Good morning. Good afternoon. Good evening. Wherever you're hailing from welcome to another level up our I am Chris short host Showrunner producer whatever you want to call me. I will probably answer to it I am joined by the one and only the illustrious Langdon White and a special guest today who we will let Her introduce herself here in a moment Langdon. You want to kick off what we're talking about in everything today? Yeah, so as as always I'm Langdon White And this is the level of our where we talk about generally speaking we talk about containers And why they're interesting and why they can be interesting to you as like a system administrator or a developer Just kind of the near of like everyday workflow not to mention kind of all the all the hype is right around like using them in production That kind of thing, but I think a lot of people who have been adopting containers Use them all the time And so we talk about all those different kinds of usages But then we kind of talk about other things as well and today is one of the more other things discussions where we'll be talking a bit about security But I will share my awesome awesome slides That everyone I know loves Not only because there's a slide But also they're the best slides So the level of our as always you can find us on Twitter at Langdon With the one and Chris short with an oh I just I need if I need to figure out some edit on it every time I say it just for the entertainment When would short not have an oh I don't know sometimes so you can all start to us on our discord And it's the link is there and I'm sure that Chris will in the chat as well And So today we're going to be talking about some new wish buds of words DevSecOps has actually been around for a while now. I think and then shift left Is maybe maybe actually I would say isn't I would say it's more recent than DevSecOps But whatever we'll get into that We can fight but Exactly as you notice it says part one and the reason it says part one is not because we're gonna do a part two on this show But we're gonna do a part two on another show called in the clouds, which I want to say is in a couple or three weeks I had meant to look up the date and then I forgot so I think it's you know Yeah, 29 right there. It is okay the 29. So just watch the channel all the time between now and then and you won't miss That's advice right exactly. So And and Kirsten will be back on that show to talk about the same subject maybe from a slightly different perspective And then as always show notes from last time we have on the GitHub repo was episode 40 Where we talked about serverless and why you want Some serverless servers, but we won't get into the jokes we can make there and that for now is the end of our slides All right So Kirsten we like everyone who especially who works at Red Hat to when they come on the show to introduce themselves Primarily because as we were talking a little bit before the show We do enough reorgs and Stuff like that, but we're never quite sure what your title Know you're awesome So we like you to you know kind of give us a little introduction of Who you are and what you do sure so Kirsten newcomer director of cloud security strategy for The cloud platforms team as Landon said we did have a recent reorg So I'm still learning the names of the business unit. That doesn't really matter I still do what I've been doing pretty much since I joined Red Hat about five years ago Which is to focus on security for containers and Kubernetes That's kind of throughout the stack. I work with a whole bunch of other security experts throughout Red Hat Interact with the the OpenShift PM team with with the engineering team Spend a lot of time with our customers talking about security and how to help them meet their security goals With OpenShift so Cool. All right So, you know, I have a relatively long-running joke of you know, I come from a development background. So security But you know, I also I really still need to get one of those t-shirts that says, you know An angel loses its wings every time you set set before zero But so I'm much much better now. I use se linux on a regular basis You know, sometimes I run into problems or whatever and I'll turn it off But then I will actually figure out why I had to turn it off fix that thing and then sort of back on again So let's kind of talk about it from a little bit of the perspective of containers versus other kinds of You know kind of deployment styles What what would you say is the biggest difference between a security in this kind of cloud natively world Versus security on, you know, a traditional virtual machine. Yep Really one of one of the things I'm fond of saying is that containers and Kubernetes really require DevSecOps and Let me explain two things, you know, what is DevSecOps and why do I say that? So first of all DevSecOps people are probably familiar with the term DevOps, right? kind of a tighter integration of development and operations in order to make it easy for Developers to build and deploy their solutions in an automated fashion at an agile in an agile fashion quickly kind of get their code out to their end user easily and quickly without kind of going through a whole bunch of Manual gates with operations right CI and CD right continuous integration continuous deployment key parts of DevOps when when the DevOps kind of framework was initially touted and and kind of Promoted it was always intended to include security gates And and kind of the concept being that you need to think about security throughout that CI CD process Security should not be an afterthought. It's not the responsibility of the security team just for operations It really should be integrated throughout that DevOps lifecycle But people forgot and some of the reason people forgot really is that you know historically teams have been siloed There's been the development team the operations team the security team You know DevOps people heard that they said oh well will connect the development and the operations team They didn't always remember to think about integrating security For folks who haven't seen it DevOps shows up as this infinity loop, right? There are different stages in it But it's really intended to be a closed loop because it's not you're not just done once you've deployed You may find issues during a production environment But then need to be fed back to the development team so that those issues can be addressed and you restart that cycle again So the reason that I see DevSecOps is so crucial for containers is that containers are designed to carry all of the system dependencies the runtime dependencies with the application code and Especially in a Kubernetes environment You're deploying you're always deploying from a container image that image is immutable unless it's rebuilt right so When a problem shows up in production and again, let's say we're using kubernetes We said I want three instances of my web front end to be running as Soon as one of those instances goes down kubernetes is going to notice and it's going to redeploy another one from the container image If a new CVE is discovered in the code in that image and you step into a running container and Fix it there you lose your fix as soon as the redeployment happens Right so best practice never patch a running container always rebuild and redeploy and in this yeah Sorry, that's so that really just means you need that infinity loop You need DevSecOps. Well, and the infinity loop needs to include security in it. Yes, not just like a break in the loop somewhere Yeah, it's not like a touch point where you physical humans come in and tell you hey Here's a stack of papers that you need to fix right, right? So just kind of by way of background At least for me. I don't know how pervasive the term CVE has gotten. I think it's gotten pretty pervasive But basically a CVE common vulnerability Numeration Numerations. Yeah, so basically it's a label of all the big bad ugly Bugs that we discover on the internet, right? So or in anywhere kind of been in the software And so it's gotten to shorten to CVE but if you think about it in terms of this is a kind of a known bug to the industry and You know, hopefully there's also a patch that's available for us at CVE, but not always, right? So just like I said by way of context to your point though is that Even if you know whenever a CVE comes out or whenever an issue comes out when the patch becomes available That does not mean that you should go and slap that into your production environment if you're thinking about containers, right? You should be as as I like to say one of the hallmarks of like an SRE or a DevOps environment Is you fix the recipe not the cake, right? So when you when you make a really bad cake, you can sometimes fix it with frosting But you know as long as it's not the flavor but the look of it I kind of mean But you're better off if next time you actually remember to grease the pan, right? You fix the recipe so that you can make the next cake a little bit better without having to cover it up with with frosting so in kind of the same way you want to introduce those patches into your container environment and Preferably with a fair amount of testing That's where we get into that continuous integration side of it so that you know that you don't have a developer who took advantage of A bug and did some sort of work around or had some sort of cheat code That allowed them to solve some problem and doesn't introduce a new security ballroom So there's all these things to think about but the point being is that you you want to bring those those patches those fixes those problems into the the base of your deployment environment so that you can roll that out So that's so basically I think what you're saying when you say DevSecOps, right is that It's it's a first-class citizen, right? In that you you want it you want it in the the catchphrase, right? So that it's considered just a part of doing business. It's not, you know, something that is added on to the side You know, I would very much in a lot of ways like to see it be, you know, DevSecQEOps You're gonna make me pull out a tweet that was really funny last week Yeah So so this other term Which I certainly haven't heard as much. Maybe it's maybe it's older and I just hasn't crossed my path as much But so what's this idea shift left? Yeah, so shift left is is absolutely tied to DevSecOps It's all about ensuring that you think about security As early in the life cycle as possible, right? So that infinity loop is typically made up of stages that include, you know design, develop You know CI which should include test CD Operations, etc. There's there's a whole set of stages. So Oftentimes kind of with traditional architectures, what would happen is the developers would work work work on their code They'd get it ready to release it be ready for deployment and the security team would run an analysis on it And then they'd feed back this huge list of Unprioritized information back to the development team and the dev team might have been working for three months and suddenly Right, they're stopped in their tracks. They can't get their code deployed until they address these vulnerabilities So shifting left in that life cycle if instead of taking and the left-hand side of that infinity loop typically is that That development side and the right-hand side of the infinity loop tends to be the operations side And so shifting left means we're going to move our security analysis As early into that life cycle as possible and we're going to use automated tools that Can provide information to the developers in a way that they can consume easily And respond to easily Without having to have that separate step just before you deploy Of a silo another team kind of doing this analysis and then throwing the information over the wall So I want tools integrated into my security tools integrated into my ci process But maybe not just my ci process. In fact red hat offers IDE plugins that do security and dependency analysis right in the IDE So the developer gets data About whether there are known vulnerabilities in their source code right at the beginning, right? You want to do this as early