687: Linux by Proxy

0:11Chris:Hello, friends, and welcome back to your weekly Linux talk show. My name is Chris.

0:15Wes:My name is Wes.

0:16Brent:And my name is Brent.

0:18Chris:Hello, gentlemen. Coming up on the show today, we're digging into those weird little desktop VMs that are hiding behind all of these new strange consumer bot platforms, and we'll see what we can do with them that they probably don't want us to do with them. Then we'll round out the show with some great boosts, some great picks, some great feedback, and a lot more. So before we get to any of that, let's say time appropes to our virtual lug. Hello, Mumble Room.

0:43Chris:Hey, Chris. Hey, Wes. Hello. Hi. Hello.

0:48Wes:Strong.

0:49Chris:Yeah, it's very good.

0:49Brent:We're going to need a bigger room.

0:51Chris:Hello. Oh, and the quiet listening is getting a little bigger, too. Hello. And of course, shout out to everybody watching live, making it a Tuesday on a Sunday.

0:58Wes:Makes it special.

1:00Chris:Also, good morning to our friends over at Define's Networking. Go to define.net slash unplugged and meet Manage Nebula from Define Networking. A decentralized VPN. A VPN?

1:09Wes:No.

1:10Chris:We should call it a DPN. a decentralized VPN built on the open-source Nebula platform that we love and use ourselves. And Nebula was originally created to securely connect Slack's global infrastructure. So it's been designed from day one for serious scale, serious performance, and serious security. And you get strong encryption. You get a decentralized architecture with no central traffic bottleneck or big tech login plane. And you get the option to self-host your own lighthouse. That way you are in full control of discovery, names, and all of that.

1:40Chris:So if you're just connecting your home lab or a global enterprise, you've got to check it out. Nebula gives you privacy, resilience, and speed. Resources are just like unbelievable what Nebula needs. Sips it. Sips it. If you're on a limited connection, you're going to really love that. You've got CPU constraints. You're really going to love it. Who doesn't want something that uses less resources anyways? See what I'm saying. Try it for free. 100 hosts. No credit card required.

2:02Chris:Go to defined.net slash unplugged. It's defined.net slash unplugged. Big thank you to Defined for sponsoring the Unplugged program. And thank you for everybody who supports the show by supporting our sponsor. You're kind of, you know, second-order sponsor in there.

2:16Wes:I feel like we should also thank them for continuing to make our networks work so well.

2:19Chris:Yeah, there's that too. Well, we have some news for you all. We have some news. A brand new Clanker Therapy 2, what we have been building, is out on YouTube and for audio. And, of course, there's a bootleg version for our members to get the complete stream. That'll all be linked in our show notes. Been getting pretty good feedback so far.

2:41Wes:Yeah, right. We put it in the extra show and then, right, yeah, your membership, you can go to a page. We'll have more.

2:47Chris:Yes.

2:47Wes:And stay tuned. Hopefully something we'll be doing more often.

2:50Chris:Yes. Yes, more Clanker Therapies. What we've been doing is using meetup.com slash jupyterbroadcasting to announce them and then just streaming them at jblive.tv. You don't need a Meetup account to actually watch the stream, but we've been kind of organizing.

3:05Wes:Just a single place for details for now.

3:07Chris:And if you watch this week's Clanker Therapy, you will get a bit of the story behind something we're announcing today, a brand new resource for our community that we're very excited about. and I want you to go to uplink.jupiterbroadcasting.com where we now have a two-minute voice note that you can leave us all using built-in in-browser technology and it will send us a note. It lets you record very briefly so you can just allow your audio device, make a two-minute recording when you are done.

3:38Chris:You can play it back and double-check or delete it if you don't like it. And then you give us a name and tell us what you've been working on, what your project is you want to talk about. And if you wanted to go to the Clanker Therapy stream, you choose what are you building. If you wanted to go to Linux Unplugged, you choose Linux Unplugged. And optional contacted note, and you can send your update. And we will get a voice note from you. And we'll incorporate some of them into future episodes. We won't play all of them for airtime.

4:05Chris:But we'll play some future voice notes. So it's uplink.jupiterbroadcasting.com. We want to know about your home lab, your projects, things like that. and if you're a member and you sign them with memberful you get an extra minute you get an extra minute. So if you're a member, you get a three-minute voice note. And that is something which, if you're curious about the tech or how we built it or the story behind that, that's all in that clinker therapy, too.

4:33Chris:Uplink.jupiterbroadcasting.com. Tell us what you've been building, a Linux project, a Homelab project, a new desktop setup. We want to hear it. We built it. And it's just for you.

4:42Wes:And as producer Jeff says, voicemails are cool again.

4:45Chris:Yeah. And you don't even have to use the phone. You can use, like, if you've got a headset and you want to sound good.

4:51Wes:You don't have to go jump through a bunch of hoops. Just use that. Or use your phone with the browser.

4:55Chris:Or maybe you want to go through hoops and you could, maybe there's a way you could leave a voice. It probably works from the phone, Wes. You could probably do it from the phone.

5:03Wes:Oh, it definitely does.

5:04Chris:Yeah. Yeah. All right. So we thought, you know, we like to do something from time to time here on the show. So something a little different, something a little crazy. And we like to do a little live thing from time to time to see how it goes. And, you know, if you've been listening for a bit, we've been kind of toying behind the scenes with different ways to render our website. We played around with Zola. And that was interesting. But Wes and I have been wondering, could you build and deploy the entire website using Nix?

5:36Chris:Could Nix be the deployment method? And we wanted to see if it could do it and do it right. And we thought the best person to verify this would be our chief QA.

