LINUX Unplugged - Episode 230: Invest In Popcorn | LUP 230

Episode Date: January 3, 2018

Wes & the Beard kick Chris out to share their top tips for starting 2018 out right, plus a holiday surprise from Linux Journal, a new device for Google’s Fuchsia & an unfortunate new flaw in a processor near you.

This is Linux Unplugged, episode 230 for January 2nd, 2017. Welcome to Linux Unplugged, your weekly Linux talk show that's already forgotten what year it is. weekly Linux talk show that's already forgotten what year it is. My name is Wes, and joining me this week is the man, the man behind everything, the secret sauce of the whole darn network. That's right. It's Rikai. The man, the beard, the legend. Oh, yeah, absolutely. All of those things. All right. Well, it's 2018. All sorts of things are happening. Maybe not so much in the Linux world, except in the security front. You'll hear more about that as the show goes on. But we've got a good show.

We've had all kinds of technical and physical and perhaps even metaphysical problems today. But that's okay because no matter what, it's going to be a great day for the network. There's an Ask Noah coming up soon. Maybe you've even heard from him already today. Yeah, because of some of those metaphysical problems, the show is going to be shorter. Yes, it will. So this is going to be, you know, first of the year. We're starting out light. We're on a Linux diet today. So it's going to be a streamlined show, rapid fire, some stories, some ads, and then we're going to get out of the way so that Ask Noah can be live on its new time. Because that guy, he's got a hard limit that we can't push into. That's right. Well, we've got some good news today.

Some good news about some of our friends in the Linux journalism world. We've got some interesting behind-the-scenes stuff going on with the Googs. A big story that's not so great for anybody. Really, for anybody. Yeah, really, anyone at all. Some confusing, just a little bit of Linux gaming updates. A new couple open- source apps we want to talk about, and then

a little catch up on predictions and maybe we can talk a little bit about our plans for 2018, get excited about all the cool tech stuff we're going to work on. But to do any of that, I mean, I'm not sure anyone can join us for our weird time today, but if so we have to say time appropriate

greeting to the mumble room. What's our mumble status there, Rike? Empty. Empty. You know what? That'll happen. People are off probably trying to achieve their New Year's goals.

Or still, you know, have a hangover. Or still have a hangover. Yeah, right? They have metaphysical problems of their own. I think those are just physical problems. You're right. Those are just physical problems. Thanks for keeping me honest today. So regardless of all of that, let's just

jump into our first story today. And that, my friends, is that it's a happy new year. It's 2018. Oh, yes. And before we left, we covered some sad news about Linux Journal calling it quits. I was sad to hear that they've really been a staple of the Linux journalism ecosystem for a long time. But it sounds like they've been saved. So talk about a happy new year. They've been resurrected by the open source saviors that are saving every project under the sun. Yeah, exactly.

Private Internet access. They sure have. So as they write, you know, it turns out we're not dead. In fact, we're more alive than ever thanks to rescue by readers, specifically by the hackers who run Private Internet Access, also known as PIA, a VPN owned by London Trust Media. They're avid supporters of Freenode and other larger FOSS community things. We've seen a number of stories over the past year, past two years maybe, of PIA stepping in, providing various financial backing or even just buying some services. It kind of weirds me out in a way, though. Like what happens if for some reason private Internet access fails?

All these things that are now relying on their income are going to fail again. Yeah, you're right. Like it's good that they are supporting the products that they use, right? Like, as they write here, they're really all about Linux and the rest of the modern portfolio, things like privacy, crypto freedom, rewriting the rules of business and government. I don't know what that means. But, you know, it seems like PIA has the right ideas. But having just one of them. Yeah, you're only as strong as the weakest link in your chain.

Yeah, right, exactly. So this is kind of exactly what Linux Journal had been hoping for, but really had not expected. Really and truly, they waited to put up their farewell post until all hope was lost. And that's got to be so hard, right? You're working really hard. They do a lot of really good work.

They've been doing it for a long time. And when things just aren't viable, sometimes, you know, you just have to throw in the towel. And that's a painful experience for everyone. But hey, it turns out you don't have to believe in miracles to experience one, because that's exactly what happened. So what we know so far, first, the PIA people are hardcore Linux free software and open source hackers. That does seem to be clear. They also want to do right by developers, users, and the whole free and open-networked world. Second, they're eager to support building Linux Journal 2.0. So this is not just like a life support line that's being extended. It's not that they're going to kind of limp along,

which is nice, right? But what that means is in rebuilding Linux Journal, they need input. They want input from readers, maybe people who haven't been readers. If you're at all interested in seeing, you know, good quality Linux Journalism continue, I would definitely go, you know, have a say, have some voice, let them know what you liked or didn't like, what maybe would turn you from not a reader to a reader. I know from our perspective here on the network, it's always helpful to have usually constructive criticism. Third, expect to see some familiar names and faces continuing to work there. So if you followed reporters and journalists there

that you've liked, they're probably sticking around. Fourth, they're committed to giving all their subscribers everything that they can to reward you for their support. So if you haven't already yet claimed your archive of all the back issues, go do that. They really want to take care of their readership, which is important. And finally, they're committed to leading the way towards new and better business models so they want to use this as an opportunity to work out like how can we

now that we have some you know injection of funding and support how can we reshape this so that we can continue doing it as the year goes on which i think i mean that's that's an important way to do it uh it won't work to just keep doing the same old thing. Now that we had a chance to completely shut down, let's reset and figure out the good things that we can do and separate out the bad things that cause us to fail. Yeah, exactly. So, you know, I like this story just because, one, I'm personally a fan of the Linux Journal. But then, two, it's nice to start out, you know, 2017 was a rough year in many respects. It's nice to start out with a little hope i feel like they should have memed it up a little bit and named the blog post uh new year new me

new year new me oh yeah i like that well uh you know maybe you should give them some more feedback rika it usually helps me okay so this is a lightning show we're moving right along to our next story today over at ours they've got some updates on Fuchsia. Now, we've talked a little bit about Fuchsia on this program before, but no one really knows a ton. But it looks like it's now coming to a Chrome OS flagship. Google's in-development operating system, Fuchsia, has a new development device, the Google Pixelbook. This is a $1,000 laptop. It usually runs Chrome OS, but with the latest builds of Fuchsia,

you can swap that out and run Fuchsia right there on it. So it really only started development back in 2016. It's Google's third operating system, right? So they have Android, they have Chrome OS, and now they have Fuchsia. Fuchsia is really kind of in its own league there because Chrome OS and Android are both Linux-based. Fuchsia is not. It's described as targeting modern phones and modern personal computers,

which would seemingly put it in competition with both of Google's existing operating systems. But everything's still kind of up in the air, right? It seems like a from-scratch rewrite of a modern operating system. The OS doesn't use the Linux kernel. It instead uses a Google-developed microkernel called Magenta. Okay, no, it was formerly called Magenta, and now it's called Zircon. I feel like they're doing Fuchsia to build an operating system around the idea of convergence from the ground up. Interesting. Instead of trying to bolt it on after the fact.