as possible and empower the development team To to take action with good information Well, and uh, one of the things that I think is important and um That you kind of alluded to that I want to kind of really call out. This is uh, When I was doing waterfall development 20 years ago on uh, particularly on windows Windows has always had a long habit of pushing updates automatically And the problem as a developer is that it came in in an uncontrolled way, right? So I would just turn off updates until I was ready for you know, quote unquote patch day, right? So, you know, if I was in the middle of a critical, you know development cycle I would try to bottle all that up into one step towards the end Where I could deal with all those changes Good and bad, right? So like as in I could then contain the work into that sort of scenario But it means that I may have a large volume of it I especially now we're getting so many attacks, right? We have so much code in place, you know I have my kind of running joke, you know my stupid hdmo website's running on like Like at least a million lines of code, right? I didn't write any of it But it's you know, if there's a ton of code in there, there's tons of places for bugs And so it's really important that we even if we're we don't have a ci system Or things like that we need to be doing continuous integration all the time as developers, right? We need to know Hey, there's you know, there's these vulnerabilities out there We need to be incorporating those changes all the way along as we go And actually that might be you know because of testing it might be because of security It might be because of requirements change. There's lots of different reasons, but you continuously need to be reevaluating and looking at your code Just as a human right like not even in some sort of magical deployment environment No, absolutely and and honestly it's it You know as as developers you want that code to get out there so that your users have access, right? and so anything you can do to Prevent roadblocks down the down the road is to your benefit, right? And it might mean you need to learn a couple of things I mean one of the things so part of my history is I've worked on developer tools For many years prior to prior to joining red hat and prior to joining black duck before that It was with rational software and I watched the open-source community take over The developer tools market which has actually been a real win, right? So things like cvs is an open-source source code control system now everybody's using git Right, but but it's just been there a plethora of plethora of open-source tools available to the developers So if if you're working in an environment where somebody isn't yet, you know, you don't have Easy access to a pipeline or something go go find one go play around with tecton for containers Use claire for vulnerability scanning in your environment Um, you know find some of these open-source tools and incorporate them into what you're doing So that you've saved yourself the hassle of hearing down the road that something's not ready Or if you or if it's your own code you're managing your own deployment, right? You don't want to deal with having to scramble at the last minute To address now there's no way there's no way to predict all the vulnerabilities that we're going to be dealing with Right new vulnerabilities are discovered in existing code all the time That's the other reason that automation is so important You because you're going to need to respond to something at some point Right right and and the thing This is one of those uh, you know, perfect is the enemy of the good.  Like they're all open source, you know And you know, which means two things one they're continuously getting better, but they're also free Um, and so you can you know, aside from having to spend the time and the energy to set it up While I would prefer my infrastructure team provide me this stuff kind of in a way that I can consume it As a developer or even as an administrator. I want to you know, I can still do it myself, right? I can still incorporate my own components. Um I just wanted to pause there briefly because uh chris, were there questions There are some questions We have somebody that is very new to dev sec ops and is interested in what kinds of tools That people are using. I mean we've mentioned claire already dropped the link to that in chat But kirsten, I don't want you to focus necessarily specifically on tools but classes of tools What would you recommend, you know, everybody needs in their dev sec ops pipeline? Yep. Great question So there are a couple of things most people are familiar with vulnerability analysis Um oftentimes, you know, it used to be that that a lot of that analysis was focused on Packages like jar files, etc. Now, of course, there are plenty or binaries There are plenty of scanners out there that will scan container images When you're building a container you always need a base image with your os dependencies So you still need a container image scanner and that's one of the things claire does, right? And and so that's key another really good thing to look at is a static sast static analysis Security tool, right? So this is something that's going to be run on your source code As and it's going to look for patterns of known Coding practices or poor coding that that can lead to vulnerabilities So often the the sast tooling like especially again if we're talking web apps There's something called the o wasp 10 Which is the top 10 vulnerabilities that are that are known to be or In this case, I'm not talking cvs, but but again challenges with with coding practices that can create that can lead to vulnerabilities Things like cross-site scripting. So you want a sast tool that can look for those kinds of challenges Those are kind of two of the key ones one of the newer things to think about in a kubernetes environment again You're not just deploying a container image. You have to have instructions to kubernetes about how to Manage that deployment and that's called a deployment or sometimes an open shift a deployment config You might have a helm chart that you're using you might have a kubernetes operator those instructions Should be analyzed as well. Uh, and so there are things there that's kind of an emerging space So I call it app config analysis It's less it's it's newer, but there's something like kubernetes, which is an open source project where you can assess What are the privilege requests that are being made in those deployments or those helm charts? Are they appropriate for the environment? If you want to get so those are kind of the the three basics right vulnerability and you know cde analysis Uh, or sometimes also called a software configuration analysis tool Assessed tool force and analyzing your code And then analyzing your application config data. If you want to get fancier, there's dynamic application security testing There's runtime application security testing But I would start with those those minimum three That's funny. You say three, but I managed to write out five That's because The last two many layers. Yeah Dast dast and rast right dynamic and runtime are things that I would consider You can add them on after you've gotten comfortable with the first three, right? And I think Like the oas top 10 is something that you continuously need to look at because it does get updated, right? Right and these are the like top 10 You know most known bad Security practices that are happening out in the world and oasp is trying to focus people to mitigate them And their intention is to build every, you know cycle of their top 10 on their security stacks of suggestions so Great question. There's a lot of tooling that covers that entire space. I mean, I will link to the cncf landscape It'll give you an idea The overwhelming amount of tooling that's out there But that's basically the the gist of what you need to be looking for I was going to also add there too another way to think about it. It's like There's kind of like looking at your code Like from the outside, which is kind of the vulnerability analysis There's kind of looking at the code from the inside Which is kind of static analysis and then there's looking at the code from Where it's going to run in production, which is right And those three things are actually important in any development environment, right? Like whether you use containers or not containers or whatever It's the it's the mechanics of how you do that or where the where the stuff lives or how many of the places can introduce new problems Which is the difference between doing that in bare metal or doing that in kind of containers You know, it's just in the Kubernetes environment. You get all these advantages about making sure that You know bit like things kind of like around uptime right the downside is that You need to be really need to be much more aware of the environment in which that container is playing in So all the things around your code To be sure that you're not introducing holes there that That you wouldn't necessarily see On kind of a physical deployment or something. Yeah, I'm gonna I'm gonna pick at that a little bit Langdon, so I can pick at it too. Yeah So yeah, so so first of all you can run containers on bare metal, right? You can run containers anywhere linux runs or windows if you're doing windows containers So I I think it's actually There the the difference that I would call out between a traditional environment And a containerized environment is in two levels and and you're absolutely right about those three categories applying to both Traditional architectures and containerized architectures The the difference is that in a traditional environment You can More easily step into That environment and view the configuration In a when in a running container, it's still a linux process But that container image it's one of the that container image is Not as it's a little bit more opaque initially when it's deployed And that running process you can still step into it, but generally it's You don't generally and and so it's so again, there's that that bit of opaqueness and the tools Had to evolve to address that Um, so these tools these these categories of tools have been around for a long time to your point, right? They've they've been used in traditional environments They needed to be updated to be able to understand container images container processes And kubernetes and and a lot of the original security tools, you know, some of the the perimeter tools, etc They they assumed that a An application was running with a specific ip address, etc It was stat in one place Containers if they're being managed by kubernetes, they're moving around you don't know what hosts they're deployed on They don't have static ip addresses And so the security principles for traditional and containerized apps are the same the tooling had to be updated and Some of the approaches like at the point in time at which you apply security or how you track Security when when you're not relying on an ip address, right? You need to Instead of using firewalls, etc You use what some people call as cloud native firewalls or container native, but Let's let's call it kubernetes network policies So so you take a different approach you're using the same principles, but you're thinking differently So i'm not sure It's more that we're so used to the traditional architecture that we kind of know how to step into that environment and debug There's a learning curve that people are still On around containers and kubernetes and there's some elements about the amount of Of data that you wind up collecting like if you're following an audit trail to debug or something the amount of data And in the context that you need to really pull on those threads in a container and container and kubernetes environment That's more complex for sure Yeah, I was I was also kind of getting at that The the thing that is hosting your environment is also significantly more complex. So there's a lot more opportunities for Uh, inadvertent failure because of poor config, right? It's kind of like a difference between running a java application and running a java