5:46Wes:Well, who else?

5:47Chris:Manager and producer brentley and so brentley we want you to go to nix.jupiterbroadcasting.com, and tell us how the website if it looks weird to you at all if anything seems out of place.

6:03Brent:Okay should i.

6:04Chris:Check my profile.

6:04Brent:Photo first is that uh how this is gonna go, Uh, okay. I see it looks kind of, you know, at first glance, like our website. That's good. Um, a couple of things might.

6:17Chris:You might notice new, if you go to community and matrix. Oh, community is dropped down. Oh, I think a lot of people are visiting it right now, Wes.

6:25Brent:Yeah. Is it running off Wes's website or laptop probably?

6:30Wes:It is not.

6:31Chris:No, it's not. No, it's not.

6:33Brent:Oh, there's a whole, yeah, there's a whole kind of index of all the chats that we use. MeshTastic podcast chatting.

6:39Chris:Yeah, it's a nice upcast.

6:40Brent:Right? Podcast chatting, that's awesome. That's very nice.

6:42Chris:It's a nice improvement.

6:43Brent:Hey, we're making it easier for everyone else.

6:46Wes:That's the goal.

6:46Brent:Yeah.

6:47Chris:Nothing stands out though, right?

6:51Brent:Not yet, although I see a couple buttons that I want to check out here. So, Boost, does Boost still? Oh.

6:58Chris:Even better now. Boost is even better now, the Boost button.

7:00Brent:Hey. Yeah.

7:02Chris:Yeah.

7:02Brent:Oh, that's sweet. That's what we should have put in the first place. So the boost leads to now boosting instead of just talking about boosting. That's way better. Okay, so when does this deploy or has it already been deployed?

7:17Chris:Well, that is on the public internet right now. Of course, it's at a subdomain. What if I told you that your original line of questioning was more on the money than you might know? It is not running on Wes's laptop, but it's not running on a VPS.

7:36Brent:It's running off your alarm clock.

7:39Chris:It's running off of Wes's Muse.

7:42Brent:Come on.

7:42Chris:The VM, Wes has gotten the VM in his Muse to install Nix and host our website.

7:50Brent:Wow. That's amazing.

7:51Chris:Yes. So this is what I want to talk about today is I don't recommend these bots and we'll get into the privacy stuff, but I realized something this week that I think has gone over everybody's head. And that is if these platforms start to break through, there are going to be millions and millions of Linux desktops deployed. And it does look like Muse is doing pretty well. It may already be in the millions of users. Every one of these commercial bot platforms, be it Muse, the GrokBot thing, or the OpenAI Dots, or some of the other ones, they all are coming with a full Linux VM.

8:31Chris:And some of them are actually really, really nice systems. Like the OpenAI Dot box is a pretty reasonable spec'd box with, I think, 12 gigs of RAM, was it, or something like that? And a modern Debian base and AMD Optron, something like that?

8:47Wes:I think, what, eight cores, too, maybe?

8:49Chris:Yeah. Yeah, and Muse is a little bit less, but it's still a full desktop VM.

8:54Wes:Yeah, you get eight gigs of RAM, 2X Xeon Platinums in there.

8:58Chris:And it's just a number of gigs.

8:59Wes:I think.

8:59Chris:It is just an implementation detail. However, the actions these agents are taking on behalf of their users are taking place in the Linux VM. So when they go out and browse the web, when they go look something up, when they ping an API, they're doing it, for the most part, from a Linux VM. from a Linux client. It's another Linux machine. And that's got to be good for Linux. And look at these numbers. Muse alone has reported half a million daily users within weeks, and the current numbers as of yesterday are 3 million people prompted at least once a week.

9:33Chris:One million people are prompting Muse every day, and more than 4 million people use it in some form each week. Every one of those 4 million users has a Linux desktop. GrokBot has hit 418,000 weekly users as of September 14th, so that's a little old. and no word on OpenAI Dots yet because they're very new, but ChatGPT has 1.2 billion active weekly users.

9:57Brent:Wow. This gets me thinking that our traditional ways of measuring Linux usage is very outdated now.

10:04Chris:I don't think we're even, I don't even think this has sunk in. So like take Muse, for example. Muse is an Ubuntu 24.05 box. It's got their own custom kernel seven.

10:16Wes:Yeah, the 6.8 if you just run with the stock distro, But clearly they're doing some special things.

10:21Chris:100 gigs of persistent storage. We'll get into some of the technical limitations here. And that's just Muse. And Muse is essentially free right now. It's essentially absolutely free. And if you use an invite link, you get a billion free tokens additional. GrokBot is using Firecracker Micro VM. And it's a little more expensive. but it's again a full Linux desktop and then the OpenAI dots went all the way depending on the image you get it could be Ubuntu 24.4 some report the one I tested was Debian Trixie, Linux 6.18.4.4 but get this Brent, The .Linux VM includes an XFCE desktop, a terminal emulator, a file manager, a browser, Blender, GIMP, Inkscape, KDNLive, like more and more.

11:17Chris:And the agent can use all of it. And you can take over. In the web browser, you can take over the desktop session.

11:23Brent:It seems like those installs are pretty targeted, though, to visual arts, I would say.

11:29Chris:Yeah.

11:30Brent:Which is not the first place I expected that to go.

11:33Chris:A lot of those tools can be stacked to, like, grab clips for people and, you know, make little videos.

11:39Wes:Edit or change images.

11:43Chris:The numbers could be pretty nuts in that it's like it reminds me of Android where we got millions of Linux users, but they don't even know it. But there is the incentive for certain hardware device manufacturers now to target Linux because of that fact. You know, like, it feels like it's a version of that, only it's not just the kernel now, it's a full Linux desktop.

