Chris: Hello, friends, and welcome back to your weekly Linux doc show. My name is Chris.
Wes: My name is Wes.
Brent: And my name is Brent.
Chris: Hello, gentlemen. Coming up on the show, we'll break down the openness of HFly
Chris: you probably need to know about.
Chris: And then we're going to attack our own systems. In the spirit of finding issues
Chris: before the bad guys do, we're going to go over how to red team your own network for fun and security.
Chris: Then we're going to round out with some great booths, some picks,
Chris: and a lot more. So before we get to all of that, let's say time-appropriate
Chris: greetings to our mobile room. Hello, VirtualLug. Hey, guys.
Wes: Hello, gang.
Chris: Look at those guys. Hello, everybody. And hello up there in the quiet listening.
Chris: Hello to the live Matrix Room. Yeah, we're live.
Chris: We make it a Tuesday on a Sunday over at jblive.tv, and you can get it at jupiterbroadcasting.com
Chris: slash calendar in your time zone.
Brent: My time zone?
Chris: Well, any time zone.
Wes: We never know what time zone you're in. That's why we have the system.
Chris: If we deployed the calendar today, we'd probably say it's using AI to automatically
Chris: determine your location.
Chris: It is, in fact, not. It may be using JavaScript.
Wes: It's, I guess, whatever Google Calendars do it.
Chris: I also want to say good morning to our friends over at Define Networking.
Chris: Go check out Define.net slash unplugged and meet Managed Nebula from Define
Chris: Networking. It's built on the open source Nebula platform. We love it. We use it. It's great.
Chris: Nebula gives you fast encrypted peer-to-peer networking without routing everything
Chris: through somebody else's cloud.
Chris: And it's ready for modern networks. IPv6 is built in with IPv4 or dual stack
Chris: support when you need it. And the technical implementation should be studied.
Chris: I'm telling you, it's great.
Chris: And you can run your own lighthouses, so that way you can define your network.
Chris: You have control of the core of your network.
Chris: And, of course, they'll now provision one for you as well as part of Manage
Chris: Nebula, and you could use Bolt.
Chris: It's huge. It was originally built for Slack, for serious scale, serious privacy.
Chris: And today you can connect up to 100 hosts for free, no credit card required.
Chris: You just go to define.net slash unplug.
Chris: Nothing else offers Nebula's level of resilience, speed, and scalability.
Chris: I am telling you, you're going to be impressed. Get started 100 hosts,
Chris: absolutely free, no credit card required.
Chris: Defined.net slash unplugged. Big thank you to Defined for sponsoring the Unplugged
Chris: program. And go redefine your VPN experience. Control your network destiny at
Chris: Defined.net slash unplugged.
Chris: We now have the schedule for Texas Linux Fest 2026.
Wes: Yeah, you can go check it out if you're curious what talks are on offer.
Wes: For a quick reminder here, it will be at the UT Commons Event Center,
Wes: same place as last year, November 6th through the 7th, 2026.
Chris: Yeah, not October, November 6th through the 7th. And there is early bird pricing
Chris: right now. You do need to buy tickets. That ends soon, very soon.
Chris: So go grab your tickets now and support Texas Linux Fest.
Chris: and we'll have a link to the full schedule. We are still putting together our
Chris: plan. We really, really do want to go. We feel like there's a few of these events.
Chris: Really, there's no other industry that does an event like Texas Linux Fest.
Chris: The Linux community is unique in this where it's community-run, community-organized,
Chris: And it's so more like refreshing and recharging.
Wes: It's such a great time. It's so welcoming. It's so earnest and open.
Chris: Well, how do you describe the difference between this and like a commercial vendor?
Wes: Night and day.
Chris: Night and day, right?
Brent: Like going to see family instead of like some kind of scale work function.
Chris: I could do five. I could do five Texas Linux events to one like Red Hat Summit. You know what I mean?
Chris: It really is a recharger. And so even if you're not a podcaster,
Chris: if you're not in the JB community directly, but you're just kind of in the industry
Chris: or kind of in the Linux space, I think you'll really, really enjoy it if you can make it.
Wes: Well, speaking of beloved Linux conferences, we do have some news on scale as well.
Wes: 24x will be taking place next year, but the dates are different.
Wes: Before it's been like early March.
Chris: Yeah.
Wes: Now it's going to be early April. April 1st through the 4th,
Wes: 2027 at the Pasadena Convention Center.
Chris: April could be really busy. Yeah. Yep, at the Pasadena Convention Center.
Chris: And they do have their call for presentations going now.
Wes: Yeah, open now. So closes November 1st. You've got a little while, but don't sleep on it.
Chris: And then last but not least, really, Nix Vegas.
Wes: Yeah, so Nix Vegas and DEFCON 34 just wrapped up. I was lucky enough to go last
Wes: year, had a wonderful time.
Wes: And they did it again this year. Another fantastic looking badge and a great
Wes: set of talks. And it seems like an even more impressive setup because they've
Wes: already got those talks turned around and up on YouTube. So if you want to go
Wes: check them out, please do.
Chris: Links in the notes.
Chris: All right, so OpenSSH 10.5 has come out, and it's A, an important update that
Chris: you probably need to install, but B, I think it sort of shows us the shape of things to come.
Chris: It is perhaps an example of what's probably going to be more and more common.
Chris: So, Mr. Payne, as best you can, can you kind of tell us what's going on and
Chris: why they had to release 10.5 this week?
Wes: Yeah, the big bit here is around SSH agent forwarding, which maybe you've done,
Wes: right, where you have like an SSH agent to handle how you handle your keys.
Wes: Maybe you got a fancy YubiKey or something or you just got a key with a password
Wes: and all of that kind of going.
Wes: But you want to be able to use that throughout a network, right?
Wes: So like you're going to one box and then you want to be able to still use your
Wes: agent to be able to answer cryptographic questions further down the chain.
Wes: So that's where SSH agent forwarding comes in. Well, there was an interaction
Wes: between agent locking and OpenSSH's session binding that could allow certain
Wes: operations that were supposed to stay local happen remotely through a forwarded agent.
Chris: Uh-oh.
Wes: Yeah, this included adding PKCS11 tokens and in some cases using destination-restricted keys.
Wes: The SSH client also, the update for it also fixes a potential use after free bug.
Wes: And on the server side, they've fixed the restrict option in authorized keys.
Wes: So it now properly applies to tunnel forwarding too. So more work in the tunnel area.
Wes: Worth noting though, tunnel forwarding is still disabled by default.
Wes: So it only applies if you've actually explicitly turned it on.
Wes: Though plenty of people do.
Chris: Yeah, yeah. Guilty.
Wes: And then, furthermore, OpenSSH says it's seen, surprise, surprise,
Wes: not really, they're seeing a surge in AI-assisted vulnerability reports.
Wes: Now, of course, a lot of them don't really hold up under realistic threat models.
Wes: You kind of fill out the details.
Wes: But they do explicitly say findings backed by human analysis,
Wes: test cases, and fixes are welcome.
Wes: And perhaps more interestingly, they've seen vulnerabilities first found with
Wes: AI, later independently discovered by other researchers.
Chris: So two notes to that, Wes. Number one is it's sort of this double-edged sword
Chris: that we continue to see with AI contributions is,
Chris: maybe you get 10 crappy slop reports and then you get one or two genuinely important security reports.
Chris: And they still have to go through those 10 or 11 slop reports to get that one genuine.
Wes: And figuring out how to do that well and at scale is now a new open problem.
Chris: But also, it seems likely that the genuinely good reports will increase as things
Chris: like KimiK3 and DeepSeek4 become more prevalent in the community.
Wes: Yeah, the signals and noise should get better as model capability and our techniques get better.
Chris: Yeah.
Wes: You would hope.
Chris: Yeah, yeah. So there, but that doesn't mean they see less submissions, right?
Chris: So they're going to have this – and OpenSSH is one of many that are going to
Chris: have this accelerated issue of if one LLM with one guy can find it,
Chris: then another gal with another LLM is going to find it. And it's almost –,
Chris: It could almost be an assumed that if an LLM found that bug,
Chris: it's almost public at that point. So there's sort of an urgency in which they have to move.
Wes: Yeah, and especially because we've seen like with Bitcoin projects,
Wes: I think OpenSSH is another one, right, where it's independently maintained,
Wes: not a huge team, and is like a high leverage tool where if you can own that,
Wes: then you can really get everywhere.
Wes: They do also say that as, you know, and I wonder if we'll see this more because
Wes: it's kind of a stress test of the whole like software delivery pipeline.
Wes: They are talking about doing release fixes, releasing fixes more frequently.
Chris: Yeah, faster release cadence because of this problem.
Wes: Which is probably a good idea.
Chris: Maybe. I mean, it doesn't mean that the rail boxes and Ubuntu LTS boxes up there
Chris: are going to get updated any sooner. No.
Wes: But hopefully it means we do have to polish that and pay us more attention.
Wes: It's a good excuse to invest in securing that entire pipeline.
Wes: And I mean, you're right. It doesn't mean anyone actually does the updates,
Wes: but at least maybe they're there.
Chris: Maybe it forces people to adopt a system that can update more frequently.
Brent: I would imagine this updated release cadence, though, puts a lot of pressure
Brent: on these projects to push forward in a pace they haven't previously seen.
Brent: And so is that sustainable long term? I sure hope so, because we need it more than ever.
Wes: I think that's an open question, too.