application in an application server like You're still got the same problems just that the the volume Of places where you can kind of screw up around your code kind of has gone up Um, I don't know. So I just think that there's and that's also for your typical developer. It's also not the kind of Thing I guess, you know languages programming whatever you're used to looking at right? And so when you're looking at like deployment configs If you are normally, uh, you know, what let's say a c developer, you know every day Looking at a deployment config. It's not your normal wheel. It's nice. It's right. Yeah And in frequency. So even as you learn it, right, you have to kind of relearn it each time. Um, so So a little bit of distinction without a difference Sorry, I didn't mean to cut you out there like now. Are you done? Uh, sure. Okay I thought you were done my bad so like I remember walking into a startup that I worked at in 2015 And I ran some of these traditional tools against the repos and then, you know This is just me coming in with my knowledge and saying, all right You know, we need to cure these tools and we need to use them The second I started using them The developers realized that everything is vulnerable and they have to completely change the way they develop things Don't be surprised if you're new to this and you start running stuff That there's some like practices that have to change and people will learn new things about like why their code is vulnerable You need to be able to educate people as to the why behind that So it's almost as hard learning the stuff as it is explaining it to others That they have to change some way they do things or there's a new tool in the process That's going to start kicking back their prs because something's wrong, right? So I also dropped a link In chat to our 97 things for cloud Native environments. I can't remember the name of the book to be honest with you, but I contributed to it If that counts for anything You can get it for free. It's 97 things every cloud engineer should know we talk about containers in the book There's a lot of you know, my friends that wrote part of the book As well as some folks that have appeared on the channel like dr. Holly Cummings and Uh kirsten, I think you contributed this book to I forget. I don't know But yes, that book will help you kind of get that high level overview Of cloud natives, you know security and your your musts have Four things that are out there in your environment And and then as you're saying right so we we mentioned awasp.org earlier, right? There's there's some interesting information there The linux foundation likely has some good content as well for kind of how do you learn about some of these things? Definitely looking for Various, you know various places to get educated Is is useful So and it's it's important that you keep up with it too. Yeah, and like it is very dynamic It is very dynamic You don't have but you don't have to know every cd that drops as much as you need to know like What are the new ways you can do a bad job of writing, right? Or what are the new ways? And you know and really if you start to see I think what also helps is this is where the experience comes into Is the more you see of like how things like the os top 10 Work the the more you'll start to kind of incorporate best practices kind of into your own coding style Where you'll second guess yourself when you start to say Well, maybe maybe I shouldn't approach this problem this way, right? Well, and and here's a radical idea, right? Can you make friends with someone on your security team? Some companies actually and and and maybe not as many as as need to but some organizations really have started To embed somebody from the security team into the lines of business So that they can participate with the development in developers at the app dev team In the design process in the development process And collaborate and and honestly this has to be a two-way street the the security team needs to learn some things too Um in that you know security there's first of all, there's no such thing as 100 security. There's there's always some level of risk Um, and so you're really looking at balancing risk and business benefit or or you know And and so you want to have a conversation and and frankly because of some of the historical silos Security teams also haven't yet gotten necessarily up to speed on containers and kubernetes And they may not understand all of the business goals of the application that you're building And so having a conversation That talks where you kind of can go back and forth about Why is security asking for abc? And you as a developer can think about well, is there an alternate way to meet that goal? Right, you can still get to the use case Maybe it's not in the way the security team originally thought like one of the things we do I do see a lot of right is there's a lot of practice there are a lot of Implementation practices or security guidelines that have evolved for traditional architectures And they actually create Some challenges for for kubernetes, but also for speed to delivery So for example, you know, it's funny when landon when you were talking about the the complexity and kubernetes is complex It's absolutely true but Also when vms first came Into the world right that was a new type of complexity right everybody had to adjust for vms And everybody has right right the tools caught up Right, yeah, I simplified the experience right and so actually Absolutely, so we're on that same trajectory with containers and kube But so, you know, so for example a common process is like i'm deploying my app and I need to get a cert for my app from The corporate ca and that's often I put in a request and service now and I wait and you know I wait and I wait And eventually I get a cert and I can deploy my app So in a kubernetes environment again because my containers might go down and be redeployed And they need that that cert automatically You really need to have an environment where Where that can be done in an automated fashion And so to meet that use case There are tools that are evolving in this space That that help but but that's an example too where The the use case of self-signed certs are bad or it has to come from a Corporate ca those are tied to particular architectures Maybe that changes with a new architecture and so you really kind of Need to try to find a nice way to ask your security team What's behind the requirement? What are they trying to accomplish? And then you as a developer can really help think about how to do that So so I was going to make a comment that I think sounds a little tongue-in-cheek, but I really don't mean it that way But this is kind of the argument, you know that we've made a couple times on the show And the test is like behind diversity and inclusion in software right is that Yeah, we need uh to all share different perspectives, right? So in other words, it's a lot easier to learn about what's going on in security world when I have lunch with a friend Who does security stuff for a living, right? Yeah, it's a lot more fun too and tastier And so if you get assuming you're not eating the friend We won't get into that part But so kind of the idea of that we you know the more perspectives we can incorporate into our software development and deployment and operations of testing The more likely we are to not make stupid or easy or even hard mistakes, right? Like and it might be a security mistake. It might be you know, it might be an interpretation mistake You know, I I always go back to this You know to the face recognition problems that they've been having because of who they're testing the face recognition on Yeah, the models they're building basically the data sets they have mainly Ski with certain direction or another yeah, right so so but the kind of the takeaway from that right is like The more people that you kind of can interact with about uh, kind of what you're working on and how you're working on it and What you know and to your point like what is the goal behind this rule? You know The better you will be as a you know as an engineer or as an investor or even as a security person, right? Like all of those different perspectives you need to you need to be not just living in your little world You might know everything an oasth has ever said But that doesn't mean you necessarily to your earlier point understand the goals or the business goals of the application um And so you really need to try to incorporate as many perspectives as you can And you will end up with better software. Um, and I think that's a really important point that I think is highlighted by security in particular Yeah, and you know, honestly, I it's an opportunity for security teams to learn as well Um to your point about you know YAML and helm charts these things not necessarily being things developers learn about You know deployment etc that they they they learn about earlier. It's not their main focus They're coding in java or and and you know, whatever their main language might be security teams often haven't needed Haven't been asked to do much coding either. No But YAML is a nice bridge in some ways And and again, it's there is this cultural aspect that I love your idea of lunch because that's a way to To just kind of create bridges, even if the organization hasn't yet Been willing been figured out how to do that But but I do know organizations who've asked their security teams to understand The pipeline the application pipeline the cicd pipeline and the tools in them And to start learning enough scripting whether it's YAML or whatever is required for them to be able to kind of Understand how to implement some of the security gates in that pipeline And that also means they understand more about the tools the development team relies on And they're they can have a better conversation, but it it's a challenge for sure It's going to take time right people process technology. All of these things need to adjust Right, right. And one of the things I mean, I I often I think I say this on the show But I kind of talk about it in general. It's like, you know, remember our industry is Just this person Our industry is ridiculously young, right? And so Not very long ago, right as a developer. I needed to know how to pull a hard drive and replace it, right Most most people don't know how like I it was actually funny I was trying to upgrade the hard the hard drive in my laptop to only discover I got the laptop open and it doesn't have a hard drive. It just has Just soldered No, it's a whatever that That new Yeah, PCie you know, and so We we have gotten very specialized So we kind of were at a point where everybody had to know everything Which wasn't sustainable and now we kind of went through the other end of the spectrum where Everybody only knows their thing really really well and we're trying to find that happy medium of okay I know i'm an expert in my field and I know enough where I know enough people, right? To be able to Know, you know or or to be able to cover kind of all the other things In software development, and I think we're still Still working through that and we may be for a long time Yeah, and I think, you know, I'm thinking back to something you said right at the beginning Langdon Where you're talking about se linux And and needing to turn it off and and frankly even a lot of people Haven't heard of se linux right security enhanced linux And in traditional architectures a lot of admins turn it off because the custom apps or even the off the shelf apps that they deploy On their server don't understand how to work with se linux So one of the advantages That a solution like open shift has is it understands how to work with se linux So when you code your container images you're They don't have to understand se linux right open shift takes care of that for you But it calls out the need to really simplify to assist developers with security And this is another place where You know Open source can help and and red hat has been investing right because there are a complex set of interactions between Like some of these terms may not mean anything to our audience yet secure computing profiles sec comp It's a linux os thing right c groups se linux all of these things that in linux help to protect a running container process But how do I work with those as a developer? What do I need to know about those? How do I learn about those? And so One of the things there's this open source project called udisa. I never pronounce it u d i c a And and and it's all about Giving developers a tool that they can use To create an se linux context to better protect their container image So recognizing nice right that it's not and and that's becoming I think that's morphing into something called There's gonna there's an upstream container security operator Again, try trying to give developers tools That will assess their environment their solution and what it needs And and provide recommendations on how to better secure it so that they don't have to get as as deep in these different tools Right and sharing that one out. Yeah, we'll definitely be looking at that one On a number of times on this show we've we've talked about like, you know Using volumes and you know colon little z and colon capital z and You know and like and what those different things mean and how sometimes those things don't work actually across like nfs mounts and things like that, um, you know, so Se linux is something when i'm using containers I have to be a lot closer to Then I have been on with se linux as a developer for quite some time You know, uh, the nice the really nice thing about how se linux in particular Has gotten over the years is it really has faded into the background? It's just doing its thing and it doesn't cause me problems anymore, right?  