. So you want a legal structure that is behind OpenSUSE.

But if you're using the SUSE trademark and brand, there are tons of restrictions that come along with that. And so that's something they're beginning to be a little concerned about. I mean, you can see how there would be some impedance mismatches between a company and what they need to do and how they're trying to represent themselves in an open source project with maybe totally different aims in some communities.

Yeah, but today there's alignment between what SUSE, the parent company, wants and what OpenSUSE is trying to do. There's alignment and they're very supportive. Five years from now, will that be true? How will that work if SUSE is sold to another company? Imagine like a Microsoft or an Oracle were to buy the SUSE division for their cloud. Then where does OpenSUSE fit in that picture? So having a separate legal entity is a really good idea, but you run into all these trademark issues. And that's where the

name issue comes up. It's maybe we need to call it something else. And I don't know where they're going to go with this. They say the primary motivation for the name change, as described by Richard Brown, is that OpenSUSE contains the words SUSE. The company will have to retain a significant amount of control over what the foundation could do with its own name. And likewise, the distribution. The other consequences of the current trademark situation, Brown said, is that OpenSUSE's board spends a significant amount of its time dealing with trademark issues,

to the detriment of the rest of the project. Yeah, okay. Didn't realize that. Wasting a bunch of time. No, I wouldn't have imagined that at all. Unsurprisingly, others in the group, other board members, feel that the name change would be a bad idea. Some say it would cause the distribution

to lose its users. Some say the brand is the most important part of keeping the distribution alive. Throwing it away means throwing away the distribution. That's a strong statement. I mean, you could see it though, right? If you weren't already interested and you maybe knew what Seuss was,

but you didn't really know what this other non-branded or new name project, are you going to check that off on a list, even if it's up on DistroWatch? I don't know. Yeah, it just could become yet another Linux distribution. Versus a route of, oh, Seuss, interesting, I see their name or their products. There's a historical legacy here.

What do you think about this, Cheesy? I think this is a great step for Seuss, OpenSeuss, to kind of pull themselves out of that Seuss umbrella. This is a great step for Seuss, OpenSeuss, to kind of pull themselves out of that Seuss umbrella. This is a good opportunity for them to maybe, you know, be funded and have a few projects that they really focus on to bring to the community. So I think this could be a good thing for them. You know, whenever you change brands, names, logos, titles, colors, you're always going to get backlash. It is kind of important for them to pick a name that represents them well. But I think that the

majority of the OpenSUSE users are going to migrate over to whatever it is they call it. I mean, if they call it catch up, people are still going to use it because it used to be open Seuss and that's what they're used to. So, you know, I think it's a good step for them to kind of pull themselves out from that umbrella, that Seuss umbrella, remove all that branding, you know, kind of like what Fedora has done, right? Yeah. They argue that Fedora was harmed by their name change, but I see it more the way you're seeing it. It would actually, to me, be an advantage for them. And there's another way around this. There's a middle ground they may be able to tread here. They may get away with coming up with something like the Green Lizard Foundation for the name of the foundation, and then OpenSUSE is what the

foundation takes care of. And then if the need ever came along to change the name of the distribution because of what the parent company was up to, then the foundation name would be established by that point and everybody would know, oh yeah, that's the same thing. You at least already have a strong association and you could pivot then not to put all your eggs in one basket right now. Those are lizard eggs to be clear. Sure.

And you avoid all those trademark entanglements by calling it the Green Lizard Foundation or whatever it is. So that seems like a middle ground that could go here that we might see. It also seems like at this point, no one really agrees. I guess it's early days for the conversation. It is neat, though, that we, I mean, we get to watch this from afar as it's all playing out. Elle, would you install open ketchup on your laptop?

You know, it might just get a little messy. It already does, so. Nice. Nice. You know, it might just get a little messy. It already does. So nice. Nice. Well, there's one element that would remain the same, and that is Seuss's involvement in picking the chairman that runs the whole thing. At the moment, if you look at the wiki page for OpenSeuss, there is the existing rules that we define how the board is elected. There is the existing rules for how members or who can be a member that Richard needs to put back there. But basically, the idea is without having gone through a lawyer yet, fundamentally, we don't want

that structure to change. The chairman will still be appointed by Sousa. The board will still be voted by the members in the same way it is now. be appointed by Sousa. The board will still be voted by the members in the same way it is now. Now, that is also possible that if the members of the board don't like the chairman being appointed by Sousa, they can vote to change it. So that is still an option to them. And it's not something Richard Brown asked for, but that's how it's going to work. And I have the policy linked in the show notes if you want to see it. The way the board election rules work is the chairman is appointed by Sousa. So there's still some connection there. Yeah. But I mean, I guess that could also be a if you want to see it. The way the board election rules work is the chairman is appointed by SUSE. So there's still some connection there.

I guess that could also be a good thing. It could change the involvement from the parent organization saying that they care about what's happening there. Yeah, for sure. You could argue that, exactly. You could argue they want to make sure the mission is carried out or whatever. We'll let you know. If they come up with a new name or if they get a foundation established, we'll let you know. If they come up with a new name or if they get a foundation established,

we'll let you know. I mean, Red Hat has CentOS, so maybe SUSE could have $OS. Yeah, something like that. I was thinking it's kind of like the opposite of the CentOS situation where CentOS, actually, not really.

CentOS is based on RHEL. Open SUSE, or at least Open SUSE Leap is based on RHEL. OpenSUSE, or at least OpenSUSE Leap, is based on their enterprise distribution, OpenSUSE, or SUSE desktop, enterprise desktop. So there is a lot of similarity there, where CentOS is connected, but rebranded. It's not like the first time we've seen this trademark issue. This isn't like an unknown thing. I think my biggest takeaway was, I'm kind of surprised SUSE is at this stage right now, but they kind of have a unique situation too.

