LINUX Unplugged - 398: Back in the Freedom Dimension

Episode Date: March 24, 2021

We share our favorite networking trick of all time, and then chat with the blokes behind a new WireGuard-powered service. Plus our reaction to RMS's return to the FSF, some big project updates, picks, and more! Special Guests: Dalton Durst and Danielle Foré.

There's a lot of news today in the show, but this one, I'm just still reading the room. Microsoft is said to be in discussions to buy Discord for over $10 billion. And you can see the advantage for Microsoft. They could immediately get a very relevant chat platform. There's potential integrations with their Xbox chat platform there. And they'd probably be willing to architect it in a way that makes surveillance entirely possible like they did for Skype. So it's just a win for regulators.

It's a win for corporations. It's a win for the Discord founders. It doesn't feel like a win for the users, though. And I wonder if this is going to be like a Matrix sale, essentially. Everybody check out Matrix. It's over here and it's great. What? You don't think they'll open source it?

No, Wes. I don't. Hello, friends, and welcome into your weekly Linux talk show. My name is Chris. My name is Wes. Hello, Wes, and yes, I am smelling what you're cooking, but I'm just not sure about a crockpie in the studio. Oh, you'll see later, buddy. We'll see about that.

And I want to thank A Cloud Guru for sponsoring this episode. It is brought to you by A Cloud Guru. They are the leader in learning for the cloud, Linux, and other modern tech skills. Hundreds of courses, thousands of hands-on labs. Get certified, get hired, get learning at acloudguru.com. Well, on today's episode, we're just kind of having fun because we're getting close to 400, and we wanted to share one of our favorite WireGuard-powered tricks to get around your ISP and get any system you have behind a NAT, a public IP, and accessible from the Internet.

We do this often so that way the chat room can abuse a box that we have on our LAN. So we've set up a hotbox on Linode, and we'll walk you through our favorite way of accomplishing this trick. It's pretty straightforward. And we'll also chat with a new business that's built on top of WireGarden Linux that's trying to make this even easier for you. Plus, we have a bunch of community news. We've got feedback.

We've got probably some pics if we've got time, but more importantly, we have our esteemed room of internet experts. Time-appropriate greetings, Mumble Room. Hello, Virtual Lug. Hello. Hello, Chris. A special hello to Dan the Rabbit

in there from Elementary OS. Hello, Dan. Nice to see you. Hey, how's it going? Also, Dalton Durst from Ubuntu Touch Project is in there as well.. Hello, Dan. Nice to see you. Hey, how's it going? Also, Dalton Durst from Ubuntu Touch Project is in there as well. Hello, Dalton. Cha-cha! Hello. Good to have you. Of course, lots of friends. We have lots of friends that we always have, returning friends too in here. So, Brent, it's good to

see you. Been a little bit too. Hope you're well. I'm good. I'm good. Thanks for having me. And of course, thank you to everyone who makes it all the time. We've got 17 people in there in total. We have some in the quiet listening and most everybody in the on-air room. That's one of the things you can use our mumble room for is just a live, low latency, very, very low latency, high quality audio stream if you just want to live stream using free software. And then the whole stack's free because we're doing it on Linux using free software and you'd be listening on free

software. So that's a cool way to listen to a podcast about free software. But we really actually have a lot to get to, so I should stop fooling around. And there is some breaking news this week. This is CNN Breaking News. By the time we come on the air, it is becoming more and more known that Richard Stallman is back at the Free Software Foundation on the board. He's not running it like the president, but he is on the board.

And Stallman, as we have talked about on the show before, he is a hard man to like, as Lawrence Lessig put it. He's driven. He's often impatient. His anger can flare at friends as easily it does foes. And he is uncompromising. And he is persistent. And he is patient.

That is something else about Richard Stallman is he is waiting. He's willing to wait for a long time. And so this week at a live event, he announced that he was back. First, I have an announcement to make. I'm now on the Free Software Foundation Board of Directors once again. We were working on a video to announce this with, but that turned out to be difficult. We didn't have experience doing that sort of thing. So it didn't get finished.

But here's the announcement. Some of you will be happy at this and some might be disappointed, but who knows? In any case, that's how it is. And I'm not planning to resign a second time. It was a while ago. It was before the pandemic. It was September 2019, just a few months after the world had learned about the horrific sex trafficking operation run by the influential billionaire Jeffrey Epstein. Revelation after revelation had come out about powerful people and influence, and MIT got wrapped up in all of that. Epstein had donated $850,000 to MIT's Media Lab. He had visited the campus many times, and of course he had associated with several professors and administrators there.

Now, RMS wasn't one of them, but an associate of Stallman's, Marvin Minsky, who was an AI pioneer at MIT and passed away in 2016, was involved with Epstein, and allegedly in some very serious ways. When that information became public in 2019, it created quite an upset. In response to that upset, protests were planned at MIT. The organization of those protests was done over email,

and it was sent out to several email lists. Richard Stallman was on one of those lists. as you would imagine, since he had affiliations with MIT, and he replied all. And in a very typical Stallman fashion, he took issue with how words were being used, specifically the term sexual assault. And in a very insensitive to the moment kind of way, went on a whole diatribe and rant about the use of the term sexual assault that email thread made into the hands of an mit alumni who then forwarded that email to reporters but really the reporters didn't do much with it so she then turned to medium and she penned a post entitled remove richard stallman and everyone else horrible

in tech that post did get traction, specifically on social media, and groups began digging into Stallman's past who were not familiar with Richard Stallman. They began unearthing lots of objectionable content that you can find on his personal blog. From there, with the connection to Epstein and the content on his blog, things escalated very quickly, and regular media outlets started reporting on the incident.

The pressure grew on Richard Stallman and the FSF very fast, so Stallman resigned from MIT and the Free Software Foundation, which he founded in 1985, a week after he sent that reply all. And it's been since September 2019 that he sort of laid low. Did I make a prediction that he'd be back, Wes? Was it this year that I predicted or was it last year? Yeah, I think you did. We'll have to check the archives after the show,

but I don't know that any of us expected him really to be gone forever, at least in all capacities. Did you expect to be back on the board? That I'm not sure about. Yeah, it seems like this you expect to be back on the board? That I'm not sure about. Yeah, it seems like this was supposed to be a splash, but they kind of bamboozled the announcement video, and so they just kind of casually said it in a low-attended live stream.

