680: Go Hack Yourself

Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
(00:11):
Hello, friends, and welcome back to your weekly Linux doc show. My name is Chris.
My name is Wes.
And my name is Brent.
Hello, gentlemen. Coming up on the show, we'll break down the openness of HFly
you probably need to know about.
And then we're going to attack our own systems. In the spirit of finding issues
before the bad guys do, we're going to go over how to red team your own network for fun and security.

(00:32):
Then we're going to round out with some great booths, some picks,
and a lot more. So before we get to all of that, let's say time-appropriate
greetings to our mobile room. Hello, VirtualLug. Hey, guys.
Hello, gang.
Look at those guys. Hello, everybody. And hello up there in the quiet listening.
Hello to the live Matrix Room. Yeah, we're live.
We make it a Tuesday on a Sunday over at jblive.tv, and you can get it at jupiterbroadcasting.com

(00:55):
slash calendar in your time zone.
My time zone?
Well, any time zone.
We never know what time zone you're in. That's why we have the system.
If we deployed the calendar today, we'd probably say it's using AI to automatically
determine your location.
It is, in fact, not. It may be using JavaScript.
It's, I guess, whatever Google Calendars do it.
I also want to say good morning to our friends over at Define Networking.

(01:18):
Go check out Define.net slash unplugged and meet Managed Nebula from Define
Networking. It's built on the open source Nebula platform. We love it. We use it. It's great.
Nebula gives you fast encrypted peer-to-peer networking without routing everything
through somebody else's cloud.
And it's ready for modern networks. IPv6 is built in with IPv4 or dual stack
support when you need it. And the technical implementation should be studied.

(01:43):
I'm telling you, it's great.
And you can run your own lighthouses, so that way you can define your network.
You have control of the core of your network.
And, of course, they'll now provision one for you as well as part of Manage
Nebula, and you could use Bolt.
It's huge. It was originally built for Slack, for serious scale, serious privacy.
And today you can connect up to 100 hosts for free, no credit card required.

(02:06):
You just go to define.net slash unplug.
Nothing else offers Nebula's level of resilience, speed, and scalability.
I am telling you, you're going to be impressed. Get started 100 hosts,
absolutely free, no credit card required.
Defined.net slash unplugged. Big thank you to Defined for sponsoring the Unplugged
program. And go redefine your VPN experience. Control your network destiny at

(02:28):
Defined.net slash unplugged.
We now have the schedule for Texas Linux Fest 2026.
Yeah, you can go check it out if you're curious what talks are on offer.
For a quick reminder here, it will be at the UT Commons Event Center,
same place as last year, November 6th through the 7th, 2026.

(02:48):
Yeah, not October, November 6th through the 7th. And there is early bird pricing
right now. You do need to buy tickets. That ends soon, very soon.
So go grab your tickets now and support Texas Linux Fest.
and we'll have a link to the full schedule. We are still putting together our
plan. We really, really do want to go. We feel like there's a few of these events.

(03:09):
Really, there's no other industry that does an event like Texas Linux Fest.
The Linux community is unique in this where it's community-run, community-organized,
And it's so more like refreshing and recharging.
It's such a great time. It's so welcoming. It's so earnest and open.
Well, how do you describe the difference between this and like a commercial vendor?

(03:30):
Night and day.
Night and day, right?
Like going to see family instead of like some kind of scale work function.
I could do five. I could do five Texas Linux events to one like Red Hat Summit. You know what I mean?
It really is a recharger. And so even if you're not a podcaster,
if you're not in the JB community directly, but you're just kind of in the industry

(03:51):
or kind of in the Linux space, I think you'll really, really enjoy it if you can make it.
Well, speaking of beloved Linux conferences, we do have some news on scale as well.
24x will be taking place next year, but the dates are different.
Before it's been like early March.
Yeah.
Now it's going to be early April. April 1st through the 4th,
2027 at the Pasadena Convention Center.

(04:12):
April could be really busy. Yeah. Yep, at the Pasadena Convention Center.
And they do have their call for presentations going now.
Yeah, open now. So closes November 1st. You've got a little while, but don't sleep on it.
And then last but not least, really, Nix Vegas.
Yeah, so Nix Vegas and DEFCON 34 just wrapped up. I was lucky enough to go last
year, had a wonderful time.

(04:33):
And they did it again this year. Another fantastic looking badge and a great
set of talks. And it seems like an even more impressive setup because they've
already got those talks turned around and up on YouTube. So if you want to go
check them out, please do.
Links in the notes.
All right, so OpenSSH 10.5 has come out, and it's A, an important update that

(04:54):
you probably need to install, but B, I think it sort of shows us the shape of things to come.
It is perhaps an example of what's probably going to be more and more common.
So, Mr. Payne, as best you can, can you kind of tell us what's going on and
why they had to release 10.5 this week?
Yeah, the big bit here is around SSH agent forwarding, which maybe you've done,

(05:15):
right, where you have like an SSH agent to handle how you handle your keys.
Maybe you got a fancy YubiKey or something or you just got a key with a password
and all of that kind of going.
But you want to be able to use that throughout a network, right?
So like you're going to one box and then you want to be able to still use your
agent to be able to answer cryptographic questions further down the chain.
So that's where SSH agent forwarding comes in. Well, there was an interaction

(05:38):
between agent locking and OpenSSH's session binding that could allow certain
operations that were supposed to stay local happen remotely through a forwarded agent.
Uh-oh.
Yeah, this included adding PKCS11 tokens and in some cases using destination-restricted keys.
The SSH client also, the update for it also fixes a potential use after free bug.

(06:01):
And on the server side, they've fixed the restrict option in authorized keys.
So it now properly applies to tunnel forwarding too. So more work in the tunnel area.
Worth noting though, tunnel forwarding is still disabled by default.
So it only applies if you've actually explicitly turned it on.
Though plenty of people do.
Yeah, yeah. Guilty.

(06:22):
And then, furthermore, OpenSSH says it's seen, surprise, surprise,
not really, they're seeing a surge in AI-assisted vulnerability reports.
Now, of course, a lot of them don't really hold up under realistic threat models.
You kind of fill out the details.
But they do explicitly say findings backed by human analysis,
test cases, and fixes are welcome.

(06:44):
And perhaps more interestingly, they've seen vulnerabilities first found with
AI, later independently discovered by other researchers.
So two notes to that, Wes. Number one is it's sort of this double-edged sword
that we continue to see with AI contributions is,
maybe you get 10 crappy slop reports and then you get one or two genuinely important security reports.

(07:09):
And they still have to go through those 10 or 11 slop reports to get that one genuine.
And figuring out how to do that well and at scale is now a new open problem.
But also, it seems likely that the genuinely good reports will increase as things
like KimiK3 and DeepSeek4 become more prevalent in the community.

(07:29):
Yeah, the signals and noise should get better as model capability and our techniques get better.
Yeah.
You would hope.
Yeah, yeah. So there, but that doesn't mean they see less submissions, right?
So they're going to have this – and OpenSSH is one of many that are going to
have this accelerated issue of if one LLM with one guy can find it,
then another gal with another LLM is going to find it. And it's almost –,

(07:51):
It could almost be an assumed that if an LLM found that bug,
it's almost public at that point. So there's sort of an urgency in which they have to move.
Yeah, and especially because we've seen like with Bitcoin projects,
I think OpenSSH is another one, right, where it's independently maintained,
not a huge team, and is like a high leverage tool where if you can own that,
then you can really get everywhere.

(08:14):
They do also say that as, you know, and I wonder if we'll see this more because
it's kind of a stress test of the whole like software delivery pipeline.
They are talking about doing release fixes, releasing fixes more frequently.
Yeah, faster release cadence because of this problem.
Which is probably a good idea.
Maybe. I mean, it doesn't mean that the rail boxes and Ubuntu LTS boxes up there
are going to get updated any sooner. No.

(08:36):
But hopefully it means we do have to polish that and pay us more attention.
It's a good excuse to invest in securing that entire pipeline.
And I mean, you're right. It doesn't mean anyone actually does the updates,
but at least maybe they're there.
Maybe it forces people to adopt a system that can update more frequently.
I would imagine this updated release cadence, though, puts a lot of pressure
on these projects to push forward in a pace they haven't previously seen.