And there is a part of me, like it seems like if SUSE was huge, like if it was a blow away success, these issues would have been long resolved. Yeah, it is interesting that we're kind of hitting them right now. It speaks both to its success and to its relative size. Yeah.

Now, speaking of foundations, the Matrix Foundation has been formed along with Matrix 1.0. Now, I know some of you may not be Matrix users right now. Just as a quick reminder, it's an open source project that creates an open source standard for secure, decentralized, real-time communication, and it's like Slack plus 10, all under the Apache license. Yeah, I like to think of it as like a, it is kind of, it is like a matrix, or like a web mesh,

a signaling standard for the internet. Yeah, yeah. In the modern era. Yeah, because you could use it for so much more than just basic communications. It's such a cool project, and so that's why it's really exciting, too, that they've just released version 1.0.

I remember talking to the team five years ago when they just launched this thing, and they've finally now reached 1.0 and exited beta. That's fantastic news. It probably means if you haven't already tried Matrix or some of their stuff, like you can get the Riot 1.0 app going and try it out that way. Maybe run a server yourself. Now's a great time to try. We've got some integrations even in the JB Telegram

chat. And the System76 PopOS community is using it. So when you want to pop in there, you can chat with people. I think this is great. This is a huge milestone. I mean, it really does take a lot to get this far. Five years is a long time to keep working on the same project.

And calling it 1.0, right, they're making it a big deal. They're saying this is stable, self-consistent, self-contained, ready for use. That's big. That means it's ready for the enterprise. It's ready to compete with Slack and much, much more. And then to combine it with the announcement of the foundation, which we've known is coming. It's been in the works for a long time. But they're doing it in such a great way.

As of today, they've finalized the foundation. As of like today, the day we're recording, everything's been finalized. And all of the assets for matrix.org have been transferred from NuVector, which was the startup they formed in 2017 for the project, for the core team. They've transferred all of the assets from that startup to the foundation. Whoa. Yeah. Interesting.

They're going all in. That is, yeah, that is a sign right at the start that this is legit. But they don't stop there. You ready for this? They've also created guardians of the matrix.org foundation. Amazing.

How about this? The guardians are legal directors of the nonprofit foundation and are responsible for ensuring that the foundation and by extension, the SPAC core team keeps on mission and neutrally protects the development of matrix. development of Matrix. And they've started the foundation with five of these guardians, two of which are the original founders of Matrix, and the other three are entirely independent, which they say ensures the original Matrix team forms a minority, which can be kept in check by the rest of the guardians.

Wow, that's an interesting governance structure. Yeah. That's pretty humble. To create something like this, to birth something like this, to have this be your passion for years, and then to cede full control like that over? It's like an anti-Zuckerberg? Is that how it works? It's exactly what something like Matrix needs to have. They've really honed in on the audience.

They've really got it figured out. And this is the kind of long-term arrangements that could make this thing like the glue that we need it to be. I find this to be really exciting. I think this is a very important project. And I can't wait to see all the applications like Riot and other ones built off of it just get better and better. Now that it's 1.0 and it's a stable API, it's a self-contained project, it's ready to be built off of.

Matrix.org, it is still a little bit difficult to search for, but they have a great domain name. Yeah, that's true. Yeah, it is a lot of foundations these days. Like we need like a foundation bingo game or something because we've got a lot of foundations. I thought, I don't know, I thought we'd have like some meta foundations and people would work under those like the conservancy and whatnot. But nope, nope, no, we're just going to have all the foundations, I guess. But congratulations to them. 1.0 is huge.

Okay, now I'm curious to know your take on this next one. I'd like to know the MumbleRoom's take on this too. Firefox Premium, if it were to launch later this year. Now we have very little details, so we're going to do a little guessing here. Speculation, you know. The CEO of Mozilla, Chris Beard, revealed the plans in a conversation with a German media outlet, T3N, through a stream. It sounds like Mozilla will make a privacy and security feature service available, and one would probably be correct to assume that it will include their VPN partner amongst

other things that they already have. And in details that we got in an update, there's a quote that reads, we'll probably launch some new services first, and then we'll think carefully about which bottle makes the most sense while ensuring the best user safety. Firefox and MIDI security features and services like enhanced tracking protection will still be free. Beyond that we've got

little details. So we don't really know where the line's going to be. But if you have Firefox Premium, then what's Firefox non-premium? Firefox Standard? Substandard. Firefox Free? Firefox Standard? Substandard. Firefox Free? Firefox Basic? Maybe just Firefox.

I think that it's a possibility that this is going to be just a weird branding that they've been doing. So they have Firefox Monitor and Firefox Sandwich have nothing to do with Firefox itself. And that this might be a premium service in the sense of like, hopefully, in the same kind of vein that the Librem One stuff is. That's what I was wondering. And if Mozilla came around and kind of offered the same suite of services that Librem One is offering, I'd probably be more inclined to buy it from Mozilla. What about you? Oh yeah, absolutely. If Mozilla was the one doing it, that's when I first heard Librem One was announced, I was like, I mean, that's a great idea, but I'd be more comfortable if another organization has, you know,

have a bigger backing and has been around longer to be doing it. And one of the examples I gave was Mozilla. Right, because they have a wider interest in keeping the web open, too. Yeah, right. And they're, I mean, they're already running services. They've just been doing more of the password stuff, right? So they have a long history of keeping user data. I also wouldn't mind coming up with a way to directly contribute to Mozilla.