I don't have to worry about like the entire environment as well So should we pause here and uh talk about our sweet sweet internet points? Yeah, I just asked the audience they had any more questions for kirsten So I think now's a good time for let those roll in feel free to ask your questions before we sign off You know, we want to make sure you get those answered but go ahead Langham and for kirsten sake, um All right, so we internet points we like to do a little thing on the show that we uh refer to as sweet sweet internet points Uh, and sweet sweet internet points are have no extrinsic value whatsoever But they have the intrinsic value of you are awesome if you have uh gotten a lot of sweet sweet internet points You too can be awesome You too can be awesome. Uh, and right now we have on our leaderboard. We have the rendef uh with 6100 points Which is just a ridiculous amount of points. Uh followed closely as always by netherland hackham. They've gone back and forth a few times Um, no friction. Uh, still I don't we have to go find out what happened to them. Uh, that we they're pretty static at the at the 4 000 along with uh, joe fuzz However, if you notice detective kono kudo has actually surpassed joe fuzz with 2400 points And bacon fork tightly behind. Uh, and so uh, we look forward to some more mixing up of the of the point scale As always, uh, there is the activities page on the uh episodes repo, uh, which has kind of how you can earn points But one of the ways is by entering this code that you see right here on the screen In an awesome awesome probably very secure google form um that uh has Uh unit points and I will cut and paste that into the link just to make your life easier. Um So here's a good. Oh go ahead finish up. Yeah. Yeah, I was just gonna say and uh, you know So please enter your points and and you can you can also have cool cool or sweet sweet internet points That may actually be worth something someday like we promised for we we we know they're going to be time So kirsten, you know, I think I think like most of us at readout you can attest to we're actually pretty good at swag We are yeah, we are except for this show. Yeah It's minus the show But uh, so here's a good question from the same person Jessica at Sorry if I say your name wrong that prompted the you know, the question of you know, what kind of tooling we need Are there any playgrounds where people can practice that? That like because there's a lot of tools that you could practice with right? I know we have our own playground on the learn site. I know we have uh, the developer sandbox Which focuses your URL for that like your code at the bottom of the screen But like I don't know if you can play with all the tools in those two places I know you can play with a lot of them in those two places That's a really good question. I am not really sure Uh that I have heard of such a thing um I mean I want to say what is the company that is get lab opa Oh, well opa styro is the company that backs opa opa is is Uh, you know rego is the policy language opa gatekeeper is an admission controller, right? We talked about security tools kind of for the Develop the ci process. We didn't really talk about some of the security tools that that are available to gate deployments And and opa gatekeeper is one of those but i'm wondering whether you know Whether a get lab environment might be a place that you could play around That's a good point because get lab does have a free tier which ties into Another free tier for kubernetes engine. I think uh google kubernetes engine like they have a partnership So you could spin up a cluster And attach it with get lab and really start hacking away at it Looking at the styro sites, you know if they have anything go ahead Yeah, no and and I was just thinking so so certainly, you know get lab kind of You know has that whole concept of of shift left and has a has a lot of good information kind of if you just on on on their website Um, and at the same time, right? That's not the only set of tools you can use But it could give you a good example of oh and they do have integrations potentially with with other solutions Um, so so it might be an interesting place to to play around. Yeah. Yeah, it's actually I mean, it's it's quite a good point and it is somebody's Could be working on because I mean I do know there are places where you can kind of play around with like sequel injection Right, you know like where you can just kind of go try it out and see what it feels like and you know and have Or have things do sequel injection tests against your site Um So like it it might be interesting to think about how can we Yeah, it is. Yeah, and and actually a uh dev ops or a dev sec ops kind of environment Is something that some of us at red had have been talking about so So, yeah, maybe maybe something will show up Yes, you heard it here first Exactly As we talk about a lot on the show, right? Um, we we are actually from the future. Um, and so everything everything we talk about, uh, is might be forward facing Right, right coming. Oh, so uh, but uh, let's see. Were there any other questions? No, not that I see uh, feel free to ask. We're running up on time here folks We only I was going to kind of say was uh, maybe this is a good point to wrap up I was or kerson. Is there any other like what's the What's the single biggest takeaway as uh, you know, I hate to use this term But like, you know, when I see right an individual contributor somebody who is not in control of the overall organization What's the single biggest thing they can do to incorporate secure practices into their workflow or their work As just you know, somebody who who is an employee at a company Yeah, so I so I think we we kind of touched on that a little bit earlier But do do your best to learn I think I think check out owasp.org Check out the the book that chris you mentioned earlier And you know for anybody who's got time to to try a playground You know, I think the git lab free trial would give you an idea Of what it's like to incorporate all of these things Um And actually I really lined in I so you asked for one. I'm sorry. I don't have one It's okay Have lunch with with your security, you know get to know somebody in security No, I was gonna say actually I was gonna add to it. I was like and don't forget make friends Um, yeah, and those friends can be on twitter. They could be on right, you know Instagram wherever let's just make more friends in the space is the biggest thing Exactly. Um, and just also by way of a little bit of context We kind of gloss over dev ops on a pretty regular basis If you aren't that familiar with dev ops Go read the fun little novel the phoenix project. Um, and you know, kind of learn from there It's it's a fun little book. Um, you know, it will be a good excuse to read something for work that Is not bored. Um, yeah, like the phoenix project I I do not like reading books because I don't have that long of an attention span basically But the phoenix project I picked up on Friday evening and was done by a sunday afternoon. All right, like yeah, that's how good it was It was it's really quite a good little novel. It's not a it's not a it's not like a tech book It is a real life like novel like of a fictitious environment where they're having lots of issues And dev ops and the three ways of dev ops are explained in the book and and there's a security guy And so that's that's that will very much also play into this conversation about dev sec ops And uh, you know, I I I continue to wait for the next novel that is dev sec ops or you know dev ops with quality assurance You know, but uh, I I I talked to um, uh, what's his name? Um, that guy kim The guy change him. I was like gordon. No, that's not the right one The uh, I talked to him years ago actually about like doing some of those novels You know, I was really waiting for the follow-ups, um, but I continued to wait So uh, and he went off and has been doing other stuff. Yeah, he did the unicorn project recently Which I have a copy of but I haven't read yet. So yeah, yeah Me and my books All right Thank you so much for coming. We really my pleasure Yeah, you you've given me a good blog poster right So And uh, remember you can see kind of uh, kirsten talking about it from a slightly different perspective And more of more about shift left And dev sec ops on in the cloud in a couple weeks on 29th On 29th. Yes, and uh, you should definitely check that out. Uh, chris. What else do we have on the channel today? Oh good question lyndon. So coming up at 11 a.m. Eastern 1500 utc. We're going to be talking about the open shift assisted installer Which is one of my most favorite tools from red hat in the open shift world It's actually how I spin up clusters routinely When I break mine you're at home. I use it to spin it back up again And then later on we're talking about dev sec ops again at noon So a very dev sec ops kind of day talking about protecting data in the actual open shift So like data in the environment and everything else Along with that so that'll be a good show And then I think we're off the rest of the afternoon because lord knows i'm stacked up with meetings today Like i'm literally from 8 45 until 5 p.m. I i'm in the channel is negatively impacted when uh people want to talk I know right like you invite me to a meeting that takes away from everybody else Just remember that red hatters So yes, thank you very much kirsten. This was a my pleasure. Thank you both I think the audience is thanking you as well. So You've done a fantastic job today. Thank you Anything else lyndon? No, I think we're good, uh, and we'll see you all next week. We're going to talk some more about security And uh, you know some of the buzzwords or words in the industry that you may not know things like authentication and authorization and devastation and What all those things mean and why you might care? And uh, we hopefully are going to have a few people joining us for the show uh to Uh Explain the things that I don't know how to Yes, and there will also be A super special announcement next show. Oh, yes. Yes. Yes. And so tune in for that for sure All right, folks. We will catch you here in about an hour So take it easy stay safe out there if I don't see you again And thank you very much again to kirsten and lyndon the illustrious one as always