12:04Wes:If you want folks as, you know, helper agents to be able to use your thing, well, then it better support Linux.

12:10Chris:Let's talk a little bit about the design, too, because they're trying to do these in a secure way. And Meta's pitch is for Muse is that every user gets their own Linux computer in the cloud. Nat Friedman said it out on X, I think he said, quote, a free Linux computer in the cloud with every Muse. And the way they're doing it is a container that sits on top of a VM. And the container runs under systemd nspawn as PID1. And then they just wipe that container, right?

12:39Wes:Yep. That's their, like, deploy mechanism. Yeah. So you do get like there is a VM from cloud hypervisor that sort of runs everything. But then internally, like, yeah, all the the only thing that really persists is your home slash home slash hatch. And then they use the container to sort of deploy everything around that. A lot of the environment kind of sets everything up and it makes it so that like because they'll restart the service frequently every couple of hours overnight.

13:03Chris:They're doing updates during the day.

13:05Wes:And they've tried to make it work so that they can just sort of cleanly roll things out. And maybe you notice a little blip and the bot isn't showing up as green for a second or something. But otherwise, it just gets it right back into action. And as long as you're not relying on anything that just got rolled by the container update, you'll be okay.

13:21Chris:But it does mean you lose everything outside your home directory.

13:23Wes:Yes.

13:24Chris:But you can design around that, obviously, as Wes has, which we'll talk about more later. There's also... A really kind of super strict network design around Muse. Really, the Muse VM has no direct access to the internet, inbound or outbound. So anything you do is definitely being intercepted by meta.

13:49Wes:DNS is intercepted. TLS is intercepted.

13:52Chris:These are not private.

13:52Wes:There's no UDP at all, including loopback.

13:56Chris:So there's a lot of VPNs that won't work, too, because of the way they've structured their network. There's a lot of apps that rely on UDP that won't work. A lot of network communications tools that rely on UDP that won't work.

14:05Wes:Yeah, egress is basically all done through an authenticated HTTP proxy. Port 22 is blocked. You can get SSH to work, but you have to jump through a couple of hoops.

14:14Chris:And you can get Tailscale to work, which is surprising. And that's because Tailscale supports derp, which is how it's able to communicate in this funky network setup.

14:24Wes:But what that allows is that they've got this separate sentinel that they call. and it's able to then do fine-grained control. So you can allow access to a particular domain or whatever once, or you can allow it all the time and a prompt just sort of loads that. And that's all done by sort of not restricting what the request sort of, you can make in theory inside the VM, but just only allowing ones to succeed that actually go through their gateway.

14:48Chris:And on the topic of networking, GrokBot, just really quickly, I'd say you could characterize it as probably the most open. There are ways to connect it to external services and it can communicate. And then what they do with GrokBot is they sell the lockdown as kind of like an enterprise upsell. So if you want the business version of GrokBot, they start locking that down. And then on OpenAI Dots, the picture is much more murky. And the irony and the pitch with OpenAI Dots is that if you get a dot, you get GPT-6 Astra behind it, supposedly the best of all of these agentic platforms that they're just begging you to use.

15:27Chris:Muse is actually quite good, but, you know, it's not the frontier model or whatever the crap. But this thing is so constrained at the agentic layer that it really doesn't know what's going on. It appears from what I can tell that a lot of the security practices and the networking best practices and all of that are like almost like at the agent's MD level for this thing and not at like the OS and architecture level. Where with Muse, they are at the OS and architecture level and the Muse agent can just figure it out.

15:55Chris:But with dots, because it's being constrained more at the agent layer, it won't push. It kind of refers you to open AI support instead. It won't do – I have to really push it to –. Really make modifications like just as a brief aside you could ask muse where was my persistent storage and where is it not and muse can answer that the dot cannot you have to just have it deploy files and monitor them for 24 hours and tell you what files persisted.

16:21Wes:Yeah it really feels like the muse bot is just sort of sitting in this you know containerized linux environment and within that is happy to try to poke around for it's surprisingly unrestricted, yeah whereas you got to wonder as on the dot side like is it a more limited harness experience where it's mostly just sort of adjudicated, APIs and not like a full-fat shell, something like that.

16:40Chris:Feels like that to me. It definitely, I was able to get Nix installed in my .vm and get it persistently reloaded after VM wipes. So I did get there after a while. But architecturally, Wes, is there anything else you think it's worth noting, how these things are set up from like a Linux VM or system standpoint?

16:59Wes:Well, yeah, like we've tried to dig into some of the details. there's, mixed a lot of you know sort of assumptions or guesses because not all of the details are public it does seem like meta has been particularly fairly open about a lot of the design and and in their case they're using a lot of ebpf, um like they have one thing that you might run into when you try to get something like nix working is, uh they use extended attributes to sort of track files that you've modified so they have two particular ones and they mark stuff that gets downloaded from the network and they also mark any user modified or created files and you you can list that you can see it they don't hide it from you but you can't remove it at least from you know within the within the virtual machine so they're clearly and i think then they have um like ebpf filtering for that kind of thing and are doing a whole bunch of extra sort of, i assume observe observability and telemetry on that because it does seem like they've they've really put work into the harness engineering side of this whether or not you like the product or want use it or trust them. It is kind of impressive. It is...

18:00Wes:Well integrated. They have crons that seem to work quite well. It has no problem doing subagents or polling. And all within a VM, it is happy to poke around.

