Okay. This is the uh this is the
Wednesday, December the 11th, 2024 general meeting of SLU, the St. Louis
Unix users group
Tonight, our first speaker.
is Lee Lamert of Omnitech Corporation.
And he's going to talk to us about GCE vulnerability scanner.
After that, we'll have a talk by Tom Clark.
On…
Distrobock. Distro box will be Tom Clark's main talk.
Coming up later this evening.
Turning it over to Lee.
All right, Gary. Thank you.
presentation started here.
And…
There we go.
All right.
what three or four years ago
You know, we had clients that had
we support and we support
in the SMB, SME space.
You know, nothing fancy.
And I was looking for a way to
scan their networks once a week, something like that.
Just to see if there's anything on the network that shouldn't be on the network.
And so I stumbled across the green bone
vulnerability scanner.
And I was pretty impressed with it, but using it for about five years now.
It's well supported. It gets regular updates.
So I wanted to show everybody else how to do it.
And it's actually
fairly trivial to start
to start off with, it is open source it is free.
It uses the open bass open vulnerability assessment scanner
Anybody that's in security knows that a scanner is just part of the process. It's used to identify possible
vulnerabilities within
machines or systems on the network.
and or identify machines that shouldn't be on the network.
I'll show you some examples of that as we get going.
But there are a lot of other pieces of the security puzzle, and I don't mean to imply that a vulnerability
that a vulnerability scanner is the only piece you need to worry about.
Just that it's a pretty important one. It's fairly simple to run.
And it doesn't take a lot of effort to maintain.
and it provides a benefit because if somebody
as something like an old XP machine that actually comes up on the network
And that happens, somebody happens to use it to go out on the web
whole building could be compromised.
So what we're talking about here is the scanner is basically
identify security weaknesses.
Like I said, we're in the SMB SME space, so it fits pretty well.
you know we've probably got
I don't know, 10 or 11 clients around town where we set it up.
And it just runs automatically. I set them to run every week. Again, I'll show you how to do it.
And it's also a great example of using Docker and things like that.
Why do you want to do it?
It's a good way to find those vulnerabilities
There are a lot of compliance that you may get involved with. GDPR over in Europe, HIPAA over here.
I'm not sure how it plays into PCI. I haven't looked at that in about 15 years but
The whole point of a scanner
PCI is very much a thing.
Dig in.
PCI is very much a thing. I'm dealing with this at work with a different scanner.
Oh, yeah. Yeah. Well, like I say, I know it's a thing, but I haven't
haven't dealt with it since I was hosting uh credit card
processing in-house
And I gave up on that once I gave up on that.
Once PCI finally hit
And the credit card company said, well, you got to have this 30-page report done by, you know, before we renew your agreement at the end of the year. And I said, heck would I just went to Stripe.
GCE is also
an excellent fit.
in the world of open source tools, everybody here knows about them. I'm certain.
But it's amazing how when they talk to a client
and try to educate them a little bit
without totally blowing them away
they realize that, hey, yeah, there might be some benefit to having a tool set here that's well supported
gets updated regularly.
It uses the global database of vulnerabilities with a couple of caveats we'll talk about here in a few minutes.
It is very cost effective.
And it is very user friendly because it's been
some of the updates here in the past few years have greatly improved
the user interface.
GCE, again, GCE is the Green Bone Community Edition.
It is a comprehensive vulnerability.
scanner and detection.
provides decent reporting.
And allows you to send emails and things like that if you happen to hit
high priority vulnerability.
It is updated regularly, although we'll see here in a few minutes. It is not as fast as the commercial version.
So they say anywhere from two days to a week or so behind
the commercial product they put out but you still get a
And most of the stuff sitting on the network isn't of that high a priority that you need to worry about those two, three, four, five days.
the chance of a zero day hitting is pretty small in an organization with 10 or 15 computers.
and let's say community supported
It is defensibly the first step in security policies no cost
open source.
Green bone has an excellent reputation.
We've had a couple different presentations on this before.
Although…
most people using it use it as part of a larger tool set like they've got Kali Linux running on a VM in the operation.
That's a great environment.
But there's a heck of a lot of time there.
that takes to manage it, to run the updates.
And for that reason, I've never even really played with Cali that much. That's why I like the green button because
I'll show you how to set it up in Docker.
And it'll run on anything, anything Linux, I should say. I have no idea if they have Windows versions of the containers.
A lot of people consider it a benchmark for assessment tools
Some people criticize it for requiring technical expertise to operate effectively.
But I would propose that those windows complete that those people complaining or the windows users that don't know anything
about anything other than flicking a mouse.
GCE is widely used across the globe.
frequently referenced. I'll put these slides out to Stan and he'll get them up
posted next week.
We talked about the database.
The user community is gangbusters.
Like I was saying, the changes that are made in the last couple of years have been
an order of magnitude better than it was before that time.
You can also run in any environment.
Simple deployment.
Everything is automated.
And I run a crown job once a week.
force updates on the feeds.
All I do is once a month
I don't even have email set up yet because it never really found a serious problem, but I just go in once a month and look at the scan, see if there's any high priority vulnerabilities.
As I mentioned before, there are two different additions, the community edition gce
open source community supported
You pay a penalty on the feeds
So a few days to a week or so.
delay. If you have a higher priority, if you have uh
PCI requirements or HIPAA requirements
where you need to take action immediately
then you need a commercial product.
GCE, again, is scanning open source
You could run it. I'm going to show you Docker. You can also run it in a VM, or you can build an appliance for it.
Reporting is basic.
There aren't many third-party integrations and no customer support
Although the community
is pretty good about people that will answer questions.
GSM, Green Bone Security Manager, on the other hand
Is enterprise grade commercial licensing?
You can have any kind of appliance you want, hardware or virtual
It provides good scalability, extensibility, comprehensive tools, and they will even give you a service level agreement if you want to pay for it.
All right, let's get started.
it's not that hard to do.
Give me one second here.
And let's see, you guys have a screen here, black screen with a prompt.
Yep.
Okay.
There is one thing you want.
Basically, here's the link.
green ball github.io
there is a
Oh, that's the docs.
That's the doc. Sorry, that's not the docker compose
I'll put the link to Docker Compose up here.
So basically what I do is this is a docker compose that you download
It's all pretty straightforward.
really weird in it.
I just downloaded this this afternoon.
it creates a bunch of volumes for you.
And what I do is I just create a SIM link
to the current version.
Because when you run Dock Compose, it will automatically look for the Docker-compose.yaml.
And you're off and running.
And what was the passphrase needed for?
The new YAML file or the new Docker compose file
requires you to log in to GitHub.
are to Docker to pull the images. So I had to set up pass and that is my
passphrase on the private key that I set up with GPG.
Okay.
And it took him about a half an hour to set that up today.
That is a large Docker compose file. This seems like enterprise grade something, something here. You got Redis and everything.
MQT ESR.
Yeah. Yeah.
Let's see.
Let's jump out to a live machine
There are six
containers running all the time.
two or seven rather
two, four, six, seven.
Notice that these are all live green bone containers.
This particular version has been up for three weeks.
Here's another one.
That's interesting. One of them has six and one of them has seven.
It's not that uncommon.
bar them to break.
I never bothered to figure it out.
All I did is run an update.
This is the update script.
Like I say, I run it once a week or if I notice something's crashed, I'll just go in and
and look at it and run it manually.
Here's a docs for feed synchronization.
The docs are excellent.
I can't say enough about him.
tells you everything that's going on. And like I say
A lot of this documentation has just been published in the last couple of years.
I don't know if there's new people on the team or people are just getting around to filling in the holes.
But, you know, it's fantastic. I can't say enough good things about it.
And this guy is running here locally.
And let's see, where's my browser?
This is the standard URL.
Jeez.
GCE runs on local port 9392.
if you were running a remote machine.
that might cause you some concern, but I'll show you in a minute here a trick that I use.
I don't even bother with it.
Let me find the right one here.
I'm sorry.
This one doesn't have the authentication yet i didn't
set the password.
Let me go ahead and kill that.
what i do what i do
is I have a list of
reverse tunnels set up
And whenever I want to talk to
a client either a client either
router, our GCE.
like here's the penny that we were just looking at.
I bring up that reverse tunnel
And I go out and i go out
93, 92.
And this is the actual live one of one of our clients.
It used to be you had all kinds of, or the UI was basically splattered across the top here.
And it was a lot of these
topics were buried in the menu system and it was just kind of ugly
But now, you know, it's i mean
I like it. The last
The last few updates here this summer have just
improved a lot of it.