Chris: Yeah. And could there be more security mistakes that slip in if you're going
Chris: faster? There's always that concern as well.
Chris: And it's, I think, isn't just an open SSH story, like we've said.
Chris: We're really discovering bugs that have sat quietly for years getting discovered
Chris: now because a machine that just has unlimited patience can go through and find these things.
Chris: So we're going to see, I think, more projects with more frequent security releases.
Chris: They're going to have to have some sort of continuous scanning themselves and
Chris: some sort of assisted triage.
Chris: And you may see some of these projects. Would you be surprised,
Chris: to find like an maybe not OpenSSH, but a project like OpenSSH have a daily branch
Chris: that a company like maybe Red Hat and Canonical and others are ingesting?
Chris: they're running their own checks against it and they're shipping those patches
Chris: as fast as possible to their customers after they've done a pass for quality checks.
Chris: You could see like these LTS distros getting a faster stream of software to
Chris: resolve some of this stuff.
Chris: So I think it doesn't look like an isolated incident. And it reminds me of a
Chris: talk just a couple of weeks ago that OpenAI gave at Black Hat 2026.
Chris: And this was just a few days after it became public that OpenAI's testing models
Chris: had breached hugging faces systems and it's a good talk willing to the whole
Chris: talk. I thought it was surprisingly candid.
Wes: Yeah. Refreshing.
Chris: Uh, very technical and, um, some stuff I think is new.
Chris: Some stuff in here is novel and there's a bit in here.
Chris: That's one of their takeaways is that as these models advance and as agents
Chris: begin to work together, which is something that led to this breach,
Chris: uh, you're going to have to have a different speed in which you respond to,
Chris: Wes made an implication of this earlier, but this has been really pronounced
Chris: over in the Bitcoin community recently as that's sort of been the front line
Chris: because you compromise a Bitcoin wallet, you can steal somebody's funds,
Chris: you immediately get the reward.
Chris: And so it's been going through the Bitcoin community almost like locusts,
Chris: just going from one project after the other, stealing funds and whatnot as they
Chris: use these tools, mostly via Kimmy K3,
Chris: to find weaknesses in projects like by scanning GitHub repos and exploiting those.
Wes: Yeah. The other thing that kind of stuck out with some of these recent quote
Wes: unquote escapes or just the various stories we've been talking about is just,
Wes: that it's not really like suddenly all security principles are thrown out the window.
Wes: If anything, it means things like defense in depth and like knowing where you're,
Wes: you know, what your threat vectors are and like what you're actually trying
Wes: to protect and why and having a good understanding of what's going on with your
Wes: systems is more important than ever.
Wes: I mean, there is a component of being able to find more zero days,
Wes: but a lot of this is also the orchestration side, being able to go from doing
Wes: a scan to actually executing through to getting a persistent vector or getting
Wes: through the network or whatever.
Chris: Yeah, like in the case of the OpenAI exploit, they took advantage of a package
Chris: manager that was connected to the internet that had exploits,
Chris: and then they took advantage of a web dev share that was available to do agent coordination.
Chris: So they didn't create those exploits. They took advantage of those things,
Chris: which they can be very good at.
Chris: You're right. So if they had proper isolation and proper security on the OpenAI
Chris: network, these things would have never gotten out.
Wes: Yeah, there's just ways you could design it if you're really trying to do this
Wes: in a hardened way from the get-go, though that would surely slow you down.
Chris: Of course, I guess the silver lining or maybe the steel man,
Chris: it would be as the models get more advanced, they have to come up with new and
Chris: more sophisticated ways to isolate them, perhaps.
Chris: But when you look into the root cause, it is.
Chris: There was mistakes made.
Wes: And, you know, it's not like necessarily there's, we will see different zero
Wes: day rates across different projects.
Wes: And there's been, you know, and a big part of this is sort of an economic thing
Wes: of there's one part of like, what is the frontier?
Wes: What is the, you know, you can pop novel software quickly sort of aspect.
Wes: But then just the other side is you just now have this market to be able to
Wes: buy the automation on demand for the rest of it.
Wes: yeah and i think that just sort of changes what which low-hanging fruit now
Wes: becomes economic to actually attack.
Chris: Yeah now it's can you afford the credits the token credits and uh can you you
Chris: know are you creative of what project you pointed out etc.
Wes: Yeah and that's where i think there's also then on the defensive side as we
Wes: kind of heard a little bit there is,
Wes: like we're going to talk a little bit about maybe what you can do with your
Wes: your home lab or things like that but we also need to figure out how we can
Wes: invest at scale for the free and open source communities because projects are
Wes: going to need resources on the defensive side.
Chris: Yeah, so I figured it was worth time figuring out how we could,
Chris: as they say, red team ourselves to try to figure out where we have low-hanging fruit.
Chris: Because my suspicion is, and I don't like making this forecast,
Chris: but I suspect likely that,
Chris: a lot of the free software we rely on for infrastructure is going to get poked
Chris: at pretty soon because that's the same infrastructure banks rely on, e-commerce relies on.
Chris: A lot of money rides on top of the Linux stack.
Wes: It's embedded in the industry in innumerable places.
Chris: Yeah, and then there's monitoring and spying. If you pop, there's all kinds
Chris: of advantages to popping the stuff that we rely on every single day.
Chris: So I'm sort of operating under the assumption that once they get done having
Chris: their fun with the Bitcoiners, they're kind of coming for the rest of us.
Chris: And you're starting to see it a little bit with OpenSSH. That makes sense.
Chris: That'd be another low-hanging fruit.
Chris: The other one that could be fun if you want to do a little homework is Apple
Chris: released a patch for remote desktop. And now, you know, the AI-assisted reverse
Chris: engineering made it possible for them to go out and chase every single Mac that
Chris: hasn't been patched now. And so now there's a cat and mouse game playing out.
Chris: That's happening right now as we record this episode.
Chris: So how do you protect yourself? It seems like it's clanker versus clanker.
Chris: It's like some sort of horrible sci-fi novel where you need to have a defensive
Chris: clanker that's checking your own systems.
Chris: And so I built a red team agent that has been hacking our infrastructure literally all week long.
Brent: Chris, you alluded to attacking your own infrastructure, which I would imagine
Brent: revealed a few things. But A, how and B, why?
Chris: All right. You know, the why is just to try to catch stuff.
Chris: Also, you know, just try to get a sense of what it needs to be retired first.
Chris: Last week, we talked about retiring our node box. And so I figured before we
Chris: take it offline, let's attack it and see how vulnerable and risky it really
Chris: was to have that thing in production. So you can get a sense of that.
Chris: It could be nice to run it against your VPSs. I want to stress that this is
Chris: for really to audit your own stuff, to make sure you're safe.
Chris: And that's really the intention of all of this.
Wes: And also to kind of get a sense of what kind of automation was out there in
Wes: terms of, you know, like we can run Nmap or a couple commands ourselves,
Wes: but like, can we take it to the next level?
Chris: You could totally just, you could do a lot of this with some port scanning and
Chris: identifying the versions of stuff and then going looking up that version with
Chris: CVEs it has. I was like, you could do this manually.
Chris: I wanted to be able to go to my agent data and say, data, attack this system and give me a full audit.
Chris: And what it would do is it would initiate some of those basics,
Chris: like an NMAP and a ping and all that kind of stuff.
Chris: Identify what services are open and what versions of them. And then based on
Chris: that, look up the CVEs and then proceed to try to exploit them.
Chris: And then if it gets that far, give me a report.
Chris: And so to accomplish that, I'm using a project. There's a lot of them out there.
Chris: Don't do as I do.
Chris: I'm using a project called Hextrike AI. And it's essentially a collection of
Chris: MCPs with behind it 150 different security tools and a bunch of different autonomous
Chris: AI subagents that can do these tasks.
Chris: And it's pretty conventional in the execution order, but actually pretty great
Chris: in the document, discovery, discovery, documentation, authorization for more advanced attacks.
Chris: So Hextrike is both a very powerful tool but can also be a foot gun because
Chris: of the types of tools it's using. They're moving so fast, the tools themselves often have exploits.
Chris: So you have to build this in a way where it's extremely isolated because there
Chris: is conceivably a possibility where these types of tools can be turned back around on yourself.
Chris: So I spent quite a bit of time designing this in a way where it was completely offline and isolated.
Chris: individual components would be spun up on demand continue to be isolated,
Chris: operated with wrappers and the MCPs and so underneath it there's a really really
Chris: good set of tools, one of them is called Nuclei, N-U-C-L-E-I,
Chris: which does a lot of the CVE heavy lifting, SQL map.
Chris: Oh, Nuclei, yeah. Oh, yeah, thank you. Hydra's in there, Hashcat's in here,
Chris: NetExec, various DNS tools, web exploits, framework exploits, binary analysis tools.
Wes: Fuzzers.
Chris: Yeah, there's a lot of really good stuff in here. And what I wanted is I wanted
Chris: something that was essentially on demand for my agent, that I could have a system
Chris: that then they would give me a report.
Chris: It would be documented in a particular place every single time,
Chris: and I would get a summary in Telegram.
Chris: And so the idea was is I want to do an attack by prompt is kind of what I was
Chris: going for. And I know you looked at this, Wes.
Wes: Oh, yeah. I got a sort of – I'm curious to see how similar our setups were.
Chris: Well, okay. So I went pretty wild. I will admit I blew way too much time on
Chris: this. I literally started this project when I got home from the show last week.