Right. And you could see, right, they've spent the past, what, decade now trying to play in the mobile space, try to get it underhand. But Android has never really been theirs. They use Linux. They kind of built this weird OEM community that they steward. But really, there's AOSP in the field as well. I can see how they would want maybe a level of control similar to what Apple enjoys.

how they would want maybe a level of control similar to what Apple enjoys. Another interesting part about it is they're using, the renderer they're using is called Escher, and it's written using Vulkan. So they're already ahead of the game right there. It also seems custom built to run Google's material design interface. So that's just baked right into the ground floor. They're written in, apps are written in Google's Flutter SDK, which produces cross-platform code that runs on Android and iOS and Fuchsia, so that's handy. And since there's no Linux, yeah, you guessed it, there ain't no GPL here.

The OS is licensed under a mix of BSD 3 Plus, MIT, and Apache 2.0. They are getting something that most operating systems don't get when they're new. They're getting the entire Android app ecosystem instantly. Yeah, right. That's a huge problem. So yeah, if you can already cross-compile, if you're already developing using this SDK, you can just immediately target Fuchsia. That's a big win.

So it's still incredibly difficult to get Fuchsia running really anywhere. Along with the Pixelbook, it supports only two other obscure pieces of hardware, an Acer Switch Alpha 12, I don't know what that is, and an old Intel NUX from 2015. Actually, I might have one of those Intel NUX. I'll have to check. VueShare can run on the open source QEMU emulator, but VueShare's graphics stack, as we said, requires Vulkan support. QEMU doesn't have Vulkan support yet. So you get a command line. Command line Fuchsia. I really don't know how helpful that is. It's not like the target of, I suppose you could poke around at some of the internals,

see how POSIX-y it is, that sort of thing. I would be curious to try that, but it doesn't give you a good taste of what Google's end design goal here. They used to have a system UI that was packaged up that you could run, but that doesn't exist anymore. Is the terminal material design? You know, I don't know. That's a good question. Okay, so one other fact that I thought was really interesting in this whole thing is that the Pixelbook installation process that they've described for this is kind of strange. Google recommends installing the OS with a USB drive. Sure, nothing unusual there.

But the media creation process is quote-unquote destructive to the USB device. That's right, you actually have to sacrifice a USB device to the fuchsia gods to get the OS running. I don't know what they mean by that, but it's a little concerning.

I'm looking at the fuchsia screenshots. It very much reminds me of Windows 10 mixed with Android. Interesting. Is that something you would be interested in using? Like the Windows Universal App Store apps. Like Mail, how they're all

very flat and single colored, but then it's got the Android headers. It's really weird. I don't know if I'd be on a desktop. I don't think so. Right. Now, it is important to point out here that the extreme difficulty in getting this all

running really reinforces the fact that it's, you know, it's still heavily in development. It hasn't been released anywhere publicly yet. They're not really, Google isn't really ready to talk about or encourage people to try it. It took them like five years to turn Android into a real product, so if you just survive that long, maybe we'll see it in 2020? Sometime later. Hence why in this screenshot they open the email app and it just says BAD MODULE in all caps. Yeah, right.

Yeah, exactly. A larger question that this makes me wonder, I wonder what your thoughts are on it. Does this spell the end of Linux in the embedded space? Do you see, you know, are people going to flock to this? If Google can launch it, if it's simpler, if it has some of the Linux drawbacks,

if it has a more friendly license to OEM-type vendors. Well, lucky for us Linux people, Google is really bad at launching software. Burn! Their only success is Android, and that's because they let other people launch it for them. Yeah, I guess you're right about that. So you don't really see Fuchsia having a huge future.

No, and for all we know, it's only going to be an internal Google thing anyway. They haven't said it's going to be like this widespread OS that's going to be on all kinds of devices. You're right. So I should just shut up about my speculating. Linux is fine. For now. Yeah. I like that. We're going to keep on this hopeful New Year's trend. I'm going to say at least for 2018. That's my prediction, Wes. Okay. Okay. Well, you probably won't be able to use it here anytime soon, but you can bet the second that you can run Fuchsia on a phone, you're probably going to be able to try it on our first sponsor today.

That's right. It's our friends over at Ting. Head on over to linux.ting.com. There you'll find a smarter way to do mobile. Yeah, okay, so when you first find out about Ting, you're like, yeah, okay, whatever. It's another one of those, you know, pay for what you use sort of plans where I have to like prepay, but I don't have a contract. No, it's not. It's not really like that.

Ting does it differently than just about anyone else out there. It really is a smarter way to do mobile. And when you find out that the average Ting bill is just $23 per phone per month, you'll kind of start to see why. I've run into a few people who knew about Ting before I told them, but so I was really happy about that. I was impressed. I was like, yeah, you guys are already, you're already on the bandwagon of people in the know, but they didn't have the advantage that you, dear audience, have, which is by going to linux.ting.com, you get a $25 service credit if you sign up. So that'll probably pay for most of your whole month, first month's bill, maybe more. Or if you need a new device, go check out their shop. They have a ton of great latest and greatest stuff. You can use it there too.

