Untitled Linux Show 278 Transcript

Please be advised that this transcript is AI-generated and may not be word-for-word. Time codes refer to the approximate times in the ad-free version of the show.

Jonathan Bennett [00:00:00]:
This week, there's an emergency in OpenSSH that you probably don't have to worry about. Debian, at least one maintainer, is no longer uploading to GNU because of AI. There is a TCP bug that Ubuntu is getting some criticism for their fix. We shake our Linux kernel Christmas present a bit early to see what all is in it. There's a bunch of Linux bugs getting fixed and a whole lot more. You don't want to miss it, so stay tuned.

TWiT.tv [00:00:30]:
Podcasts you love, From people you love. From people you trust.

Jonathan Bennett [00:00:35]:
This is TWiT. This is The Untitled Linux Show, episode 278, recorded Saturday, November 7th. Non-deterministic humans. Hey folks, it is Saturday and it is time for The Untitled Linux Show. That's where we come together and talk about hardware and software, all the crazy things going on throughout the week. This week we've got a pretty nuts security story that we're going to get started with here pretty soon. But first off, it's not just me. We've got the whole crew in today.

Jonathan Bennett [00:01:09]:
And of course, it— ooh, that was unfortunate and fancy. We swapped positions. Anyway, we've got Ken and Jeff and Rob, and we are going to have a lot of fun today. Welcome, everybody.

Ken McDonald [00:01:24]:
Glad to be here again.

Jonathan Bennett [00:01:27]:
And Rob's like, I'm not going to talk over that. I know how this is going to go. I'm just going to sit here.

Rob Campbell [00:01:32]:
And now for my turn. Hello everybody, I'm glad to be here. I'm on the mute button. Didn't know I was on mute.

Jonathan Bennett [00:01:38]:
Oh, okay, that's what happened. Gotcha. Anyway, false start. Yeah, do we have to— do we have to run back 5 yards and restart the down? Uh, anyway, so we're actually going to start with a a pretty big security story, but it's not quite as big as I thought it was. So it's an OpenSSH problem. And the name of this one is StarSSHole, which think about what that looks like in person and you'll figure out the intended pronunciation, I believe. But there is a very good reason for that. And it's actually It's actually a pretty clever name in looking at it.

Jonathan Bennett [00:02:25]:
But what this boils down to is a problem in certain Linux distros running SSHD that a user who in the user's file, their password is represented by a single asterisk, can log in simply by providing a password that is over 256 bytes. Any password over 256 bytes will work. Now, the distros that this works on are the things based on MUSL, M-U-S-L. And if you're not familiar with that, let me tell you, that is Alpine, OpenWRT, Buildroot, Yocto, and a whole bunch of Docker images that are based on one of those things. Alpine is very— Alpine is a very, very minimal Linux distro. And so it's actually pretty common to build your Docker images based on it. And it's, yeah, it's a pretty bad problem. It's kind of hilarious why it's a problem.

Jonathan Bennett [00:03:37]:
I read through this and so— In /etc/passwd, so the password file, there is— there's this format that we use, and it's the name of the account and then a colon and then a representation of the password and then a colon and then some other details about the user. Those first 2 are the ones that matter. And Back in the old, old days, you would just have a password there in plain text. And it did not take long, like that was original Unix. It did not take long to realize that that's probably not a good idea that you can just look up everyone else's passwords. So, you know, there's been this series of improvements to this process. And, you know, nowadays we have these password hashes, you know, things based on things like bcrypt and the various different ways that you hash passwords. And so, you know, a real password will start with something like $6, and that indicates one of those hashing things.

Jonathan Bennett [00:04:49]:
And the asterisk is just used to mean that there is not a password set. Well, SSHD is smart enough to know, well, if there's not a password set, then we— People in the chat are trying to log in with extremely long passwords. It's hilarious. SSHD is smart enough to know, well, there's not a password set, we don't let someone log in. Okay, all well and good. The problem is that the function that checks these passwords will, if there's a problem, if anything goes wrong, it returns a null. So like no password. Instead of a pointer to an actual object, it just returns nulls, like a 0 instead of a thing, essentially.

Jonathan Bennett [00:05:35]:
And apparently, a lot of functions were not checking for null, and so there was a bunch of bugs throughout the years. And as a result, in Muscl, Crypt no longer returns null, it returns a single-character string to indicate that something went wrong. And that character is the asterisk, which is the exact same character that we use inside the passwords file to indicate no password set. And then there was one other change made in muscle, and that was that if you send too long of a password— so this was actually a denial of service attack— you could send a really, really long password and the machine would just chug away on it doing something like a SHA-512 crypt. on it. And so they said, oh, well, we know how to fix that. We will just— anything over 256 bytes, nobody has a password that long, which is probably true. So anything over 256 bytes, it'll just be, you know, invalid.

Jonathan Bennett [00:06:43]:
And it sends a null back. Everybody knows how to check for the null, except it doesn't send the null back. It sends the asterisk. And not everyone got the memo to check for the asterisk. And if you have an account with the password set to the asterisk, which is what most accounts are by default, SSHD on Muscle will go, oh, hey, that's an asterisk. This is an asterisk. It matches. You're good to go.

Jonathan Bennett [00:07:09]:
You're logged in. So not a good time. Now, now I saw this and I went, oh, I've got OpenWRT. This will be great. Let me crack my OpenWRT box before I go and patch it. So I pulled my phone out with, with Termux on it. I said SSH into my OpenWrt box. And I just, I sat there and, you know, I, I kind of, I counted it first.

Jonathan Bennett [00:07:29]:
I'm like, what do you think? And then like, I got the rhythm of it. Finally got up, you know, that's probably around 256. Type in a few more characters to make sure. Enter. Wouldn't let me in. Like, huh, I wonder why. And, uh, so I went, I went and I checked it out and apparently It is not that easy. It's not that simple.

Jonathan Bennett [00:07:53]:
There are a couple of other gotchas that you need to have set. And so all of these things that I said are vulnerable, yes, they are, but they're not vulnerable under default config. And so in the case of OpenWRT, you're probably not running SSHD. You're probably running the other smaller SSH. daemon, which I don't remember off the top of my head what that is. What do they use by default? OpenBear, I think? DropBear. DropBear. Yep.

Jonathan Bennett [00:08:28]:
So they have DropBear in there. It doesn't have this problem. So for OpenWRT to be vulnerable, you would have had to have either built or manually installed SSHD. And then for things like Alpine and the rest of them to be vulnerable, you would have had to have gone in and set SSHD to allow you to do a root login with password, which is off by default. So this flaw, it's hilarious. It's really interesting to understand how it came about. And in theory, it's a really, really terrible one. But in practice, there's a very limited number of installs that are actually vulnerable to it.

Jonathan Bennett [00:09:09]:
So not nearly as bad as it sounds. But really intriguing to step through, like how we got to this point and why the asterisk lets anyone log in.

Jeff Massie [00:09:21]:
Yeah, I thought it was just— now I hadn't— I had heard about this, but I didn't look into it. So I just assumed it was, oh, over 256 and it automatically lets you in. I didn't realize there was other

Ken McDonald [00:09:32]:
circumstances. No, it's just that with it being that big, it ends up The hash coming back saying the splat.

Jonathan Bennett [00:09:43]:
Yeah. So once you hit a certain limit, a DoS, denial of service protection kicks in. And so basically it just kicks it out and says, this is no longer a valid password. But instead of it being a null, it kicks back an asterisk. So not a splat, but an asterisk. And because splat is the hash line, I believe. I think. Yeah.

Jonathan Bennett [00:10:06]:
So, but yeah, it's— yeah, blob. Now, Harold Finch asks a really interesting question, and that is, whose bug is this? Is this an OpenSSH bug or is this a muscle bug? Yes. Yeah, that's a really interesting question. I wonder what the— I wonder what the fix is for this. Like, which one of the— probably both of them will roll out fixes for it. Um, but, uh, yeah, yeah, it's, it's an interesting question. I think it's probably technically a muscle bug.

Rob Campbell [00:10:47]:
Yeah,

Jonathan Bennett [00:10:48]:
I would, I would say

Rob Campbell [00:10:49]:
because it's returning something that it, it shouldn't. I would— I think— I don't think, I don't think, uh, asterisk is an appropriate response to null.

Jonathan Bennett [00:10:59]:
Indeed. But then you have the question of, is fixing that going to cause a bunch of other things to break?

Rob Campbell [00:11:05]:
You know, one other, one, one little clarification. Unless these, um, distros or whatever, they don't— their password's actually in the /etc/shadow like all the others, aren't they? Or like, years ago, it used to be /etc/passwd and they moved them. Most everything.

Jonathan Bennett [00:11:24]:
So if you have, if you have a password set, yeah, it's going to be in your shadows file. But if you don't have a password set there and you just have the asterisk set, well, that, that means that you don't have a password set at all. But this particular bug, um, and, and I, I Googled and Google's AI says, Gemini tells me, so, you know, take this with the enormous grain of salt. It's not necessarily either of their bug. It's just an unfortunate gap in how the two implement standards.

Rob Campbell [00:11:52]:
AI is always the last to point fingers. AI will not point a finger. Like, uh, uh, yeah, it's like, well, that's a little, um, strong of a statement. You should probably be like, no, I'm keeping my strong statement here.

Jonathan Bennett [00:12:13]:
So Dan Gooden over at Ars Technica also has coverage of this. And he calls this point out. He says, it's not entirely clear where the vulnerability resides, getting to the same question of like, who's at fault here? OpenSSH issued an update on Thursday where they said, we consider the root cause of this bug to be outside SSHD, but it is exploitable via SSHD and can be avoided there. And then a muscle developer, Rich Felker, says, it is my position that this is not a bug in muscle and it is just erroneous use by the caller. So they're both like, no, no, no, it's not on us. Not my fault.

Ken McDonald [00:13:02]:
Basically, one of the articles I read said that it's because of the muscle making a change back in 2012, which made a failed crypt call return an unmatchable hash rather than null.

Jonathan Bennett [00:13:16]:
Right. Yeah, because so many things didn't check for null and so they were crashing, right? It was a fix to try to fix downstream bugs.

Ken McDonald [00:13:25]:
To stop the crash.

Jonathan Bennett [00:13:27]:
To stop, yeah, to stop crashing, which sometimes a crash can be a security bug. You can have all kinds of weird stuff because of a You know, null pointer dereference. So yeah, weird, weird story. Fun to sort of trace through though. I'll kick Dan's article here into the show notes as well because it's pretty good. I always like Dan Goodin's commentary on this stuff. He's pretty good at also parsing through the security noise and getting at stuff. All right, Jeff, are you no longer going to be on Debian? Is this what this means? You weren't on the team to start with.

Jeff Massie [00:14:05]:
This is a little bit of a fun little adventure down a thread on the Debian mailing list. So when you're going to place a package to Debian, Debian has a front door and it's called newqueue, N-E-W space queue. So like I said, you upload a package that Debian's never seen before or You know, it waits there until a human checks it. You know, is the license actually free by the Debian Free Software Guidelines, the DFSG? Does the copyright file say what it needs to? You know, things like that is what they're checking for. Since the start of 2026, a dedicated Sorry, a dedicated DFSG team handles that work. And by most accounts, you know, people said it's gotten fairly fast. One maintainer even said fixes and reuploads are sometimes happening within a day. But this fall, the team got an assistant.

Jeff Massie [00:15:14]:
So on October 26th, Johannes Schauer Marin Rodriguez posted to the Debian development list with the subject line, I will no longer upload to new. Uploads were now being run through an LLM review and nobody announced it. Each report says up front that it— that you get back after you upload says, you know, that it up front that it wasn't written or checked by an actual DFSG team and that it may be wrong and it may have missed things. Johannes laid out the choice, spend volunteer free time reading machine output that might be wrong or ignore it and waste the resources that made it. The verdict that he came across or that he states in this thought process is, I will not upload anything to new unless there's a way for me to opt out of this. Johannes isn't leaving Debian, just handing new packages to someone else to upload. Now, if we go back a little bit, in August, Debian had voted on AI and the winning option, and we talked about this back then, was for responsible use of generative AI. Now, this was from don't use AI to we use AI for everything.

Jeff Massie [00:16:35]:
And kind of in the middle, the responsible use is what won. And that was written by Mark Haber. And it neither endorses nor bans AI tools. You know, it just, it says that actions with broad project impact should get prior discussion and consensus first. Now, Johannes's point is running every new package through an LLM is pretty broad. So the, you know, he's putting this to the test. So the first big test of Debian's AI policy is, Debian itself. Now, this thread is kind of long.

Jeff Massie [00:17:13]:
It's gone over 80 messages last I looked. And, you know, it wasn't a simple pro, you know, anti versus pro fight. For example, Gunnar Wolf, who uses LLMs in his own Debian work, still calls sending unreviewed output to uploads just wrong. Ted Sow, the longtime ext4 maintainer, said, Most Linux kernel subsystems maintainers now use AI reviewer called Sashiko, adding, humans are unreliable and non-deterministic, you know. Which is, for those that don't know, that's also how people describe AI. Martin Steigerwald pointed out the difference, you know, in this is in that, In the kernel, the maintainers choose whether AI is used or not. And, but conversely, some people found the reviews genuinely helpful. Richard Lager dug through a long one and found real copyright problems that later got fixed.