Wes: You can cook it.
Chris: And I finished it this morning while we were doing the stream.
Wes: Yeah, during the pre-show as far as I saw.
Chris: But I went way over complicated because I wanted to isolate.
Chris: I wanted to integrate it with my Hermes agent.
Wes: Oh, yeah, that's nice.
Chris: If you just ran it standalone with the MCP tools like through open code,
Chris: I think it would be a much leaner, faster setup.
Wes: Yeah, so that's what I basically did.
Chris: Tell me about this.
Wes: Yeah, I stood up Kali VM because Hextrike doesn't provide the tools.
Wes: It just like runs them and orchestrates them and makes them available,
Wes: services them to the agent.
Wes: and I just figured like half of these are already in Cali and the rest are in
Wes: easy repos or easy to run on Cali because it's all designed on that,
Wes: so I got that spun up in just a quick QEMU VM and then have forwarded some ports
Wes: there to wire up SSH access for the agent as well as the MCP server back and then,
Wes: Yeah, kind of just kicked it off from there.
Chris: I think VM is a really good approach. You know, that keeps it as isolated as you kind of can.
Wes: Yeah, and then I chose to connect it up with a mesh network,
Wes: a quick little nebula network, and then I could just kind of add some groups
Wes: that I could add it into. And so I knew just like, okay, well,
Wes: whatever I'm actually going to target.
Wes: Like, obviously, you're not going to do the full, like, layer two,
Wes: like, all the complicated, but for sort of scanning what services were running
Wes: and that kind of thing, it was perfect.
Chris: Right, for really, which is what a remote attacker is going to go after,
Chris: right? Like my analysis going in is what is somebody who's not familiar with
Chris: the LAN, somebody who's remote likely going to get maybe they've somehow got
Chris: on the Wi-Fi or the LAN, but they're not really intricately familiar with it.
Chris: So I think that accomplishes that.
Wes: And then obviously in another situation, like if I was trying to scan like a
Wes: public VPS of mine, then I would attack it through that interface or whatever.
Chris: I like the, you know, Mesh Network Nebula, just put the host on there that you're scanning.
Wes: A lot of this too was like I was learning how to use this tool, right?
Wes: So it's like I didn't really want, I wasn't, I haven't got as far as like,
Wes: this is like a trusted tool that I know well, right? So I kind of wanted to
Wes: have some known good hosts I could attack and be like, okay,
Wes: this is stuff that even if something goes wrong is fine and I have backups of and all the rest.
Chris: So one of the nice things about Hextrike is because it is essentially,
Chris: like Wes said, it's orchestrating established tools, but you can have...
Chris: it is aware of like these are critical like financially important systems or
Chris: production important systems and this is a box i can bang on.
Wes: And it comes with it seems like a lot of prompts that it it provides with as
Wes: you as you run through the tools and integrate with it that kind of shape that
Wes: too so it's very the resulting system just out of the box is pretty careful
Wes: around like i'm only going to do this with authorization and like you know are
Wes: we checking the boxes and.
Chris: One of the things i spent a lot of time was reducing ceremony.
Wes: That was the.
Chris: Term i had to keep using is like it wants you to sign with a key here wants
Chris: you to open up a markdown document initially and put your name in there and
Chris: a date like it is serious about authorizing stuff i'm like no no no no no i
Chris: don't want to do any of that.
Wes: So i did do like some some initial tests so like it was doing nmap it was doing
Wes: some curls against stuff it was using a fuzzer to attack just sort of basic
Wes: ports and web services it was using nuclei um yeah it did some ssfrf probes
Wes: the it didn't find too much because.
Chris: Everything's up to date.
Wes: Right yeah it's like a nix os box yeah up to date but uh it did the thing that
Wes: it would have found if it was a problem uh
Wes: is it did immediately latch on that i have an llm gateway yeah there right and
Wes: it was like uh you know you have like pretty much all your stuff i can't get
Wes: the actual key data but i can get every all the rest of the metadata about the
Wes: key and i can see all your models and i can send requests,
Wes: but it did try like fuzz insert uh sir xng didn't find anything there so good
Wes: good and then as a parallel request i was checking out um the new
Wes: meta model uh muse glimmer that they released because that was their first open
Wes: weight model for a while and this is before we set up Hextrike.
Wes: So I just had that run and trying to do,
Wes: Because a bunch of these tools are also in Nix packages. So I did a separate
Wes: attempt with an unknown model. So it was kind of a mixed bag.
Wes: But to just see like, well, if I just give you some of the basic tools that
Wes: you would want anyway, how far can you get on the same thing?
Chris: Sure.
Wes: And kind of similar results, not as rich, not as well structured,
Wes: but it did get, it did find basically the same thing. It was telling though, because one of the...
Chris: This is using the meta self-hosted model?
Wes: Yes. And I was running it on a rented RTX A6000.
Wes: um one issue with that model is it seems to be kind of high with hallucinations
Wes: and oh after doing a review like it did all of the stuff it just definitely
Wes: did some exaggerating in the report so it's another like you're gonna if you're
Wes: going to use this kind of automation definitely apply,
Wes: sort of good techniques to cut down that kind of.
Chris: I'd be curious if you tried one of the distilled kimmy k3 models where they've
Chris: left in all the cybers offensive defensive stuff.
Wes: Good idea that could be some some follow-up yeah yeah i did try like a whole
Wes: crisscross of models i put in the doc deep seek memo quen's nematron so i was,
Wes: i drove a few of this with a bunch of them just to see which ones would refuse
Wes: and which ones would actually i got.
Chris: I got constant refusal from um gpt constant refusal like it as soon as it realized
Chris: it was dealing with a cyber security tool it would bail it could build all the
Chris: scaffolding and all the configs,
Chris: but when it kind of like dug in and realized, oh, no, this is a tool for hacking,
Chris: it would stop the whole session.
Chris: So I have to give a huge shout out to Minimax M3 thinking, not only is that
Chris: sucker an open source model, but like never said no, never said no.
Chris: Now, it's not the most clever model, but it's a hell of a worker.
Chris: And it had no problem driving some of this for me when GPT would say no.
Chris: And I'm trying to do self-defense here. I'm not trying to attack anybody.
Chris: I'm just trying to do self-defense.
Chris: Also, I got to try Grok 4.6 for like 15 minutes before I ran out of usage.
Chris: And that also had no problem. and boy did it cook so yeah i like that you tried
Chris: the different models i also use deep seek for a lot.
Wes: Yeah i think the only one of the like uh open ones or you know that non-frontier
Wes: class was like high three that refused me on one part of that yeah it was kind
Wes: of surprising um but the rest of them yeah it was all totally fine.
Chris: Yeah, the bouncing around sort of stunk. So one of the things I built into my
Chris: Hermes system is when it begins, so normally it's being,
Chris: it's like, it might be on, if it's on a GPT model, when it begins a process,
Chris: it has to switch over to Minimax, or if it's really going deep,
Chris: it could go, yeah, actually, it has a, it drops to DeepSeek,
Chris: and if DeepSeek's slow or unavailable, it uses Kimi K3.
Wes: Oh, nice.
Chris: Yeah, it's got like a whole-
Wes: A little tiered.
Chris: System. I love it. Yeah, yeah. So just as a recap, you kind of have these goals,
Chris: these attack goals, these audit goals that you give Hextrike,
Chris: and then you task the agent to go off and perform one of those audit goals.
Chris: Hextrike runs all of the various tools, orchestrates all of the stuff you've
Chris: heard about for years, plus stuff you've never heard of.
Chris: If it finds something, it then sort of can kick off a next layer.
Chris: So there's a level one pass, a level two pass, and that level three pass,
Chris: it can actually go in there and try to exploit stuff if you've given it permission
Chris: to do that and investigate further.
Chris: So that is sort of the setup I wanted. And I figured we could do a little demo if you want.
Wes: Yeah, we should.
Chris: You want to try it? See how it goes? So I have it ready to go.
Chris: I will say that for time I'm not going to do the most extensive,
Chris: right? Because there's 150 different tools in here.
Chris: All of this. So the way this kicks off is I prompt my agent,
Chris: my Hermes agent data to access the,
Chris: system the hex strike system via a set of mcps and then it has a separate set
Chris: of wrappers i've created to sort of audit and monitor the process and then it
Chris: generates a markdown report and it saves it to a sync thing directory
Chris: that will sync to my computer so when we're done we'll get the high level results sound good boys
Chris: are you ready here we go,
Chris: Oh, yeah, I forgot to mention it. It plays a little thinking music while it
Chris: scans. That's how I roll.
Wes: Mandatory.
Brent: It's a nice touch.
Chris: Thank you. Thank you. So, all right. So here we got our report.
Chris: This is the box we retired last week. It's still online because it's finishing up some work.
Chris: And it's not a perfect report. I think I could have turned it up a little bit
Chris: and had to be a little more aggressive.
Chris: So we don't have any, like, massive vulnerabilities standing out here.
Chris: But it discovered 10 TCP services were reachable and tested remotely.
Chris: and it discovered that OpenSSH identifies itself as 8.2p1.
Wes: That doesn't sound modern.
Chris: And NGINX identifies itself as 117.18. Cockpit is well behind as well.
Chris: Here's the one I thought you might find interesting though, Wes.
Chris: Port 3000 leaks an application stack trace to an unauthenticated scanner.
Wes: What's that?