Before you do that, to convince yourself that you're really going to save a bunch of money with Ting, which you almost certainly are if you have a, you know, if you're a tech savvy individual who has Wi-Fi in most of his life or his or her life, that's where Ting really starts to make sense. If you want to use like a thousand gigabytes a month, it can make sense there too. That's the magic of pay for what you use. So head on over the rates page. Lines start at just $6 per device. So you have two devices, $12. It's so easy. And they have this great little, this great intuitive dashboard you can use to sort of figure out what you're going to pay. You can deactivate, activate lines. You don't have to call anyone to do any of those things. And then to figure out your bill,

it's super simple, right? You just take your usage. Maybe you use like 100 minutes a month. Nothing big, right? How many phone calls do you really make? I don't use any text messages because thankfully I've managed to convince most of my friends and family that there's better ways to communicate. Telegram. Yeah, Telegram. Discgram signal. There's a thousand different options.

Just don't use text messages. But maybe I get like a couple a month just because someone else or an automated service or I ordered some food. And then just whatever data you use. So if you're smart and savvy with wi-fi maybe you use like a 500 megs a gig that monthly bill right there that's 22 that's the cost of like one meal out and you get cell phone service for the whole month and it comes with all the things that you want right like it has three-way calling it has tethering if you want to use that voicemail that all the standard features, and none of the early termination fees or mandatory contracts. I feel like the only reason

Ting isn't like the biggest carrier in the United States is because too many people don't know about them. Yeah, you're right. So go spread the word, the wise, wonderful word of Ting at linux.ting.com. And thank you very much to Ting for sponsoring the Linux Unplugged program. Okay, so I think it's time that we move on today and we discuss some big news. We're not going to do a deep dive into this. That'll almost certainly happen on the TechSnap program before too long. But we have to talk about it. It's not so positive. Kernel memory leaking Intel processor design flaw forces Linux and Windows to redesign. Now, when this story first dropped, I don't know about you, but I saw a lot of references just to Linux. And I think that was because that was where some of the first open source patches that we saw involved in this story were.

So a lot of it was reported that this was like maybe it was a Linux flaw or what's going on here. It has come clear that it doesn't look like AMD systems are affected by this vulnerability. It's just Intel only. But let's get into that. So a fundamental design flaw in Intel processor chips has forced a significant redesign of Linux, Windows and other kernels, right? So Linux and Windows are the first ones so far to have moved on this issue, but OSX, anything else that's running on Intel and takes advantage of some of these features will have to be redesigned as well. Does that mean Android too? Because there is Android x86. I guess they'll just get it with, as long as Android picks up from the kernel patches.

Oh yeah, I suppose. Yeah, but who knows if they will, right? That's one of the huge problems there. So programmers are scrambling to overhaul the open source Linux kernel's virtual memory system. And Microsoft is also expected sometime this week or the next patch Tuesday at the latest to release a patch there. So one important note here is that both of these fixes right now incur a performance hit on Intel products. So the effects are still being benchmarked, but it's somewhere between 5% and 30% of a slowdown, depending on the task and the processor model. More recent Intel chips have some features that will make this performance hit not so bad.

But basically, the performance we've come to know and love from these wonderful Intel chips may be reduced because it's just not safe to do so, right? So details of the vulnerability, they're still under wraps. So we don't know a lot, but we have seen various movements reported all over the place on the kernel mailing list, etc. We're expected to let all this is supposed to come out in the open sometime probably this month, but they're giving people time to patch, as is usually good policy. But we get to talk about it and speculate anyway. So, hey, isn't that fun? We do have some details, right?

So right now we know that it affects modern Intel processors produced around the last decade, and basically it allows user space to read kernel memory, or at least possibly read kernel memory. This ends up in potentially bypassing KSLR, kernel address space layout randomization. It's really no good. So the fix is to separate the kernel's memory completely from user processes using what's called kernel page table isolation or KPTI.

So whenever a running program needs to do anything useful, so just write a file, open a network connection, it has to make a syscall, hand control back to the kernel to carry out the job, make that transition. And so to facilitate that, the kernel gets mapped into all the user space processes virtual memory. So it's just sitting there. You can do that quickly. That's no longer going to work.

What we're seeing here is that there's what's called speculative execution. You know, Intel processors will try to predict what code is going to get executed and will run some. In this case, it looks like some of the security checks that should prevent user space processes from accessing kernel memory, they're just not being done. What did you think about this story, Mr. Beard? I think it's a whole lot of stuff that is way over my head, and I'm glad people are fixing it.

Yeah, right. So, like, with these new patches, they're going to move the kernel into a completely separate address space, so it's not just invisible, it's just not even mapped at all into the user space's virtual memory. It shouldn't be needed, but there's a flaw in Intel Silicon that allows kernel access protection to be bypassed. We're not quite sure of the details yet, but the downside is that it's relatively expensive

to do these new safeguards, right? So each time you have to switch between them, there's more flushing that has to do. You have to make sure that kernel memory is not accessible at all to user space, even with the speculative execution. We're not quite sure of exactly what the implications are. A bunch of patches have been proposed. It seems like AMD is not vulnerable. We're not sure what the final performance is. Really, nothing is final. But it would, you know, it does allow more vulnerabilities to get executed. And where you currently couldn't find kernel address information now you can so best case scenario it's possible the bug could be abused to defeat kslr

especially with things like return oriented programming it may not be that severe time will tell yeah it's it's kind of crazy i was was reading apparently over at the Chaos Communication Conference earlier this year, somebody was describing a pure JavaScript ASLR attack where you could exploit this purely through the browser. Wow, yeah. So yeah, there had been some previous research done as well, like this summer with some patches called Kaiser that people had looked at but were concerned about the performance hit.

I think a big thing to note here is that shared systems are one of the ones that are most vulnerable to this, in particular some of those big name cloud computing environments, things like EC2, Azure, Google Compute. So over at the Python Sweetness blog, there's a really great discussion about, you know, just all that's going on. They have a really good summary of following the different patches, looking at LWN's coverage, looking at the actual mailing list. So if you're interested in this, if you want to get in on all the speculation, go check that out. We'll have it linked in the show notes. Also note that you'll probably start seeing some things from if you are using these cloud services. So Azure has already said there's going to be some maintenance reboots on the 10th.