(09:00):
And so is that sustainable long term? I sure hope so, because we need it more than ever.
I think that's an open question, too.
Yeah. And could there be more security mistakes that slip in if you're going
faster? There's always that concern as well.
And it's, I think, isn't just an open SSH story, like we've said.
We're really discovering bugs that have sat quietly for years getting discovered

(09:22):
now because a machine that just has unlimited patience can go through and find these things.
So we're going to see, I think, more projects with more frequent security releases.
They're going to have to have some sort of continuous scanning themselves and
some sort of assisted triage.
And you may see some of these projects. Would you be surprised,

(09:43):
to find like an maybe not OpenSSH, but a project like OpenSSH have a daily branch
that a company like maybe Red Hat and Canonical and others are ingesting?
they're running their own checks against it and they're shipping those patches
as fast as possible to their customers after they've done a pass for quality checks.
You could see like these LTS distros getting a faster stream of software to

(10:05):
resolve some of this stuff.
So I think it doesn't look like an isolated incident. And it reminds me of a
talk just a couple of weeks ago that OpenAI gave at Black Hat 2026.
And this was just a few days after it became public that OpenAI's testing models
had breached hugging faces systems and it's a good talk willing to the whole

(10:26):
talk. I thought it was surprisingly candid.
Yeah. Refreshing.
Uh, very technical and, um, some stuff I think is new.
Some stuff in here is novel and there's a bit in here.
That's one of their takeaways is that as these models advance and as agents
begin to work together, which is something that led to this breach,

(10:46):
uh, you're going to have to have a different speed in which you respond to,

(13:29):
Wes made an implication of this earlier, but this has been really pronounced
over in the Bitcoin community recently as that's sort of been the front line
because you compromise a Bitcoin wallet, you can steal somebody's funds,
you immediately get the reward.
And so it's been going through the Bitcoin community almost like locusts,
just going from one project after the other, stealing funds and whatnot as they

(13:50):
use these tools, mostly via Kimmy K3,
to find weaknesses in projects like by scanning GitHub repos and exploiting those.
Yeah. The other thing that kind of stuck out with some of these recent quote
unquote escapes or just the various stories we've been talking about is just,
that it's not really like suddenly all security principles are thrown out the window.
If anything, it means things like defense in depth and like knowing where you're,

(14:14):
you know, what your threat vectors are and like what you're actually trying
to protect and why and having a good understanding of what's going on with your
systems is more important than ever.
I mean, there is a component of being able to find more zero days,
but a lot of this is also the orchestration side, being able to go from doing
a scan to actually executing through to getting a persistent vector or getting

(14:34):
through the network or whatever.
Yeah, like in the case of the OpenAI exploit, they took advantage of a package
manager that was connected to the internet that had exploits,
and then they took advantage of a web dev share that was available to do agent coordination.
So they didn't create those exploits. They took advantage of those things,
which they can be very good at.
You're right. So if they had proper isolation and proper security on the OpenAI

(14:56):
network, these things would have never gotten out.
Yeah, there's just ways you could design it if you're really trying to do this
in a hardened way from the get-go, though that would surely slow you down.
Of course, I guess the silver lining or maybe the steel man,
it would be as the models get more advanced, they have to come up with new and
more sophisticated ways to isolate them, perhaps.
But when you look into the root cause, it is.

(15:18):
There was mistakes made.
And, you know, it's not like necessarily there's, we will see different zero
day rates across different projects.
And there's been, you know, and a big part of this is sort of an economic thing
of there's one part of like, what is the frontier?
What is the, you know, you can pop novel software quickly sort of aspect.
But then just the other side is you just now have this market to be able to

(15:40):
buy the automation on demand for the rest of it.
yeah and i think that just sort of changes what which low-hanging fruit now
becomes economic to actually attack.
Yeah now it's can you afford the credits the token credits and uh can you you
know are you creative of what project you pointed out etc.
Yeah and that's where i think there's also then on the defensive side as we
kind of heard a little bit there is,

(16:01):
like we're going to talk a little bit about maybe what you can do with your
your home lab or things like that but we also need to figure out how we can
invest at scale for the free and open source communities because projects are
going to need resources on the defensive side.
Yeah, so I figured it was worth time figuring out how we could,
as they say, red team ourselves to try to figure out where we have low-hanging fruit.

(16:22):
Because my suspicion is, and I don't like making this forecast,
but I suspect likely that,
a lot of the free software we rely on for infrastructure is going to get poked
at pretty soon because that's the same infrastructure banks rely on, e-commerce relies on.
A lot of money rides on top of the Linux stack.
It's embedded in the industry in innumerable places.

(16:43):
Yeah, and then there's monitoring and spying. If you pop, there's all kinds
of advantages to popping the stuff that we rely on every single day.
So I'm sort of operating under the assumption that once they get done having
their fun with the Bitcoiners, they're kind of coming for the rest of us.
And you're starting to see it a little bit with OpenSSH. That makes sense.
That'd be another low-hanging fruit.
The other one that could be fun if you want to do a little homework is Apple

(17:05):
released a patch for remote desktop. And now, you know, the AI-assisted reverse
engineering made it possible for them to go out and chase every single Mac that
hasn't been patched now. And so now there's a cat and mouse game playing out.
That's happening right now as we record this episode.
So how do you protect yourself? It seems like it's clanker versus clanker.
It's like some sort of horrible sci-fi novel where you need to have a defensive

(17:25):
clanker that's checking your own systems.
And so I built a red team agent that has been hacking our infrastructure literally all week long.
Chris, you alluded to attacking your own infrastructure, which I would imagine

(17:49):
revealed a few things. But A, how and B, why?
All right. You know, the why is just to try to catch stuff.
Also, you know, just try to get a sense of what it needs to be retired first.
Last week, we talked about retiring our node box. And so I figured before we
take it offline, let's attack it and see how vulnerable and risky it really

(18:12):
was to have that thing in production. So you can get a sense of that.
It could be nice to run it against your VPSs. I want to stress that this is
for really to audit your own stuff, to make sure you're safe.
And that's really the intention of all of this.
And also to kind of get a sense of what kind of automation was out there in
terms of, you know, like we can run Nmap or a couple commands ourselves,
but like, can we take it to the next level?

(18:34):
You could totally just, you could do a lot of this with some port scanning and
identifying the versions of stuff and then going looking up that version with
CVEs it has. I was like, you could do this manually.
I wanted to be able to go to my agent data and say, data, attack this system and give me a full audit.
And what it would do is it would initiate some of those basics,

(18:54):
like an NMAP and a ping and all that kind of stuff.
Identify what services are open and what versions of them. And then based on
that, look up the CVEs and then proceed to try to exploit them.
And then if it gets that far, give me a report.
And so to accomplish that, I'm using a project. There's a lot of them out there.
Don't do as I do.

(19:15):
I'm using a project called Hextrike AI. And it's essentially a collection of
MCPs with behind it 150 different security tools and a bunch of different autonomous
AI subagents that can do these tasks.
And it's pretty conventional in the execution order, but actually pretty great
in the document, discovery, discovery, documentation, authorization for more advanced attacks.

(19:42):
So Hextrike is both a very powerful tool but can also be a foot gun because
of the types of tools it's using. They're moving so fast, the tools themselves often have exploits.
So you have to build this in a way where it's extremely isolated because there
is conceivably a possibility where these types of tools can be turned back around on yourself.

(20:03):
So I spent quite a bit of time designing this in a way where it was completely offline and isolated.
individual components would be spun up on demand continue to be isolated,
operated with wrappers and the MCPs and so underneath it there's a really really
good set of tools, one of them is called Nuclei, N-U-C-L-E-I,
which does a lot of the CVE heavy lifting, SQL map.