Chris: A malformed basic http request produces a 500 internal survey or the response
Chris: exposes the internal paths including app utils proxy js app utils safe handler js
Chris: and expresses router internals it even reveals the failing operation cannot
Chris: read properties of undefined reading ends with,
Chris: so it's sort of an information disclosure error handling weakness it discovered
Chris: that would be a little interesting to push on potentially like you read what's
Chris: on 3000 so you could come back one of the things you could do this report is
Chris: say all right come back and let's push on that right because you get.
Wes: Things you can go drill down.
Chris: On if it seems worthwhile it kind of it kind of critiques the uh bitcoin lightning
Chris: setup we have for uh hey for responding to network requests anything is jump
Chris: out anything jump out at you wes,
Chris: It gave us a one-sentence takeaway. The audit found a surprisingly broad and
Chris: somewhat chatty surface, including admin, Bitcoin, Lightning,
Chris: and RPC interfaces. But the part designed to determine whether any of this actually
Chris: is vulnerable and failed, it failed because we didn't do the actual deeper scan.
Chris: So the strongest conclusion is interesting exposure, incomplete security assessment,
Chris: no vulnerabilities detected yet.
Chris: So then it gives us a list of what we could do next here, five further steps
Chris: to drill in deeper here, and get Nuselli giving us a complete working vulnerability report.
Chris: Nuselli completes the report, but sometimes it doesn't complete in time,
Chris: so it doesn't get included. And then we also...
Wes: Oh, yeah, I think that was one thing I saw, the bot identify with Hextrite,
Wes: some timeouts weren't always handled kind of that great.
Chris: Yeah, yeah. So there's a little bit you have to fix in there.
Chris: Also, it suggests we renew or rotate some of our TLS certificates before September 6th.
Wes: And I think that also speaks to this, to like, it's kind of nice just from understanding
Wes: what all is happening, especially on a box like this that's like just been kind
Wes: of off in the corner right checking up on things especially you could go poke
Wes: around like your whole tail net and check things out.
Chris: There or.
Wes: You know whatever.
Chris: Right once the bulk of getting hex strike set up and depending how you do it
Chris: it could be a really quick thing or it could be a week-long thing,
Chris: um but then the end of thing is like all right go check this box go audit it
Chris: for me and then you can have a produce report that's consumable for yourself
Chris: or a team of people just depends on what your audience is so that's all manageable,
Chris: um and there is a few things in here like we need to get open ssh if we were
Chris: going to keep this box online,
Chris: my immediate takeaways are we would have to update we would have to update open
Chris: ssh nginx and cockpit and,
Chris: we'd probably want to look at this json rpc service on 5 000 or 50 000 or whatever
Chris: it is and the service on 3 000 we probably need to figure out what those are
Chris: this http thing that we're leaking.
Wes: It does at least seem uh like it makes sense given what the box is.
Chris: Which is.
Wes: A crazy smattering of docker composed containers with a whole bunch of different ports.
Chris: And those paths are umbral paths that it's exposing through that port 3000.
Chris: So that, you know, right there, if I were putting my old hat on back in the
Chris: day when I was getting hired to do these security audits with tools that were
Chris: way less cooler than this, that would be the number one thing I would go.
Chris: I'd go knock on that port 3000 a lot more and figure out what's going on there,
Chris: because it's revealing the internal structure of the entire frickin' Umbral
Chris: setup, which is where the Bitcoin node lives.
Chris: So that's a pretty juicy reveal right there. And if you knew going in,
Chris: like I do, the Umbral app structure, I would immediately recognize that.
Chris: So machine or not, right? I could take this report. I could take it further. Or the other thing.
Wes: That's what's kind of great, right? Like you don't need to just rely on the,
Wes: like it can just be a tool that you can use. It could be a tool to like work together.
Wes: You can learn a bunch of how the tools work and drive it yourself.
Chris: The Hermes system, this is why I wanted to integrate it. The Hermes system knows what this system is.
Chris: It knows what this box's role is. It's important. So it, it knows like in a
Chris: way that makes it very useful because it, first of all, before it even scanned
Chris: this node, I never told any, it just, Hey, this is an important economic machine.
Chris: Do we want to be careful? Like it knew all of that, right? But it also knows
Chris: Umbral's on there. So it can use all of this information to inform its attack.
Chris: So it's really, if you have an agent system that's managing infrastructure,
Chris: you can stand this up alongside of it. It can use that information to essentially
Chris: go be a chaos monkey under your control.
Chris: And you can turn up the heat depending if you just want port knocking and pinging, you can do that.
Chris: But if you want like CVE identification and then go and try to exploit it,
Chris: you can do that, right? You can turn it all the way up.
Chris: But I do think it is something that's kind of a more advanced tool that people
Chris: need to be extremely careful with. But –,
Chris: looking at this open ssh situation right like now i could go point this at some
Chris: of our github code repos or something like that.
Wes: Yeah that'd be the next thing that i was kind of get trying to get set up for
Wes: but haven't yet would be would be trying to get the bot tooled up to go see
Wes: if it could find things like a zero day or
Wes: issue in code or especially if you compare right you have the metadata report
Wes: so you know what versions are running on whatever boxes you're trying to check out so then
Wes: it can go clone that exact version and then go check through it and run tests or you know set up,
Wes: uh that version running locally to hit against as it develops a theory that kind of.
Chris: Thing i think if you want to just play with it your setup you know where you
Chris: had a cali vm really straightforward got it going probably within an hour i would.
Wes: Imagine yeah it was pretty it was pretty easy.
Chris: Yeah uh and so that's how i want to try this and see what it tells me see what
Chris: i can figure out with this for.
Wes: Me obviously it would be a little more work like if i i need to set up like
Wes: proper bridge networking or put it like if i was trying to do it proper like
Wes: on a land or you know corporate environment or something like that it'd be more
Wes: work but because i was doing a pretty minimal test run it made it easy.
Chris: Yeah and it's you can do it all the way if you want you could turn up all the
Chris: way there's a lot of tools out there to do this kind of thing so if you have
Chris: any suggestions boost.jupiterbroadcasting.com and let us know.
Wes: Yeah because we could we could only talk about some yeah yeah.
Brent: I have a couple questions for you, gents.
Chris: Go for it!
Brent: You mentioned Kali was an important tool to use as a base for this research.
Chris: I actually just pulled as much as I could from Nick's packages,
Chris: but Wes, I think, has a nice cheat code there.
Brent: Yeah, my curiosity there is Kali was the golden goose for doing this previously
Brent: because it sort of collected all these tools in a place that you could use them.
Brent: And that sounds a lot like what Hextrike is doing. It's collecting a bunch of
Brent: at least tool knowledge.
Brent: It's not providing the tools themselves, but that's kind of trivial at this point.
Brent: And so is this sort of the new Cali that people are going to go to or these tools at least?
Chris: I mean, I think it might be fair. Or the next wave, right? Like how we've seen,
Chris: this is a really stretched analogy, right? But we see a whole lot of people
Chris: generating songs and pictures that could never make music or take a great picture before, right?
Chris: So now I think you're going to see a lot of people. And you see a lot of people
Chris: making some good review PRs, some bad PRs.
Chris: You see a lot more code getting generated. So what you have now is if you know
Chris: just a little bit about your network, you now have a system that can operate the tools for you.
Chris: This is both enabling and also risky. It's a double-edged sword.
Wes: It has more leverage, so there's more leverage.
Chris: So before it took an understanding of how to orchestrate and stack these tools
Chris: together, like you needed to have a sense of, oh, there's something like you
Chris: would do an end map yourself.
Chris: You would see that port 3000 yourself. You would go try to poke at it with Telnet
Chris: or throw some curls at it or whatever.
Chris: And then you would just have that instinct and you would use additional tools
Chris: to drill down and go do the searching you need to do.
Wes: There's various workflows you've learned, right? Attack patterns,
Wes: processes that human experts have developed over the years.
Chris: Now this thing's doing it for you. It can do it dynamically.
Chris: It can be updated every single week.
Chris: And it can do it at scale.
Chris: So the real trick now is the knowledge about it, how to set it up, that kind of knowledge.
Chris: And then the budget to spend the tokens on some API or local model.
Chris: Like there are distilled models now that can do this locally.
Chris: Like there's a Quen model that runs locally. even on laptops that can do this.
Chris: And there is that Kimi K3 model that can run on some reasonably powerful local
Chris: systems now that's distilled that can do this.
Chris: These are open source and local. There's also lots available via the APIs.
Chris: So if you have access to hardware or you can pay for API credits,
Chris: you essentially have access to this now. That's the barrier now.
Brent: Can we talk about your token budget this week?
Chris: Really?
Brent: I know it's not in the doc.
Chris: But like- You're going to shame me like that?
Brent: It's important.
Chris: So, you know, I have not really had to pay a lot for tokens recently because
Chris: I find Minimax to be extremely useful.
Chris: And it gets me really, really far. However, to get this over the hump,
Chris: I did end up pulling in some Kimi K3 and some Grok.
Chris: And so to build this for my system, I spent my budget on this,
Chris: I guess you could say, I guess, was $43.90. And that was 716.4 million tokens.
Chris: So it's not a cheap thing, but for me, $43, $45 to now to be able to audit JB
Chris: infrastructure on demand in a report style that I can share with you guys.
Wes: And a lot of that, I imagine, was the setup and tuning that would be amortized
Wes: over each individual scan, which would not be that much. And you can probably
Wes: drive with not the Premiere model.