Hey everybody, welcome back to the Linuxcast. I'm your host, Matthew Weber. I'm joined by Tyler. I don't know what your last name is, Tyler. It's Kelly. I did know that. So this is your first episode. So Tyler, why don't you tell us a little bit about yourself? Well, I'm someone who's been using Linux for a few years. Linux wasn't always my main system. I hopped between Linux and Windows for a little bit, for work and playing games. But here over the past couple of years, I've pretty much just stuck to using Linux unless I had to use Windows for work. And so I'm making videos on Linux and just enjoying it, to be honest. Compared to Windows, I'm tired of it. Yeah, I haven't used. I had a dual boot of Windows for a little while after I built my new computer. And I use it like twice. It's horrible. It is. All right, so what we've decided to do is just keep the podcast layout the same for now, even though we've done a host shuffle. But we'll probably or somewhat change it up in the future as we kind of get used to what we want to do. And remembering to look at the camera. I'm not actually going to do that. Because my camera is over here. I have a camera over here.  Why would I want to do it? Anyway, so this week, what have you been doing on Linux and open store stuff? Oh, quite a bit. I have a few things, but I'll try and keep them quick. Because the main one that I've been pretty interested in is I have this Acer Aspire one. It's a 10-inch netbook. It was really popular. I think it came out like seven years ago or something like that. But it was actually my first laptop that I ever got. It was my first computer that I ever bought with my own money. And I've been trying to use it, but it's a 32-bit system. So you have to pick and choose your operating system. So I've been trying different things on it. And I found OpenBSD to be really good on it, surprisingly good. Because OpenBSD is, as far as I can tell, when it comes to the BSDs, it's not the fastest one. It's not really designed for performance. It's more designed for security. But it's actually brought that little, like it's got an Intel add-on in it. So it doesn't have decent processing power whatsoever. What's the app selection? Like, I've never used BSD like at all. It's pretty good. I mean, being fair, you'll find quite a bit of software that isn't ported over to it, mainly OBS. Like OBS is the big one that's just, it's not on there. But I mean, SpectreWM, DWM, like Tiling Window Managers, Qt browsers over there, like most of the software that I'm used to using is on there. It's just some you might find not. Like Qtiles is one, I really like the Qtile Window Manager, but it just hasn't been ported over to OpenBSD. But the app selection is pretty decently good.  Like you couldn't like build a package or something like that. Like you could like Ungent2 or something. I don't believe so. Even though I'm starting to use OpenBSD, it's very much the beginning of my journey. So I'm not sure exactly all that you can do with it. Well, you're already waiting the way more than I do, so. Like I know with this, I've never really had the interest in trying it mostly because the software things care. Because like I use Spotify and I'm sure you probably can't get Spotify on there, right?  Like I use Notion. I'm sure that can't be over there to do this. I use all these proprietary software nonsense foreshadowing. That would probably prevent me from even using it. But maybe someday I'll try to figure it out and put it on like a laptop or something after. Yeah. I mean, for me, what I've found with OpenBSD is it's a fantastic operating system. It's just at least, I'm sure there's people out there that would disagree with this, but at least for me personally, it's not a workstation ready operating system. It's more, it's definitely really fun to tinker around with. It's just, there's quite a few things about it that just aren't ready for it to be prime time when it comes to using it for video creation, stuff like that, so. So is it meant for servers or something? Is that what it's primarily used for? Yeah, it's primarily used for servers and like the security when it comes to OpenBSD, when you start using it, like you'll find quite a few details, like small details about it that are completely like an obviously meant for security. Like when you install OpenBSD, one of the main things that you'll notice is if you try and listen or record any audio from a microphone, it will not work out of the box. You have to actually, and like your microphones and everything are set up out of the box and should work, but they've set it up so out of the box, your computer will not allow anyone or you to record from any microphone unless you specifically set the option to be able to record from audio, which I think is kind of a neat thing, like if you're gonna set up a computer and it's got microphones in it, but you're not ever gonna use them and you would rather know for sure that there's not gonna be any case where someone is recording you through it without your knowledge. I think that's a pretty cool feature. And it's just a small touch where you notice they take security really seriously. It reminds me of Tails. Yeah. That's cool.  Well, there's that. And then I've also, I have switched to elementary OS from Arch. Yeah. Trader. I don't know if I can talk to you anymore. I know, I was just gonna do a video on it. And then I was like, dang man, I really, like, I really like it. The aesthetic is pretty freaking nice. And hey, I mean, I could give it a chance as my main operating system or distro of choice, you know, whatever. And I loaded it up and surprisingly, and now I made a video not too long ago about distro hopping and how bad of an experience I had with that, but I decided to give it a chance. And I've really liked it so far. And so I've been using that. And then also I'm messing around with Godot quite a bit. I'm messing around with a 3D project. So might, might be making a video on that before too long, but my skills aren't great. I have issues with elementary OS. I've talked about it before, but I just don't care for, it feels to me like they're prompting developers to develop just for elementary OS instead of having them develop for Linux in general. So it's really, so like there's this great to do applications called Planner. And it's developed for elementary OS and it will work on other things, other Linux distributions and other, you know, window managers and desktop environments and stuff. But you can tell it was developed for elementary OS and it just feels like, you know, there's always been a problem with Linux, the full fragmentation thing. It just feels like that makes it worse, you know? Like I understand stuff on elementary OS can work elsewhere, but it just feels like it's making. So I have my issues with it. And I won't disagree with you there. Yeah, even though if it's one of those things, like I feel like if you're a user of elementary OS, you'll really enjoy the fact that they have their own sort of like design guide and like preferences for how developers go about like, you know, making their apps look and feel. But yeah, it definitely does contribute to fragmentation like across Linux, which I mean, to be honest, that is a problem that it needs to be addressed, but I don't know how as a community, like we can go about like really attacking it. Yeah, I don't think that it can be fixed at this point. Mostly because I think you have people like me and you probably you is that you feel that fragmentation is a problem, but we're a very small minority in the group of Linux users. Everybody else thinks that having choice is a fantastic thing. And there are times where I think having choice is a fantastic thing too, but in fact, probably the more majority of time, but when I try to think big picture about trying to get Linux to be more popular, fragmentation always is a negative, right? So, all right, so me, I don't know if you, any of the listeners know this, but I have a crappy camera and it seems to be getting worse as time goes on. Like this is like a $40 camera from Amazon. It doesn't even have a brand name. It's one of those ones that says 1080p webcam on Amazon. And I was like, well, that has to be good. It has five stars. Of course it has to be good. It's not good. It's horrible. And like I said, it keeps getting worse. I feel, I'm getting whiter. And some of that is the lighting. So like I have a video light here, but there's no like diffusion on it or whatever. So it's like really bright. And if I don't have it set exactly right, the camera will actually go really dark, really dark, really like over and over and over again, especially in OBS. Like right now, we're not really recording the video and OBS is coming through Discord. So it doesn't seem to be as a problem, but in OBS where there's like actual video settings, it seems to be doing weird stuff. So I actually have to have that light on all the time. And when that lights on, I look like I just stepped out of like a dark room that I lived the last 20 years and without ever seeing the sun. It's horrible. My last video, I looked like a ghost. It's horrible. The lack of a neck beard also contributes to that because I'm even whiter without facial hair. So it was not. You can really tell it. Yeah. And then they accused me of going DT. Like I did not go full DT. I have hair. Like there's hair up here. It's not a lot of hair, but there's hair. I saw that comment and made me laugh. So I'm like, what are you talking about? He's bald. Like I'm not even close to being bald. Like there, I would not look. I mean, I'm not sure. If you're bald, I'm bald, man. Like there's hair up here, man.  Oh man. All right. So I've been struggling. Doing this entire week is trying to get this camera to look at least half reduced because getting another camera is, it's going to happen. But I mean, you got to do with shipping and stuff. So that's going to take like a couple of weeks. And so I've been trying to get this to work. I've not been successful because there's not any really good camera software. So like every web camera, whatever comes with its own software. Like, but it's all Windows based. And I'm not even sure if this camera came with its own software. I have no clue. I mean, like I said, it didn't even have a brand name. So I doubt they've spent a lot of money on software development, but I've, you know, I thought maybe I could look it up and try to see if I could get whatever software there is to run through like wine or something. I'm not very able to find any of the software. So I've just been dealing with the settings and OBS and those are not great. Yeah. Well, and also I have noticed, I have an Aki webcam. Like it's, it's one of those cheap ones but it actually does have a brand name. But for it, I've noticed that I think the settings in OBS, some of them, like they don't actually work. Like they'll, they do, they, like for, for one thing that I've noticed on it is the saturation. When I mess with a saturation, like even though the bar is this long, like the changes only take place like within this like section of it.  Like so. I mean, there are two settings that I really need. So OBS has saturation like levels, right? It has a saturation slider or whatever. And it also does them supposedly automatically. So I've, you know, I tried the automatic stuff, that didn't work. That for whatever keeps auto focusing even though auto focus is off.  But there's no like exposure slider. Like, so it's a mess. And honestly, I'm just going to end up having to deal with it until I end up with the ever meter one, ever media one that I was talking to you about. I'm just going to end up ordering that. But I mean, it's 200 bucks, but if it's good and it lasts for a long time, it'll be a good investment, but I don't know.  