So that was going to be my answer. If this was some sort of premium browser, I might still pay for it. Probably not for any sort of features, but just as a way to have an easy way to just like, hey, Mozilla, here's some money. Thank you. I have over the years just bought like a T-shirt or I'll buy like a, I bought a backpack, which I've used for like a decade now. So that's where you got that. Yeah. Yeah. It's, it's, it's time to replace that backpack too. Like over the years, I've just bought swag to support them. And I, I encourage them looking for viable, sustainable revenue models that get them off the search engine

bandwagon, you know, cause that's how they're making money right now. And that's not a good idea long-term for, for what they want to do for the web and for where they want their leverage. They need to get off that sauce. Brent, I can't remember if you're a Firefox or Chrome user, but what would your thoughts be on somebody who travels a lot? If you got a VPN service and a couple other things, would you pay for it? And would you want to go through somebody like Mozilla or would you do like what I'm doing right now? I have an AirVPN subscription, for example. That's my VPN provider. No affiliation or anything. It's just who I use right now. And I kind of trust them to do a better job at that. I'm curious what your thoughts are. I would say my first reaction to seeing this last night was like, oh no, like the model

for a browser that I use every single day is changing. And what does that mean? But now hearing a few of your perspectives, I think that, wow, yeah, we definitely should have an easier way to support Mozilla. They're certainly a group of people that I've really believed in for a decade now. Can you say that? And so if they're coming out with some products like VPNs and things like that,

I actually think I would be first to trust them over even some dedicated VPN providers, simply because they've built so much trust around the internet and the open source community in the last many, many years. So I think it's a good thing. If it goes that direction, I mean, we're going to have to wait for some details. We know that the VPN is more than likely going to be using the Proton VPN, because there was a partnership announcement last year sometime where they were going to be doing something with Proton.

As far as trusting them, if people trust ProtonMail, that's a good option. Yeah, fair point. It does seem like that. That would be the most likely service provider that goes, so that's a fair point. I think looking at this whole thing in totality, the thing in the back of my mind is, I've had some

questionable moments when I watch Mozilla and some of the decisions they've made even like this year thing in the back of my mind is I've had some questionable moments when I watch Mozilla and some of the decisions they've made, even like this year or in the last year, there's been some questionable moments for sure. And, you know, you have to take everything in its totality. However, I also like to judge people based on their work. And Firefox has been consistently getting better. They really, truly made a focus. And Mozilla as an organization has been making the right moves for both user privacy and for open web standards now. And they really haven't deviated on that course. And so I would actually say their trust level in my book has gone up considerably over the last year. Isn't that interesting? Yeah, that is what it is.

We just feel good about them because we've seen what they do and believe that they have the right intentions behind them. I want to get Elle's perspective. Last take on this. Elle, would you pay like a monthly fee, like $10 a month, if you got a Firefox VPN and some other services and it goes towards Mozilla? Is that something you'd be interested in actually doing? I mean, I already pay for their VPN, so can I just get rolled in? You're ready to go.

I'm good. I mean, you know, every time you guys are like, oh, load up Chrome, I throw a fit. So I'm already there. Yeah, that's true. That is a good point. Good point. All right. Very good. Well, why don't you tell us a little bit about something pretty amazing that happened recently at a hacker family dinner? And I think it's something that the whole audience should hear about. So this was an event held before B-Sides. One thing I've gotten into doing is just kind of throwing a B-Side event next to our large conference just to get to know people. And so I

had about 25 people show up and, you know, we get down to the tables and this is a family dinner. People have drinks in their hands before we even have the table. Their appetizers going, everything's great. We're all talking. And about an hour and a half in the guy next to me turns around and he's like, Hey, I've got to go. I'm like, Oh, you know, we're going to miss you. Bye. And then he comes back by the table and says, just let everybody know that up to this point, I went ahead and took care of the bill. And it didn't register my brain. I thought he was telling me, Hey, I already paid for my food. Bye. And so I was like, okay, have a, and I didn't even finish the sentence by the time the guy is gone. So yeah, it took me a minute and I'm

wait, I look over at Allie and I said, did he just say he paid for the meal? She's like, no, no, he must've met his. So I went over to look for the waitress and she's like, no, he covered the bill. And I was like, for everyone? Yes. All the drinks, appetizers, everything? And she's looking at me like, are you daft? Yes. There were two tables worth of people and he was out the door before we could even acknowledge it.

I tried to find out how much the bill was and another waiter was like, no, it was his gift and just kind of like cut me off there. So a very, very special thank you to, and I'm just going to call him by his Twitter handles, not to out him for privacy, a Jedi mammoth for that great gift. That's so great. Amazing. The best community in the world. And a classy move. Yeah, that is a really classy move. And that's another thing.

We've been doing these study groups, which are posted on the Meetup. But also, if we're at an event, like Elle's Dinner, for example, that was on the Meetup page. Meetup.com slash Jupiter Broadcasting. Thank you to Jedi Mammoth for doing that. That's super cool. He's an interesting individual himself. I'll put a link to his Twitter profile. We have the coolest community. He's, we have the coolest,

we have the coolest. He's a very interesting guy. And I'll put his Twitter profile in there. Well, that's really great, Elle. How was all B-Sides and all of that? Was that a good event? It was a lot of fun. This is the one conference that I really try to stay away from volunteering so I can just enjoy it. And every single year, I'm trying to figure out how they make it happen for as little as they pay or as they charge for the tickets. Yeah. And B-Sides, okay. So for those people that are not familiar, because it's kind of not fully well-known yet, B-Sides is happening all of the time and it grew out of a larger, more well-known and more established conference. So B-Sides grew out of Black Hat. When Black Hat was going on, there was only so many talks they could establish or they

could host. And there was a little bit of arguments to really how they should pick these talks. And so a great guy by the name of Chris Nickerson and a few others, I could miss them all by name, but of course, because I'm talking, I've forgotten them all, decided, you know what? We'll rent a mansion. And in every room, we're going to have a talk. And just invited all of the conference speakers that didn't get accepted to come and give their talks.