AWS has sent out some emails saying, hey, we've got a major security update. Look for, you know, your instances are going to get restarted. We're going to have to do some maintenance there as well. So I do like that the Python sweetness blog is kind of like doing reverse engineering to figure out what's going on because they're not being so public about it? Oh, yeah, absolutely. So that blog's titled The Mysterious Case of the Linux Page Table Isolation Patches. It is interesting, right? We live in this world where responsible disclosure is very important,

but we also have open source products. So I'm sure Microsoft has been making a bunch of patches, but we just don't get to talk about it. Okay, so as we've said, this is a lightning show. We have to move right along. I want to keep talking about it. But again, check out TechSnap. We'll have an actual in-depth explanation where we have real details.

That's not what this show is about. This is Linux Unplugged. We're about having some fun. We skip the details. We skip the details. We have rampant speculation. We abuse our airtime. We have unplugged opinions that may not be grounded in reality.

Yeah, exactly. And I love it. So moving right along, we've got another sponsor for you today. And that is DigitalOcean. You may be concerned, right? You're concerned. You want to make sure that you, if you're using cloud services, the people behind them have security in mind that are going to be doing these patches

as soon as they're available, that they're reading these articles and are concerned about your security. And DigitalOcean is really the place to go. So hop on over to DigitalOcean.com. We've got a promo code that you can use. It's a D-O unplugged, all lowercase, one word, D-O unplugged. That'll get you. A guy with some nice hair told me that it's a promo code of power. It is a promo code of power. That guy is so smart. I don't know who he is, but he's wise.

Yeah, so what can you do with that promo code of power? Well, you're going to get a $10 credit. And prices at DigitalOcean, they start at just $5 a month. What do you get for that? Well, you can get a droplet two months for free, Wes.

Two months for free! And that droplet comes with 512 MB of memory, one super fast virtual cpu 20 gigs of all ssd disk and a whopping one terabyte of transfer oh yeah and this isn't this isn't your grandfather's transfer this is like real international peering top-notch 40 gigabit e right to the kvm hypervisor all the technologies that you would use if you were building a data center. It's like your hard line in some internet. Yeah, exactly.

Yeah, right to the brain. It's incredible. I will frequently use DigitalOcean just to proxy download things because they're so much faster. It's as close as you get to the matrix until we have the matrix. Yeah. So on top of all of this, you also get their amazing dashboard, which is all powered on their incredible API. Whatever technology you're doing, right? So maybe you're using one of their big, big name competitors, and you're like, I just want to take out this DigitalOcean thing.

Probably all the scripts, command line, third party tools, stuff like Terraform, they're already supported with DigitalOcean. They have drivers for them. Integration is super simple and easy. And if you're like me, you're going to compare the APIs and you're going to be like, wow, why aren't all APIs this simple and well-documented? It's just a pleasure to work with. Well, as an example, we wanted to be able to turn off and on droplets from the IRC to be able to control some of the stuff for the show. We got a plug-in set up in like 15 minutes. I went into the developer room. I was like, listen, guys, I need this.

And 15 minutes later, he's like, here's a plug-in. Wow, that's incredible. Yeah. That is literally amazing. And they have like API toolkits for most of the major languages. Yeah, they really do. Plus, they've got a whole bunch of other features that you probably want to take advantage of, right? So things like load balancing, monitoring,

private networking between droplets. They've got snapshots available. They've just introduced object storage. They also have attachable block storage up to like a huge amount, all SSD disks. Maybe you want to go play with zfs digital ocean is a great place to do it maybe you don't want to have to build a bunch of compile your maybe you're doing the gen 2 challenge and you don't want to have to compile

a bunch of stuff on your machine go spin up one of these like 20 an hour uh 20 a month excuse me 20 a month droplet three cents per hour you get two cpus two gigs of 40 gigs of all-SDC disk, and three terabytes of transfer. It's such a deal. And not only that, if for some reason you're listening to Linux Unplugged just because you're looking for people that like Linux and you want to hate Linux, you can even run BSD over in DigitalOcean. You absolutely can. That's the power of that KVM hypervisor, my friend. Anyway, don't take our word for it.

Go to DigitalOcean. Go check out their awesome community-m DigitalOcean. Go check out their awesome community-maintained documentation. Go check out their super-friendly community of users. Go check out their incredible dashboard. DigitalOcean.com. Promo code DEO, unplugged. And thank you to DigitalOcean for sponsoring the Linux Unplugged program. Okay, so back to the show. Here's just an open-source app I thought we'd talk about. In the spirit of open source, this article is from last year. Yeah, it's true.

But I think it'll be relevant in 2018 as well as we take this time to look at, you know, how do we want to do things as open source enthusiasts, open source users? And do we have the tool sets we need? So one thing a lot of people I know use or have used is Evernote. I don't know about you, Beard. Are you an Evernote user? No. I've considered using Evernote, but I just never got around to it. Yeah, sure.

Well, would you consider giving Joplin a try? It's a new open source Evernote alternative. Depends. Is it any better than all the other alternatives that supposedly existed? Well, let me tell you a little bit about it, and maybe you can answer that question for yourself. So it's an open-source cross-platform note-taking and to-do application. It can handle a huge number of notes. You can organize them into note-puts and synchronize them across all sorts of different devices.

The notes can be edited in Markdown, either from within the app or your own text editor. It doesn't matter. And each application has an option to render Markdown with formatting, images, URLs, all those kinds of, you know, Markdown enhancements we've all come to know and love. Plus, any number of files, such as images, PDFs, whatever, can be attached to a note, and notes can also be tagged. So you got a lot of primitives to work on here. The creator started developing it when Evernote changed its pricing model.

And because, you know, he wanted his 4,000 plus notes to be stored in a more open format. As we've talked about so many times on the show, cloud services can be great. They can be value ads, they can help your business, they can stream on your workflow, but you are at their mercy. And so when it's a streaming music service, it's pretty easy to say, well, I don't like them or they fold it, I'll switch to a different one. But when it's something like this, when it's a smaller company, we're all pretty sure that Google Drive will be around for the next million years. But who knows, really.

And especially for some smaller companies, you may not have assurances that you will have access to your stuff. And when it's important to your business, when it's important to your life, if you don't have an easy export option, that can be really dangerous. Indeed. So to that end, there are three Joplin applications, all under the MIT license. You have a desktop version, which is

Windows, macOS, and Linux. There is a mobile version for both Android and iOS. No fuchsia yet, I know, you're disappointed, beard. And, check this, there's a terminal application for Windows, Mac, and Linux. So they all have like similar user interfaces, and they can synchronize with each other. So it's really like a complete set there.