Chris: 100%, because once you have the structure, Minimax is totally capable of handling
Chris: it, and I can basically run that forever.
Chris: um but yeah you you wanted you wanted something a little more advanced to build
Chris: out the structure and get this thing right and so some kimmy in there some grok in there,
Chris: probably oh yeah lots of deep seek lots of deep seek but deep seek's pretty
Chris: cheap that worked and then mine's all using podman containers that spin up and
Chris: then disappear when they're done and stuff like that um and then like with the
Chris: different levels of gating.
Wes: Oh that's fun.
Chris: Mm-hmm. Mm-hmm. Mm-hmm.
Brent: I'm curious, what's the next step then? Like, are you going to push this further
Brent: and look at all the boxes on the JB network? Are you going to put it aside for
Brent: a second until you reassess whether you put enough controls in?
Chris: I'm going to tweak the reporting a bit and the timeout issue a little bit so
Chris: I can get more information in the report.
Chris: But then what I think it's probably best to point at the boxes that are sort
Chris: of on the top of our list to retire and kind of just make a priority list based
Chris: on these findings and just sort of use that data to derive our decisions to
Chris: sort of shore up infrastructure.
Wes: Yeah, that and maybe whatever the few maximally exposed things are.
Chris: Yeah. And hopefully, you know, find stuff before we get to a point where this
Chris: stuff is getting widely exploited. And we, you know, we don't really want to
Chris: be in a position where once a week or every few days we're SSHing into these
Chris: boxes and updating them.
Brent: Right.
Chris: And if we do get to that point, we want to have a fleet that's lean enough that it's manageable.
Wes: And probably reset up in a declarative, repeatable way so that that becomes a more sane task.
Brent: Got a bunch of beautiful feedback this week, and we're going to start with Nathan.
Brent: Nathan says, literally just discovered this podcast, and you happen to mention
Brent: Trek, which has been my recent obsession.
Brent: I'm currently planning my honeymoon with it.
Chris: Oh, cool.
Brent: Oh, he means the tool.
Chris: Not the show. Yeah, not Star Trek. No. The collaborative road trip and travel planning.
Brent: Okay. I'm currently planning my honeymoon, congratulations, with it,
Brent: and it's been a dream compared to my normal spreadsheet slash calendar workflow for trips.
Brent: It comes with a built-in MCP, so I hooked it up to my LOM setup, and I've been doing,
Brent: some research that way to try and find some spots off the beaten path and working
Brent: them into the trip plan to include travel time, cluster locations,
Brent: proximity to our hotels.
Brent: It's a super polished app. I haven't tested out the collaborative features yet,
Brent: but they all seem quite promising.
Brent: figured I'd write in to give the Trek recommendation a plus one.
Brent: Now off to download the backlog of the show because, well, it seems super cool.
Chris: You know, you can plug on all kinds of like travel APIs to those agents as well.
Chris: There's all kinds of stuff with those.
Chris: You bring it all together with Trek. I think that's great.
Wes: I love how it's just like such a thoughtful thing to spend time crafting.
Chris: And thank you, Nathan. Glad you found the show. I'll take the next one.
Chris: Peter writes in, I just want to turn you guys on to TopGrade.
Chris: if you haven't heard of it yet. It updates all the things in one command so
Chris: you don't have to remember what you have installed. Super useful.
Chris: Upgrade all the things with top grade.
Chris: This may have been an agent pick on the show way back in the day. Um...
Chris: It doesn't support every distro, obviously, but it does support quite a few of them.
Wes: It also got the coveted Drew plus one behind the scenes.
Chris: Oh, did it? Uh-huh, yes, it did. Does he use it?
Wes: Yeah. Second this, top grade is super rad, says Drew.
Chris: That is nice. That's one of the things I like about the uBlue stack is they
Chris: have that uUpdate or whatever. I don't even know. It just runs.
Chris: And that updates all your packages and your flat packles.
Chris: You want to take that next one there, Mr.
Wes: P? Yeah, we got actually two messages from Magnus here.
Chris: Okay.
Wes: First one here. Hi, guys. thanks for the fantastic content universe you're providing
Wes: long-time listener and intermittent member i thought you might find this useful
Wes: yes this is completely shameless self-promotion,
Wes: paul hibbert even made a video on it and i thought maybe you guys would find
Wes: some exciting ways in using this,
Wes: home assistant tailored open code app super simple to start using and flexible
Wes: and it seems like it's sort of an open code that you add on to home assistant
Wes: and then you can sort of have it directly control Home Assistant just from the plug-in.
Chris: In open code.
Wes: Yeah so that fascinating it can drive everything.
Chris: I mean, that makes sense. Home Assistant has an extensive API and an MCP.
Chris: So it seems like that should be pretty doable. Very nice.
Wes: Yeah, it seems pretty clever. I haven't tried it. I've only checked it a little
Wes: bit here when I was gathering the feedback, but it's a smart idea,
Wes: especially if you don't already have any of that info set up,
Wes: but you want something to help you manage.
Chris: Before you get his next one, can I just say I'm surprised I haven't heard a lot of people talking.
Chris: Hermes 0.20 added conversational voice support.
Chris: So that evening, I set up an Anker USB-C speakerphone that has two microphones and a speaker.
Chris: And immediately, it outclasses anything the Alexa units or the HomePods or the
Chris: Google Homes have ever done.
Chris: And it ties in with my home assistant. And I can even say things like, play Magnum.
Chris: And it will activate the Apple TV. It'll launch the Infuse app.
Chris: It'll play the most recent episode of Magnum PI. And I don't have to even touch the remote.
Chris: and I can turn I control lights temperature it's way better,
Chris: than anything from any of the big tech companies and I don't see anybody talking
Chris: about it and I even like the thinking music I have thinking music uh when when
Chris: I when you like say hey you know hey Laura what's the weather uh,
Chris: he's pulling from my local weather station over home assistant and while he's
Chris: doing that I have a little thinking music that plays I like to do the thinking music.
Wes: I like that so you know what's going on uh magnus goes on listening to the backwards
Wes: episode where you dig into the old xeon server yeah you mentioned self-documenting
Wes: have you ever thought about running a sherpa type agent on your server's task
Wes: with keeping tabs on all the stuff running.
Chris: There.
Wes: The config containers mappings ports and proxies this could be posted as json
Wes: somewhere to keep a centralized documentation repo,
Wes: And once it's there, you could build dashboards from it.
Wes: And the best part, it could be a set and forget type feature,
Wes: just picking up on new stuff being set up or config that changes.
Chris: So unofficially, my agent data does sort of manage a lot of the important infra
Chris: and has a little index of everything, but that's just on my system.
Chris: So yeah, that would be something we should formalize. Hey, how about this?
Chris: Thank you, by the way. Appreciate that, Magnus. How about this?
Chris: Mike wrote in, you could try running and sharing this, And he links us to something called CBBS Pi.
Wes: A vintage CBBS style bulging board system emulator for macOS,
Wes: Linux, Docker, and the Raspberry Pi.
Chris: Something's happening here. I think we're going to have a BBS.
Wes: The energy is building.
Chris: The energy is building. I don't know if this is it.
Chris: I'm kind of, I hate to be this guy. I just can't even stand sitting at my Raspberry Pi anymore.
Chris: It just feels so archaic and slow. And like, it's just this weird platform that
Chris: I have to bend over just to get working right. And then like do weird twister
Chris: games versus like an x86 SBC that just, just works, dude. Like, I don't know.
Chris: I don't know. I'm having a hard time. I got too many pies and I'm having a hard time.
Chris: Bretton, you want to wrap us up with Ryan's email?
Brent: Ryan sent in a juicy one for the show.
Chris: Ooh. All right.
Brent: Not sure if you're still in the Apple or iOS ecosystem, but I just stumbled
Brent: upon the Mother Hen app in the Apple store.
Brent: It's written by Weston Bustron.
Brent: Why am I writing you to inform you about this? Well, it's a purpose-built chicken egg hen laying app.
Chris: Hey.
Brent: And it tracks when eggs are ready by the flock.
Chris: I mean, they just lay every morning. I don't understand.
Wes: I like this next bit.
Chris: Okay.
Brent: It's somewhat random, but I know you're the original Chicken Coop Home Assistant guy.
Brent: Thank you. So maybe it's worth checking it out as a $3 curiosity.
Brent: I'm kind of curious what kind of an app you could use for chickens,
Brent: as close as MQTT integration as you can get?
Chris: You know, I think close to this line of thinking, Ryan, is I need to be able
Chris: to take the camera feed I have of the chickens entering the roost box and coming
Chris: out and be able to track that. Because that's the real signal.
Chris: And like good little birdies, I'm so proud of them.
Chris: They're all laying in the nest box.
Chris: So far, they haven't laid anywhere else in the yard or in the run.
Chris: So stinking proud of these birds. But, you know, I'm still trying to figure
Chris: out which birds lay in the egg. So something like that, I think would be really good.
Brent: There's some interesting information in the app description here.
Chris: Okay.
Brent: I guess there's a couple different parts to the app. There's three parts.
Brent: There's the harvest tab, which is designed to be used on a daily basis.
Brent: So when you go out and find the latest batch of eggs waiting for you to collect,
Brent: you just like punch in some environmental factors such as light and stress and
Brent: how they can affect the egg production.
Brent: So by tracking all of that and the egg counts specifically, you can watch all
Brent: of the trends and make some informed decisions.