Is it possible this is hidden in here as sort of a diss on free software video editors, and that's why it was so hard to put that together? Yeah. This, for the FSFF is a key moment, and there will be some that decide that they no longer feel represented by the FSF. And you may see some other organizations stand up. I mean, it's been around since 85, so it has quite a history. But that has to be, I think, in a sense, it's going to be a social forking

that's going to happen. Yeah, I mean, it seems like we're sort of evaluating here. It's not really clear how this happened. Yes, he's now listed on their website, but there wasn't a lot of clear, at least at first, sort of announcements around these changes. And the way he says it in that video is sort of like you get the idea that there's some force of will being here. You know, he seemed to want to be back. being here. He seemed to want to be back. It wasn't said in a way that sounded like, well, after discussing it with all the parties, we've determined this is what's best for the Free Software Foundation and the advocacy for free software. And that's where it's tricky.

It's like, okay, we want to support free software. We want to support these ideas. But what does the Free Software Foundation do? And who do they associate with? What are their parties? And how do they advocate? And does that match our goals? And you kind of have to suspect and wonder if this wasn't the plan all along, you know, lay low, wait for the temperature to drop on this. And then when we feel like it's safe to do so, we'll bring you back to the board, perhaps. I mean, how else do you get somebody as radical as Richard Solomon to step aside without some kind of perhaps compromise like that?

Regardless, he's back and he has a renewed focus on the problem of web apps. And it seems the pandemic has made him think more about this than he has in the past. There used to be a few of these, but there are lots of them now. Government websites are inaccessible. For instance, the House of Representatives website, without running JavaScript code, non-free JavaScript code, you can't see a page, any page. The whitehouse.gov interface doesn't allow you to send a message. Various Massachusetts websites don't work. The websites to get vaccinated for COVID-19, sites to get vaccinated for COVID-19, something that you should definitely do, don't work without running non-free JavaScript code. Fortunately, you can make appointments in some places by phone. And that's what I did. And I listened to this and I think, boy,

this is a tough position. If the bar is even all JavaScript has to be open source, which understandably would be for him, and I look at the direction and trend line things are going, I don't think he has any influence in this. I think his influence has waned. He says we have to move away from web apps entirely. I've been talking about web services and their web apps. Well, one bad thing about them is how they depend on running non-free software on your computer and send it to you, and you have to know to stop it. But they do other bad things, too. For instance, web apps frequently spy on users, mislead users, can sabotage users. And so we need to move away from web apps. If you depend on a web app, you're depending on something that some organization can change on you at any time. It can sabotage it totally. It can impose new conditions on you, anything at all. So I call them online disservices because what they do to you is not, in my opinion, a service. He's got a joke in there.

Pithy as always. Yeah. Doesn't it feel like, Wes, especially after the work from home, school from home year that we just had, that we are further away from this than ever? Web apps are more dominant and in use than ever right now. Yeah. I mean, as ever, right, he's not wrong in spirit,

but it's just so far away from what the norm is. And I think from pushing any of this sort of compromises that we're actually likely to see successful, you know, we need to think more about privacy and data sovereignty and ownership. And okay, maybe I do need to pay some proprietary service over the network to do a job for me, but how can I make sure that that's reasonably in my favor?

I'm not going to get to the point probably ever of being able to dictate what someone I exchange data with over the network runs on their side. That's just part of the internet and the web, right? We can't enforce that. But if we can set up some better frameworks, and it just doesn't feel like that's where his head is, I mean, maybe we'll see if there's some interesting things. He's certainly contributed a lot,

and I'm not proposing we erase Richard Stallman in any way. It just doesn't seem like he's connected enough to what's going on in actual popular culture to be an effective advocate right now. Right. Mini-Mc, there's a message here that is worth listening to, but it's like we need a spokesperson or maybe a group of spokespeople that are not as polarizing as RMS. Yeah, you see, I totally agree with what Wes just said. And still, I think we need, even though his positions might be a little bit extreme, we need some people like him in the Linux new community.

We need this little talk in the background that tells us, yeah, have a point on open source and try to use software that is open source. So I think he has his place in our community. And we've all thought about this, about web apps. Like here I am on my full free software system, and I'm connecting to a proprietary web app. And I guess my comfort level with this has always been as free as possible. Like PyCrash points out, you could GPL the JavaScript.

I mean, you could. So that's an option. But I live in a kind of a more reality-based situation where I kind of feel like where I want to really focus on free software is the core of my OS. What makes my computer boot and function,

how I access the hardware on my system, I like that to be free. Then I really like my user land to be as free as possible. My desktop environment, my mail client, my web browser, I all have preferences to use free software there. Then there's like another layer. It's like the nice-to-have-ities that I don't think would destroy the computing experience

if I couldn't launch Slack or Steam. And it'd be nice if they were open source, but I want them to run on that free software stack, number one. And so it's the lower you go in the stack, the more important in my mind it is to be free software. And for some reason, that means websites are kind of like at the top of that stack. They're kind of like the furthest removed from me. And I somehow have just gotten used to the fact that these damn websites will just change on me with, and that's something he goes into more in his talk that these websites will just change. The UI will re change and you

can't go back to a previous version like you can with physical software. But that's also just sort of the trend line of development. And in some ways, it's a positive. And it's just not a black and white issue. And I think where RMS loses touch with the rest of us these days is that he cannot connect with that position at all. And while you do need somebody who tugs at these ideals, you have to do it in a way that doesn't seem so extreme that it's unable to be processed. And so I don't necessarily, I can't really see this being a net benefit for the free software foundation. But, you know, time will tell. Really, we will see. It's one of those stories where we can only just say, we'll see what happens sort of like the first time back in

September. Well, let's move on, Wes. Let's talk about something that's coming a little bit down the road, something a little more entertaining and exciting, perhaps something you'll want to catch yourselves. It's the Elementary Developer Weekend, and Dan's here to tell us a little bit about it. Dan, welcome back to the show.