(20:26):
Oh, Nuclei, yeah. Oh, yeah, thank you. Hydra's in there, Hashcat's in here,
NetExec, various DNS tools, web exploits, framework exploits, binary analysis tools.
Fuzzers.
Yeah, there's a lot of really good stuff in here. And what I wanted is I wanted
something that was essentially on demand for my agent, that I could have a system

(20:48):
that then they would give me a report.
It would be documented in a particular place every single time,
and I would get a summary in Telegram.
And so the idea was is I want to do an attack by prompt is kind of what I was
going for. And I know you looked at this, Wes.
Oh, yeah. I got a sort of – I'm curious to see how similar our setups were.
Well, okay. So I went pretty wild. I will admit I blew way too much time on

(21:14):
this. I literally started this project when I got home from the show last week.
You can cook it.
And I finished it this morning while we were doing the stream.
Yeah, during the pre-show as far as I saw.
But I went way over complicated because I wanted to isolate.
I wanted to integrate it with my Hermes agent.
Oh, yeah, that's nice.
If you just ran it standalone with the MCP tools like through open code,

(21:34):
I think it would be a much leaner, faster setup.
Yeah, so that's what I basically did.
Tell me about this.
Yeah, I stood up Kali VM because Hextrike doesn't provide the tools.
It just like runs them and orchestrates them and makes them available,
services them to the agent.
and I just figured like half of these are already in Cali and the rest are in
easy repos or easy to run on Cali because it's all designed on that,

(21:55):
so I got that spun up in just a quick QEMU VM and then have forwarded some ports
there to wire up SSH access for the agent as well as the MCP server back and then,
Yeah, kind of just kicked it off from there.
I think VM is a really good approach. You know, that keeps it as isolated as you kind of can.
Yeah, and then I chose to connect it up with a mesh network,

(22:16):
a quick little nebula network, and then I could just kind of add some groups
that I could add it into. And so I knew just like, okay, well,
whatever I'm actually going to target.
Like, obviously, you're not going to do the full, like, layer two,
like, all the complicated, but for sort of scanning what services were running
and that kind of thing, it was perfect.
Right, for really, which is what a remote attacker is going to go after,
right? Like my analysis going in is what is somebody who's not familiar with

(22:38):
the LAN, somebody who's remote likely going to get maybe they've somehow got
on the Wi-Fi or the LAN, but they're not really intricately familiar with it.
So I think that accomplishes that.
And then obviously in another situation, like if I was trying to scan like a
public VPS of mine, then I would attack it through that interface or whatever.
I like the, you know, Mesh Network Nebula, just put the host on there that you're scanning.
A lot of this too was like I was learning how to use this tool, right?

(22:59):
So it's like I didn't really want, I wasn't, I haven't got as far as like,
this is like a trusted tool that I know well, right? So I kind of wanted to
have some known good hosts I could attack and be like, okay,
this is stuff that even if something goes wrong is fine and I have backups of and all the rest.
So one of the nice things about Hextrike is because it is essentially,
like Wes said, it's orchestrating established tools, but you can have...
it is aware of like these are critical like financially important systems or

(23:23):
production important systems and this is a box i can bang on.
And it comes with it seems like a lot of prompts that it it provides with as
you as you run through the tools and integrate with it that kind of shape that
too so it's very the resulting system just out of the box is pretty careful
around like i'm only going to do this with authorization and like you know are
we checking the boxes and.
One of the things i spent a lot of time was reducing ceremony.

(23:43):
That was the.
Term i had to keep using is like it wants you to sign with a key here wants
you to open up a markdown document initially and put your name in there and
a date like it is serious about authorizing stuff i'm like no no no no no i
don't want to do any of that.
So i did do like some some initial tests so like it was doing nmap it was doing
some curls against stuff it was using a fuzzer to attack just sort of basic
ports and web services it was using nuclei um yeah it did some ssfrf probes

(24:08):
the it didn't find too much because.
Everything's up to date.
Right yeah it's like a nix os box yeah up to date but uh it did the thing that
it would have found if it was a problem uh
is it did immediately latch on that i have an llm gateway yeah there right and
it was like uh you know you have like pretty much all your stuff i can't get
the actual key data but i can get every all the rest of the metadata about the
key and i can see all your models and i can send requests,

(24:30):
but it did try like fuzz insert uh sir xng didn't find anything there so good
good and then as a parallel request i was checking out um the new
meta model uh muse glimmer that they released because that was their first open
weight model for a while and this is before we set up Hextrike.
So I just had that run and trying to do,
Because a bunch of these tools are also in Nix packages. So I did a separate

(24:53):
attempt with an unknown model. So it was kind of a mixed bag.
But to just see like, well, if I just give you some of the basic tools that
you would want anyway, how far can you get on the same thing?
Sure.
And kind of similar results, not as rich, not as well structured,
but it did get, it did find basically the same thing. It was telling though, because one of the...
This is using the meta self-hosted model?

(25:13):
Yes. And I was running it on a rented RTX A6000.
um one issue with that model is it seems to be kind of high with hallucinations
and oh after doing a review like it did all of the stuff it just definitely
did some exaggerating in the report so it's another like you're gonna if you're
going to use this kind of automation definitely apply,
sort of good techniques to cut down that kind of.

(25:35):
I'd be curious if you tried one of the distilled kimmy k3 models where they've
left in all the cybers offensive defensive stuff.
Good idea that could be some some follow-up yeah yeah i did try like a whole
crisscross of models i put in the doc deep seek memo quen's nematron so i was,
i drove a few of this with a bunch of them just to see which ones would refuse
and which ones would actually i got.

(25:55):
I got constant refusal from um gpt constant refusal like it as soon as it realized
it was dealing with a cyber security tool it would bail it could build all the
scaffolding and all the configs,
but when it kind of like dug in and realized, oh, no, this is a tool for hacking,
it would stop the whole session.
So I have to give a huge shout out to Minimax M3 thinking, not only is that

(26:19):
sucker an open source model, but like never said no, never said no.
Now, it's not the most clever model, but it's a hell of a worker.
And it had no problem driving some of this for me when GPT would say no.
And I'm trying to do self-defense here. I'm not trying to attack anybody.
I'm just trying to do self-defense.
Also, I got to try Grok 4.6 for like 15 minutes before I ran out of usage.

(26:41):
And that also had no problem. and boy did it cook so yeah i like that you tried
the different models i also use deep seek for a lot.
Yeah i think the only one of the like uh open ones or you know that non-frontier
class was like high three that refused me on one part of that yeah it was kind
of surprising um but the rest of them yeah it was all totally fine.

(27:01):
Yeah, the bouncing around sort of stunk. So one of the things I built into my
Hermes system is when it begins, so normally it's being,
it's like, it might be on, if it's on a GPT model, when it begins a process,
it has to switch over to Minimax, or if it's really going deep,
it could go, yeah, actually, it has a, it drops to DeepSeek,
and if DeepSeek's slow or unavailable, it uses Kimi K3.
Oh, nice.
Yeah, it's got like a whole-

(27:22):
A little tiered.
System. I love it. Yeah, yeah. So just as a recap, you kind of have these goals,
these attack goals, these audit goals that you give Hextrike,
and then you task the agent to go off and perform one of those audit goals.
Hextrike runs all of the various tools, orchestrates all of the stuff you've
heard about for years, plus stuff you've never heard of.
If it finds something, it then sort of can kick off a next layer.

(27:44):
So there's a level one pass, a level two pass, and that level three pass,
it can actually go in there and try to exploit stuff if you've given it permission
to do that and investigate further.
So that is sort of the setup I wanted. And I figured we could do a little demo if you want.
Yeah, we should.
You want to try it? See how it goes? So I have it ready to go.

(28:04):
I will say that for time I'm not going to do the most extensive,
right? Because there's 150 different tools in here.
All of this. So the way this kicks off is I prompt my agent,
my Hermes agent data to access the,
system the hex strike system via a set of mcps and then it has a separate set

(28:25):
of wrappers i've created to sort of audit and monitor the process and then it
generates a markdown report and it saves it to a sync thing directory
that will sync to my computer so when we're done we'll get the high level results sound good boys
are you ready here we go,

(29:11):
Oh, yeah, I forgot to mention it. It plays a little thinking music while it
scans. That's how I roll.
Mandatory.
It's a nice touch.
Thank you. Thank you. So, all right. So here we got our report.
This is the box we retired last week. It's still online because it's finishing up some work.
And it's not a perfect report. I think I could have turned it up a little bit
and had to be a little more aggressive.
So we don't have any, like, massive vulnerabilities standing out here.

(29:36):
But it discovered 10 TCP services were reachable and tested remotely.
and it discovered that OpenSSH identifies itself as 8.2p1.
That doesn't sound modern.
And NGINX identifies itself as 117.18. Cockpit is well behind as well.
Here's the one I thought you might find interesting though, Wes.