It's just weird cause when I first got this and I was like, you know, it's cheap. Like, that's not bad. It's better than, cause I have a, like a 10 year old Logitech on my other monitor. It's like, it's like, it was like the precursor to the 940 or whatever. It'll only record in 720p 30 and only in 43. So yeah, if you try to get it to go 16 by nine, the frame rate goes down to five frames per second and it looks like you're in stop motion. Awesome. Yeah. So, cause that's the camera I started out with, but it was, you know, it was fine, whatever. It's just cameras on Linux just don't seem to want to be okay. But maybe that's just with my crappy cameras. I'm hoping with a more recognized brand names that it'll be a little bit better. Cause I know that some of the, at least if it has software I might be able to get to run through wine. Yeah. So we'll see. That's what I've been doing all weekend like that. And messing around with X-Moin ad, I seem to say this every single week cause I'm gotten for punishment. I can't, I'm not good at Haskell like at all, but I keep going back into X-Moin ad hoping that, you know, I can switch to it for, you know, at least a little while to make a video about it. I keep messing around with the configuration files and keep making mistakes because cameras aren't in the right place. It's not, it's not.  I cannot even mess with Haskell. I start, I start looking around at Haskell and I'm like, this language, what's going on here? I mean, it's, it's super com, like complicated to understand for a new user trying to understand Haskell. Like it's not easy. It's really not. Well, it's, I've been trying for months now. I made my first videos about X-Moin ad probably in December-ish, back when I was like a truly, truly new YouTuber and trying to get stuff done. And those videos are absolutely hilarious. Utter entertainment if you want to look at them cause it's just me completely failing for like 30 minutes to try to get X-Moin ad to actually work to, you know, like I had it installed and I was trying to change colors and change key bindings and stuff for like a half an hour. It was just fail after fail. And funnily enough, I've been trying ever since then I'm still just as bad at it. All right. Let's go ahead and jump into the contact information. If you want to get in contact with us, you can do so. We're on Twitter, I'm at the Linux, I'm at MTWB. The Linux cast is at the Linux cast. Sandy, you're not actually on Twitter, are you? No, I'm not.  I have a feeling about you. Actually, I used to be on Twitter. So I'm not anti Twitter.  You can follow Tyler at the official Zanny on my library in Odyssey and you can subscribe to him on YouTube. The link for that will be down in the description below. Definitely check him out. He needs some more subscribers. You can subscribe to all of our stuff, audio-wise and video-wise at thelinuxcast.org or on YouTube at youtube.com slash linuxcast. And I'd like to take a moment to thank our patrons, which you can find all of our patron stuff at patreon.com slash linuxcast. I don't actually have a list of all my patrons here, so I'm going to go look at it. Let's see if I can remember Devon, Marcus, Merrick, Donnie, Maglin, Camp. I'm forgetting one. I can't remember. Yeah. You did good, though. There's a seventh one. I don't remember your name. I think you're the new, oh, Mitchell. Yes, I remembered. Solid, man, good memory. That's only going to happen once I get past seven. My memory is going to, you know, I mean, I think we better just stay at seven. So I can't remember any more. All right, anyways, so each every week, each of us will be selecting a news topic to talk about. And I'm going to go first this time. I don't even remember what I chose. Oh, yes. So system 76 has unveiled a brand new desktop environment based on GNOME because there aren't enough desktop environments out there based on GTK. We needed one more. So true. So true. I think that they've done this in response to GNOME 40 because GNOME 40 has significantly changed the, you know, the look and feel of GNOME. So they're probably doing this in order to have more control over their own user interface. So I'm assuming that that's the reason why they're doing this. But if you've taken a look at it, and you can find the link in the description below, it is, well, I mean, obviously it's early days, but it doesn't look, I mean, it looks like GNOME. I mean, so I'm wondering why they bothered. The same, but at the same time, I will say the one thing that I do give them a little bit of credit for is the separating of like applications and the like Rofi like, you know, like launch launcher, I guess, I don't know what they're calling it, but it's a run launcher. Come on. Yeah, well, I mean, it looks kind of like what they're doing is they're taking their, they're just taking standard GNOME and then automatically, you know, enabling tiling by default. And have you used the material shell thing for tiling? It's not great. I, if I'm gonna be completely honest, I hate it. I don't, the thing that gets me about their tiling that like really upsets me is like, if you're going to implement, like the tiling in GNOME makes no sense because the title bars, like they don't get smaller or anything, they're just the same size.  Yeah. Turning on the tiling should turn the title bars off. We can agree on that. That's point number one. The second thing is, is when you're in a tiling window manager the number one thing you always do with every key binding is hit the super key. And that means your super key has to have just one use. It's the modifier for every other key on the keyboard. But in GNOME, the super keys, also the activities button, right, you hit it and you get to your activities view. It has dual use and it doesn't work. So you, the tiling thing, I mean, it's a good effort. And it's not as if it's completely unusable. I mean, it's not, I mean, you can use it. But if you're gonna use a tiling window manager just use a tiling window manager or they need to go through and say, when you turn the tiling on, we disable the functionality for the super key during this time and we get rid of the title bars. I mean, I understand from a development standpoint, that's hard because, excuse me, the super key is hard coded into GNOME. You're not gonna get rid of that very easily. Maybe that's the reason why they've forked GNOME. I mean, because that's basically what they've done here is fork GNOME. And maybe that's the reason why they've done that so that they can go through and make it easier to actually go through. Because they seem to like the tiling idea.  Just to use a big word. They seem to be kind of like that. So I mean, they, you know, maybe that's the reason why they've gone through and done this so that they can have more control and focus more on the tiling aspect. But I don't feel like the, I mean, PopOS has become very popular over the last few years because it's kind of like Ubuntu, but without all the Ubuntu-ness, you know? Yeah, yeah. That's a great way of putting it. Right, it doesn't have the focus on snaps. It's meant for like gaming and it's supposed to be really, really fast. And for some reason, people seem to trust System 76 a little bit more than they trust Canonical. And they have all these things, but I don't feel that there's, I don't think going through and making this shift to something totally new and radically different is going to necessarily work out for them. Now, maybe they'll be smart about it because they went through, when they switched to PopOS on their like hardware or whatever, they maintained. Actually, I think you can still go through when you order like one of their computers, you can have regular Ubuntu install or you can have PopOS install. So maybe this will just become like a third option, at least until it's more mature. So those are my thoughts on it. I don't know, because I've used that tiling thing before and it's just, no bueno, you know? Yeah, yeah. It's not great. Maybe, I was thinking, maybe if you hadn't used an actual tiling window manager before, it'd be okay. Good point. Like if you don't have the experience of what the real stuff is like, then maybe it's just, this is cool. This is automatically putting things. I mean, they've always had that like snap mode or whatever where you're dragging things around and it snaps to the quadrant or whatever. This is basically what that is only it's. I've had people tell me that's essentially the same thing as tiling, which that one gets me. Like, no, it's not, no, it's not. But like, yeah, I think you're right. I think it's a great in-between for, moving from a desktop environment to a tiling window manager can be a very stark difference. So maybe the tiling is just to, you know, get yourself comfortable with the idea of a tiling window manager so that you move into it. But yeah, I don't see this like new desktop environment really doing super like or changing too much about the, you know, view on GNOME and stuff. But maybe, maybe it'll work out for him. Maybe it'll be really good. But to be honest, as long as they don't do the thing that Ubuntu did where they, you know, come out with unity and then force it on, you know, everybody when it's half-baked, I think they'll be fine. But there's nothing stopping them from doing it. So hopefully they'll just do it. Like I said, they'll do it smart and just making it an option.  So most people probably want to be able to drag it to the front. I'm assuming that whatever they end up with will probably have the option to turn that off.  So maybe they'll be able to just turn it off. So maybe they'll just turn it off. Maybe they'll be able to just turn it off. Or maybe they won't even be defaulted by the end. It will just look like a gnome. In which case, I'll wonder even more why they bothered. Yeah. So I mean, at that point, all they did was separate out the applications from like making it a separate two windows, which, I mean, cool, but that's not really like super innovative. Yeah, that's why it's one of the reasons why I admire what like Budgie did. With the Solis guys, they went through and yes, they went through and used, at first it was GTK. Now they use QD, I believe. But when they went through and created a new desktop environment, they actually created a new desktop environment. They did the work where they didn't do something like, I mean, Mate is just gnome two, but modernized. XFC has basically been the same for the last 20 years. Ubuntu has been using the same look and feel since 2010 or something when Unity came out 2009-ish, 2011, I don't know. Somewhere around there's looked exactly the same. And even when they went through and changed to gnome, it stayed the same. GNOME has, when they went to GNOME three, that's looked the same up till GNOME 40. And even, I don't know if you've looked at GNOME 40, but that looks, I mean, yes, it looks different and behaves a little bit different, but you can still, it still feels like GNOME, right? So when we get a new desktop environment, it just feels like, usually it's just the fork. You know, it's just somebody taking GNOME and it's almost always GNOME. I mean, there's very few, if any, like true forks of KDE. You notice that? Yep. I mean, there are implementations of KDE Plasma that look different, like on Garuda or something, but there's still Plasma or whatever. There just doesn't seem, it doesn't seem to be the willingness of distributions to fork KDE and make their own as there is with GNOME. Maybe it's because GTK is easier to code for. I don't know, maybe it's you didn't find it. Like, I don't know, it's a thing. All right, so what's your link for this week? For this week, it is the dark mod and it is, so this is like a really interesting game. So I've been checking out some free and open source, you know, games and just in general, different types of games. And I found this and I had never heard of it, even though it seems to be a pretty popular game, but as the title might suggest that it's a mod, it's not. It started off as a mod for, I believe it was, it was, I believe it was DOOM 3 or it was at least like based off of the DOOM 3 engine, but they've switched over, it's now standalone. And I just, I had to talk about this because for one, when it comes to free and open source, like games, you'll have, there's like two classes of free and open source games. There's the ones that are, you know, like zero AD or I'm trying to think like open arena or something like that where you could just, you know, if you have a distribution that has a software center, you can just install it in, you know, button press or if you have something like RH, you can get it from your package manager, maybe the AUR or something like that. So it's simple