18:10Chris:I want to talk about that just for a moment. I'll start with the privacy aspect because I do feel like this is the elephant in the room. All of these are a privacy nightmare. Like in the case of connecting your Gmail accounts, they all, when you start them, want to immediately connect to your Google Calendar, your Gmail inbox. And in the case of Muse, and I'm certain this is how the other ones are doing it, those emails are getting pulled into a queue box that lives outside your Muse, that lives outside the VM, that lives outside your agent, that is a service that Meta runs and a service that OpenAI runs.

18:43Chris:And it creates like a queue, and then the agents basically over like an MCP, can connect to that queue and check for email for you. So that's doing the pulling. And while it's in that queue, there's absolutely nothing that says they couldn't be reading all of those emails, right? And this is the problem throughout. They can do DNS interception. They can tell what files you've modified. It's clearly not a private platform, where when you do this stuff with something like Hermes or OpenClaw, that data exists on your system to the extent of what it sends to the LLM or not.

19:13Wes:Yeah, it does seem like they're trying to give you control. Like it is pretty transparent about the network stuff, right?

19:17Chris:They are very transparent about everything, actually. You can ask it. It will tell you.

19:20Wes:And I think they're going to offer something like confidential VMs where they do more encryption or whatever. But yeah, fundamentally, you just can't really trust that beyond what you're willing to.

19:30Chris:And then the other thing that struck me compared to now, you know, so what's happened is, what I realized is, January and February, we started getting our own agentic harnesses, and people that can self-host had access to this pretty early in the year. Now what we're seeing is the mass consumer versions of these, where they have commoditized the technology. They have bought the compute infrastructure, like meta overbought infrastructure. So that's why they can give Muse away for free for a while.

19:54Chris:And then their intention to monetize is that you're going to love using this thing so much that you'll do transactions that they can take a piece of the action on. So they have all this compute. They have all this strategy. that can now bring it and blast it to everybody's Facebook feed and everybody's Instagram feed. And they can take something that was only available to us geeks back in February and just 10 months later, now it's available to anybody that has an Instagram account.

20:16Chris:That's where we're at now. Or anybody that has a ChatGPT account or anybody that has an X account and they're willing to pay the fee. Or Muse is free. So this is where we're at. And it's all running on Linux. The whole stack is running on Linux, right? So that element I like. And when you start using them initially, if you're familiar with the self-hosted versions, they feel very primitive and very basic. But as you continue to use, or in our case, poke and test at them, you will find that they actually have incorporated ideas that we spent a lot of time building the last 10 months.

20:45Chris:They've just baked it right into their product. And the normies just get it by clicking a button.

20:48Wes:Clearly been paying attention.

20:50Chris:Yeah. Like if you've ever had a problem getting your agent to follow up on a task, they've all solved that, buddy. If it says I'll report back when it's done, it reports back when it's done.

20:57Wes:Yeah, very good at that.

20:59Chris:Lots of little things. It's like clearly they've polished that. And it's going to be compelling to some people. and they're all going to, I mean, there are millions of people already.

21:06Wes:In that sense, it's almost like, you know, again, I agree with all of the qualifiers.

21:11Chris:Yeah.

21:11Wes:It is somewhat heartening to see a product rollout in this category that isn't trash because we've seen a lot of really bad rollouts for quote unquote AI. And we've talked a bit about some of the backlash from that. So I'm not saying this is a perfect product or that y'all should use it. It doesn't really respect a lot of the stuff we like on the show.

21:28Chris:It's pretty much better than every other AI product big tech companies have rolled out.

21:33Wes:Yeah.

21:34Chris:And it comes with a Linux VM. I mean, I just, again.

21:36Wes:That you can install almost whatever you want.

21:39Chris:Well, we can even run a website on it, which we'll get to in a moment. But your thoughts so far, Brentley?

21:43Brent:Yeah. This feels like we've gotten to the point where, we're seeing like mass shifting compute to the cloud or whatever you want to call it. And away from personal devices. So, you know, those of us who are listening to the show are fine because we have way too many computers probably around us and we're doing all sorts of things with them. But this feels like a major shift. Like if they're deploying millions of these on a daily basis, it's just a matter of time that most people are using these if this catches on in the way that we're seeing at least early.

22:19Chris:And what cooks my noodle is the way people are going to be interacting with the Linux desktop in a way that outnumbers all of us is they're going to open up an app on their phone and they're going to ask it to do a thing. And then the thing that they need that needs done will be will happen on the Linux box. and then it'll launch a chrome browser and.

22:37Wes:Go look at stuff and yeah take screenshots it.

22:41Chris:Kind of reminds me of.

22:43Brent:The like popularity of linux through android but now it's just another version.

22:48Chris:Of it which i agree both very cool technically.

22:51Wes:And unfortunate which i mean kind of one of linus's goals right.

22:55Chris:But out of all of those the androids the tivos, This one maybe has the most upside for desktop Linux users because these are Linux desktops using Linux desktop applications with Linux desktop web agents. Right? Like before, it was all lower level kernel stuff, networking drivers.

23:15Wes:Embedded devices.

23:16Chris:Maybe they didn't even want like the user land, right? But this, like if you open up an OpenAI dot and you go and look at the – they will all show you their computer screens. GrokBot, Muse, they all let you just basically VNC into the computer. And the dot one is just sitting there with an XFCE desktop with a freaking dock, and Chromium just sitting there ready to go. That's its default state. And you can click on the terminal and you can uname dash A and you can type. It's wild.

23:44Chris:Or you tell them the thing to do it and you can watch it. You can sit there and watch it use the computer.

23:49Brent:Wow.

