Untitled Linux Show 265 Transcript

Please be advised that this transcript is AI-generated and may not be word-for-word. Time codes refer to the approximate times in the ad-free version of the show.

Jonathan Bennett [00:00:00]:
This week we're talking about AI at GCC and ShadowFetch Linux. And then there's that unfortunate story of the international traveler that wiped his phone under duress and is now facing charges because of it. AUR maybe finally has their malware problem under control. There's something that comes after X, hint, it's Y, and a whole lot more. You don't want to miss it. So stay tuned.

Jonathan Bennett [00:00:36]:
This is the Untitled Linux Show, episode 265, recorded on Saturday, August 1st: Malicious From the Beginning. Hey everybody, it is Saturday and it's time to talk Linux. It's the Untitled Linux Show. I'm your host, Jonathan Bennett. And today we've got some fun, some craziness, some wild stories to talk about. It is not just me, though. We've got the crew, the regulars.

Jonathan Bennett [00:01:01]:
We've got Rob and Jeff and Ken. And we've got some stories to tell. Up first, Rob is going to take it away and talk about one of Rob's favorite things to talk about. He talks about this almost every time he's on the show. That's compilers.

Ken McDonald [00:01:19]:
Oh.

Rob Campbell [00:01:21]:
You're all wrong. That's not at all what I was talking about. A lot of what I talk about— Is the result of compilers.

Jonathan Bennett [00:01:28]:
We were both trying for the joke. We went 2 different directions. That was perfect, Jeff. I don't know if we could have planned it any better. Rob, we're talking about GCC and AI again. What's new in that corner of the world?

Rob Campbell [00:01:40]:
AI is what you really meant to say. So a lot of open source projects are trying to decide, obviously, whether artificial intelligence fits into software development. The news story seems to be popping up every week because I keep bringing it to you every week. Obviously, I can't help it. I just call it as I see it. So, you know, yeah, some projects are taking a hard line against it. Others allow AI-generated code as long as a human reviews it, understands it, accepts it, is responsible for it. Normally, as you know, I fall strongly into that second group.

Rob Campbell [00:02:21]:
I'm not a fan of banning AI simply because someone does not like the technology. AI is a tool, and refusing to use better tools is not how technologies or anything moves forward. But there are some places where being more cautious makes sense. And GCC, the compiler, the GNU something compiler, is not just another application. And I guess I have my notes right here. It's the GNU Compiler Collection. That's what it stands for.

Ken McDonald [00:02:55]:
Yeah.

Rob Campbell [00:02:57]:
is used to compile an enormous amount of the software running on Linux and other systems. And so a mistake introduced into a compiler could potentially affect far more than, you know, just one program. You know, it's not just that one program that you're putting the code in. It could be wide-ranging. And that brings us to the GCC Steering Committee's new AI policy. GCC will now reject legally significant contributions containing code generated by or derived from a large language model. Smaller contributions may still be accepted when clearly marked and AI-generated test cases are specifically allowed. Contributors can also continue using AI for research, debugging, bug discovery and code review.

Rob Campbell [00:03:54]:
Any accepted AI-generated content must include an assisted by tag, and a human must understand and take responsibility for the change. That is, that's an important distinction. You know, GCC is not banning people from using AI altogether. It is placing limits on directly contributing AI-generated code, largely because of unanswered ownership and copyright questions. And, you know, honestly, I'm kind of okay with that. You know, with something as foundational as a compiler, there needs to be some clear chain of ownership and accountability. Uh, you know, the person submitting the code needs to understand exactly what it does and be able to prove they have the right to contribute it. My one major exception would be a security vulnerability.

Rob Campbell [00:04:54]:
And maybe this isn't necessarily against their policy at all, depending on how it plays out. But if AI helps someone discover and fix a security vulnerability, you know, I think the project should not leave users exposed simply because AI was involved in producing the patch. That does not mean blindly merging it. The code should still receive a complete human review and yada yada, etc. But security kind of needs to come first. You know, that's probably a huge part of the reason why they're putting this policy in place. You know, a reasonable AI policy should protect the project from questionable code without preventing a crucial, critical vulnerability from being expressed. So, you know, this is one that for the most part I kind of agree with.

Rob Campbell [00:05:43]:
So what'd be really awesome now is if Jonathan takes the opposite view and doesn't agree with it.

Jonathan Bennett [00:05:52]:
Oh, let's see quickly. I got to tune up the opposite view. Um, no, I actually thought it was a little, a little too restrictive, honestly. Um, too restrictive? A little bit.

Ken McDonald [00:06:03]:
Yeah.

Jonathan Bennett [00:06:04]:
So essentially what this is saying is that if you have more than 12 lines of changes and you used AI to write them, then it gets tossed out. And like compilers are some of the really fiddly programs. I suspect that AI is going to be really good at doing compiler work just based on the things that I've seen, particularly like having AI in the loop to help you test the results of your compiling because it's really good at doing that. It's good at that fiddly binary stuff. And I would actually think that GCC is one of the places where it would maybe make a lot of sense to put the AI to work. So I think maybe it's a little over-restrictive.

Rob Campbell [00:06:42]:
Well, there's always Clang.

Jonathan Bennett [00:06:45]:
I would suspect that Clang is going to have a more AI-friendly policy.

Jeff Massie [00:06:51]:
You know, I really like the kind of middle ground of you can use AI, but you need to be able to understand and defend the code.

Rob Campbell [00:06:59]:
yourself.

Jeff Massie [00:06:59]:
So you've at least, you know, maybe AI wrote it, but you know what it wrote.

Jonathan Bennett [00:07:08]:
Yeah, I would agree. That's where I come at it. You need to have at least put your eyeballs on the code. And if I ask you a question about how it works, you need to have a clue.

Jeff Massie [00:07:17]:
Yeah.

Jonathan Bennett [00:07:17]:
That's sort of the basics to be able to get something done.

Ken McDonald [00:07:21]:
From Saurabh's article, it sounds like they are willing to accept Except AI-generated code that's outside the— basically imported from other projects.

Jonathan Bennett [00:07:38]:
Yeah. And there's also a mention that if it's something inside the test suite, they are more open to it being AI-generated as opposed to the GCC proper. We shall see. I don't know if this is going to last long-term or if this is just a stepping stone for them. There was commentary that like— I think it'll change. Yeah, there's commentary that in like 2027, um, that changes are going to happen. Um, they're going to revisit the policy, I think is what they said. So wouldn't surprise me if, well, I mean, in 2027, the AI is going to either, either the bubble will have completely burst and we're all back to writing code by hand again, or the AIs are going to be so much better that it's not even going to be a question of whether or not you would accept it.

Rob Campbell [00:08:21]:
I think the trend that we're going—

Ken McDonald [00:08:22]:
Throw a third option in there.

Jonathan Bennett [00:08:25]:
Okay.

Ken McDonald [00:08:25]:
And that is that it's going to be so expensive that the average person can't afford it anyways.

Jonathan Bennett [00:08:32]:
I mean, that's kind of the bubble has burst scenario, really.

Jeff Massie [00:08:36]:
You know, I don't think so.

Rob Campbell [00:08:38]:
That's been my— that's why I've said for a while, but I'm starting to kind of think differently about that. I actually think costs are going to come down in the back end and make it that we could still afford it.

Ken McDonald [00:08:51]:
Well, later in the show, I think I'll talk about a free alternative that some people, in fact, I think that'll be coming up next, won't it?

Jonathan Bennett [00:09:00]:
It might be. I will say this, that like, I don't think AI is going away, if only because you can run it on your own machine. Not quite the same crazy same models that they run in the data center, but a reasonably powerful laptop with an APU, you can run local inference and it will do useful things. So like, it's— the bubble may burst to some extent, but it's not going away.

Jeff Massie [00:09:24]:
It's, it's going to have a little air let out of it because I see there's going to be 2 forks in AI. You're going to have the LLMs for the, you know, Geminis when you're searching the internet and things like that. I think they're going to stick around, but a lot of like, say, the coding and stuff is all going to go to agents, and a lot of that stuff you're going to run locally from You know, all the information, the open source models that are already out there.

Ken McDonald [00:09:50]:
Right, right.

Jeff Massie [00:09:51]:
And then, because when you think about, all right, I've got this for coding, I don't care that it doesn't need to know about the Roman Empire. Well, okay, you can cut a lot of things out and just focus on that, run it locally, and you're going to be fine. And then the enterprise is where some of that will be you know, they'll still be paying those higher prices and be able to justify it.

Rob Campbell [00:10:16]:
Yeah.

Ken McDonald [00:10:16]:
So with running AI locally, anybody got any suggestions on how to do that?

Jonathan Bennett [00:10:25]:
We talked about it several times here. You can get Hugging Face and get— I would start with Hugging Face is one of the best places to go to.

Rob Campbell [00:10:33]:
Well, the one that ChatGPT hacked into?

Jonathan Bennett [00:10:37]:
Yeah, probably. I mean, if that's the one that ChatGPT targeted, then that's a pretty resounding recommendation for it, don't you think?

Jeff Massie [00:10:46]:
And attempting to totally ignore Ken's self-segue, which we've already discussed, Ken, not allowed, not allowed. A couple of weeks ago, a few weeks ago, I talked about whichllm as a command line tip, and it evaluates your hardware and tells you what models would be best to run.

Ken McDonald [00:11:03]:
Yep.

Jeff Massie [00:11:03]:
And then it gives you a—

Rob Campbell [00:11:04]:
Jeff has a good suggestion for you. There you go.

Jonathan Bennett [00:11:08]:
Yeah.

Rob Campbell [00:11:09]:
Now we can just skip that story.

Jonathan Bennett [00:11:11]:
And then of course, you know, it's hard to get one of those set up on your own machine. If only there was some tool where you could ask questions about like, how do I make this work on my own machine? I wonder what Claude would tell you. I'm sure Claude would just do it because that's what Claude does. Here, help me set a local AI up so I don't ever have to talk to you again.

Rob Campbell [00:11:29]:
I've actually asked one AI how I should prompt or do something on another one while I was having a problem on another one or how to set various things up and they don't care.

Jonathan Bennett [00:11:39]:
Well, of course, I think they're incapable of caring, right?

Jeff Massie [00:11:43]:
It's great when they disagree and then you feed the output of one into the other and you let them fight it out.

Ken McDonald [00:11:47]:
Yes.

Rob Campbell [00:11:47]:
I've done that. I've done that. I'm like, well, Claude says this.

Jonathan Bennett [00:11:53]:
It would be fun to write some tooling to let them do that automatically so that you could just, you no longer have to be the meat Puppet in between.

Rob Campbell [00:12:02]:
Tokens.

Ken McDonald [00:12:03]:
I thought I heard in the, uh, I'm trying to think of the, uh, AI, uh, users group that they did Friday, that they've actually— somebody's actually done that.

Jonathan Bennett [00:12:17]:
Oh, I'm sure, I'm sure. Probably using a— probably vibe coded the whole thing using AI to help write it too, because that's the world we live in.

Rob Campbell [00:12:24]:
You make sure you put a cap on the price, on how much you're going to spend on those tokens though, because if those two are just talking to each other, they can go wild. Absolutely.

Ken McDonald [00:12:32]:
That's where you need 2 local machines to talk to each other.

Jonathan Bennett [00:12:36]:
All right, Ken, tell us about local machines. He's been trying the whole time.

Ken McDonald [00:12:46]:
Actually, I'm not going to tell you about local machines themselves. I'm going to tell you what Linux distribution Bobby Borsalf wrote about that might work for you as for a That since it's a distro built around local AI, it's called ShadowFetch Linux. And it is a Debian testing base distro featuring the KDE Plasma 6.6 desktop, putting locally running AI at the center of its desktop experience. The ShadowFetch developers add their own desktop configuration. graphical installer, first boot wizard, networking defaults, recovery tools, creative software collection, and local AI environment on top of Debian. In fact, all security updates and about 99% of the Shadowfetch Linux package archive come directly from upstream Debian. Shadowfetch makes the AI focus immediately visible by including its own assistant. This assistant examines the system's hardware and recommends a local model suitable for the available memory and graphics capabilities.