Chris: Okay.
Brent: There's also a flock tab for keeping tabs on the members of your flock.
Brent: I mean, you've named them all already, so that makes it pretty easy.
Brent: So if you're like the authors here, sometimes it's hard to keep track of who's
Brent: in the coop. So adding a picture or name goes a long way.
Brent: For the breeders out there, they added a family tree as well.
Brent: And there's a last tab here. It's the finances tab that gives you the ability
Brent: to see, if you particularly want to, just how much your feathered friends are
Brent: costing you in feed and other expenses.
Chris: Oh.
Brent: Or if you sell your eggs, how much money they're making you.
Wes: You just don't open that tab, it's fine.
Chris: One of the preview screenshots has my type of chicken in it. I love it.
Chris: You know, this is actually, the more I think about it, interesting because I
Chris: have particularly controlled the lighting and heating of the hen house to try
Chris: to maintain chicken egg production during the winter. It'd be interesting to
Chris: see if I can achieve that.
Brent: Is data controlling that again?
Chris: Well, that's all controlled by Home Assistant, Some potato does operate and
Chris: monitor that. That's really good stuff. I like that, Ryan. Thank you very much for sending that in.
Chris: There's some good stuff in there.
Chris: And we'll put a link if you have some chickens to the Mother Hen app.
Chris: And if you do have chickens, boost in and let us know. We want to hear about that.
Chris: Gentlemen, it is time for Le Boos, and let's start out with Ol' Bridie,
Chris: a.k.a. Kyron, coming in with a row of super McDucks.
Wes: Wow, that's mega McDucks?
Chris: Mega, mega ultra McDucks?
Brent: That's a whole flock.
Chris: 222,222 Satoshis.
Chris: Wow.
Brent: Incredible.
Chris: Amazing. That is really something. Thank you very, very much,
Chris: sir. We appreciate that baller boost. Hey, new member. Hey, hey,
Chris: hey. All right. Yes, yes.
Chris: Old time lurker. The web boost is the best thing yet. I have previously tried
Chris: Fountain, but the hassle of dealing with buying sets, it's just,
Chris: well, I like this edition.
Chris: It gives us normies a way to support without the eebie-jeebies. Thanks for all the fun.
Wes: That's the idea. Make it easy.
Chris: Just wait the one day that Fiat will give you the eebie-jeebies.
Chris: But in the meantime, we appreciate it very, very much. You know,
Chris: and he did it with ZapRite.
Chris: So he got the sats. So I'm impressed all around. However you want to do it,
Chris: man. We really appreciate it. And we thank you for being our baller.
Chris: And look at this. Another Mega McDuck. Lutris.
Wes: Lucitropy.
Chris: All right. Also coming in with a Mega McDuck.
Chris: 222,222 sats.
Chris: Wow. Thank you, sir. Thank you.
Wes: Yeah, sorry guys. Last couple of boosts through Fountain. Splits didn't go right for some reason.
Wes: Chris and JB got their splits, but the others didn't go through.
Wes: So here's a rectifier boost.
Chris: Keep up the good work.
Wes: You didn't have to do that, but thank you.
Brent: That's very sweet.
Chris: Thank you very much.
Brent: Well, we've got our Adversary 17 here with 54,321 sets.
Chris: All right.
Brent: I've gone to dial p get it plaid reversed oh i see because the episode was reversed
Brent: last week and so he's gotten also he's gotten clever with.
Chris: The numbers is what he's done there,
Chris: uh-huh it's.
Brent: Backwards i think he actually wanted that backwards.
Chris: Yeah yeah well.
Brent: Uh yeah i'm sure says I'll just escort myself out.
Chris: I kind of liked it. Thank you, Versaries. Appreciate that. The Incredible Mulk
Chris: comes in with 32,810 Satoshis.
Chris: Hey, another long-time listener Jupiter Party member. Yes!
Chris: Awesome. First-time booster. Thank you for all the hard work.
Chris: Especially on the last few shows. Here's some help to keep the lights on.
Chris: Thank you for the great content.
Chris: And also, it's a zip code boost, boys.
Wes: Ooh.
Brent: Danger.
Chris: Now, Wes, did you bring the...
Wes: I pack the map every week.
Chris: All right. All right. Let's look this up. I'm feeling like you're going to nail this one.
Wes: Yeah. I'm feeling Eastern time zone, I think.
Chris: Syncing it to the digital map for us. Okay. What do you got?
Wes: Oh. Orlando, Florida.
Chris: Ha ha. I knew it. I knew it. Hello, Orlando. Thank you for boosting in and for being a member, too.
Wes: We appreciate it.
Chris: Yeah. We do.
Wes: IRU comes in with 11,111 sats.
Wes: Now that the dust has settled, I've given BcacheFS a try.
Chris: Hey, good job.
Wes: I've set it up as the root FS with encryption and secure boot.
Wes: Mixing different drives and setting copies on a per file or directory basis,
Wes: I can choose to have copies equals one for redownloadable files while keeping
Wes: replicas on important data. A godsend in this economy.
Chris: No kidding.
Wes: Look at you getting clever.
Chris: I wouldn't mind a follow-up in a little while to know how it's going.
Chris: I mean, we're two years in on one of our systems running BcacheFS.
Chris: A couple of major upgrades in there. You're how many years in now on that sucker?
Wes: Two and a half, three.
Chris: Woo! And that system gets worked out.
Wes: It does.
Chris: Thank you, IRU. Appreciate you.
Brent: Well, Gene Bean sent a collection of Rosa Ducks and Leet Sats.
Brent: That's a total of 7,340 sats. Thanks, Gene. Let's go through them.
Brent: Number one, this episode was fun.
Wes: Well, we appreciate it. That's the goal.
Chris: We weren't sure if the Reverso episode would be horrible or not.
Wes: It confused us, so we couldn't tell.
Chris: Yeah, it was a surprisingly hard episode for us to do just because it took constant
Chris: mental effort to remember how to do the show backwards. It was silly.
Brent: It was like doing the math every each segment.
Chris: Nearly 13 years of doing it one way. It was awesome.
Wes: Yeah.
Brent: Note how we're not doing this episode backwards. Gene continues,
Brent: I really like local send. Yeah. So that's another plus one there.
Chris: Thanks, Gene.
Brent: I'm really interested to see where buzz goes. Sounds really great.
Brent: As a follow-up, it's a paid Slack that I want to connect an agent to.
Brent: This is a follow-up to a question from last week.
Chris: And then I like this one Brent why in God's name would you want 18 windows of
Chris: the same app how the heck do you find anything this is our point Gene.
Wes: You're making a presumption that he does find anything.
Chris: That's the thing Gene.
Brent: That's also quite a strong presumption I would say I have put in tools to try
Brent: to help myself here and it has not completely succeeded.
Wes: Okay maybe give us a follow up on that down the.
Chris: Line we're just gonna leave that one right there we'll do an episode at some
Chris: point A Dajabusan with 4,747 cents.
Wes: Every time I hear the break song, it scratches my show tune itch.
Chris: Oh, thank you.
Wes: But then replaces it with another itch of needing JB the musical.
Wes: You know, like those old sitcoms that would have a random musical episode.
Chris: JB the musical?
Brent: No.
Chris: I don't know about that. Maybe one day we'll put together an album.
Chris: I just, you know, if they're just, you know, I don't know. I guess, I don't know.
Brent: Send in your booths to vote for the album being released this year.
Chris: Yeah, I don't know about that. All right. Okay. All right. Maybe one day. Maybe one day.
Chris: I'm going to say Ensign Nginx. What do you think? Ensign Nginx?
Chris: Ensign Nginx. Oh, there you go.
Chris: Ensign Nginx comes in with a row of ducks, $2,222.
Chris: The Rust project leader has adopted an LLM policy that I completely agree with.
Chris: If we were to rely on LLM to write code, it will eventually become dependency,
Chris: and we risk not understanding what has been created.
Chris: So, did you read the Rust LLM policy?
Wes: I have not checked it out yet.
Chris: Neither have I.
Wes: But I will have to.
Chris: The people who review, yeah, I think it's the, I think it, I mean,
Chris: the high level here looks like you got to understand what you posted.
Chris: You got to be responsible for what you committed, that kind of stuff.
Chris: But I will try to read it after the show.
Wes: Yeah. Thanks for boosting in.
Chris: Yes. Thank you very much. I have that tab open now and I don't have crazy amounts of tabs.
Brent: Hey.
Chris: Well, I do have a lot of tabs actually. I do have quite a bit of tabs, but I have it open.
Wes: And probably a lot of them you can close after the show.
Chris: I will, but not that one.
Brent: Do you pin some of them?
Chris: I have a bunch of pin tabs.
Brent: I don't do that.
Chris: No you don't you definitely don't pin your tabs,
Chris: A Monday comes in with 19,941 Satoshis.
Chris: I would absolutely love a security camera deep dive. On the cusp of doing that
Chris: myself, just finally got a Reolink
Chris: doorbell cam and integrated into Home Assistant, and that's awesome.
Wes: Nicely done.
Chris: That's amazing. Also very much enjoyed the reverse episode. It was fun. P.S.
Wes: X5 for a zip code. Oh, okay.
Chris: Whoa, another zip code, and this one. Okay, so Wes, you got to do a little math.
Wes: Did I bring my calculator today?
Chris: So yes.
Wes: So multiplied by five, is that right?