Hey, how's it going? You know, pretty good, Dan. You know, there's a lot going on these days, but I'm feeling like it's time to talk about something else. And you apparently wanted to have more work to do, Dan. You know, I wake up every day and I'm like, I don't have enough things to do. What more can I pile onto my plate? Because if I'm not completely exhausted,

there's something else I could do. Right, of course. So you have the Developer Elementary weekend that you are announcing. It's the very first of its kind. And it feels like perhaps something that in the past would have been considered as an in-person event. But with the current COVID situation, it's a great opportunity to try something virtual and see how it works, I imagine. Yeah, absolutely. And, you know, this is something we've been thinking about for like a long time,

and we've always envisioned it as an in-person event. But in-person events are like really expensive. And so there was kind of, like you said, this opportunity to go, huh, well, maybe we can try it online first and see what happens. Yeah. So what's the idea here?

It looks like there's a call for papers. It's going now until April 20th and looking for ideas and talks. What kind of stuff are you guys looking for? Yeah. So kind of like the whole thing is that, you know, we've been to a lot of different like open source software conferences and there's kind of like two big things. There's either events that are like really inclusive and for everybody, but aren't necessarily technical or they're more like expo focused. And then there's events that

are very technical, but they're usually like, you see a lot of the same people there and they're people that are kind of already insiders in, in the free software community. And they're usually the people that are like making the platforms themselves, like, you know, GNOME developers and KDE developers and stuff like that. So we want to really create an event that's about app developers that are people that aren't necessarily on the inside in these communities. But then it's also a really technical event. So we're asking for people to either submit ideas of things they would like to see, or to submit talks that they would like to give that are focused around development and building applications.

And we want to create this really educational space where we can help people be the best app developers they can be. And that could lead to some great Linux desktop apps one day. So the website to check it out is edw.elementary.io. And of course, we'll have a link in the show notes where you can suggest an idea or submit a talk. And rumor has it, perhaps, your humble host here may be involved to some regard.

I don't know if we've really sorted out how much will be on air or not. But if nothing else, we're going to be here pushing buttons to make it all happen. I like that it looks like submitting a talk is done through GitHub. This feels very open source. Yeah, good idea, Dan.

Yeah, we've really been trying to stretch out the new discussions feature in GitHub and thought this was a really cool way to do it because you can kind of vote on subjects too. And since it's a developer-focused thing, people don't have to create an account in some special presentation software. They probably already have a GitHub account.

So we're trying to go where the developers are at. Clever. And I like that you've thought a lot about the format as well. I know that's something that you and I talked a bit about off air, but how to do it where the presentations are, well, quite frankly, presentable and enjoyable to watch and easy to understand and still have the optional component of interacting live with people and all of that. So I think you guys have got a clever idea of how to sort of formulate it there

that has taken a lot of the lessons learned from the virtual events we've seen over 2020 and kind of brought a lot of the best ideas together. Yeah, I really hope so. I mean, this is our first event, so, you know, like, not going down in flames would be awesome, but also being able to do something really, like really useful and fun for the community would be cool. I just want one day to just have... I want this to be successful so that one day we're doing this in person. We're drinking beers. We're hanging out again. It's like a full nerd event. And so this is the first step, I think.

Yeah, and I think that's the best part about creating these kind of conferences is like hallway conversations and, you know, going out afterwards and like really that community and camaraderie and friendship. So hopefully we can springboard from this into like a much larger in-person event. Absolutely. Well, Dan, thanks for joining us and telling us about it. Yeah. Thank you very much for giving me a space to. And also here today on the show is Dalton from Ubuntu Touch, and they just had a new release, OTA 16. And Dalton joined us on Linux Action News to go into some of the details and nitty gritties about the release.

And it's looking like it's running pretty sharp on the 3A, Dalton. Oh, you got it installed? No, but I went YouTube spelunking. So it turns out it's not Wes that has the 3A. So I wasn't able to take his phone and flash it. Man, you got me so excited. And dang it, you still took my phone. Yeah, well, I just wanted to wipe it. There's reasons. Let's just put it that way. Also really cool that we are almost at the four-year mark since this became an independent project. Yeah, it's kind of crazy to think that. I mean, April 5th, 2021 is our four-year anniversary.

Man, does it feel like it's been four years or does it feel like it's been 10? Both. It's like having a kid. Yeah, it's interesting because I know you guys have been really super committed. It feels like it's just been, it just feels like it's been a, it's been a four year push really, but it kind of feels like it's coming together. You know, I mean, of course there's a transition to 2004 on the horizon, but right now it looks like it's getting pretty solid.

The pixels out there, the volophones out there, the 3a is a great phone. A new Samsung phone just got support. I mean, it's kind of all coming together right now. It really does feel like that. It just feels like we're in a really good, decent place to work on the project and, you know, do things that we think are fun in addition to things that move the needle forward. Well, you know, Dalton, something we didn't touch on in the Linux Action News chat that maybe we should touch on here is I didn't realize that in their effort at Volaphone to support Ubuntu Touch, they have set up at least some people

in their offices that are supporting Ubuntu Touch directly. Like, they're developing and working on Ubuntu Touch now and getting paid by Vala, right? That's correct, yes. That seems like a big development. Can you give me an idea of how long you expect that to be and how big of an impact you expect that to make? Ooh, how much can I say about...

Yeah, I understand it could be kind of tricky. So what you are comfortable sharing is fine. I feel like it's a long-term investment for them. They feel like this is important to their platform as Vala and to mobile use cases in general. There is some other cool stuff coming up that I don't know when it's going to come to fruition and especially not, you know, in full light, but I can just say it's really cool and I can't wait to talk about it. And it'll probably be more reason why they would need staff to support the OS, I would imagine. Yeah. Yeah. Okay. Interesting. That's

really exciting, man. I'm getting kind of like to the point where I'm feeling kind of ashamed that I'm not running it on a device currently. Like that's the state it's gotten. It's like, oh, this is something I need to start checking in on now. Should I wait until the transition to 2004 or should I just go for it? I'd say just go for it. Good answer. Very good answer. Well, Dalton, thanks for coming by and updating us. Thanks for bringing me in. It was good to chat with you.