Ken McDonald [00:14:06]:
The ShadowFetch AI package can then install the recommended model together with a locally hosted web-based chat interface. The project's goal is to make running an AI model Locally much easier than manually choosing a model, installing a runtime, configuring a web interface, and checking if the computer can handle everything. ShadowFetch limits— well, ShadowFetch Linux provides tools for running autonomous AI agents directly on the computer. Now Bobby's article lists several support options that can be installed via dedicated ShadowFetch packages rather than assembled manually from their individual components. And ShadowFix Linux is also presented as a ready-made creative workstation that includes GIMP, Krita, Inkscape, and Scribus for graphics and publishing, along with Darktable, RawTherapee, and digiKam for photography in its default software collection. The distro also includes Ardour, Audacity, Hydrogen, Kdenlive, Shotcut, and OBS Studio for audio and video work. If you do 3D creation, engineering, and color management, then there is Blender, FreeCAD, OpenSCAD, Argyle CMS, DisplayCal, and ColorD. Now, Bobby's article gives more details about ShadowFix limits.

Ken McDonald [00:15:47]:
And with some of the software that it comes, it sounds like it's being set up so you could use it to do the full gamut, create your own podcast with AI.

Jonathan Bennett [00:15:58]:
Oh, that's just what the world needs. AI podcasts. Yes.

Ken McDonald [00:16:02]:
It's already got them. I know.

Jonathan Bennett [00:16:05]:
I've seen those stories. It's like we can create 1,000 podcasts in a day.

Ken McDonald [00:16:11]:
Great.

Jonathan Bennett [00:16:11]:
This is what we need.

Ken McDonald [00:16:12]:
And how many tokens did that take?

Jonathan Bennett [00:16:15]:
Too many.

Jeff Massie [00:16:17]:
Well, I thought it was like us. We're AI. Awful lot of intelligence.

Rob Campbell [00:16:23]:
All intelligence.

Jonathan Bennett [00:16:24]:
I won't tell you some of the other acronyms I've heard for what AI stands for, but some of them are quite funny. Some of them are real in some cases too. There was a startup back a couple of years ago that claimed that they had AI coding apps for you. And turns out that no, no, their AI stood for actually Indians. And it was just a company in India where the poor workers in a software sweatshop is actually programming.

Ken McDonald [00:16:52]:
I think we're getting it wrong. That's not a capital I.

Jonathan Bennett [00:16:56]:
It's AL. It's all AL. Yeah.

Rob Campbell [00:17:00]:
Artificial license. I don't know.

Jonathan Bennett [00:17:03]:
Artificial learning? I don't know.

Rob Campbell [00:17:05]:
Learning. That actually fits.

Ken McDonald [00:17:07]:
Artful.

Jeff Massie [00:17:09]:
Artificial ingredients.

Ken McDonald [00:17:10]:
Hmm.

Jonathan Bennett [00:17:12]:
Lots of show titles there too. All right. We're going to take a quick break and then we're going to come back and I'm going to talk about probably the most disturbing story I've read in a while when it comes to technology and your rights. So we're going to dive into that right after this. All right. So this story is about an activist at an airport, specifically an airport flying back into the United States. And those of you out there that are familiar with the way that our legal system works right now or have heard horror stories, uh, sort of know the, the style of direction that this story is going to go. Uh, but there's a very interesting technology twist on it.

Jonathan Bennett [00:17:56]:
And so this, this happened. A gentleman's name was Samuel Tunick. And this all actually happened back in 2025. And Sam flew back into the United States from being overseas and was detained by security forces. I don't remember if it was TSA or Border Patrol or which, you know, what was a law enforcement agency detained him at the airport getting through reentry security. And, uh, that is actually fairly important because— and I don't want to make this an extremely political story, but we're going to have to a little bit— um, because when you're entering the United States, you have a different set of rights than you do as a citizen of the United States inside, which personally my opinion is that that's incorrect. I'll put it nicely like that. That is wrong, and that's not the way that that should work.

Jonathan Bennett [00:18:57]:
Just if you want, just imagine the, the rant that should go here and just sort of mentally put it there. I'm going to move on. Um, he was in the midst of this, and he was being looked at for— I believe they said that they suspected, um, CSAM, child sexual abuse material. Uh, It turns out that that's probably not what they actually suspected him of, but that was the sort of the excuse that was used. And they wanted access to his cell phone, which he had with him. And law enforcement that he was talking with was going to try to force him to unlock the phone, essentially. And so they made this— they made the statement several times, you're going to have to unlock the phone. And he said, no, I want my lawyer.

Jonathan Bennett [00:19:44]:
Am I being detained? You know, the normal things that you sometimes say when you're, you know, you think you're about to be arrested. Um, it didn't matter because again, he was in this weird legal limbo of coming back into the United States. And he finally gave them a password to his phone. It turns out that he was running GrapheneOS, which is a spin, a custom spin of Android that has some interesting features on it. One of those features being a duress password. You punch the duress password in and it wipes your phone. And that was the password that he gave them. And so at the time they realized what happened, they kept the phone and they sent him on his way.

Rob Campbell [00:20:28]:
He got to leave.

Jonathan Bennett [00:20:31]:
Recently, he has been charged with a crime, the crime of not tampering with evidence, but attempting to destroy evidence. Right. I'm trying to remember the exact term that they used. Knowingly destroy or damage property to prevent it from being seized. That's the law that he's being charged under. And so they are in the middle now of a court case around this, and he is being charged with this crime. He probably was targeted because of his involvement with a— in Atlanta, in Georgia, in the city of Atlanta, there is an activism group that is— they're trying to prevent a police training facility often known as Cop City, the Ars Technica article says. And on his way back, they nabbed him for suspected terrorism activities.

Jonathan Bennett [00:21:41]:
So there's a whole lot here. I don't want to unpack all of this. Some of this is just totally outside of the scope of what I want to talk about. The really interesting things here are the technology things. And so they, in covering this, so I've got an article here from Ars Technica and an article from CNET. I think the Ars Technica article, they actually talked with some folks from the Electronic Frontier Foundation. And the EFF guys say, first off, this particular law has never been applied this way before. And so there's a very real chance that the court is going to throw this out.

Jonathan Bennett [00:22:19]:
The other side of this is, don't do this. This is not the way to handle this. So like, I am telling you guys, don't do this. This is not the way to handle this. The Better way to handle this, if you're running a phone that has a decent full disk encryption setup on it, turn your phone off before you go through security. Turn your phone completely off before you go into this area where it could be seized. And just do not turn it back on and do not put the password in until you get to the other side. And essentially, a decent security system, particularly Apple, I hate to say it, but Apple's better at this than Android is.

Jonathan Bennett [00:23:05]:
If it's from the powered-off state, from what I have been told, even the cutting-edge techniques will not be able to unlock it and decrypt it. So that would be the way to handle it. And don't do the wipe because that could land you in some legal hot water. I think, in my opinion, the fact that the government is trying to go after him for wiping his own phone, particularly when he was not under arrest, he was merely being talked to, I think is legally a problem. Legally, ethically, morally, it's a problem. But personally, I see the larger problem as this idea that the government has that when you're reentering the country, you don't get your rights as a US citizen until you've passed through border security. And that That offends me in multiple ways pretty deeply. But again, that is as deep into the political waters as I want to go.

Jonathan Bennett [00:24:01]:
I think there's also the interesting technology story here as well. And Rob got so offended that he left and now he's come back. What do you guys think about this?

Ken McDonald [00:24:13]:
Boy, I wonder how a congressman would feel if he was treated that way coming back in from visiting deployed troops.

Jeff Massie [00:24:22]:
Yeah, yeah. And there's so much legally to untangle here. Like, yeah, you know, for example, on your phone, the cops can take your— now this applies to citizens— they can take your fingerprints, they can open your phone with your face, but they are not allowed to force you to tell your PIN because what you are they can take, but what you know falls under the Fifth Amendment. So, I mean, there's that. But then, like you said, you're not, even though you're a citizen, you're not really a citizen until you get back in. I mean, it's, man, there's a lot to unpack here, but I, yeah.

Jonathan Bennett [00:25:00]:
I mean, best case scenario, this will go to the Supreme Court and they will knock that idea down.

Rob Campbell [00:25:07]:
So politically, this is wild. Quite the story. This is not a political show.

Jonathan Bennett [00:25:13]:
Indeed.

Rob Campbell [00:25:13]:
But I got to say, that feature sounds pretty awesome. Even if it's not a good idea to use it.

Ken McDonald [00:25:19]:
Well, if you're under duress, then definitely use it.

Jonathan Bennett [00:25:24]:
So, I mean, it's not, it's not, they're not the first ones to have that.

Ken McDonald [00:25:27]:
You're going to give them the duress code.

Jonathan Bennett [00:25:31]:
That's an interesting idea.

Ken McDonald [00:25:35]:
Since I am under duress, this is the code I'm going to give you.

Jonathan Bennett [00:25:38]:
So that is an interesting idea, Ken. I would say anyone out there that like seriously thinks you're going to get into this sort of a problem, Go talk to a lawyer about it. Like, seriously, if you go, if you're looking at this going, that could be me one of these days, find a lawyer and have a conversation with them about it. Get some actual legal advice. We are not lawyers. We just play them on TV sometimes.

Rob Campbell [00:26:00]:
So what happens when it wipes it? Is it like, is it visibly obvious that it's wiping it? Because a better feature might be where it looks like it logs in, And it's just like a different blah user and doesn't have anything there important.

Jonathan Bennett [00:26:16]:
So apparently, that's an interesting thought. I'll get back to that in a second. Apparently, it flashes. It's like it unlocks, it flashes the screen, goes off, and then it reboots to a fresh install. Now, that is an interesting thought because there was the old TrueCrypt software and it had it. So it was a whole disk encryption. software. And one of its features was, um, the plausible deniability, uh, feature where you could set up 2 different passkeys, 2 different passwords.

Jonathan Bennett [00:26:49]:
One would unlock your real volume, but the other one would unlock a fake volume that you could also have files on. And so it was literally a duress mechanism where you could give someone a password and it would decrypt and it would show files. And so you could put things on there that looked sensitive, but not be the things that you were actually trying to protect. And that was very much that same idea of let's give people something that they can use in a moment of duress.

Rob Campbell [00:27:21]:
Derek Key says, what, the battery's so low it won't boot up? Maybe that's another password where it just flashes a battery. Low battery.

Jeff Massie [00:27:29]:
I honestly, okay. If, if I was, you know, left the country and I was doing some dirt and damage or whatever, and I'm coming back, I would have all that stuff on international location somewhere, and I would wipe my phone before I ever went through. Um, because there's so many instances coming into a country, going out of a country, they're always trying to take your phone and always trying to just—

Rob Campbell [00:27:55]:
I've never had it happen, but But I don't know.

Jeff Massie [00:27:58]:
Well, depending on what country you're going into, there's certain protocols based on the industry you're in.

Ken McDonald [00:28:03]:
And depending on how you go in and out.

Jeff Massie [00:28:08]:
Well, no, I just mean regular.

Jonathan Bennett [00:28:11]:
So of the 4 of us here, Jeff and I are probably the 2 that would be most likely to face more scrutiny traveling from one country to another. Don't you think, Jeff? Would you kind of consider yourself because of the industry that you work in? at a little bit of an elevated risk in some cases?