And it's just continued to grow. And last I counted was, I think, 52 with B-Sides Cairo being the latest one. And the name comes from, you know, running B-Side, a major conference, or the major conference being the A-side of the record. The B-side of the record, yeah. So you're saying, how many are this year? I think it was 52.

Now I wish I would have looked it up before I got here, but it's huge. That is. It's really neat because it's a good example of a grassroots community conference. And the name, B-Sides, is so good because it is beside another conference or it is the B-Side of a record. I love it. All right, well, we have some things to talk about in the housekeeping.

First of all, you may have noticed that the AWS DevOps Professional Certification exam has just been updated, as they often are. Well, the good folks over at Linux Academy have got your back. Check it all out. I'm going to put a link in the show notes for a lab and some information about the AWS Developer Suite. This is a big area right now. AWS,

I'll tell you what, changing like crazy. Yeah, you've got to stay up to date. And it's easier this way, let me tell you. Exactly. So I'll have a link to that. If you haven't heard BSD now for a while, it's easier this way, let me tell you. Exactly. So I'll have a link to that. If you haven't heard BSD Now for a while, it's hot and fresh. You know what? This calls for a special moment, don't you think?

You ready for a classic? Welcome to BSD Unplugged, your weekly BSD talk show that's too busy getting actual work done to care about your silly display server. My name is Alan. Still hurts. But you probably want more Alan Jude. We all do.

Yeah. BSD Now has been refreshed. Starting with 301, we are recording in a brand new format, high fidelity audio. And Mr. Drew is editing each show so we try to fix up as much crosstalk and things like that. The show is tighter and better than ever. 300, too. Congratulations to them. So go check out BSD Now.

I'll have a link to 301, bsdnow.tv slash 301. Also, Fostalk Live happened. Man, that looked like so much fun. I was jealous. Yeah. So that's an event that happens across the pond that we've never really been to, but it's a night of podcasting, of Linux podcasting. Live!

And our friends at the Ubuntu podcast participate in late-night Linux, and others are all participating in what is basically just a great night of Linux podcast geekiness in a nice, really kind of intimate venue. It seems like you can find beers there, too. Yeah, rumor has it. And I believe the first episode from there, late-night Linux, is out, and I bet you our friends over at Ubuntu podcast have something there too. Yeah, rumor has it. And I believe the first episode from there, Late Night Linux, is out. And I bet you our friends over at Ubuntu Podcast have something too.

So check out a link for that or go to Late Night Linux. Speaking of podcasts, the best 17 seconds from Texas Linux Fest did indeed make it into the Friday stream. Fridaystream.com. Fridaystream.com. I really, really enjoyed this last episode.

Make sure you stick around for the post show because we did a live version of Who Wants to Be a Millionaire? Where it was Elle versus Allie and we gave away a game to a live stream audience member. That was fun. Exciting stuff. That really was fun. That was great. I mean, if you want to see stuff like that too, you can watch it all live on the actual Friday. That's true.

You could. Yeah, 1 p.m. over at jblive.tv or jupiterbroadcasting.com slash calendar to get it converted to your local time zone. Now, we do have some other details on the meetup page about upcoming events. We just finished up the Linux Permissions Basic study group. Yeah. Oh, that was good. We just finished up the Linux permissions basic study group. Yeah. Oh, that was good. Like, I think we're going to, I'm not quite sure how we're going to actually deliver it because we may split it up into multiples, we're thinking.

But we'll soon have an update on that. But we just did another study group where we had a fantastic presenter, Alex from Rackspace, sat down and went through the basics of Linux permissions, but then some of the more advanced things that I think most Linux users have sort of glossed over that are so crazy powerful. sat down and went through the basics of Linux permissions, but then some of the more advanced things that I think most Linux users have sort of glossed over that are so crazy powerful. So that information will be out soon. But if you want to attend those kinds of things live,

meetup.com slash jupyterbroadcasting is where you go for that. Also, it's cheesy. We should tell people about the Telegram sticker pack. Oh, yeah. It's got all of, well, it's the first six stickers that we've released in the pack. It's pack one. There are more to come.

But we do have some of your favorites in there, like Get It Out of Here, Patch Your Shit, Negative in the Freedom Dimension. I encourage everyone to go over there. If you're on Telegram, go ahead and pick them up. There'll be a link in the show notes. If you're not on Telegram then you should be and just go on over to the site and click on the little Telegram icon at the top of the site

and you'll be prompted to join. Now Al, this is your moment. Now was there anything else? Any meetups we should mention? Or any other things that you want to plug before we wrap up the housekeeping? So the next meetup

is going to be Understanding Burnout and I think this is a really important topic that we're not discussing in the community is kind of mental health. So please join us. That's a good one. Okay. Yeah. The burnout one's good. Important. Yeah, it is. It is. So meetup.com slash you bracket, you know, go there. Why do I have to keep telling you, geez, just go do it. Gosh, meetup.com slash Jupiter Broadcasting. Gosh. Okay. I think we got pretty trolled this week.