to install. And then there are the other ones like Freedom where it's, I mean, it's a game, but you only get the project files and you've got to go out and get an engine and do all of this stuff to get your game up and running and working. And this one, I found it to be extremely easy to install, extremely, like it's, what is it? Four steps, four steps. Oh no, excuse me, excuse me, I missed one. There's five steps. And they're extremely easy to do. And then it's a game that's very heavily thief inspired and as somebody who I never really got big into the thief games. So I don't really have a frame of reference when it comes to how like true to the series it is, but I have been playing the absolute heck out of this game. It is super fun. Just sneaking up behind people and conking them on the back of the head and trying to stay in the shadows. Like I found it to be really fun. Have you checked it out at all? I haven't yet. I'm not much of a gamer, like at all. My gaming is pretty much limited to Hearthstone and even that I don't play as often as I used to. Now I was really into City of Skylines for a while, but it crashes like Dickens on Linux. Like you can't run it for more in a few minutes and it just crashes on you. Maybe that's just me, I don't know. But I guess- I've never gotten into the City of Skylines. I have a buddy who keeps telling me, he's like, dude, you just got to try it, you'll get addicted, you'll love it. Let's see, I got really, really into like SimCity back, you know, back in the day, like when I was really young and played SimCity 2000 and SimCity 4 was just like the most amazing thing ever. And then they ruined it with the whole online thing with the SimCity, whatever the most recent one is. And then like City of Skylines is just kind of like SimCity, but with like Uber control. I mean, it's really cool. And it's great because the whole mods scene is like huge mungus, right? And they have a ton of mods. So I think one of the reasons why it crashes for me is because I have all the mods installed. Not all of them, but I mean, it's like way too many. So that's probably the reason why it crashes on me. But yeah, I'm not, I want to game. Like I have an Xbox 360 that I've had for ages, but it has not been turned on in four years. Same, I have one I haven't turned it on in a year. Like I doubt, I mean, it's sitting on the floor. It probably has three or four inches of dust on it. It's, I have, I don't have like a lot of games. I have like, I don't know, probably six games. And one of them is Batman Arkham City, Arkham Asylum or something, never been opened. Still has. Really? Yeah, still has, still has the cellophane rep on the outside. That's how much of a gamer I am is that it's still sitting up there. I mean, it's like a collectible at this moment. It's like, it's never been opened. It's probably worth like 25 cents or whatever, I don't know. I've been told it's a really good game. I wouldn't know. I haven't played it. Now like I have Skyrim out there too. I played that a little bit, but because I like, I really like Elders. I liked Elder Scrolls. So I thought I'd get into Skyrim, but I could, by the time, you know, I, by the time Skyrim came out, I was just not a gamer anymore. Like we used, I mean, I used to do a ton of game. Like we, you know, we didn't really have time for this, but we went through and played that Gran Turismo and a whole bunch of other games. Definitely to see our podcast from last week with Martin's last episode, because we talked about retro gaming, so it was good. Anyways, let's go ahead and move into our, we're 35 minutes in. We're just now getting to the main topic, but that's just the way it's gonna go. So this was your topic. So I rewarded your topic to quote DT. So it's proprietary software garbage. And well, I don't remember what's your original topic. Software proprietary software on Linux, really a bad thing. So it was much more PC of putting it. So what are your thoughts on proprietary software? We don't need PC titles here. To be honest, when it comes to proprietary software on Linux, even though people talk about like, you know, it being okay and it being something that like, there's too many people out there that are not willing or not okay with the fact that proprietary software is available on Linux and it's just a thing. Like I think we need proprietary software on Linux not because it's good to be proprietary software, but it makes the transition for newcomers to Linux much, much more digestible. I mean, we all like, I don't know about you, but I remember that my first experience with Linux was me installing it and then noticing how much wasn't available on Linux. And now that's no longer the case. And I think it's a good thing. I think having the option to use Discord, having the option to use Spotify is a good thing. Not necessarily that you should be using them, but you and I tried to use an open source solution to record this show and it was horrible. It was not a good experience. So if we didn't have Discord, we would be using Skype. Yeah, yeah. So yeah, don't talk to me about open source VoIP projects. They're not good. At least the ones that we've tried so far have not been a good experience. Sorry to interrupt you, but I just wanted to put that out. Oh no, no, no, you're right. I don't think we can afford to be... The whole free software foundation mindset of where... If you even allow proprietary software to be installed out of the box on your distribution, that's nobody know we can't have it. I don't think that helps Linux adoption at all.  The stuff that I'm used to isn't even there. So I guarantee you, even those people who are out there saying that proprietary software is the root of all evil are still using proprietary software in some form. They have to be because unless they're not using a computer at all, every single thing that makes an Intel processor run is proprietary. That is in the kernel. There are ways of getting around it, but you're not going to have a... There's a Libre kernel out there that will run on some hardware, but try getting a Wi-Fi card to work with a Libre kernel. You can't do it. I should say that you can do it, but it's a significant hurdle in order to get it to actually work, right? And if you just want Linux to run out of the box, you have to use the regular blog standard kernel that has all these proprietary blobs in it, and you have to use that. I mean, because that's what enables the vast majority of hardware to run. And yeah, that stuff's in the background. That's not in your face. You're not getting... It's not like in order to use your computer, you have to blog into Microsoft Word or something, but I think really the... Really weird feedback in my headphones right now. I think that the reason why proprietary software has such a bad name is mostly because of Microsoft's propensity in the past to be horrible to Linux.  Because Microsoft is one of the huge companies that have a lot of software that people want to use, Office, and all that kind of stuff. And Adobe is the same way. Adobe has been very... I want to say they've been uninterested, I guess is a nice way of putting it, of bringing any of their software to Linux. I mean, I think the only software that Adobe has ever brought to Linux was Adobe Reader or something. I mean, I think you could get Adobe Reader back in the... I mean, seriously, to say, but you still use Adobe Reader, but... I hope not. I mean, it's just a thing. I mean, Flash obviously would work on Linux, but that wasn't Adobe bringing it to Linux. That was Google and Firefox or whatever bringing it to Linux. So I think that the position against proprietary software has really been... It's been pushed back and given a bad name because of the way those companies have treated open source software a lot in the past. But I think that there's this whole idea that all proprietary software is bad. But really, I think that there's... The real way to say it is that there is some proprietary software that is bad, like not necessarily bad, but it's not privacy-respecting or whatever. But there's good proprietary software we're using Discord right now. I don't think that... I think the vast majority of people would say Discord's actually a really good thing. And I think that they've... Because they've brought their client natively to Linux, I think that's a great thing. Because without it, I mean, it would feel like there was something missing, right? Especially with gaming, because Discord's a huge thing with the gaming community. We've tried so hard over the last 25, 30, 40 years or whatever it is. I mean, it's a long, long time to try to get gaming on Linux. And we seem to finally be succeeding. We've finally with the help of Steam and Proton and Lutris and gaming on Linux, all this stuff and wine, we're finally making some headway in that area if we didn't have Discord because we were so against proprietary software, which I mean, which would be completely hypocritical because all gaming is proprietary software for the most part. It'd feel like something was missing, right? It'd be another reason why you'd wanna go through and game on Windows because you could then talk to your friends. I mean, it feels like Discord's completely changed the way a lot of people do gaming, right? Yeah. I don't know. It boggles the mind a little bit that people are so against... I mean, I can understand wanting to use as much FOS software as possible, FOS, whatever. I'm using FOS software, FOS software, software, whatever. But I understand that and I do too.  It's because I wanna use an open source browser and I don't trust Brave and I don't get the whole cryptocurrency nonsense. And the browsers that I wanna use is Vivaldi. Like it's based on Chromium, you know, and they seem to at least have some cool about innervating and stuff and make it look a little bit different and stuff. It's an open source. I've been dragging my feet on it, right? So that's, I mean, I understand the whole idea of wanting to go through and use, you know, FOS stuff. But on the same thing is, if I were only going to use FOS stuff, my experience using my computer wouldn't be as good because there's certain things that we just don't cover. We don't do a good job with messaging standards like Discord and stuff. I mean, there's Matrix or whatever out there and stuff, but it's, a messaging platform's only as good as the number of people who use it. So you can have, you can, it's the reason why Mastodon is horrible because there's nobody there, right? It's the same thing with any open source federated kind of thing is that there's just a small number of people there and it's not, it's fun. It's somewhere like a Twitter or Discord or whatever. So there's just a blank spots that Linux doesn't seem to be able to do as well in. Yeah. So. And I mean, I think it's one of those things where like it could get better. It could, like when it comes to FOS software, but the idea that we can't, we can't tell people that it's like, it's not okay to be like you shouldn't use proprietary software. It's just not like, it's okay to use whatever works for you. Just, you know, over time, don't ever get to the point where you're not okay with trying a FOS software. Like even though Discord works and it works great for what we need it, if a free, if a FOS piece of software comes out and lands in front of us and it, you know, it does everything that Discord does just as well. Yeah, I'll use it, but that's the thing. There are some proprietary software that just does things either better or just does things that FOS software can't right now. It just, it has FOS, some pieces of FOS software haven't matured as much as the proprietary software has. So, you know, just use what works. Don't be so negative towards people who use it. Yeah.   I mean, just because one person just sticks to all FOS stuff doesn't make them any different or better than me because I use proprietary software. There are items of proprietary software that I couldn't live without.  