Jeff Massie [00:18:20]:
So this, and if I haven't described it properly, this is kind of the LLM is kind of a first pass looking for problems. It's not the end-all be-all. Now, there is an opt-out, sort of. There's a checkbox labeled, do not email me about the LLM reviews of my uploads. So it's still, you know, it still is running. So Colin Watson's complaint was to that very nature of that you basically have to go find it, meaning the little checkbox, and no matter what, the LLM runs either way. Now, then they started bringing up about 24 hours. Martin Steigerwald found a public report stating the uploader was given 24 hours to respond to the serious issues the review found, the LLM review, and did not.

Jeff Massie [00:19:13]:
Martin's response was, this is not okay. You know, simple as that. It's just not. 2 proposed changes on the team's code repository. Now, they're both still listed as open. They haven't been sealed yet, or last time I looked anyway, describe exactly that system and it flagged uploads. So flagged uploads, you know, something's wrong with your upload or the LLM thinks there is. You have 24 hours and then it drops in priority if nobody answers.

Jeff Massie [00:19:46]:
So packages that the LLM likes get a bonus of getting passed on through to the reviewing team. The ones that it doesn't like, the robot doesn't reject you, it just kind of puts you towards the bottom of the queue again. So it's, it's, it's not totally eliminating you, it's just if you're taking time to get back to it, it's going to take time for it to get through the system. Now, there was brought up problems with accuracy to show the reviews, you know, could be shorter. Lucas had an LLM summarize one and it listed 4 blockers, which were all missing copyright holders. Bill Amball replied that under Debian policy, 3 of the 4 are not blockers at all, and that the LLM fundamentally misunderstood the purpose of Debian copyright. Sean Whitten, who wrote that section of the policy, agreed and suggested putting the policy text into the prompt. So on November 4th, Bill filed a bug against the review tool.

Jeff Massie [00:20:50]:
So somewhere a language model just got its first bug report about itself. Jonathan Carter, a former Debian project leader, was blunt. I certainly do not want any automated service emailing slop at me. Mark Haber defended the tool. We're not translating our C code to machine code manually since we have compilers. And when Colin said he'd rather have his uploads not trigger LLMs at all, Mark asked, so you want to forbid the, the DFSG team from using AI in their work? Colin's answer is, I might not get my wish, but I'm allowed to at least have that preference. And the DFSG team itself, Sean Whitten noted the team doesn't tend to engage with these threads like this. And as of when I last checked, nobody speaking for the team has posted in it.

Jeff Massie [00:21:53]:
Enko Zini asked a bigger question. Can we design for where we could go rather than adopt LLMs to make it supposedly easier to stay where we're at? Sean Whitten's entire reply was, quite. Take a look at the link in the show notes for the post which started the long thread and offshoots. And last I looked, it was still going. But, you know, it's kind of an entertaining read for how, you know, Debian itself is Overcoming some hiccups in the AI that it voted for.

Jonathan Bennett [00:22:31]:
So I will tell you, in the project that I work with, the thing that we have done that has most increased our code quality is we opted into CodeRabbit, which is a great product, by the way. They do this free for open-source projects, and it is an AI that will review all of your pull requests. And our flow now has become, you write your pull request, you send it in, and CodeRabbit will find things. And probably about 20% of what it finds, you say, no, CodeRabbit, that's not a real thing, just go away. And then the other 80%, real flaws. And it's like, you need to fix this. And so we just, our habit now is, please address the CodeRabbit review before you ask us to look at it. And It has literally come to the point, and I was joking with one of the devs several days ago, several months ago actually, it was at DEF CON, we were all there together.

Jonathan Bennett [00:23:26]:
But it's like, I use my clanker to write something, I send it in, your clanker reviews it, I let my clanker review your review. Once the 2 clankers get done talking to each other, then I take my time and actually look at it. And that's what software development is becoming.

Jeff Massie [00:23:43]:
And

Jonathan Bennett [00:23:43]:
it gets it done and it fixes bugs and things work. And especially this being the new packages, the place where they're most likely to have AI slop on the input, I think it makes a lot of sense to have the AI be the first line of defense of looking at things and fixing it. Now, do they need to make their AI reviewer better? Yeah, possibly. But—

Jeff Massie [00:24:07]:
And that was the bug reports.

Jonathan Bennett [00:24:09]:
Yeah, yeah, that's the bug reports.

Jeff Massie [00:24:13]:
And it's really trying to do what you were describing.

Jonathan Bennett [00:24:15]:
Yeah, yeah.

Jeff Massie [00:24:15]:
Just that first pass to catch the little stuff.

Jonathan Bennett [00:24:19]:
Yes. I think a software developer that gets offended by an AI review of his work does not have a very bright future career as a software developer. I just, that's the way it is. Now, Now, there's one thing that I have— I've continually instructed my AI, and this has been helpful, and that is you get to— you, the AI, you get to review and respond to automated reviews. You respond to other AIs. But if an actual human leaves a review, that's on me to respond to. And so I think that actually works out pretty well. And maybe that leads on to something which it sounds like they're doing here, but it's like, Let's mark whether this is strictly the AI talking or a human talking and respond in kind.

Jonathan Bennett [00:25:09]:
Because I will tell you, as a developer reviewing a patch, one of the things that will drive me nuts is if I sit down and I review and type out an answer myself manually with my own human fingers pushing on the keyboard with my sausage fingers and your AI responds to me. I'm not terribly interested in that. In fact, we've banned people for doing that back several months ago before, you know, all of this really took off. But yeah, I like the idea of the AIs talk to each other and then the humans talk to each other and everybody fixes their bugs and we get really good code out of it.

Rob Campbell [00:25:45]:
I just wish I had enough pull requests for any of my open source projects to care about this.

Jonathan Bennett [00:25:50]:
It's a double-edged sword, man.

Rob Campbell [00:25:52]:
It's pretty much just my own pull requests.

Jonathan Bennett [00:25:55]:
The next thing you know, you're spending all day looking at pull requests. You're suddenly Linus Torvalds in his bathrobe reading people's emails, looking at pull requests.

Jeff Massie [00:26:04]:
Well, the thing too is, you know, with the AI now, it's so easy to write something and it's so easy to write something terrible. And before, if I had to hand code something, I had some actual vested time in it. And I was really, you know, it wasn't probably something I'm doing on a whim unless that's a hell of a big whim. You know, you took probably quite a while to code it, you know, on average. Yeah, there's the little short stuff. But now a whim can go like, oh, I want to make a new word processor. Oh yeah, let me type this in. Oh, look, I got something.

Jeff Massie [00:26:41]:
Might be absolute garbage, but there's no—

Rob Campbell [00:26:45]:
But let's not fool ourselves. I think writing your own code, it was pretty easy to write bad code manually as well. I know over the years, especially early on, I wrote a lot of bad code. It just worked, but it wasn't good code.

Jonathan Bennett [00:27:03]:
That's true. I've written my share of bad code for sure.

Ken McDonald [00:27:05]:
Times when I've wrote good code, but it didn't work because of that typo.

Jeff Massie [00:27:09]:
Well, but what I'm saying is though, so, but see, you had to write that bad code. You had a certain amount of dedication that you had to put into it to keep coming back to the computer to write the code or stay at the computer long enough to finish the code versus, oh, I type in a couple sentences and hit go and come back and it's, it's good and I send it out. So that level of dedication has dropped significantly, and I think that's where you can get some real garbage because people haven't even properly thought about what they want to do. They kind of just sort of have an idea, throw it out, and then try to upload it.

Rob Campbell [00:27:43]:
But also back then, as soon as it worked, I was done. I was like, okay, I am exhausted. I'm not gonna see if I have SQL injections in here or some other horrible whatever, or if it's commented well or anything else. I'm like, it works. I'm done. I am beat. I have had it. I don't want to do anything more.

Rob Campbell [00:28:01]:
Now, you know, I write an AI thing. It's like, ah, this works great. Hey, let's test it for this. Hey, let's do this. I'm not, I'm not like worn out and exhausted. I still have the energy to keep on going. It's like, You know what? I don't like this. Let's change this.

Rob Campbell [00:28:15]:
Let's change this. Let's test this.

Ken McDonald [00:28:18]:
Or even better, you don't need to have the energy. You can say, let's check all this while I'm taking a break.

Rob Campbell [00:28:25]:
Yeah. I mean, often I'll have a plan going. I'm like, okay, what is our plan now from here until whatever? And they'll tell me, well, we want to do this step, this step, this step. I'm like, okay, I'm going to bed. Let's do these 5 steps and I'll come back and Check out— check this out in the morning.

Jeff Massie [00:28:45]:
But I'm saying the people that don't know code and don't have that, that drive or that ambition, the dedication, aren't running all these self-check tests. They're not running all that. They're just—

Ken McDonald [00:28:58]:
I want to just ask one question.

Jeff Massie [00:29:01]:
Yeah.

Ken McDonald [00:29:02]:
How do I?

Rob Campbell [00:29:04]:
Yeah, but it's also I mean, yeah, it's definitely better if you know something about what's going on underneath, but it's not a big leap to be like, okay, I don't know AI. What else do I need to be concerned about? Because I mean, sometimes I even ask that. I was like, okay, what am I missing, ChatGPT? Is there something else I should have in here? Some other problem I'm not looking at? And it'll offer all kinds of suggestions, many good ones. I'm like, yeah, I don't want to do that. I'm just running this on my local LAN. I don't care if it— has every tiny security hole closed or whatever it is, but it'll give you all the suggestions, things you should test, things you should look at. Sometimes if you don't even ask, it will still tell you, we should probably test this out next.

Jonathan Bennett [00:29:50]:
Now, here's the question. Are we quickly coming to the end of very easy AI slop because the prices are about to go up?

Jeff Massie [00:30:00]:
Hopefully. No, because the home models are getting so much easier that I'll just run it locally and generate slop.

Jonathan Bennett [00:30:08]:
But does it take a little bit higher level of technical expertise to run a local model?

Rob Campbell [00:30:16]:
Yeah.

Ken McDonald [00:30:17]:
I'll answer that question in one way. I've got Moss Image that I can run now.

Jonathan Bennett [00:30:25]:
I think it actually— you have what now? You have what again?

Ken McDonald [00:30:29]:
Moss Image. Image processing AI?

Jonathan Bennett [00:30:34]:
Are you, are you, is he, is he trying to, no, he's not trying to segue. What are you talking about?

Jeff Massie [00:30:39]:
He's saying he's, Ken's running a local AI. So he's saying the ability to run a local AI is not that hard.

Jonathan Bennett [00:30:47]:
Right. But what is Moss Image? I'm not familiar with that one at all.

Ken McDonald [00:30:50]:
Isn't that one you covered last week, Rob?

Rob Campbell [00:30:54]:
No,

Jonathan Bennett [00:30:55]:
I'm not familiar with this one.

Ken McDonald [00:30:57]:
Maybe I came across it in one of the articles I was reading.

Jonathan Bennett [00:31:00]:
I'm just not familiar with it at all.

Ken McDonald [00:31:02]:
Downloaded and installed Moss Image and I got it running. Let's see, did I?

Jeff Massie [00:31:08]:
I've got Quen 3.6. I think it's 40B running on this.

Ken McDonald [00:31:13]:
Yeah, oh, I've got a—

Jeff Massie [00:31:14]:
And I set it up in like no time at all. It was so easy.

Ken McDonald [00:31:18]:
I even downloaded and installed MetaMuse.

Jonathan Bennett [00:31:22]:
Interesting.

Rob Campbell [00:31:23]:
You know, I think it's not yet to be determined where the cost is going to go. And I have multiple Things here. One, one is, one is the actual story that happened. I mean, people who follow ChatGPT know they were doubling their, their token cost pretty much. They were going to, they announced it, maybe they even did it. Everyone complained and then they like reversed and I think gave you double the tokens. And the weird thing is, ever since then, even though I've used it heavily, my usage has been at a, like, I've had 100% left. I don't know if that's like a temporary thing because they messed up, but like, I haven't used anything even though I have.

Rob Campbell [00:32:05]:
Um, and the other thing I was gonna say is, um, it's more expensive for those higher— for the higher packages, I think, as they, you know, release 6 Frontier models. Oh yeah, yeah, as they do that. But I'm finding I don't need to use those. I, I am several models back, it's doing just fine. Like, I have switched. I like, at one point I did, like, ah, let's, let's see what these new ones can really do. And it's like burning through and it takes so much longer. It's slower, but probably better results, ideally, hopefully.

Rob Campbell [00:32:39]:
But anyway, it burns through and all of a sudden it's like, ah, you're out of tokens. Like, what? And I switched back down. I was like, I just run all day on these, uh, On the older, faster.

Jeff Massie [00:32:53]:
So I think, say, 5 years from now, 7 years from now, a lot of people are going to have AI at home. And the large, you know, ChatGPTs, Claude Codes, and stuff like that is going to be reserved for business. And it's only going to be when they're running really hard, cases, something super complex, because even the businesses are going to run their own AIs that will handle, you know, say 90% of the workload themselves. And you're only going to farm out that high end to the ChatGPTs or Claude Codes or what have you. And their usage is going to go down. They're not, they're not going to have the success they're thinking they're going to have.

Rob Campbell [00:33:42]:
I think that's true. I mean, mostly, but I also think that, you know, and this is a reverse from what I said in the past, I think, I mean, their cost to deliver this, I think it's going to go down eventually.