The whole idea here is you set up a
task, a scan you want to do.
This is internal network.
There are different ones. It's the default open bass scanner.
Falling fast.
All assets, schedule, it runs Wednesday.
one o'clock in the morning.
Or 5.30 a.m. rather.
took 91 or 21 minutes last time.
And let's see, internal network. Here's the definition of internal network.
They are 192.168.1.
Gerald slash 24.
to our 54 hosts.
all GCP ports.
Yeah.
the ion assigned ports to me is a significant subset
of the 65,000.
K possible.
And also, would you…
speak to the difference between OpenVAS and green bone. It seems like OpenVAS is a component
behind green bone.
OpenVash is a different component of the green bone community environment.
Okay.
That is the scanner used by
the green bone system.
Okay. Anybody else?
Sure.
You know, it's not every port
every one of them that
people care about.
Yeah, it goes up to 49, 150.
And like I say, every time it runs.
I keep 90 days.
So here's the one december 8th.
There were some hits here.
And…
You can look at the scans, see what
If they completed, like here's a couple that didn't, or let's see, there were none here
These all finish. Once in a while, a scan won't finish for some reason.
scans an internal network.
These are the results in the database.
One of the issues that
I haven't figured out yet.
when you see a result, the first thing you have to do, here they're listed by severity.
You need to go over and look at the date.
the results don't disappear
or don't get purged when you purge the report.
In other words, the oldest report here
is September 19th, but yet results go all the way back
to July.
Which is weird. Man.
But, you know, like I say, it's a minor problem
all of these 7.5 results
Most of them are old.
And there's something weird going on.
the Shamba installation on this server out of all the ones that we scan.
Because this is the only one that complains.
about these vulnerabilities.
If you need to look at vulnerabilities, there's an entire database here.
Here's the assets involved in the scans.
Any idea how big the vulnerability database is? How many bones it'll check for?
Uh…
And let's see here.
I'll try to move this.
there's 58 that were hit.
In other words, 58 had positive results.
I would interpret that as…
I'm not sure I know, Grant.
Okay.
As far as I know, it's the entire feat.
Yeah, I'm just trying to roughly quantify some of the ones I've worked with
before it's like five to 10,000 different things, it will check
each time or can if you tell it to.
I was just curious how
Many, how big its corpus was.
That is a good question. Somewhere down here should be
Okay, here's NVTs.
But these are only
Yeah, I'm sorry. I don't see these
I don't see any…
These are all hits. These don't tell you how many are in the database.
Number.
So you're certainly getting
reports on things that you would not know about if you weren't running the scanner. So it's providing value.
All right.
And probably 70 or 80% of this I've never explored because basically I just want to see a scan against the database of vulnerabilities.
once a week that I can use to identify a problem should one exist.
Okay, oh.
Back down here in configuration, here's the schedule
You can see that the wednesday weekly
first run in February 2023.
Next run tonight.
runs every week.
And let's see, where's the time? Yeah, 1130 p.m.
Let me close this for a second.
And jump back and look at a different one.
This guy is…
This is one with two scans or two tasks rather
internal scan.
And Depot, these guys
repair like
handheld computers. They do Android stuff, but I'm talking about
They put out maintenance contracts and stuff that's 20, 25 years old.
And they'll keep it live.
Here you can see on the shelf up there there's
seven or eight handheld scanners here in the shop that I've worked on in the past.
they can fix them. They do component level repair.
Nice. Anyway.
in the depot
you know i get
high value vulnerabilities all the time
Because they actually have
a bunch of Windows XP stuff sitting on their network.
But it's not connected to the internet.
You know, these are dedicated devices
you know like here's Windows XP EOL detection
all right okay they got these are Windows 7. I've seen xp here also
Yeah, here's an XP, Windows XP.
Have you considered
exceptions
for some things for them. Like, yes, we know these are there. Don't report on this issue for this system.
It's a conversation.
No, because it just takes me
you know 30 seconds
every few weeks just to scan it.
And I can see these.
I know what the IP ranges are.
These are all DHCP.
It amazes me how they get so many alerts on a single IP. I haven't figured that out.
for the same vulnerability.
But the point
Are they different scan dates?
Looks like it.
Yep, you're right.
wanting to figure out how to purge the old ones.
Looks like there's 77,000 results in your database there.
Yeah.
And 103 individual vulnerabilities that have been found.
Yeah, gee, some of these are pretty old.
what is this guy?
Windows 10?
Yeah, something weird here in Windows 10.
Anyway, any questions?
I have a question.
that phrase correctly is something
weird in Windows 10 or is it just there's something weird here at Windows 10?
Stop that, Gary.
So the final.
All right. Yeah, go ahead.
The findings that it reports.
what kind of value
do you get from them as
the sysadmin or network admin
for your clients.
You know, for example.
They had some updates done.
Last spring. And let's see, I don't think that's in their database anymore.
are in the reports anymore.
I found a Windows 7 machine that alerted
when it shouldn't have been there because I knew it had been retired. It turns out nobody bothered to turn the darn, turn the VM off.
And if that had, if anybody had used that
in a internet fashion that opened an attack vector.
no telling what kind of damage could have been done.
So basically they told me where the host was so i uh
jumped over there and shut it down.
Okay.
All right.
Can you tell me whatever magic you're using in that remotes folder where you had all those things or is that a separate talk?
Oh, oh.
Please.
Yeah, what is this?
These are all like this guy here.
Fish, GC.
Oh.
It's reverse tunnel.
from…
This internal IP, port 9392
to 93.92 on my machine.
using this host.
Gotcha. So basically, if you go to that port on your machine, it's going to forward it to that machine. Is that what you're saying?
Right.
Is that with the dash capital L does?
Well, capital L is the reverse tunnel.
In other words, the forward tunnel would be to forward my port
referred by connection from here to there.
the minus capital L does forge
this port connection to my machine
So that when I go to this port on my machine, it automatically forwards back to the remote host.
Cool.
And this is what I use all the time.
You know, like we've got a a jump server
there's like 20 machines on 20 different ports on that jump server i can ssh any one of them.
In fact, this connection is actually a remote connection
Let's see, SD9A.
you know this is
the tunnel that gives me access to that machine.
if anybody would like a copy of this, I'll be happy to pass it around.
But on this machine
There are…
two files that are important.
check link is a crown job that runs every five minutes to see if the link is up.
And the config here is the one that
specifies where it's going.
description. So if I got an email when it restarts, I see it, that's where to send the email.
local port on that on the remote end
the target.
on Apollo, which is our jump server.
That's where the connection goes.
And then here's the physical reverse SSH command.
So are you running that on something like that on each of
your remote client
Right.
systems and they're linked back into something
at your location providing what it considers remote tunnel
So from your location, you hit the port and it goes
through the client side initiated tunnel.
Correct.
I like the rappers.
Yeah.
And I've also got a
Where am I?
Globalized ban.
I'm not quite following that. So you do this and then like
and then you run something against the port on that machine, but it's actually running against some remote host. Is that the point?
uh let me…
Back up a second. This is a remote machine.
down in Webster, not Webster Groves, the Grove down there by Shafley.
And…
the check link config on that machine
Hang on a second.
And this cron job
runs every five minutes. It does check link.
It looks to see if there is a
process to Apollo.
That's our jump server.
And if that process does not exist.
it'll restart it.
And I also have a reset link
Once a day it will actually reset it
take it down and let it restart.
Because sometimes links aren't stable. I don't need to use it here because this
You know, these guys are on fiber.
with charter and some of the other
services that used to exist like fiber like ethernet over copper or stuff like that
Yeah, I reset it once or twice a day
Just to make sure we keep the link up.
So this is a remote machine.
And this check link config
governs how governments how
the tunnel is set up from the remote machine back to Apollo.
So checklink sets up a reverse tunnel from this machine to apollo
such that when I SSH to Apollo on this port.
it automatically forwards
to…
Port 7722.
on the other end which
local host
D9 Archive.
And do you have SSH running on an alternate port or something?
Yes.
So would it be fair to describe this as
Yes.
you kind of have two halves
to the process where all your clients in the field
establish a remote tunnel back to a jump server
And then on your workstation in your office
you when you need it, USSH to that
remote port that the clients created and you can get all the way into the client
via the jump server.
Right. ISSH to the jump server
at this port, 65423.
In fact, if you remember that.
Does that make sense, Sean?
Yep, I'm following.
It's kind of two halves joining in the middle.
Yeah.