I don't actually know, I don't know if this was a long con or if our team has peaked and it's time for us to all go home. I guess, I mean, maybe we should survey. I'm curious how far everyone got. Yeah, I am too. So this was a suggestion that came in

by SWListener. He wrote to us, at Chris and at Wes Payne, how about you take a look at the tinfoil hat brigade, take a look at resilientlinux.com. So we went over to resilientlinux.com, which looks like it might be ripping off

the elementary OS background, and we read around and saw what we liked, a resilient Debian GNU slash Linux derivative for indestructible installations for desktops and servers that are 64-bit. Oh, yeah. A persistent partition that contains only diffs from the stock installation, things like that. Yeah.

And based on Debian Stretch with a unique partitioning scheme crafted for maximizing the strength against file system corruption, as well as persistence and a friendly installer. So you end up with a nice, clean-looking Linux desktop. You write to a USB, you boot off that, and they write, in less than a minute, the installer will easily install Resilient Linux onto your PC hard drive. You could optionally set a password

for encrypting the persistence partition, and then you can test and use it in a virtualized environment as well. So this is pretty nice. It has a lot of potential. It looks like it's a passion project of two individuals. So, you know, we're not going to try to, like, bash on it or anything, but I'm not actually sure if it's actually meant to be run.

I will start with the honesty. I couldn't get it to boot. In fact, I can't remember the last time I have come on this podcast or on any of my podcasts and said, I can't get this Linux dist it to boot. In fact, I can't remember the last time I have come on this podcast or on any of my podcasts and said, I can't get this Linux distro to boot. I don't know if I've ever, if that's ever been my... I mean, you remember to press F12, right? Yeah, I could not get it.

I could get to Grub. I could get past Grub. But from there, I just got various versions of fail. What about yourself, Cheese? Were you able to get this to boot, resilient Linux? Yeah, I was able to get it to boot. Did you get to a desktop? I did.

Actually, I'm running it right now. You're shitting me. Okay, Elle, did you get it to boot? No, I don't believe him. No, did you, Wes, did you get it to boot? No, not quite. I kept running into issues in the internet. I know.

Wes wanted to be the one to get it to work, too. He was on a mission. I tried a couple things to try, but just like in a virtual machine, and I tried get it to work, too. He was on a mission. I tried to try it, but just like in a virtual machine. And I tried, yeah, I tried writing it to a USB stick. I tried it on my T480, raw dog off a USB thumb drive. I tried it in a KVM virtual machine. I couldn't get it to boot in either places. Wow.

Wow. All right. So, Elle, how far did you manage to get it? Did you get to Grub at least? I know I got to Grub, but then I started cyber stalking the person because I thought this was a joke. So I even got into their GitHub and was looking at the code going, wait a minute. Yeah, I thought maybe we were getting punked. Like I thought this isn't actually meant to boot because, because see, the reason why I didn't think Cheese had ever got it booted because he sent me pictures.

And when it first booted up, it put everything upside down. So his whole screen was upside down. I thought he must have given up. So Cheese, you got, did you get past the upside down screen stuff? Yeah, yeah, I did. It should be said too, that whenever you go to download this image, it's a zip file. There's no checksum there, which would be nice to see if you're going to do this. It's an image file too, not an ISO file. I got it to boot. It did take some finessing to get it to work. I'm running it on, I think it's a Dell Inspiron 3000, like two-in-one inexpensive old Windows laptop. And one of the problems that

most GNOME-based distributions have on this particular laptop is that the IIO sensor proxy, which is basically the accelerometer, so whenever you flip it over into tablet mode or whatever, it'll rotate the screen. Well, by default, it rotates the screen. By default. So your screen's rotated by default out of the box. Out of the box. Because obviously that's going to be a super common use case for all those Gnome Shell tablets out there.

And what's super weird is if I reboot the machine right after, then it'll reboot right side up. So there's some commands you can run and you can remove the IO sensor proxy package and stuff like that so that you don't have those issues. All right, hold there. Now, I'm curious to know once you got things, that's funny. Can you imagine him doing that? Once you got things right side up, I want to hear how it went. But I know Brent, you also tried to give it a go. How far did you get with Resilient Linux? So while I was downloading, I got super interested in all of it. And I read up on some of the founders and stuff and got super jazzed. And then same as you, I tried it in a VM with nothing.

And then I was like, okay, I got this brand new, well, brand new. I got this new to me, X240, and I'm just going to do it on bare metal. And I got the same as Wes, this NetRAM FS. I couldn't get past it. And I thought, I think I know what I'm doing. For the most part. I can't remember the last time I couldn't get... I think it was CrunchBang was the last time I couldn't get something running.

And I just couldn't get past it, and I wasn't motivated enough. Once I read into it, I started getting confused. I think Elle just linked a page that was an installer as well, that was a dev installer, and I was like, I love the sounds of this project, but I'm just not that motivated.

It is a little confusing. If you go over to the GitHub page, there's a release four days ago, actually. That one has an ISO file. And then, yes, they also have this dev that is a Python package that will install on a USB stick. So, probably they're still working out some of the fundamentals.

Because you'll note some of the previous work, stuff like LiveEng, they've put a lot of time and thought into rethinking some of how live environment works. That probably affects the image we're trying to boot. Right. Yeah, I just kept getting dropped down to a busy box. So, Cheesy, once you got the desktop going, what's the takeaway experience like?

I mean, it's not bad. It's pretty standard GNOME. So all the apps that you would expect are there. Chromium, Firefox even. I think it's Nautilus. It's the file manager, Rhythmbox, and so on and so forth. One thing that I did find kind of interesting is that on the applications page, panel, wing, whatever it's called in GNOME, there is a software icon. It says software dot dot dot.