And they're based on open standards. This might make you a little upset. They do use SQLite. That's great. They are made in JavaScript, though. So hopefully that's okay with you. They use TerminalKit, which is a Node.js terminal framework I had not heard of. They use TerminalKit, which is a Node.js terminal framework I had not heard of. The desktop apps use Electron and then React Native for the front-end devices. It's also offline first, so data is always available on the device even without an internet connection. So you don't have one of these annoying apps where even though it's stored locally, you're waiting for the thing to sign in or figure out that,

hey, I just want to read this note I left for myself even though I'm on the plane. Oh, and it's got a multi-service support for its backend syncing, so you're not tied to a particular service. Yeah, exactly. Yes, exactly. So the synchronization is designed without any hard dependency to any particular service. Most of the synchronization process is done at an abstract level with access to external services such as OneDrive and Dropbox. It's just like a lightweight driver. You can ideally plug that in, play, maybe we'll see some support for other

things like NextCloud, things like, you know, any of the other popular syncing alternatives that are out there. Sync thing comes to mind, LibreVault. Yeah, you do have to sync manually the first time that you use a new service, but after that, it's automatically syncing in the background. Excellent. So it looks like currently you can sync with OneDrive or the local file system. A Dropbox driver will be available. They're waiting on another upstream bug to be fixed before that happens.

I think it has two major advantages over the past Evernote alternatives. Okay, yeah. One, it has the ability to have attachments, which, like, none of the other ones do. And two, it has the ability to import from Evernote. Oh, okay. See, that's a huge deal.

Including attached files. Including attached files. So that means you should be able to go over to Evernote if you're ready to jump ship, or you just want to even try jumping ship. Go over to Evernote, export all your stuff, fire up a Joplin instance, and get it going. Yep, they've got the instructions,

and we'll have them in the show notes. I like that. They've got some pictures. You can go check this blog out. It's over at opensource.com. It does look like they're pretty similar cross-applications. That should make it pretty easy, even if maybe you're trying to sell a spouse

or a family member on it, and want them to join the the crew it should be easy to support across platform i don't know if i'm about to try it but i am pretty curious and i'm intrigued that they have a terminal application as well that makes me the linux nerd feel pretty at home i kind of already like it more than evernote because the support is marked down and evernote doesn't i know yeah exactly I thought that was a huge deal right there. And I do like that the, you know, it's focused on some of its core ideas and that syncing and other sort of

third-party concerns are left outside. That seems like it should be flexible enough to remain relevant regardless of whatever, you know, when Dropbox dies, this will still work. And not only does it support Markdown, it supports Markdown correctly because it has the editor and the rendered view right side by side. That's something that SimpleNote never really did.

Yeah, you're right about that. And it's funny like it sounds like a small thing, but that actually matters a lot when you're for usability. Yeah, especially when you're iterating quickly. You know, you're taking a note and then you paste it into something else later when you look at the note and it's rendered all wacky. Rendered all wacky. Exactly. All right.

Well, hopefully that's something people are interested in. If anyone's using it, I would love to hear about it. Do let us know. It seems like it might be a handy new thing that you could try deploying out. It should be easy too, right? You're not installing a bunch of services. You're not having to run a new server, even though we know that would be easy

with some of our previous sponsors. Just install it on a couple devices, get syncing going. You probably already have one of these accounts, and away you go to a more open source 2018. Wes, why are you giving me good apps? I don't need any more projects right now. You sure don't.

Okay, so since we've got the beard up in here, I thought maybe we would just take like just a quick moment and talk a tiny bit about some gaming on Linux. Okay. I don't know if you heard about this, but there's kind of been a weird Linux Valve Steam related controversy going on. I have not heard about this. Okay. Oh, interesting. So are you familiar with Catbot?

Nope. Okay. Ooh, interesting. So, uh, are you familiar with Catbot? Nope. So apparently there's, there's a new, there's some new cheating tools going around in the, uh, in the Steam world. And there's been a big controversy about are they banning Linux users before they should? Are they banning Linux users just based on their name? There have been some updates to the story. So it sounds like, of course, it's not as extreme as one might think, but we can, let's get into the details. Catbots, if you're not familiar with the term, are player-created bots that flood TF2 servers,

lighting up headshots on everything in sight. They're called names like Catbot1574, and they're a huge nuisance. But in an attempt to stamp them out, some players are claiming that Valve has crossed a line. Anybody with Catbot in their Linux username, yes, not their Steam username, their Linux username, will now find themselves with an automatic VAC ban, regardless of whether they're actually booted up TF2 or not. Now, one thing to note here is how many Linux users actually have Catbot in their username, right? But there is, like, the potential that's not necessarily a good way to decide these things. Listen, Wes, don't judge me just because I like cats and I want to turn one into a robot.

Right. So there was some discussion over on a GitHub thread. One user said, I installed Ubuntu in a virtual machine, named the computer Catbot 9.18, and installed Ubuntu in a virtual machine, named the computer Catbot 918, and installed Steam. Within an hour of not playing anything, I received a ban. Now, a GitHub moderator for Valve did confirm that the

policy was, in fact, a deliberate attempt to combat bots, but they did add that it was not open for discussion on GitHub. Valve has been pretty famously, they're pretty closed about the anti-cheating steps they take, partially because if you know about it, it makes it a lot less effective. And generally they do it in good faith, I would say,

to try to keep the games fair, make sure that you have a good community going on and that it's an enjoyable game to play. However, contrary to that, Valve has since contacted uh the people that wrote this article and said that um that in fact was not deliberate and that um what was it uh the the claims were a tactic employed by cheaters to try and sow discord and distrust among anti-cheat systems. Yeah, isn't that an interesting development?

So, like, at first it sounded like, oh boy, is this like a misstep that's hurting Linux users, even though, as we know, it's a tiny percentage of the gamers actually on Steam? But no, it looks like this is just, you know, a false flag tactic that people are now trying to get everyone upset about when, really, it's not what's happening. So, as they say, VAC will not ban you for simply having Catbot in your username, either your Steam profile or your actual Linux account. The bug report, and I suspect many of the posts on the thread, are a tactic employed by cheaters to try and sow discord and distrust.