I think I've heard of a way to set this up using
SSH config as well, where it'll like forward the SSS agent or SSH agent along or something
Well, you can use SSH config to set it up as a jump server.
you know you can use a capital J
to say okay log into this and then log into another machine
But you have to have the reverse tunnel
Because there's no way to physically get past the firewall on that end.
Okay.
Because the local port
There, 772
is not opening
from to the outside.
Oh, okay.
That's why you have to have the reverse tunnel.
Gotcha.
And then this is
a line in my SSH config with 65423
So that when I did that command a while back, SSHD9A,
that link established to this link
on Apollo, which was automatically forwarded to 7722
on that remote hoax D9A.
Makes sense? Yeah. Blairs mud, right?
Yeah, that makes sense. Thanks.
Okay.
All right, anybody else?
All right. Thank you, guys. And I shall turn it over to Gary for the gooey middle.
Thank you very much. That was Lee Lamert from Omnitech Corp.
And he was talking about using the green bone uh
The GBC vulnerability Scanner. So thank you.
lightning little tutorial.
Appreciate it. Okay, we'll go to our main speaker in just a few minutes. But first, as Lee said, we're in that gooey middle.
So announcements. First announcement
Normally.
the new users log
would be next week on Tuesday.
And this month
it is being canceled for, as Stan likes to refer to it, it's the holiday schedule
So there will not be a new user's log meeting this month so
Everyone should come back in January.
But it will not be a December meeting of the new users log so
If I could pull up my calendar for a moment, I'll verify what that date is.
Yeah, that meeting was supposed to be Tuesday the 17th.
And holiday schedules, so it won't be
Until next time until next time
the January 28th meeting.
will be the next new user meeting.
Let's see.
other tidbits here.
I've got a point here.
There was a note in discuss that was from jay truesdale.
And he had asked
somebody, anybody to respond. He said that
He's playing with his cable modem and ran a speed test
He got 646 megabytes down and 384 megabytes per second up.
And he's wondering if anybody else
test it with upload speeds
with something other than OCLA's speed test
Nobody's responded. And come on somebody in our user group has to be uh
doing some good tests. Well, I got 453 by 419.
Okay. But that…
I got almost a full gig
Okay. What are you on?
charter spectrum. I have a doxus 3.1 modem
And they're gigabit ethernet. And I got almost a full gig on my upload.
Okay. Both ways, man.
Yeah, symmetric now.
Cool.
Okay. And Lee, I think Lee was about to say that he
he may not be your typical user since he's doing this test from inside the bat cave.
And has some nice fiber that AT&T
I actually got two of them. I got a gig for the office and 50 meg per direct. But no, the comment I was going to make is why would you use UCLA? This install speed test CLI.
Okay.
speed test and spell it again.
speed test hash CLI dash CLI. Standard package on every
Every district I've looked at.
And that way you don't have to have no freaking gooey
know a bunch of gooey.
a gooey would goo up in the middle of your speed test right now.
Okay. All right. We'll put some of those results out and reply to Jay's message. If anybody else thinks of any
Good feedback for Jay. Go to the discuss mailing list, please.
make a response and we'll try and type these in for jay
Okay. Let's see other uh
Other items. I don't think there's anything else I wanted to specifically announce.
Oh, holiday parties. Sorry for those of you who are out of town.
But every year there are
holiday parties, physical gatherings and different eateries and drinkeries around town.
So if they're open parties for techie people uh
used to be in the days before COVID, at least a few of them each year, and they're starting to reoccur again um so i believe
I think the last one I saw on the schedule is coming up on Monday.
And I'll double check that as we speak.
It is actually the Microsoft
holiday party
And it's the .NET and the Azure group.
And it's from 6 to 9 at four hands in the district. So for those of you who are
in the area physically and want to go to a physical holiday party
Next Monday night's the last one that seems to be open invitation to techies around town.
hosted by Microchet, Microsoft user groups.
So anybody knows of any other ones that are
just invite any techie by all means. Send editor at sleep.org.
the invitation and we'll put it on the calendar for people.
With that, anybody else have any
announcements that need to be made.
If not, anybody have any general questions? Don't have to necessarily apply to our topics of the evening, but
just things that they've been working on.
found a problem with, want to ask a question or make a point
I was curious if anybody other than lee and i
attended the OpenSSL
thing
a few weeks ago, I found it very packed, very dense.
And very useful. And I've already referred back to things.
Yeah, that was excellent, too.
Lee indicated it might be
good source material to do a presentation around
So if anybody did go or had questions about SSL,
related stuff, feeders for topics.
Yeah, I will get the link for the…
shared slide deck.
And I'll post it in the chat.
Excellent idea. Thank you, Grant.
Great.
Any other questions, comments?
After our main speaker there'll be
more time that people can use different
ideas and questions
For those who may not be able to stay around late, this is the chance.
Okay. In that case, I think we'll move on to our main speaker since we are running a little late.
So our main speaker tonight.
is Tom Clark.
Tom Clark's a freelance software developer.
He loves to tinker with things. Many of them
Not even programming.
We appreciate Tom coming in tonight tom had uh
I believe, given this talk or a variation of it.
at the 2600 meeting, I think.
So we thank him for coming and reprising it here tonight.
So he's going to talk to us about distro box.
With that, I'll turn it over to Tom.
Alrighty, let me go ahead and screen share here.
All right. Can everyone see the turtles?
Yep.
So basically everything we have for all of our technology, especially computers, is basically turtles upon turtles.
Versus when you start the computer, there's all sorts of little operating systems like say you have BIOS or UFE or whatever
That could maybe be your first turtle
The main turtle that we're going to deal with is we're loading into a linux host machine.
So that's probably this biggest
turtle on the bottom right there.
We're actually in the virtual machine already right now.
So let's go ahead and do a mute.
Can you bump that file all the time?
So…
What was that there?
Can you enlarge that font a couple of times?
How's that?
All right, so we can see our hypervisor vendor right here is kdm
So we are on a Linux host and machine using hardware virtualization through Linux kernel.
So we've already got
a couple of turtles here. We're on this turtle
Right now. And so let's go ahead and add another turtle by using distro box.
So the manual pages for DistroBox are
pretty extensive here.
You may wonder like you may wonder
Why do I care about using DistroBox though?
So it's kind of like a
Why though? I think you may have seen this meme before.
containers have a bunch of different types of runtimes. You have Docker, podman
Linux containers, LXC stuff, etc.
And why do you want to use DistroBox? Well, you can write a bunch of your own scripts to exercise things like Podman yourself.
and do all of the things that you want and integrate them with your host, like sharing the
graphics server or something like that.
Things like flat pack use have their own little things that bubble wrap that does a similar sort of thing. So shares a bunch of stuff.
So you don't have to like manually do those sorts of things.
DistroBox is basically a command line tool to
get any Linux distribution you want.
share all of those things. It shares like your home directory by default. It shares your graphics server. It shares
all your devices so you don't have to do that yourself.
That's pretty much why you want to use this robots. Why do you not want to use Distrobox?
For the same reason, it shares all of that stuff, right?
It's mainly giving you convenience more than anything.
And the manual pages
are…
Pretty straightforward on it. That's really all the documentation you need to get started on it.
It's a relatively new project. I believe like the first commits around like 2019 or something like that.
So mainly when I do programming, if I've ever had issues with conflicts between
libraries or like packages I don't need. I just have to spin up another virtual machine or like clone a virtual machine and
You know, that's a real hassle that takes a bunch of time.
DistroVox really simplifies that process to where you can get almost any distribution that you want.
Let's go for instance into
compatibility here.
So it sounds like most people are familiar with containers in general here. So any OCI image that you've
get from wherever
is going to be able to be used at DistroBox for the most part.
Even if it's not quite exactly supported, if it's close enough, like any Debian durian
For instance, is going to be just fine.
um and
you can just pull those in.
by either specifying the image specifically
Or they have a number of container distros built in that already have where they're going to be sourced from.
like clay.io or you know uh docker hub etc
Now, one that is going to
not be in there is going to be Nick's
I heard that mentioned a little bit earlier.
are liking immutable distributions.
And the two main ones are OS tree based and Nix-based.
Now, Nix as a guest is not supported.
And they're suggesting that you use
A few other tools if you really want to be under Dix and then have Nick's guests.
Now, Nick's, of course, supports it as a
as the host so that you can leverage everyone else's
distributions whenever you're inside of nix and so
Even though you're on Nixon, you know, you can have access to the entire package manager of
Arch or Debian or whatever.
So that's really convenient.
So let's go ahead and start with our first commands here.
So DistroBox LS is…
going to list what we have, which is absolutely nothing at this point. Let's go ahead and create one.