Once you click on it, it actually brings you to the software sources and not to the software store. So the software store is found under utilities. I think that's just something they just maybe didn't look over whenever they were pushing this out. But all in all, it's really not bad. I mean, it's snappy. appy. I like the fact that it boots, you know, relatively quickly. The three applications in the drawer, the panel at the bottom, terminal, text editor, Firefox. I love that. The installation of Inkscape was super painless. I'm kind of playing around in Inkscape with it right now.

You know, it does support the touchscreen that is built into this 2-in-1. So I can, you know, move objects around in Inkscape or whatever just fine. All right. It might not be the snappiest, you know, but it's definitely not bad. Once you remove, if you're on one of these 2-in-1s

like me and have that problem, once you remove that sensor proxy're on a, one of these two and ones like me and have that problem, once you remove those, that sensor proxy package, it seems to work all right. Well, I'll tell you what I like about this. I like what they're trying to do. Um, we've talked a lot about an indestructible Linux before. I think it's, I think it's a good idea. Something that has this persistent partition that only contains the diffs from the stock installation is a solid idea. I

like where the project's going with this. Now, Brent, what do you think from like a perspective of like somebody who just tried to give it a go? When you delve into the project, does anything alarm you? Was there anything people should take away from this before they try it? Things like that? I would say that I love the direction of where all of the writing went that I read. The thing that really stood out to me was right on the front page, it says resilient Debian Linux derivative for indestructible installations.

And that's the first time I come across that term. And I think that just to an endlessly curious being like me, that just felt like a taunt. And I thought, ah, this is great. I'm going to install this and I want to dive in more and figure out what it's all about. So I was a little disappointed that I never got as far as cheese. I'm glad he did.

He's going to have to school us a little bit maybe. But I think really what I took away was that i'd love to keep an eye on this and just uh maybe um if they come out with you know in a month from now if they come out with a little bit more um maybe support around all this so that we can get some checksums and and get this running something that's a little more mature maybe that's it exactly so i would be totally up for trying it again for sure brand. Brent, the issue is just you weren't resilient enough. Oh, nice. I knew these were coming.

It was destructible for me. Yeah, I think it's sort of in the same camp that right now I put Clear Linux and Silverblue in now. It's like, I'm watching these because this might be a new way I do my desktop or at least a workstation in the future. You know, it's like, I'm watching you now. That's another great part about open source stuff.

We don't have to use it. We don't have to rely on it. We have plenty of options for great real-world everyday installs. And then these can be research projects that might eventually make it into the tech we use every day. It's also neat to see another Debian-based distro. I just, I don't know, I love that, you know. A lot of times you see them based off of Ubuntu these days, which is fine, but it's cool to see those that are still based off of Ubuntu.

They went all the way up. Yeah, that's right. So you can check it out. If you want to give it a go and tell us what we did wrong, resilientlinux.com. If you do get it going, let us know. Because apparently we weren't that successful. And maybe try to break it.

Yeah, yeah, see if it is unbreakable. All right, there you go, resilientlinux.com. It looks like a good initiative, although I think they got to work on that art at the top of the old website there. That's just my take on it. That's what happens. You tweet us, see if we'll give us a challenge

to see if we can get something working, and we gave it a go. Like, the whole team gave it a go. No guarantees. That's our new little add-on line. Oh, I also want to mention, we're going to get to the picks now. So just a little bonus information

before we get to the picks, because I didn't know when we were talking about the B-Sides stuff. But Elle wrote up a hell of a post. We call them articles on B-Sides 2019. We'll have a link in the show notes for that. Some pictures. If you want to know a little bit more about what B-Sides is about and sort of that organic community stuff, check it out. We'll have a link in the show notes for that. Now, let's get to the pics.

Mr. Payne, I have something I don't think I tried to keep from you. You may have seen it if you've been really watching my links. I want to talk about Chobb. Have you heard of Chobb? No. Chobb. Anybody have a guess of what Chobb is? Anybody want to guess?

It sounds like truth almost. Yeah, yeah, yeah, it does. It does, doesn't it? No? You guys have no idea. I've stumped you, haven't I? Don't Google it. Don't Google it. That's cheating now. Yeah, just use it does. It does, doesn't it? No? Oh, you guys have no idea. I've stumped you, haven't I? Don't Google it. Don't Google it.

That's cheating now. Yeah, just use dot dot go. Yeah, okay. You have maybe a 50-50 shot there. All right, are you Googling it? That's a good question. Is it chop? Like C-H-O-P?

I'm saying chop like cob, like C-H-O-B. Like brats, B for brats. Yeah, like B for brats. All right, anybody have a guess? Anybody? I Yeah, like B for brats. All right. Anybody have a guess? Anybody? I'm going to guess on this one. All right.

Go ahead, Brett. I think O-B for just sounds like obvious to me. So I don't know. Chopping it to obvious. So is it a link demystifier? Oh, that's a good guess. I can see that. Good guess.

No, it is not a link demystifier, though. Does it do something to change object files? Output from a compiler, maybe? Oh, Wes, you've been doing too much Coder Radio. No, it is not changing object files in a compiler. Why would I make that a pick? I thought maybe you'd be listening. I don't know.

All right, anybody else have a guess before I reveal one? This is a lot of fun. I'm really enjoying this. I cheated, and there is no way I would have figured it out just by guessing. Fair enough. Fair enough. All right. All right.

All right. Fair enough. All right. Here we go. Get it out of here. Chob, C-H-O-B, is a nice little helper tool that you can run on the command line that will search across Flathub, Snapcraft, and App Images for an application. Oh.