Jeff Massie [00:33:59]:
Yeah.

Rob Campbell [00:34:00]:
Not yet, but I mean, you know, as they create their new fancy chips that are more efficient and whatever economies of scale and whatever else, I think I think they'll be able to. And once they don't have to keep drawing the new

Jonathan Bennett [00:34:16]:
model— You've got 2 different effects going on though, because the costs go down, but also the capabilities go up. So like you've got better chips we can make. Let's just talk about your transistor size, right? We can go from 3 nanometer to 2 nanometer. That means it doesn't take as much. We can put more of these chips on a single die. Therefore the price of each of them goes down. Or we can make the die the same size and put more transistors into a single CPU. Well, maybe, you know, not always does that make your costs go down.

Jonathan Bennett [00:34:46]:
Sometimes that makes your capabilities go up. So there's always going to be that tension, I think, between the two.

Rob Campbell [00:34:54]:
Like I said, I mean, their capabilities can go up, but like I said, I think their models are at a point where I don't really need them to get any better. They're doing everything I want where Like if you need those more expensive models, you know, the more features, more capabilities, you know, like maybe some, you know, big enterprises do, they could pay that more. But for the most people, where we're at now is probably enough.

Jonathan Bennett [00:35:21]:
Yeah. And that's really Jeff's points too, that we're quickly coming on the point where you can just do all this stuff at home. The AI model we have at home is good enough.

Jeff Massie [00:35:32]:
And those models are going to get better. The hardware we have at home is going to get better. You know,

Ken McDonald [00:35:38]:
it's— Or the LLMs are going to get good enough and small enough that you can run them on your existing hardware without much difficulty.

Rob Campbell [00:35:50]:
Or Facebook will do, or Meta will do what they're good at in giving away their stuff for free. Free. And you can use their Muse forever for pretty much free.

Ken McDonald [00:36:08]:
And you wonder why you're seeing a lot of bandwidth being used on your network.

Rob Campbell [00:36:14]:
I'm not.

Jonathan Bennett [00:36:16]:
You know, you could ask your local LLM to help you figure out where all that bandwidth's going towards. I'm sure it'll be glad to help you.

Jeff Massie [00:36:26]:
Anyway. I have it go through my router logs every so often just to go, do you see anything weird?

Jonathan Bennett [00:36:31]:
Yeah. Yeah, that's not a bad idea.

Rob Campbell [00:36:33]:
I have it go through my server logs every once in a while.

Jonathan Bennett [00:36:36]:
All right, we're going to take a quick break and we're going to come back and talk about something other than AI. So some of our listeners like Keith, I see you out there. We'll give you a break and we'll be right back after this. Don't go anywhere.

Rob Campbell [00:36:50]:
Last week, I posted on social media about a critical Linux vulnerability and how Debian managed to beat Ubuntu to the security patch. I also briefly mentioned it on here on the show. Uh, we didn't, it wasn't a story. We didn't get in too deep to it. Debian, the distribution that supposedly takes forever to update anything. Well, yeah, that just doesn't seem to be the case, at least not Here again. Well, I briefly mentioned it, posted it here. There is a little bit of an update to the story this week.

Rob Campbell [00:37:27]:
And I thought I'd dig into it just because last time it was just me posting about it. Now it's gained some traction out there. There's other people talking about it. So the update. So it raises, this raises some questions about Ubuntu's approach to security and It also further vindicates my move away from Ubuntu on my servers. So the vulnerability I'm talking about here is CVE-2026-98432. It's a critical flaw in the Linux kernel TCP handling. And with a severity score of 9.8 out of 10, that is almost as bad as it gets.

Rob Campbell [00:38:09]:
Under certain conditions, it could allow an attacker to remotely execute code with root privileges. Pretty serious stuff. Debian released its security update on October 16th. That's over 3 weeks ago now. It's, yeah, it's November. Ubuntu, meanwhile, took a different approach. Canonical explained that it needed additional testing before pushing the patched kernels into its normal update repositories. Its test It tests against more than 2,000 certified devices and servers to make sure an update doesn't break something.

Rob Campbell [00:38:51]:
And I understand that, you know, nobody wants a security patch that brings down production servers, but you can't just let an almost 10.0 CVE sit out there unpatched like that. I'd rather my servers be taken down due to a bad update. than from being hacked, taken over, ransomware, malware, whatever the vulnerability is of the week. I would so much rather be taken down from a fault than to be compromised. That's a bad day. The latest, now the latest interim release, Ubuntu 26.10, had the fix for a little while. The LTSs, Ubuntu 22.04, 24.04, and even 26.04 releases We're still waiting for normal updates. And it's a— it wasn't even available if you were paying for pro support.

Rob Campbell [00:39:47]:
Canonical made patches available in its proposed testing repository, but that's not going to do much to secure your critical servers. And because nobody should be running testing on a production server that you want secure and to function. Well, now, okay, now here's, here's an update. Finally, it appears those LTS updates are starting to arrive and they started to arrive around November 6th. It's like 3 weeks, long time. But there's an important distinction here. The patched kernels for Ubuntu 22.04 and 24.04 have appeared in the regular updates repository. So these aren't exclusive to Ubuntu Pro subscribers.

Rob Campbell [00:40:35]:
That's good. Thanks for caring for us. However, they're showing up in the regular updates channel, not the security updates channel. And, you know, yeah, I usually update everything, but, you know, that matters still because systems configured to automatically install only security updates. May not receive these patches automatically. And Canonical's own vulnerability tracker still lists these LTSs as vulnerable. So I don't know what's going on there. It's a little wonky.

Rob Campbell [00:41:10]:
Meanwhile, the older LTSs like Ubuntu 18.04, 20.04, which now require Ubuntu Pro for extended security maintenance, they are still waiting for the fix. So anyway, we're seeing confusing situation where some patches are available, others are pending. Canonical's own security tracker hasn't caught up. So I don't know. And that's roughly 3 weeks after Debian delivered it, the fix, you know, without a problem. No one complained there. Just let the thing go, whatever. Anyway, I previously ran, you know, as I did share on the show, I previously ran into a PHP Twig vulnerability on Ubuntu where I had to enable Ubuntu Pro just to get the security fix in a brand new LTS release, not something old.

Rob Campbell [00:42:02]:
Now, you know, we're constantly told Debian is slow and conservative while Ubuntu provides a more polished enterprise-friendly experience. But there's a difference between conservative about software features and being slow to deliver critical security fixes. Every day I continue to feel vindicated and glad my servers are now running pure Debian.

Jonathan Bennett [00:42:30]:
Do you know what the, like, how exploitable was this problem really? Right? Like, did you have to go and open up ports in your firewall for it to be exploitable? Do you have to have jumbo packets turned on for it to be exploitable? You know, like some of these, yes, theoretically it's a 9.8 CVE. But like, it's never going to happen in the real world, right?

Rob Campbell [00:42:50]:
I don't remember exactly. I looked into, I remember looking more into it, like when it first came out and I updated it and I stopped looking into it. And then I stopped even thinking about it. And then someone put an article about it. It's like, huh, I guess other people noticed the same thing going on here. So I haven't dug into it anymore about the actual vulnerability. I don't really remember the details at this time.

Jonathan Bennett [00:43:14]:
Yeah. Interesting. I just, I know, I know sometimes the, the, the CVSS, the Critical Vulnerability Scoring System, is just detached from reality, we shall say.

Rob Campbell [00:43:27]:
Also, as you do know, and as we talked about last time, this is for enterprise and enterprises need compliance. They can't have CVEs in like above 7.5 and still be compliant.

Jonathan Bennett [00:43:43]:
Yeah. I think part of this also is just the tidal wave of CVEs that the kernel is pushing out right now.

Rob Campbell [00:43:51]:
Yeah.

Ken McDonald [00:43:52]:
And also, I suspect their new process for updating the kernel may have impacted this too.

Jonathan Bennett [00:44:00]:
Yeah, absolutely. And so it may have not been a great time. Maybe Ubuntu just did not, Canonical did not time this well that, oh, we're going to do Better screening of all of these CVE fixes. And oh, hey, by the way, we just had the most ever CVEs recorded in the kernel.

Rob Campbell [00:44:18]:
Well, the funny thing, I think what Ken is referencing is the fact that they cut down. So they are releasing kernels every 2 weeks instead of what it was every month before.

Jeff Massie [00:44:28]:
I don't know.

Rob Campbell [00:44:29]:
Something like that. So, so yeah, it's like, okay, what good is releasing kernel security kernel updates more often if you're not actually patching them.

Ken McDonald [00:44:40]:
Well,

Jonathan Bennett [00:44:41]:
yeah,

Ken McDonald [00:44:41]:
but if you're patching them one at a time, where is it in that queue? Is it going to be patched in the one that comes out next week?

Jeff Massie [00:44:51]:
You'd have to patch them more than one at a time. You'd have to bundle several fixes together to make it any kind of real actual security dent.

Jonathan Bennett [00:45:01]:
Yeah, I still think a big part of this is that we're seeing thousands of things fixed in the kernel and they're all CVEs. It's a very difficult time to try to have a program like this to actually make sense. Anyway.

Rob Campbell [00:45:16]:
Luckily, we got distros like Debian who seem to keep up. Thank you, Debian.

Jonathan Bennett [00:45:22]:
Yeah, because Debian is not trying to test all of these. They show the kernel fixed something. Okay, ship it.

Rob Campbell [00:45:27]:
I don't

Jonathan Bennett [00:45:28]:
know. Is Debian even trying to backport these fixes?

Rob Campbell [00:45:31]:
No, I don't think they really do that.

Jonathan Bennett [00:45:32]:
Yeah. Yeah.

Ken McDonald [00:45:33]:
They're just doing the fix for the current kernel.

Jonathan Bennett [00:45:37]:
Yeah. It's not exactly the same thing.

Ken McDonald [00:45:38]:
Which is only going to be Trixie.

Rob Campbell [00:45:40]:
Yeah. They're only supported for like 3 years. I think it is.

Jonathan Bennett [00:45:44]:
So anyway, let's talk about Audacity. Ken, what is new there in my second favorite audio editor for Linux?

Ken McDonald [00:45:53]:
What's the first? Oh, Ardour.

Jonathan Bennett [00:45:55]:
Yes.

Ken McDonald [00:45:57]:
Well, some of these changes you probably won't see in Ardour, but according to Bobby Borisov and Marcus Nestor, who wrote about the latest release of my favorite open source, free, and cross-platform audio editing software, and we're talking about here Audacity version 4.0.2, This release addresses project corruption, crashes, and audio editing reliability issues. According to Bobby and Marcus, Audacity 4.0.2 restores automatic saving during recording, reducing the risk of losing work during sessions, and fixes a project corruption bug when loading projects that contain empty clips. Now, as a Linux user, I am glad to hear this release resolves the issue of not seeing any files to select when using file import. According to Bobby, Audacity 4.0.2 addresses several crashes: one when opening projects with sample snapping enabled, another when selecting repeat last effect after closing a project, and a third triggered when the split keyboard shortcut was unassigned, providing more stability for Audacity. According to Markus, this release also fixes incorrect handling of Chinese, Japanese, and Korean characters during text trimming, NTSC frame snapping issues, And missing metadata in certain file formats and incorrect title and artist fields. Now, since I've only highlighted what I felt were the more important improvements, I do recommend reading Bobby and Marcus's article for more details. As always, they're available in our show notes.

Jonathan Bennett [00:47:59]:
Yeah, you guys remember when Audacity was dead, when it got sold and like, oh, it's dead. Nobody's ever going to use it. It's got spyware in it and blah, blah, blah, blah, blah.

Ken McDonald [00:48:08]:
I remember talking about it being dead.

Jonathan Bennett [00:48:12]:
Yeah, its death was a little over-exaggerated, I think. It's not been too bad.

Rob Campbell [00:48:18]:
But I'm glad to hear they fixed the corruption in the project.

Jonathan Bennett [00:48:24]:
Indeed.

Ken McDonald [00:48:25]:
Have you ever been hit by working on a project and then all of a sudden finding the files in it are corrupted?

Rob Campbell [00:48:31]:
Oh, that kind of corruption. I thought they fixed the project. Corruption in the project, not the corruption the project was creating in your files.

Jeff Massie [00:48:42]:
I can tell you I've used Ardour and Audacity, and I prefer Audacity, but I have an extremely simple— I just want to record something and maybe take, trim a minute off the end of something. That's it. I'm not doing anything beyond that.

Ken McDonald [00:48:59]:
It's my go-to for recording my Vinyl albums and then going out back and separating each of the songs.

Jonathan Bennett [00:49:08]:
Yeah, you got to remember, I come at this, I've worked pro audio for a while. And so like, I love, oh, here, let's get this, you know, this plugin here and this plugin here. And let me take the virtual cables and string them together the way exactly that I want. And oh, by the way, I've got a sound card. I want to be able to connect the inputs on the virtual plugins to the real inputs on the sound card and, you know, blah, blah, blah. And then I have physical cables. I love that stuff.

Rob Campbell [00:49:31]:
That's what I want to do. That sounds fun, but I just don't have the requirements for that.

Jonathan Bennett [00:49:38]:
Well, I don't necessarily have the requirements.

Rob Campbell [00:49:39]:
Or the patience.