Go check it out. OTA 16 just came out last week, and we will have a link to that in the show notes and more details about the release in this week's Linux Action News. Now, something that we don't have details about yet, but I just want to let you know that if you are running the security updates for any of the boxes, if you're responsible for that, the OpenSSL project is bracing us for a big update. They are announcing an announcement, and they're telling us that there will be a new release of OpenSSL on Thursday, the 25th of March, 2021. And they're even giving us a time range between 1300

and 1700 UTC. It's a security fix for a high severity issue. You just don't see this very often, Wes. No, I guess we know exactly where our sysadmin friends are going to be. Yep. Maybe it's a good time to rob them. Wow. Wow. Yeah, because you know this is going to be really public, right? So this is one that people are really going to need to jump on. Yeah, we're going to try to get full coverage, a full breakdown in Sunday's land because we should have all of the information by the time we're recording Linux Action News. We just don't know much right now.

We could speculate, but that just wouldn't do anyone any good. So we won't. Linode.com slash unplugged. Go there to get a $100 60-day credit towards your new account and go there to support the show. $100 means you can really try it out. You can do a lot. Linode is our cloud server provider. And what we're about to tell you about just in a few moments was done on Linode is our cloud server provider, and what we're about to tell you about just in a few moments

was done on Linode. We always use Linode for these experiments because it's super quick to spin up a system. It's really easy. It's also really easy to clone them and back them up and take snapshots. And so within minutes, we'll get something up and running, and we can take a risk.

We can take a risk of breaking something that might destroy the networking, and then we can't connect to. We can take a risk of breaking something that might destroy the networking and then we can't connect to it because it's really easy just to revert back. So that kind of flexibility makes it super easy for Wes and I to prototype ideas for infrastructure, but also for show segments. And I know that that would translate for your projects as well. And so I think that's something worth just using the $100 credit for right there. But personally, one of the things that I really like about Linode as a longtime Linux fan, don't know if you knew that, but I've liked Linux for a little while. They really support just about all the Linuxes and even some of the ones you might

not want to run in the cloud. But you know, you got your reasons. Even the SUSEs, even the SUSEs, actually, of course, the SUSEs are up there. They have a bunch of distributions they support. I like that a lot. But there's other features we play more with now than I expected. Like I'm always constantly finding new ways to use object storage for back-end storage for things that, especially things that are shared between systems or when we need to like send like a segment to a sponsor or an interviewee. We're using object storage for that now too because a lot of times they're bigger than what a lot of email server attachments support. And so we just use the Linode command line tool to pop it up on the object storage and generate a public link. It's fantastic. It really is nice to just find ways to integrate it into

your workflow because these tools are really good. Like some of the stuff we're about to talk about, you could achieve with Linode's cloud firewall. They started in 2003. And so they've had time to really focus on how to do this right. They haven't gone off and tried to create every single different service under the sun and do all this different stuff. They've really focused in on what they're good at, and over the years, they've built something really awesome. You know, in 2016, they took over control of their networking and became their own ISP. On some of their dedicated CPU rigs, they have some really high-end AMD EPYC CPUs that are just crazy fast.

They have great disk I.O. They have fantastic network connections, 40 gigabit connections coming into the hypervisor. They're dedicated to offering the best virtualized cloud computing. If it runs on Linux, it runs on Linode. But go try it yourself. I mean, $100 really means you can actually try it. So go over there and give it a go. And support

the show. Linode.com slash unplugged. We have some potential news for the Linux kernel. And it's pretty exciting, Wes, because it involves one of our favorite technologies. Uh-oh, I think I know what's coming next. Next. Initial support for the Rust language has landed in Linux Next, which I assume you all are probably just running it already. But for a long time now, Linux kernel developers have pondered the prospects of allowing the Rust language to be used in kernel device drivers.

Kernel device drivers, which could be a particular area of interest for Rust and could potentially bring some of Rust's best features like safety and performance to device drivers. So announced just recently on the Rust for Linux mailing list was word of initial Rust support hitting Linux next. Although the announcement was quick to note that this does not mean we'll make it into mainline, of course, but it's a nice step to make things as smooth as possible. Of course, another issue with all this is support is obviously conditional on having a Rust compiler on the system that you're building the kernel on. That's a good point.

But really, if you think about it, that's kind of a good place to start for this kind of thing. Because you're going to have less platforms you're building forward anyways with device drivers. They target fewer platforms to begin with. And it kind of seems like there would be a lot of benefits to drivers in Rust as well. And it's not an area that's going to really break anything major. Right. You're not like rewriting the whole kernel. You're just saying, hey, I've got a new device. This was going to be new code anyway,

or maybe it's some old code that was never very good. Let's see what it looks like in Rust. While Rust is now in Linux Next, we should be clear it's not yet known if it's actually going to get into mainline. That depends on some stuff. How does Linux Next bake? Could stay in there for a while,

could end up never getting merged, but it's a step in the right direction. And it seems like some of the kernel leaders, including Linus, have some thoughts. Yeah, that's true. Greg KH has chimed in on the matter. They all kind of have an air of skepticism, as they probably should regarding this issue,

I would imagine. You know, kernel, they've talked about this, but they've kind of looked at it as, okay, we can give it a go. Linus Torvald says, personally, I'm in no way pushing for rust, but I'm open to considering it. The promised advantages of avoiding some safety pitfalls seem good, but I also know that a lot of times some of these promises don't pan out. Isn't that true?

The part that I like in this is just sort of, you know, getting support for this, people not saying no, and letting people hack on what that initial implementation looks like, you know. How does this play with the existing methods and data structures that exist in the kernel? Can people figure out some of that low-level integration work so that down the road, maybe we can benefit from the pool of people that already know Rust and want to contribute a device driver but really didn't want to do it in C? There you go, Wes.

We knew eventually it would make its way. Will it ever actually ship? We will see. But Rust is invading the kernel. All right, let's tidy it up a little bit around here. I want to let you know to keep an ear out for episode 401 of your Linux talk show. 401, I chat with someone who ended up building a Linux-powered bus to automate, to build, all of it. He didn't know any of it. He didn't know Linux.

He had to learn it all from scratch at each step of the way. And I sit down for a chat with him, and we discuss that, and that is coming in episode 401, which means we're taking 401 off. Well, we're not taking it off, but we won't be live because it'll be prerecorded. You know how that makes sense? So if you're subscribed, you're going to get it. Probably don't even need to mention it, but I wanted to let you know that if you do like to join us live on the 13th,

we will not be live as a result, but then we'll be back to our regular bat time after that. All this is just easy to keep track of in our Telegram group at jupyterbroadcasting.com slash Telegram, so you can join that. Maybe if you were going to join live, use that time to figure out your mumble setup if you haven't done that already.