And then present you a menu, and then proceed to install whichever one you prefer. So if you are sick and tired of figuring out, geez, is there an AppImage or a SnapCraft or a FlatPak for this particular thing, you use Chob, and it will give you all of the results. So an example that they have on their GitHub page, and it

works great, is Chob. You can type in the Chob command once you have it installed. I just love the name. Chob code. And then it installed. I just love the name. Chob code. And then it'll give you all of the results across Snapcraft developers, AppImage developers, and Flatpak. Unfortunately, if you try to use it to search for itself, it's not listed.

Meta, dude. Meta. And then you just pick which one you want, and you're off to the races. So now you have a universal search for all of those universal packages. It's a meta universe. Yeah, it's kind of nice. And you can just grab it as a binary and run it directly. Or there is a deb as well. And I think, you know, I would bet I would bet you could probably other ways to install like it's I think it's using node. It would be nice if it had like a little bit more

version information. It would also be neat if it could hook into your distro's package manager, maybe compare and show, like, here's the different versions you can get, here's what you have natively. That would be next level cool, right? So then you can make an educated decision. Should I go with the one that's in the repo, or should I go with the one that's in Flatpak? You know, there's downsides, upsides, lots to consider.

Yeah, I don't think so. They do have just a binary you can run, download at jmod plus x and you're set. They also have a dev file, it looks like. How did I come across this? That's a, I think I was trolling blogs and Twitter feeds. I found it on Reddit just now. It was posted like a month ago, and I saw it, and it completely ignored it because it said Chob. I can't, I don't, I think I saw it just recently

because I tagged it like in the last seven days. So I must have just seen it recently. I can't remember. I can't remember what it was. I know I've, you know, I follow like a lot of the different like Snap developers and App Image guy and the Flatpak developers. And I've been doing a lot of digging around

for my Fedora machine. So I think maybe I found it when I was looking for Flatpaks, but I don't, I can't remember. I tagged it forever ago, which in my world is more than three days. And don't worry, it is based on JavaScript. Well, okay, it's TypeScript, but I'm pretty sure it bundles Node in there for you.

Phew, oh good, oh good. All right, well, there we go. Well, there's your pick of the week. There you go. God, I love Mario. I just love it. I just love it. You know?

It just makes you happy. All these years later, still love it. Still good. Still really good. Stay a while and listen. Now, if you love these shows, I want to remind you that we are part of Linux Academy. You should go check out linuxacademy.com, and you can tweet them, linuxacademy.com, and tell them how much you appreciate them here for making these here shows,

because we appreciate them doing that for us. We sure do. linuxacademy.com on the Twitter. Send them some love. Let them know you appreciate them making these shows sponsor-free for the community. Yeah, we're not here. Just selling you some crazy. They didn't ask me to say that.

I was thinking about it this morning. I was having an argument in the chat room, and I had a realization. It's a huge deal. We've dropped all ads. That's really great. So great for me. I was thinking about it this morning. I was having an argument in the chat room and I had a realization like it's a huge deal. We've dropped all ads. That's really great. So great for me. I was thinking the same. I was listening

and the local NPR station was doing a pledge drive. We also do that, right? We could if you want. Feels good though. I know. It's been nice. I think we should

send them some love. There's a lot of gratitude to go around for that. Linux Academy, call them on Twitter. Let them know. And also, the community edition,

by the way, free. Oh. With video.com on Twitter. Let them know. And also, the Community Edition, by the way, free. With video. That's right. And mobile apps now, too. It's getting better and better all the time. Now, we do this show here on Tuesdays over at jblive.tv. jupiterbroadcasting.com

slash calendar is where you can go to get that converted to your local time. That mumble room is open to the community. We'd love to have you come and share your opinions. That's our virtual lug. Not everybody can get to a lug on their neck of the woods. So come be part of ours. We'd love to have you.

Thanks so much for joining us and we'll see you right back here next Tuesday. අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි අපි This story didn't really kind of fit the theme of the show this week, so I didn't include it in the show, but I kind of wanted to save it just to talk about it with you guys because it makes me feel like people that never update their machines have got it right all along. Oh, no. Oh, no. I know. I know, because I'm always, like people that never update their machines have got it right all along. Oh, no. Oh, no. I know.

I know, because I'm always, like, arguing against those people, but I think they have it right. Only 5.5% of all vulnerabilities are ever exploited in the wild, according to, well, at least ZDNet. Most vulnerabilities that are exploited in the wild also have a CVSS severity of 9 or 10. New research published this week has shed some much-needed light onto the world of vulnerability exploitation, revealing how many of the total number of security flaws discovered in the past 10 years were actually ever exploited in the wild. Turns out, not much. Not much. Not much. Only 4,183 security flaws from the total of 76,000 vulnerabilities discovered between 2009 and 2018 had actually been exploited in the wild.

I mean, this is interesting, but I feel like this is a statistics problem sort of thing. In that, like, shouldn't we have some weights here? And really understanding that, okay, the ones that are rated highest are the ones that are probably remotely exploitable or on services that are of that nature. And then a lot of the ones that don't get exploited, yeah, they're not going to get exploited all over the place, but they are bad. They might be a secondary link or an island hopping sort of event when they got local access and suddenly they have root access. Also, there is, I mean, they go on and on and on in this article, which we'll have linked in the show notes about how great their data is and how they've collected this research from a multitude of different sources, et cetera, et cetera. Ain't nobody reporting breaks into their systems unless they have to. Like, ain't nobody, right?

