680: Go Hack Yourself

(upbeat music) - Hello friends and welcome back to your weekly Linux Dockship. My name is Chris. - My name is Wes. - And my name is Brent. - Hello gentlemen, coming up on the show will break down the openness of HVLA yet. Probably need to know about. And then, then we're gonna attack our own systems in the spirit of finding issues before the bad guys do. We're gonna go over how to red team your own network for fun and security. Then we're gonna round out with some great booze, some pics, and a lot more. So before we get to all of that, let's say time appropriate greetings to our mobile room, Hello Virtual Lug. - Hey Chris. - Hey Wes. - Hello friends. - Hello JD. Look at those guys. Hello everybody. And hello up there in the quiet listening. Hello to the live matrix room. Yeah, we're live. We make it a Tuesday on a Sunday over jblive.tv and you can get it at jubitabragcasting.com/calendar in your time zone. My time zone? - Well, any time zone. - We never know what time zone you're in. That's why we have this system. - If we deployed the calendar today, we'd probably say it's using AI to automatically determine your location. It is in fact not. You may be using JavaScript. - It's what I guess, whatever Google calendars do it technically. - I also wanna say good morning to our friends over at Define Networking. Go check out Define.net/onplug and meet Managed Nebula from Define Networking. It's built on the open source Nebula platform. We love it, we use it, it's great. Nebula gives you a fast encrypted peer-to-peer networking without routing everything through somebody else's cloud. And it's ready for modern networks. IPv6 is built in with IPv4 or dual stack support when you need it and it's, he, the technical implementation should be studied. I'm telling you, it's great. And you can run your own lighthouses so that way you can define your network. You have control of the core of your network. Of course, they'll now provision one for you as well as part of Managed Nebula and you could use both. It's huge, it was originally built for Slack, for serious scale, serious privacy. And today you can connect up to 100 hosts for free, no credit card or required. You just go to Define.net/onplug. Nothing else offers Nebula's level of resilience, speed and scalability. I am telling you you're gonna be impressed. Get started 100 hosts, absolutely free. No credit card required, defined.net/onplug. Big thank you to Define for sponsoring the unplug program and go redefine your VPN experience, control your network destiny at Define.net/onplug. (upbeat music) We now have the schedule for Texas Linux Fest 2026. Yeah, you can go check it out. If you're curious what talks are on offer. For a quick reminder here, it will be at the UT Commons event center, same place as last year, November 6th through the 7th, 2026. Yeah, not October, November 6th through the 7th. And there is early bird pricing right now, you do need to buy tickets that ends soon. So very soon. So go grab your tickets now and support Texas Linux Fest. And we'll have a link to the full schedule. We are still putting together our plan. We really, really do want to go. We feel like there's a few of these events. Really, there's no other industry that does an event like Texas Linux Fest. The Linux community is unique in this, where it's community-run, community-organized, and it's so more refreshing and recharging than such a great time. It's so welcoming, it's so earnest and open. Well, how do you describe the difference between this and like a commercial vendor event? Night and day, right? I go and see family instead of some family-like function. I could do five, I could do five Texas Linux events to one like Red Hat Summit. You know what I mean? It really is a rechargeer. And so even if you're not a podcaster, if you're not in the JB community directly, but you're just kind of in the industry or kind of in the Linux space, I think you'd really, really enjoy it if you can make it. - Well speaking of beloved Linux conferences, we do have some news on scale as well. 24X will be taking place next year, but the dates are different. Before it's been like early March, now it's gonna be early April. April, first through the 4th, 2027 and the Pasadena Convention Center. - April could be really busy. - Yeah. - Yeah, at the Pasadena Convention Center, and they do have their call for presentations going now. - Yeah, open now. So closes November 1st. You've got a little while, but don't sleep on it. - And then last but not least, really, Nix Vegas. - Yeah, so Nix Vegas and Defcon 34 just wrapped up. I was lucky enough to go last year, had a wonderful time. And they did it again this year, another fantastic look and badge, and a great set of talks. And it seems like an even more impressive setup because they've already got those talks turned around and up on YouTube. So if you want to go check them out, please do. - Winx and the notes. (upbeat music) - All right, so open SSH 10.5 has come out, and it's an important update that you probably need to install. But B, I think it sort of shows us the shape of things to come. It is perhaps an example of what's probably going to be more and more common. So Mr. Payne, as best you can, can you kind of tell us what's going on and why they had to release 10.5 this week? - Yeah, the big bit here is around SSH agent forwarding, which maybe you've done right where you have like an SSH agent to handle your keys, maybe you got a fancy UB key or something, or you just got a key with a password and all of that kind of going. But you want to be able to use that throughout a network. So like you're going to one box, and then you want to be able to still use your agent to be able to answer cryptographic questions further down the chain. So that's where SSH agent forwarding comes in. Well, there was an interaction between agent locking and open SSH's session binding that could allow certain operations that were supposed to stay local, happen remotely through a forwarded agent. - Oh, yeah. - This included adding PKCS 11 tokens, and in some cases using destination restricted keys. The SSH client also, the update for it also fixes a potential use after free bug and on the server side, they've fixed the restrict option in authorized keys. So it now properly applies to tunnel forwarding too. So more work in the tunnel area. Fourth noting though, tunnel forwarding is still disabled by default. So it only applies if you've actually explicitly turned it on. The whole plenty of people do. - Yeah, yeah, guilty. - And then furthermore, open SSH says it's seen, as surprise, surprise, not really. There's seen a surge in AI assisted vulnerability reports. Now, of course, a lot of them don't really hold up under realistic threat models. You kind of fill out the details. But they do explicitly say they findings backed by human analysis, test cases, and fixes are welcome. And perhaps more interestingly, they've seen vulnerabilities first found with AI later independently discovered by other researchers. - So two notes to that, Wes. Number one is it's sort of this double-edged sword that we continue to see with AI contributions is, maybe you get 10 crappy slop reports and then you get one or two genuinely important security reports and they still have to go through those 10 or 11 slop reports to get that one genuine. - And figuring out how to do that well in its scale is now a new open problem. - But also, it seems likely that the genuinely good reports will increase as things like Kimi K3 and Deepseek 4 become more prevalent in the community. - Yeah, the signals and noise should get better as model capability and art techniques get better. - Yeah, you would have goodness. - Yeah, yeah. So that doesn't mean they see less submissions, right? So they're gonna have this, an open SSH is one of many that are gonna have this accelerated issue of if one LLM with one guy can find it, then another guy with another LLM is gonna find it. And it's almost, could almost be assumed that if an LLM found that bug, it's almost public at that point. So there's sort of an urgency in which they have to move. - Yeah, and especially because we've seen like with Bitcoin projects and the open SSH is another one where it's independently maintained, not a huge team and is like a high leverage duo where if you can own that, then you can really get everywhere. They do also say that as, and I wonder if we'll see this more because it's kind of a stress test of the whole software delivery pipeline, they are talking about doing release fixes. Releasing fixes more frequently. - Yeah, faster release cadence. Because of this problem, probably a good idea. - Maybe, I mean, it doesn't mean that the rail boxes and Ubuntu LTS boxes up there are gonna get updated any sooner. - No. But hopefully it means that you have to polish the and pay some more attention. It's a good excuse to invest in securing that entire pipeline. And I mean, you're right. It doesn't mean anyone actually does the updates, but at least maybe they're there. - Maybe it forces people to adopt a system that can update more frequently. - I would imagine this updated release cadence, though puts a lot of pressure on these projects to like push forward in a pace they haven't previously seen. And so is that sustainable long term? I sure hope so because we need it more than ever. - I think that's an open question too. - Yeah, and could there be more security mistakes that slip in if you're going faster? There's always that concern as well. And I think isn't just an open SSH story like we've said, we're really discovering bugs that have sat quietly for years getting discovered now because a machine that just has unlimited patience can go through and find these things. So we're going to see I think more projects with more frequent security releases. They're going to have to have some sort of continuous scanning themselves and some sort of assisted triage. And you may see some of these projects, would