Jeff Massie [00:28:29]:
Yeah, well, I was just thinking they don't like bald men with white beards. No, but in all seriousness, yeah, because of the industry I'm in, they want to— a lot of countries want to know, okay, what do I know? And they're hoping it's on a phone that I have with me.

Jonathan Bennett [00:28:47]:
Yeah. Yeah. So all that to say, that conversation with Jeff just now, just to say you don't have to be You don't have to be a terrorist. You don't have to be, you know, a bug-eyed lunatic to be in the, you know, the population that has to consider this. Right. And I'm sort of in the population that has to consider it, too, because of some of the things that I've worked with here recently. Again, none of it is illegal. None of it is breaking the law in any way.

Jonathan Bennett [00:29:13]:
It's just there are certain industries where you're, you're slightly elevated. You might catch someone's attention for one reason or another.

Jeff Massie [00:29:22]:
Yeah.

Ken McDonald [00:29:22]:
Especially if you're wearing a t-shirt that has the calculations for crypto on it.

Jonathan Bennett [00:29:34]:
Your Border Patrol agent would have to be such a nerd to get the joke that he's probably going to laugh at you and send you on. I'm not too worried about that one.

Jeff Massie [00:29:44]:
Well, and one thing I always say is whenever you hear something like, oh, we should do that, Now think of a party or group or whatever politically opposite of you and using that in the most malicious way they can to, you know, make your life really bad.

Ken McDonald [00:30:07]:
Sure.

Jeff Massie [00:30:07]:
Because sometimes people think, oh, that would be great, we're gonna go after—

Jonathan Bennett [00:30:10]:
it's like, uh, how do you feel if that tool gets used against you? Yeah.

Jeff Massie [00:30:16]:
Yes.

Jonathan Bennett [00:30:16]:
Yeah, that's, that's a useful sort of thought process. to weigh whether something is worth it, right?

Ken McDonald [00:30:25]:
Yeah.

Jonathan Bennett [00:30:25]:
Interesting. Like we said, all sorts of hair on this particular issue. I think we managed to thread the needle on the coverage of that one though.

Jeff Massie [00:30:34]:
Well, and realistically, we probably won't find the results for a long time because it's going to go through—

Ken McDonald [00:30:40]:
5 years?

Jonathan Bennett [00:30:42]:
Maybe more than that. In this particular case, there's a decent chance it'll wind up at the Supreme Court.

Jeff Massie [00:30:47]:
It's, it's going to hit every, you know, it's going to get decided and it's going to get appealed. It's going to go to the next level and it's going to get appealed. It's going to go to the next level. And no matter what the answer is, it's going to just work its way up. And I bet I— this has good odds of hitting the Supreme Court eventually.

Jonathan Bennett [00:31:04]:
It does. Or, or being shut down in the lowest court possible. No, not even that. Uh, it will either It may hit the Supreme Court, but what will often happen is that you'll have multiple cases that come to the lower courts at the same time. And so this may not be the one that actually triggers it, but it may be a case that gets referenced in a Supreme Court ruling. Right. So it may not be the actual case, but it becomes part of case law. And this is something novel.

Jonathan Bennett [00:31:36]:
Like we said at the beginning, this is something novel that has not really been decided in front of a court in the US before. And so, you know, regardless of how high it goes, it will become part of case law. And then if these things ever get sort of dealt with at higher levels, it's likely— yeah, it's likely to be at least referenced in one of the cases that will be potentially changed by Supreme Court ruling. You know, because sometimes they'll go, hey, this case needs to get reopened because of this, or what have you. So yeah, something— it very much is something to watch, something to keep your eyes on.

Rob Campbell [00:32:09]:
He was just in the Dominican even, huh? I mean, that far. I was just there last year. Better than me.

Jonathan Bennett [00:32:17]:
Could have been. I mean, there are, there are some places that are likely going to be safer to travel to and from than others, right? Like if you're going to— if you're going to Europe, your, your chances of being looked at are pretty low. There are some European countries where you might be looked at for one reason, or some Caribbean countries, uh, or South American countries you might be looked at for one reason. Then of course, if you're flying back from the China, you might be looked at for an entirely different reason. You know, all sorts of stuff going on. So like, be aware, be wary as travelers and just know that there are things that could happen.

Ken McDonald [00:32:49]:
Is there anything else we need to be wary of?

Jeff Massie [00:32:52]:
Nope.

Jonathan Bennett [00:32:53]:
Well, I think Jeff is going to tell us that if you're running Arch, there are some things to be aware of.

Jeff Massie [00:32:59]:
Yeah. My story is really the latest chapter in an ongoing security problem affecting the Arch User Repository, or AUR as we commonly call it, which, you know, is one of the most popular features of Arch Linux. The immediate news is that Arch Linux team has temporarily disabled package adoptions in the AUR after discovering another wave of malicious activity involving package maintainership changes. So when I say adopting packages, I mean you can't take over who owns you know, oh, that's packaged. I will become the maintainer. Not right now. They've stopped that. Now, we've talked about this before, but, you know, a quick recap on some of this in case we have new listeners is the AUR, you know, is unlike the official Arch repositories.

Jeff Massie [00:33:51]:
The AUR is largely maintained by community members and users can upload package build scripts, maintain existing packages, in some cases adopt packages that appear abandoned. Now, this system has made the AUR one of the largest collections of Linux software available anywhere, but it also requires a higher degree of trust and vigilance from both maintainers and users. Basically meaning that it was kind of a lot of just, eh, it'll be fine, we trust everybody. Well, now we're running into problems. The current action by the Arch Linux team is especially aimed at stopping package adoptions while they investigate ongoing abuse. According to the announcement referenced in the article linked in the show notes, attackers appear to be using package adoption mechanisms to gain control of packages and distribute malicious code. The Arch team is encouraging users to report suspicious package transfers, unusual comments, or any adoption activity That appears questionable. Now, what makes this particularly concerning is that it comes only weeks after an even larger security incident, which we covered, which back in, you know, June and July— this is August 1st, after all— the AUR was hit by a sophisticated malware campaign that ultimately affected more than 1,500 packages.

Jeff Massie [00:35:11]:
So that was one of the largest security incidents in the AUR history. And it demonstrated how attackers could exploit the trust users place in community-maintained software repositories. In the case of abandoned packages, they were being adopted by malicious actors. Well, now we're facing another round of malicious package submissions and package ownership changes. The fact that these incidents are arriving back to back suggests that attackers are actively targeting the AUR rather than these being isolated one-off events. The newest round of suspicious activity reported involves dozens of packages which are not necessarily obscure packages.

Rob Campbell [00:35:51]:
That—

Jeff Massie [00:35:51]:
now this is the difference, because the last time they had a huge number of packages, but there's a lot of them that were really obscure. And I think they only had, I think it was like 300 downloads before they, uh, were able to shut it down. Might not even been that much. It was—

Ken McDonald [00:36:09]:
it—

Jeff Massie [00:36:09]:
but because Part of it was, it was such weird oddball packages. They weren't something that people were readily pulling from. This time, though, some are associated with developer tools, drivers, networking utilities, and applications that may be installed by technically sophisticated users who often trust the AUR as part of their normal workflow. Now, one important point for listeners is that the AUR does not work exactly like a traditional binary software repository. So in many cases, users, you know, myself or whoever's using it, download package build instructions called PKG builds. And then they fetch some source code or binaries from elsewhere and it builds it and then installs it on your system. Now, Arch users have always been encouraged to inspect these files before installing software. Now, this longstanding recommendation exists precisely because AUR is a community resource rather than an officially curated repository.

Jeff Massie [00:37:13]:
So incidents like this reinforce why this guidance exists. Now, from a broader Linux ecosystem perspective, this is a reminder of the challenges open community repositories face as they grow. The AUR has become enormously successful, and with the popularity comes increased intention from attackers. A repository containing tens of thousands of packages and serving a large community becomes an attractive target because the compromising of even a small number of widely used packages can potentially affect many systems. It's also worth noting that, you know, the Arch team appears to be responding aggressively. You know, rather than waiting for further damage, they've disabled package adoption altogether while they investigate. Now, this may create some inconvenience for legitimate maintainers who want to take over abandoned packages, but it limits one avenue attackers may be using to gain package control. Package adoption has historically been a useful feature because it allows abandoned software to continue being maintained.

Jeff Massie [00:38:20]:
However, recent events may lead to discussions about stronger verification requirements, additional review processes, or enhanced monitoring of ownership transfers, you know, These conversations are going to continue as the Arch community evaluates how to balance openness with security. When you think about it, you know, okay, we want it to be really secure, but then you think there's tens of thousands of these packages out there and they're all, you know, a lot of them are getting updates all the time. How much are they maintained? Are they a very strong maintainer that's always on it or somebody's kind of got their pinky on it and just barely paying attention to it. And, you know, that's a lot of work to evaluate and sift through all that data and try to figure out what's, you know, who's really a good citizen of the open source community and who's a bad actor. Now, the key takeaway here, in case anybody's worried, Arch and And by, uh, it also means all the other distributions, you know, the caches and things like that, they have not been compromised. It's only the community-maintained AUR that is facing the attacks. So the official repositories, they're fine. There's, there's been no issues there.

Jeff Massie [00:39:46]:
So after, you know, after dealing with packages only a month ago, they're now really— the Arch community is really looking at this hard and trying to come up with a remedy to make sure that this stops and they can shut this kind of malicious activity down. Take a look at the article linked in the show notes for further details and links to the mailing list threads and the official announcements. And, you know, stay safe out there.

Rob Campbell [00:40:16]:
The other thing worth noting is that default Arch, if you follow just the basic installation or Cache, they don't even install the AUR tools by default. Now, I believe Manjaro did. Manjaro, last time I used that, had yay in it, which is a helper for the AUR. But a lot of the others, like at least Cache and Arch, I don't know about any of the other ones out there. But They don't want to do it by default. So you have to actively choose to use that. So depending on your level of sophistication. The most, the most secure way to keep your system and not install malicious software is to not install software.

Rob Campbell [00:41:00]:
So if you really want to lock it down, you just don't install anything. It's a balancing act is all I'm saying.

Jonathan Bennett [00:41:05]:
You just go in and unplug and remove your hard drive. That's the most secure way to have it go.

Ken McDonald [00:41:10]:
Yeah. Do you want a brick or do you want a NUC? Yeah.

Jeff Massie [00:41:16]:
DT Pantera says, wonder how many users are ditching Arch, going to something else.

Jonathan Bennett [00:41:21]:
Probably not very many.

Jeff Massie [00:41:23]:
I don't think very many because like what Rob was saying, it's the distro itself is not the problem. It's the AUR.

Rob Campbell [00:41:29]:
I know even last time though, a lot, I feel like a lot of users maybe aren't sophisticated or realize that distinction. I remember last time there was a lot of things on social media. Well, now that Arch is hacked, what should we go to? What else is there?

Ken McDonald [00:41:47]:
So for those of y'all who use Ubuntu, another example would be Ubuntu has third-party PPAs that you can set up and download from.

Jeff Massie [00:42:03]:
And personally, I I do use a couple packages from the AUR, but I haven't worried about them because they don't update very— it's like one of them's like a really old printer driver that hasn't been updated for— 7 years old? It's what?

Ken McDonald [00:42:19]:
7 years old?

Jeff Massie [00:42:20]:
No, but it was like, I think it was last updated a couple years ago. So it's, and it's still, quote, maintained. I mean, there's not really anything. to maintain on it. But if I do have an update for anything, I definitely go through it. But I, because I only have, you know, like a couple packages that don't really change it, I haven't been concerned about it.

Ken McDonald [00:42:46]:
This one's for Rob. Would you recommend having Al review those package builds before you download them?

Rob Campbell [00:42:52]:
Absolutely. But, you know, I was going to say, So they fixed the real problem.