So if you have a breach and you can get away without telling anybody about it, you're not writing a press release. Absolutely. You're not submitting it to a database. So, like, I don't know. Auditors have to ask first, right? Yeah. Like you have to be in an industry that is forced to disclose, which is some industries, but not all industries. That's why we don't take personal data here at Jupyter Broadcasting. That's right. We are GDPR compliant. That is for sure. The thing is, you know, not patching your machine is an attitude, bad attitude or a bad routine.

And someday it will lead into problems. So it's never, never a good thing. But apparently if you're playing the odds, it might be, you know, you might be all right. I don't know. I mean, we should do it for science. Let's find out. Someone said that during their security job interview.

How do you handle security? I just play the odds. Eh, I don't bother. Someone said that during their security job interview is how do you handle security? I just play the odds. Yeah, I don't bother. Hey, that's what Sony did. You know, somebody ought to just put

their machine out on the internet and not patch it. Actually, somebody's done that before, right? I just install all this software no one uses.

How do you handle your security? And they'll just respond, obscurity. Problem solved. Just add one to every port. Well, and I didn't just make a Telegram sticker that says,

don't patch your shit, so. You know, I think we need a, is there, do we have a Bratz, Bratz to the front of the line sticker? We don't yet, but it's on the list. And I've already got the middle image in my head. Big juicy Bratz. Bratz to the front of the line. What about Resilience is Futile?

That's kind of cute. That's kind of cute. That's kind of cute. Guardiansofthematrix.org. I was looking at this thing not booting, and I said to myself, I said, all right, you're either going to take this all the way to the end and not stop until you get it booting, or you're going to call it right here. And I looked at it, and I thought to myself, I said, you know what, I'm never going to switch to this.

I'm going to call it. That's the first time I've ever done it. Like, I've never allowed myself to not get it installed. It's like, I got to talk about it on the show. What am I going to do? Go on the show and say I didn't get it installed? Like, I can't say that. That's ridiculous. How long can you talk about it? But like, but then like, what's funny is like, none of us really wanted to admit to each other that we couldn't get it going. So like, it just sort of started becoming obvious that we were all struggling. No one had made any serious observations about it. And so it's like, oh, okay.

But then I had to then call for the Shroud of Silence. We have to call down the Cone of Silence because now we can't talk about it. Now we've got to share our experiences on air because I think we've all had a bad experience. So I genuinely did not know cheese had got it working. So out of all of us, the design guy on the team got it working. That's what I'm thinking. You guys have worked in Linux for years. And here I am just like, okay,

DD it to a flash drive, zip file, okay, whatever. This is my homework for the evening. Yeah, it looks nice. It's got a nice UEFI GPT setup. It should boot just fine. I mean, it's got like a nice UEFI GPT setup. It should boot just fine. I mean, I was doing like PCI pass-through.

Maybe I just over-engineered my KVM, maybe. It should be said, too, that the easy installer is maybe not so friendly. I mean, it's easy. But so if... Don't do this on a machine that you might want to sacrifice you might not want to sacrifice because oh yeah like it just goes to town and then whenever you yeah whenever you light up the script the python script for the installer it's basically sda right done yeah it only takes two minutes but it doesn't give you any other options to um you know like they have with their usb installer which would be nice to have that built into the gui installer

so that you could just boom put it over to a flash drive like i could see that being useful in this scenario but it is also kind of a large image it like almost four gigs i think it's like three and a half gigs or something. Yeah. Yeah, true. So, yeah. That's good advice, though. I had that problem with an early edition of Clear Linux where I was installing it on a laptop that I hadn't really,

I hadn't planned to wipe the whole thing for. Right. Right. Yeah, good point. That's so great when you're like, when you've been doing this for a decade and you still make that mistake. It's the best.

I definitely prefer doing it in VMs now. Like, I don't, I'm trying to go for a, I'm trying to go for the entire lifecycle of Fedora 30 without reloading that laptop. So I don't want to repartition. You have worked at it.

It's impressive. Yeah, that's why I'm trying to get this VM stuff all set up. But today, I just couldn't get it going. Had to call it. Congratulations, Cheese. Thank you.

You win the Linux hat. Oh, yeah? For this one. one yeah i don't know if we do it's also red i'll take it i'm just discovering now that uh i guess on my usb drive that i tried to install it with um i've got cheap party complaining that my backup gpt table is corrupt so that's maybe not a good start. It's destructible Linux. It just cleared everything. And then in the documentation I read, and I sent this to Wes yesterday,

that as a warning, it says the USB installer will deploy the resilient Linux initial ISO image onto all the inserted and listed USB devices, thus creating complete resilient Linux operating system. So whenever you got plugged in, it sounds like things are going to install too, which sounds kind of dangerous considering I had my backup drive installed.

Well, I immediately thought about Clear Linux whenever you had thrown this distro my way. I was thinking, you know, this is a super interesting way to handle this sort of thing. You know, just diffing everything is a neat way to do it. And I think that there's something there, but it's an early release. It's two guys working in a garage in their bedrooms or whatever, and this is their summer passion project or something, you know.

They could be a lot closer than we're giving them credit for. It could be just a few missing pieces. That's kind of what I like about it is, like, you never know. You just, with distros, you just, you never know. You don't want to count everybody out like this because every now and then they'll surprise you think about before people really use that arch linux thing or if there's one thing that the resilient guys do that it's taken off to another project to benefit us somewhere else yeah sure so next week bedrock

lfs bro oh no we're not getting back into this again Gen 2 Challenge take 2 Gen 2 2019 you should do the crux because of the inspiration of Arch

that's right yeah damn right and also Brent's apparently sorted history with it I thought it wasn't in existence anymore well that's even more

reason than yeah it was last year but it might not be anymore that's what we should do is Caldera Linux