you be surprised to find like an open SSH, but a project like Open SSH have a daily branch that a company like maybe Red Hat and Canonical and others are ingesting their running their own checks against it and their shipping those patches as fast as possible to their customers. after they've done a pass for quality checks. You could see like these LTS distros getting a faster stream of software to resolve some of this stuff. So I think it doesn't look like an isolated incident and it reminds me of a talk just a couple of weeks ago that OpenAI gave at Black Hat 2026 and this was just a few days after it became public that OpenAI's testing models had breached hugging faces systems. And it's a good talk. We'll link to the whole talk. I thought it was surprisingly candid, refreshing, very technical and some stuff I think is new, some stuff in here is novel, and there's a bit in here that's one of their takeaways is that as these models advance and as agents begin to work together, which is something that led to this breach, you're going to have to have a different speed in which you respond. Wanted to have this talk in such a rapid fashion was to share our belief of lessons learned with you as defenders. We believe this is a watershed moment for computer security as an industry as well as of course for OpenAI and AI as a whole. What I would internalize is that AI orchestrated, fully automated, offensive attacks are real now. And the actions we have discussed today were an unintended side effect of running evaluations on frontier AI. In the near future, we should expect that threat actors will intentionally deploy, optimize, weaponize, and use offensive agent collectives in the manner that we have just described here. The use of these offensive agent collectives results in exploit and offensive work that is faster, occurring at larger scale, if you can scale up your model in inference capacity or GPU count, et cetera. And with significantly better coordination and lower latency, then you would expect of a human red team. The challenge in this moment for the industry is that we have seen what will be a dramatic acceleration of offensive capability for attackers. We have an existence proof that was unintentional, but it exists before us and we have a consequence seen a glimpse into the near future of what attacks will look like for our industry. The challenge is that we need a similar acceleration of defense. And today, we see fully automated and offensive possible. We have no such existence proof for full automation of core defensive loops and cycles in behavior. We believe it's vital at this moment to begin accelerating defense and finding ways to automate SDLC like in the modern parlance, so incident response, vulnerability detection, vulnerability patching. There are some things that are standard acutely as challenges for the industry to begin tackling with high urgency. So continuous agentic red teaming is one of them. As you can see from this incident, agents are quite good at finding zero-dead attacks in the infrastructure of companies. The question that's now going to be posed is, are companies able to invest sufficient model intelligence in effort in finding and remediating their vulnerabilities before someone else that's a threat actor does it for you? This style of operating will be different now, but ultimately we need to invest in having AI agent red teaming that enables defenders to find and remediate vulnerabilities before attackers do. And West made implication of this earlier, but this has been really pronounced over in the Bitcoin community recently as that's sort of been the front line because you compromise a Bitcoin wallet. You can steal somebody's funds, you immediately get the reward, and so it's been going through the Bitcoin community almost like locusts, just going from one project after the other stealing funds and whatnot as they use these tools, mostly Vick, Kimi K3 to find weaknesses in projects like by scanning GitHub repos and exploiting those. Yeah, the other thing that kind of stuck out with some of these recent quote unquote escapes are just the very stories we've been talking about is just that it's not really like suddenly all security principles or thrown out the window. If anything, it means things like defense and depth and knowing where your threat vectors are and what you're actually trying to protect and why and having a good understanding of what's going on with your systems is more important than ever. I mean, there is a component of being able to find more zero days, but a lot of this is also the orchestration side being able to go from doing a scan to actually executing through to getting a persistent vector or getting through the network or whatever. Like in the case of the OpenAI exploit, they took advantage of a package manager that was connected to the internet that had exploits and then they took advantage of a web dev share that was available to do agent coordination. So they didn't create those exploits. They took advantage of those things, which they can be very good at. You're right. So if they had proper isolation and proper security on the OpenAI network, these things would have never gotten out. Yeah, there's just ways you could design it if you're really trying to do this in a hard way from the get go, though that would surely slow you down. Of course, I guess the silver lining or maybe the steel man it would be, as the models get more advanced, they have to come up with new and more sophisticated ways to isolate them, perhaps. But when you look into the root cause, yeah, there was mistakes made. And you know, it's not like necessarily there's, we will see different zero day rates across different projects and there's been, you know, and a big part of this is sort of an economic thing of, there's one part of like, what is the frontier? What is the, you know, you can pop novel software quickly, sort of aspect. But then just the other side is, you can just now have this market to be able to buy the automation on demand for the rest of it. Yeah. And I think that just sort of changes what, which low hanging fruit now becomes economic to actually attack. Yeah, now it's, can you afford the credits, the token credits, and can you, you know, are you creative of what project you pointed at, et cetera? Yeah. And I think there's also then on the defensive side as we kind of heard a little bit there is like, we're going to talk a little bit about maybe what you can do with your, your home lab or things like that. But we also need to figure out how we can invest at scale for the free and open source communities because projects are going to need resources on the defensive side. Yeah. So I figured it was worth time figuring out how we could as they say, red team ourselves to try to figure out where we have low hanging fruit. Because my suspicion is, and I don't like making this forecast, but I suspect likely that a lot of the free software we rely on for infrastructure is going to get poked at pretty soon because that's the same infrastructure banks rely on e-commerce relies on. A lot of money rides on top of the Linux stack. It's embedded in the industry and innumerable places. Yeah. And then there's modern and spine if you pop, there's all kinds of advantages to popping the stuff that we rely on every single day. So I'm sort of operating under the assumption that once they get done, get it having their fun with the Bitcoiners, they're kind of coming for the rest of us. And you're starting to see it a little bit with open SSH, that makes sense. That'd be another low hanging fruit. The other one that could be fun if you want to do a little homework is Apple released a patch for remote desktop. And now, you know, the AI assisted reverse engineering made it possible for them to go out and chase every single Mac that hasn't been patched now. And so now there's a cat and mouse game playing out. That's happening right now as we record this episode. So how do you protect yourself? It seems like it's clanker versus clanker. It's like some sort of horrible sci-fi novel where you need to have a defensive clanker that's checking your own systems. And so I built a red team agent that has been hacking our infrastructure literally all week long. Chris, you alluded to attacking your own infrastructure, which I would imagine revealed a few things. But A, how and B, why? All right, you know, the why is just to try to catch stuff. Also, you know, just try to get a sense of what it needs to be retired first. Last week we talked about retiring our node box and so I figured before we take it offline, let's attack it and see how vulnerable and risky it really was to have that thing in production. So you can get a sense of that. It could be nice to run it against your VPS. I want to stress, this is for really to audit your own stuff. Make sure you're safe. And that's really the intention of all of this. And also to kind of get a sense of what kind of automation was out there in terms of, you know, it could help like we can run and map or a couple commands ourselves, but like, can we take it to the next level? You could totally just, you could do a lot of this with some port scanning and identifying the versions of stuff and then going looking up that version with CVEs, it has like, you could do this manually. I wanted to be able to go to my agent data and say data, attack the system and give me a full audit. And what it would do is it would initiate some of those basics, like an end map and a ping and all that kind of stuff, identify what services are open and what versions of them. And then based on that, look up the CVEs and then proceed to try to exploit them. And then if it gets that far, give me a report. And so to accomplish that, I'm using a project. There's a lot of them out there. Don't do as I do. I'm using a project called Hextrike AI and it's essentially a collection of MCPs with behind it, 150 different security tools and a bunch of different autonomous