23:51Chris:It doesn't seem like the most efficient way. Like, you know, it reminds me like KDE Plasma was thinking about ways to make it more friendly for AI workflows. Well, here you go.

24:02Wes:Like, yeah, don't force it to take the slope.

24:05Brent:I'm surprised they're not using desktops that are more like AI friendly. Like, why didn't they choose Hypervibe?

24:12Chris:Well, I mean, I imagine because they want something that's low resources, doesn't need a compositor, you know, that has a GPU.

24:18Brent:Didn't we see?

24:19Wes:Reliable remote setup.

24:20Chris:Yeah, because you're using this like through VNC.

24:23Brent:But didn't we see Hyperland getting, was it Hyperland getting like APIs or MCPs to use the desktop itself? Wouldn't that be far more efficient?

24:32Chris:Sure would be. Also, you could do this with Pipewire and RDP and that would also be more efficient. But I mean.

24:38Wes:It'd be interesting to know exactly what they are doing.

24:40Chris:Somebody will probably figure it out, but it's amazing they've gotten this far in some ways. It's just mind-blowing that Linux desktop is just a feature that comes with these things. Just a whole frickin' VM with RAM and disks, you know, various amounts.

24:56Brent:We're just a commodity now.

24:58Chris:Oh, here it is. Yeah, AMD Epic CPUs and the OpenAI dot. Some people are reporting 32 gigs of RAM. In this day and age, we could raise RAM prices? 32 gigs of RAM?

25:12Wes:You're going to have to spend a little bit just to get that for yourself.

25:14Chris:So it just begs the question, is there something more you could do with this? Like if Muse and Dots are going to be thrown in your face for free, is there something more you could do with that Linux box? That was the question we asked ourself, and I think you already know the answer. I think it's time we tell you how we did it.

25:41Brent:Well, I've been kind of busy this week, not really connected as I usually am to our conversations here internally at JB. And I noticed this part of the segment of the show just says, Wes. So, Wes, what the heck is going on? What have you gotten yourself into?

25:57Chris:Wes, what have you done?

25:59Wes:Yeah, well, I mean, it started just with, you know, the obsession with Nix, if I'm honest, right? Because I got on this thing where, you know, we were making some updates, working with the website a little bit. and I just wanted to be able to do it all with Nix and not have to deal with, the containerized setup, which is totally fine and definitely works, but I already have Nix all set up. Plus, then I realized, like, we're more than a few versions behind on Hugo at this point. There's some other stuff under the hood, like the horribleness of Dart sass and upgrades to Libsass and deprecations and things there.

26:34Wes:And I wanted to be able to test things out, right? And here at the same time, I'd been playing with Muse just to see what was this all about? How does it compare with the various setups?

26:45Chris:Honestly, when somebody's going to throw that much free compute at you.

26:48Wes:Yeah. Mm-hmm. And so it just sort of clicked, and I thought, well, why not just test it this way? I don't have to spin up a VPS. I've already got a VPS.

26:58Chris:The Muse. Well, and also, you know, these are shipping Ubuntu or Debian, right? There's maybe some logic to having the Nix package manager inside these because it just opens you up to so much.

27:10Wes:App does a lot, which is great, but there's going to be stuff that App doesn't have. And then your bot's probably going to come up with whatever ad hoc way it happens to land on to go download a binary or install Homeware or whatever it does.

27:19Chris:Like, for example, in my Muse and in my Dot, I have OpenCode set up. And I want OpenCode version 2 because it has an API backend. And version 1 is available in Debian, but version 2 is not. It's available in NPM, but I don't want to deal with that. I want to use Nix packages to manage that and install that for me. So in my Muse and in my Dot, I have Nix packages installed. And then they installed OpenCode with the API backend and the Goal plugin.

27:49Chris:and I authorized it to my OpenCode account and I can, through Muse and through Dot, submit jobs to OpenCode and have it build on Space Bunny or something and then they can monitor it through the API. And when it's time for an update, they use Nix packages to update it.

28:07Wes:Which is kind of what you exactly wanted, right?

28:09Chris:Yeah, I just basically have a little background build machine that's always just working on something. I mean, if you're going to give me free compute, I'm just going to have it sit there turning on something. And, you know, Space Bunny's free right now, too. So I'm going to eat it up, you know, build that Nix stuff.

28:24Wes:There are some hoops you've got to jump through with Nix because of those extended attributes in particular. Because Nix wants to be really pure. And so it's going to want to try to strip extended attributes to keep things fully under its control and deterministic when it's adding stuff to the store. But you're not allowed to remove those extended attributes. So ultimately, we've explored like a few different things.

28:46Chris:That's funny because I was sorry to interrupt, but I was going to say the trickiest thing is that they wipe themselves.

28:51Wes:Well, that too. That's also.

28:52Chris:And so you have to build it in a way that recovers from a complete system wipe.

28:55Wes:But you have to get it working first.

28:57Chris:Yeah, yeah, yeah. So these are the caveats. And then you've got the networking caveats.

29:01Wes:It does look like we've explored, like we had the bot write like an LD preload shim for a while. I explored a custom Nix build, but it does look like there are sufficient config options that you can get it to totally ignore those ACLs. There's an ignore ACL option, essentially, and then not have to worry about it. But then you run into that second problem, which is like if you have a regular slash Nix or something, that's just going to get wiped. Or if you put it on a temp FS, there's only like two gigs available there by default.

29:25Chris:And it'll get wiped.