Jonathan Bennett [00:49:40]:
It's just the coolest thing I can do.

Rob Campbell [00:49:41]:
I don't have the use cases for it. Yeah, and my use cases are I have like some audio to record and I haven't recorded anything in like 10 months, but I just need to do this one thing. I don't need anything fancy.

Jonathan Bennett [00:49:57]:
That's fair.

Jeff Massie [00:49:58]:
Yeah, I was gonna say, Ardour is wonderfully powerful. It's just 99.9% of it I don't need. It's like using Photoshop to like, I just got to crop this picture a little bit.

Ken McDonald [00:50:11]:
Yep. Or I just want to add text at the bottom of it.

Jeff Massie [00:50:15]:
Yeah.

Ken McDonald [00:50:16]:
GIMP does great for that.

Jonathan Bennett [00:50:18]:
Well, Jeff is going to reach under the tree and shake our Christmas present just a little Isn't that right, Jeff?

Jeff Massie [00:50:27]:
I am. And what Jonathan's talking about is the Linux kernel's 2-week merge window has closed. And what happens is when it closes, Linus Torvalds tags Release Candidate 1 or RC1. So on Sunday, November 1st, the merge window for Linux 7.4 officially closed and Torvalds opens his announcement like this, quote, this is a big merge window. How big? Torvalds put it at almost 20,000 commits against the usual total of about 15,000. Phoronix counted 19,671, the largest merge window in the kernel's roughly 35-year history. And just for reference, the previous 7.3 cycle had about 16,000. Now, LWN, which only counts actual changes and not the merge bookkeeping, you know, some of the overhead, came in a bit lower, around 18,600.

Jeff Massie [00:51:31]:
But however you count it, it's a record. The source tree is now about 41.6 million lines with nearly half a million new lines of code in 2 weeks. So why so big? Torvalds wrote, quote, I think the reason is by now the obvious one. And the obvious one is AI. For most of this year, AI tools have been finding kernel bugs at a rate maintainers have struggled to keep up with. And a lot of those fixes have landed here. You might expect Torvalds to be annoyed, as he has been in the past, but he isn't. Right after calling it big, he wrote, I'm actually— Taking this as a good sign, he said he's much happier with the flood of AI-triggered work going into the merge window rather than it showing up mainly as extra fixes during the RC period.

Jeff Massie [00:52:21]:
So his verdict was, I think that's a much healthier model. So basically, in other words, if AI is going to dig up hundreds, hundreds of bugs, he'd rather have that work arrive in the 2 weeks built for big changes than trickle it in during weeks meant for calming things down. He did hedge. We'll see how the RCs look. I should also mention he likes the early stuff because it goes into Next. So, you know, a lot of the will it compile and not break a bunch of things, kind of the early checks go in there. So it makes things a little smoother as well. He offered a second reason for the size too, is people are expecting 7.4 to be the next LTS release.

Jeff Massie [00:53:08]:
LTS is long-term support. The kernel that gets maintained for years and ends up in enterprise distros and Android phones. Well, getting your features into the LTS kernel means it'll be around for a long time. So developers rush to get things in. One catch, the LTS is usually the last kernel in the calendar year and Greg Crowe-Hartman makes the call. So if 7.4 hits its expected date, of December 20th or 27th, it's the favorite, meaning it, it will be the LTS. If it slips into January, Phoronix has suggested Greg might play it safe and pick 7.3. Uh, and as anybody knows, 20th or 27th in December is when it should be done, but it depends on how the RCs look and how Linus feels about it, feels about it.

Jeff Massie [00:53:58]:
So. Those are always subject to change. Now, Torvalds also warned people about reading the wrong numbers because he said a full third of the patch is just AMD GPU register offsets and bitmasks. So a third of the record-breaking patch is AMD header files, you know, basically a giant table of numbers. Now, I will note here that he's complained in the past about AMD header files and their size. It is kind of something he's pontificated on in the past as well. But set those aside, and about half of the rest is drivers. As for the short log, you know, the one-line-per-change summaries, his advice was, and I mean even more than usual, you don't want to see The short log.

Jeff Massie [00:54:53]:
It runs about 24,000 lines and 1.2 megabytes, which, you know, would almost fill a floppy disk for those of the proper generation to know about floppy disks. And yes, this merge window also included floppy disk driver fixes, which is why I brought up that little fact. All right, you might be thinking, yeah, it's all great. What's in it for me? Give me some goodies here. So this is just cherry-picking here of the few things. So AMD graphics, the AMD GPU driver gets HDMI 2.1 FRL, the high bandwidth mode for 4K at high-res refresh rates, along with FreeSync and variable refresh rate. If you've had trouble getting full speed out of HDMI TVs on Linux, this one's for you.

Jonathan Bennett [00:55:45]:
Mm-hmm.

Jeff Massie [00:55:46]:
Apple Silicon. The Asahi developers added initial support for the M4 Macs and the A18 Pro-based MacBook Neo. Now, don't get excited. It boots to a text console with no GPU and most peripherals missing. It's upstream. It's in the kernel, but this is very, very early foundation. It's, we poured the concrete. You can't live in the house yet.

Jeff Massie [00:56:14]:
Security. Landlocked, a kernel feature that lets programs sandbox themselves, gets new controls over namespaces and capabilities. On the file system side, Btrfs gets faster Z-standard decompression, and ext4 picks up buffered IOMAP support, a part of a long-running cleanup of how it handles I/O. Networking, a new congestion control algorithm called TCP ROCKET, R-O-C-C-E-T, a variant of the default CUBIC algorithm, is tuned to reduce lag on cellular connections. Dealing with Rust, another sizable batch of Rust support changes, and Intel's Xe graphic driver can now report VRAM temperature. Torvalds also mentioned 2 pull requests still sitting in his inbox that he's still thinking about. RC2 may get a bit bigger. I didn't find what those 2 requests were, but we'll probably find out soon enough.

Jeff Massie [00:57:16]:
Release candidates come out every Sunday from here. And with the final release, like I said, expected right before Christmas or maybe right after Christmas. Take a look at the show notes for full details and more features added as I only touched on a small, tiny fraction of everything getting added to this kernel.

Jonathan Bennett [00:57:35]:
Yeah, it's gonna— I'm looking forward to it. It's gonna be cool. It's interesting to see that it's so big though, for the various reasons mentioned.

Jeff Massie [00:57:42]:
Oh yeah, and a lot of stuff going in.

Ken McDonald [00:57:47]:
But why is everybody blaming Al?

Jonathan Bennett [00:57:51]:
Indeed. Um, I, uh, yeah, I've mentioned it last week. I'm real tempted to start running this on my desktop. Uh, might start with some of the release candidates when they actually get to RC stage. Get rid of that.

Jeff Massie [00:58:03]:
I have run RC1s before and they haven't been too bad.

Jonathan Bennett [00:58:07]:
Yeah, it's usually not too bad and it just gets better and better as you go. Um, yeah, you know, I've got a, uh, HDMI to DisplayPort to HDMI converter running right now to be able to get my TV up and working, and it would be very nice to be able to go back to just raw HDMI. Um, because there's some— not everything works through the converter. Either. And I think everything will just work with the, uh, with the proper HDMI version, with 2.1 working.

Jeff Massie [00:58:34]:
It's supposed to.

Jonathan Bennett [00:58:36]:
It's supposed to. Uh, all right. Yeah, I heard that.

Ken McDonald [00:58:40]:
Yeah, asking too much for, uh, 2.2 to work?

Jonathan Bennett [00:58:44]:
Does HDMI 2.2 exist yet? I don't think it does.

Jeff Massie [00:58:48]:
Is— yeah, I didn't think it—

Ken McDonald [00:58:52]:
Where did I see an article?

Jeff Massie [00:58:53]:
It's one of those that's out there like PCIe Gen 7, but No actual hardware exists yet.

Jonathan Bennett [00:58:59]:
Yeah, I think that's what it is. That is what it looks like. All right. Well, we're going to take a quick break and then we're going to come back and we're going to talk about

Rob Campbell [00:59:10]:
more of

Jonathan Bennett [00:59:10]:
the kernel. Bob, I thought you weren't going to talk about AI anymore. And this story says OpenAI. What's wrong with this? Anyway, no, it's kernel stuff. We'll be right back. Don't go anywhere after this.

Rob Campbell [00:59:21]:
All right. Well, Jeff talked about Linus being happy about all the AI bugs coming their way. Hopefully this still pleases him because this week OpenAI just discovered nearly, well, I'm sure they've been working on it for a little longer. I don't know, but they just discovered nearly 1,000 security vulnerabilities in the Linux kernel. And believe it or not, I actually think this is fantastic news. Not because I'm a hacker. We'll get into that. So according to Phoronix, OpenAI used an experimental AI security research system to scan the Linux kernel and identify 2,308 potential vulnerabilities.

Rob Campbell [01:00:08]:
Of those, it successfully reproduced 1,724 vulnerabilities and ultimately identified 948 distinct local privilege escalation vulnerabilities complete with working exploits. So it's not just in theory, you know, those 1,700 or 2,300, that's more of the theory. Maybe things they should fix at some point too, because somebody could find a bug, but AI or exploit, but AI couldn't at this point. So these are vulnerabilities. These 948 are ones that could potentially allow someone with limited access to a Linux system to escalate their privileges and gain root access. And it accomplished all this for about $1.2 million in API costs. Obviously, it's their own system, so I don't think anybody paid that, but it cost some electricity. Now, that's rather impressive, but I think the bigger story is what this means for the future of security.

Rob Campbell [01:01:17]:
We've been hearing increasing complaints from open source maintainers over the past few years about being overwhelmed by AI-generated vulnerability reports. And I get it. Those developers already have enough work to do. And now AI is finding vulnerabilities faster than humans can possibly review the patch. But I think, you know, That's looking at it the wrong way. Consider the alternative. These vulnerabilities, they already existed. You know, OpenAI didn't create them.

Rob Campbell [01:01:52]:
It just discovered them. And, you know, here's something we need to understand. The bad guys have access to these AI tools also. So if OpenAI can use these tools to discover nearly 1,000 ways to gain root access, What makes any of us think cybercriminals and nation-state actors aren't developing similar capabilities? Because they absolutely have an incentive to do so. And unlike OpenAI, they're not going to responsibly disclose these vulnerabilities and provide proposed patches to the maintainers. They're going to exploit them. So yes, maintainers might be overwhelmed right now with vulnerability reports. Hopefully they get all patched and that overwhelmingness slows down.

Rob Campbell [01:02:44]:
But would they rather be overwhelmed with bug reports and patches or overwhelmed with zero-day attacks against systems that have already been compromised? I know which one I would choose. Now, there's an important distinction between legitimate validated security research and dumping thousands of unverified AI-generated reports on already overworked developers. I mean, that, okay, that's a real problem there. But OpenAI actually tested these vulnerabilities, developed working exploits, generated candidate patches, and included human review before reporting them. It's about as responsible as it gets, isn't it? I don't know. You know, that's kind of the process. I hope even overwhelmed maintainers can get behind. And as I've said many times, we just need better tools and resources to help maintainers handle this growing volume of discoveries.

Rob Campbell [01:03:46]:
And Jonathan, I guess, mentioned something about some rabbit earlier that can do this. I don't know. But because AI-powered vulnerability research isn't going away, it's only going to get faster and more accessible. Unless the price gets too expensive, like some people theorized in the show here. We'll see. The challenge now is making sure the defenders can help find and fix these vulnerabilities before the attackers discover and exploit them. And personally, I'd much rather hear about 948 vulnerabilities being discovered by security researchers than 948 vulnerabilities being discovered by attackers. Finding vulnerabilities isn't the problem.

Rob Campbell [01:04:30]:
Leaving them undiscovered and unpatched is.

Jonathan Bennett [01:04:36]:
Yeah, every time we hear about something like this, I do kind of have to ask myself, like, how many of these are— how many of them are real vulnerabilities? Yeah, like, it is possible, and I've seen these reports before, it's possible to have like a theoretical vulnerability, but you you get to diving into the details of it, it's like,

Rob Campbell [01:04:56]:
well,

Jonathan Bennett [01:04:57]:
that's never ever going to happen in the real world.

Rob Campbell [01:05:00]:
948 of them have working exploits, actual code.

Jeff Massie [01:05:04]:
But you need to have like a Wangenstein keyboard with a— That's the fun sort of thing. Fantastic mouse, and between the 2 drivers, they cause a, you know.

Jonathan Bennett [01:05:15]:
Or one of the other ones that you get sometimes that it's like, this vulnerability assumes to, you know, to be able to exploit it, you would have to be at the computer touching things, or you have to be running in kernel already to be able to exploit things like that. I guess that's the big one that I've seen before. It's like, it's a vulnerability, but you have to be writing kernel code to be able to access it. It's like, it's not a vulnerability at that point. There's no escalation of privilege. And so I just, I have it. Hey, I have a grain of salt. I'm sucking on a grain of salt, we shall say, whenever I hear one of these.

Jonathan Bennett [01:05:54]:
And yes, Harold Finch points out local exploits are still a problem. Yes, yes, Harold, I know they're still a problem. You would like to get rid of them. I acknowledge that. But yeah, like I said, a little bit of a grain of salt whenever I hear these. At the same time, I'm sure most of them are indeed bugs. Yay for getting them fixed.