(29:57):
Port 3000 leaks an application stack trace to an unauthenticated scanner.
What's that?
A malformed basic http request produces a 500 internal survey or the response
exposes the internal paths including app utils proxy js app utils safe handler js
and expresses router internals it even reveals the failing operation cannot

(30:21):
read properties of undefined reading ends with,
so it's sort of an information disclosure error handling weakness it discovered
that would be a little interesting to push on potentially like you read what's
on 3000 so you could come back one of the things you could do this report is
say all right come back and let's push on that right because you get.
Things you can go drill down.
On if it seems worthwhile it kind of it kind of critiques the uh bitcoin lightning

(30:42):
setup we have for uh hey for responding to network requests anything is jump
out anything jump out at you wes,
It gave us a one-sentence takeaway. The audit found a surprisingly broad and
somewhat chatty surface, including admin, Bitcoin, Lightning,
and RPC interfaces. But the part designed to determine whether any of this actually

(31:05):
is vulnerable and failed, it failed because we didn't do the actual deeper scan.
So the strongest conclusion is interesting exposure, incomplete security assessment,
no vulnerabilities detected yet.
So then it gives us a list of what we could do next here, five further steps
to drill in deeper here, and get Nuselli giving us a complete working vulnerability report.
Nuselli completes the report, but sometimes it doesn't complete in time,

(31:27):
so it doesn't get included. And then we also...
Oh, yeah, I think that was one thing I saw, the bot identify with Hextrite,
some timeouts weren't always handled kind of that great.
Yeah, yeah. So there's a little bit you have to fix in there.
Also, it suggests we renew or rotate some of our TLS certificates before September 6th.
And I think that also speaks to this, to like, it's kind of nice just from understanding

(31:48):
what all is happening, especially on a box like this that's like just been kind
of off in the corner right checking up on things especially you could go poke
around like your whole tail net and check things out.
There or.
You know whatever.
Right once the bulk of getting hex strike set up and depending how you do it
it could be a really quick thing or it could be a week-long thing,
um but then the end of thing is like all right go check this box go audit it
for me and then you can have a produce report that's consumable for yourself

(32:11):
or a team of people just depends on what your audience is so that's all manageable,
um and there is a few things in here like we need to get open ssh if we were
going to keep this box online,
my immediate takeaways are we would have to update we would have to update open
ssh nginx and cockpit and,
we'd probably want to look at this json rpc service on 5 000 or 50 000 or whatever
it is and the service on 3 000 we probably need to figure out what those are

(32:34):
this http thing that we're leaking.
It does at least seem uh like it makes sense given what the box is.
Which is.
A crazy smattering of docker composed containers with a whole bunch of different ports.
And those paths are umbral paths that it's exposing through that port 3000.
So that, you know, right there, if I were putting my old hat on back in the

(32:56):
day when I was getting hired to do these security audits with tools that were
way less cooler than this, that would be the number one thing I would go.
I'd go knock on that port 3000 a lot more and figure out what's going on there,
because it's revealing the internal structure of the entire frickin' Umbral
setup, which is where the Bitcoin node lives.
So that's a pretty juicy reveal right there. And if you knew going in,
like I do, the Umbral app structure, I would immediately recognize that.

(33:20):
So machine or not, right? I could take this report. I could take it further. Or the other thing.
That's what's kind of great, right? Like you don't need to just rely on the,
like it can just be a tool that you can use. It could be a tool to like work together.
You can learn a bunch of how the tools work and drive it yourself.
The Hermes system, this is why I wanted to integrate it. The Hermes system knows what this system is.
It knows what this box's role is. It's important. So it, it knows like in a

(33:44):
way that makes it very useful because it, first of all, before it even scanned
this node, I never told any, it just, Hey, this is an important economic machine.
Do we want to be careful? Like it knew all of that, right? But it also knows
Umbral's on there. So it can use all of this information to inform its attack.
So it's really, if you have an agent system that's managing infrastructure,
you can stand this up alongside of it. It can use that information to essentially

(34:06):
go be a chaos monkey under your control.
And you can turn up the heat depending if you just want port knocking and pinging, you can do that.
But if you want like CVE identification and then go and try to exploit it,
you can do that, right? You can turn it all the way up.
But I do think it is something that's kind of a more advanced tool that people
need to be extremely careful with. But –,

(34:26):
looking at this open ssh situation right like now i could go point this at some
of our github code repos or something like that.
Yeah that'd be the next thing that i was kind of get trying to get set up for
but haven't yet would be would be trying to get the bot tooled up to go see
if it could find things like a zero day or
issue in code or especially if you compare right you have the metadata report
so you know what versions are running on whatever boxes you're trying to check out so then

(34:48):
it can go clone that exact version and then go check through it and run tests or you know set up,
uh that version running locally to hit against as it develops a theory that kind of.
Thing i think if you want to just play with it your setup you know where you
had a cali vm really straightforward got it going probably within an hour i would.
Imagine yeah it was pretty it was pretty easy.
Yeah uh and so that's how i want to try this and see what it tells me see what

(35:09):
i can figure out with this for.
Me obviously it would be a little more work like if i i need to set up like
proper bridge networking or put it like if i was trying to do it proper like
on a land or you know corporate environment or something like that it'd be more
work but because i was doing a pretty minimal test run it made it easy.
Yeah and it's you can do it all the way if you want you could turn up all the
way there's a lot of tools out there to do this kind of thing so if you have
any suggestions boost.jupiterbroadcasting.com and let us know.

(35:32):
Yeah because we could we could only talk about some yeah yeah.
I have a couple questions for you, gents.
Go for it!
You mentioned Kali was an important tool to use as a base for this research.
I actually just pulled as much as I could from Nick's packages,
but Wes, I think, has a nice cheat code there.
Yeah, my curiosity there is Kali was the golden goose for doing this previously

(35:53):
because it sort of collected all these tools in a place that you could use them.
And that sounds a lot like what Hextrike is doing. It's collecting a bunch of
at least tool knowledge.
It's not providing the tools themselves, but that's kind of trivial at this point.
And so is this sort of the new Cali that people are going to go to or these tools at least?
I mean, I think it might be fair. Or the next wave, right? Like how we've seen,

(36:16):
this is a really stretched analogy, right? But we see a whole lot of people
generating songs and pictures that could never make music or take a great picture before, right?
So now I think you're going to see a lot of people. And you see a lot of people
making some good review PRs, some bad PRs.
You see a lot more code getting generated. So what you have now is if you know

(36:37):
just a little bit about your network, you now have a system that can operate the tools for you.
This is both enabling and also risky. It's a double-edged sword.
It has more leverage, so there's more leverage.
So before it took an understanding of how to orchestrate and stack these tools
together, like you needed to have a sense of, oh, there's something like you

(36:58):
would do an end map yourself.
You would see that port 3000 yourself. You would go try to poke at it with Telnet
or throw some curls at it or whatever.
And then you would just have that instinct and you would use additional tools
to drill down and go do the searching you need to do.
There's various workflows you've learned, right? Attack patterns,
processes that human experts have developed over the years.
Now this thing's doing it for you. It can do it dynamically.

(37:19):
It can be updated every single week.
And it can do it at scale.
So the real trick now is the knowledge about it, how to set it up, that kind of knowledge.
And then the budget to spend the tokens on some API or local model.
Like there are distilled models now that can do this locally.
Like there's a Quen model that runs locally. even on laptops that can do this.

(37:42):
And there is that Kimi K3 model that can run on some reasonably powerful local
systems now that's distilled that can do this.
These are open source and local. There's also lots available via the APIs.
So if you have access to hardware or you can pay for API credits,
you essentially have access to this now. That's the barrier now.
Can we talk about your token budget this week?

(38:05):
Really?
I know it's not in the doc.
But like- You're going to shame me like that?
It's important.
So, you know, I have not really had to pay a lot for tokens recently because
I find Minimax to be extremely useful.
And it gets me really, really far. However, to get this over the hump,
I did end up pulling in some Kimi K3 and some Grok.

(38:27):
And so to build this for my system, I spent my budget on this,
I guess you could say, I guess, was $43.90. And that was 716.4 million tokens.
So it's not a cheap thing, but for me, $43, $45 to now to be able to audit JB

(38:48):
infrastructure on demand in a report style that I can share with you guys.
And a lot of that, I imagine, was the setup and tuning that would be amortized
over each individual scan, which would not be that much. And you can probably
drive with not the Premiere model.
100%, because once you have the structure, Minimax is totally capable of handling
it, and I can basically run that forever.
um but yeah you you wanted you wanted something a little more advanced to build

(39:13):
out the structure and get this thing right and so some kimmy in there some grok in there,
probably oh yeah lots of deep seek lots of deep seek but deep seek's pretty
cheap that worked and then mine's all using podman containers that spin up and
then disappear when they're done and stuff like that um and then like with the
different levels of gating.
Oh that's fun.
Mm-hmm. Mm-hmm. Mm-hmm.