Yep, we have that link at linuxunplugged.com. This Sunday as we record, so coming up really soon, I want to encourage you to join the LEP Lug. Minimek, you have some details about a great Lug session coming up this Sunday. Yeah, what I can say, LEP Lug is going strong, and we will have another recording next Sunday, and there will be the presentation of a tool called Meerschaum. So if you have seen the movie National Treasure, you know what a Meerschaum pipe is. So now I could try to tell you about that project, but we have the developer of

the tool right here in Mumble. So Bennett, tell us what you will be talking about. Thanks, Minimac. And hey to all you sysadmins and Linux lovers out there. So in the next Leplug this Sunday on March 28th, check jupyterbroadcasting.com slash calendar to get the time in your time zone.

I will be presenting a passion project of mine called Meerschaum. Meerschaum is an open source data management system, which makes getting your time series data onto a dashboard

as quick and easy as possible. I'm always looking for feedback and user testing. So if you'd like to help out, please join us in the next Leplug. You can read more about Meerschaum at meerschaum.io or mrsm.io. I hope to see you all next Sunday. That's going to be great. Like you said, the dates and time are on the calendar. There's also a Luplug channel on our Matrix. If you want to jump in there and start chatting, all of the info, the Mumble info, the Matrix info, it's all at LinuxUnplugged.com.

Just make it easy. You just go over there, and you'll find it all. And with that, that's all the tidying we have for this week. So we wanted to share our favorite network trick with you this week. It's something that we've done in various iterations over the last year to let the chat room come in live and abuse a machine we have on our land. I mean, obviously, I don't want to expose the studio's public IP, but I want to give people an IP to connect to so they can interact with what we're doing. Some of you may also have a desire to self-host something at home,

but perhaps your ISP blocks ports, or maybe like me, you're behind some kind of crazy carrier-grade NAT. There are ways to get around it. And one way to get around it is a new service that's launched called Hoppy. And this is a way to do what we're about to tell you about, but just do it real easy through their service. And it's also one of the reasons that Wes and I have been so keen to follow WireGuard, because we knew since we saw the announcement that when it landed in Linux distributions

and made it into the kernel, it was going to enable all kinds of network connectivity, fun, trickery, and solutions that we hadn't really seen before, and make some older solutions that are still viable, but make them seem a little obsolete. And Hoppy is a good example of this. Hoppy.network has created a business built around WireGuard and Linux. It's a service that lets you get a public IP on a machine behind an ad, which is a big win for us self-hosters. And I chatted with both the co-founders this morning

to get an idea of how it all works. I chatted with Yoon. My name is Yoon, or Yoon Sik Park, and I am the co-founder of Hoppy Network. And his other co-founder, Logan. My name is Logan Collins, and I am a co-founder at Hoppy Network. And I asked them to give us the elevator pitch on what Hoppy is so you guys could understand the value. Hoppy is how you can lease a IP address, a public IP address, and attach it to any device that you want. It's a way of making a device public to the world and bypassing any kind of inconvenient networking situations that you might have. It's a way of enabling you to self-host your own services and take back a little bit of control in the digital landscape that's been changing over the last couple of years. I like this idea. I knew why Wes and I wanted to accomplish something like this.

So I asked them what was their motivation. It kind of arose out of my self-hosting journey. I was trying to decrease my reliance on iCloud specifically, trying to self-host everything. And the biggest roadblock was self-hosting a mail server. And the reason is, like, most ports are unblocked at home except for, like, SMTP or port 25. And that's because, like, this port specifically is

used to spam others. And a lot of ISPs want to block that there wasn't a way I could really get around that without putting my server into the cloud again. And I thought, is there a way to get a IP address and unblock ports within my own home. And I was looking into different VPN services that could accomplish that, and there wasn't really anything like that. And I spent like a few months learning about networking, and what I came up with was like a prototype of Hoppy Network that would actually accomplish that. And like you probably are right now, I was wondering, how does it work?

And like you probably are right now, I was wondering, how does it work? Each one of our servers, they use BGP to get access to an IPv4 block, as well as an IPv6 block, but I'll just simplify it for now. And that slash 24 is then split up across the different WireGuard clients. So in our routing tables, we have each IP address routed to the WireGuard interface. So as long as you have that WireGuard interface connected to us, we'll try to forward

that IPv4 address over that interface. And once your client receives that packet, as long as your client is configured properly to assign that IPv4 address to its own interface, then it'll just accept IPv4 addresses as if it was like a native system interface.

To use an analogy that is horrible, but I still love using it. You can imagine these WireGuard tunnels between our server and yours as a giant Ethernet cable. That is just it's like you plugged in a new cable into your zero port or whatever. And you got assigned this public IP to that network interface. As far as your machine is concerned, you have this public IP address and we don't exist. All the ports are open because the traffic for that IP is coming directly to you. So obviously, my next question was, well, what about security, monitoring, those kinds of issues? First of all, we can't, nobody can man in the middle of you because the Connected FireGuard is fully encrypted. Between

us and you, the traffic is encrypted. Nobody can view it. It's really great. Between us and, can view it. It's really great. Between us and whatever client is connecting to you, your IP is public. You should be using SSL or something. We're not looking. We don't care what you're doing. And we have a really good privacy policy. It's less than a page long. Anybody can read it. It's something we adhere to. I think Logan's saying there's not much we can do other than that promise that we won't spy. And after we had wrapped up and I was Logan's saying like, there's not much we can do other than that, like promise that we won't spy. And after we had wrapped up and I was saying goodbye to them, they gave me another insight that wasn't prompted, but it was just something that came up while we were saying our goodbyes. And I thought it showed that their hearts really were in the right place with this

project. It's new, but I think their goals align with what we'd like to see. We hope that this service encourages people to self-host more. It also encourages IPv6 adoption because you get a slash 56 as well. Pretty much we want to make the internet a better place. Yeah, and that's about it. So cheers to them. Thanks for coming on, guys, this morning and chatting with me about it. You can find it at hoppy.network. And they've created a business around making it really simple for you to get around NAT using WireGuard. You just connect to their WireGuard instance they have hosted. Now, of course, you could do this yourself, too.