Rob Campbell [01:06:15]:
Even if only a quarter of those are bad, that's— it doesn't— it only takes one. It only takes one vulnerability to get exploited. So

Jonathan Bennett [01:06:24]:
that's fair.

Ken McDonald [01:06:25]:
What's scary though is when you start talking about chains.

Jonathan Bennett [01:06:31]:
Well, usually that's— usually that's what you have to have. Like, one of these vulnerabilities by themselves will oftentimes not be particularly exploitable, but you'll have like 3 of them that you can chain together, which goes from, okay, you can leak a little bit of data and you can do it, you can set, you can write to memory. And then you have this other one that'll let you jump to memory. And it's like, well, you put those 3 things together and you can defeat the randomization of the kernel layout. You can write shellcode somewhere and then you can jump into shellcode and execute it. So yeah, that's—

Ken McDonald [01:06:58]:
Or you take all 941 vulnerabilities and bundle it into one massive

Jonathan Bennett [01:07:07]:
You get your AI working on that, Ken. I would love to see that. Come write me a POC that uses all of these. That would be amazing.

Jeff Massie [01:07:15]:
I want to see the token cost bill on that one.

Rob Campbell [01:07:18]:
I mean, this alone was $1.2 million.

Ken McDonald [01:07:19]:
I'm not spending $151 million on it.

Rob Campbell [01:07:23]:
But, you know, I saw even if it was their own systems and it didn't really cost them that much, they still put real work into it, I'm sure. And, uh, So you got to give them kudos for, you know, taking the initiative and actually, you know, doing something. And they did human review. So that is real work right there, at least.

Jonathan Bennett [01:07:45]:
Oh, no, absolutely. I do not say that to downplay the work that was done here. I'm sure it's excellent work. I just, like I said, I've seen weird vulnerability reports before.

Jeff Massie [01:07:55]:
Yeah, I think there's probably 100 of these that are like, ooh boy, this is kind of pretty real. The rest are the kind of weird.

Rob Campbell [01:08:02]:
Well, maybe we'll find out in a kernel release coming up soon when they—

Jeff Massie [01:08:07]:
7.5.

Ken McDonald [01:08:09]:
I'm just glad I'm not their CFO looking at the cost of all this.

Jonathan Bennett [01:08:15]:
Oh, no.

Jeff Massie [01:08:16]:
Well, OpenAI— It doesn't cost them that much.

Rob Campbell [01:08:18]:
This is marketing.

Jonathan Bennett [01:08:19]:
Yeah, exactly. It's exactly it, Rob. If I was the CFO of OpenAI and I said, we got that return on $1 million, give these guys more money. That's amazing. We have the nerds at the Untitled Linux Show talking about us again.

Rob Campbell [01:08:32]:
That's great. That's $1 million, $1.2 million of tokens. What's that really cost them? I mean, I don't know what it really cost them.

Jeff Massie [01:08:39]:
Well, you missed something else too.

Rob Campbell [01:08:41]:
Maybe.

Jeff Massie [01:08:42]:
No, this is a tax write-off, I bet.

Jonathan Bennett [01:08:46]:
Oh, that's true. I'm sure. Let's

Jeff Massie [01:08:49]:
crank that value up, baby.

Rob Campbell [01:08:51]:
Donating that time.

Jonathan Bennett [01:08:53]:
Absolutely.

Rob Campbell [01:08:54]:
Absolutely. To a charitable—

Jeff Massie [01:08:55]:
We need more sharks with lasers on their head.

Jonathan Bennett [01:08:57]:
Yeah.

Ken McDonald [01:08:58]:
So that's what the CFO's saying. All right. That takes care of this year's taxes.

Jonathan Bennett [01:09:04]:
It's only $1 million.

Rob Campbell [01:09:05]:
I don't think, I don't think they owe any taxes the way they've been in the red anyway.

Jonathan Bennett [01:09:12]:
Probably true. All right. Hey, let's talk about LibreOffice. Ken, what is new there?

Ken McDonald [01:09:18]:
Well, there's a lot new in LibreOffice. If you're looking for stuff that's helping to keep a stable version of it stable, because what Bobby Borisov and Markus Nister wrote about is the release of LibreOffice 26.2.7. This is a final maintenance update to the 26.2 series of my favorite free and open source office suite for the desktop. According to Markus, this release includes more fixes to address bugs, crashes, and other user-reported issues, improving the overall stability and reliability of this popular open-source, free, cross-platform office suite. One notable change addresses Microsoft Word compatibility. Now Writer fixes an issue where hyperlinks in a .docx document's table of contents could stop working until the table was updated. LibreOffice 26.2.7 also adds support for Web Query— that's the .iqi files that you, uh, might find in Calc. Addresses several DOCX round-trip problems and upgrades the bundled Python interpreter to version 3.12.16.

Ken McDonald [01:10:54]:
According to Bobby, Impress users will see fixed audio playback problems in presentations, including a Windows-specific regression that prevented embedded audio from playing. I'm glad it wasn't in Linux. Now, as I said earlier, LibreOffice 26.2.7 is the final release in this branch, and it does reach end of life the end of this month, November the 30th. The Document Foundation recommends you move to the newer LibreOffice 26.8 series by then. You can get more details from Bobby and Marcus's articles. which are, as always, are in our show notes.

Jonathan Bennett [01:11:39]:
Yeah, it's what's new in the old version. The newest thing in old LibreOffice.

Jeff Massie [01:11:45]:
The LTS version.

Jonathan Bennett [01:11:46]:
Yeah. Apparently 26.8 is out. And I would assume working on 26.9.

Ken McDonald [01:11:54]:
And we should see an article come out about it next week.

Jonathan Bennett [01:11:58]:
I would imagine so. There's been a bit of a back and forth as to whether LibreOffice is continuing to carry the torch forward, um, uh, or whether— because apparently several of the engineers that used to work at LibreOffice are now over at Collabora. And I think, wasn't it Fedora that was talking about possibly using Collabora as the default office suite going forwards? I think I saw that.

Rob Campbell [01:12:20]:
Yeah, I think so.

Jonathan Bennett [01:12:21]:
So that's, that is, uh, that is something to watch, I will say. Uh, see where exactly that ends up.

Rob Campbell [01:12:26]:
LibreOffice is all right, but I don't think it's my favorite.

Jonathan Bennett [01:12:30]:
What's your favorite?

Rob Campbell [01:12:31]:
I don't know. I like a lot of the other ones. I just, I don't know. I've always had my criticisms of LibreOffice. It just feels so— just the style.

Ken McDonald [01:12:40]:
I'll have to plead guilty to finding myself grabbing Google Docs more and more lately.

Rob Campbell [01:12:48]:
Yeah, it's definitely not Google Docs either.

Jeff Massie [01:12:50]:
Yeah. You know, I'll tell you what, maybe I'll just try some Collaborate for a while because, you know, as much as I like LibreOffice other than The interface stuff is, it's just kind of awkward. It just doesn't behave like any other office suite. So you're like, oh, I'm going to drag and move it. Oh, that didn't work. I

Rob Campbell [01:13:10]:
use it often because it's the default and it's there. But I like OnlyOffice or Collabora or I don't remember them all, but I like most of a lot of them better than LibreOffice really.

Jeff Massie [01:13:24]:
If they could redo the interface, It would go a long way.

Rob Campbell [01:13:28]:
You know, I've even told them that on a Facebook post that they had. I said something about that one time, and I don't remember what the response was. They responded to me. I don't remember what it was.

Jeff Massie [01:13:39]:
Well, and honestly, as much as people, you know, love to hate on Microsoft's Office products, it's kind of the standard. And it's like, if you kind of just copy that, you know, the— The behaviors, it would make transitioning a lot easier.

Ken McDonald [01:13:59]:
I don't know. If I had a choice, I'd say going back into the day that I preferred Lotus 1-2-3 over Microsoft's Office suite.

Jonathan Bennett [01:14:12]:
That's going way back, Ken.

Rob Campbell [01:14:13]:
Yeah, maybe comparing it to—

Ken McDonald [01:14:16]:
Like I said, back in the day.

Rob Campbell [01:14:18]:
Maybe comparing it to Word 1 at the time. I don't think it'd be anywhere comparable to Word or any of them today.

Ken McDonald [01:14:26]:
Well, you know how Microsoft Office got to where it is today? By buying up its competitors and putting them into the Office suite.

Jonathan Bennett [01:14:39]:
I mean, that seems to be the case, yeah. All right, let's talk. Actually, let's take a break. We got some other fun stuff coming. In fact, we're going to do a little gaming here in a moment. And that is the thing to look forward to. So don't go anywhere. We'll be right back.

Jeff Massie [01:14:56]:
GOG, good old gaming, started life in 2008 as, well, it's just as good old games and a store for classic PC games with no DRM. Buy a game, download the installer, and it's yours. No online checks, no launcher required. 18 years later on November 5th, GOG held its first ever showcase to celebrate its birthday. Among the remastered Wing Commanders, and I say Wing Commanders because there was like a bunch of them in there, and a new publishing label called RetroVibe, it made the announcement that Linux gamers had been voting for. GOG Galaxy is coming to Linux in 2027. Now, Galaxy is GOG's optional, optional desktop launcher. It handles installs and updates and cloud saves and achievements and playtime.

Jeff Massie [01:15:51]:
And it can pull in your libraries from other stores. So everything lives in one place. And, you know, think kind of like how Steam does a lot of their stuff. It's only ever existed on Windows and Mac, though. Linux users could buy GOG games with native Linux builds, which GOG's offered since 2014, but no Galaxy. So GOG's anniversary page describes the new client as the next generation of our launcher, faster and fully customizable with a modern interface and finally on Linux. In its statement, GOG added, we know this has been a long time coming, but we wanted to do it properly. GOG Galaxy is officially headed to Linux.

Jeff Massie [01:16:38]:
So long time coming is fair. You know, the wishlist request for Linux Galaxy client has more than 44,000 votes according to Computerbase. This year, GOG revised— revealed it in slow motion. The first step came in January. CD Projekt had been sold GOG to its co-founder, Michael Kicinski, for about $25 million, making the store independent again. In an interview with PC Gamer, Kicinski didn't hold back about Windows. It's such poor quality software and product, and I'm so surprised that it's spent so many years on the market. End quote.

Jeff Massie [01:17:22]:
Managing director Maciej Gobrinski said Linux was one of the first things that we put our strategy for this year to look at closer, admitting we probably could do better on that front. Yahoo reported that Kaczynski himself had left Windows for macOS, but, you know, baby steps. That same month, GOG posted a job opening for a senior C++ engineer on Galaxy. that called Linux the next major frontier. The listing also asked the hire to achieve, use, and promote AI-assisted development tools, which PC Gamer treated as the listing's jump scare. Step 2 came in July. Joint CEO Kazinsky-Rapolsky and Gaming on Linux, the company had hired that specialist, was actively exploring the best ways to approach Linux support. But, quote, this is a significant undertaking.

Jeff Massie [01:18:25]:
So while we're not ready to share any specific plans or timelines or results just yet. And step 3 was this week, you know, a year, 2027. There's a signup for the Galaxy beta and a redesigned client for every platform. But GOG says the new version is simpler, faster, with better library views. And it's noted that the design shown is still in development. They have some like mockups, or at least what they— what it looks like now, but subject to a lot of change. GOG also reported its core promise. GOG Galaxy is entirely Optional.

Jeff Massie [01:19:12]:
The offline installers aren't going anywhere. So if anybody's at all nervous about this, you don't have to use it. This is simply a front end to make things easier, a little more, oh, I want to play this game, click, versus having an independent array of games. You can now have one launch point. So why does this matter? Well, you know, some of it's because Linux gaming isn't niche anymore. The Steam Deck runs on Linux and Valve's Steam Machine does too. You know, if you want GOG games on a, on a Deck, you know, you use commodity tools like Heroic Games Launcher or Mini Galaxy. And people have said Heroic is good, but it's not as good as it could be.

Jeff Massie [01:19:58]:
It's been quoted as, quote, it doesn't always work flawlessly with every title. And users report cloud headaches. And an official client means official cloud saves and official support. So here's where what GOG has not said, and this matters quite a bit. Windows games. Most of GOG's catalog is Windows only. On Linux, those need a compatibility layer like Wine or Valve's Proton. Will Galaxy bundle one? Lean on Proton? Well, you know, which GOG doesn't control Proton, or will it build its own? GOG hasn't said, as, you know, Hardware Busters put it, the native client is only half the problem.

Jeff Massie [01:20:46]:
Distro's and SteamOS. No supported, you know, distributions, packaging format, or Steam Deck gaming mode integration has been announced. So what's— who's going to get the support? natively? Who's going to have to have some coders tweak it a little? We don't know. It's coming. That's all we know. Feature parity. The website asks whether Linux Galaxy will pull in your other store libraries like the Windows versions do. No answer yet.

Jeff Massie [01:21:24]:
And like I said, dates. No beta start date, no launch date beyond 2027. Uh, is from lack of details, I'm thinking, you know, think like probably a year from now, 2027, but that's my own personal wild uninformed speculation. Uh, some people have been waiting for the year of the Linux desktop for decades. Uh, you know, GOG fans will have to settle for the year of the Linux desktop launcher. Like I said, signups are open now. Just don't expect the installer for this Christmas. Take a look at the article linked in the show notes for a lot more details.