Chris: I am very much considering going over my multi-frigate camera setup.
Chris: So if people have any questions and I get a few of those, I'll definitely do an episode on it.
Brent: Wes, I think you have to solve for X actually on this one.
Wes: Oh, well, I was just guessing. I thought.
Chris: That's not going to work, Wes. That's not going to. That's not going to.
Wes: Okay. So we had 19,941 multiplied by five.
Wes: That's 99,705.
Chris: Oh, that's a nice boost.
Wes: What I'm finding on my map, it's a little old, but it would seem to be the city of North Pole, Alaska.
Chris: Oh, really? Hello, Alaska.
Wes: Where the county of Fairbanks, North Star Borough.
Chris: I love that.
Brent: I have questions. It's not actually the North Pole, but they call themselves?
Brent: Can we get a history lesson?
Wes: Sure. You're right. We need to know more.
Chris: Night62 comes in with 12,000. Thank you for the boost. 12,345 sets.
Chris: Boost might not always be a clear indicator of a popular topic.
Chris: I often boost in just to say something, not because the episode sparked the
Chris: topic. I enjoyed the buzz episode. Being ahead of future trends is good.
Chris: Many of us are not vocal, but we trust your taste and enjoy quiet listening
Chris: and learning. Thanks. Well, that's always good signal to hear too, right?
Brent: Yeah.
Chris: Thank you. Appreciate that.
Brent: Keep doing what you're doing is what I heard.
Chris: Yeah, we appreciate that. You want to take MG there?
Brent: I'll take MG. GMG sends in a row of sticks, 11,111 sats.
Brent: That reverse episode was fun. By the way, I've boosted the previous three shows,
Brent: but I haven't heard those messages.
Chris: What?
Brent: I didn't say much other than appreciate you. So didn't need to make it into
Brent: the show. I just wanted to make sure you guys are getting the support you need.
Chris: If they're above 2,000 sats, they make it into the show. But if they're below
Chris: 2,000 sats, they will be included in the doc and we read them,
Chris: but we don't read them out loud on the air. That might have been it.
Wes: But if not, let us know.
Chris: Yes.
Wes: Because then something might be broken.
Chris: Thank you, MG. That did make it in. So we appreciate you.
Wes: Time for some Fiat boosts here.
Chris: Let's do it.
Wes: Yeah. Covered bridge cookies. A very old listener. 150 Fiat.
Brent: Wow.
Chris: All right.
Brent: Yahoo.
Chris: Covered Bridge Cookies, thank you very much.
Wes: I was there for Stallman, Dot Cloud, Matt's GTX 960, Bacon, and more.
Wes: You helped my IT career more than words convey.
Wes: I since nuked that, now I apply DevOps and FOSS principles to our co-op bakery.
Wes: Covered Bridge Cookies.
Wes: Coveredbridgecookies.com.
Chris: They look delicious.
Wes: Look at this, wow. That's so cool.
Chris: Coveredbridgecookies.com It looks like they probably do shipping too. Ginger Snaps.
Chris: All right. Oh, maple shortbread. What's going on here, Brent?
Brent: Oh, you got me.
Wes: Mind if we mail you free cookies?
Chris: No way, really?
Wes: That's what it says there. I mean, that sounds awful.
Brent: I don't think you should be doing that.
Chris: Yeah, we definitely wouldn't want a sampling of some of those delicious cookies.
Chris: The .cloud reference is deep and the GTX 960. Thank you very much.
Chris: That's amazing. Appreciate that.
Wes: Thanks for boosting in.
Brent: It's a slight zip code boost because at least the website says they're baked
Brent: in Vermont cool alright well the Sithy Penguin boosted well it didn't boost and fiat it in 10 fiats,
Brent: This is different from leaving voicemails to the launch. Also,
Brent: I'm going to need you to not do a reverse show again. I already questioned my
Brent: sanity. I don't need it coming from my favorite Linux podcast.
Brent: Just kidding. That was funny as hell.
Chris: I mean, it was a little tough on the sanity. Senior Smile comes in with $5.
Chris: Oops, I forgot my name on the Kubernetes and the kernels. Here,
Chris: have a fiver. All right. Thank you, Smile. Appreciate you.
Chris: We got a free member boost from Anonymous. they're back. Chris,
Chris: I think I heard you do have I think you had a farm with some chickens.
Chris: I'm not sure if it's worth mentioning. I've been working, assisted of course,
Chris: although I am a professional dev, on an egg farm tracking system.
Wes: What?
Chris: Check it out.
Brent: Two in one episode.
Chris: Cluckwork.
Wes: Oh, I like the name.
Chris: This is a thing people are doing, guys. Yeah, I definitely have chickens.
Wes: There's demand. A little short description. Poultry farm management.
Chris: Look at this thing.
Wes: C-sharp type script.
Chris: All right, I got another thing to check out after the show.
Wes: How about that?
Chris: That is really something right there. You mentioned needing a Slack export tool.
Chris: You might try out Slack dump, which we'll put a link in the show notes.
Chris: When the CNCF almost lost its free Slack instance, they recommended this project
Chris: to teams as a way to preserve history.
Chris: I didn't end up using it because Slack backpedaled and kept sponsoring the plans, but it does seem nice.
Chris: Jumping off of Wes's idea, I put a full ButterFS multi-node sync plus load balancer app scheduler.
Wes: I think this is the idea for what to put in the kernel if you could.
Chris: Oh, oh, oh, right. Oh, now this is clever. Actually, let's just pick a must-have
Chris: subset of Kubernetes and put it all. You know, I bet there's a lot of people
Chris: that wouldn't mind some Kubernetes in the kernel.
Chris: K-K-8. No, that's horrible.
Wes: K-8's in your kernel.
Chris: That's horrible. Thank you, Anonymous. Nice to hear from you.
Wes: Paul Mumbabusin to say, back again.
Chris: Hello, Paul.
Wes: Wanted to make it clear that for audiobooks, I mostly buy them digitally from Libro.fm.
Chris: Good one.
Wes: I use their subscription to get a credit every month, which I can use to buy
Wes: an audiobook. you can use their app or download the DRM free mp3 or m4b.
Chris: Yeah that's a good one we should mention Libro FM so thank you for audiobooks.
Wes: Are also way cheaper this way.
Chris: I love audiobooks too for road trips I stack up audiobooks and podcasts unless
Chris: I'm driving with peeps and then these days I'm just going to make West Beat DJ,
Chris: however if you have music assistant you can actually just have your agent create
Chris: playlist for you so that's what I've been doing recently.
Brent: Night 62, member boosted in. Can I get a few more characters in these here? Web boost.
Brent: If not, is it permissible to add a pastebin link or something like that?
Brent: I don't really want to chunk up my comments or split them across multiple boosts.
Brent: I don't need to write a book. But even AI is having trouble reducing my thoughts to 300 characters.
Chris: You can always send us a boost and refer to an email. That's true.
Chris: The thing is, we do try to keep these moving. So that's why the length is an
Chris: issue. there, but you could always email it and let us know.
Chris: All right, Papa John comes in with a member boost. I think the anonymous members
Chris: assume their name will come through when they sign in with Memberful,
Chris: so they don't fill out their username field. Great show, guys.
Chris: Yeah, I don't know if I can bring that in without some additional approval,
Chris: but I do think maybe that is a thing. Good catch, Papa John.
Wes: Space Warlock comes in. The Reverso format wasn't for me.
Chris: I understand.
Wes: It wasn't bad content-wise. It felt like change for the sake of change rather than positive impact.
Wes: I like the idea of a SSH in the kernel. I can see a use for it.
Chris: I think it was, was it Brent's idea? How did it come up? It came up.
Brent: Are you blaming me now? Yeah. It came up from like, we were having a discussion
Brent: somehow of, on a topic and then it just sort of popped in my head. So I will take the blame.
Brent: And then we tried it. And I, it was surprisingly difficult to be honest.
Chris: It might be good. It might've been a good exercise for us to do just to put
Chris: us out of our comfort zone and push it a little bit.
Wes: Thank you for your patience.
Chris: Adversary 17's back with a member boost love the reverse episode i think it
Chris: broke all your brains a little except chris which just straight up broke entirely
Chris: i it was bad it was bad momentum thank you adversaries appreciate you.
Wes: Mohan comes in to say this episode started off with outro and ended with the intro it was backwards.
Chris: Yeah it was all leading up to that observation it was all.
Brent: Well, Gene Bean sent in a member's booth saying, give this a read.
Brent: Open Claw with Clawed Opus 4.6. Hacked a gym.
Chris: Oh, yeah. I heard about this. Yeah. Well, he found like the schedule.
Chris: He found like a way to kick people off the reservation list and bump their operator
Chris: up on the reservation list.
Wes: Those reservation systems are often not really well controlled at all.
Chris: Yeah. It's just beginning. Clanker versus clanker. Tell you what.
Chris: All right. Thank you, everybody who supported the show. When you hear a dynamic
Chris: ad, you know, that means we didn't make an ad deal. That means we're barely,
Chris: barely, barely, barely getting by. And if it wasn't for our members and our
Chris: boosters, we just wouldn't be making it.
Chris: And I want to say thank you to everybody who also streamed stats.
Chris: We didn't get as many this last episode for some reason.
Chris: Twelve of you streamed stats, and collectively you stacked 11,789 Satoshis.
Wes: Sometimes you're too confused to stream, and that's our fault.