(39:33):
I'm curious, what's the next step then? Like, are you going to push this further
and look at all the boxes on the JB network? Are you going to put it aside for
a second until you reassess whether you put enough controls in?
I'm going to tweak the reporting a bit and the timeout issue a little bit so
I can get more information in the report.
But then what I think it's probably best to point at the boxes that are sort

(39:56):
of on the top of our list to retire and kind of just make a priority list based
on these findings and just sort of use that data to derive our decisions to
sort of shore up infrastructure.
Yeah, that and maybe whatever the few maximally exposed things are.
Yeah. And hopefully, you know, find stuff before we get to a point where this
stuff is getting widely exploited. And we, you know, we don't really want to

(40:16):
be in a position where once a week or every few days we're SSHing into these
boxes and updating them.
Right.
And if we do get to that point, we want to have a fleet that's lean enough that it's manageable.
And probably reset up in a declarative, repeatable way so that that becomes a more sane task.

(42:21):
Got a bunch of beautiful feedback this week, and we're going to start with Nathan.
Nathan says, literally just discovered this podcast, and you happen to mention
Trek, which has been my recent obsession.
I'm currently planning my honeymoon with it.
Oh, cool.
Oh, he means the tool.
Not the show. Yeah, not Star Trek. No. The collaborative road trip and travel planning.

(42:44):
Okay. I'm currently planning my honeymoon, congratulations, with it,
and it's been a dream compared to my normal spreadsheet slash calendar workflow for trips.
It comes with a built-in MCP, so I hooked it up to my LOM setup, and I've been doing,
some research that way to try and find some spots off the beaten path and working

(43:04):
them into the trip plan to include travel time, cluster locations,
proximity to our hotels.
It's a super polished app. I haven't tested out the collaborative features yet,
but they all seem quite promising.
figured I'd write in to give the Trek recommendation a plus one.
Now off to download the backlog of the show because, well, it seems super cool.

(43:27):
You know, you can plug on all kinds of like travel APIs to those agents as well.
There's all kinds of stuff with those.
You bring it all together with Trek. I think that's great.
I love how it's just like such a thoughtful thing to spend time crafting.
And thank you, Nathan. Glad you found the show. I'll take the next one.
Peter writes in, I just want to turn you guys on to TopGrade.
if you haven't heard of it yet. It updates all the things in one command so

(43:50):
you don't have to remember what you have installed. Super useful.
Upgrade all the things with top grade.
This may have been an agent pick on the show way back in the day. Um...
It doesn't support every distro, obviously, but it does support quite a few of them.
It also got the coveted Drew plus one behind the scenes.
Oh, did it? Uh-huh, yes, it did. Does he use it?

(44:12):
Yeah. Second this, top grade is super rad, says Drew.
That is nice. That's one of the things I like about the uBlue stack is they
have that uUpdate or whatever. I don't even know. It just runs.
And that updates all your packages and your flat packles.
You want to take that next one there, Mr.
P? Yeah, we got actually two messages from Magnus here.
Okay.
First one here. Hi, guys. thanks for the fantastic content universe you're providing

(44:34):
long-time listener and intermittent member i thought you might find this useful
yes this is completely shameless self-promotion,
paul hibbert even made a video on it and i thought maybe you guys would find
some exciting ways in using this,
home assistant tailored open code app super simple to start using and flexible
and it seems like it's sort of an open code that you add on to home assistant

(44:55):
and then you can sort of have it directly control Home Assistant just from the plug-in.
In open code.
Yeah so that fascinating it can drive everything.
I mean, that makes sense. Home Assistant has an extensive API and an MCP.
So it seems like that should be pretty doable. Very nice.
Yeah, it seems pretty clever. I haven't tried it. I've only checked it a little
bit here when I was gathering the feedback, but it's a smart idea,

(45:18):
especially if you don't already have any of that info set up,
but you want something to help you manage.
Before you get his next one, can I just say I'm surprised I haven't heard a lot of people talking.
Hermes 0.20 added conversational voice support.
So that evening, I set up an Anker USB-C speakerphone that has two microphones and a speaker.

(45:38):
And immediately, it outclasses anything the Alexa units or the HomePods or the
Google Homes have ever done.
And it ties in with my home assistant. And I can even say things like, play Magnum.
And it will activate the Apple TV. It'll launch the Infuse app.
It'll play the most recent episode of Magnum PI. And I don't have to even touch the remote.

(45:59):
and I can turn I control lights temperature it's way better,
than anything from any of the big tech companies and I don't see anybody talking
about it and I even like the thinking music I have thinking music uh when when
I when you like say hey you know hey Laura what's the weather uh,
he's pulling from my local weather station over home assistant and while he's
doing that I have a little thinking music that plays I like to do the thinking music.

(46:21):
I like that so you know what's going on uh magnus goes on listening to the backwards
episode where you dig into the old xeon server yeah you mentioned self-documenting
have you ever thought about running a sherpa type agent on your server's task
with keeping tabs on all the stuff running.
There.
The config containers mappings ports and proxies this could be posted as json
somewhere to keep a centralized documentation repo,

(46:45):
And once it's there, you could build dashboards from it.
And the best part, it could be a set and forget type feature,
just picking up on new stuff being set up or config that changes.
So unofficially, my agent data does sort of manage a lot of the important infra
and has a little index of everything, but that's just on my system.
So yeah, that would be something we should formalize. Hey, how about this?

(47:07):
Thank you, by the way. Appreciate that, Magnus. How about this?
Mike wrote in, you could try running and sharing this, And he links us to something called CBBS Pi.
A vintage CBBS style bulging board system emulator for macOS,
Linux, Docker, and the Raspberry Pi.
Something's happening here. I think we're going to have a BBS.

(47:29):
The energy is building.
The energy is building. I don't know if this is it.
I'm kind of, I hate to be this guy. I just can't even stand sitting at my Raspberry Pi anymore.
It just feels so archaic and slow. And like, it's just this weird platform that
I have to bend over just to get working right. And then like do weird twister
games versus like an x86 SBC that just, just works, dude. Like, I don't know.

(47:53):
I don't know. I'm having a hard time. I got too many pies and I'm having a hard time.
Bretton, you want to wrap us up with Ryan's email?
Ryan sent in a juicy one for the show.
Ooh. All right.
Not sure if you're still in the Apple or iOS ecosystem, but I just stumbled
upon the Mother Hen app in the Apple store.
It's written by Weston Bustron.

(48:15):
Why am I writing you to inform you about this? Well, it's a purpose-built chicken egg hen laying app.
Hey.
And it tracks when eggs are ready by the flock.
I mean, they just lay every morning. I don't understand.
I like this next bit.
Okay.
It's somewhat random, but I know you're the original Chicken Coop Home Assistant guy.

(48:38):
Thank you. So maybe it's worth checking it out as a $3 curiosity.
I'm kind of curious what kind of an app you could use for chickens,
as close as MQTT integration as you can get?
You know, I think close to this line of thinking, Ryan, is I need to be able
to take the camera feed I have of the chickens entering the roost box and coming

(49:00):
out and be able to track that. Because that's the real signal.
And like good little birdies, I'm so proud of them.
They're all laying in the nest box.
So far, they haven't laid anywhere else in the yard or in the run.
So stinking proud of these birds. But, you know, I'm still trying to figure
out which birds lay in the egg. So something like that, I think would be really good.

(49:22):
There's some interesting information in the app description here.
Okay.
I guess there's a couple different parts to the app. There's three parts.
There's the harvest tab, which is designed to be used on a daily basis.
So when you go out and find the latest batch of eggs waiting for you to collect,
you just like punch in some environmental factors such as light and stress and
how they can affect the egg production.

(49:43):
So by tracking all of that and the egg counts specifically, you can watch all
of the trends and make some informed decisions.
Okay.
There's also a flock tab for keeping tabs on the members of your flock.
I mean, you've named them all already, so that makes it pretty easy.
So if you're like the authors here, sometimes it's hard to keep track of who's
in the coop. So adding a picture or name goes a long way.

(50:06):
For the breeders out there, they added a family tree as well.
And there's a last tab here. It's the finances tab that gives you the ability
to see, if you particularly want to, just how much your feathered friends are
costing you in feed and other expenses.
Oh.
Or if you sell your eggs, how much money they're making you.