Jonathan Bennett [00:43:01]:
And I'm sort of disappointed that their take on it is we're going to make this temporary because the fix that they finally rolled out here is the appropriate one. And really, it's the obvious solution. And it's what I said they needed to do to start with. And that is, you cannot— no user can take over one of these abandoned packages.

Rob Campbell [00:43:23]:
Right.

Jonathan Bennett [00:43:24]:
Because there's no way that you can do that securely. You need to have a way for it to replace the packages, but not automatic. Like, so with Jeff's printer driver, you know, you said that you're not worried about it because it's so old. That's actually one of the ones that you need to worry about because it's probably technically been abandoned, which means that it would be one of these drivers that someone could come along and pick up. Now they can't anymore. Because Arch finally has disabled that. But the whole problem is that something that didn't get updated for months and months was considered abandonware. And then they had this system where anyone could come along and pick it back up.

Jonathan Bennett [00:44:04]:
And yeah, it just needs to go away. They need to create a new package under a new name. And if somebody wants to go get it, they can go out and get it by hand. But automatic doing it, Getting people to update automatically to untrusted packages, yeah, it was just, it was always a bad idea.

Rob Campbell [00:44:21]:
You know, I know we said it last time that this can still, I mean, even though the AUR had much looser controls in place, it's, this still can affect virtually any repository, whether it's official or Flatpak or Snaps, if something gets by somebody.

Ken McDonald [00:44:42]:
Ubuntu PPAs?

Rob Campbell [00:44:44]:
PPAs, definitely, because that's basically, uh, private. That's just as bad, if not worse.

Jonathan Bennett [00:44:51]:
I actually disagree. I don't think that a PPA has the same problem that this does. A PPA would have the problem if another person could come along and take over a PPA after it's been abandoned. Like, that's really the problem here, is that they let untrusted users take these packages over.

Rob Campbell [00:45:08]:
Well, if— If I had DNS going to it and I let my whole domain go away, someone could take over that PPA.

Jonathan Bennett [00:45:16]:
If it's DNS, if it's hosted on a private domain, this is true.

Jeff Massie [00:45:19]:
Or I'm a malicious actor and I fork something or I set it up from not from an ownership standpoint, but from I was malicious from the beginning and added something in there.

Rob Campbell [00:45:35]:
Yeah, it's more than malicious from the beginning than actually changing trusted packages like can be done in the AUR to an untrusted person.

Jeff Massie [00:45:44]:
Well, and I, the reason I said I wasn't worried about that printer driver is because it might be abandoned, but it's old enough that if it got an update, I'd be like, whoa, this is wrong. You know, this, nope, nobody's going, oh, I better fix this and fix the, you know.

Ken McDonald [00:46:02]:
Right.

Jonathan Bennett [00:46:03]:
It's, but Would you know it if that old driver got updated?

Jeff Massie [00:46:08]:
Yes, because when you do an update with the AUR, it throws up a lot of, hey, here is the changes in the update. So it doesn't update like a normal repository. It throws up, here is all the, basically it's a diff of the software. So you can see what they're removing and what they're changing. And it goes through the details. So You could look through and go, wait a minute, why is this, you know?

Jonathan Bennett [00:46:36]:
But do you actually look through it whenever you do these updates?

Jeff Massie [00:46:40]:
Yes.

Jonathan Bennett [00:46:41]:
There you go.

Rob Campbell [00:46:42]:
I would say a lot of people don't.

Jeff Massie [00:46:44]:
Well, but most people probably—

Ken McDonald [00:46:47]:
Do you want to install this? Yes, no?

Jeff Massie [00:46:50]:
Yes. Do you accept these changes? And I say that because you're already kind of probably an advanced user to get into the AUR. There's good odds. I mean, you could be cutting and pasting from, you know, Claude or something.

Ken McDonald [00:47:05]:
But is there a -y option that would automatically update?

Jonathan Bennett [00:47:10]:
Probably.

Ken McDonald [00:47:11]:
No.

Jonathan Bennett [00:47:12]:
Really?

Jeff Massie [00:47:14]:
At least not the installer I'm using. You have to say, for AURs, you have to say yes.

Rob Campbell [00:47:21]:
And sometimes you can even select different options. When you're installing something too, and you just select a lot of things.

Jeff Massie [00:47:29]:
If there's multiple, you can have ones where you can have multiple, like, I'm, you know, I'm going to install the Ken package. And it's like, oh, you have this version at this repository. You have this version in the AUR. You have this. And then there's some of them you can pick and say, oh, I want, but it defaults to repositories. So you purposely have to—

Ken McDonald [00:47:49]:
Give me the oldest version.

Jeff Massie [00:47:52]:
Well, yeah, and could be. Or somebody, you know, oh, I added patches for this one fix or something. But you would have to specifically pick that AUR version.

Ken McDonald [00:48:06]:
Mm-hmm.

Jeff Massie [00:48:07]:
Now, I look through them because, like I said, I have like 2 and they, I think I've gotten like one update on the other one. And it was like, Okay. It's, I look through for anything funky.

Rob Campbell [00:48:23]:
You know, Keith pointed out, I may have been somewhat incorrect about the actual PPA functioning because that is on Ubuntu's, on their Canonical's Launchpad. So there might be other protections there, but I know you could set up your own app repository. I have done that before.

Jonathan Bennett [00:48:39]:
Yeah. Yeah. And that would definitely, you'd run the risk of the DNS name changing because I don't think apps are If you set your own up, I don't think it's protected by signing. I don't know.

Ken McDonald [00:48:51]:
You have to look.

Rob Campbell [00:48:52]:
I think you can have things signed. It's optional. You don't have to. And yeah, then you just put in the source file, the /etc/sources, I think it is. It's been years since I set up an apt repository, but I've done it, right? 15 years ago, 20.

Jonathan Bennett [00:49:08]:
Long time ago.

Rob Campbell [00:49:10]:
Oh my goodness. 20's probably too far, but What letter's coming next? Why?

Jonathan Bennett [00:49:18]:
Oh goodness. The puns, they hurt. All right, Rob, tell us what comes after X.

Rob Campbell [00:49:23]:
What comes after X? Y. All right. For years, I've been critical of the Linux desktop continuing to rely on X, Xorg, X11, you know, that whole family. X11 has been around for decades and the X.Org server carries a lot of old code and legacy functionality. There comes a point when continuing to patch an aging system becomes harder than moving forward towards something designed for modern computers. That is why I have viewed Wayland as the way forward. It's not perfect and the transition has certainly taken longer than many have expected, especially if you're a Mint user. But Linux cannot keep dragging decades of technical baggage behind it forever.

Rob Campbell [00:50:18]:
At least that was the choice we seem to have. Continue maintaining X.Org or move to Wayland. But if not X, why? A new third or maybe fourth or fifth, I can't keep up, option is in development.

Jonathan Bennett [00:50:35]:
Oh, really?

Rob Campbell [00:50:35]:
And it's called YServer. You had the XServer, now you got the YServer because apparently Y comes after X, which actually makes a lot of sense to me, you know, from a naming convention. You know, keep them in sequence order. Anyway, YServer is a new X11 server written from scratch in, even better, Rust. Largely with the help of AI, Claude Code specifically. So it's got all the great things. Instead of copying and forking the entire X.Org codebase, the project is attempting to support the parts of X11 that modern desktops and applications actually use while leaving behind things like obsolete visuals, old driver interfaces, and other legacy functionality. And this is not just a small demonstration anymore.

Rob Campbell [00:51:31]:
YServer can already run desktops, including MATE, XFCE, Cinnamon. So, you know, all the ones that are kind of lagging behind a little bit, guys. But it can also run KDE Plasma-based environments. We don't need you, KDE doesn't. But those other guys, they really need you.

Ken McDonald [00:51:50]:
Version 1.4.

Rob Campbell [00:51:54]:
Adds GPU acceleration for Chrome and Steam, better NVIDIA responsiveness, KDE Plasma improvements, and full-screen gaming and video under Cinnamon. I still believe Wayland is the future, the way forward. Rewriting the X server doesn't automatically fix every limitation built into the X11 protocol, but I cannot deny that this is intriguing. One of the biggest problems with rebuilding old software is the enormous amount of time and work involved. All the tech debt, everything you gotta get out of there. AI may change that calculation. Instead of spending years untangling an old bloated code base, developer can use AI to help build a cleaner implementation from the ground up. YServer probably won't stop Wayland from moving forward, but it may provide an alternative for some of the legacy desktops that continue to struggle and just can't keep up.

Rob Campbell [00:52:59]:
You know, we may now have a serious display server contender to Wayland. And I'm curious to see if anything really comes of this.

Jonathan Bennett [00:53:11]:
Is it, you may have said this, is it compatible with XServer? Like, does it just replace X as the backend?

Rob Campbell [00:53:20]:
Um, it sounds like it's supposed to.

Ken McDonald [00:53:24]:
Is it?

Rob Campbell [00:53:25]:
That's— it works with all the, all the, all the things like Mate and Cinnamon and—

Jonathan Bennett [00:53:29]:
Isn't, isn't part of the problem with X though, just the lack of security that's baked into the protocol? Like, I don't, I don't know that this is a, I don't think it's a solution for the problems that made people move over to Wayland.

Rob Campbell [00:53:44]:
Maybe. I mean, they do say that they're trying to leave behind a lot of the old bloat, you know, if it's not used, um, something old legacy functionality, that they're not trying to bring that along. So, um, it, it depends, I guess.

Jeff Massie [00:54:01]:
Well, it was a security issue because, and Rob said it, sometimes it's easier to start over than try to keep patching the old. And that was the maintainers of X11 said, this is too much, and they started Wayland. So that's why there's no real Wayland or X11 maintainers anymore, because they all went to Wayland. They all agreed that this is the method we should go.

Rob Campbell [00:54:24]:
In some ways, the way I see this, I don't know, I haven't looked through all the code, obviously, but it is somewhat of a build from scratch.

Jonathan Bennett [00:54:35]:
Yeah, but it implements the X11 protocol though. And so the point I'm getting at is part of the problem is that the X11 protocol itself was broken and insecure. And so I just— You run into this state where it's like, okay, we want to— we hate Wayland. We want to take X and fix the problems with X. And when you do that, you end up with a ground-up rewrite Which means that you end up rewriting Wayland.

Rob Campbell [00:55:04]:
Yeah. So, so, you know, maybe, maybe not. I mean, that's a part of it, but, um, you know, if they are leaving a lot of the legacy stuff, you know, one of the reasons why they didn't, um, why they decided they just can't keep working on X and they had to just start from scratch is because there's just all this legacy bloat in there.

Jeff Massie [00:55:22]:
And if they're starting from a point that doesn't have that, maybe it makes it easier to fix Oh great, I got a brand new car with all the rust of a 50-year-old car and it doesn't come with back seats because I didn't use them in my other car. Yeah, it's—

Jonathan Bennett [00:55:39]:
oh boy, it's—

Jeff Massie [00:55:41]:
it— to me it's like, at your age you're not going to use them anyway, so it's somebody's hobby.

Jonathan Bennett [00:55:51]:
You put grandkids in the back seat at Jeff's age.

Rob Campbell [00:55:53]:
Come on.

Jeff Massie [00:55:54]:
Well, I'm in between. My kids are too old. They're not around and I don't have any grand— I don't have the grandkids yet.

Rob Campbell [00:56:00]:
So. You might need that feature in the future.

Ken McDonald [00:56:02]:
You don't have 3 generations in the house yet?

Jonathan Bennett [00:56:05]:
Give them a few more years.

Jeff Massie [00:56:06]:
Well, I do have, I have one daughter going to college, but kids are hopefully several years off.

Ken McDonald [00:56:15]:
Kids or grandkids?

Jonathan Bennett [00:56:16]:
All right. On that note, on that note, we're going to take a quick break and then we're going to come back and talk about the best text editor. We'll be right back right after this.