AI subagents that can do these tasks. And it's pretty, it's pretty conventional in the execution order, but actually pretty great in the document, discovery, discovery, documentation, authorization for more advanced attacks. So Hextrike is both a very powerful tool, but can also be a footgun because of the types of tools it's using. They're moving so fast that the tools themselves often have exploits. So you have to build this in a way where it's extremely isolated because there is as conceived. a possibility where these types of tools can be turned back around on yourself. So I spent a quiet, a quiet bit of time designing this in a way where it was completely offline and isolated. Individual components would be spun up on demand, continued to be isolated, operated with wrappers and the MCPs. And so underneath that there's a really, really good set of tools, one of them is called NewSally, NUCLEI, which does a lot of the CVE heavy lifting, S2L map. Oh yeah, thank you. Hydras in there, hash cats in here, NetExec, various DNS tools, web exploits, framework exploits, binary analysis tools. Fuzzers. Yeah, there's a lot of, there's a lot of really good stuff in here. And what I wanted is, I wanted something that was essentially on demand for my agent, that I could, I could have a system that then they would give me a report. It would be, it would document it in a particular place every single time. And I would get a summary in Telegram. And so the idea was is, I want, I want to do an attack by prompt. It's kind of what I was going for. And I know you looked at this west. Oh yeah, I got a sort of, I'm curious to see how similar our setups were. Well, okay. So I went pretty wild. I will admit, I blew way too much time on this. I literally started this project when I got home from the show last week and I cook it. And I finished it this morning while we were doing the stream. So during the pre-show, that's why it's fast. But I went way over complicated because I wanted to isolate, I wanted to integrate it with my Hermes agent. Oh yeah, that's nice. If you just ran it standalone with the MCP tools, like through open code, I think it would be a much leaner, faster setup. Yeah. So that's what I basically did. Tell me about this. Yeah. I stood up, uh, Cali VM because you heckstrike doesn't provide the tools. It just like runs them and orchestrates them and makes them available services them to the agent. Yeah. And I just figured like half of these are already in Cali and the rest are in easy repos or easy to run on Cali because it's all designed on that. So I got that spun up in just a quick QMU VM and then have forwarded some ports there to wire up SSH access for the agent as well as the MCP server back. And then yeah, kind of just kicked it off from there. I think VM is a really good approach. You know, that keeps it as isolated as you can kind of can. So yeah. And then I chose to connect it up with a mesh network, a quick little nebula network. And then I could just kind of add some groups that I could add it into. And then so I knew just like, okay, well, whatever I'm actually going to target, like obviously you're not going to do the full like layer two like all the complicated, but for sort of scanning what services were running in that kind of thing. It was perfect. Right. For really, which is what a remote attacker is going to go after, right? Like my, my analysis going in is what is somebody who's not familiar with the land. Somebody who's remote likely going to get maybe they've somehow got on the Wi-Fi or the land, but they're not really intricately familiar with it. So I think that's back accomplishes that. And then obviously in another situation, like if I was trying to scan like a public VPS of mine, then I would attack it through that interface or whatever. But I like the, you know, mesh network nebula, just put the hose on there that you're scanning. But a lot of this too was like, I was learning how to use this tool, right? So I didn't really want, I wasn't, I hadn't gotten as far as like this, this is like a trusted tool that I know well, right? So I kind of wanted to have some known good host like an attack and be like, okay, this is stuff that even if something goes wrong is fine and I have backups of and all the rest. So one of the nice things about HexRike is because it is essentially like West said, it's orchestrating established tools, but you can have, it is aware of like these are critical, like financially important systems or production important systems. And this is a box I can bang on. And it comes with, it seems like a lot of prompts that it provides with as you run through the tools and integrate with it that kind of shape that too. So it's very, the resulting system just out of the box is pretty careful around like, I'm only going to do this with authorization. And like, you know, are we checking the boxes? And one of the things I spent a lot of time was reducing ceremony. That was the term I had to keep using is like, it wants you to sign with a key here, wants you to open up a markdown document initially and put your name in there in a date. Like it is serious about authorizing stuff. I'm like, no, no, no, no, I don't want to do any of that. So I did do like some some initial tests. So like it was doing end map with doing some curls against stuff. It was using a fuzzer to attack just sort of basic ports and our both web services. It was using nuclei. Yeah, it did some SSFRF probes. It didn't find too much because everything's up to date, right? Yeah, it's like a NIXOS box. It's up to date. But it did, the thing that it would have found if it was a problem is it did immediately latch on that I have an LLM gateway. Yeah, right? It was like, you know, you have like pretty much all your stuff. I can't get the actual key data, but I can get every all the rest of the metadata about the key and I can see all your models and I can send requests. But it did try like fuzzer sir X and G didn't find anything there. So good, good, good. And then as a parallel request, I was checking out the new meta model muse glimmer that they released because it was their first open weight model for a while. And this is before it set up hex, right? So I just had that run and trying to do because a bunch of these tools are also in NIX packages. So I did a separate attempt with a unknown model. So it was kind of a mixed bag, but to just see like, well, if I just give you some of the basic tools that you would want anyway, how far can you get on the same thing? Sure. And kind of similar results, not as rich, not as well structured, but it did get, it did find basically the same thing. It was telling though because one of this is using the meta, meta self hosted model. Yes. And I was running it on a rented RTX a 6,000. One issue with that model is it seems to be kind of high with hallucinations. And after doing a review, like it did all of this stuff, it just definitely did some exaggerating in the report. So it's another, like, you got to, if you're going to use this kind of automation, definitely apply sort of good techniques to cut out that kind of. I'd be curious if you tried one of the distilled Kimi K3 models where they've left in all the cyber offensive defensive stuff. Good idea. That could be something some follow up. Yeah. I did try like a whole crisscross of models. I put in the dog deep seek memo, quen's, Neematron. So I was, I drove a few of this with a bunch of them just to see which ones would refuse and which ones would actually, I got constant refusal from GPT, constant refusal. Like as soon as it realized it was dealing with a cyber security tool, it would bail. It could build all the scaffolding and all the configs. But when it kind of like dug in and realized, oh, no, this is a tool for hacking, it would stop the whole session. So I have to give a huge shout out to many max M3 thinking, not only is that sucker an open source model, but like never said no, never said no. Now it's not the most clever model, but it's a hell of a worker. And it had no problem driving some of this for forming when GPT would say no. And I'm trying to do self defense here. I'm not trying to attack anybody. I'm just trying to do self defense. Also, I got to try groc4.6 for like 15 minutes before I ran out of usage. And that also had no problem. And boy, did it cook. So yeah, I like that you tried the different models. I also used deep seek for a lot. Yeah, I think the only one of the like open ones or you know, that non frontier class was like high three that refused me on one part of that. Yeah, I was kind of surprising. But the rest of them, yeah, it was all totally fine. Yeah, the bouncing around sort of stunk. So one of the things I built into my Hermes system is when it begins, so normally it's been, it's like it might be on, if it's on a GPT model, when it begins a process, it has to switch over to many max or if it's really going deep, it could go but yeah, actually, it has a, then it drops to deep seek and if deep seek slower unavailable, it uses Kimmy K3. Oh, nice. Yeah, it's got like a whole little tiered system. Yeah. So just as a recap, you kind of have these goals, these attack goals, these audit goals that you give Hextrike. And then you task the agent to go off and perform one of those audit goals. Hextrike runs all of the various tools, orchestrates, all of the stuff you've heard about for years plus stuff you've never heard of. If it finds something, it then sort of can kick off a next layer. So there's a level one pass, a level two pass and that level three pass, it can actually go in there and try to exploit stuff if you've given a permission to do that and investigate further. So that is sort of the setup I wanted. And I figured we could do a little demo if you want. Yeah, we should. You want to try it? See how it goes. So I have, I have it ready to go. I will say that there for time, I'm not going to do the most extensive. There's 150 different tools in here, all of it. So