Chris: That might happen, yeah. Maybe the stats stream reversed that episode and went to them. Who knows?
Chris: When you bring that together with our fiat boosts, and if we just price them
Chris: at the current stats value.
Chris: That brings our total for this episode, it's pretty great, to 847,041 satoshis.
Chris: Thank you, everybody who supported the show with a membership or a boost.
Chris: Boost.JupiterBroadcasting.com.
Chris: You know, we might even be at the 13-year mark, and it just feels like in so
Chris: many ways a massive future ahead of the show and so much we can dig into and
Chris: new shows we could launch and all kinds of stuff.
Chris: So we really do appreciate the support. Even if the ad market doesn't think
Chris: a little old Linux podcast is worth supporting, we appreciate that you do,
Chris: and you keep us going. And it means the world to us. It's all the difference.
Chris: All right, we got a couple of picks, as we do. I was surprised to see that you picked iDescriptor.
Wes: Well, I picked it for you. Because I know you have some iDevices around.
Chris: I do have some iDevices around.
Wes: So I thought maybe you would like an AGPL 3.0 free open source cross-platform
Wes: iDevice management tool. And it just stood out because it's not all the time
Wes: that things like this run on Linux.
Chris: That is true. And also, it's cross-platform. So if you're on Windows,
Chris: you could do that. It's developed with Qt and...
Chris: A little bit of rust.
Wes: Oh, look at that. And C++, look at that.
Chris: Too. I guess I would say if you're familiar with iPhone management that you
Chris: used to get on Macs for a while that was built into iTunes and then later built
Chris: into Finder, it's kind of like that.
Chris: You get the information about your iPhone, the storage information.
Chris: You can browse the files, the apps that are on there, and you can do it over USB or Wi-Fi.
Wes: It has AirPlay. Wow.
Chris: Yeah. iDispatcher. iDispatcher. It really is the missing piece of iPhone management.
Chris: If you like to do this kind of stuff from the desktop, I think it's really cool.
Chris: Also, if you go the jailbroken route, it also gives you a few extra options.
Chris: If you did that kind of thing. iDescriptor, yeah. And like you said, it's AGPL 3.0.
Chris: All right, boys. Now, I would like to present you something that I think is
Chris: particularly interesting. And Brentley.
Chris: This might be worth the consideration of a pivot if i were not two three years
Chris: however long four years into obsidian i may consider kiwi fs,
Chris: and so i want to mention it and i'd also like to know if anybody could take
Chris: a peek at it and tell us if it's something we should review kiwi fs is a searchable
Chris: structured version markdown system,
Chris: and you can plug an agent into it in 30 seconds KiwiFS makes Markdown files
Chris: writeable, searchable, queryable, versioned, and human readable.
Chris: They are the source of truth, and everything else is a derivative index of your
Chris: Markdown files that you can build.
Chris: And KiwiFS basically becomes a file system and a wiki for your AI agents as well.
Chris: AI agents can read and write the same knowledge base humans use.
Chris: You can use an MCP, an API, WebDAV, Fuse, all kinds of options.
Chris: It's Obsidian-style Markdown knowledge management but designed to be shared
Chris: with agents and automation. It's self-hostable. It's a single Go binary.
Chris: And they pitch it as a Markdown file system for you and your agents working together.
Brent: Huh.
Chris: And I've thought about this, too. Like, say you get a document,
Chris: say you get like a PDF for the van or you get a receipt like you want to be
Chris: able to just give it to the agent. And then two years later,
Chris: say, hey, I need that receipt from O'Reilly's that was in August of 2026. Right.
Chris: That's what I want. And that's what this is. This is that's one of the things
Chris: along with notes, because it uses three tiers of indexing. So it can be really light.
Chris: You can just use grep. Then you can graduate up to something that's called like
Chris: the BM25 algorithm. You might know more. I don't know what. And then you can also go to vector.
Wes: Yep. Full text plus vector. And then you can kind of have it combined across
Wes: different methods to sort of do a ranked final delivery.
Chris: And you can have a pretty advanced backend that's using object storage and NFS and all this stuff.
Wes: Get versioning built in. I like that.
Chris: Yeah. Yeah, so I think if I hadn't gone down the Obsidian path,
Chris: I'd probably have deployed this this week.
Wes: The other thing that is nice to see is they clearly have a concept of importers
Wes: because they say they have 19 data importers, including Pay,
Wes: Postgres, Notions, Obsidian, CSV, which perhaps also tells you you could wire in your own converter.
Wes: There's an interface for it. It's set up to have multiple of those already, which could be handy.
Chris: I like the versioning built in. That's really nice. The search stuff looks really
Chris: good. The MCP, a lot of these things have that now, but they built that from the very beginning.
Chris: Yeah, I don't know. I mean, I think KiwiFS looks really good.
Chris: I don't know if it's worth replacing something you already have.
Chris: It also could be a bit of a memory system for your agent. So you and your agents
Chris: are kind of working from the same memory system. Think about that for a moment. And it's...
Brent: How did...
Brent: How did you know I was, like, diving into these tools and I wasn't happy with
Brent: anything that I've been finding recently?
Wes: Because you've been doing that since we met you?
Brent: Yeah, that's true.
Chris: That's true. That's true, yeah. The project is new, I should warn you.
Chris: It is new. It started in April of 2026, but it's already, I mean,
Chris: it's got 600 GitHub stars. It's under Active Contributors in Development.
Chris: They've really got, they've moved something. They got something quick, so.
Wes: It is apparently a business source license.
Chris: Yeah.
Wes: So it's free to use, self-host, and modify. the only restriction you can't offer
Wes: QEFS as a commercial hosted service.
Chris: Right.
Wes: Each release does convert to Apache 2 after four years.
Chris: Oh, interesting.
Wes: Just know that going on if you are going to use it.
Chris: Okay. See, there's a lot to like, right? And Markdown is always the source of truth.
Brent: I've been looking at, um, well, many of the suggestions from listeners recently,
Brent: but, uh, Joplin made it into my list as well.
Brent: And they have, uh, seemingly quite, um, you said you're shaking your head,
Brent: but I, I, I'm only mentioning it. I'm not using it.
Chris: It's just, I've been down the same path too. I've been, it's like.
Brent: And I was thinking you would say that exactly.
Chris: The reason.
Brent: I bring it up is only because they seem to have a.
Chris: Lot of like.
Brent: Some of the agent tools as well.
Chris: So it's curious.
Brent: To see these note-taking apps go in that.
Chris: Direction you're either going to fall back from you're either going to fall
Chris: back to obsidian or you're going to try to give qo notes an earnest try that's
Chris: your next no i did that a long time i'm never no you'll you'll think about it
Chris: you'll be like actually no no no qo notes is just the way i should go here.
Wes: We go uh he's a big git guy.
Chris: Right well so brian.
Wes: In matrix is saying i've just been using my forgeo repo to store all my documentation for my agents.
Chris: There you go simple although you know if it ever gets too big that you know
Chris: there it would be nice to be able to vector that or something like that all
Chris: right you know what we do we put links to all this stuff linuxunplugged.com slash 680,
Chris: and then there's the whole network over jupiterbroadcasting.com as long as that
Chris: uh It steals on going. You can find the links over there for all the other shows.
Wes: Yeah, the incredible community-powered website.
Chris: Where are they going? Nowhere? As far as I know. Yeah, that is true.
Chris: That is still a great community-powered website.
Chris: And, of course, we've got boost.jupiterbroadcasting.com as well.
Chris: So here's the thing. If you want to really have some fun, you've got to show
Chris: up on a Sunday. You make it a Tuesday on a Sunday. You hang out with the boys.
Chris: You listen to or watch a little Linux Unplugged live.
Chris: Sundays, 10 a.m. Pacific, 1 p.m. Eastern, your time at jibiterbroadcasting.com
Chris: slash calendar. Now, for the download itself, in your RSS feed, we got some extra stuff.
Wes: We do, including, you're familiar with the MP3?
Chris: Yeah.
Wes: We provide an upgraded MP4.
Chris: You mean there's one extra MP? In the feed?
Wes: That's right, yes.
Chris: Just sitting there in the feed?
Wes: Right in the feed.
Chris: Wow.
Wes: Right next to the e-transcription files.
Chris: What?
Wes: Including, you know, ones that say who's talking to who.
Chris: Do you have any kind of, like, structured data my agent could use?
Wes: Oh, yeah. Like a JSON file that has cloud chapters in it.
Chris: Maybe you have years worth of episodes that have all of that.
Wes: Yeah, not every episode, and different ones got different parts at different times.
Chris: Getting better and better.
Wes: Getting better and richer all the time.
Chris: There you have it. All right. Thank you very much. I could tell you more.
Chris: I'll just leave it with this. Thank you to our mumble room for hanging out with
Chris: us. Thank you to the folks in the live chat, our members, our boosters,
Chris: and thank you for downloading and listening to this episode.
Chris: And I don't say it enough, but for those of you who have been listening for
Chris: a long time, we deeply appreciate you. We really do.
Chris: Thank you for hanging with us through all the ups and downs and changes.
Chris: Well, it's all ups, of course. Through all the ups and ups.
Wes: The ups and slightly less ups.
Chris: Yeah, that's it right there. Thank you.
Chris: And also, thank you for joining us on this particular episode.
Chris: And we'll see you back here for next week's particular episode,
Chris: which will not be in reverse, all right? We're done with that.
Chris: It's going to be in regular order. We'll see you next week.