(50:29):
You just don't open that tab, it's fine.
One of the preview screenshots has my type of chicken in it. I love it.
You know, this is actually, the more I think about it, interesting because I
have particularly controlled the lighting and heating of the hen house to try
to maintain chicken egg production during the winter. It'd be interesting to
see if I can achieve that.
Is data controlling that again?
Well, that's all controlled by Home Assistant, Some potato does operate and

(50:49):
monitor that. That's really good stuff. I like that, Ryan. Thank you very much for sending that in.
There's some good stuff in there.
And we'll put a link if you have some chickens to the Mother Hen app.
And if you do have chickens, boost in and let us know. We want to hear about that.
Gentlemen, it is time for Le Boos, and let's start out with Ol' Bridie,

(51:13):
a.k.a. Kyron, coming in with a row of super McDucks.
Wow, that's mega McDucks?
Mega, mega ultra McDucks?
That's a whole flock.
222,222 Satoshis.

(51:36):
Wow.
Incredible.
Amazing. That is really something. Thank you very, very much,
sir. We appreciate that baller boost. Hey, new member. Hey, hey,
hey. All right. Yes, yes.
Old time lurker. The web boost is the best thing yet. I have previously tried
Fountain, but the hassle of dealing with buying sets, it's just,
well, I like this edition.

(51:58):
It gives us normies a way to support without the eebie-jeebies. Thanks for all the fun.
That's the idea. Make it easy.
Just wait the one day that Fiat will give you the eebie-jeebies.
But in the meantime, we appreciate it very, very much. You know,
and he did it with ZapRite.
So he got the sats. So I'm impressed all around. However you want to do it,
man. We really appreciate it. And we thank you for being our baller.

(52:18):
And look at this. Another Mega McDuck. Lutris.
Lucitropy.
All right. Also coming in with a Mega McDuck.
222,222 sats.

(52:43):
Wow. Thank you, sir. Thank you.
Yeah, sorry guys. Last couple of boosts through Fountain. Splits didn't go right for some reason.
Chris and JB got their splits, but the others didn't go through.
So here's a rectifier boost.
Keep up the good work.
You didn't have to do that, but thank you.
That's very sweet.
Thank you very much.
Well, we've got our Adversary 17 here with 54,321 sets.

(53:06):
All right.
I've gone to dial p get it plaid reversed oh i see because the episode was reversed
last week and so he's gotten also he's gotten clever with.
The numbers is what he's done there,

(53:27):
uh-huh it's.
Backwards i think he actually wanted that backwards.
Yeah yeah well.
Uh yeah i'm sure says I'll just escort myself out.
I kind of liked it. Thank you, Versaries. Appreciate that. The Incredible Mulk
comes in with 32,810 Satoshis.
Hey, another long-time listener Jupiter Party member. Yes!

(53:51):
Awesome. First-time booster. Thank you for all the hard work.
Especially on the last few shows. Here's some help to keep the lights on.
Thank you for the great content.
And also, it's a zip code boost, boys.
Ooh.
Danger.
Now, Wes, did you bring the...
I pack the map every week.
All right. All right. Let's look this up. I'm feeling like you're going to nail this one.

(54:14):
Yeah. I'm feeling Eastern time zone, I think.
Syncing it to the digital map for us. Okay. What do you got?
Oh. Orlando, Florida.
Ha ha. I knew it. I knew it. Hello, Orlando. Thank you for boosting in and for being a member, too.
We appreciate it.
Yeah. We do.
IRU comes in with 11,111 sats.

(54:42):
Now that the dust has settled, I've given BcacheFS a try.
Hey, good job.
I've set it up as the root FS with encryption and secure boot.
Mixing different drives and setting copies on a per file or directory basis,
I can choose to have copies equals one for redownloadable files while keeping
replicas on important data. A godsend in this economy.
No kidding.

(55:02):
Look at you getting clever.
I wouldn't mind a follow-up in a little while to know how it's going.
I mean, we're two years in on one of our systems running BcacheFS.
A couple of major upgrades in there. You're how many years in now on that sucker?
Two and a half, three.
Woo! And that system gets worked out.
It does.
Thank you, IRU. Appreciate you.
Well, Gene Bean sent a collection of Rosa Ducks and Leet Sats.

(55:28):
That's a total of 7,340 sats. Thanks, Gene. Let's go through them.
Number one, this episode was fun.
Well, we appreciate it. That's the goal.
We weren't sure if the Reverso episode would be horrible or not.
It confused us, so we couldn't tell.
Yeah, it was a surprisingly hard episode for us to do just because it took constant
mental effort to remember how to do the show backwards. It was silly.

(55:52):
It was like doing the math every each segment.
Nearly 13 years of doing it one way. It was awesome.
Yeah.
Note how we're not doing this episode backwards. Gene continues,
I really like local send. Yeah. So that's another plus one there.
Thanks, Gene.
I'm really interested to see where buzz goes. Sounds really great.
As a follow-up, it's a paid Slack that I want to connect an agent to.

(56:17):
This is a follow-up to a question from last week.
And then I like this one Brent why in God's name would you want 18 windows of
the same app how the heck do you find anything this is our point Gene.
You're making a presumption that he does find anything.
That's the thing Gene.
That's also quite a strong presumption I would say I have put in tools to try
to help myself here and it has not completely succeeded.

(56:41):
Okay maybe give us a follow up on that down the.
Line we're just gonna leave that one right there we'll do an episode at some
point A Dajabusan with 4,747 cents.
Every time I hear the break song, it scratches my show tune itch.
Oh, thank you.
But then replaces it with another itch of needing JB the musical.
You know, like those old sitcoms that would have a random musical episode.

(57:04):
JB the musical?
No.
I don't know about that. Maybe one day we'll put together an album.
I just, you know, if they're just, you know, I don't know. I guess, I don't know.
Send in your booths to vote for the album being released this year.
Yeah, I don't know about that. All right. Okay. All right. Maybe one day. Maybe one day.
I'm going to say Ensign Nginx. What do you think? Ensign Nginx?

(57:27):
Ensign Nginx. Oh, there you go.
Ensign Nginx comes in with a row of ducks, $2,222.
The Rust project leader has adopted an LLM policy that I completely agree with.
If we were to rely on LLM to write code, it will eventually become dependency,
and we risk not understanding what has been created.
So, did you read the Rust LLM policy?

(57:47):
I have not checked it out yet.
Neither have I.
But I will have to.
The people who review, yeah, I think it's the, I think it, I mean,
the high level here looks like you got to understand what you posted.
You got to be responsible for what you committed, that kind of stuff.
But I will try to read it after the show.
Yeah. Thanks for boosting in.
Yes. Thank you very much. I have that tab open now and I don't have crazy amounts of tabs.

(58:08):
Hey.
Well, I do have a lot of tabs actually. I do have quite a bit of tabs, but I have it open.
And probably a lot of them you can close after the show.
I will, but not that one.
Do you pin some of them?
I have a bunch of pin tabs.
I don't do that.
No you don't you definitely don't pin your tabs,

(58:30):
A Monday comes in with 19,941 Satoshis.
I would absolutely love a security camera deep dive. On the cusp of doing that
myself, just finally got a Reolink
doorbell cam and integrated into Home Assistant, and that's awesome.
Nicely done.
That's amazing. Also very much enjoyed the reverse episode. It was fun. P.S.
X5 for a zip code. Oh, okay.

(58:51):
Whoa, another zip code, and this one. Okay, so Wes, you got to do a little math.
Did I bring my calculator today?
So yes.
So multiplied by five, is that right?
I am very much considering going over my multi-frigate camera setup.
So if people have any questions and I get a few of those, I'll definitely do an episode on it.
Wes, I think you have to solve for X actually on this one.
Oh, well, I was just guessing. I thought.

(59:13):
That's not going to work, Wes. That's not going to. That's not going to.
Okay. So we had 19,941 multiplied by five.
That's 99,705.
Oh, that's a nice boost.
What I'm finding on my map, it's a little old, but it would seem to be the city of North Pole, Alaska.
Oh, really? Hello, Alaska.

(59:36):
Where the county of Fairbanks, North Star Borough.
I love that.
I have questions. It's not actually the North Pole, but they call themselves?
Can we get a history lesson?
Sure. You're right. We need to know more.
Night62 comes in with 12,000. Thank you for the boost. 12,345 sets.
Boost might not always be a clear indicator of a popular topic.