the way this kicks off is I prompt my agent, my Hermes agent data to access the system, the Hextrike system via a set of MCPs and then it has a separate set of wrappers I've created to sort of audit and monitor the process. And then it generates a markdown report and it saves it to a sync thing directory that will sync to my computer. So when we're done, we'll get the high level results. Sound good, boys? Are you ready? Here we go. Please stand by. Your scan is very important to us. Thank you for scanning with data. Your patience is appreciated. Your scan is being processed in the order it was received. Your agent is attacking your box. I'm not screwing around with this scan. I'm really giving this box everything I've got. Your report is now ready. Oh yeah, I forgot to mention it, it plays a little thinking music while it scans. That's how I roll. It's a nice time now. Thank you. Thank you. So all right. So here we got our report. This is the box we retired last week. It's still online because it's finished finishing up some work. And it's not a perfect report. I think I could have turned it up a little bit and had to be a little more aggressive. So we don't have any massive vulnerability standing out here. But it discovered 10 TCP services were reachable and tested remotely. And it discovered that OpenSSH identifies itself as 8.2P1. It doesn't sound modern. And NGINX identifies itself as 11718. Cockpit as well behind as well. Here's the one I thought you might find interesting in the West. 3,000 leaks in application stacks. to an unauthenticated scanner. What's that? [laughs] A malformed basic HTTP request produces a 500-internal survey, or the response exposes the internal paths, including AppUtil's proxy J.S., AppUtil's safe handler J.S., and expresses router internals. It even reveals the failing operation cannot read properties of undefined reading ends with. So it's sort of an information disclosure, air handling weakness, it discovered, that would be a little interesting to push on. Potentially, like you read this on 3,000. Yeah, what's on 3,000? So you could come back, one of the things you could do is report and say, "All right, come back and let's push on that." Yeah, you get things. You could go drill down it on, if it seems worthwhile. It kind of critiques the Bitcoin lightning setup we have for, hey, for responding to network requests. Anything has jumped out, anything jumped out at you, Wes? I like, it gave us a one sentence takeaway. The audit found a surprisingly broad and somewhat chatty service, including admin, Bitcoin, lightning, and RPC interfaces. But the part designed to determine whether any of this actually is vulnerable and failed. It failed, so because we didn't do the actual deeper scan. So the strongest conclusion is, interesting exposure, incomplete security assessment, no vulnerabilities detected yet. So then it gives us a list of what we could do next here, five further steps to drill in deeper here, and get Nusseli giving us a complete work in vulnerability report. Nusseli completes the report, but sometimes it doesn't complete in time, so it doesn't get included. And then we also-- Yeah, I think that was one thing I saw the bot identified with XTRI, some timeouts weren't always handled. That great. Yeah, yeah. So there's a little bits you have to fix in there. Also, it suggests we renew or rotate some of our TLS certificates before September 6th. And I think that also speaks to this to like, it's kind of nice just from understanding what all is happening, especially on a box like this, that's like just been kind of off in the corner, right, checking up on things, especially you could go poke around like your whole tail net and check things out there or whatever. Right, once the bulk of getting XTRI, and depending on how you do it, it could be a really quick thing or it could be a week long thing. But then the end of thing is like, all right, go check this box, go audit it for me, and then you can have a producer report that's consumable for yourself or a team of people, just depends on what your audience is, so that's all manageable. And there is a few things in here, like we need to get open SSH. If we were going to keep this box online, my immediate takeaways are we would have to update, we would have to update open SSH, engine X and cockpit. I would probably want to look at this JsonRPC service on 50,000 or 50,000 in one or whatever it is, and the service on 3,000. We'd probably need to figure out what those are, this HTTP thing that we're leaking. It does at least seem like it makes sense, given what the box is, which is a crazy smattering of Docker Compose containers with a whole bunch of different ports open. And those paths are umbral path, that it's exposing through that port 3000. So that, you know, right there, if I were putting my old hat on back in the day when I was getting hired to do the security audits with tools that were way less cooler than this, that would be the number one thing I would go, I would go knock on that port 3000 a lot more and figure out what's going on there. Because it's revealing the internal structure of the entire frickin umbral setup, which is where the Bitcoin node lives. So that's a pretty juicy reveal right there. And if you knew going in, like I do, the umbral app structure, I would immediately recognize that. And I would, that's, so machine or not, right? I could take this report, I could take it further. Or um, the other thing. That was kind of great, right? Like, you don't need to just rely on the box. Like it can just be a tool that you can, it can be a tool to like work together. You can learn a bunch of how the tools work and drive it yourself. The Hermi system, this is why I wanted to integrate it. The Hermi system knows what this system is. It knows what this box's role is. It's important. So it, it knows like, in a way that makes it very useful. Because it, first of all, before I even scanned this node, I never told any, it just said, "Hey, this is an important economic machine." Do we want it? Do we want it? Carefully. Like, it knew all of that, right? But it also knows umbrals on there. So it can, it can use all of this information to inform its attack. So it's really, if you have an agent system that's managing infrastructure, you can stand this up alongside of it. And you can use that information to essentially go be a chaos monkey under your control. And you can turn up the heat, depending if you just want port knocking and, I am pinging, you can do that. But if you want like CVE identification and then go and try to exploit it, you can do that. You can turn it all the way up. I do think it is something that's kind of a more advanced tool that people need to be extremely careful with. But looking at this open SSH situation, right? Like, now I could go point this at some of our GitHub code repos or something like that. Yeah, that'd be the next thing that I was kind of trying to get set up for, but haven't yet would be, would be trying to get the bot tools up to go to see if it could find things like a zero day or issue in code. Or, especially if you compare it, right? You have the metadata reports so you know what versions are running on whatever boxes you're trying to check out. So then it can go clone that exact version and then go check through it and run tests or, you know, set up that version running locally to hit against as it develops a theory, that kind of thing. I think if you want to just play with it, you're set up, you know, where you had a Cali VM really straightforward, got to go in, probably what thin an hour out, I would imagine. Yeah, it was pretty easy. Yeah. And so that's how I want to try this and see what it tells me, see what I can figure out with this. For me, obviously it would be a little more work, like if I need to set up like proper bridge, networking or put it like if I was trying to do a proper like on a LAN or a corporate environment. So like that would be more work. But because I was doing a pretty minimal test run, it made it easy. Yeah. And it's, you could do it all the way if you want. You could turn it up all the way. There's a lot of tools out there to do this kind of thing. So if you have any suggestions, [email protected] and let us know. Yeah, because we could only talk about some. Yeah. Yeah. I have a couple questions for you, Jens. Go for it. You mentioned Cali was like an important tool to use as a base for this research. I actually just pulled as much as I could from Knicks packages. But Wes, I think has a nice cheat code there. Yeah. And my curiosity there is like Cali was the golden goose for doing this previously because it sort of collected all these tools in a place that you could use them. And that sounds a lot like what Hextrike is doing. It's collecting a bunch of at least tool knowledge. It's not providing the tools themselves, but that's kind of trivial at this point. And so is this sort of the new Cali that people are going to go to or these tools at least? I mean, I think it might be fair, or the next wave, right? Like how we've seen this is a really stretched analogy, right? But we saw, we see a whole lot of people generating songs and pictures that could never make music or take a great picture before, right? So now I think you're going to see a lot of people. And you see a lot of people making some good review PRs, some bad PRs. Like you just see a lot more code getting generated. So what you have now is, if you know just a little bit about your network, you now have a system that can operate the tools for you. This is both enabling and also risky. It's just it's a double X story. It has more leverage, so there's more leverage. So before it took an understanding of how to orchestrate and stack these tools together, like you needed to have a sense of, oh, there's something like you would do an end map yourself. You would see that port 3000 yourself. You would go try to poke at it with telnet or throw some curls at it or whatever. And then