Let's just do Debian, for instance. And you can specify which image you want
So we could do Debian latest, or if you want to, you could specify like 10 or any specific version
It's going to pull in.
So let's go ahead and create that.
um
I forgot one thing.
So that's created. It already had the image local, so we didn't have to pull anything in. So let's go ahead and turn into it.
So what is it doing here?
It's making sure that it has all of the
things installed that it needs to install it
share the container
with your host operating system essentially
And it doesn't normally need to do this on every single startup. It only does this when we created something fresh like this from
a very minimal image that it pulled for Debian.
It takes just a little bit, not too long.
Okay, so we're inside now. So it set it up, all the packages it needs, you know, it shared all of our devices. It mounted
the file system, et cetera, home directory, blah, blah, blah.
And then it's set up so that we can you know
do rootful things within our container.
Now, by default.
This is not going to do rootful things.
inside the container that affect our operating system itself. So if you try to go to
some sort of file and do something
even using sudo inside the container, it's not going to work.
There is a special flag for that.
So if you go into distrovox
To create.
Now, here is where you're going to specify that
It could have root.
that reaches out to your host operating system, which usually you don't want.
And pretty much 100% of the cases for my use case, I don't want that.
So now we're inside Debian.
the host operating system is the system is
So…
fedora.
I couldn't.
Okay, so we are on Fedora 41.
In our host operating system, which is in a virtual machine.
And now we are inside our Debian machine. Let's go ahead and do that.
There we go. It says Debian.
Let's really make sure it's Debian.
Okay, there we go. Now we're pretty sure it's Debian
Since we have an app now and you can move with us
um
I'm sure everyone's seen this before. It's like been around since like the 90s
Any questions so far?
All right. One thing that people kind of get hung up on is the difference between virtual machines and containers. It may not be
This group in particular but for instance.
Even though we are inside this container, let's see what kernel that we're using. We're still using Fedora.
um so
Some people get hung up on that thinking that somehow
we're going to be using a different kernel which should be
you know the they
virtual machine type swap out there. It's going to use a different kernel and then directly communicate with the hardware.
Whereas then we're in the container so it's going to
communicate with the kernel and everything else is sort of
get routed through the kernel that we're using.
most of the time that isn't a problem. But if you diverge too much, you know, something could eventually become a problem there.
One of the use cases for this is
Is everyone familiar with like flat packs and snaps, I'm assuming, with this group?
no nays there. So I'll take that as a guess.
Um.
So whenever you look at snaps and flat packs.
like there's a lot of sketchy stuff posted there
that's not verified at all.
So you might not be comfortable downloading that. Like say Signal, for instance.
Usually if you're using Signal, you value security and
some type of form. So we go to flat type here and we look at signal desktop that comes up.
someone has put it up here, but it's completely unverified
So it's just random people doing it. They may be completely fine people and there's nothing in there that's like a Trojan or anything.
But, you know, it's kind of sketch and you might not want to put that on your machine and use your actual signal through it because it could be scraping, whatever.
Also, if you prefer snaps rather than flat packs
You go over to Snap Store and it's like, okay, well, it's a snap crafters. You know, they have
a decent reputation that they're trying to build, but you still may not be comfortable with that.
Whereas, you know, whereas the
signal people themselves have a
Package for package
signal desktop for Linux. But the problem here is we're on Fedora and it's like
Well, you look at this and it's like, oh, well.
This is for Debian. I don't run Debian. How am I going to use this? You know?
Well, you could, you know, build something yourself and then make your own container and all sorts of things like that.
Or since we just created
a Debian container extremely easily with very little hassle. It shared everything with our host.
Well, let's just copy and paste this and install signal.
You know, saves you
a little bit of time.
There we go.
So you're in your Debian
container there, right? Is that the idea?
Correct. And one of the funny little things, because it's called DistroBox, whenever you go into
one of your containers on the command line, it'll have this little box right here that you can see.
And then it also says, you know, whatever user at, you know.
your container so
I just like the box. The box is a nice touch right there.
So now this is running out of the container and we have signal
available inside fedora now with very minimal fuss. We didn't have to build any containers ourselves, compile anything, any of that nonsense.
It's just there for us.
Now, one thing to note is it's only available inside the container.
So say we go out into our main operating system here. I'll make that larger again.
There you go.
note that we are inside the Debian container right now.
we go into our main container, we're in Fedora, and we type uh
Signal desktop
Can't type today.
It's not here. Or signal. Oh, nothing's here.
Right.
DistroBox has a really easy way of solving this problem for us.
is disturbox.
export to app and then signal desktop
All right. So it says applications you know exported, wait a few seconds, et cetera.
Is everyone familiar with the desktop files for everyone
Or the…
stuff for the GUI probably.
Vaguely.
Okay.
Are those files different depending on what DE you're using or is KDE and GNOME using the same files?
they use like the same stuff. It's kind of kind of standard.
So we're inside right here there's also
I'm in Sway right now, which is
on Wayland. I used to use I3 on
x and x and x
So anyway, that's why it might look a little different than I3 but um
there's two different types of runs here. There's run and de-run, and that's basically the difference between
doing a run and a D run on a particular application.
So right now it only exported the desktop file because this is an application. So that's why it's only coming up with an entry here for DRUN.
Let's go ahead and do that. Okay, now.
we started that on the main operating our main
host system inside this VM.
We just did it using the little command line launcher there.
So we can do it here as well.
Maybe that's not refreshed yet.
Not sure why that's having an issue.
sounding fine there.
Well, that's not refreshing for whatever reason. Look into that later.
So we are outside of the container now since
you know, you can just do a control D and go outside
And right now, that's our only two containers.
Now…
Say you want to upgrade all your containers at once. They have easy command for that.
DistroBox upgrade right here is what we're looking for.
So let's go ahead and snap here.
So this makes it
assuming it's fully supported, it will automatically call your package manager and upgrade anything that needs upgrading for you.
Which is very helpful and easy to manage all of your containers with.
It's like a shift in here.
So that shouldn't even be possible that Sean T said. What was that in reference to?
There shouldn't be an option.
I was talking about the dash dash route option there. That shouldn't even be an option you know it's like
It's like that log4j vulnerability that was really big, what was it earlier this year or last year or whatever.
Mm-hmm.
Where it's like, hey, this logging library can all of a sudden execute arbitrary commands. It's like that shouldn't even be a feature.
And I feel the same way about this dash dash route. Like that shouldn't even be
Because that's just an attack vector, right? It's like it shouldn't even exist
Well, there's two different ways to look at that. One is you could actually run the DistroVox container itself, like run distrovox enter as root itself, you know, sudovox enter, etc.
And that is even worse than running
something like creating a distro box that has the root access
embedded into it. It's not going to automatically let you do things. There's still like a block on it. It's not going to like automatically just let the container do whatever it wants.
to any file that would require root.
So it's probably not as bad as it sounds.
They just kind of leave that trap
door in there just in case you have like some sort of weird use case that needs it.
Right, because it's still only you're still inside the container, you're still only going to have access to whatever's mounted, right? And hopefully…
Mm-hmm.
they're only mounting like your home directory and things in what probably like sys or something for like usbs and stuff
But hopefully they're not mounting much more than that, right?
Yeah, they're not doing too much there. And one thing to note is it's an opt-in.
So like, say you're talking with Log4j where you could
arbitrarily embed something into a serialized object. And then, you know, whenever it's deserialized it you know does stuff um
Yeah, that there wasn't really like a way to opt out of that if someone would abuse that.
Here you're very deliberately opting in to being able to do that so
that's kind of like a different kind of like a different
situation i think i could
you know, you know what I'm saying?
Yeah, that's true.
Bye.
You have to very deliberately shoot yourself in the foot. It's not an accidental shoot yourself in the foot.
You say that yet I'm looking at notifications from Gen2 security
And the first message was distro box
arbitrary code execution.
That's interesting.
kicked out earlier today.
to take a look at what that's about.
Seems to be version
1.7.0.1.
I'm just wondering like where the…
injection of arbitrary code happens at exactly like is it you already have access to your host machine as if you're using DistroBox normally or is it something like
a malicious container somehow does something or, you know, that sort of thing.
No idea.
That'll be interesting to explore after the talk, actually.
Has anyone else used user mode Linux kernel as in user mode to run a different kernel inside the containers.
I do not think so.
That would be something fun to explore.
And then run versus derun. Explain that one already.
Oh, and then someone linked the…
CVE here for us to go look at.
Looks like it was back in March. So it's pretty old.
Oh, it's probably fixed already then.
What was it exactly?
Um.