Jonathan Bennett [01:22:07]:
You know, you asked about that. Will they make their own wine, their own Proton? And it reminds me, the guy that does Bottles is making a wine alternative called Raven. I suspect he's heavily using the AI to make such rapid progress because he's already got Microsoft Office running on it.

Rob Campbell [01:22:26]:
I never heard about this. Did we do a story on this?

Jonathan Bennett [01:22:29]:
I don't think we have. I'll throw a link in to—

Rob Campbell [01:22:32]:
Breaking news.

Jeff Massie [01:22:34]:
Rob missed a Microsoft story? What?

Jonathan Bennett [01:22:36]:
Yeah.

Rob Campbell [01:22:37]:
That's a Microsoft story.

Jonathan Bennett [01:22:40]:
I kind of, yeah. Indeed. Yeah, it's crazy. No, I don't know much about it either. I was just, you triggered the memory that this is a thing. And so I went looking for it and apparently it's called Raven. And, uh, it is, it's by the guy.

Jeff Massie [01:22:57]:
And, and while, you know, GoD doesn't control, say for example, Proton, it's a hell of a foundation to start off on.

Jonathan Bennett [01:23:05]:
True.

Jeff Massie [01:23:05]:
And they can tweak from there if they need to. I mean, it's better if you don't have to, but a huge chunk of the work is already done and you could just kind of put unique patches on it. Yeah, kind of like Proton Experimental. Just, we have the solid base. Let's just throw this other stuff and see what sticks.

Rob Campbell [01:23:28]:
You know what I would love to see is Microsoft. They really love Linux. I'd love to see them get in the game of making a, either chipping in with Wine or making a Wine alternative themselves.

Jonathan Bennett [01:23:42]:
I mean, they have done kind of quietly, they've done some work over the years on some of these things. Like, I remember a story years ago that they, they, they helped the Samba devs make something work and fix problems in Samba. So like, it would not terribly surprise me if there's some Microsoft devs that are quietly out there fixing things in Wine. They're just probably because reasons they don't do it from their @microsoft.com accounts.

Jeff Massie [01:24:12]:
Well, and I don't know how much things They want things like Office to run locally. They would rather have them run in the cloud and then you're tied into their whole ecosystem.

Rob Campbell [01:24:25]:
But the local client costs more money. So if you have the 365 on-premises client, the fat client or whatever, that costs more than just the single plain old cloud license only.

Jonathan Bennett [01:24:42]:
Yeah, that's true.

Ken McDonald [01:24:43]:
Yeah, but don't they charge per user for the cloud license for enterprises?

Rob Campbell [01:24:47]:
They also do for the, the, the, it's also per user for the, uh, fat client or the installable.

Jeff Massie [01:24:56]:
Enterprise, I don't know. As far as I know, you don't just get Office. It kind of, you kind of have to buy the whole big bundle.

Ken McDonald [01:25:04]:
It's a bundle.

Jeff Massie [01:25:06]:
What?

Ken McDonald [01:25:07]:
It's a bundle.

Rob Campbell [01:25:09]:
I've sold the 365 licenses for years. So I know all about the different SKUs. If you really want to know—

Ken McDonald [01:25:15]:
It's a Microsoft bundle.

Rob Campbell [01:25:16]:
If you really want to know the different SKUs, I could tell you about them. I am a little outdated on the pricing because I don't do that stuff anymore. But I know what the prices were a few years ago.

Jonathan Bennett [01:25:25]:
Aren't you so glad, Rob, that you don't have to do that anymore?

Rob Campbell [01:25:28]:
It's wonderful. Well,

Jeff Massie [01:25:29]:
and a lot of the pricing, tell me if I'm wrong, Rob, a lot of it has to do also with the size of the organization. how many seats you will have and—

Rob Campbell [01:25:37]:
No, not so much.

Jeff Massie [01:25:39]:
Oh, really?

Rob Campbell [01:25:41]:
You can maybe get some discounts from a certain vendor based on size, but not so much, especially if you just buy direct,

Ken McDonald [01:25:47]:
but— You pay for X number of seats automatically and you make sure you don't go above that.

Rob Campbell [01:25:54]:
Yeah. If you don't need the high enterprise, this is the pricing of a few years ago. $4 a month for Exchange only. That's email only. Per user. Yes. $6 a month for the web apps and email.

Ken McDonald [01:26:10]:
And SharePoint?

Rob Campbell [01:26:12]:
Yep. That comes with anything that's free. $8.25 a month for just the fat client, no online. $12.50 a month for all the online, all the offline. And now there's higher ones where you can get get, you know, the security and all the other things too. But that's, that's kind of the lower-end base packages. And I think those costs have gone up a little bit, but that's what they were.

Ken McDonald [01:26:35]:
And if you've got 25 users or less, how much does it cost per person?

Jeff Massie [01:26:43]:
Same. You see, I was coming from the enterprise side of like, okay, what if you have, you know, 50,000 users? And,

Rob Campbell [01:26:51]:
you know, you probably could get a deal with it, but it's not, uh, market that way. But there's like E3, E5, premium licenses, all kinds of stuff that have all kinds of other things.

Jeff Massie [01:27:00]:
And I will say, I am so far away from that where I work. Thankfully. I have no idea. Yeah, it is not at all what—

Rob Campbell [01:27:08]:
As fun as I like talking about, you know, my past life and selling Microsoft Office, we probably should move on.

Jonathan Bennett [01:27:15]:
We probably should. I was going to make a comment about how disheartening it is for someone to buy a new computer computer and built the computer and then like, okay, now it's another $300 for that corporate Microsoft license. Anyway, let's talk about something that everybody agrees on. It's time to dive into a bit of Wayland news. Rob, what's new there?

Rob Campbell [01:27:36]:
Well, this actually isn't Wayland news. Wayland is involved, but this is a desktop. So here's a project. It caught my eye this week. I haven't installed or looked too deep into it, but it caught my eye, especially since most of my programming experience, at least going way back 27, 26 years ago, has been in web development. So this project, it's called Domicile, and it's a new Wayland compositor. I mean, I guess there's Wayland, but that lets you build And customize your Linux desktop using HTML, CSS, JavaScript, and even React. That's right.

Rob Campbell [01:28:22]:
Instead of writing complicated desktop environment code, you can easily build your desktop the same way you'd build a website. Sounds kind of fun to me. Domicile uses a modified version of Chromium that represents native Wayland applications, application windows as elements, in a web page. Um, and, uh, you know, if you want rounded corners on your windows, use CSS. Want animated transitions between workspaces? CSS, or, you know, can handle that too. Want to completely redesign your taskbar, application launcher, or window layout? You could do that with the same technologies millions of web developers Already know. And your applications are still native Linux applications. They're not, you know, suddenly running inside a web browser or anything.

Rob Campbell [01:29:16]:
So I find this fascinating, but it also reminds me of something from the old Windows days. Uh, does anyone remember Microsoft's Active Desktop? Yes. So anyway, back in the late 1990s, Microsoft introduced this feature that allowed you to put actual web pages directly on your Windows desktop. You could have live news, weather, stock tickers, or pretty much anything. I don't know how much of that stuff— I don't remember how much of that stuff really existed back then, but you could put it there if you found it. It was part of Microsoft's big push to integrate Internet Explorer into Windows, complete with technologies like ActiveX. Dun, dun, dun. And as you might imagine, combining web content with desktop functionality introduced some interesting security concerns.

Rob Campbell [01:30:09]:
Active Desktop actually survived all the way through Windows XP. And I don't think I even realized it was that long, but before it disappeared with Vista. And ActiveX developed quite a reputation for security vulnerabilities over the years. Now, domicile, let's get back to the topic here. Domicile isn't quite the same thing. It's Ordinary web pages don't automatically receive access to your operating system, but trusted desktop components can have significant system access. And building your desktop around Chromium introduces questions about memory usage, security, and how quickly your browser vulnerabilities can be patched. Still, I think this is an interesting option for Linux.

Rob Campbell [01:30:56]:
And isn't one of the best things about Linux the choices, the options we have? So, you know, instead of learning an entirely new development framework, web developers can use skills they already have. Now, is this going to replace KDE or GNOME? Probably not, but it could inspire some creative new desktop environments. And maybe Microsoft's old desktop idea wasn't entirely crazy after all, just a few decades ahead of its time. And, you know, maybe, maybe this inspires something. And then one of the more traditional desktop environments takes it and is like, hey, that's a really great idea. I love that. We're going to— obviously, you'd have to re-port it. to something that's not a web technology, but, you know, it's like they could maybe take those inspirations into their own desktops if something cool comes out of it.

Jonathan Bennett [01:32:00]:
Yeah, absolutely. You know, there's a lot of the existing desktops that you already use some of these web technologies in, like

Rob Campbell [01:32:12]:
KDE Widgets, I think.

Jonathan Bennett [01:32:13]:
Yes, exactly. That's the one that was coming to mind.

Rob Campbell [01:32:16]:
Made one of those years ago when it like first came out in what was that 4, KDE 4, when they had all the prompts and they first had widgets, I think. Yeah, the Plasma desktop.

Jonathan Bennett [01:32:26]:
Yeah, but it enabled so much cool stuff. Yeah. Um, so yeah, really, really, really interesting stuff. Um, I'm actually, I found something else that I'm going to, uh, we're gonna let Ken talk about OpenShot and then I've got one more story I'm gonna tag on because something just News just released. Talk about some actual breaking news.

Rob Campbell [01:32:44]:
Breaking news.

Jonathan Bennett [01:32:45]:
Yeah. So we'll let Ken go first with OpenShot 4.1. And then I've got one more thing to finish off the show with.

Ken McDonald [01:32:53]:
Just one more thing?

Jonathan Bennett [01:32:55]:
Just one more.

Ken McDonald [01:32:56]:
Well, first, let me go ahead and let you know what Bobby Borisov wrote about the latest release of one of the free open-source video editors for Linux. As you mentioned, Jonathan, it's OpenShot. This time version 4.1. According to Bobby, one notable addition is the ability to create and edit text directly in the video preview without opening the separate title editor. Users can insert a text clip via the timeline toolbar or by pressing Shift+T, then type and format text using a floating toolbar with controls for fonts, size, color, alignment, and other styling options. Other highlights include Auto-Optimize, Optimize, where small, fast optimized copies are created for instant previews and seeking. Smarter Export, where export settings are checked as you edit. With clear explanations and one-click fixes, and ARM64 builds for Linux, allowing you to install OpenShot on ARM64 computers and servers.

Ken McDonald [01:34:18]:
Now, as always, more details are available in Bobby's article, and I have the link in our show notes. Yeah, Jonathan, have you, uh, Played with OpenShot yet?

Jonathan Bennett [01:34:32]:
I think I have, but it's been quite a while. You know, there are a couple of these editors. There's about 3 video editors on the Linux desktop that are all pretty decent. OpenShot, Kdenlive, and Shotcut. Yeah. I think—

Ken McDonald [01:34:49]:
And you still prefer Kdenlive?

Jonathan Bennett [01:34:51]:
I do. I never can remember the difference between OpenShot and Shotcut, like which one is which. One of them is the more feature-filled and the other is the more intentionally simple. And I never can remember which one is which.

Ken McDonald [01:35:03]:
I think Shotcut's the more simple and simpler one.

Rob Campbell [01:35:07]:
I normally use Shotcut. I often misname it and call it OpenShot.

Jonathan Bennett [01:35:12]:
Yeah.

Rob Campbell [01:35:12]:
And I find out my computer, never mind, it's Shotcut.

Ken McDonald [01:35:14]:
That answers your question, Jonathan.

Jonathan Bennett [01:35:16]:
Yes. I, uh, yeah. I want to go back and give OpenShot a try. Last time I tried it, it was laggy, the timeline in particular. Like if you had an hour and a half long video that you just dumped on the timeline and then went to start messing with it, everything was just really slow and did not work for my use case. But I will have to go back and try it again because maybe they've fixed that at this point. And if so, I would really like it. It's a nice editor.

Ken McDonald [01:35:47]:
I need to try that instead of just jumping straight to FFmpeg.

Jonathan Bennett [01:35:53]:
What you need to do is vibe code your own front end onto FFmpeg. No, don't do that. You just want to—

Jeff Massie [01:35:59]:
First, Ken, shut off the VAX. It's time to let go.

Jonathan Bennett [01:36:03]:
It's time to let go of the VAX. Indeed. All right. So I teased you on it. We got one more story that is some breaking news. And that is with Linux 7.3 happening, we've got the Asahi 7.3 Tree progress report. And they are— they have some things to brag about. And I'm sort of reading this live.

Jonathan Bennett [01:36:25]:
So if this is a little disjointed, that is why. They've got— they talk about the patches for the low-level SoC blocks. AVD, the driver has spent 3 months in the downstream tree and it's already— I'm not sure what list it's on, but it's on some list. They're working on the M4 Pro and the Max devices and also the M5. Those things are coming along. The initial device trees are bare bones and only sufficient to boot the SoC to a TTY. That is an accomplishment, actually. So it looks like the Max devices and the M5, you can now boot to a TTY.

Jonathan Bennett [01:37:02]:
That is not nothing. That is definitely something to be proud of. They are shifting to an upstream-first approach where practical. I like that. It's one thing that's always been weird about the Asahi project is, uh, it was sort of cloistered and they'd eventually push stream up, push stuff upstream. Um, they now consider the M3 support to be good enough for it to be considered generally available. You no longer have to hit the I'm an expert button. Um, looks like they're doing some more work with virtualization and enclaves and all of those things.