you would just have that instinct and you would use additional tools to drill down and go do the searching you need to do. This very work flows you learn, right? Attack patterns, processes that human experts have developed over the years. Now this thing's doing it for you. It can do it dynamically. It can be updated every single week. And it can do it at scale. So the real trick now is the knowledge about it, how to set it up, that kind of knowledge. And then the budget to spend the tokens on some API or local model. Like there are distilled models now that can do this locally. Like there's a Quinn model. There runs locally even on laptops that can do this. And there is that Kimmy K3 model that can run on some reasonably powerful local systems. Now this distilled that can do this. These are open source and local. There's also lots available via the APIs. So if you have access to hardware or you can pay for API credits, you essentially have access to this now. That's the barrier now. Can we talk about your token budget this week? Really? I know it's not in the dock, but you're going to shame me like that. It's important. So I haven't, I have not really had to pay a lot for tokens recently, because I find many Macs to be extremely useful. And it gets me really, really far. However, to get this over the hump, I did end up pulling in some Kimmy K3 and some Groc. And so to build this for my system, I spent my budget on this, I guess you could say, I guess, was $43.90 and that was $716.4 million tokens. So it's not a cheap thing, but for me, $43, $45, to now to be able to audit JB infrastructure on demand in a report style that I can share with you guys. And a lot of that I imagine was the setup and tuning that would be amortized over each individual scan, which would not be that much. And you could probably drive with not the premier. 100% because once you have the structure, many Macs is totally capable of handling it, and I can basically run that forever. But yeah, you wanted something a little more advanced to build out the structure and get this thing right. And so some Kimmy in there, some Groc in there, probably, oh yeah, lots of deepseek, lots of deepseek. The deepseek's pretty cheap. That worked, and then mine's all using pod man containers that spin up and then disappear when they're done and stuff like that. And then like with the different levels of gating. Oh, that's fun. Mm-hmm. Mm-hmm. Mm-hmm. I'm curious, what's the next step then? Are you going to push this further and look at all the boxes on the JB network? Are you going to put our aside for a second until you reassess whether you didn't have controls. I'm going to tweak the reporting a bit, and the timeout issue a little bit, so I can get more information in the report. But then what I think it's probably best to point at the boxes that are sort of on the top of our list are retired and kind of just make a priority list based on this. these findings, and just sort of use that data to drive our decisions to sort of shore up infrastructure. Yeah, that and maybe whatever the few maximally exposed things are. Yeah. And hopefully, you know, find stuff before we get to a point where this stuff is getting widely exploited and we, you know, we don't really want to be in a position where once a week or every few days where SSH into these boxes and updating them, right? And if we do get to that point, we want to have a fleet that's lean enough that it's manageable. And probably reset up in, you know, declarative, repeatable way so that that becomes a more sane task. I want to take a moment and mention my friends over at Connected and Internet and use the promo code Jupyter35 to get $35 off your order. They're not a sponsor, but they sent me some gear a while ago and I just ended up using it over the weekend. And I'm like, this is so good. It's one box and it combines all of the high speed data networks in the US and Canada. And it has technology in there. It's based on, I think, an open WRT OS and it kind of picks between the best for your signal and data and all of that. And they have truly unlimited plans as well, including plans with priority internet access, which means you get higher priority on the LTE network or the 5G network and they have plans with no data caps. It's really rare out there. I mean, I have been doing this since the days of buying bootleg sins off of eBay and to have something like this now is just remarkable and to have it across the different popular networks too is really great. And not too long ago, they introduced their backup plan, $39 a month that comes with a router and the antenna and everything you need. And it just auto fails over when your internet goes out and auto fails back. That's it. Auto restores when your internet returns. It's just great. And they also have things for more permanent installs, like their fortress router, which I have up at the farm, 7 and 10 a beast, also run an open WRT. It's impressive. ListinInternet.com is where you go connect 10, internet.com. And if you use our promo code Jupiter35, you can take $35 off your entire order. They hooked me up when they sent some gear and I'm giving them a shout because I'm still using it to this day and I think it's great. And since we don't have an official sponsor for this spot, I say go check out Connected Internet. I really, I really liked it. And if you're a mobile or you need a backup internet connection, it's a no brainer. Look out, Jupiter35. Got a bunch of beautiful feedback this week and we're going to start with Nathan. Nathan says literally just discovered this podcast and you happen to mention Trek, which has been my recent obsession. I'm currently planning my honeymoon with it. Oh cool. Oh, he means the tool. Yeah, the collaborative. No, yeah, yeah. Yeah, that's our Trek. No. The collaborative road trip and travel planning. Okay, you could do this. I'm currently planning my honeymoon. Congratulations. With it. And it's been a dream compared to my normal spreadsheet slash calendar work for trips. It comes with a built-in MCP, so I hooked it up to my LOM setup and I've been doing some research that way to try and find some spots off the beaten path and working them into the trip plan. Absolutely. Travel time, cluster locations, proximity to our hotels. It's a super polished app. I haven't tested out the collaborative features yet, but they all seem quite promising, figured I'd write in to give the Trek recommendation a plus one. Thank you. Now I'll have to download the backlog of the show because, well, it seems super cool. You know, you can plug in all kinds of like travel APIs to those agents as well. There's all kinds of stuff with those. You bring it all together with Trek. I think that's great. I love how it just looks like such a thoughtful thing to spend time crafting. And thank you, Nathan. Glad you found the show. I'll take the next one. Peter writes in. I just want to turn you guys on to top grade, if you haven't heard of it. It updates all the things in one command, so you don't have to remember what you have installed. Super useful. Upgrade all the things with top grade. This may have been an agent pick on the show way back in the day. It doesn't support every distro obviously, but it does support quite a few of them. It also got the coveted Drew plus one behind the scenes. Oh, did it. I guess it did. Did he use it? Yeah. Second this, top grade is super rat. That's true. That is nice. It's one of the things I like about the UBlue stack is they have that like a UUpdate or whatever it is going on even now. I just run. And that updates all your packages and your flatpagels. You want to take that next one, Nathan? Yeah, we got actually two messages from Magnus here. Okay. First one here. Hi guys. Thanks for the fantastic content universe you're providing long time listener and intermittent member. I thought you might find this useful. Yes, this is completely shameless self promotion. Paul Hippard even made a video on it. And I thought maybe you guys would find some exciting ways in using this home assistant tailored open code app to be simple to start using inflexible. And it seems like it's sort of an open code that you add on to home assistant and then you can sort of have it directly control home assistant just from the plug in in open code. Yeah. So that can drive everything. I mean that makes sense, a home assistant has an extensive API and an MCP. So it seems like that should be pretty doable. Very nice. Yeah. It seems pretty clever. I haven't tried it. I've only checked it a little bit here when I was gathering the feedback but it's a smart idea. Especially if you don't already have any of that info set up but you want something to help you manage. Before you get his next one, can I just say I'm surprised I haven't heard a lot of people talking. Hermes 0.20 added conversational voice support. So that evening I set up an anchor USBC speaker phone that has two microphones and a speaker. And immediately it outclasses anything the Alexa units or the home pods or the Google homes have ever done and it ties in with my home assistant. And I can even say things like play Magnum and it will activate the Apple TV. It'll launch the infuse app. It'll play the most recent episode of Magnum PI and I don't have to even touch the remote. My control lights temperature. It's way better than anything from any of the big tech companies. And I don't see anybody talking about it. And I even like the thinking music. I have thinking music when I when you like say, hey, you know, hey, Laura, what's the weather. He's pulling from my local weather station over home assistant. And while he's doing that, I have a little thinking music that plays. I like to do the thinking music. I like that. You know what's going on. Magnus goes on listening to the backwards episode where you dig into the old Zion server. Yeah. You mentioned self-documenting. Have you ever thought about running a Sherpa type agent on your servers tasked with keeping