And so that's what Wes and I want to talk about today is while we found Hoppy during kind of investigating different ways to improve our solution for the studio. We thought, you know, there's probably reasons we could do this ourselves and would want to do this for ourselves and pondered how we could get around my extreme double-carrier-grade mutant net that I have at home and take advantage of that as well. Ugh, that thing. I mean, we've had to try a lot of solutions, and I think it's safe to say that your home networking is not exactly simple at this point. No, no, it's even crazier now that I aggregate two carriers. Okay, yeah, let's put that aside just for a second here. Because regardless, there are a lot of ways to solve this problem.

Probably a lot that the audience is definitely already familiar with, right? You've got things like SSH forwarding. That's super resilient. You can do all kinds of fun tunneling, take local ports and forward them, take remote parts and forward them, all kinds of stuff. Maybe you use a service like ngrok, which I suppose focus perhaps more on developers exposing HTTP services on the web, but does the same kind of NAT busting and NAT reversal and forwarding you and putting you on the public interface and proxying to you. That's also another approach, right?

Like you could just use a VPN like WireGuard and then a reverse proxy setup on your cloud host like Nginx or Traffic if you've already got multiple sites or you're just familiar with how those work or you want it to do TLS termination for you anyway. But of course, this is Linux Unplugged, we started things off using Wirecard. We do love it. And part of why we love it is because it's like, it's just so integrated into Linux at

this point, right? Especially now that it's merged into the kernel. It just makes it easy to play in whatever complicated networking setup you might already have, like Chris. Or if you just want to play with whatever tools are integrated that come installed on your Linux OS, once you've got WireGuard, all the normal sort of IP and Linux networking tricks that you might have, those work just fine, including what was maybe our first approach to this, which is just forwarding ports with IP tables over that WireGuard connection. Yeah, and you know, it's not bad. We use that setup for a bit. And this might be the one I would recommend for most people because it essentially becomes a cloud firewall. You allow

certain ports like in our case, 80 and 443 and only those ports. And so you're not sending every bot that wants to come knock on your SSH port over your connection to your home machine. You're blocking it there at the VPS level using IP tables. And so this is neat because you set up IP tables to forward those things down the WireGuard connection. It's a pretty simple, straightforward connection. It can be done with literally just a couple of lines of IP tables rules. I mean, very simple. Yeah. I mean, I think our sort of proof of concept was two commands, and that was it once WireGuard was set up. Yeah, and then you're just sending those two approved ports back to the machine, which I think is probably the ideal solution. But what if you wanted the entire machine?

Like, maybe you wanted to expose a firewall that had a WireGuard connection on it, and you wanted to then manage it at that firewall level. Right, or, you know, in this case, it's sort of, it's much like just running a proxy on the box. You kind of have to manage both boxes, right? Like when you add a new service on your back end, you've got to go tell the front end about it too and make sure that that's all working,

it gets properly forwarded and allowed, which, as you say, that can definitely be a good thing and you should take security seriously. But sometimes you just want to say, maybe you're not on a network where you could forward ports or you don't have full control, and you really just, as you're testing something out, you want to maybe you're not on a network where you could forward ports, so you don't have full control, and you really just, as you're testing something out, you want to expose this machine, put it in the DMZ,

get it right out there on the internet. And yeah, with WireGuard, you can do that too. Yeah, in fact, we have done just that. In your browsers right now, you can do it after the fact or while you're listening live, go to wireguard.club. I should make sure this is still up. Wireguard.club in your web browser. And what you will get is a beautiful, extremely intricate website that I spent hours building just for you that is actually running on a VM on the machine I have right in front of me in the studio right now.

I didn't know you knew web design. Look at that, right? It's pro work right there. Your connection will hop through a Linode running WireGuard back to a VM on my machine. So the VM has the WireGuard client active, connected to the Linode, which has been routing all of the traffic down here. So how the heck did we do this, Wes? Oh, boy. Well, yeah, definitely WireGuard is involved. And so we were just talking about

sort of the maybe traditional port forwarding approach. And in that style, you basically just set up your WireGuard tunnel and you've assigned sort of private IPs behind there, right? So you can talk between them. And if you're just on local host there on your box in the cloud, your Linode, your VPS, you can go hit that private service.

But you need IP tables to both forward the ports on so that things from the internet can get there, but also because the whole WireGuard system, you know, that's using private IPv4 addresses, you also have to introduce NAT. And sometimes you just don't want that. I mean, it works fine. Linux kernel's great at doing that,

and IP tables has no problems. It's easy to do, and many people have done it. It's just not quite as flexible. Maybe you're trying to do a complicated WebRTC audio setup, and you just don't want more levels of NAT involved. It turns out WireGuard makes this super easy. What we did on Linode in this case was get a second IP address and assign that to our Linode.

They make that easy, and tons of hosting providers do too, right? You just got to get yourself a second IP address. You need one still to keep the host accessible. But that second one, much like you just assign whatever arbitrary, say, 10.200.200.1 address to your WireGuard network, to whatever machine you're connecting to on the backend, you can just put the public IP address there. And if you're using something like WG Quick, we'll have a link in the show notes that has sort of an example set up. That example is using IPv6, but works just the same for IPv4 pretty much in this case. And WireGuard figures that out. So on the backend side, the system running right at Chris's fingertips, right there in the studio, we just told it, hey, this is your IP address for WireGuard. It's going to be the public IP address. And then on the server in the front end running in the cloud, you say the same

thing like, hey, here's this WireGuard peer that's going to connect to you. Here's the IP address that it's allowed to send from. And oh, yeah, hey, in the reverse direction, we're just going to send everything. So not only can you access all the ports on that, hey, in the reverse direction, we're just going to send everything. So not only can you access all the ports on that hosting machine, but the hosting machine, all of its traffic is going at that IP address too. So on that machine, it really just feels like this is your new public IPv4 address right out there on the internet. That's exactly what it seems like. It's so slick, and it's wherever you connect as a client from.

You just established the WireGuard VPN, and you could be it's wherever you connect as a client from. You just established the WireGuard VPN, and you could be mobile. You could be at a coffee shop. You could be at home. You could be wherever you connect from. It'll just send the traffic there. So it's really slick because I realized very quickly that this is kind of handy on my laptop because I could just turn it on briefly, send you the IP from wherever I was at, and you could connect to my laptop that I was sitting at at that moment. And then when we were done, I could just disconnect WireGuard, and it goes away. And that was super useful.