Let me find…
Because what I'm looking at looks to be something brand new.
Yeah, go ahead and link it in chat if you don't mind.
I'm dealing with VNC and multiple things and multiple nesting turtles all the way down.
I didn't have to bring things across.
While we're going to pause your time, it just occurred to me, does DistroBox support chain virtualization?
No.
I don't think so. If I'm understanding what you mean by that.
Yeah, basically, if you're running on a host with kd amersen
I'm a kernel than chain virtual
makes those virtualization functions available in
the VM or container.
But I guess you can do it in a VM.
I didn't know if there was something they can do in their style container.
I don't think so.
Okay, so it is what Sean linked to but
Gen 2 released something today about it.
Weird.
Maybe they finally integrated the fix or something. They're a little slower than uh
Maybe.
getting their stuff in there. I mean, March would be a little excessive now.
Yeah. I mean, just…
Murphy timing on your presentation. It looks very interesting going through email. It's like hey
security announcement for DistroBox.
The biggest security things for DistroBox would probably be its underlying runtime because
you can use say docker or podman or there's actually one called lillapod
I don't know if anyone's heard of that.
made by the creator of DistroBox himself. He made himself kind of like you know just a
proof of concept toy container runtime himself
And DistroBox, of course, supports it.
By default, it uses podman unless you want to opt into using one of the other runtimes.
So this CVE was arguments passed to exported binaries or interpreted by the shell. I like how there's a misspelling there.
on the uh on the
github issue interpreted by the shell and can result in unexpected behaviors and syntax errors.
So it's…
Not too bad one.
I think the commit I saw was like quoting dollar sign one was like the fix or something
Interesting.
Okay.
What's going on there? Okay.
That was a cap slot. All right.
So…
Back to DistroBox upgrade. Yeah, that's where we were.
So you can upgrade these all just en masse with an all flag or you can choose which specific
just a box that you want to upgrade at any given point in time.
We just created this.
So yeah, we didn't really have much to do.
So, but that's a really easy way to manage all your VMs.
I usually create or containers rather
I usually create a different container for each one of the clients or something I'm working in specifically. Like I have a different one that I use for rust versus something else.
So when you accumulate a lot of these, that can save you a lot of time and it's just really easy.
And then DistroBox stop. I think that one's rather obvious. We don't really need to run that one.
Distrobach host exec is really interesting. You can be inside the district box and
run a command on the host
I have not had a specific use case for that, nor did i find one
explained to me very well why I would care about that.
So Distribox is simple. That's an interesting one.
So Dr. Box has DistroBox assembled to where you can create a file that says, I want to have these sorts of things
in my
container by default, like additional packages and whatnot
I usually just run
my own file
for Debian or whatever, Fedora, I kind of just had my own files for shell files for what I want installed on them
By default, so I don't really find too much use for this file
Unless you want to take advantage of
more esoteric things such as actually giving the container root access to the host.
Or this NVIDIA flag is actually really interesting.
Let's go ahead and talk about that for a moment.
Does anyone do stuff with machine learning and like CUDA type stuff or anything like that?
I run Olama occasionally, but…
the API costs are so cheap on these cloud services that I usually end up using those instead.
Yeah.
It's expensive to get…
good cards that'll actually run fast.
That's for sure.
So by default, for all of your Intel and AMD sort of stuff.
That's all going to be passed in.
Without you having to do anything, there's this NVIDIA flag that will try to integrate the host NVIDIA drivers into
the guest container right here.
And…
Some people have difficulty with that, so they have to
pass even more stuff in for CUDA.
To be able to get that stuff to run.
That's just kind of like a heads up if you're
on NVIDIA hardware and you're trying to do stuff like that, you could run into some
interesting issues there. Since we're in distrobox create the manual page let's go ahead and
go over some stuff there.
I have the images of reusing pulled down already right now. So it hasn't been asking me.
But normally it would prompt you to ask, this is just a bypass for that, of course.
You can also clone from whatever image that you have.
In terms of versioning for the
containers.
it's not built in currently. So like you would need to
version a container yourself using podman directly rather than through the distro box stuff.
And maybe at some point they'll put that in, just pass it through or they may not want to because they don't like to really
duplicate what someone else is doing well, it seems like.
Now, since DistroBox by default does share absolutely everything uh
that it can.
Pretty close. There is an unshare all right here.
that will unshare basically
everything by default, except for it still has access to your home directory.
And that'll be about it.
And…
Whenever you do that, it won't be able to see any of the processes on its host or anything like that.
So I don't have too much occasion to use it since I usually just use it for development and I'm primarily using it to keep
having any sort of binary conflicts, package conflicts, that sort of thing.
But some people do have use cases for it.
It's all fine.
Let's go.
So here are some environmental variables that you can set. So if you just always wanted to pull images, you can set that and
It'll never ask you again.
Usually on my host that I actually use, I set that because it's like, yeah, sure. Why not pull the image right
Unless you're tethered to some sort of connection that
has limitations on it. Maybe you want to turn that off, but that's a very rare scenario, especially with Starlink being so prolific now.
And that's unlimited data.
Now you can set the host name and default container name etc
You can use different sudo programs. I don't mess around with that.
Perhaps someone else has a different preference there.
each to their own, right?
That's what the whole sort of unix
tight spaces about is about is
people can kind of go their own way. It's customizable, right? It's not forcing you into doing things a particular way.
Next.
sister box ephemeral. That's an interesting one.
it will create a container and a container
While you're in that, everything's good. As soon as you exit it, it destroys it.
Something that I skipped over that i should do.
is so let's go ahead and do this direct center.
Debian. So we're back inside of our Debian container because we've got our little
box there. It's not from Amazon, probably.
um
So that's our default working folder here. And what's our home?
Okay, so that's interesting. It shared our home right
There is a feature that we can use.
to have a different home directory.
So that…
we don't get our dot file stomped on.
And actually keep them separate.
I usually use that just to keep
everything separate so they don't get stomped on.
So let's go ahead and create one with that.
You're up a bit.
I think it's because you're inside the distro box, so you're trying to do like inception
Oh, yep, you are correct, sir.
I just can't have today.
I think you're going to want to call in between the Debian and the latest
Arrogant.
While we're waiting for that.
when you had talked about the
NVIDIA option uh saying
tribe for the NVIDIA. So if there are problems with that
where's the best way of
trying to resolve that. Is there good documentation from NVIDIA or
You have to search around through user groups
figure out what the necessary solution was to throw away the Chromebook, get a real laptop.
Mm-hmm.
So there's actually
Okay.
Wow, it really doesn't like you.
Yeah, I'm always on VPNs.
AIs are getting smarter all the time.
Okay, we're done with that.
So.
There we go. Thanks, DuckDuck
Quack.
So there's a…
So there's a lot of
useful tips here. This is just like the start of it of doing all sorts of weird things that
most people don't really have too much of a use case for.
And then down here
Yeah, so most of your NVIDIA stuff will probably work fine with the NVIDIA flag. But if you start doing CUDA stuff, you may need to get
their stuff and then, you know.
pass these values in.
to get it to run.
Okay.
Yeah, there's a lot of fun stuff on the useful tips here.
Also, yeah, that reminds me. Yeah. Using Podman or docker to
version your containers because that's not built in.
you can hop down directly into those.
Stuff like that.
Thank you.
Yep.
Where are we at here?
store in there.
Okay.
So now let's go ahead and take a look at what our home directory is. Now it has its own home.
So it's going to have everything separate, not stomp on your dot files and
put whatever in there, like if you're installing rust using rust up all your
Rust versions are going to be in there.
etc stuff like that.
So I'll send the docket here.
Also, DistroVox LS is the same thing as DistroVoxList.
um
disturbucks RM here. That's pretty self-explanatory. It's going to remove it.
Sue.
Japan. What's next?
Sure.
I have a question. You're on Fedora and they they're pushing toolbox
instead of distro box
Hmm.
And from what I can tell, it just seems like a less featureful version of pretty much the same thing. Is that your read on it? Have you tried it at all?
Yeah, Toolbox is written in Go. And I may be wrong, but as far as I knew in the past that it only supports Podman as your
container runtime.
And yeah, it just basically has…
Less features written in Go.
If you…
Like distra box is basically completely shell scripts uh
So that's what it's written in.
Maybe some people don't like that and they would rather be go. I don't know.
But yeah, I think that's a
Fairly accurate read on it.
Also, in terms of
the exports
So let's say we…
I don't know if people are familiar with rip rep or not.
it's a fully featured rep replacement that's like way faster than grep and we'll
use however many cores it has, et cetera. It finds things extremely quickly.