tabs on all the stuff running there that config containers, mappings, ports and proxies? This could be posted as JSON somewhere to keep a centralized documentation repo. And once it's once it's there, you could build dashboards from it. And the best part, it could be a set and forget type feature just picking up on new stuff being set up or config that changes. So unofficially, my agent data does sort of manage a lot of the important infra and has a little index of everything. But that's just on my system. So yeah, that would be something we should formalize. Hey, how about this? Thank you, by the way. Appreciate that, Magnus. How about this? Mike wrote in, you could try running and sharing this. And he links us to something called C-BBS. Hi. A vintage C-BBS style bulge in board system emulator from H.O.S. Linux Docker and the Raspberry Pi. Something's happening here. I think we're going to have a BBS. I had the energy's building. The energy is building. I don't know if this is it. I'm kind of, I hate to be this guy. I just can't even stance it into my Raspberry Pi anymore. It just feels so archaic and slow. And like it's just this weird platform that I have to bend over just to get working right and then like do weird Twister games versus like an X86 SBC that just just works, dude. Like, I don't know. I don't know. I'm having a hard time. I got too many pies. Bradley, you want to wrap us up with Ryan's email. Ryan sent in a juicy one for the show. Ooh. All right. Not sure if you're still in the Apple or iOS ecosystem, but I just stumbled upon the mother hen app in the Apple store, it's written by Weston Bustron, "Why am I writing you to inform you about this?" Well, it's a purpose built chicken egg hen laying acts when eggs are ready by the flock. I mean, they just lay every morning. I don't understand. I like this next bit. Okay. It's somewhat random, but I know you're the original chicken coop home assistant guy. Okay. So maybe it's worth checking you out as a $3 curiosity. I'm kind of curious what kind of an app you could use for chickens as close as MQTT integration as you can get. You know, I think close to this line of thinking, Ryan, is I need to be able to take the camera feed I have of the chickens entering the roost box and coming out and be able to track that because that's the real signal. And like good little birdies, I'm so proud of them. They're all laying in the nest box so far they haven't laid anywhere else in the yard or in the run. So stinkin' proud of these birds, but you know, I'm still trying to figure out which birds lay in the egg. So something like that I think would be really good. There's some interesting information in the app description here. Okay. I guess there's a couple of different parts to the apps with three parts. There's the Harvest tab, which is designed to be used on a daily basis. So when you go out and find the latest batch of eggs waiting for you to collect, you just like bunch in some environmental factors such as light and stress and how they can affect the egg production. Uh-huh. So by tracking all of that and the egg counts specifically, you can watch all of the trends and make some informed suggestions. Okay. Okay. There's also a flock tab for keeping tabs on the members of your flock. I mean, you've named them all already, so that makes it pretty easy. So if you're- like the authors here is sometimes it's hard to keep track of who's in the coop. Yeah, so adding a picture or name goes a long way. For the breeders out there, they added a family tree as well. And there's a last tab here. Okay. It's the finances tab that gives you the ability to see if you particularly want to just how much your feathered friends are costing you in feed and other expenses. Oh, or if you sell your eggs. How much money they're making you. You don't open that tab. It's fun. One of the preview screenshots has my type of chicken in it. I love it. You know, this is actually the more I think about it interesting because I have particularly controlled the lighting and heating of the henhouse to try to maintain chicken egg production during the winter. It'd be interesting to see if I can achieve that. Is data controlling that again? Well, that's all controlled by homo system. But data does operate and monitor that. That's really good stuff. I like that, Ryan. Thank you very much for sending that in. There's some good stuff in there. And we'll put a link if you have some chickens to the mother hen app. And if you do have chickens boost in and let us know we want to hear about that. And now it is time for le boost gentlemen. It is time for le boost. And let's start out with old Brydie aka Kairing coming in with a row of super mcducks. Wow. That's mega mcducks. Mega ultra mcducks. That looks awful, but not 222,222 satosis. Wow. Incredible. I'm amazing. That is really something. Thank you very, very much sir. We appreciate that baller boost. Hey, a new member. Hey, all right. Yes, yes, fun will now commence. Old time lurker, the web boost is the best thing yet. I have previously tried fountain, but the hassle of dealing with buying sets. It's just, well, I like this edition. It keeps us, it gives us the normies of way to support without the ebgb's. Thanks for all the that's the idea. Make it easy. Just wait the one day that fiat will give you the ebgb's. But in the meantime, we appreciate it very, very much. You know, and he did it with ZapRite. So he got the sats. So I'm impressed all around however you want to do it, man. We really appreciate it. And we thank you for being our baller. And look at this. Another mega mcduck, Lutris, Lutris Lucitripe. All right. Also coming in with a mega mcduck. This old duck still got it. 222,222 satosis. Make it show. Wow. Thank you, sir. Thank you. Yeah. Sorry, guys. Last couple of boosts through fountains, but it didn't go right for some reason. Chris and JB got their spits, but the others didn't go through. So here's a rectifier boost. Keep up the good work. Well, that's really good. You didn't have to do that, but thank you. That's very sweet. Thank you very much. Well, we've got our adversary 17 here with 54,321 sets. All right. I hold that virtual kind. He's a good guy. He's a real good guy. No, he's a great guy. I've gone to dial P. Get it? Glad reversed. Oh, I see. Because the episode was verse last week. And I've gone to dial. So he's gotten also. He's gotten clever with the numbers. This is what he's done there. Hell was that space ball one? They've gone to play. Uh-huh. I think you actually wanted that backwards. Yeah. Yeah. Well, yeah. I have a share that says I'll just escort myself. I kind of liked it. Thank you, adversaries. Appreciate that. The incredible mulk comes in with 32,810 citatoshis. Hey, another long time listener, Jupiter party member. Yeah, awesome. First time booster. Thank you for all the hard work. Especially on last few shows. Here's some help to keep the lights on. Thank you for the great content. And also it's a zip code, boost, boys. Yes, zip code is a better deal. Now, Wes, did you bring the, uh, I pack the map every week? All right. All right. Let's look this up. I'm feeling. I'm feeling like you're going to nail this one. Yeah. I'm, I'm feeling Eastern time zone, I think. Sinking it to the digital mark for us. Yeah. Okay. What do you got? Uh, oh, Orlando, Florida. Haha. I knew it. I knew it. Hello, Orlando. Rock in rule. Thank you for boosting in and for being a member, too. We appreciate it. Yeah, we do. I.R.U. comes in with 11,111 sets. Now that the dust has settled, I've given B.K.S.FS a try. Hey, good job. I've set it up as the root of S with encryption and secure boot. Mixing different drives and setting copies on a per file or directory basis. I can choose to have copies equals one for a redownable files while keeping replicas on important data. A godsend in this economy. No kidding. Look at you getting clever. I wouldn't mind to follow up in a little while to know how it's going. Mm-hmm. I mean, we're two years in on one of our systems running B.K.S.FS. Couple of major upgrades in there. You're how many years in now? And that sucker? Two and a half, three. Woo. And that's, uh, that system gets worked out. It does. Thank you. I.R.U. appreciate you. Well, Gene Bean sent a collection of Rose Ducks and Leet Sats. This is a tasty burger. That's a total of 7,340 Sats. Thanks, Gene. Let's go through them. Number one, this episode was fun. Well, we appreciate it. That's the goal. We weren't sure if the reverse episode would be horrible. No, it could be hard to be engaged. Yeah, it was a surprisingly hard episode for us to do just because it took constant mental effort to remember how to do the show backwards. It was like doing the math every segment. Nearly 13 years of doing it one way. It was a lot of memory. Yeah. Yeah. Note how we're not doing this episode backwards. Gene continues. I really like local send. Yeah. That's another plus one there. Thanks, Gene. I'm really interested to see where buzz goes. Sounds really great. As a follow up, it's a paid, it's a paid slack that I want to connect an agent to. This is a follow up to a question from last week. And then I like this one. Brent, why in God's name would you want 18 windows of the same app? Same app. How the heck do you find anything? This is our point. You're making a presumption that he does find anything. That's the thing, Gene. That's also quite a strong presumption. I would say I have put in tools to try to help myself here. And it is not completely succeeded. Okay. Maybe give us a follow up on that down the line. We're just going to, yeah, we're just going to leave that one right there. In an episode at some point. A Dasha boost in with 4747 cents. Use the boost to get through. Every time I hear the break song, it scratches my showtune itch. Oh, thank you. But then replaces it with another itch of needing JB, the musical. You know, like those old sitcoms that would have a random musical episode. JB, the musical? No, I don't know