VAC has many different types of detections, and, you know, Steam doesn't really want to comment on them, but they will say that all detections require that the detection occur while a user is actively cheating and connected to a server. So, like, you need to be playing the game and connected to a VAC-secured game server to actually get caught cheating, which, I mean, that makes some sense, right? The other thing I thought was interesting in their comments was that they said linux historically hasn't been a problem for cheating the base rate of cheating is significantly lower on linux than it is on windows unfortunately a healthy community of cheaters grew up around catbot on linux and their impact on tf2 became large enough that they simply could no longer be ignored so those ban users are now very annoyed that the VAC has dropped the ban hammer on them.

What do you think? Is this a reasonable policies by valve? Just a bunch of fluff. I think it's perfectly reasonable by valve. Nah, apparently the cheaters are spreading a whole bunch of fake news. Wes. Yeah.

I mean, I think we're definitely seeing some fake news going on here. Oh, but that's the world we live in. That's the 2018 world. That was the 2017 world. It's all part and parcel of the same thing. Have you had any interesting gaming developments in your life in 2017 or coming up in 2018? Wes, I've been too busy moving.

Video games are not a thing, except for the fact that I've started streaming again. You have? Oh, wonderful. I decided that I'm going to try to stream every single day this year. That is an impressive New Year's resolution, sir. Good luck to you. Thanks.

Okay, so moving right along in today's lightning show, we've got one more sponsor to knock out of the way before I move on to our final topic of the hour. So first up, maybe you've made some New Year's resolutions. Maybe you're finally going to – that's not the right one. What am I doing over here? I got my tabs all over the place. Well, that was in fact my New Year's resolution was.

Right? Yeah, exactly. But maybe you don't quite have the skills that you need. You probably don't have the skills that you need. Maybe you do. But if you don't, I know the perfect place to go. Can you guess? Would be an academy.

Yeah, but it's not one of those ones that will teach you how to do underwater basket weaving or how to cook a steak the correct way. Now, you should learn how to do underwater basket weaving or how to cook a steak the correct way. Now, you should learn how to do that. But if you want to learn about Linux, there's no better place than linuxacademy.com slash unplugged. Go there right now. They've got a sale going on.

It's extended through January 9th. You can get a free trial and go test out this incredible learning resource, right? When I first heard about Linux Academy, it was kind of new, new kid on the block, hadn't been used so much, but now it has grown an incredible amount. I now see it on a ton of resume applications

when I'm interviewing people, people I had never talked about it before with, sysadmins all over the place are talking about what a great resource it is. And that's because they have awesome tooling to make it easy to learn, Stuff like Nuggets, right? So if you don't have a ton of time to go do like an hour-long tutorial, check out some Nuggets, just little bits of fun information.

You're probably going to learn something. Yeah, nice course scheduling so you can adapt it to your schedule. Yeah, exactly, right? You have unlimited access to the courses. They have hands-on labs and exercises, and they customize it. So if you're trying to learn on a Red Hat based distribution, yeah, they got servers for that. Maybe you're really invested in the Debian ecosystem. You're an Ubuntu admin who's trying, or you're trying to learn one from the other. Perfect. Linux Academy, they custom tailor the courseware so that it matches whatever distribution you're

actually using. And you don't have to worry about the expense of trying to figure out like, oh gosh, I got to spin up an AWS account. And am I going to go beyond the free tier? And how much is this going to cost me? I just wanted to learn. No, none of that. Because Linux Academy manages all that behind the scenes for you. On top of all that, they do certification stuff too.

They also do certification. So it's a great way if you're trying to train for a certification, go check out the ones that they have available, because it's really going to be some of the best resources that you can find on the internet. And, you know, if you're like me, I was resistant at first. It's like, well, I'm pretty good. I'm a pretty good self educator. I know how to find resources. I'm a good reader. But these days, with the speed of how Linux and open source is moving, what you end up doing is you end up with a whole bunch of links that are like three four five years old maybe the author has come back you know they wrote up a tutorial on their blog maybe they had an updated post but

probably not and so you're trying to like especially as a beginner you're trying to hodgepodge bring that together build your understanding and it's just not very efficient Linux Academy has people who use Linux. They built their site with Linux. They're Linux enthusiasts. They're people like us, and they keep this stuff. It's always up to date. They have the latest and greatest software that you're going to want to use, and maybe you're trying to learn some cloud platforms. Maybe you want to get up to speed on containers. Perfect use case for Linux Academy, and they have great support. So maybe you just want to do it on your own to try to get into the Linux field, or if you're already there, it's a great way to bone up,

and it's super easy to sell to your boss because they have team support. They have an easy way to manage it so that you can make sure that everyone is up to date, that they've gone through with the training that they said they would, that they're taking advantage of the program, and they even have profile pages now too. So you can go do a bunch of training, do grading your courses and show that off to prospective employers. Yeah. Some feedback that we've gotten recently is some people have recommended Linux Academy to their employers and then Linux Academy courses got deployed for the entire company just to bring everybody up to par. Really? Yep.

That's fascinating. So yeah, exactly. That's a great way to do it. You have a common base understanding, and you know that it's going to keep getting updated, so it's just a great value. Or if you've got your boss trying to get you to go get more certs, and you want to get some brownie points with him, try to save some money, you can be like, hey, can I go get my cert via Linux Academy, and it'll save you some money. It'll save you some money, and it's more flexible, right? Instead of like going to a dedicated thing

where you're just going to learn one thing, after that's done, keep using Linux Academy and go learn a bunch of other areas where you need to know. It's perfect, especially if you're trying to transition into a new field. So go check it out, linuxacademy.com slash unplugged. You can try it out for free, so there's really no risk. And if you're anything like me, you'll be hooked.

Thank you very much to Linux Academy for sponsoring the Unplugged program. All right, so as we said, we're flying through today's episode. But it is the new year, right? New year, maybe not so new us, something like that. Refreshed us. Refreshed us. But it does make me think it's time to think about, you know, the end of 2017, you're thinking about all the things you didn't do. You're thinking about the terrible stuff that happened.

But it's new. It's fresh. And I don't know about you, Beard, but I've been trying to think about, like, what is it that I want to accomplish this year? I know I won't get all of it done, but I want to set some high goals that I can try to achieve and work towards. high goals that I can try to achieve and work towards. In that spirit, I thought it would be good to talk about all the annoying tech chores you need to do when you have the time, because this is probably something you should add to your list of 2018 goals. A fresh start to the new year.