29:26Wes:And yeah, and it's the only real static places under slash home slash hatch. And then what you are going to want to end up doing is writing some wrappers. You know how we love wrappers. Because you want something idempotent so that it basically can, every time it runs, it can say, like, am I set up? Okay, great. Use the tool normally. If not, go re-bootstrap the environment, which is pretty fast, actually, but still needs to be done.

29:47Chris:Another trick you could add to that is the scheduler is persistent and the home directory is persistent. So you could, if you knew the wipe schedule or... Every so often, you could have cron essentially reset up your environment when it gets wiped out or something. Do a little check and then reset it up.

30:04Wes:Yes. And that has been a huge help in making this website not fall apart constantly.

30:10Chris:These are some of the limitations Wes had to work around.

30:12Wes:Yeah, exactly. So, like, right now, you know, the request press, I am using a VPS, but that's just for a public IP, essentially. Proxy. Yep. And then because you need some kind of proxying going on and you have to get through the sort of approved egress going out of this whole setup from the Sentinel, I'm using essentially a nice SSH forwarding setup.

30:34Chris:Ah, classic. A goodie.

30:36Wes:But even that, there have been times where the egress has been a little bit flaky. So you're definitely going to want to build in some ability to handle drops. At one point it was like, today it's been pretty good. But, you know, there were times where, like, 50% loss on some of the connections. So it needs to be resilient, reset itself up, that kind of thing.

30:54Chris:So you got a SSH tunnel going back to a VPS, where a VPS is running with a public IP and a little NGINX proxy that's just taking the port 80 traffic and the 443 traffic and sending it back over the SSH tunnel.

31:08Wes:Right.

31:09Chris:Then sending to the muse.

31:10Wes:And then yeah and then on the muse thing uh i essentially gave it uh access to the version of the site that's now building with nyx and so then it could use its nyx wrapper script to bootstrap the nyx environment, uh which pulls in the updated version of hugo builds the whole site uh and then it, uh it wrote its own little quick static server just to add on it's using python just to be easy but it also added on threading and gzip for some of the assets a few optimizations just to make it not super painfully slow.

31:39Wes:And then it starts that up as part of this setup as well. And then that's ultimately what terminates the whole thing. Python serves the static sites that Hugo built. But of course, we want that idempotent too. So there's a start site script that kills anything that's existing. It makes sure everything is correct, makes sure the server is running, does some loop checks to actually make sure that it is fully serving to the outside world as well.

32:01Chris:Okay, good. Wow.

32:02Wes:Yeah.

32:02Chris:We can basically, we're good to go.

32:04Wes:And that's where there's also the site watchdog cron every five minutes that goes and checks to make sure everything's happening. There's also some other stuff, similar, like Nix, to just make sure everything's still set up and ready to go. And then the other part I ended up setting up, which was just kind of helpful, was I set up a mailbox on that VPS so that I was using an open code locally and Muse could start working together.

32:28Chris:Interesting. So you're having like handoffs essentially between Muse and an OpenCode job to set stuff up?

32:34Wes:Yeah.

32:34Chris:I love that.

32:35Wes:And so OpenCode could just go leave messages. And then the crons are so reliable that like it just had it set every two minutes. It goes and checks for new mailbox messages and it'll automatically pick it up and it'll ping me if it has a question about it or whatever. Or I can ping the bot back if it would like to.

32:50Chris:That's great. I should think about that. Yeah, the big thing for me was figuring out, the breakthrough was just figuring out getting the environment restored. I have not hosted any persistent services in it. I got to imagine we're going to watch them try to respond to people doing this.

33:07Wes:Probably.

33:08Chris:Because an SSH tunnel is sort of a pretty well-known foo. You know what I mean? People are going to do that.

33:14Wes:Yeah, so it wasn't crazy. There were some hoops to jump through.

33:17Chris:The performance is okay.

33:18Wes:Muse did not try to get in the way. Nothing about the system seemed to be like, what are you doing? Yeah, performance is fine. Not the fastest box, not the slowest. I mean, the Muse VM is better than the VPS that I'm renting to me, the proxy.

33:31Brent:Wow.

33:31Chris:Yeah, well, that's the thing. If you were just trying to host some private stuff for yourself, you could add this to your tail net, and you could put Jellyfin, on this thing or something. Like, you could have it be a little server on your tail net.

33:47Wes:And there's a set of a cron that just makes sure it's running and starts it, if not.

33:50Chris:You've got to be a special kind of special.

33:52Brent:Read the terms of service first, right?

33:55Wes:However- Don't put your weirdest media on there.

33:57Chris:All like the ACL stuff and the lockdown stuff you can do with Tailnet devices, you can do with the Muse too.

34:01Wes:Yeah, you don't have to expose it to everything on your Tailnet.

34:04Chris:Right, right. But it's just a wild, because then all of a sudden, all this stuff you've done, For the networking layer, kind of just completely goes away. You still have to recreate the persistent environment and all that, but like all of those networking workarounds with the VPS and an SSH tunnel and checking to see if it's gone down, probably don't have to worry about that if you just...

34:22Wes:You definitely don't, no. You mostly just need one thing guaranteeing that, like, whatever service you want is running and starts it if not.

34:28Chris:I got to imagine these things are going to end up loaded with crypto miners, and bot networks, right, Brian? Like, don't you think? Like, this is just going to get abused? Oh, 100%.

34:36Brent:As soon as there's free compute, that's always what happens.

34:40Chris:I mean, like, yeah, it's too irresistible.

34:42Brent:I mean, that came to my mind like about five minutes ago. So anybody who's actually wanting to mine Bitcoin would have thought of it already. I'm curious what you both ran into that was like your most, I don't know, annoying or largest paper cut in this process. Because it sounds like you have to go through a couple of hoops just to get a compute environment that you actually want. But was there anything that like you didn't expect was going to be an issue?