So…
I like really installing that on all of my machines now
We just installed that inside of this container
Which doesn't have our box for some reason, which kind of threw me.
I know.
Anyone else notice that so like we logged out here. So we're actually on the host right now
um so
This is like some sort of bug going on.
I think. So we are on the host right now.
Then let's go ahead and enter into that. You see how the uh
prompt didn't change with our little box here.
Okay.
So see, we are inside Debian, but the prompt right here is saying that for some reason.
So we have encountered a bug.
Like…
Yeah, that prompt must be getting set in the other home.
the main home.
No, I've not encountered that before. It's probably something
Like specifically, let's actually
try and so I just started up a completely new terminal here
And let's go ahead and make it bigger again.
And then let's do that one.
I was doing the same thing here.
Stude, just the normal Debian.
Oh, so it's something bugged.
With that specific one.
That's interesting.
So let's go into the home here. We exported that app earlier for Signal.
You can also do that with binaries.
So do distrovox export.
binary and we had just used
the ROG inside there.
So let's go ahead and do RG. Oh, wait, we have a problem. We can't find RG. So…
this is kind of like a enhancement that would be nice is you don't have to actually know the exact
um you know path to where that is.
But now it's like, okay, we're good with that.
So now we're back on the host.
For certain, this is on a host because it was just a new host
terminal that was opened. So now we have HARG available on the host as well. So you can do that with both the apps that export the desktop file and you can do that with
any binary period.
All right.
Any questions more right now?
That's actually interesting that this uh
One is bugged right here and it's reproducible.
So I'm going to go ahead and snapshot this VM actually.
And see what's going on there.
Any other questions so far?
Nope.
Is there any weird stuff that we want to explore?
Do you happen to know if…
distro boxes using its own network namespace or is it reusing the root namespace, root network namespace?
I believe it's reusing that. It's just sharing everything.
Yeah.
I kind of assumed so since you were able to
get to GUI applications and display without a problem.
Yeah, it's whole like purpose in life is to
integrate with the host in every way possible.
Um, so.
It's kind of a change route on steroids.
using container technology not so much
a more complete container.
It seems…
Yeah, that's a…
And there's definitely places for that.
I mean, use…
a tool for what it's made for, right? When you want a screwdriver, you want a screwdriver and you want a hammer, you want a hammer.
And when I want dynamite, I want dynamite yeah
I don't care the state of system D. If I want the box to go down, I'll pull the power cord and I'll watch it go thump.
All right. Well, uh…
We're getting frustrations out at this point.
I have a question that's kind of random here. So you're using Sway. I see you're using Sway. You told us you were.
And are you using it in like some kind of tabbed mode instead of the tiling mode?
Is that what we're seeing across the top here?
I mean, it's…
I mean, the tiling mode is right here like uh
So you can use the stack
you can do various different
modes with it, right? You can use uh the stack
Or you can use it.
I never remember how to switch back to Thailand.
So I usually try and disable those phones.
Hmm.
So these tabs are your window manager, not your terminal, right? These aren't tabs in your terminal. These are actually separate
terminal processing.
Yeah, this isn't TMUX. Yeah, each one of these is a separate terminal process and it's not TMUX.
This seems kind of neat, but then I'm thinking about like web browsers that have the tabs on the top and then it'd be like two rows of tabs up there. I don't know if I could deal with that.
Yeah.
See that?
Unless you use like a tree style manager. I'm not sure if you're familiar with that.
um
Yeah, I use side berry in Firefox. That's pretty good.
Yeah.
But I have to hack the user Chrome to get it to
pick the tabs off the top, though.
Yeah, very nice. Exactly.
how it should be.
Is it as fully featured though because like
Well, the other thing I really like is like inside or in whatever I use side barrier or whatever it is
You can create like different groups
As well. So like I can have multiple groups of different side uh
Anyway, whatever. It doesn't matter.
It's pretty cool though.
It saves you a lot of clicking if you can use a timely window manager.
For my host, I usually use
you know something more normal like gnome or kd or whatever but
Usually if I'm in a programming environment, I use
some sort of tiling window manager.
Yeah.
James, are you still using, are you still, which one are you on now? You switch like every month, which tiling are you on? Which one is, what's the flavor of december
Cyperland.
Okay, yeah, I tried that one out recently too.
You should…
CLO will auto load your config so you can make mistakes faster.
Yeah, that was pretty cool how you just saved the file and it like automatically does that.
You should share your config so I don't have to like because it's like
It's very much like assemble your own DE, right? Like at least what I saw was very bare bones. You should share your face. I don't have to do all that.
It's more set up than like i3 or Sway at the beginning.
Yeah.
at least on Arch, it might be different if you compile it from source or something.
I just wasn't happy with the default way bar or whatever it's called config, but then I'm also too lazy to go through and
Configure it, yeah.
change it. So I just went back to KDE and like, I'll deal with this later
Yeah.
Well, I had a lot less to explain than this one since uh people
understood containers and virtualization
more than some other groups that i
present this to.
So kind of went through a little fast.
Yeah, we appreciate it. Pretty thorough.
I appreciate it. Thanks.
Just trying to get a little bit of awareness of it since it's kind of a new tool. And I found it extremely useful. Like I use it every day for
all of my development now pretty much.
Excellent stuff.
Oh, uh.
Sean was mentioning
toolbox is kind of a competitor alternative. Anybody else using something else
find similar?
there.
manually mounting my home directory into doctor containers and hoping I don't break anything. That's my alternative.
I have something that plays in a very low level space
for networking things.
um i
created some scripts that use
NS enter and unshare.
and will create
they are functionally containers. I'm not messing with file systems, but network namespace
UTS namespace.
and a few other things so I can
create a tiny little system
to then actually multiple and then create virtual networks between them.
to play with various things, test out ideas
It's using all the same
things.
they functionally are containers.
And we're great.
Yeah, this is like, you know, it's like the next step here, or it's like, this feels like almost like one step away from the like bootsy stuff that Fedora and Red Hat are doing.
Or like the you blue stuff. I don't know if like messing with that but
There, it's different, obviously, because you're like switching your entire operating system and booting into a whole different
operating system, but it is very container based and image based and all that so
It feels a little similar. And I just I wonder…
Yeah, it's not really a competitor to this, though. I feel like this solves a different
Because you're not going to want to reboot your computer when you switch
things your you know projects or whatever you know
Yeah, it's definitely a different niche because I can be in a single VM and have three different dev environments that are all conflicting.
You know, and just they get along.
Yeah, when you say it like that, it makes it sound like NixOS is also a competitor here because that's kind of its claim to fame is you can install
all sorts of dependencies and they don't conflict because of the
the SIM linking and the NixOS.
cash and all that that it has the next store.
Oh, nice comment. Documentation from NVIDIA. It's the funniest thing I heard all night.
Well, that is uh
what i had unless people want to explore something else
Cool.
Anybody have any other
alternatives, comparisons they want to make?
If not, thanks a lot, Thomas has really been uh
a good little power tour.
explaining what it is in distro box
something some of us have heard of, but haven't yet played with. So thank you for the uh
the introduction.
Any other questions or comments that someone would like to direct to Tom while he's uh
I'm not saying time's going to go away
Just trying to finish up on anything specific to
to the distro box topic and then we can throw it back open to general questions if anybody has any
Yeah, Gary mentioned the 2600 group or something before that you gave this talk at that one. What does that group do?
Or what are they all about?
They're primarily a security focus group. There's this magazine, 2600 back in the day. They're also the local
314 DEFCON group as well.
So they're very security focused. So you'll have
all sorts of people there just interested in security hacking, like even stuff like lockpicking and whatnot because
you know that that's even a portion of pen testing right is you like
Oh, let's use a flipper zero to clone someone's card and then get in. And it's like, oh, there's an actual physical lock on something. I need to pick that now. And then now finally I can get into that machine, that sort of stuff. So that's what they're about.
And as Tom said, it takes the 2600 part of the name from the magazine
2600 is actually a worldwide
organization. So there are chapters in there
many, many cities all over the world.
I was going to ask if the 2600 you're talking about here is
officially affiliated with the affiliated with
mangothene.
I believe they're the registered
group here yeah
local chapter.
I'm not sure how official that
makes things like email someone or something
Right.
I've never been sure what makes it official or what advantage or disadvantage there is to it. I do know that
I've been going to those meetings off and on.
for probably 20 years.
At that time, 20 years ago, they said they were part of that group.
One of the odd things that I've always found is
apparently worldwide they meet on Friday night, the first Friday night of the month.