Jonathan Bennett [01:37:36]:
They can now split spawn up to 3 virtual machines in EL1. M3 support, they're now working on the GPU and it can, it appears, draw triangles to the screen, which sometimes that's the majority of the battle. They promised Thunderbolt support way back in January of 2024, and that is finally coming. They say there's a catch though. It's only USB 3 and XDomain and Thunderbolt networking. So there's some other thing, PCIe support and DisplayPort tunneling are not supported yet. That is coming. They're continuing to work on gaming.

Jonathan Bennett [01:38:16]:
They talk about FEX and how it has gotten better and better and also Wine and those things. But, but, but, but this brings us then to the thing that really caught my attention and what I actually wanted to talk about. And that is that Asahi has done its work under the MIT license, which is in and of itself a little odd because it's mostly work on the kernel, which is GPL. But they say that as much as possible that they have, they've worked under the MIT. And I believe a lot of that was because they wanted it to be able to be used with BSD. and some of the other operating systems that were not GPL compliant— not GPL compatible, excuse me. So they complain, they talk about in this update that they have started to see what they consider to be malicious software practices by other people out there. And apparently there is at least one person, one company out there that is attempting to replace the project and monetize Linux on Apple.

Jonathan Bennett [01:39:32]:
And they said in some cases, they were seeing that in-development code was being lifted out of their own individual forks where they were working on it and being published without attribution, or in some cases rewritten with LLMs to obfuscate the origin. And they say the MIT license explicitly allows this. And it has no carve-outs to protect against bad faith actors. I want to take a quick little break there and say neither does the GPL. And that's important because no one can actually agree on what bad faith actor means. One person would say, oh, this is terrible. Another person would come along and say, no, no, that's exactly what the MIT is intended to allow you to do, right? It's the whole, you can't have a don't be evil clause in your license because it turns out nobody can actually agree on what that would mean. mean in the real world.

Jonathan Bennett [01:40:22]:
So that's an aside. Continue going. So as such, they have made the difficult decision to transition all of their repositories to the GNU GPL v2 or later. Going forward, all Asahi Linux code will be licensed under strong copyleft licenses only. Those who do not learn from history are doomed to repeat it. I think it makes sense for them to be GPL v2+ because that's what the upstream kernel is. And in fact, I think anything that was based on the kernel was actually already GPLv2 because that's the way that license works. So this is going to be like their extra stuff, their glue code, their scripts, the things that run to make Linux on the Mac work, not the Linux code itself.

Jonathan Bennett [01:41:06]:
GPL is a great license. No problem with that. I really wonder though if they didn't stop and think when they first started doing this and Like, do they understand what the GPL was for? Because like the things they're complaining about is the reason that you would have an MIT. You have an MIT so that people can do this. Um, so anyway, I— they talk about, they talk about Wine having similar problems and learning the similar lesson that there's a reason you might not want to use MIT licenses and there's a reason the GPL exists. Um, yeah, it's just like I said, breaking news. I just now saw this. I think this was published this morning or overnight last night.

Jonathan Bennett [01:41:45]:
And really interesting to see. But yeah, Asahi is going GPL like the rest of the kernel is.

Rob Campbell [01:41:51]:
Yeah, I think it's good. I mean, I'm fine either way at the licensing aspect of it. It seems like they're making good progress. But I had to chuckle when you said that they were publishing it without attribution. I'm like, that's kind of the point of the MIT license. Like you take it and you can almost do anything you want with it. Whereas the GPL, you know, at least how I, my main distinction with the GPL is, and why I usually do it is because, you know, I'm doing this for free. The least you could do is attribute, if you're going to take it, attribute to me just as a thanks.

Rob Campbell [01:42:28]:
This guy helped make, do part of this for me. But I mean, if you don't care about, you know, that, that little bit of thanks in a way, hey, this guy played a role.

Jonathan Bennett [01:42:37]:
And the other thing that GPL does is if you're going to base work off of this, it gets to be GPL as well. You can't do, you know, you can't fork it and go private with it. You can't fork it. You can sell it if you want to, but it still has to be GPL. Yeah, there's a reason the GPL exists.

Rob Campbell [01:42:53]:
And you're— but your evil clause, I mean, I don't think it does anything for either of them. You know, the first one, they can still take it and do whatever they want and say they did it. GPL, They could take it and still resell it and whatever they want. They just have to have attribution in there.

Jonathan Bennett [01:43:10]:
And I will tell you from personal experience, the GPL will not stop people from using the LLM to white room re-engineer your code because they will ask the LLM to do it and it will go, sure, I can absolutely do that.

Ken McDonald [01:43:26]:
And then they'll include the— line that says, thank you, Rob, for contributing to the cause.

Jonathan Bennett [01:43:32]:
Well, no, what I've seen, because I've looked at this code before where someone has sent over in Meshtastic, this has happened to us multiple times. We clean room re-engineered your code. We asked the LLM to do it. And if you go in there, you will see the comments of this value came from this location in the original source. It's like, you have no idea what you're talking about. You have zero understanding of how this actually works in copyright law. It's frustrating. That's not how that works.

Jonathan Bennett [01:44:01]:
That's not how any of this works. So yeah, this, this, I mean, there's nothing wrong with it as a step, but this is not a magic bullet. And if people, if people want to take advantage of your work, they're going to continue to do so.

Rob Campbell [01:44:14]:
Yeah. I mean, yeah, they're going to, they're going to try to clean room white, white label with AI no matter what.

Ken McDonald [01:44:20]:
You might as well just hold the original up to a mirror.

Jonathan Bennett [01:44:24]:
It's backwards. It's not the same. It's a— it's— yeah, absolutely.

Rob Campbell [01:44:28]:
They could still— they could still repackage it and do whatever as long as they keep that little attribution in the code. They're following it. They could sell it.

Jonathan Bennett [01:44:38]:
Yeah.

Ken McDonald [01:44:38]:
And if you hold it up to the mirror, you still got the attribution.

Jonathan Bennett [01:44:43]:
Yeah. Well, so I mean, remember, Rob, there's more to the GPL than just attribution. There's also— Yeah, I know. You have to release this somebody asks you for it.

Ken McDonald [01:44:49]:
Source code and include the file with the license in it.

Jonathan Bennett [01:44:54]:
Yeah. Yeah. So,

Rob Campbell [01:44:55]:
yeah.

Jonathan Bennett [01:44:56]:
All right. Let's, let's take a break and then we're going to get into some command line tips. And so don't go anywhere. These are good. We'll be right back. Jeff, you are up first with the tips. What is cCrypt? Are we, are we going dungeon exploring? Is this the night of the crypt?

Jeff Massie [01:45:17]:
This is the rebirth of Crypt, kind of. This is an actual command line tip. No GUIs involved in this. So, CCrypt, it's a small file encryption tool by Peter Selinger, first released in 2001. It uses the Regedel cipher. It's the same family. Right now. Is it right now? Oh.

Jonathan Bennett [01:45:42]:
I

Jeff Massie [01:45:42]:
gotta clean my glasses.

Jonathan Bennett [01:45:44]:
Sorry.

Jeff Massie [01:45:46]:
Same family as the AES, and strictly speaking, it uses the Rijndael with a 256 block where the normal AES uses 128, but it's the same well-studied design. And here's— it's— here's a little callback to Crypt. This, this C-Crypt before I get into it too much, has a --unixcrypt switch, and it's a mode built specifically to decrypt files made with the 1979 crypt command. Now, the man page says it's only there for decrypting existing files because crypt is an old encryption program that works somewhat like the Enigma engine. It kind of worked on like a rotating cipher, but the really short version is it's super crackable today and it's not used anymore because, you know, modern tools go through it like a hot knife through butter. It's not any good. So that's where Ccrypt came along years ago to give it— give a real, uh, true encryption that isn't so breakable. Uh, you know, like Debian and Ubuntu, you can just sudo apt install.

Jeff Massie [01:47:05]:
There's Homebrew. It's on the AUR. It's out there on many, many distributions. Usage is pretty simple. It gives you basically 3 commands. ccencrypt space, and then like say notes.txt. That, it will ask for a key twice. to make sure you didn't typo anything and you put things in just as you wanted.

Jeff Massie [01:47:30]:
They got to match. And then it encrypts the file in place and renames it, renames it for, in our example, notes.txt.cpt. To get it back, you got ccdecrypt space notes.txt.cpt. You feed it the file and then it gives it to you. Now, You can also do a ccat space notes.txt.cpt and pipe it to less, and it will decrypt your file, but it only sends it to the pipe. So it won't decrypt the file on the disk. It just does the decryption and sends it wherever you need it sent. Now there's, there's things worth knowing on here.

Jeff Massie [01:48:21]:
Like, number one, it overwrites in place and it does it on purpose. So for example, something like gzip, it writes a new file, you know, takes everything, and then it deletes the old one. Well, they don't do that because that can leave the original data laying around on the free disk space. So Secrypt literally overwrites the file's contents with the encrypted version. Now, the trade-off is a little bit inconvenient because if you interrupt it mid-write, you can have a half-encrypted file. So now it can, it will protect itself. So if you hit Ctrl+C, it like, and you have multiple files, it finishes the current file first before it shuts off. It's a polite Ctrl+C.

Jeff Massie [01:49:15]:
Now, if you're in something that you, you don't care, you've got to, you know, going down the road and got to throw it in park, you hit Ctrl+C twice quickly and it forces it. So wherever it's at, it just, it is done. Garbling files, you know, not, not part of the concern if you're shutting it down that way. Now, It won't decrypt with the wrong key. So every encrypted file starts with a random seed block and includes a check value. So CCrypt can tell you when your key is wrong, and it will refuse rather than spitting out garbage all over your existing file, because it— again, it overwrites. Because of the random seed, encrypting the same file twice gives completely different output. So just be wary of that.

Jeff Massie [01:50:11]:
You can change the key without decrypting. There is a ccrypt -x and then your file, and it asks for the old key, and then you have to supply it with a new one. So it is possible to change your keys without actually decrypting. It works on directories and pipes, so you can do all the normal directories and pipes encryption. You can, of course, use it so you can create a tar file, put it together, compresses it, and then you send it to CC encrypt and redirect it to your whatever output you want. You do— just kind of a note here— you do want to always compress first because encrypted data looks random and random data doesn't compress, or hardly at all. If you're using it like in a script or something, never put your key on the command line. There's a -k option to take care of that, but you don't want to use it because it will then show up in the history.

Jeff Massie [01:51:31]:
So if you really are trying to be secretive about whatever you're encrypting, don't leave the key laying around. There is— now this is something kind of cool here. There is, if you mistype and lock yourself out of a file, CCrypt ships a companion tool called ccguess. You give it your best guess and it tries every variation within 5 typos. It's adding letters, missing letters, you know, swapped neighbors. Now I should say this is not a backdoor. It just tries a lot of keys really fast. So take a look at the link in the show notes for more details on how you can use CCrypt to encrypt whatever you need kept secret.

Jonathan Bennett [01:52:18]:
Cool. I like it. All right, Rob, you're up. What are— where are we cleaning lint?

Rob Campbell [01:52:27]:
We're cleaning something. So mine is also a command line tip this week. It is rm-lint or remove lint. So what this does, it finds space waste on your file system. So it finds duplicate files, directories, non-strip binaries, broken system links, empty files and directories, files with broken user ID groups. I'm not going to demonstrate everything, but I'll demonstrate a little bit of this here. So if for those watching, if you look at this directory, I have a test2 and a test1. So these are kind completely different files.

Rob Campbell [01:53:09]:
I'll cat these 2 so you could see. They say this is a test file, this is another test file. If I do rm lint, I'll just run that and it found 2 files, 0 duplicates, 0 groups, pretty much found 0 nothing. I am going to do something else. I'm going to copy test, to test3. So now, um, test and test3 are duplicates. So now if I run rmlint, it says it found one duplicate file. And now at the bottom it says it wrote a JSON file that I look at, but it also wrote an SH file or a bash main file.

Rob Campbell [01:54:00]:
So I can run that To clean up. Now in this case, it's not going to do much, but— or it's going to do something, but not a whole lot. So if I just do, uh, sh and the rmlint.sh, um, maybe it's execute— oh yeah, it's executable. I didn't need the sh. But anyway, uh, I'm gonna— I didn't want— I want to do one thing. I wanted to do it -d, uh, and there it actually just cleaned it up. It says it kept the first one and it deleted the test3. So now if I do ls, you see there is no test3.

Rob Campbell [01:54:38]:
It put some— left some other stuff in that file. But, you know, this is a lot more useful if, say, you do this on the whole system. I don't have permission there. Anyway, let's Anyway, it'll run through all kinds of stuff. I probably shouldn't have did the root folder because it's, it's a lot. Anyway.

Jonathan Bennett [01:55:01]:
That machine's dead now.

Rob Campbell [01:55:02]:
Nah, it doesn't actually do anything. Oh,

Jonathan Bennett [01:55:05]:
okay.