Ken McDonald [00:56:24]:
Well, Jonathan, as you said, Bobby Barsoff wrote about the best editor that Jonathan and I both consider our favorite command line text editor for Linux. And he wrote about it receiving a maintenance update to GNU Nano 9.2.

Rob Campbell [00:56:44]:
Me too, Ken, me too.

Ken McDonald [00:56:47]:
Codename, Alcazar. I think I said that right. Now, according to Bobby, nano 9.2 is a fairly minor one and features 3 specific changes: a new startup check, clearer naming for an existing option, and the restoration of support for 2 old keyboard sequences. The most significant change is that nano will refuse to start if its standard output is not connected to a terminal, stopping the interactive text editor from launching in situations where it cannot properly display and manage its terminal-based interface. GNU nano2 also provides the new, more descriptive --newbuffer command line option as an alternative to the existing --multibuffer buffer option. Also, set new buffer can replace the set buffer in your nano rc configuration files. Both options still allow nano to open a newly read file into a separate buffer rather than replacing the current one. Existing scripts and configuration should continue to work without any changes since --multibuffer and the set multibuffer option are still available.

Ken McDonald [00:58:12]:
Jonathan, your muscle memory will be glad to hear that this update brings back recognition of the legacy Ctrl+W, Ctrl+T, and the Ctrl+/Ctrl+T combinations of keys. As always, additional details are available from Bobby's article. Anybody have Nano 9.2 yet?

Jonathan Bennett [00:58:36]:
Not yet. I'm way behind on installing updates, honestly. I'm trying to remember what those keyboard combinations actually do. I can't off the top of my head.

Ken McDonald [00:58:47]:
I know Ctrl+W by itself is used for— I want to— not right. That's— yeah, I want to say right.

Rob Campbell [00:58:57]:
Ctrl+X. Oh yeah, Ctrl+W is right.

Ken McDonald [00:59:01]:
Yeah.

Jonathan Bennett [00:59:03]:
Control-O writes out a file.

Rob Campbell [00:59:08]:
9.1 is all I got. It's at the bottom of the screen. That's all I know.

Jonathan Bennett [00:59:11]:
Well, some of them are at the bottom of the screen.

Rob Campbell [00:59:13]:
The ones I need are.

Ken McDonald [00:59:15]:
Just use Control-G.

Rob Campbell [00:59:17]:
You know, back to— go ahead, Jeff.

Jeff Massie [00:59:20]:
Well, I was going to say, that's why I like Fresh as my command line editor better because it uses the standard Control-O.

Rob Campbell [00:59:29]:
See, and that just messes up muscle memory. Here's my perspective about Fresh and Nano. And, you know, all I need is a basic text editor. I need to be able to go in there and type, save, whatever. And it's nice to have the stuff at the bottom, like I think Fresh does.

Jeff Massie [00:59:46]:
At the top, like a—

Rob Campbell [00:59:47]:
Oh, at the top, okay.

Jeff Massie [00:59:48]:
A TUI in the command line. And you can use the mouse in there, which is handy.

Rob Campbell [00:59:53]:
I don't have— a GUI half the time when I'm using it. Anyway, no. So I was going to say—

Jeff Massie [00:59:59]:
GUI.

Rob Campbell [01:00:00]:
Yeah, I know, but you said a mouse. Well, it's like in the console, mouse doesn't work at all often. But anyway, I was going to say, you know, whether it's Nano, Fresh, Micro, or even the old Pico, Pico as I called it at the time, you know, they're all the same. I could put text in there. I could save. I can do whatever. What I like about nano the best right now is that it's on there and I know how to type nano. Fresh is longer to type.

Rob Campbell [01:00:32]:
I was so upset when Pico went away and I had to start typing nano. Like, I just want to type the same thing every time and be able to use a text editor. I don't care which one it is, really.

Ken McDonald [01:00:43]:
That's going to be a future command line tip, how you can set it up so you just type edit and it opens whichever one you want to use.

Jonathan Bennett [01:00:50]:
Well, I think we've talked about that before, actually.

Jeff Massie [01:00:53]:
Yeah.

Rob Campbell [01:00:54]:
Yeah.

Ken McDonald [01:00:54]:
But it sounds like it's time to give Rob a refresh on that.

Rob Campbell [01:00:58]:
Nano is easier to type because 2 out of 3 characters are the same. So my fingers are already there.

Ken McDonald [01:01:06]:
How about XED? Would that be easier to type?

Jeff Massie [01:01:10]:
I don't know.

Rob Campbell [01:01:10]:
Those are characters kind of in weird spots that I feel like I would not hit well.

Jonathan Bennett [01:01:15]:
Oh my goodness.

Jeff Massie [01:01:16]:
Well, and I've used Nano for years, but see, I don't have muscle memory. I always have to look at the bottom and Okay, what command was this to? Because most of the time I'm not in a text editor, but when I need it, it's nice to go in and just, I just need to change this one line or something. I don't know.

Rob Campbell [01:01:33]:
I mean, usually the only command I need is Ctrl+O, I think, to save. And I'm done. Or Ctrl+X.

Ken McDonald [01:01:40]:
Just Ctrl+X, Y, Enter.

Rob Campbell [01:01:43]:
Yeah, that's what, yeah, there we go. Ctrl+X. Yeah, actually Ctrl+X is almost the only command I ever need.

Ken McDonald [01:01:50]:
Nano space filename. Make your changes, Ctrl+X, Y, and then Enter.

Rob Campbell [01:01:57]:
I'm usually not changing the filename. If I do that, it's using the mv command or something.

Ken McDonald [01:02:03]:
Well, no, you type the name of the file you want to edit.

Rob Campbell [01:02:07]:
Oh yeah, yeah, yeah.

Jonathan Bennett [01:02:10]:
Makes sense.

Ken McDonald [01:02:11]:
And of course, Y for some people is easier.

Jeff Massie [01:02:16]:
I've never used vi without having to go, wait, what do I type?

Rob Campbell [01:02:22]:
Vi is powerful. Definitely not easier because you have to know what you're typing. Whereas like nano, it says it right there, what you need to type.

Jonathan Bennett [01:02:33]:
You know, the only problem with vi is it's so easy to get stuck. Scores of people just Can't make their way out.

Jeff Massie [01:02:43]:
Well, when you use it once every month, you know, once, twice a month, you don't have it down.

Jonathan Bennett [01:02:49]:
Indeed. All right. Jeff, let's talk about Nouveau, or as we always used to call it, Novue. We got a very angry listener one time who goes, no, no, it's Nouveau. Stop with the slander.

Ken McDonald [01:03:05]:
But that's the fun of running Linux. You can do whatever you want with it.

Jonathan Bennett [01:03:09]:
Yeah, I suppose. But people have to listen to us.

Jeff Massie [01:03:12]:
And we're not natively French, so we mess things up. I assume it's French. There's a lot of vowels in it. Anyway, there's a relatively small sounding change coming to the Nouveau graphics driver, but it's one that could have meaningful implications for the Linux desktop community in stability and future compatibility. Now, the headline of the article in the show notes is that Nouveau developers are preparing to enable atomic mode setting by default, something the drivers technically supported for years, but they never turned it on by default. Now, Nouveau is the community-developed open-source graphics driver for NVIDIA GPUs on Linux. Unlike NVIDIA's proprietary driver, Nouveau is developed in the open and is integrated directly into the Linux kernel and Mesa graphics stack. Over the last few years, the drivers gained renewed momentum thanks to NVIDIA publishing more documentation and contributing support for newer hardware through interfaces that allow projects like Mesa's NVK Vulkan driver to evolve much more rapidly.

Jeff Massie [01:04:26]:
Now, while some listeners might go, hey, NVIDIA now has an open kernel driver, Well, which is true, but the majority of the code that runs the driver is not in the kernel, and it's the form of binary blobs, which, you know, the open part of the driver loads in. So overall, the official driver isn't very open. You know, they kind of got the bootstrap somewhat to kind of mess up the term a little bit. in the kernel to load all the proprietary stuff. Anyway, the specific feature discussed here is called atomic mode setting. In Linux graphics terminology, mode setting refers to how the operating system configures displays. That includes screen resolution, refresh rate, monitor layouts, display enablement, and similar settings. Historically, many Linux graphics drivers handled these changes incrementally, applying settings one piece at a time.

Jeff Massie [01:05:31]:
Atomic mode setting changes that— changes that approach by allowing the entire display configuration to be submitted as a single transaction. Either the whole configuration succeeds or none of it does. So basically, the— well, the practical benefit is increased reliability So when display changes occur atomically, the desktop environment and compositor can make coordinated updates without partially completed operations. So this can reduce screen flickering, eliminate some display glitches, and provide more predictable experiences when monitors are connected, disconnected, or reconfigured. Atomic mode settings has become the standard approach used by modern Linux graphics drivers and desktop environments. Now, I hope— sorry, I'm going to apologize now for this. Lide Paul of Red Hat has been working on the patches and had this to say. Nouveau is one of the very few modern hardware drivers in the kernel that doesn't have atomic mode setting enabled by default, in part because when it was originally written by Ben, there wasn't much in the way of good atomic mode setting clients.

Jeff Massie [01:06:44]:
to actually test things out, test things out with. Nowadays, however, atomic mode setting is very much the norm and supports— and sorry— and support in user space for non-atomic drivers is starting to bit rot a bit, leading to its own set of issues. At the same time, many of those issues are fixed by just turning on atomic in Nouveau. Plus, I've been running Nouveau with atomic mode setting on by default for most of the machines I work on, and I've already fixed quite a number of issues to the point where it seems quite, quite stable, excluding a single screen flashing bug on my desktop, which I'm not particularly convinced has anything to do with atomic mode setting. So, so this patch series enables atomic mode setting by default, at least for NV50 and newer. NV04 is left unchanged as atomic mode setting was never implemented for it. So this series also enforces leaving— this series also enforces leaving atomic mode setting disabled on less than NV50 cards and adds a value of NOVUATOMIC to our kernel debug output. So NV50 GPUs would be the unified shader GPUs such as the GeForce 8800 GTX and later.

Jeff Massie [01:08:08]:
So most modern GPUs will be able to handle this atomic mode setting. Most users will never know atomic mode setting exists. However, if the transition goes well, they may notice fewer display glitches, smoother monitor reconfiguration, improved Wayland compatibility, and better long-term support as the Linux desktop software continues moving towards modern graphics infrastructure. Take a look at the article in the show notes for full details on this coming change.

Jonathan Bennett [01:08:40]:
Yeah, interesting stuff. Is it to the point now to where it's usable? Are you going to start— are you going to do another test run of Nouveau with gaming?

Jeff Massie [01:08:51]:
There actually was a Phoronix article talking about testing That very situation.

Ken McDonald [01:08:59]:
On CashEOS? I don't think that— I think you're referring to the one that Keith512 posted in the Discord notes chat.

Jeff Massie [01:09:13]:
There you go.

Rob Campbell [01:09:13]:
Yep.

Jeff Massie [01:09:15]:
And it didn't really hang with the— I wouldn't use it for gaming. But if you have something that you're not gaming with, I think it's Probably the point of being usable. Uh, it— some games didn't work, some of them were a lot slower, and it doesn't have like ray tracing and a lot of advanced features in there. So there's quite a performance gap, but you know, it's, it's usable for non-gaming, um, applications. I don't know as it would play video. That great either. There's still a lot of acceleration and advanced hardware features it doesn't support yet. But, you know, it's a lot better than it was because it used to be I couldn't even use it.

Jeff Massie [01:10:01]:
I would only get black screens. I couldn't even get it to display.

Ken McDonald [01:10:04]:
Sounds like it'd be perfect for using Nano.