And I have mentioned at a number of the meetings that
This is what brands us geeks as nerds is the fact that on a Friday night, we're sitting around where there's
usually less than a one to nine ratio of men to women
You mean the other way around the other way around.
And I've suggested that, you know, hey, we might
get better attendance
we don't nerd out and do this on a Friday night. And I have always been shot down and told no
2600 group demands that we meet on the first Friday night of the month. Okay, fine.
Yeah. So I think I was…
And it sounds like they probably are related.
But if it's would the magazine acknowledge
the local chapter is yeah
You contact them, hey, where's a local group in this area
they would point back to.
And not just somebody else
writing the name coattails type thing.
It sounds like there's some actual relation.
Not that it probably matters.
I will point out that as far back as I can remember.
we have always listed the 2600 meeting on the sloop.org calendar
it's always showing there on that monthly placeholder. And as soon as we find out what the topic of the month is, we usually try and put it in there.
so uh
2600 group.
I think always meets physically. I don't know if they ever went to
during COVID, if they ever went to just online
But they have for the last at least two years been trying to always do hybrid meetings.
They really kind of focus it more on the physical people there but uh
They do make it a hybrid available online.
One other neat thing they do is about once a year
They throw a credentials party.
So that you can come in and have…
have people verify uh your
your online credentials.
I'm thinking of like a GPG.
PGP signing party
Yeah, it's a key signing party.
I don't. Okay.
Yep.
I keep wanting…
There's a link.
And while we're always forget about merits and now we're talking about key signing party, really? Okay, got it.
I keep wanting to do more with PGP or GPG.
But email the world I live in
SMIME is easier.
Oh.
And if you talk to
There are a number of people in the crypto
cryptography community that are very much against
PGP and GPG.
And from what I can deduce.
their concerns
seem to be legitimate.
But it's more
along the lines of we're trying to keep
governments, multinational corporations, and various other big money institutions
trying to keep them out of things like if they really want to get in, they're going to find a way.
we're tilting against them.
Versus just something that's better than plain text.
PGP still does a very good job of that.
It's kind of a weird dichotomy.
reminds me of something I wanted to do as an announcement at the halfway but uh
it relates to the 2600 group
Our topic for next Thursday night, the monthly
Linux user group meeting.
we were going to have uh
Joe.
This video comes to you from a field located in northwest Ohio.
Okay.
mute button was found. Please continually.
We were going to have Joe from the 2600 group
speak next week.
But there's been a he's had something come up and he's not going to be able to make it.
It was going to be about something that I can't pronounce.
On Gachi. Say it again. On Gachi. On Gachi.
So, uh.
Oh, no, no, no. Ponagachi.
Oh, I got you. Okay. Okay.
Onagotchi.
Does that hurt?
When I say it, it does.
Anyway, something came up and he's not going to be able to make it. So I will be scratching that off our…
calendar entries for next week.
So right now, I don't know who or what our speaker is going to be next Thursday night.
We still intend to have a meeting Thursday night.
If anyone has a great topic or would like to speak.
or has a way of bribing someone to speak, by all means.
mention it or we'll help you drag them in and force them to speak or whatever. I'll donate to member to the project.
Pardon me? I'll donate some Amber Bach to the project. There we go. There we go.
Are you talking the beverage or the server that needs to be updated?
Hey, do we want next Thursday to be a working session?
that would be an option. Yeah, that could be an option.
For those who aren't familiar with it.
we are the server we use for the mail server for Slug.
is running on Debian 10.
and needs to be upgraded to Debian 12.
And we've been playing with it for almost a year now so
So every time we think we got a plan
somebody throws a grenade into works. This isn't working, that isn't working.
Right now, the biggest issue is mailman too.
and some other things that I forget about now because it's been so long.
Primarily, it would really be nice to
some help to try to pull the documentation together.
you know it actually has some time to read through the emails and collect all the notes
Makes sense, Adam.
But Indians are always in short supply.
I kind of feel like it's kind of feel like
like some projects I have where it's
I have a lot of the pieces.
I might even have all the individual units. I just need to sit together and walk through the process of plugging them together
defined what is missing.
Yeah, yeah.
And go get that thing and then go and get that thing
repeat the process.
Yeah, that's kind of where we keep finding ourselves is that classic thing of, okay, yeah, we know what needs to be done and we we
I think we know how to do it and we've got confidence that we can do it.
And it's just that every time we get close to pulling the trigger.
and we start thinking through the steps, all of a sudden there's that one step
Wait a second, did we get the necessary
Damn, we're not ready yet. Okay.
And I kind of feel like, unless Sean has a presentation, I see he has a comment.
do a new clone
And just walk through the documentation we have.
to update that clone.
And find what's missing.
Because I thought we had an answer.
for mailman. And I thought it revolved it
either installing another package which kept Python 2 around
or a parameter to one of the upgrade commands.
I want to say
had the answer to that.
in the mailing list.
Yeah, but there was something else that mike brought up
When I mentioned doing that exactly
Why don't you go?
I'm surprised, you know, I'm surprised we can't just like
upgrade the host OS and then…
have a Debian whatever 10 or whatever the old version is container that runs mailman
I mean, I realize that's not ideal long term but that
To me, when you are putting mailman in a container.
you're effectively
moving mailman to
a separate server from a separate server from
where the MTA for the domain is.
And from an email architecture
there are some complications for that.
And somebody had, let me put my glasses back on um tyler
It's Mailman 2, which is dependent on Python 2.
And by default, when you upgrade from is it
10 to 11 or 9 to 10, whatever version it is
it also
default upgrades
to Python 3, which Mailman 2 is not compatible.
with Python 3.
And Mailman 3.
It's like the difference between Windows 95 and NT.
Or Solaris and AIX.
They look similar. They do similar things. They have some similar ideas, but how they do it is completely effing different.
Yeah, I think Mailman 3 is a Django app.
And Mailman 2 is something much, much older.
Yeah.
I would say that mailman 3
Unless there is a
documented upgrade conversion process
I would honestly question
Do we want Mailman 3
Or are we in the market
for a different mailing list manager.
it is so different.
in the back end from mailman to
why are we sticking with mailman at that point?
Well, the discussion we had a long time ago was
it's not the admin or the functional side, it's the history side that we're concerned about.
Yeah, and my fear is even the bringing the history
forward into Mailman 3
it is like completely restructuring the archive.
Well, there's no problem restructuring it as long as we've got the script to do it.
Like when Mailman 3 was first released
I don't even think it had any history mechanism.
It was just mail in, mail out.
but uh yeah
whoever was asking, I think the idea was to upgrade the os
and retain Mailman 2
And then on the new OS, which is
supported
do the migration from mailman to mailman three
And then once we were on Mailman 3,
we could then do the next
OS update.
to get to current.
Yeah, I don't know if anybody has looked. I just did a quick search of migrate mailman archives.
And I see a whole bunch of them.
migrating mailmen to to mailmen three
I would hope there's something by now, but there wasn't originally.
Most of this stuff is from over
a year and a half ago now.
Yeah.
another mini announcement done with a
a test, not a test, but just a question afterwards.
The mini announcement is there's an election coming up, I believe, in February.
basically every February we elect one or two people to our five-person board of directors for the SLU.
organization.
And they appoint the officers. There's also a uh
suggestion election of who should be the officers.
So that comes up in February.
And you might say, gee, who votes on that? And basically, if you have attended any
of the slug organized meetings in the last year, calendar year.
then you're eligible to vote in February.
So…
that goes to the question that was asked just as we were starting.
is, oh, Stan isn't here who's taking the attendance
That's why we take the attendance is just so
we have a record, so hopefully you put down a name that you can be identified with
So that if it comes…
you can vote.
What's Stan's going rate to make sure your name does not appear on the ballot?
Ah, yes. I think he mentioned 20 bucks the last time it came up.
Yeah, and I think I heard him say it was going up. So is it 220s or is it now a 50?
Oh, yes.
do monopoly bills count?
For credit card bills?
Oh, boy. I do have a then a
Just a weird question and we'll see if we can play with the reactions thing and do this by a show of hands.
And I know we've had some people who've already dropped off the meeting tonight but
By a show of hands, who considers themselves to be an out of town person?
who is here at the meeting tonight as opposed to an in-town person.
Does everybody know how to raise their hand yeah
That's another question. Does everybody know
It might be a case of raising your hand if you know how to do it and then put it down.
If you're an out of town.
And are you talking St. Louis City proper or the greater St. Louis area
That's why I just said, hey, if you consider it, I would say St. Louis area
Yeah.
City limits.