Rob Campbell [01:55:06]:
When you just run rm-lint, it builds a script that you can then run to delete. So you can go and edit that script and, you know, view it, remove things that, that you don't want it to delete. So it's telling you the things that it's created in the script, doing ls and rm through all the things in the directory there. And then it creates a script for you that if you don't want it, if you want to go on there and edit that script, modify, you know, tell it, you know, don't delete this thing, delete that thing. You know, you can— made my nano really small for some reason here. I don't know why I didn't use a full screen there. Anyway, it's a complex script, but you can go through and edit it afterwards and use it how you want. So anyway, rm-lint, a nice command line tool to build a script to clean up your system.

Jonathan Bennett [01:56:08]:
Yeah, very cool. I need to try that out. I've got some file system problems where I've got too much stuff lying around.

Rob Campbell [01:56:18]:
Yeah, and there are, so I only showed basic usage of it. If you do the -h or --help, it's gonna show you all the things you can do based off, you could do different flags based off of timestamp and many other options. That is a base, a simplified, roundabout of what it does, but you can go way deeper.

Jonathan Bennett [01:56:41]:
Yep, absolutely. All right, uh, my turn. And let's see here if we can, uh, take a quick look at this. So, uh, we're gonna talk about, uh, GIO. Here we go. And it stands for GNOME In/Out. And there's several things that you can do with this. It's got a bunch of commands in it.

Jonathan Bennett [01:57:06]:
Some of these are kind of boring. You can use it to copy files, but you can get information about locations. You can launch an application from a .desktop file, which is pretty interesting. You can get— you can do things with MIME, MIME types, all kinds of interesting things in here. The one that I actually needed was Trash. That was because I, like I said, was working on a desktop that was running out of disk space. And one of the solutions was to empty the trash. And it's like, I think it was not sitting at the desktop at the time, I think.

Jonathan Bennett [01:57:37]:
But anyways, like, I wanted to do that from the command line. Like, how do you empty the system trash from the command line? Well, Gio is one of the ways that you can do that. So you have the trash subcommand and it's got some flags that you can give it. One of the interesting ones is --list, and then that will tell you all the things that are in your trash. This is all my Chassis firmware stuff where I deleted something and it's left behind. I can just say we want to empty it. It'll very quickly, did not take long, goes through and trash is emptied. If you want to be able to empty your trash from the command line, There you go.

Jonathan Bennett [01:58:25]:
GIO is one of the ways to do it. I'm pretty sure it's not the only way. And then, like I said, there's some other interesting little tidbits in there. So go and have a play with GIO. Works even if you're running KDE. It's not specific to GNOME. It's one of the very nice things about the Linux desktop is even if you're not a fan of GNOME at all, you can still use some of their better utilities, which I like that about it.

Rob Campbell [01:58:48]:
I feel like I've used that and just forgot about it. Long time ago.

Jonathan Bennett [01:58:52]:
That's Rob. He's forgotten more Linux tricks than he knows.

Rob Campbell [01:58:56]:
I forgot. Yeah. You said GIO. I thought you were saying G.I. Joe with a silent J or something.

Jonathan Bennett [01:59:03]:
It's a long time ago, but yeah. All right, Ken, what do you got for us?

Ken McDonald [01:59:10]:
Well, this week I would like to introduce another command line utility that comes with Calibre, ebook-polish. Now, if you are creating an ebook in the ebook EPUB format, this tool can help you apply that final polish. You can also use it to clean up ebooks created from production templates, which often include numerous extra CSS rules that don't correspond to any of your act— any actual content in your ebook. Now, these unnecessary rules can slow readers down because they have to parse through them all. First of all, to find out all the options available, let me go ahead and bring up my command line. Is that big enough for you to read, Jonathan?

Jonathan Bennett [01:59:56]:
Yep, that works.

Ken McDonald [01:59:58]:
Okay. And as with the previous ones I've demonstrated, you can start off by finding out more by typing ebook-polish --help. And then it gives you all the information. For those of y'all listening, it is about a page and a half of information and starts off with the very first line saying integration status. Since I'm not running the ebook polish command within Calibre's graphical user interface, it's going to come back saying the integration status is fault. That's with all the tools. By the way, for usage, you've got the ebook polish with the options that you can use. I'll go over them in a minute, followed by either the input file's name, and if you want to, you can put an output file so it doesn't write over that input file.

Ken McDonald [02:00:56]:
But by default, if you just provide an input file, it will just make the changes to that file. And it gives you a brief description like I just did. Uh, first, uh, second option I want to go over is, uh, --version. It'll give you the version number and just exit. But you can use eBook Polish to embed fonts. You can embed all the fonts that you may be using within your document. Or you can just embed a subset of the fonts just basically for the characters that are used in your ebook. And that can come in handy if you're trying to get that size down.

Ken McDonald [02:01:39]:
You can give it the path to a cover image to embed within the book, an OPF file with the metadata that you want in the book, and it'll update the book with that. You can insert a book jacket page at the start of the book. That contains all the book metadata such as a title, any tags you may have assigned— excuse me— authors, series, comments, and any other information that you may have in your metadata. If there's any previous book jacket, that'll be replaced by whatever you put in. You can remove a previously inserted book jacket so there's not one. And here's one that I've had mixed results with myself. You can tell it to smarten the punctuation in the EPUB. You can remove unused CSS rules from your top style sheets and style tags.

Ken McDonald [02:02:43]:
That would help to get the size down a bit. Here's another one that will really help with getting the size down: compress images. Add soft hyphens if you want to put it so that you have the hyphens for where the work flow of the book will change depending on the font size that a user may select. You can remove those soft hyphens. Now one that I've been playing with a little bit is upgrading EPUB 2 books to the EPUB 3 For book format. Uh, one— now this one, last one, it does— it's going to make your, uh, EPUB file larger because what it does, it's called download external resources. It downloads all those external resources such as any images, style sheets that you might have URLs pointing to instead of the Within the EPUB book, it'll download those and put them in the book so that you don't have the actual URL. So you can see that using that, making the book a little bit or a lot bigger.

Ken McDonald [02:04:05]:
Now I'm going to go ahead and list my current, uh, directory, and it's got a Hardy Boys Towers. I forgot to delete the polished text, but that polished text was created with the command ebook polish --remove-unused-css --compress-images --smarten-punctuation --verbose. Then I gave it the name of the Hardy Boys Tower TR 0000rf Fran.epub. And then I said to put the output file as test polished. I'm going to go ahead and run that again. And the output shows all the, uh, Smarten punctuation that was added. It basically gives you a Report. So Spartan punctuation.

Ken McDonald [02:05:09]:
And as I'm scrolling through, it starts at, uh, with the EPUB notice HTML, then page 5 HTML, 8, and keeps going down up to 228. And pretty much every single page is hitting with the Spartan punctuation. The advantage to this doing that is you could then open the EPUB up in an e-reader software that you have so you can look and see how the Smart and Punctuation affects the flow of the book. Then it says it removed un-USCCS rules, a total of 9 of them. And then it just went in and lossily compressing images. Seems like the biggest compression was with a 92.5 kilobyte JPEG. It went— put it down to 54 kilobytes. So you can see that can save you quite a bit of savings with just doing that alone.

Ken McDonald [02:06:17]:
And the total image file size was reduced from 4.6 megabytes to 4.3 megabytes. with average reduction of 7.9%, and that all 12 images were changed. And let's go back and look at that folder again. And you'll see that the size of the original, the Hardy Boys Tower Treasure ebook, was 4.9 megabytes. The test polished EPUB is 4.6. So this is a way you can put a polish up your books and get some space back.

Jonathan Bennett [02:07:02]:
Cool.

Ken McDonald [02:07:03]:
And when you start talking 100 books, that's quite a bit of space.

Jonathan Bennett [02:07:08]:
Yeah, absolutely. We've talked about using this based on your command line tips, actually using this to organize our real life books because that database seems like it's got Pretty much all of the things that we wanted to be able to do that. So if we actually find the time to do that, I think we need to do some other cleaning here in the office first.

Ken McDonald [02:07:26]:
But you're going to be sitting down doing a lot of data entry for the paper.

Rob Campbell [02:07:32]:
I think you got some real trash to take out first.

Jonathan Bennett [02:07:36]:
We do. We do. I was talking to the guys about this beforehand, before the show started. They're like, I have— Rob was telling me, I have a little trash can by my desk. I have a trash can by my desk and I've reached the point where the trash can is full and the trash is falling out and I've got a little pile around it. So just need to deal with it.

Ken McDonald [02:07:51]:
It's a good thing it's not a volcano.

Jonathan Bennett [02:07:53]:
Yes. Well, it's kind of a trashcano.

Rob Campbell [02:07:54]:
It's a good thing it's not food waste or something.

Jonathan Bennett [02:07:58]:
That's true. No, I avoid that. We don't do that. No, actually, Rob, you know what I'm going to do? I'm not going to do database entry by hand. What I'm going to try, take a picture, light it up well. So do it during the daytime. Take a picture of a single section of shelf and upload it to Claude and say, Claude, grab all of these books and give me— essentially try to automate it as much as possible.

Rob Campbell [02:08:21]:
Give me an input file, I can import it.

Jonathan Bennett [02:08:24]:
Absolutely. I bet you it'll do pretty well with that, actually.

Rob Campbell [02:08:27]:
Yeah, I think so.

Jonathan Bennett [02:08:31]:
All right. Well, that is— that's it. That's the show. We got through everything. I'm gonna let each of guys plug whatever they want to. I know Ken has a sneaky browser tip that he wants to get in before we let everybody go. Ken, what's that? What's your Firefox tip?

Ken McDonald [02:08:48]:
Well, yeah, if you go into the address bar, Firefox has always had it where you could do calculations in the address bar. If you Do a calculation where the result is 150. It's going to show you a hidden snake game.

Jonathan Bennett [02:09:11]:
Nice.

Ken McDonald [02:09:12]:
I've got a link in the show notes to an article about this so you can check it out. And if you're not currently in Firefox, open it up and try it. I actually spent a good 15 minutes just playing around with the game.

Jonathan Bennett [02:09:27]:
Nice. That is a celebration of their 150th release, I believe. All right, Jeff.

Jeff Massie [02:09:36]:
Nothing too much to go over, so a little bit of poetry. Look, Mama, no hands, only one finger typing. Easy commit scripts. Have a great week, everybody.

Jonathan Bennett [02:09:53]:
Oh my goodness. All right, and Rob.

Rob Campbell [02:09:57]:
All right, just my usual for those who want to get more of me. I post on social media almost daily. Those places, I'll get to them. The easiest way to find me is first going to my website, robertpcampbell.com. And once you're on my website, go down, I have links to my LinkedIn, post there all the time. Twitter, do not post there ever. BlueSky, post there all the time. Mastodon poster all the time and place to donate a cup of coffee.

Rob Campbell [02:10:29]:
That's where you post. That's where you come in. The slow coffee cup. You can donate me a cup of coffee. And if you don't want to, another thing I'd almost appreciate, you know, I don't get as much as I don't get the full $5 that I would be donating for a cup of coffee, but I still, it's cool to know that people are reading about me. So you could do that. And my book, um, I'm looking at the screen and it's totally throwing me off because it's— no, it's not mirrored. I don't know why I thought it was me.

Rob Campbell [02:11:01]:
Trailer Park to Technology Leader, that is what it's called. This is me. This is me now. This is basically what I looked like, oh, 25 years ago, um, or so. Uh, my book, it— there's some great reviews online. Anyway, if you want to get my book, you could just search for Trailer Park to Technology Leader on Amazon or from my website. Scroll down and there is a link in the page to buy it on Amazon. It's available in softcover, hardcover, Kindle.

Rob Campbell [02:11:36]:
I really hope to do an audiobook, but don't hold your breath on that. I may never do that. Don't wait for that. Get one of those books first. And And the audiobook may be coming. I don't know. I haven't started that. I am lazy.

Rob Campbell [02:11:52]:
But hey, anyway, this book is there. It's a good trajectory telling from being born poor during a snowstorm in a trailer court. I wasn't born in a trailer court, but that's where I lived

Jonathan Bennett [02:12:06]:
growing up.

Rob Campbell [02:12:06]:
To become a technology leader. It shows a path. To, to that, but not necessarily the only path. Um, and, you know, it kind of shows twists and turns along the ways. And, you know, it's not just a boring old story about, well, you know, I did this, I did that. There are some fun, um, things, especially I think about my childhood. I think that was— those are the funnest stories, uh, I thought. But maybe other people think differently.

Rob Campbell [02:12:34]:
Maybe it's just nostalgia for me. So why don't you check out the book and tell me if I just like those childhood part, the early part of the book, because it's nostalgia or if it's actually good. All right. That's all I got.

Jonathan Bennett [02:12:48]:
All right. Thank you guys for being here. It has been a lot of fun. The one thing I want to plug is, well, hopefully, hopefully FLOSS Weekly on Hackaday. We actually got a response from the guest that they're going to be here. So I've been saying this for like 3 weeks now, but hopefully FLOSS Weekly is coming back this upcoming Tuesday. We've had a terrible run of luck of guests actually showing up, but watch out for that. And if you're not subscribed to it yet, go subscribe to the feed.

Jonathan Bennett [02:13:15]:
That way you'll find out when we do have guests show up. Anyway, hackaday.com, uh, FLOSS Weekly is there these days. We have a lot of fun with that. Other than that, we just want to say thank you. We appreciate everybody that's here and catches us on the Untitled Linux Show. Whether you watch us live or on the download, we sure appreciate it. And we will be back. We'll see you next week.