(59:57):
I often boost in just to say something, not because the episode sparked the
topic. I enjoyed the buzz episode. Being ahead of future trends is good.
Many of us are not vocal, but we trust your taste and enjoy quiet listening
and learning. Thanks. Well, that's always good signal to hear too, right?
Yeah.
Thank you. Appreciate that.
Keep doing what you're doing is what I heard.
Yeah, we appreciate that. You want to take MG there?

(01:00:18):
I'll take MG. GMG sends in a row of sticks, 11,111 sats.
That reverse episode was fun. By the way, I've boosted the previous three shows,
but I haven't heard those messages.
What?
I didn't say much other than appreciate you. So didn't need to make it into

(01:00:39):
the show. I just wanted to make sure you guys are getting the support you need.
If they're above 2,000 sats, they make it into the show. But if they're below
2,000 sats, they will be included in the doc and we read them,
but we don't read them out loud on the air. That might have been it.
But if not, let us know.
Yes.
Because then something might be broken.
Thank you, MG. That did make it in. So we appreciate you.
Time for some Fiat boosts here.

(01:00:59):
Let's do it.
Yeah. Covered bridge cookies. A very old listener. 150 Fiat.
Wow.
All right.
Yahoo.
Covered Bridge Cookies, thank you very much.
I was there for Stallman, Dot Cloud, Matt's GTX 960, Bacon, and more.

(01:01:20):
You helped my IT career more than words convey.
I since nuked that, now I apply DevOps and FOSS principles to our co-op bakery.
Covered Bridge Cookies.
Coveredbridgecookies.com.
They look delicious.
Look at this, wow. That's so cool.
Coveredbridgecookies.com It looks like they probably do shipping too. Ginger Snaps.

(01:01:42):
All right. Oh, maple shortbread. What's going on here, Brent?
Oh, you got me.
Mind if we mail you free cookies?
No way, really?
That's what it says there. I mean, that sounds awful.
I don't think you should be doing that.
Yeah, we definitely wouldn't want a sampling of some of those delicious cookies.
The .cloud reference is deep and the GTX 960. Thank you very much.

(01:02:05):
That's amazing. Appreciate that.
Thanks for boosting in.
It's a slight zip code boost because at least the website says they're baked
in Vermont cool alright well the Sithy Penguin boosted well it didn't boost and fiat it in 10 fiats,
This is different from leaving voicemails to the launch. Also,

(01:02:28):
I'm going to need you to not do a reverse show again. I already questioned my
sanity. I don't need it coming from my favorite Linux podcast.
Just kidding. That was funny as hell.
I mean, it was a little tough on the sanity. Senior Smile comes in with $5.
Oops, I forgot my name on the Kubernetes and the kernels. Here,

(01:02:49):
have a fiver. All right. Thank you, Smile. Appreciate you.
We got a free member boost from Anonymous. they're back. Chris,
I think I heard you do have I think you had a farm with some chickens.
I'm not sure if it's worth mentioning. I've been working, assisted of course,
although I am a professional dev, on an egg farm tracking system.
What?
Check it out.
Two in one episode.
Cluckwork.
Oh, I like the name.

(01:03:10):
This is a thing people are doing, guys. Yeah, I definitely have chickens.
There's demand. A little short description. Poultry farm management.
Look at this thing.
C-sharp type script.
All right, I got another thing to check out after the show.
How about that?
That is really something right there. You mentioned needing a Slack export tool.
You might try out Slack dump, which we'll put a link in the show notes.

(01:03:31):
When the CNCF almost lost its free Slack instance, they recommended this project
to teams as a way to preserve history.
I didn't end up using it because Slack backpedaled and kept sponsoring the plans, but it does seem nice.
Jumping off of Wes's idea, I put a full ButterFS multi-node sync plus load balancer app scheduler.
I think this is the idea for what to put in the kernel if you could.
Oh, oh, oh, right. Oh, now this is clever. Actually, let's just pick a must-have

(01:03:55):
subset of Kubernetes and put it all. You know, I bet there's a lot of people
that wouldn't mind some Kubernetes in the kernel.
K-K-8. No, that's horrible.
K-8's in your kernel.
That's horrible. Thank you, Anonymous. Nice to hear from you.
Paul Mumbabusin to say, back again.
Hello, Paul.
Wanted to make it clear that for audiobooks, I mostly buy them digitally from Libro.fm.
Good one.

(01:04:16):
I use their subscription to get a credit every month, which I can use to buy
an audiobook. you can use their app or download the DRM free mp3 or m4b.
Yeah that's a good one we should mention Libro FM so thank you for audiobooks.
Are also way cheaper this way.
I love audiobooks too for road trips I stack up audiobooks and podcasts unless
I'm driving with peeps and then these days I'm just going to make West Beat DJ,

(01:04:38):
however if you have music assistant you can actually just have your agent create
playlist for you so that's what I've been doing recently.
Night 62, member boosted in. Can I get a few more characters in these here? Web boost.
If not, is it permissible to add a pastebin link or something like that?

(01:04:58):
I don't really want to chunk up my comments or split them across multiple boosts.
I don't need to write a book. But even AI is having trouble reducing my thoughts to 300 characters.
You can always send us a boost and refer to an email. That's true.
The thing is, we do try to keep these moving. So that's why the length is an
issue. there, but you could always email it and let us know.

(01:05:21):
All right, Papa John comes in with a member boost. I think the anonymous members
assume their name will come through when they sign in with Memberful,
so they don't fill out their username field. Great show, guys.
Yeah, I don't know if I can bring that in without some additional approval,
but I do think maybe that is a thing. Good catch, Papa John.
Space Warlock comes in. The Reverso format wasn't for me.
I understand.
It wasn't bad content-wise. It felt like change for the sake of change rather than positive impact.

(01:05:47):
I like the idea of a SSH in the kernel. I can see a use for it.
I think it was, was it Brent's idea? How did it come up? It came up.
Are you blaming me now? Yeah. It came up from like, we were having a discussion
somehow of, on a topic and then it just sort of popped in my head. So I will take the blame.
And then we tried it. And I, it was surprisingly difficult to be honest.

(01:06:09):
It might be good. It might've been a good exercise for us to do just to put
us out of our comfort zone and push it a little bit.
Thank you for your patience.
Adversary 17's back with a member boost love the reverse episode i think it
broke all your brains a little except chris which just straight up broke entirely
i it was bad it was bad momentum thank you adversaries appreciate you.
Mohan comes in to say this episode started off with outro and ended with the intro it was backwards.

(01:06:35):
Yeah it was all leading up to that observation it was all.
Well, Gene Bean sent in a member's booth saying, give this a read.
Open Claw with Clawed Opus 4.6. Hacked a gym.
Oh, yeah. I heard about this. Yeah. Well, he found like the schedule.
He found like a way to kick people off the reservation list and bump their operator
up on the reservation list.

(01:06:56):
Those reservation systems are often not really well controlled at all.
Yeah. It's just beginning. Clanker versus clanker. Tell you what.
All right. Thank you, everybody who supported the show. When you hear a dynamic
ad, you know, that means we didn't make an ad deal. That means we're barely,
barely, barely, barely getting by. And if it wasn't for our members and our
boosters, we just wouldn't be making it.
And I want to say thank you to everybody who also streamed stats.
We didn't get as many this last episode for some reason.

(01:07:18):
Twelve of you streamed stats, and collectively you stacked 11,789 Satoshis.
Sometimes you're too confused to stream, and that's our fault.
That might happen, yeah. Maybe the stats stream reversed that episode and went to them. Who knows?
When you bring that together with our fiat boosts, and if we just price them
at the current stats value.
That brings our total for this episode, it's pretty great, to 847,041 satoshis.

(01:07:47):
Thank you, everybody who supported the show with a membership or a boost.
Boost.JupiterBroadcasting.com.
You know, we might even be at the 13-year mark, and it just feels like in so
many ways a massive future ahead of the show and so much we can dig into and
new shows we could launch and all kinds of stuff.
So we really do appreciate the support. Even if the ad market doesn't think

(01:08:08):
a little old Linux podcast is worth supporting, we appreciate that you do,
and you keep us going. And it means the world to us. It's all the difference.
All right, we got a couple of picks, as we do. I was surprised to see that you picked iDescriptor.
Well, I picked it for you. Because I know you have some iDevices around.