Where the hell is a hand?
Trust.
react the heart at the bottom.
Oh, there it is.
Okay. So that's interesting i'm seeing.
A couple of the hands come up differently than other ones. That's weird, okay?
Well, where'd I go?
Okay, so I'm only seeing, I think, four showing as out of town.
Let me turn the question around.
Just one, two, three.
People consider themselves in town, please raise your hand. Out of town has put your hand down.
Reactions.
Come on, Tyler. You're in town, aren't you?
Yes, I am. I'm just trying to find where the button is.
hard on the bottom.
Yeah, it says reactions. If you click on that, then it gives you the option to raise your hand.
Okay.
If I count it right, I got six verses four.
There are still some coming. Sean.
Steve.
She's probably asleep.
Okay.
Or he's yelling at Mike. He can't find it.
So eight to four with a few people who have it or a couple of people who haven't voted so okay
And that I only ask the question
First off, to make sure that we
couldn't not do anything that would deprecate the people
for joining us from out of town.
But yeah, every now and then people say, well, where are the attendees coming from?
I'm like, hey, that's why we're…
Yeah, in some ways it would be nice to all get together over pizza and beer but uh
Yeah, quite a few of our attendees are out of towners.
Hang on a second.
what I've seen people do in cases like
is if you have a location with a location with
a webcam and a projector.
at pizza and beverages or whatever group that are in town get together there and
what work has done is they have actually paid for
are allowed expensing
Uber or something for a reasonable priced meal so you can attend
from your house on your webcam and enjoy your meal while the group
wherever else is enjoying their meal and it's just
a distributed meal.
Yeah, yeah, yeah.
Yeah, it does make it nice.
Okay, we just need a laptop with a…
WebCare.
Yeah, the projector is kind of nice if you have multiple people in the room
Or a big screen to be able to see lest you're
six feet away eating your slice of pizza, squinting, going, who's saying what?
I may be able to swing
meeting room at siemens again if
That's something you guys want to do.
So, you know, the cell service is terrible there.
about the meal.
How do you get somebody to pass the butter remotely?
refill the beer.
Pass the butter. Well, David, at least your name isn't humphrey Pogart.
All right. Well, I'm getting hungry and uh
Lasagna has come out of the oven, so I think I'm going to say have a good evening, gentlemen.
Thank you, Grace. A really big thank you to our speaker tonight. Really appreciate it, Tom.
informative. So we hope to come back soon.
Thank you, Tom, and thank you, Lee. And with that, have a good night.
Good night. Hasta la vista.
But it's not just.
Any…
Anyone have any other things they would like to comment on or just muse on or ask questions about?
Hey, Lee, how hard would it be to
bundle up the mailman.
data for me to attempt an upgrade on it.
Oh.
I had no idea.
I've never looked at it.
This documentation is very long.
Where is it?
You might have…
Tyler linked it in the chat earlier.
The exact page he linked is not very helpful, but if you keep going down the sidebar.
It looks like far lip mailman
But we got mailman and mailman restored.
we had to deal with this in Golan, though I think we're still staying with
Mailman 2, but there's some sort of
UNA, mere.
And the way that we were
When the mail finally needed to be migrated somewhere else.
We had email history back to 2009.
And somehow we were able to suck it out of the usenet thing
and re-zip it up now eventually when it settled out to where it went
I don't think the entire archive went back to 2009 because
Or it never got re-implemented that Piper Mail would actually
feed that far back. But we were able to
because it had been archived to UCNET,
I just don't remember the name of it, but there was something wrong with
where it was hosted that it was hosted
They couldn't connect to the port or couldn't connect to the right port without a timeout.
So the little script didn't work.
But I'd have to go back to the go log
archived remember when we talked that about five years ago.
Actually, this isn't that long. I thought all these were separate pages, but they're just headings on the same page.
So actually.
The documentation doesn't look that long, actually. I'm looking at it again.
still a bunch of stuff that I have no clue about but uh
Looks like 1.3 gig.
worth of archives
Incredible. That is incredible because I tried to send
like a two meg picture and it like it was like hell no
No attachments ever. So I'm amazed that we have 1.3 gigs of just flat text. That's incredible.
Yeah, announces 33 meg.
discuss the 700 meg.
I don't know what discuss m box is looks like a mailbox
inbox format jobs
Stericom, 171 meg. WebDev is…
is gone. System admin, 140 meg
And a bunch of little stuff.
Well, in the days before
social media
This group's existed for a long time.
Well, there used to be there used to
lengthy discussions with many people participating
arguing about one point or another
would go on maybe for a couple of weeks.
discuss isn't quite as active as it used to be.
The question is, did the quality go
down or the quantity?
Because I follow tank memes just moved over to Facebook, I'm fine with that.
Looks like we've got about
20 years worth of archives in here.
I'm just making a tar ball and watching it fly by.
To me, email is too low bandwidth right it's like
You can't do like there's just things that I expect now in like chat apps, right? Like I expect to do
Pictures, gifs, reactions
all that kind of stuff and emails just ain't got none of that and it's just
I don't know. It feels low bandwidth to me low
That's engaging.
Well, the email is, but with 25 years worth of archives, you got 1.4 gigabyte worth of crush.
Yeah.
The thing is that all the limits you just mentioned are
are just limits
on this particular version of mailman or
the officers we turned on or off.
I mean, you can certainly put pictures in the mail you could
your reaction to fail.
Geez, Louise.
I'm still archiving.
What the hell does…
It was a 2006 date that just went by.
I've seen 2001
2001, okay. So I'm assuming there's 2,000 in there once in a while.
I just want to see how big a tar ball it is that way
If somebody wants to play with it, we can…
I don't play with it.
Yeah, that's what I'm thinking is maybe one of these days when I'm burning vacation instead of, you know.
Trying to figure out how to load balance belts inside a factory i can
tinker with it in on my virtual machine.
So how come?
we're talking thousands of months here with all the data.
This makes me think in the news just this last week
they talked about
there is a…
stone tablet that is over
over 15
hundred years old
that they found in Palestine.
And it was found, I think they said in like 1908 or something like that
And people didn't even realize what was on. It was written in some ancient script and
And so now they realize it's a copy of the Ten Commandments.
It had actually been being used as a paving stone in somebody's driveway. But yeah, it's like…
If you can imagine, maybe in old 1500 years, somebody is going to find this archive
tar ball of all the old emails.
I don't understand this, Gary.
we're still in discuss archives
And I swear I've seen these dates go by more than once. Yeah.
It…
I mean, they're certainly not in order.
Oh, I know what it is.
the archives
have a single HTML page
where every page is displayed.
It's all static.
Okay. There's four pages for a month. There's four HTML files and four sets of everything.
Oh.
Would that be for thread subject
author and date.
Yep. That's your thing to make sense.
for discuss i saw the same dates go by at least
four or five times.
So if there's a static page generated for each view
That would make sense.
Of course, I probably shouldn't have done anything. I should have just just done
steer time discussing sysadmin since that's all we're really
Yeah.
Oh, well.
They had that much time invested in it.
That's like 225 meg.
So we've got…
The thing that we archived against was gene name.
g nam.io.
And you could actually then use a news reader
read the
basically what was in Piper mail
Okay, I'm going to…
make an archive of discuss your comment?
insisted, man.
since that's basically what we're interested in.
What is that, Leva?
the rest of the craft what is the rest of the craft? Tests.
web dev.
tragic crap like that.
Okay.
I never checked my
slug email because there's no way to
Walk the ground.
We've got ShereCom, web dev.
Temp, test, testing.
I don't know what users it is.
Oh, announced. Okay.
Tom, thank you.
Did a great job tonight. Yeah, it was definitely interesting.
check out your page on our new website and you can start stacking presentations like Lee. He's got dozens under his name.
228 meg.
Except for an ounce. I should have added that, damn it.
The recording's still going, by the way, just in case we're…
Yeah, should we kill the recording?
I'm sorry, what did you say, Tom? Not Tom.
Sean? According to…
Yeah.
Yeah, I guess.
we may talk about something of good technical nature, but I think we're just winding down so
Yeah, unless somebody thinks we're going to have a good technical comp.
comment or two, turn off the recording so bookend
This has been the Wednesday, December the 11th
2024 meeting the general monthly meeting of slug st louis
Unix users group
our speakers tonight, the basic tutorial was by Lee Lamert.
We're talking about green bone vulnerability scanner.
And our main topic tonight was done by Tom Crowe.
And he did a good presentation on
distro box
We all enjoyed that.
So with that
That's the end of our meeting. Thank you all for coming.