Yeah, exactly. So first up, update your software. This might be not as relevant to us Linux users, but I think it still is, right? Especially like you probably have software on your phone, you have software on systems you don't use that much, and you have firmware on probably all kinds of weird embedded devices that you don't think about. I would add to that, not just update your software, but reevaluate your software and see if there are better alternatives that might make your life better. Right. Like, don't just keep using the same old stuff. And don't throw it away if you don't need to. Maybe switch from Evernote to Joplin.

Yeah, exactly. Or at least give it a try, right? Yeah. Allocate a little bit of time. Maybe you can make something better. You've been hooked on proprietary syncing.

Try out NextCloud. That's one of the things I'd like to do this year. I'm realizing that I don't love Google Drive. I have it, but I don't love it. And I don't really have

a great, I have local file systems that I keep in sync, but I don't love it. And I don't really have a great, I have local file systems that I keep in sync, but I don't have this like a richer way to sort of share lists and make notes to myself. I challenge people to set aside 30 minutes for every day for the remainder of January just to do research to try to improve their lives. Oh, that's a great idea. You're just so smart, Beard. So some other things you should do. Free up some space.

We were talking on the way up to the studio today. It sounds like you're in this boat. You get in that place, you're over 90% on your file system, things are slow, and you just can't download the stuff you want. Well, yeah, I don't really have a choice, though, because the reason I have no space is because all my other drives died. Yes, totally. But go install a couple tools that'll help you one i love in particular is ncdu which is like the normal du command but an n curses interface it makes it super easy to rapidly scroll through what's taking up space drill down into folders and you can delete files

right from the same interface so it's super easy there. There's a KDE one. I think it's like K directory statistics or something like that. Yeah. KDurstat. KDurstat, yeah. And it wasn't Winderstat, the popular Windows program, I think was originally forked from that. So there's a lot of good software you can use, but it really is, you'll probably find a bunch of files that you forgot about.

It's a great time to go clean up that downloads folder. That's one that always gets me. It's really nice to get a nice visual of a visual representation of what's taking up your hard drive. Yeah, exactly. There's a couple tips in this article in particular that are a little more Windows. So one is scan for problems.

Well, I don't know how much you want to do that on Linux or need to, but it is a good idea to have some regimen. You can do it on Linux. It's just a little bit more manual. Just go check your log files. See what's going on. Yeah, exactly.

Go check your log files. The other thing I would say is if you're running any cloud systems, business systems, anything else, maybe now is the time to check out some monitoring. Just start getting some metrics. Get some statistics that you can use to track system health or really anything else. Go set up a simple Nagio server or something better if you want to make sure that you're monitoring your home network or

your droplet. It can be super easy and you'll probably learn a lot on the way. You can even set it up for your desktop, see what it's doing throughout the day. Yeah, right. Yeah, exactly. One tool I love in that space is NetData. It's by the same team that's made Firehole, which is the firewall IP table system that I prefer. And NetData is super simple to install. It has its own web UI built right into it. It's super efficient, and it has

pluggable backends now, too. So if you just want to have disposable metrics you can look at when you need to, it does that. Or you can ship to a back-end server and save them for later okay so this one is not necessarily tech-based but it is definitely true get your photos organized you just have so many you take them all the time i saw you taking them earlier today you're taking them with me right now even though i asked you not to i can't help it west you're so pretty yeah so just here's what i ask make a west folder a west pictures folder put it right on your desktop so you have easy access Now, even though I asked you not to, I can't help it, Wes. You're so pretty. Yeah. So just here's what I ask. Make a Wes folder, a Wes Pictures folder. Put it right on your desktop so you have easy access to it.

But sort those things out. I don't know. I don't feel like when they say get your photos organized, I don't think they mean like file structure wise. No, they don't. You probably want, you know, meaningful tags and metadata info. Wasn't there like a really great Linux photo organization software? You know, there almost certainly is. I've used Darktable and I've used Raw Therapy a bit myself. Yeah, I think it's Darktable.

Yeah, Darktable actually recently had a new release, so go check that out. It's definitely something to try this year. Okay, and then finally for this one, update your router. Now, we touched on that briefly, but more and more devices these days are auto-updating, but go check. Right now is the time, especially if you're like the IT person in the family and

you're willing to do this, maybe go check on some of your family members. We've seen various things like the crack attack and other recent exploits. It's a good idea to make sure you're patched for. Yeah, I think they're talking about updating your router firmware, and personally, I would consider also updating the router hardware, because often the routers that are in place with your family and stuff, maybe yours is good, but your family... Right, they don't know these things. They just bought it at Best Buy

and installed it and have never thought about it again. Or got a bargain basement once applied by the RSP that they're getting charged for every month. Yes, exactly. So there's a lot of options, open source friendly or not, but you really want to have especially things like Wi-Fi. It's 2018 now. We've got to have these things.

This is like base infrastructure. Maybe go check out a Unify system. Google's Wi-Fi seems popular. I can tell you that I've gained a lot of family goodwill by just going to my family and saying, hey, I need you to give me $100 up front to buy you a new router. But you will in perpetuity.

In perpetuity. That's the word. You will save $10 on your bill every month for as long as you have it. Boom. Yeah. See, look at that. Wow. It already pays for itself after 10 months.

It already pays for itself after 10 months. Yeah. I think that's. And your internet will probably be faster. And your internet is probably going to be faster. Yeah. See, look at that. Wow. It already pays for itself after 10 months. It already pays for itself after 10 months. Yeah, I think that's... And your internet will probably be faster. And your internet is probably going to be faster. Yeah, I like that. Okay, so this was Gizmodo's take. I thought we'd over just as we're wrapping up today, check out what Network World has.

These are Linux resolutions for 2018 for both Linux admins and users. So I like number one a lot. Automate more of the boring stuff. I think that's definitely something we would like to do over here at JB. We'll probably talk more about that some on the TechSnap program, but you're always down in the trenches.

I think that's something you would agree with. I agree. Yeah, it's just important that like, if you're going to spend time doing it, we only have so many days left in 2018 already. Don't waste them doing the same thing over and over and over again. And if you don't feel like automating your stuff, come help us automate ours. Oh, yeah, definitely.