Jeff Massie [01:10:11]:
We segue forwards, Ken, not backwards.

Rob Campbell [01:10:13]:
All right, let's go back to the Nano story again.

Jonathan Bennett [01:10:17]:
All right.

Ken McDonald [01:10:18]:
Actually, I'm, uh, this kind of builds upon what, uh, I think Jeff's been talking about for the last couple of months. NVIDIA. And NVIDIA starting to work with Valve?

Jonathan Bennett [01:10:35]:
Seems like a little bit. There seems to be some thawing there.

Jeff Massie [01:10:39]:
Well, realistically, okay, I'm going to say it again.

Rob Campbell [01:10:43]:
AI.

Jeff Massie [01:10:44]:
AI runs a lot on Linux. Most all AI runs on Linux. So NVIDIA went, you know, we're going to have to be nicer to Linux because if we torque off that community, it's not going to bode well for us. So they've been hedging their bets. Not that there's a—

Rob Campbell [01:11:01]:
wow.

Ken McDonald [01:11:02]:
For a change.

Jonathan Bennett [01:11:03]:
And it's not like nothing is— it's not like it's never blown up in their face before. There's been a couple of times now. We've talked about it over the years. where the Linux kernel guys are like, all right, we found out that NVIDIA is doing shenanigans. We're going to intentionally make it harder to run their closed source driver in the kernel.

Rob Campbell [01:11:21]:
Yeah.

Jonathan Bennett [01:11:21]:
We've covered that story a couple of times. So there's a real threat there. Play nice.

Jeff Massie [01:11:28]:
And I think they've kind of come to realize too, it's not a big deal to support a lot of this stuff because They're a hardware company. As much as they try to be a software company, the software runs on their hardware. So if you enable it more places, that only opens up more venues to sell hardware.

Jonathan Bennett [01:11:52]:
Yeah, absolutely.

Rob Campbell [01:11:53]:
Unless there's really some secret sauce in their software that gives AMD a hedge up. And we don't know about.

Jonathan Bennett [01:12:03]:
There is secret sauce in both of their software, but what they have done is they have, they've moved that software into firmware that runs on the video card. So that, that is generally the direction that both companies have taken.

Jeff Massie [01:12:16]:
Well, and AMD went and they've kind of modularized their driver. So you don't know until the hardware comes out what bits of that driver is going to load. So it's kind of like little Lego blocks.

Rob Campbell [01:12:30]:
Maybe the problem is NVIDIA hasn't moved it all to firmware on the drivers, and that's why they're struggling to get it out there. They're working to move it there.

Jeff Massie [01:12:41]:
Some of it isn't, but they've said in the past that they've licensed third-party software, so they couldn't open source it if they wanted to, or not all of it anyway, because of third-party licenses. Now, that's what they're saying. I can neither confirm nor deny that that's true.

Jonathan Bennett [01:12:59]:
I mean, it makes sense though. That's the sort of thing that companies will get themselves into. Nobody thought 30 years ago or 20 years ago, whatever. It's like nobody thought of that. Well, we may want to open source this one day.

Ken McDonald [01:13:10]:
Well, isn't there one company that didn't worry about that? They just bought the company that originally wrote it.

Jonathan Bennett [01:13:16]:
That has happened a few times. We can't come to a licensing agreement. I'll just buy the company. It's fine.

Ken McDonald [01:13:22]:
Now we own the license.

Jonathan Bennett [01:13:24]:
Yeah.

Jeff Massie [01:13:24]:
Yeah. And a lot of times it's like, oh, I need a, you know, I'm just making things up. I need a JPEG decoder and there isn't one out in the open source that's going to work for me. Oh, this company has one. We'll just license theirs and then we don't have to worry about it and don't have to write it. And if it breaks, we just phone them up and say, hey, fix your stuff.

Rob Campbell [01:13:46]:
Absolutely.

Jonathan Bennett [01:13:47]:
And then you open source it years later and you realize that, oh, oops, their code is in there. We didn't have the permission to do that. Like Winamp. That's what happened with Winamp with the code release there. All right. We're going to take a quick break and then we're going to dive back into geopolitics. Hopefully a little bit better story this time around, a little happier story this time around. We'll get to that right after this.

Jonathan Bennett [01:14:08]:
All right, Rob, is it a happier story?

Rob Campbell [01:14:10]:
Well, it depends who you are. I don't know. Like someone like Ken said during the break, depends on your perspective. But, you know, when I first saw this, okay, you UK people, What are you thinking here? You know, okay, so I recently saw a headline that made me stop and read it twice, and the headline was Open UK wants Britain to stop giving away open source creations. That sounds strange. Isn't giving software away kind of one of the main tenets, the ideas behind open source? I mean, it's not the only one, but isn't that like one of them? You know, open source allows people to use it, study it, modify it, and redistribute it. Uh, once we start talking about preventing people in other countries from benefiting from it, you know, we, we seem to be moving away from the entire point. You know, keep, keep it free, UK.

Rob Campbell [01:15:09]:
That's all I say. But, but anyway, after, after looking a little more closely at it, Is that exactly what OpenUK is proposing? I don't know why the title said it like that. It's perspective. OpenUK wants the British government to help create a UK-based organization similar to the Linux Foundation. It would provide a home for repository standards, datasets, training events, and project governance. The code would remain open, but the organization supporting and managing it would be based in the UK. The concern is that British developers and public funding help create important open technologies, but those projects eventually move under organizations based somewhere else. The example being used is the Model Context Protocol, or MCP.

Rob Campbell [01:16:06]:
It was created by engineers working in London and eventually donated to the Linux Foundation's Agentic AI Foundation. That gave MCP the neutral governance it needed, but it also placed that governance under a US-based foundation. So OpenUK does not really want Britain to stop giving away open source software. It wants Britain to stop giving away all the influence and economic opportunities that can grow around that software. That makes sense, although I'm still a little cautious about it. You know, open source succeeds because it crosses borders. Developers from different countries and companies can work together without every project becoming part of a competition between governments. Creating another foundation could and should probably will provide funding, more funding and support.

Rob Campbell [01:17:01]:
We don't have, uh, but it could also duplicate existing organizations or divide communities along national lines. Uh, the location of the foundation also does not determine who can use the software. Hopefully they plan to keep it that way. Uh, if the project is truly open source, American, Chinese, European, and British companies can all still build products and services around it. So it doesn't matter which foundation is funding it. But, you know, open source does not mean maintainers should work for free forever. You know, projects need funding, security support, infrastructure, and people who can manage them. A UK foundation could help provide those things while developing more open source expertise inside of their country.

Rob Campbell [01:17:47]:
So that's not bad. So, you know, I understand what OpenUK is trying to accomplish. Maybe I think I get it. I would describe as Britain refusing to give anything away. The software would still be given away. I think the UK just wants to play a bigger part, and at least I hope that's all it is about. What else could it really be? Yeah.

Jonathan Bennett [01:18:18]:
I was looking into this just now. There's quite a group of organizations that sort of serve as, like, the fiscal home for open-source projects. And it sounds like that's sort of what this is intended to be. I was actually trying to look. I think Simon Phipps is involved with one of these. And I know there's, like, Software for the Public Good and some other places like that. In the US, there's the Open Collective. You know, there's a bunch of these places.

Jonathan Bennett [01:18:50]:
There is I don't know. I think there is something to be said for trying to keep software, like the community, in a neutral place. And yeah, I don't know. I think it's a reasonable goal for this group to have.

Rob Campbell [01:19:09]:
At the very least, it's probably easier for a UK foundation to fund UK People.

Jonathan Bennett [01:19:18]:
Projects.

Rob Campbell [01:19:19]:
Yeah, projects, people, you know, pay people in the UK. I mean, not that it's that difficult for, say, a US foundation to pay somebody in the UK, or maybe it is, you know, when you're talking about the status of the companies.

Jonathan Bennett [01:19:36]:
Yeah. You know, it's kind of interesting to think about though, like most open source projects, I guess some of them would have sort of a nation that they're attached to, but A lot of them just sort of exist on the internet. And there are contributors from countries all around the world, leadership of the project from all around the world. Like several of the projects that I've worked on, even the one that pays my salary as my day job right now, I would not say that we're necessarily a US-based project. Now, when you put a company together behind it, well then yes, you have to have some place that your company is based out of. And so like the company behind Meshtastic, we're based in the United States, but the project itself, it's absolutely international. We have, you know, and many of these projects do have contributors from all over the world.

Jeff Massie [01:20:25]:
Yeah, I mean, the only thing it'd be— I get what they're trying to do, and I don't think it's bad. It's just, would it be easier to join an existing, you know?

Jonathan Bennett [01:20:34]:
Well, but if there's not, if there's not a really strong existing host in the UK—

Ken McDonald [01:20:37]:
UK-based?

Jonathan Bennett [01:20:39]:
Yeah, if there's not one in the UK that's, that is already there, and for whatever reason you feel like you, you need your host to be in the UK, then yeah, there's something to be said for having one there. Because some, I mean, some projects are primarily based in a single country. You know, most of your contributors are from, say, the UK. And so it might make sense to try to make it based there. All right, let's move on and let's talk about Calibre or Calibre, as we like to say. They've got the word libre right in there. So it's, it just jumps out. It jumps to the front of our tongues.

Ken McDonald [01:21:14]:
Yeah, I still occasionally catch myself slipping up there. But I was looking back and the last time I talked about Calibre releasing any versions was back in episode 253, where they'd released version 9.8. Now, since then, Calibre director COVID Goyle has released 4 more, more versions, bringing us to with the most recent version being 9.12. Now, Bobby Borisov and Markus Nester both thought this latest release was worth writing about, but I'm going to go over some of the changes we've seen since the last time I've— we've talked about it here by going back and letting you know that with version 9.9, We saw a new option to keep the current search when switching virtual libraries under Preferences, Searching. It also added support for accurate page counting of fixed layout EPUB files. And then moving to version 9.10, that brought a new modern interface with a sidebar to ease navigation in the content server that you can now run from Calibre. It also allowed the content server to be installed as a PWA when used with HTTPS. You can now match by keywords when filtering the list of saved searches in Edit Book.

Ken McDonald [01:22:45]:
Then we moved to version 9.11, which allowed us to use the selected placeholder when typing freeform queries to the AI in eBook Viewer. And allow exporting annotations in the HTML format as a standalone web page that can be viewed in any browser with support for light or dark themes. Searching and filtering by highlight style. Now we get to, uh, the latest release, iCalibre version 9.12. It adds a button to sort the entries in the table of contents editor, support for plugins that can add new endpoints to the content server backend, And an option to convert GIF files. I'm saying GIF, Rob. Or GIF images to JPEG/WP files when compressing. I say GIF.

Jonathan Bennett [01:23:40]:
That's what he said.

Rob Campbell [01:23:42]:
Yeah, no, he's like, I say GIF. I said, yeah, that's exactly what I would say. If you said JIF, I'd be calling you out.

Ken McDonald [01:23:48]:
So you're both wrong.

Jonathan Bennett [01:23:50]:
I'm thinking JIF.

Ken McDonald [01:23:52]:
I know it was one of y'all. But, uh, it allows you to convert it to the JPEG and WebP when compressing images in EditBook. Now Bobby and Marcus also cover all the bug fixes that I didn't touch on, and of course you can always go to the What's New from Calibre to see what else I haven't covered over those, uh, these last 4 versions. So who else is using Calibre now?

Jonathan Bennett [01:24:25]:
I still, I still haven't. I've not set it up. I'm not at the time to go mess with it.

Rob Campbell [01:24:29]:
I think I set it up once and then I gave up. I think I started.

Ken McDonald [01:24:37]:
I, when I first set it up, it was so I could keep track of the Palm books that I had for reading on my Palm.

Rob Campbell [01:24:47]:
PDA.