I think, I mean, you're probably the same, right? You have proprietary pieces of software that just are in your workflow that you just have to use. And yes, I could go to completely FOS. I could find a to-do app that isn't to-do as that's completely open source. I could do that. I could probably even figure out a way to sync it between that and my phone. I could, you know, it'd be extra work. There's an open source version of Notion out there that you can host yourself. I could use that.  I've tried, but I could use it. There are open source options for Discord and all these other things. But it's, I mean, it feels weird to say that those things are too hard to do. Because, I mean, I'm a self-proclaimed lazy person, but, and so it's kind of true that it is too hard to do, but it's also, it's more than just the convenience of it. It's more the things that I'm used to, you know what I mean? Like, I'm not opposed to doing those things. It's just more, I want to be able to be comfortable with the things that I want to use. And going through and changing to something new and working to get it set up, maybe I get some kind of, you know, sense of accomplishment for doing that, but if it's not as good when I get there, you know, it could be. Wow, yeah. And I mean, to further that point, like a piece of software being proprietary isn't necessarily, like, in of itself, a reason to not use it. Like, if the proprietary soft, like Discord right here, if, if it becomes a thing where I don't feel like my privacy is, for one, when I use Discord, I use Discord with the knowledge that anything I say on here could be traced back to me. So there's, and also like, I have my own server with a picture of me. So, you know, it kind of be pretty arrogant to think that no one would be able to figure out that, you know, this is what I'm saying. Well, it's not meant to be private, right? It's not as if, it's not like signal, like where you're, it's meant to be, you know, encrypted or whatever.  That was the point. You know, that's, that'd be silly. Yeah, and it's just that type of thing. Like, I feel like so many people have that, the mindset of, you know, you just can't use anything proprietary. No, like, if you don't have a reason to leave it and find something else that works better for you, that's FOS, I mean, there's, you don't, no one should be telling you, like you can't use something proprietary just because it's proprietary. There have to be other reasons not to use something other than just because of the license it's under. I mean, that's the way I look at it. Like, I don't want to really use anything that's Google, right, because I know Google's actively taking, you know, all the data and selling it. Like, that's a good reason not to want to use anything by Google. I still use Google stuff because it's really good, right? I mean, I've tried to switch to DuckDuckGo. It's atrocious. It's not, it's utter garbage. It's so bad. I mean, for the vast majority of stuff, I end up having to search on Google or on DuckDuckGo. I just have to research again with the G-Bang, right? And that's the way it is with a lot of stuff. I mean, like Google's really good, but I can understand when somebody says, well, I don't use Google for these reasons.  Yeah. You know, it's taking those reasons a little bit farther. And like, I don't use Google because they're data-sucking monsters. You know, that's good reason. It's a good reason.  Same thing with Microsoft.  It's a, it may not be a fantastic reason. It may not be a rational reason, but it's a good reason. It's better than because they have proprietary stuff. And it's the same thing with any other thing. I don't use Discord because, I don't know, because the moderation stuff on there is not very good. That's a good reason. You know, and it's the same, like I said, it's the same for any piece of software you want to use. Like you said, it's not a good reason to not use them just because it's proprietary. You have to have other reasons. Have other reasons. And then it's, I mean, okay.    I'm not going to judge you because I sat through and installed all the Secless software. And there are a lot of people out there who just don't understand why I'd sit down in there and take all the time to get DWM up and running.  I was like, I couldn't, I could not understand why anybody would go through and waste their time on DWM. It was like, it looks hard. There's no documentation. The people who development are arrogant and go completely against the idea of having a community. I mean, they don't want to help anybody. I mean, I couldn't understand it. Then I was like, I'm going to try this. And I still come back to DWM every single day because it's my favorite window manager. It's the one that I want to use. IQ tile, I like BSPWM, I started in I3. It's my pride and joy, my I3 config because I'm so proud of getting it under a hundred lines and everything, but I actually keep the DWM.   Yeah, yeah. So, that's it. I mean, seriously. It's just so, one of those things, it's one of those things in Linux that it's always going to be an issue that is debated upon, like GNOME versus KDE, or what's the best package manager? More recently, Snaps versus FlatPack or something like that. It's always going to be, it's going to be one of those topics that's going to be on podcasts like this one for all of eternity because for the most part, we're never, ever, ever going to agree on it as a community because it's, I mean, there's going to be people all through absolutely hate proprietary software. There are going to be people all there who say, you want to know what?  Yeah. The way it is. So anything interesting. All right. We literally talked that to death. So let's go ahead and move into our apps of the week. So Tyler, why don't you go ahead and give us your app of the week for the first time? Mine is Flameshot. If you don't know what Flameshot is, it's a GUI like screenshot utility. I found it to be really useful and it's got a lot of features built into it that make it very, I don't know. It doesn't feel bloated, but at the same time, it has plenty of features that make it really, really easy to use because for me when I'm taking screenshots, there's plenty of screenshot utilities out there for just easily capturing your entire screen and calling it a day and editing or doing whatever you want to and GIMP afterwards. But Flameshot makes it really easy to just have a system tray icon running and just whenever you want to take a screenshot of a portion of your screen, you click on that and you can select it and it's got easy tools for if you wanted to draw an arrow to something or you wanted to apply a Gaussian blur over someone's face or whatever you want to do with stuff like that. It's got features you can add text to a screenshot like in seconds. It's just, I found it to be a extremely useful and very small utility and it's really amazed me because I didn't expect to come out liking it as much as I did. Have you ever used it? Maybe. When I first started using Flameshot a couple of times, I was probably looking for a screenshot utility and I probably tried it. Right now, I'm just using the XFCE screenshot thing and really because I don't need any of that other stuff, I just need to take a screenshot. My thought is if I'm taking a screenshot to show somebody something, if they can't use their eyeballs to actually find that on the screenshot, then I've lost a hope in them anyway. So yeah, I'm not going to do that.  So that's just the way it is. So all right, so mine, my lap of the week is called Castero. I made a video about this, but basically what Castero is, is a terminal application to listen to your podcast and it's amazing. It's so good. It's the biggest downside to it is it's written Python so it's slow. And by slow, I mean like you notice that it's slow. Like you can tell that there's like a millisecond or five milliseconds or whatever delay between pressing the pause button and actually stopping. That's the only thing I've come across that it's not a good thing. The rest of it is it's easy to add podcasts to. It remembers your position in podcasts even when the application closes and comes back. You know, it's easy to download stuff for offline use. It has good quality. You can speed up the podcast. So if you've listened to your podcast, you know, two times the speed or whatever, you can do that or you can slow down obviously. But it has all the features you'd want and it's in the terminal. So it's right at my alley because I love everything that's in the terminal. So that's the one I've been playing around with enough for almost a week and I'm not one of those people who go through and you listen to podcasts on my computer. Like at all, I listen to them on my phone. That's the same way. I mean, you're supposed to do it, I think. But with this, it's actually got me listening to podcasts on my computer more than I ever had before. So yeah, Castero is the one that I've been trying out. It's really good. Now I got a question for you. When you post a video on Castero, because I didn't see any comments about this, but I just have to ask, did you get any comments of people talking about the fact that it's Python and slow, that millisecond of delay? The very first comment was like that. The second comment was like that. I'm pretty sure the third comment was like that too. And then it branched off into some of my more regular viewers. But definitely the first three comments were all about, well, this is what you get when you use Python. Well, you know what? Python is like proprietary software. It's good for what it does. It always cracks me up when people talk about how slow Python programs are, like Ranger. I had someone tell me that like, I need to stop using Ranger because I'll notice a night and day difference in speed. Ranger is perfectly fine. It's not slow. Ranger's not slow. I've never noticed it'd be slow. It's my favorite too. I have it on my little, like, on my, oh gosh, my Ryzen laptop. It's got, I mean, it's not an underpowered ship by any means, but it's not a, you know, eight core 16 thread processor I've got here in my main PC. And it runs like, Ranger is not slow. Like Python programs, when you're running something in the terminal, like unless you can't deal with something having like one or two milliseconds of delay, like how are you that anal about speed? Like, how can you even perceive that speed? I don't even know. So I have a laptop here. This is from 2011. It has a, I don't even know. I think the sticker might be still on it. I don't know. This has a, well it has an i7 in it, but I'm pretty sure it's like an i7, like 11 hundred or something. It's some crazy old processor. Ranger runs perfectly fine on it. Like it has no problems on it, like at all. I can run KD Plasma on that thing. And I'm gonna notice that there's like a thousand millisecond delay in Ranger. I mean, this does come on.   I'm just, I didn't mean it. Leave a comment. It's okay. You can hate Python all you want. It doesn't matter. Yeah.  I can't stand Haskell. So I would be, if somebody said that this thing was written in Haskell, I would be the first person on the video commenting, why are you using Haskell? It's so dumb. All right. That was fun. All right. I think that's it. I think I've had enough.  And well, I could probably use some blue tint to my facing as how I'm still the whitest person in the history of whiteness. But we're not gonna do that. I mean, we've been going for an hour and one minute. So I'm sure I'm gonna cut some of that stuff out because you will take out some of the soundness, but whatever. Anyways, thank you for watching. We record this video or the podcast every Thursday now and it will be released probably on Sunday issues, Sunday, it will probably be released on Sundays to the YouTube channel. If you'd like to get it early, like two days early, you can support us on Patreon level two, three and four. Get it two days early. If you wanna, like I said, if you wanna listen to this early, eventually if we ever get advertisers or whatever, you'll also get the audio feed completely ad-free. So patreon.com slash linuxcast, support us there. Thanks to everybody who does support us. Thank you for watching. Thank you for listening. Thank you for subscribing, like and subscribe. I'll see you next time. See you Tyler. See ya, have a good one.