But I also thought, boy, this could be handy for just home systems that I want to turn on from time to time and get them exposed to the Internet. I might prefer the style where you use IP tables to just forward certain ports, but routing all of the traffic has the advantage of just, it's like it's a node on the internet, and then you manage it with whatever firewall you want. Exactly. I mean, how many times do you end up spinning up a VPS

just because you know, like, okay, this isn't behind any of my stuff. I don't have to futz with this weird router UI or play with any of that. Like, it's just going to be on the internet. What I run there will be public. I don't have to think about it beyond that, which can be good or can be bad. And I should say, this is sort of how people view NAT as a sort of kind of firewall,

just because you have to do that network address translation step to actually get traffic to go both ways. All you really need to do if you want to have that same sort of stuff is just not forward everything by default, set up a deny by default firewall. We're using a Fedora 33 box in this case on the Linode, so you've got firewall D there, or UFW, or in this case, actually, I disabled firewall D, got to tell you that.

And installed Firehole, which I just kind of like to use anyway. Wrote up a quick config. I sent it to you, Chris. I mean, it's really, I don't know, 20 lines long at most, right? And you just say, like, these are the services I want. You can allow all ports, 20 lines long at most, right? Yeah. And you just say, like, these are the services I want. You can allow all ports. You can block specific ports. Or in this case, we took the secure route, pretty much blocked everything except the services we knew we were running.

Now, it does mean you still have to do that, but I think what's nice about this approach is you get the flexibility. You can forward everything if you want, or you can lock it down a bit more. Or if you didn't want to mess with IP tables at all, you could use, like use the cloud firewall that's probably built into whatever VPS provider you're doing, like we could do on the node.

Yeah, there's so many options. And then ultimately, the even simpler route would be something like Hoppy.network, where you just sign up, I think they're using Stripe for the billing or something, and then you provision a box after you pick. They have like an $8 a month and an $11 a month, and it's like the difference between 1TB or 2TB of transfer. I signed up a little bit just to

try it out. And what you have to do as an end user is download a WireGuard comp and then just do a WG quick up the name of that comp if you put it in Etsy WireGuard and you're connected. So it's really just a matter of starting the WireGuard client and connecting if you want to use Hoppy. But the VPS side of stuff, like what we built up on Linode with IP starting the WireGuard client and connecting if you want to use Hoppy. But the VPS side of stuff, like what we built up on Linode with IP tables and WireGuard, it's good entry-level stuff. If you've been looking for a reason to learn a little bit about networking and a little bit about different firewall options on Linux, and you want to do something that could also mean maybe you could access a home system from time to

time, this is a really nice setup. And of course course we got you hooked up with links in the show notes where you can go through some of the steps and figure out how to do this and you could always go check out hoppy and see how they're doing it again get an idea and a feel for it and then go build this yourself because even if you really have never done any of this before with a few hours of of work and and reading you could have this set up and, you know, get it running yourself. I think it's a fun way for us to expose the system. And I'm looking at the resources right now. It's actually, I got to say, you know, I'm running it in KVM, Vert Manager.

And it does a good job of distributing the load. My memory usage is going up quite a bit right now on the system at WireGuard.club, but the CPU load is getting spread out pretty good. Yeah, maybe we should talk, I mean, like, all right, we were harping on about the cool aspects of the Linux networking stack, which we should because it's awesome. But you're also, I mean, running the Linux-powered virtual machine, and you're even running like a kind of interesting Linux distribution inside that virtual machine to power the website. Yeah, this was an opportunity for us to play again with Turnkey Linux, which I wanted just a quick VM that ran WordPress. I didn't want to spend many hours building a website.

I was joking earlier, obviously. And so we grabbed the Turnkey WordPress installation. And it really is a pretty good experience. It didn't take any fuss to get it up and running. And it had a decent WordPress site ready to go. It has integration with Let's Encrypt, if you want to go that route. Makes that really simple.

I was impressed. It had been a while since I'd visited turnkey Linux land. And what's also great, Wes, is none of this is really new hardware. These are like 2017 machines, and we've got a couple hundred people knocking on the door right now, and it's doing a pretty good job.

And I'm still using the machine to read the show notes and whatnot. Yeah, that was going to be my main concern. Going to break the show. Yeah. I know, because this one, it really matters. This one, it really does. But, man, this is a lot of fun.

It's one of our favorite things to do with WireGuard right now, and we'll have links to that in the show notes. And we'd love to hear how you do these kinds of things, because there's lots of ways to solve this problem. And probably some of them are pretty interesting. LinuxUnplugged.com slash contact. UnpluggedCore.com, if you'd like to become a member of this show,

support the show. Not only does it keep the show independent and keep us going and helps us cover the costs of production, but as a thank you, you get a couple of perks. You get two different feeds. Well, you could really listen to both, but then you'd probably have time for nothing else. So I don't recommend it.

So you must choose between door one and door two. Door one is a limited ad version of the show. Same full production, just no ads. Door two is the full live stream feed, which I have no idea what condition it's going to be in today because OBS crashed on us. It was a mess. So I have no idea, but, you know, it's everything. It's raw. It's like every time my mouth didn't work today or when Wes dropped an F-bomb, it's in there.

It sure is. The topics we talk about before and after the show that don't make it into the recording at all because we hit stop, and then everybody opens up and talks about everything, that's in there too. We got you, suckers. Well, for the most part. I suppose, you know, there's really no real replacement for really being here live, let's be honest. But that's what's in feed two, is like as much as we can pack in there. It's a whole show, pre and post show. It's basically a whole extra show that never gets released

because a lot of it's tech and Linux and open source topics that we're talking about. And sometimes that stuff actually does become a topic too in the show. So it's a way to feel like you've been here, like you experienced the whole thing. So that's speed number 2. And all of that, door 1, door 2, is at unpluggedcore.com, and you can become an Unplugged Core contributor.

And thank you to our members who support the show. What do you say we do a pick, Wes? Ooh, it's been a while. Yeah, it's been a week, maybe two. I don't know. But it's been a while

since we've had on-theme picks that match what we talked about in the show. That's for sure. And DSNet is one of them. And Wes, I have a feeling it's WireGuard related. Oh, yes it is. DSNet is a simple configuration tool to manage a centralized WireGuard VPN.