about that. Maybe one day we'll put together an album. I just, you know, they're just, you know, I don't know. I guess, I don't know. Send in your boost to vote for the album being released to this. Yeah, I don't know about that. All right, okay, okay. All right, maybe one day, maybe one day. I'm going to say Ensen Engenex. What do you think? Engenex? Ensen Nick. Ensen Nick. Oh, well, there you go. Ensen Nick's comes in with a Redux 2222 cents. The Rust Project leader has adopted an LM policy that I completely agree with. If we were to rely on LM's to write code, it will eventually become dependency. And we risk not understanding what has been created. So did you read the Rust LM policy? I have not checked it out. Neither do I. But I will have to. The people who review them are, yeah, I think it's, I mean, the high level here looks like you got to understand what you posted. You got to be responsible for what you committed, that kind of stuff. But I will try to read it out to the show. Yeah, thanks for boosting in. Yes, thank you very much. I have that tab open now. And I don't have crazy minutes of tabs. Okay, well, I do have a lot of tabs actually. I do have quite a bit of tabs. But I have it open. And probably a lot of them you can close after the show. I will, but not that one. Do you pin some of them? I have a bunch of pin tabs. I don't do that. No, you don't. You definitely don't pin your tabs. A Monday comes in with 19,941 Satoshi's. I would absolutely love a security camera deep dive on the cusp of doing that myself. Just finally got a real linked doorbell cam and integrated into home assistant. And that's awesome. Nicely does. This amazing. Also very much enjoyed the reverse episode. It was fun. Yes, X5 for a zip code. Okay. Whoa, another zip code. And this one, okay. So what you got to do a little now. Did I bring my calculator today? So yes. I multiplied by five. Is that right? I am very much considering going over my multi-frigate camera setup. So if people have any questions and I get a few of those, I'll definitely do an episode on it. Wes, I think you have to solve for X actually on this one. Oh, well, I was just guessing. I thought. That's not going to work, Wes. That's not going to. That's not going to work. Okay. So we had 19,941 multiplied by five. That's 99,705. Oh, that's a nice boost. And when I'm finding on my map, it's a little old. But it would seem to be the city of North Pole, Alaska. Oh, really? Hello, Alaska. The Fairbanks North Starboro. I love that. I have questions. Is that it's not actually the North Pole, but they call themselves? Can we get a history? Sure. Didn't get you right. We need to know more. Night 62 comes in with 12,000 three. Thank you for the boost 12,345. So the combination is one, two, three, four, five. Who's might not always be a clear indicator of a popular topic. I have to boost in just to say something not because the episode sparked the topic. I know. enjoyed the buzz episode, being ahead of Future Trends is good, many of us are not vocal, but we trust your taste and enjoy quiet listening and learning. Thanks. Well, that's always good signal to hear too, right? Yeah. Yeah. Thank you. Appreciate doing what you're doing. Is that all right? Yeah. Thank you for helping us. Help you help us all. Yeah, we appreciate that. You want to take MG there? I'll take MG. MG sends in a roast sticks 11,111 sets. Oh my God. This drawer's filled with burlopes. That reverse episode was fun. By the way, I've boosted the previous three shows, but I haven't heard those messages. What? Let's say much other than appreciate you. So, didn't need to make it into the show. I just want to make sure you guys are getting the support you need. If they're above 2,000 sets, they make it into the show. But if they're below 2,000 sets, they will be included in the dock and we read them, but we don't read them out loud on the air. That might have been it. But if not, let us know. Yes. Then something might be broken. Thank you, MG. That did make it in. So, I appreciate you. Time for some fiat boosts. Let's do it. Yeah. Covered bridge cookies, a very old listener, 150 fiat. All right. Covered bridge cookies. Thank you very much. That was good. I was there for Stahlman. Dot Cloud. Matt's GTX 960 bacon and more. You helped my IT career more than words can be. I sense new that now I apply DevOps and Foss principles to our co-op bakeries. No. Coveredbridgecookies.com. They look delicious. Look at this. Wow. That's so cool. It looks like they probably do shipping too. Ginger snaps. All right. Oh, maple shortbread. What's going on here, Brent? Oh, you got me. Mind if we mail you free cookies? No way, really. That's what it says there. I mean, I'm so awful. I don't think you should be doing that. Yeah. It definitely wouldn't want a sampling of some of those delicious cookies. But the dot cloud reference is deep and the GTX 960. Thank you very much. That's amazing. Appreciate that. Thanks for pushing it. It's a slight zip code boost because at least the website says they're baked in for a month. Cool. All right. Well, the Scythi Penguin boosted, well, didn't boost and fiat it in. 10 fiat. You're doing very well. This is different from leaving voicemails to the launch. Also, I'm going to need you to not do a verse show again. I already questioned my sanity. I don't need it coming from my favorite Linux podcast. Just kidding. That was funny as hell. I mean, it was a little, it was a little tough on the sanity. Senior smile comes in with five dollars. Oops, I forgot my name on the Kubernetes and the kernels here. Have a fiver. All right. Thank you, smile. Appreciate you. We got a free member boost from anonymous. They're back. Chris, I think I heard you do have, I think you had a farm with some chickens. I'm not sure if it's worth mentioning. I've been working a system, of course, although I am a professional dev on an egg farm tracking system. What? Check it out. It's two in one episode. It's a clockwork. Oh, I like the name. This is a thing people are doing, guys. Yeah, I definitely have to. There's demands. I did all the short description poultry farm management. Look at this thing. C# type script. All right. I got another thing to check out after the show. How about that? That is really something right there. You mentioned needing a Slack export tool. You might try out Slack dump, which will put a link in the show notes. When the CNCF almost lost its free Slack instance, they recommended this project to teams as a way to preserve history. I didn't end up using it because Slack backpedaled and kept sponsoring the plans, but it does seem nice. Jumping off of West's idea, I put a full butter FS note, multi-node sync plus load balancer app scheduling. I think this is idea for what to put in the kernel if you could. Oh, oh, oh, right. Oh, now this is clever. Actually, let's just pick a must have subset of Kubernetes and put it all, you know, I bet there's a lot of people that would mind some Kubernetes in the kernel. K, k, k, 8s. No, that's horrible. K8s in your kernel. That's horrible. Thank you, Nautamus. Nice to hear from you. Paul member Boussin to say back again. Hello, Paul. I wanted to make it clear that for audiobooks, I mostly buy them digitally from Libro FM. Good one. I use their subscription to get a credit every month, which I can use to buy it on your book. You can use their app or download the DRM free MP3 or M4P. Yeah, that's a good one. We should mention Libro FM. Thank you for good. Audi books are also way cheaper this way. I love audiobooks too. For road trips, stack it up audiobooks and podcasts, unless I'm driving with peeps. And then when these days, I'm just going to make Westby DJ. However, if you have music assistant, you can actually just have your agent Kray playlist for you. So that could also be fun. That's what I've been doing recently. Yeah. Night 62 member boosted in. Can I get a few more characters in these here web boosts? If not, is it permissible to add a paste bin link or something like that? I don't really want to chunk up my comments or split them across multiple boosts. I don't need to write a book, but even AI is having trouble reducing my thoughts to 300 characters. You can always send us a boost and refer to an email is also. That's true. It's the thing is we do try to keep these moving. So that's why the length is an issue. But you could always email and let us know. All right. Papa John comes in with a member boost. I think the anonymous members assume their name will come through when they sign in with memberful. So they don't fail at the username field. Great show. Yeah. I don't know if I can bring that in without some additional approval. But I do think maybe that is a thing. Good catch, Papa John. Space warlock comes in. The reverse of format wasn't for me. I understand. It wasn't bad content-wise. It felt like change for the sake of change rather than positive impact. I like the idea of SSH in the kernel. I can see you used for it. I think it was, was it brand's idea? How did it come up? It came up. It came up from like we were having a discussion somehow of on a topic and then it just sort of popped in my head. So I will take the blame and then we tried it. And it was surprisingly difficult to be honest. It might have been a good exercise for us to do. Just put us out of our comfort zone and you know, push it a little. Thank you for your patience. Adversary 17s back with the member boost. Love the reverse episode. I think it broke all your brains a little except Chris, which just straight up broke entirely. It was bad. It was bad. Momentum. Thank you. Adversary, I appreciate you. Mohan comes in to say this episode started off with outro and ended with the intro. It was backwards. Yeah. It was all in observation. It was all in up to that. Well, Gene being sent in a member's booth saying give this a read. Open clot with clot opus 4.6. Hacked a gym. Oh yeah, I heard about this. Yeah. Well, I found like the schedule. I found like a way to kick people off the reservation list and bump their operator up on the reservation list. Those reservation systems are often not really well controlled at all. Yeah. It's just beginning clanker versus clanker. Tell you what? All right. Thank you everybody who supported the show. When you hear dynamic ad, you know, that means we didn't make an ad deal. It means we're barely, barely, barely, barely getting by. And if it wasn't for our members and our boosters, we just wouldn't be making it. And I want to say thank you everybody who also stream sats. We didn't get as many this last episode for some reason. 