35:06Chris:Hmm. I mean, you got to wrap your head around the fact that you got to sign into meta or you got to sign into open AI. Right.

35:12Brent:And then you got to be the hardest part of the process if you don't already have an account.

35:17Chris:Like to me, the worst implementation of these is in a web browser chat interface. That's actually the absolute worst implementation. Then next on that list is like Telegram and WhatsApp and those types of chat apps. And then like for me, the best is the TUI implementation. A couple of the desktop Electron apps are okay, but nothing has really beat the TUI apps for me for flexibility and building my own environment to manage these things with skills and MCPs and workflows that I establish.

35:45Chris:And so what would be really awesome is if I could pull it into open code. But that's never going to happen, I imagine. So you've got to live in their sandbox. You've got to live with their networking limitations, their VM limitations, and their interface limitations. But if you're just looking for free compute.

36:04Wes:And you kind of, you know, on some of the other products, you might get a little more choice, but you don't get full model choice either, right? Like with Muse, you just get, what, you just get Muse?

36:12Chris:Spark AI or whatever. I suppose they're going to iterate it pretty quickly.

36:15Wes:But it's not, and you don't, you can actually go look. At first, it doesn't show you very obviously the super details about what it's doing. But if you go poke, you can actually see a lot of the commands it's running and tool calls it's making.

36:27Chris:Yeah, it'll actually expose quite a bit to you. And the other thing that you just sort of touched on there made me just again with the Android analogy. It really feels like you're just going to have all of these people using this, and they're not really thinking about it. So not only are they not thinking about the fact that it's a Linux desktop, but they're not asking what model it is. People that are signing up for Muse, they're not asking... Is it using GPT-6? Is it using Claude? Is it using something meta-built?

36:55Chris:It's not even part of the discussion. Just like when you buy an Android device, they're not asking what Linux kernel it's using.

37:01Wes:They might not know that's a whole thing that's on there.

37:04Chris:But for us, it's like...

37:04Wes:They hardly know the version of Android of that.

37:07Chris:If you were to look at all of these, that's one of the key things to evaluate is what model is powering them. And to that end, their open source model behind this has been pretty damn good. Pretty damn good. Surprised me, actually, how good it was.

37:21Wes:And the implementation in Muse, the service has been pretty good. It's not perfect. It's not the best I've ever used, but it's quite reliable.

37:28Chris:Of the three I've been trying, I think it's been the fastest.

37:31Wes:It is pretty fast.

37:32Chris:And much more reliable than Dots. I don't know. I don't, I don't, I think I could foresee long-term, setting something up like Muse to just do a few reoccurring tasks that I want to burn tokens on that are maybe bandwidth heavy because it's also in a cloud data center.

37:48Wes:It burns in a data center, yeah.

37:50Chris:It is never going to replace my Hermes. It is never going to replace my open code setup.

37:54Wes:It just can't.

37:54Chris:It can't. It is not the same. And then you add the privacy. You know, it's a difference between also building on somebody else's property and renting versus, you know, building your own place and owning the foundation and owning the home and everything you build with it and all the memories and all the documents. So it's never going to replace that for me. But if I had a job that was like scan YouTube and cut clips and save them to a drive for me, well, why not burn Muse Compute for that? I don't care if they know what YouTube videos I want to watch.

38:24Wes:Yeah. For the jobs that aren't going to say a whole lot about you, aren't linking personal info, that is just sort of mechanical work.

38:30Chris:They sure do want you to link it to your bank accounts and everything, though. Just connect it right up. Not doing that. I'm not doing that. I'm not even doing that to my own bots. All right? So I'm not doing it to your bot.

38:43Wes:But yeah, you do have to wonder a little bit about some of the practices. It does seem like I tried out connecting mine to Cloudflare just to see what that was like so it could sort of manage some things for it. And you can revoke the connection really easily. You just put in one sort of API key. You can scope the API key like normal. I think the connector there mostly is just to keep that key out of the Muse environment totally so that it can be a proxy for it.

39:03Chris:Yeah, they have a little vault for your API keys and stuff. So the LLM can't see the keys and supposedly they can't see the keys.

39:10Wes:So it's like a mix of good practices with a mix of bad practices by getting you to dump all your data in there in the first place.

39:17Chris:Yeah, yeah, exactly. And that is, you know, the new privacy challenge that we are entering into is these things.

39:25Brent:Oh, gosh.

39:25Chris:And they... They go further than you would expect. I shared the RSS feed with Muse to have it find something in the RSS feed for LUP. Or no, I can't remember. I never shared it at the Clanker Therapy feed or any of the URLs for that stuff. But we had talked about Clanker Therapy because I showed it on the stream. And it later just said, hey, by the way, I verified Clanker Therapy published on YouTube. it's on extras.show and I see the files are on R2.

40:04Wes:Oh yeah didn't ask it to do.

40:06Chris:That didn't ask it to do that but it knows that that's how TWIB and LUP work because it knows about and it knew we were talking and so it just kind of tries to be helpful.

40:15Wes:And they've got some background crons which it seems like you can list so maybe you can disable too I haven't actually tried that where it does go do dreaming and then goes try to come up with like helpful tips or things it can do for you.

40:26Chris:I guess at the end I'll wrap it with to just answer your question with a button is so there was those constraints but what surprised me was is that these platforms let us do this. Because a lot of this is happening. I'm having Muse and I'm having Dots and Grok. They're the ones that are using the machine. So if I ask Dot to install Nix or I ask Muse to install Nix, it's just doing it. It's not telling me no, it's doing it and setting it up and it's helping me figure out how to make it persist and work with that constraint.