Think WG Quick, but quicker. And really the context here is, all right, so the box we were testing, that was running on KVM on one of the studio machines. While I was setting things up and playing around last night, going in and setting up Let's Encrypt, even though I didn't realize that Turnkey already had it integrated, so I hacked it on additionally, dang it. But I did that over a VPN connection,

a WireGuard VPN connection from my house, right? And how do we manage that? We've got multiple people with access to the studio, remote setups, Chris, you just lose your keys all the time and constantly have to add new ones when you buy a new laptop to play with. We're currently using Subspace for that, which is a neat web GUI project that we talked about, I think, last summer or so. Unfortunately, it doesn't really seem to have been updated since then.

And it was a little more than we needed. It had kind of its own custom database. Going and working around some of the lack of features meant I had to go into the container, restart things, disable it, really customize it more than I was looking for. And we're not managing a whole organization, but we do have a centralized WireGuard VPN. And we do want a way to record a name and description about every peer we're allowing and a way to add peers as fast as possible for when one of us sets up a new machine,

we just want to be able to go in there, add it real quick, give the key out to whoever's being added, and be done with it. And that's where DSNet comes in. Yeah, it's slick. I think we're going to switch to this. I think it's what we're going to use, don't you think?

Yeah, I think so. I mean, I've only just tried it out a little bit. We'll have to try it in practice for real and see if it holds up after adding a couple folks or redoing, modifying keys. That's my main concern. But it's kind of just enough. It's simple.

It doesn't have a GUI. It doesn't try to reinvent things. It's just a nice little shell interface that you can run on command line and get your stuff done. And we have a spot of feedback this week. This one's a special one because the author is in the mumble room. But Wes, why don't you read the highlights of it,

and then we'll engage with Bennett. Sure. Bennett wrote in to us, Hi, Chris, Wes, and the LUP crew. I just ran across this on the Linux subreddit. This engineer has been building a modular ecosystem for the Raspberry Pi compute module over the last several months. And it's nothing short of magic.

Think phone blocks, Project Aura for the Raspberry Pi. I'm talking hot swappable blocks for cameras, Ethernet, speakers, and even things like GPS and LoRa. And here's a demo video, which we'll have linked in the show note. The project's homepage is pocket.ai. Now, I know how much Chris loves his pies, so I thought it'd be a good pick for the show. Regards, Bennett. And boy, Bennett, were you right.

Yeah, Bennett, thanks for writing, and thanks for joining us in the Leplug this week. Now, what do you think? Is it real? I feel like we've had this promise so many times. So I just came across it yesterday and to me, it seemed like the holy grail of mobile computing. Google couldn't accomplish this with Project Aura. Phone blocks seemed like a pipe dream. And yet this single developer casually put up this video on the subreddit. And as I was watching it, I, the amount of disbelief kept rising as he kept showing more and more crazy modules. Yeah, it seems like there's a real big community of builders

and makers that are using the Raspberry Pi 4 compute module to build out even more fancier systems. On this week's episode of Self-Host, which, by the way, if anything we talked about today interested you at all, check out selfhosted.show. But on this week's episode of Self Hosted, we interview a YouTuber who set up 16 SATA disks to a Raspberry Pi compute module.

16 SATA disks. Like, it's all kinds of stuff they're building around that. And I wonder if maybe it takes something like a popular platform like the Raspberry Pi to make the modules a actual sustainable business, because there has to be enough users that could actually buy them to make manufacturing them viable. And it looks like on the post that I sent in the email, so many people were interested,

and it seems like the developer might be selling test kits in the coming months. Now, hardware, hmm, that changes things. Yeah, that would be interesting to see. So that is at pocket.ai, right? P-O-C-K-I-T dot A-I. We will put a link to that in the show notes. It does look really cool. I can't help but have

my really big skeptical pants on for this kind of stuff these days, but boy, would I love to see it. Boy, would I love to. That would be great. Well, Bennett, thanks for sending that in. If you'd like to give us an email here on the show, something for us to read,

something that I can make Wes read at least. At least one email so I can make Wes read it at linuxunplugged.com slash contact. I don't know, Wes. I don't know. I guess I just felt like trolling, I guess. I mean, I need a challenge. I acknowledge't know, Wes. I don't know. I guess I just felt like trolling, I guess. I mean, I need a challenge. I acknowledge that.

All right. Well, if anything we talked about today interested you, like I said, check out the self-hosted show. We talk about this stuff every other week. If you do the Twitter thing, you can follow this show at Linux Unplugged. The network is at Jupiter Signal. And there is an entire network of fantastic podcasts,

which can be found at jupiterbroadcasting.com. And if you're interested in the updates for the Ubuntu Touch Project, be sure to check out Linux Action News. And of course, we'll have the OpenSSL news in there as well. As of for this year's show, we'll be back at the same bat time. See you next week. Same bat time, same bat station. See you next week. Same bat time, same bat station. Oh, yes. Because the Linux does roll on.

Make it a whole Linux Tuesday. Join us live, 12 p.m. Pacific, 3 p.m. Eastern. Links to everything we talked about today, how to contact us, the mumble room, the matrix info, how to even subscribe. All of it. All of it. It's at linuxunplugged.com. What a great idea. A website.

Linux Unplugged. It doesn't have to be an app. It could be a website. Thanks so much for joining us on this week's episode of the Unplugged program. And we will see you right back here. Not on Sunday. Not on Monday. Nope.

Not Thursday. You guessed it. We'll see you back here next Tuesday. Hey. Thursday. You guessed it. We'll see you back here next Tuesday. All right, there was some bot shenanigans. So go to jbtitles.com and let's figure this out. Let's title this thing. Someone didn't start the show. I don't know who that could have been. Some sort of shenanigans.

J-Bot. Happy GNOME 40 week, everybody. By the time most people are listening to this, I think if all things go as planned, GNOME Shell 40 will have landed. Of course, most people won't get in their distro yet for a bit. But there is a Fedora 34 beta out too, right? Yep. I already approved it to land for this evening's update sync

for Fedora 34. So if you've installed the Fedora 34 beta ISO and then do an update from GNOME software or using DNF, you will get it. You hear that, Chris? We can switch the studio tonight.