Ken McDonald [01:24:48]:
And at the same time, I'd also started setting it up to track my physical books. So it's a virtual library for physical books.

Jonathan Bennett [01:25:00]:
I mean, hey, database. Yeah, it's useful to have, especially when you have a lot of books, you lose track of them. You find yourself at a bookstore or a book sale like, oh, this looks really cool. And you bring it home like, I already had one of No. Find a friend to give it away to.

Ken McDonald [01:25:18]:
True story happens to us. Or if you're at a library sale and you come across something like this, like audiobook, and you go, do I already have that?

Jonathan Bennett [01:25:27]:
Absolutely.

Rob Campbell [01:25:27]:
You ever seen anybody have those like little neighborhood, they're like little libraries or actually just like this little hut where you can walk in, take a book? Yeah. Or book.

Jeff Massie [01:25:37]:
Yeah, we got actually—

Jonathan Bennett [01:25:38]:
Take a book.

Rob Campbell [01:25:39]:
I actually got 2 of them on my block. And sometimes when I have an extra book or something, And I just think, well, someone else can have this one.

Ken McDonald [01:25:45]:
Yeah, I've seen that. It was actually called a library.

Rob Campbell [01:25:49]:
Yeah, I think that's what they call it, mini library or something.

Ken McDonald [01:25:54]:
Little free library.

Rob Campbell [01:25:55]:
Yeah, little free library.

Jonathan Bennett [01:25:57]:
Yeah, that sounds right. All right. Well, Jeff, the best news I've heard for a while is that somebody is officially coming back. Is it back? This seems familiar. It seems like about a decade ago I covered this story. What's new in the old?

Jeff Massie [01:26:16]:
I don't think it's coming back. I think this is a first introduction. So GOG, the digital game store best known for selling DRM-free games, has confirmed that it's actively working on bringing its GOG Galaxy client to Linux. The news comes from a statement by GOG. Joint CEO Kaz Rinstov-Papalonsky, who told Gaming on Linux that the company has already hired a specialist and is exploring the best way to approach the Linux client. However, GOG is not providing any release date or timeline yet because they're describing the effort as having a significant undertaking. Now, to understand why this matters, it helps to know what makes— excuse me— GOG different from competitors like Steam and the Epic Games Store. So GOG's business is built around DRM-free software.

Jeff Massie [01:27:15]:
When you buy a game from GOG, you can download an installer and keep it forever without needing to periodically verify ownership through an online service. GOG has even encouraged customers to back up their installers to physical media or external storage. In contrast, Steam and Epic and others generally require that their respective clients and accounts to manage purchased games is, you know, you get on the internet every so often and hit their database. GOG Galaxy is the company's optional game launcher, and it provides features that many modern gamers expect, including, you know, automatic game updates, cloud save synchronization, Achievement tracking, version rollback if a game update breaks something, and the ability to aggregate game libraries from other platforms into a single interface. Now, while these features have been available on Windows and macOS for years, Linux users have never received an official version. Instead, they've had to run the Windows client through compatibility tools such as Wine or Lutris. The announcement did not come completely out of nowhere because We saw this coming because earlier in 2026, GOG posted a job listing for a senior software engineer that specifically stated Linux was the company's next major frontier. The position mentioned responsibilities such as building and maintaining GOG Galaxy on Linux, developing Linux platform strategy, and shaping cross-platform solutions for the launcher.

Jeff Massie [01:28:49]:
At the time, many Linux gaming enthusiasts enthusiasts viewed the posting as a first concrete sign that GOG was finally taking Linux support seriously. Another factor is the changing structure of the company itself. In late 2025, GOG became independent after being sold by CD Projekt to co-founder Michael Kalinske. I'm butchering names and I apologize. Following that trend, Transition, company leadership publicly discussed Linux as an area of future investment. In an interview, Kalinske expressed dissatisfaction with the current state of Windows and noted that more users were exploring alternatives. GOG management also identified Linux support as part of the company's strategic plans for the year. From a Linux gaming perspective, the timing is interesting.

Jeff Massie [01:29:47]:
Because Linux gaming has changed dramatically over the past few years, largely due to Valve's investments in Proton and the Steam Deck and the supporting ecosystem for those. Many Windows games now run surprisingly well on Linux thanks to compatibility layers. Now, however, GOG has always been at a disadvantage because its launcher never made the jump. So Linux users often rely on third-party tools such as Heroic Games Launcher or Lutris to download and manage GOG purchases. While those tools work well, they're not official solutions and sometimes lack feature parity with GOG Galaxy. Now, there's still unanswered questions. GOG has not said whether the Linux version will support Windows games through Proton or Wine, or whether it will initially focus on native Linux games. We don't know.

Jeff Massie [01:30:38]:
Observers in the Linux gaming community have pointed out that the launcher alone may not be enough. So, Steam's success on Linux is tied not only to the Steam itself, but to Proton. You know, the compatibility layer is what makes thousands of Windows games playable. Now, since Proton's open source, it's technically possible for GOG to build upon similar technology, but the company has not announced any specific plans. The broader significance of the announcement may be less about convenience and more about software ownership. The article argues that GOG's model is increasingly important as the gaming industry becomes more dependent on digital storefronts. Recent examples of games being delisted from online stores, and they've highlighted how access can disappear when purchasing or platforms change direction. At the same time, physical media continues to decline across the industry.

Jeff Massie [01:31:35]:
As gaming becomes more digital, GOG's DRM-free approach gives users an unusual level of control over the software they purchase. Now, for Linux users specifically, an official GOG Galaxy client would represent a long-requested piece of infrastructure. It would provide first-party support rather than relying on community-developed workarounds. It would also signal that GOG sees Linux as a meaningful platform rather than a niche hobbyist operating system. Whether that translates into better Linux gaming support from publishers remains to be seen, but it would be one of the most significant investments GOG has made into the platform to date. Take a look at the article linked in the show notes for more information. It contains many links to other announcements and blogs, which if you're curious, you can dive into and get even more information. But either way, you know, no matter what, Linux gaming future just keeps getting brighter.

Rob Campbell [01:32:31]:
That's cool.

Ken McDonald [01:32:32]:
Very cool.

Jonathan Bennett [01:32:33]:
So I still, every time I see GOG, I think good old games because that's what it started out as originally. And of course it is, it has sort of moved beyond that, although there are a bunch of old games still available on the platform. Um, but GOG got purchased by, um, Project Red, I think.

Ken McDonald [01:32:53]:
Yeah.

Jonathan Bennett [01:32:54]:
Well, okay. It got purchased by one of the co-founders of CD Projekt.

Jeff Massie [01:32:58]:
Yes.

Jonathan Bennett [01:32:58]:
Of Project Red.

Jeff Massie [01:32:59]:
Yes.

Jonathan Bennett [01:33:01]:
Are they—

Jeff Massie [01:33:02]:
Because they sold it about a year ago to that founder.

Jonathan Bennett [01:33:07]:
Yeah. I'm trying to remember. They merged together and then they split back and now Michael has acquired GOG from CD Projekt. Okay. So they split it back up. apart. Yes. Interesting.

Jonathan Bennett [01:33:25]:
Yeah.

Ken McDonald [01:33:26]:
Yeah.

Jonathan Bennett [01:33:26]:
Some, some kind of weird history, but like at the same time, they obviously, you can still buy the CD Projekt games at GOG. So they, they are, they are not above making each other money.

Rob Campbell [01:33:36]:
Yeah.

Jeff Massie [01:33:37]:
And like I said, as soon as they sold, they started talking Linux. So that was a kind of a fundamental shift in the company.

Ken McDonald [01:33:46]:
Yeah.

Jeff Massie [01:33:47]:
From what they historically had, you know, Didn't care about Linux.

Jonathan Bennett [01:33:51]:
Yeah, interesting.

Rob Campbell [01:33:53]:
But that's a good trend to see lately. Yeah.

Jeff Massie [01:33:56]:
Well, and I still see more and more of the tech influencers, the media people, they're running Linux and they're talking about Linux. And it's not just, oh, we did this one experiment, we'll come back in a year. It's like, no, I'm sticking on this. I'm trying it. Here's what I'm doing. It's creeping into the mainstream more and more.

Jonathan Bennett [01:34:18]:
Absolutely.

Ken McDonald [01:34:20]:
I think I saw one where Linus from Linux Tech Tips, or Linus Tech Tips, said, I'm not going back to Windows.

Jonathan Bennett [01:34:34]:
Yeah, interesting.

Rob Campbell [01:34:35]:
I think we should start every show by saying, I apologize in advance for all the names we're going to butcher on here, that we can get that out of the way.

Jonathan Bennett [01:34:43]:
Yeah, there you go. Just have a blanket, make it part of the show description.

Ken McDonald [01:34:46]:
I thought we did.

Jonathan Bennett [01:34:48]:
Make it part of the show description. Our 4 hosts are from the middle of America and they don't know how to pronounce anybody's names.

Rob Campbell [01:34:56]:
Deal with it.

Ken McDonald [01:34:58]:
That's not— well, we know how to pronounce them the way middle Americans do.

Jonathan Bennett [01:35:05]:
Indeed. All right. Well, that is it for the stories. We're going to take one last quick break and then we're going to come back for some command line tips. I know we have some fascinating stuff this time around. Don't go anywhere. We'll be right back. All right.

Jonathan Bennett [01:35:17]:
Let's get into, let's get into some tips.

Ken McDonald [01:35:20]:
All right.

Jonathan Bennett [01:35:20]:
Rob's up first. What is DNS Globe?

Rob Campbell [01:35:24]:
So DNS Globe is a tool you might want to use if you say you're changing DNS and you want to like monitor the propagation of your DNS to see if it's getting everywhere. So I'm just going to show this is a Rust-based TUI. And here I have, I'm just searching my URL that I tell everybody about every week anyway, robertpcampbell.com. Anyone can look this up. So anyway, here's the A record. It looks up, I can't remember how many, but that's a whole bunch of resolvers, Google DNS, Cloudflare, Quad, Cisco, A whole bunch of them. And it tells you when's it expiring again. So if something's not resolving correctly, you may just have to wait for that.

Rob Campbell [01:36:16]:
You can see how long you have to wait for that to expire for it to hopefully pull the right IP the next time. And then you could tab over the AAAA record, CNAME records, MX records are especially useful if you're doing an email migration. NS records, TXT records, authority records, SOA. So yeah, just a simple way, and it's got a little globe over there that's rotating. I also found this does not display correctly if you are just in a Non-GUI console. So it does not work for that. So I had to run this different spot to, uh, in a, on a desktop to show what it's supposed to look like.

Jonathan Bennett [01:37:13]:
You know, Rob, how we were telling you the other day that your audio was getting a little weird? Your audio just got really weird in that last sentence. You totally dropped out.

Rob Campbell [01:37:22]:
So blah, blah, blah, wasn't important probably.

Jonathan Bennett [01:37:25]:
You're back now, but you got a loose connection or something going on there. You're back. Anyway, we will move along and we're gonna let Ken come up next. And Ken is gonna give us the complete package.

Rob Campbell [01:37:42]:
Boy.

Ken McDonald [01:37:43]:
Well, I'm going to tell you about a built-in Bash command.

Rob Campbell [01:37:51]:
Complete.

Ken McDonald [01:37:51]:
Now it lets you map user-defined inputs, files, directories, or custom function outputs directly to a command when you press the Tab key. Let me go ahead and bring up my terminal. There we go. Let me resize that a bit so you can see it a bit better. Is that big enough? Yes.

Jonathan Bennett [01:38:15]:
Yeah, it looks like it.