(01:08:28):
I do have some iDevices around.
So I thought maybe you would like an AGPL 3.0 free open source cross-platform
iDevice management tool. And it just stood out because it's not all the time
that things like this run on Linux.
That is true. And also, it's cross-platform. So if you're on Windows,
you could do that. It's developed with Qt and...
A little bit of rust.

(01:08:48):
Oh, look at that. And C++, look at that.
Too. I guess I would say if you're familiar with iPhone management that you
used to get on Macs for a while that was built into iTunes and then later built
into Finder, it's kind of like that.
You get the information about your iPhone, the storage information.
You can browse the files, the apps that are on there, and you can do it over USB or Wi-Fi.

(01:09:10):
It has AirPlay. Wow.
Yeah. iDispatcher. iDispatcher. It really is the missing piece of iPhone management.
If you like to do this kind of stuff from the desktop, I think it's really cool.
Also, if you go the jailbroken route, it also gives you a few extra options.
If you did that kind of thing. iDescriptor, yeah. And like you said, it's AGPL 3.0.

(01:09:35):
All right, boys. Now, I would like to present you something that I think is
particularly interesting. And Brentley.
This might be worth the consideration of a pivot if i were not two three years
however long four years into obsidian i may consider kiwi fs,

(01:09:57):
and so i want to mention it and i'd also like to know if anybody could take
a peek at it and tell us if it's something we should review kiwi fs is a searchable
structured version markdown system,
and you can plug an agent into it in 30 seconds KiwiFS makes Markdown files
writeable, searchable, queryable, versioned, and human readable.
They are the source of truth, and everything else is a derivative index of your

(01:10:18):
Markdown files that you can build.
And KiwiFS basically becomes a file system and a wiki for your AI agents as well.
AI agents can read and write the same knowledge base humans use.
You can use an MCP, an API, WebDAV, Fuse, all kinds of options.
It's Obsidian-style Markdown knowledge management but designed to be shared
with agents and automation. It's self-hostable. It's a single Go binary.

(01:10:43):
And they pitch it as a Markdown file system for you and your agents working together.
Huh.
And I've thought about this, too. Like, say you get a document,
say you get like a PDF for the van or you get a receipt like you want to be
able to just give it to the agent. And then two years later,
say, hey, I need that receipt from O'Reilly's that was in August of 2026. Right.

(01:11:05):
That's what I want. And that's what this is. This is that's one of the things
along with notes, because it uses three tiers of indexing. So it can be really light.
You can just use grep. Then you can graduate up to something that's called like
the BM25 algorithm. You might know more. I don't know what. And then you can also go to vector.
Yep. Full text plus vector. And then you can kind of have it combined across

(01:11:27):
different methods to sort of do a ranked final delivery.
And you can have a pretty advanced backend that's using object storage and NFS and all this stuff.
Get versioning built in. I like that.
Yeah. Yeah, so I think if I hadn't gone down the Obsidian path,
I'd probably have deployed this this week.
The other thing that is nice to see is they clearly have a concept of importers

(01:11:48):
because they say they have 19 data importers, including Pay,
Postgres, Notions, Obsidian, CSV, which perhaps also tells you you could wire in your own converter.
There's an interface for it. It's set up to have multiple of those already, which could be handy.
I like the versioning built in. That's really nice. The search stuff looks really
good. The MCP, a lot of these things have that now, but they built that from the very beginning.

(01:12:11):
Yeah, I don't know. I mean, I think KiwiFS looks really good.
I don't know if it's worth replacing something you already have.
It also could be a bit of a memory system for your agent. So you and your agents
are kind of working from the same memory system. Think about that for a moment. And it's...
How did...
How did you know I was, like, diving into these tools and I wasn't happy with
anything that I've been finding recently?

(01:12:33):
Because you've been doing that since we met you?
Yeah, that's true.
That's true. That's true, yeah. The project is new, I should warn you.
It is new. It started in April of 2026, but it's already, I mean,
it's got 600 GitHub stars. It's under Active Contributors in Development.
They've really got, they've moved something. They got something quick, so.
It is apparently a business source license.

(01:12:53):
Yeah.
So it's free to use, self-host, and modify. the only restriction you can't offer
QEFS as a commercial hosted service.
Right.
Each release does convert to Apache 2 after four years.
Oh, interesting.
Just know that going on if you are going to use it.
Okay. See, there's a lot to like, right? And Markdown is always the source of truth.
I've been looking at, um, well, many of the suggestions from listeners recently,

(01:13:16):
but, uh, Joplin made it into my list as well.
And they have, uh, seemingly quite, um, you said you're shaking your head,
but I, I, I'm only mentioning it. I'm not using it.
It's just, I've been down the same path too. I've been, it's like.
And I was thinking you would say that exactly.
The reason.
I bring it up is only because they seem to have a.

(01:13:39):
Lot of like.
Some of the agent tools as well.
So it's curious.
To see these note-taking apps go in that.
Direction you're either going to fall back from you're either going to fall
back to obsidian or you're going to try to give qo notes an earnest try that's
your next no i did that a long time i'm never no you'll you'll think about it
you'll be like actually no no no qo notes is just the way i should go here.

(01:13:59):
We go uh he's a big git guy.
Right well so brian.
In matrix is saying i've just been using my forgeo repo to store all my documentation for my agents.
There you go simple although you know if it ever gets too big that you know
there it would be nice to be able to vector that or something like that all
right you know what we do we put links to all this stuff linuxunplugged.com slash 680,

(01:14:21):
and then there's the whole network over jupiterbroadcasting.com as long as that
uh It steals on going. You can find the links over there for all the other shows.
Yeah, the incredible community-powered website.
Where are they going? Nowhere? As far as I know. Yeah, that is true.
That is still a great community-powered website.
And, of course, we've got boost.jupiterbroadcasting.com as well.
So here's the thing. If you want to really have some fun, you've got to show

(01:14:41):
up on a Sunday. You make it a Tuesday on a Sunday. You hang out with the boys.
You listen to or watch a little Linux Unplugged live.
Sundays, 10 a.m. Pacific, 1 p.m. Eastern, your time at jibiterbroadcasting.com
slash calendar. Now, for the download itself, in your RSS feed, we got some extra stuff.
We do, including, you're familiar with the MP3?

(01:15:01):
Yeah.
We provide an upgraded MP4.
You mean there's one extra MP? In the feed?
That's right, yes.
Just sitting there in the feed?
Right in the feed.
Wow.
Right next to the e-transcription files.
What?
Including, you know, ones that say who's talking to who.
Do you have any kind of, like, structured data my agent could use?
Oh, yeah. Like a JSON file that has cloud chapters in it.
Maybe you have years worth of episodes that have all of that.

(01:15:22):
Yeah, not every episode, and different ones got different parts at different times.
Getting better and better.
Getting better and richer all the time.
There you have it. All right. Thank you very much. I could tell you more.
I'll just leave it with this. Thank you to our mumble room for hanging out with
us. Thank you to the folks in the live chat, our members, our boosters,
and thank you for downloading and listening to this episode.
And I don't say it enough, but for those of you who have been listening for

(01:15:43):
a long time, we deeply appreciate you. We really do.
Thank you for hanging with us through all the ups and downs and changes.
Well, it's all ups, of course. Through all the ups and ups.
The ups and slightly less ups.
Yeah, that's it right there. Thank you.
And also, thank you for joining us on this particular episode.
And we'll see you back here for next week's particular episode,

(01:16:04):
which will not be in reverse, all right? We're done with that.
It's going to be in regular order. We'll see you next week.

All Episodes

Episode Transcript

Popular Podcasts

Stuff You Should Know

Betrayal Weekly

Dateline NBC

.css-15opob5{left:0;position:absolute;top:0.8rem;} All Episodes

.css-14f5ked{margin:0;word-break:break-word;display:-webkit-box;-webkit-box-orient:vertical;box-orient:vertical;-webkit-line-clamp:2;overflow:hidden;}680: Go Hack Yourself

Episode Transcript

Popular Podcasts

.css-r6mb8g{margin:0;word-break:break-word;display:-webkit-box;-webkit-box-orient:vertical;box-orient:vertical;-webkit-line-clamp:1;overflow:hidden;}Stuff You Should Know

Betrayal Weekly

Dateline NBC

All Episodes

680: Go Hack Yourself

Stuff You Should Know