We've got a nice development community. We could always use more people. Yep. I think this year I'm finally going to make the move to having a legit configuration management system running my home servers and droplets and assorted computers. Save you a lot of time. Yeah, I've tried Ansible in the past, and it didn't quite work for my use cases. I think I might stand up a standalone Chef server or maybe give Salt a try.

But either way, it's going to be an exciting journey, and I'm excited to have some reproducibility. I've already run into some systems that are working great right now, but reflecting on it, it's like, well, I would never, I shouldn't have made it this way. I would not make it this way again. And it's going to be a lot of work if this system fails and I have to rebuild it from scratch. Okay, so number two, learn a new scripting language.

Maybe just learn a new language in general. It's a good way to keep your, you know, keep your brain flexible and you might learn a new paradigm. So if you haven't tried JavaScript in the past five years, a lot has changed. Maybe try that. If you haven't done Python before, it's more popular than ever. Make sure you do Python 3,

but check it out. I would suggest Ruby. There you go, yeah. The Ruby peddler. The Ruby peddler. There's even a very easy way to learn it. If you go to poignant.guide, you's even a very easy way to learn it if you go to a poignant dot guide you will get a nice illustrated guide to ruby that's beautiful um okay so in that same spirit try a distribution you haven't used before maybe take the gen 2 challenge if you haven't used arch before try that or uh you know the elementary guys are doing great work give that one a shot

i think uh for me i'm gonna try void oh void yeah that one a shot. I think for me, I'm going to try Void. Oh, Void. Yeah, that's a good idea. Because not only is it a distribution I haven't used before, I basically know nothing about it. You know nothing about it, yeah. Or what's the other thing? Nix? Nix? That's what I was about to say. Yeah, Nix. Or what's the GNU one? GUIX? I don't know how you say it.

Both of those are really interesting. Functional approach to configuration management built into the distribution. I don't want any GNU in my life. That's fair. I like it because they use Scheme or Guile to configure it, so I'm interested. I'm still waiting for my Linux kernel with the BSD userland. Fair enough.

Oh, okay. Interesting. So K free BSD. Debian slash K free BSD. Now, that was reversed. You went the opposite of that. Exactly. Interesting. Well, maybe 2018 will be the were the opposite of that. Okay. Interesting.

Well, maybe 2018 will be the year for you. Probably not, though. All right. So number four, embrace cloud technology. I guess so. I don't know if I would make that a resolution. If it's useful to you, it's probably worth checking out, but it'll probably happen anywhere. This seems like a trend because that Gizmodo article also suggested moving to the cloud.

I'm just going to skip over that because, yeah, I mean, use it if it's useful. It's certainly available, but I don't think you should make it a focus. Indeed. Rather, focus on system security and verify that your backups are working. Those are both super important. That goes back to checking your logs to make sure nothing weird is going on. Yeah. Set up some basic monitoring, maybe set up fail to ban or other things that'll help make sure. And go rotate some keys. You know, if you have been doing this, start following some SSH best practices, start using a password manager if you're not already,

and get automated backups. A big thing for me this year is I want to get some of my friends and family on my backup system so that we can do some multi-site relocation. Right now I have at least one you know, at least one copy, but I would like two copies, at least one of them off-site. So like three copies total.

I don't know if I'll get there, but I want to start on that path. I'm going to add a 6.5. Try out ZFS. Yes, absolutely. Start getting snapshots in your life. Get used to it. And then before long, it's going to become second nature, and you're going to thank yourself that you did. And five and six kind of lead into number seven.

Yeah, they do pick up some new troubleshooting skills. Yeah. If you find a problem, you're going to be learning to do numbers. Yeah, exactly. We already touched on number eight, which is pay attention to metrics. But it is nice, you know, like, it doesn't take that much time to just get some base metrics and then later in the year you'll be thankful. I don't think I've ever had a time where I had data and I was upset that I had data, right? It's almost always the opposite. I would love to have seen what the load was during that

period, but I didn't have metrics. I would suggest doing number nine, document your procedures in combination with the Evernote alternative from earlier in the show. Yeah, go try out Joplin.

Have your documentation with you everywhere. Yes, go try out Joplin. Maybe try out NextCloud or some other services, SyncThing, whatever you can do to make sure that you have this sort of stuff available. You could even run your own open source wiki on a droplet if you wanted. That could be something that would work for you.

But document, document, document. That's one thing that saved me, even though I don't yet have a great configuration management at home. At least, you know, I'll go to a server I haven't touched in a couple years and I have a document laying out exactly what I installed, why. It really helps a lot. A lot of the rest kind of just all go together. You know, teach a class, take a class, find a new job, make your current job better, get a cert. All of these, Linux Academy. Linux Academy.

There you go. Okay. Well, that about wraps it up. I hope we've left you somewhat inspired for 2018. I know I am, right? There's just a lot. There's a lot of cool technology. There's a lot of stuff you can do.

And as Linux users, we're really empowered because all of this is, most of it's like free, open source, and we're already interested in it. So, like, how do we not, we'll be hurting ourselves if we don't take some time to play with this stuff. But at the same time, the last one on the list is have a life, take a vacation, take some time off. Yeah, remember that this stuff is supposed to be fun. Don't stress out about it. Set up some good habits, some good, you know, some good workflows, and just have a good time. Yeah, Linux will be here when you get back. Yeah, you set it up right. Exactly.

Alright, well that's going to wrap it up. I hope you're real inspired about 2018. I know I am. How about you, Beard? Pretty inspired. Alrighty, well thank you for joining us here on the Linux Unplugged program for this special super-duper unplugged edition. Mr. Beard, if they want to see more of you, where can they find you?

Twitter.com slash RekaiLP or Rek.net. Excellent. We're streaming every day. We've also got a ton of great JB content. Ask Noah's coming right up, so make sure to check them out at their new time. What's your Twitter, Wes? My Twitter is at Wes Payne. And head over to JupyterBroadcasting.com. There's a ton of great

content. Check out the archives. You can find us on YouTube. You can check out the calendar to see when you're alive. And make sure you come join us and don't leave us alone. Yeah, exactly. See you in 2018. Thank you.