Ken McDonald [01:38:16]:
There and one more. But Jeff actually gave an example of what this command does back in episode 577 when he was actually talking about the MKFS. You probably remember Jeff telling you could type MKFS and then tab tab or tab And it would give you all the formats that you support. Well, that's using complete, believe it or not. To get a better idea of how you can use complete, since it's a built-in, you type help complete, and that gives you a very quick summary of how you use it and some of the commands. And as you can see, looking up there— let me put that back— you've got a whole bunch of options that you can put in. One for doing an action, one on how to treat a glob pattern, how do you set up a word list, And a function. In fact, let me go ahead and give you a simple demonstration of doing it.

Ken McDonald [01:39:40]:
I'm just going to create a one-line function called deploy, and all it's going to do is echo deploying to number 1. So that's created. But if I just run it as is, That's all it does is deploying to. But what you can do is— because if you just do a tab tab— oh, I've already got it set up. It does that. And the way that's done is by adding the command Complete -w deployment, development, staging, production, and deploy. And, uh, another one is a goto, which I've already set up the, uh, function. I'll go ahead and paste that in so y'all can see what it is though.

Ken McDonald [01:40:50]:
But that's the, uh, function, just a one-line function. cd home projects or slash whatever you put after that, or return. And the, uh, complete command is complete -d, in other words directory, and then the command goto. So let's go ahead and I'm just going to type goto If I just hit Enter, it takes me to that projects directory. If I tab, it lists all the files within there, and I can, for example, copy Kindle book, put that there, and then it takes me there. Now, another one I did is view_pdf, or view_pdf. And let me clear this so back up at the top, making it easier for y'all to see. And I'm using— have, uh, creating a function where it's, uh, using open xdg-open followed by whatever you give it.

Ken McDonald [01:42:11]:
Now the complete says to list files. The dash capital X tells it to exclude anything that's not matching this glob pattern, splat.pdf for that. And since I've already got that set up, If I just type u underscore— ah, underscore. Now you see why I was copying and pasting a lot of that.

Jonathan Bennett [01:42:45]:
Mm-hmm.

Ken McDonald [01:42:46]:
I'm less likely to make those typing mistakes like that. There we go. Giddy up. And just typing that by itself does that. But if I tab, it enters the only PDF file in this directory. Now, what do you think is going to happen when I hit enter?

Jonathan Bennett [01:43:14]:
Uh, it'll open up the, uh, it'll open up the PDF using XDG, which if you're SSH'd into that machine, that might not do anything. Oh, hey, look, you're not SSH'd into that machine.

Ken McDonald [01:43:24]:
Nope, it's actually, uh, on my— the same machine that I'm, uh, podcasting from. It opens up the application that I use for PDFs, Ocular, and opens that file in it.

Jonathan Bennett [01:43:36]:
Nice, very cool.

Ken McDonald [01:43:39]:
If you do develop, uh, programs and you— that are meant to be run at the command line, you would use complete to set up the options for that. In fact, one last bit of information is you can use complete space dash. I need more light behind my keys.

Jonathan Bennett [01:44:08]:
We need to get you a fancy RGB keyboard, eh?

Ken McDonald [01:44:11]:
Well, one where the keys— it shines through the keys instead of just around them. And this lists all of the completions that you've got set up for various commands. Like, did you know there was one set up for— let's see if I can find it— FTP?

Jonathan Bennett [01:44:39]:
I've seen— yeah, I've seen that that works. So what's— what do you— what do you do to list all of them? Complete -l?

Ken McDonald [01:44:45]:
P, lowercase p.

Jonathan Bennett [01:44:49]:
There you go. I'd like to play around with that. I've got at least one command that does not have any autocompletion in it, and I kind of want it to.

Ken McDonald [01:45:02]:
Without it, if you tab by default, it usually ends up doing just listing your local directory.

Rob Campbell [01:45:09]:
So what I got a blank screen when I did Your machine doesn't have any autocomplete in it, apparently.

Ken McDonald [01:45:19]:
How about you, Jeff?

Jeff Massie [01:45:22]:
Oh, I didn't type it.

Jonathan Bennett [01:45:24]:
Rob is incomplete.

Jeff Massie [01:45:28]:
All right.

Ken McDonald [01:45:29]:
No comment.

Jonathan Bennett [01:45:31]:
Jeff, you want to tell us about your command line tip?

Jeff Massie [01:45:35]:
Yes, I actually, I'll give you 2 tips. So Ken, you can actually, Especially if you're on a keyboard tray, you can get little tiny, uh, LED lights that plug into USB that you can put right up above your keyboard tray and it lights up your keyboard from the top. So you don't even have to have an RGB keyboard. That's what I do with mine.

Ken McDonald [01:45:53]:
That's what I need to look for. Yeah.

Jeff Massie [01:45:56]:
And they're like a couple bucks and they just plug into any USB port on your computer. You can power them with little phone chargers or whatever.

Rob Campbell [01:46:04]:
My ring light on me lights up my keyboard just fine.

Ken McDonald [01:46:08]:
So should I get it now myself or drop hints for my birthday in October?

Jeff Massie [01:46:15]:
Okay, so my command line tip is uv. Now, the goal of uv is pretty simple, and I'm not going to go into a whole bunch of switches or options, but it's to provide one extensive, extremely fast tool that handles many of the common Python work So it's written in Rust, which makes it notably faster than many traditional Python package management tools. And in some cases, operations that previously took several seconds can complete almost instantly. At a high level, uv can create virtual environments, install packages, manage project dependencies, and even handle multiple Python versions. So instead of remembering a collection of different commands from different utilities, Developers can often do everything through a single interface. It has a pip command— a pip, P-I-P, compatible interface. So things also can be more familiar if you've already got muscle memory or you've already got a lot of scripts that rely on pip. Now, it should be noted that UV does not actually invoke or rely on pip.

Jeff Massie [01:47:24]:
It just has the same— it can handle the same commands. Think of it like a modern toolbox that streamlines some of the more tedious parts of Python development. So if you're not a Python developer, UV is probably not something you're going to want to worry too much about. But if you are a Python developer, this could help you out quite a bit. If you want to give it a try, installation is straightforward. The article linked in the show notes has a ton of different ways it can be installed. But, you know, Flatpaks and other repositories, tons of ways. I'm not going to go into all the command line option support.

Jeff Massie [01:48:04]:
It's a very long list. So the article linked in the show notes has a lot of details on how to use UV depending on the specific thing you want to do. And when I mean A lot of details. I mean, it's an organized document. It's not just one page. It's not like a man page. It's, oh, what do you want to do? You click that subsection, you open it up, and then it gives a ton of examples and talks about using it for those specific tasks. So it's, it's beyond just a quick little man page thing.

Jeff Massie [01:48:38]:
So the next time you find yourself setting up a Python project on Linux, take a look at UV. It probably won't change what you're doing, but it might make the whole process significantly faster and a lot more convenient. So happy programming.

Jonathan Bennett [01:48:53]:
Yeah. All right. I came across an app this week. I was needing to manipulate some CSV files, and I did not end up using this. I did it with just a sed command, I think it was. But this was the next tool I was going to reach for if I couldn't get done what I need to. And that is Miller. And you run it with MLR, although it's pronounced, of course, Miller.

Jonathan Bennett [01:49:18]:
And the website is actually Miller, M-I-L-L-E-R, but MLR is the actual application. Hey, looky there. There's a package on my laptop. There's a package Miller to install that provides the command MLR. So it is ready to go on a lot of distros then. But essentially what it does is it pulls apart comma-separated values and then lets you manipulate them however you want to in a whole bunch of different ways and then put them back together and output them to like standard output either as a CSV, you could do tab-separated output, you can then if you want to, you can repackage it as JSON, you can sort, you can cut, you could do all sorts of things with it and then of course you can It's a Unix tool. You can pipe it, you pipe other tools into it, you can pipe it out. And so if you need to do anything with CSV, but also it looks like it will, it'll do TSV, JSON.

Jonathan Bennett [01:50:22]:
Looks like it also can take in and put out YAML and DCF. So lots and lots of tools here, sort of a Swiss Army knife for it. fiddling with structured data in this way. So yeah, probably a tool to put in your toolbox for doing data manipulation, particularly with comma-separated values.

Rob Campbell [01:50:44]:
Some of those conversions, like, sounds like you could take a CSV and make it a JSON or—

Jonathan Bennett [01:50:51]:
Yeah, in fact, they've got a little— I think the link is to the 10-minute intro And yeah, they've— one of the examples that they have there is that you can take a .csv and get a JSON out of it. And it looks like it works pretty well. So super, super cool stuff. When you need it, it's what you need.

Jeff Massie [01:51:14]:
Cool.

Jonathan Bennett [01:51:16]:
Yeah. Alrighty. That is it. I'm going to let each of the guys get in the last word if they want to. Jeff is actually up first. First, we're going to get our dose of poetry to start out. Jeff is muted. No poetry for us.

Rob Campbell [01:51:33]:
He's miming it. Miming this one.

Jeff Massie [01:51:36]:
Yeah, I guess you can't mime a haiku. Okay. Lesson learned. So yes, poetry this week. To have no errors would be life without meaning. No struggle, No joy. Have a great week, everybody.

Ken McDonald [01:51:52]:
All right.

Jonathan Bennett [01:51:55]:
And Ken?

Ken McDonald [01:51:57]:
Well, I came across this article that Bobby Barsolf wrote, and he published it basically about marking the 25th, 27th anniversary of System Administrator Appreciation Day. Which happened to fall yesterday. It's the last Friday of July every year. So hopefully we gave the people responsible for preventing the digital world from collapsing a thank you yesterday instead of another urgent ticket.

Jonathan Bennett [01:52:35]:
Yeah, thank you.

Ken McDonald [01:52:36]:
But I've got a link in the show notes. Go ahead and read the article, and I hope you enjoyed it as much as I did.

Jonathan Bennett [01:52:42]:
Thank you, Sissett Men's. And Rob?

Rob Campbell [01:52:45]:
All right. So besides my normal spiel I got going, I got something else. It's more of a teaser of something to come. I am in the process of, well, the book has been written and now it's just being reviewed and looked at before it hits publish. I'm thinking probably early, what month is it? September. Um, there'll be a new book available called, uh, Trailer— Trailers to Technology, uh, Leader.

Jeff Massie [01:53:20]:
Um, paint-by-numbers.

Rob Campbell [01:53:21]:
Yeah. And, um, if, if you want to, uh, follow me and be, uh, ready for when that book comes out, I'll definitely have it posted on social media. The way you can do that is to go to robertpcampbell.com and you go to my LinkedIn, my Twitter, my Bluesky, my Mastodon. And I mean, you donate me a coffee here at this coffee cup, that's not going to, uh, get you any, uh, information about the book release, but, uh, I will have that on there when it is released. It will be available on paperback, Kindle, hardcover. And, um, maybe I'm thinking about it later this year, maybe audio. I, I don't know about that. That's, that's, that's another undertaking that's beyond already where it's, where it's work that's been done on it.

Rob Campbell [01:54:16]:
So maybe I will, maybe I won't.

Ken McDonald [01:54:19]:
We'll see.

Rob Campbell [01:54:20]:
Um, but anyway, uh, follow me and keep up and, uh, Maybe there'll be a book for you to check out.

Jonathan Bennett [01:54:28]:
Interesting. Sounds cool.

Rob Campbell [01:54:30]:
All right.

Jonathan Bennett [01:54:31]:
Thank you guys for being here. I appreciate it. Thank you very much. If you want to find more of me, well, there is Hackaday, and that's where FLOSS Weekly lives these days. I normally have the screen behind me pulled up to show you the link to Hackaday. And for whatever reason, it has gone to sleep on me. But, uh, you can, you can find us there. And, uh, appreciate everybody that is here, whether you watch, whether you listen, whether you get us live or on the download.

Jonathan Bennett [01:54:58]:
We sure appreciate it. And we'll be back next week for another Untitled Linux Show.