12 of you stream sats and collectively you stack 11,789 satoshis. And sometimes you're too confused to stream. And that might happen. Yeah. Maybe the sats were stream reversed that episode and went to them. Who knows? When you bring that together with our fiat boost and if we just price them at the current sats value, that brings our total for this episode. It's pretty great to 847,041 satoshi. Thank you. Everybody who supported the show with a membership or a boost boost at you but are broadcasting.com. You know, we are, we might even be at the 13 year mark. And it's just like feels like in so many ways a massive future head of the show and so much we can dig into. And new shows we could launch into and you know, all kinds of stuff. So we really do appreciate the support. Even if the ad market doesn't think a little old Linux podcast is worth supporting, we appreciate that you do. And you keep us going. And it means the world to us. It's all the difference. All right. We got a couple of picks as we do. I was surprised to see that you picked iDescriptor. Well, I picked it for you. I know you have some iDevices around. I do have some iDevices around. So I thought maybe you would like an agpl3.0 free open source cross platform iDevice management tool and it just stood out because it's not all the time that things like this run on Linux. That is true. And it's also its cross platform. So if you're on Windows, you could do that. It's developed with cute and a little bit of rest. Oh, look at that. It sees plus plus. I guess, I guess I would say if you're familiar with iPhone management that you used to get on max for a while, it was built into iTunes and then later built into Finder, it's kind of like that. You get the information about your your iPhone, the storage information. You can browse the files, the apps that are on there and you can do it over usb or Wi-Fi. It has airplay. Yeah. I dispatcher. I dispatcher. It's it really is the missing piece of iPhone management. If if you like to do this kind of stuff from the desktop, I think it's really cool. Also, if you go to jailbroken route, it also gives you a few extra options. If you did that kind of thing. That's I descriptor. Yeah. And like you said, it's a agpl3.0. All right, boys. Now I would like to present you something that I think is particularly interesting and brightly. Stay wild and listen. This might be worth the consideration of a pivot. If I were not two, three years, however long four years into obsidian, I may consider KiwiFS. And so I want to mention it. And I'd also like I'd like to know if anybody. could take a peek at it and tell us if it's something we should review. KiwiFS is a searchable structured version markdown system, and you can plug an agent into it in 30 seconds. KiwiFS makes markdown files, writable, searchable, coriable, versioned, and human readable. They are the source of truth, and everything else is the derivative index of your markdown files that you can build. KiwiFS basically becomes a file system and a wiki for your AI agents as well. AI agents can read and write the same knowledge-based humans use, you can use an MCP, an API, WebDAV, Views, all kinds of options. It's a obsidian style markdown knowledge management, but designed to be shared with agents and automation. It's self-hostable. It's a single go binary. They pitch it as a markdown file system for you and your agents working together. I've thought about this too. Say you get a document. Say you get a PDF for the van or you get a receipt. You want to be able to just give it to the agent, and then two years later say, "Hey, I need that receipt from O'Reilly's that was in August of 2026." That's what I want, and that's one of the things along with notes, because it uses three tiers of index scenes. It can be really light. You can just use GREP. Then you can graduate up to something that's called the BM25 algorithm. You might know more, I don't know why. Then you can also go to Vector. FeltSex Plus Vector. Then you can have it combine across different methods to do a ranked final delivery. You can have a pretty advanced backend that's using object storage and NFS and all the stuff, or a revision built in. Yeah. I think if I hadn't gone down the obsidian path, I'd probably have deployed this week. The other thing that is nice to see is they clearly have a concept of importers, because they say they have 19 data importers, including PayPal, Postgres, Notions, Obsidian, CSP, which perhaps also tells you you could wire in your own converter. There's an interface for it. It's set up to have multiple of those already, which could be handy. I like the versioning built in. That's really nice. The search stuff looks really good. The MCP, a lot of these things have that now, but they built that from the very beginning. Yeah, I don't know. I mean, I think the KiwiFS looks really good. I don't know if it's worth replacing something you already have. It also could be a bit of a memory system for your agent. So you and your agents are kind of working from the same memory system. Think about that for a moment. How did you know I was diving into these tools? And I wasn't happy with anything that I've been finding recently. Because you've been doing that since we met you? Yeah, that's true. That's true. The project is new. I should warn you. It is new. It started in April of 2026, but it's already. I mean, it's got 600 GitHub stars. It's under active contributors and development. They've really got they've moved something. They got something quick. So it is apparently a business source license. Yeah. So it's free to use self-host and modify the only restriction you can't offer a KiwiFS as a commercial hosted service. Right. Each release does convert to Apache 2 after four years. So, oh, interesting. Know that. I'm going to use it. Okay. See, there's a lot to like, right? And Markdown is always the source of truth. I've been looking at, well, many of the suggestions from listeners recently, but, uh, Joplin made it into my list as well. And they have seemingly quite, um, you said you're shaking your head. I'm only mentioning it. I'm not using it. It's just I've been thinking you would say that exactly. The reason I bring it up is only because they seem to have a lot of, like some of the agent tools as well. So it's curious to see these note digging apps go in that direction. You're either going to fall back from you're either going to fall back to Obsidian or you're going to try to give QO notes and Ernest try. That's your next. No, I did that a long time. I know. And you're like, I'm going to know you'll think about it. You'll be like, actually, the day QO notes is just the way I should go. Here we go. Uh, he's a big get guy. Yeah. Well, so Brian and Matrix is saying, I've just been using my for Joe repo to store all my documentation for my agents. There you go. Simple, although, you know, if it ever gets too big, that, you know, it would be nice to be able to vector that or something like that. All right. You know what we do? We put links to all this stuff, Linux on plug.com/680. And then there's the whole network over at Jupyter Broadcasting.com, as long as that deals on going and finding the links or whatever all the other shows, yeah, the middle incredible community powered website where they're going nowhere. So I know. Yeah, that is true. That is still a great community powered website. Of course, we got boost at Jupyter Broadcasting.com as well. So here's the thing. If you want to really have some fun, you got to show up on a Sunday. You make it a Tuesday on a Sunday. You hang out with the boys. You listen to a little or watch a little Linux on plug live. See you next week. Same bad time. Same bad. Sunday's 10th in Pacific 1 p.m. Eastern your time at Jupyter Broadcasting.com/calendar. Now for the download itself in your RS SV, we got some extra stuff. We do. Includes you wait. You're familiar with the mp3. Yeah. We provide an upgraded mp4. You mean there's one extra mp? In the feed. That's right. Just sitting there in the feed. Right in the feed. Wow. Right next to the eTranscription files. Why? Including, you know, ones that say who's talking to who? Do you have any kind of like structured data my agent could use? Oh, yeah. Like a Json file that has cloud chapters. Maybe you have years where the episodes that have all of that. Yeah, it's not every episode. And different ones got different parts at different times. Getting better and better. Oh, getting better and richer all the time. There you have it. All right. Thank you very much. I could tell you more. I'll just leave it with this. Thank you to our mumble room for hanging out with us. Thank you to the folks in the live chat, our members, our boosters. And thank you for downloading and listening to this episode. I don't say it enough, but for those of you who have been listening for a long time, we deeply appreciate you. We really do. Thank you for hanging with us through all the ups and downs and changes. Well, it's all ups, of course. Through all the ups and ups, the ups and slightly less ups. Yeah, that's that's it right there. Thank you. And also, thank you for joining us on this particular episode. And we'll see you back here for next week's particular episode, which will not be in reverse. All right. We're done with that. It's going to be in regular order. We'll see you next week. [Music]