40:55Brent:I I'm really appreciating what's, What they've released to the public says about how these specific companies understand or use Linux internally, because how they've constructed each of these, I don't know, ephemeral computes, or I don't know what we're calling these things, whether they've used modern Linux technologies or they just threw an XFCE desktop at you says a lot about what we don't get to see on the inside, which is some of their technology that they're running probably on the everyday.

41:29Brent:and how sophisticated they are.

41:32Wes:Yeah, that's a great point. I think you can definitely see in particular, I've used Muse here the most, you can really see the flavor of meta-engineering. And as we know, regardless of if you like their products, they've done a lot of really good Linux and SystemD and sort of Linux server work.

41:46Chris:And you see it in there.

41:47Wes:You definitely see it in there.

41:48Chris:And they're using ButterFS.

41:49Wes:Yeah, OverlayFS and all kinds of stuff.

41:51Chris:They're big supporters of ButterFS. And so that stuff, those open-source projects they've contributed to are all at work in their VM. So that's interesting. I think maybe I found Muse the most technically interesting. I think Dots has the most horsepower, and, Grok lets you do the most, but it's expensive. You've got to get it from a certified vendor. And nothing beats Hermes, even if you've got to use a remote API. But I do love free compute, and I do think I'll leave it doing some jobs for me, doing just little things that don't really matter.

42:25Wes:You know it could also be something right where like google rolled out the not great ai version of google search right but, the musebot searches very competently so if it's something you would put into a public search engine and you don't mind medicine that you wanted to search for it could go you know pull up the economic news of the day no problem.

42:41Chris:That's true that's true and i'll happily keep doing it for you every day and send you a.

42:45Wes:Report they can even make quote-unquote podcasts.

42:52Chris:Hey, I want to say thanks to Connecting Internet. Head on over to their website. Check them out at ConnectingInternet.com and use the promo code JUPITER35. They don't officially sponsor the show, but they hooked me up with some hardware a while ago, and I just, every time I use it, I'm so grateful, and I think I should mention it. I checked JUPITER35. JUPITER35 is our promo code. And what I love about them is in the U.S. and in Canada, they ride on all of the networks, auto-switches between the network that has the strongest signal in your area. You don't got a FUTZ.

43:21Chris:so great they have truly unlimited plans which is really really rare in cellular which includes you can buy a priority access plan, also very rare in cellular and then i think my new favorite thing that they have is they have that 39 a month backup plan that comes with an open wrt box that does automatic failover and health checks, so you can just you know if you got you've got if you need a connectivity just add that you're good to go um, i like their seven antenna if you're going to just put something in.

43:52Chris:Jeff and Brent, they mounted the seven antenna beast on the top of my barn. And every time I look up at there, it's just glorious internet.

44:00Brent:And you think of us.

44:01Chris:Right?

44:01Wes:Now, did the installers come for free with this package or is that extra?

44:04Chris:You got to email Brent on that one. No contract, 14 day money back. Go to ConnectInInternet.com and use the promo code Jupiter35 to get $35 off your order. And we will put a link in the show notes. That is That's connectininternet.com and the promo code JUPITER35.

44:22Brent:Well, this week we found a couple musings in our inbox. Abe writes in, hey gents, love your show. You're doing an unreal job walking all the lines that need to be walked. I can't imagine how hard that can be these days. You've struck a great balance with all the things, so here's a message to say, keep it up. On another note, I was a self-hosted listener for almost since the beginning and reluctantly moved over to Linux Unplugged as I didn't think there'd be much content that would be up my alley.

44:55Brent:But I drive so much that I thought I'd give it a try and my, was I wrong? Since moving over to Linux Unplugged, I've started hosting my company websites at home, moved my Windows server over to Brockmox, and bought a GPU for some small machine learning tasks.

45:12Chris:Nicely done.

45:14Brent:After several years of listening, I finally decided to just pull over become a member and send out this a boost i have some feedback for you that i hope is taken as constructive though, the web boost process could have been a bit more obvious, yeah i first just googled linux unplugged which came up with your website of course but i couldn't find where to send a boost i finally stumbled my way over to jupiter hold on there is an irony.

45:45Chris:I have said it on air a few times. I do say boost.jupiterbroadcasting.com a few times. And I just want to point out, the reason why I say this stuff multiple times, is because we get this kind of feedback all the time where people still don't know the URL, even though I say it two or three times an episode, every episode. So if you ever wonder why I repeat myself, listeners, this is Exhibit A. Okay? In my defense. Continue on.

46:08Brent:Okay, let me continue. I finally stumbled my way over to jupiterbroadcasting.com where there is a boost link at the top. Amazing. though that page still doesn't have an obvious link to send a web boost. So I finally found boost.jupiterbroadcasting.com and realized I've heard you say that URL about a hundred times on the show. I imagine if I set out to send a boost using my phone, like some of the 2000s kids, I would have just followed the link in the show notes.

46:37Brent:But I'm a middle-aged, and sending a boost struck me as a big-screen activity, like booking flights or sending email.

46:43Chris:I get that.

46:45Brent:Anyway, in my self-serving interest, if you made this process a bit more streamlined, more one-off boosts may come through, and you'll continue making content that we all love so much. i'm sending a concurrent boost now but just couldn't put it all into that 300 characters oh and by the way brent i'm a fellow canadian currently typing this from the shoulder of the road on highway 3 in bc.

47:08Chris:Like oh you know.

47:09Brent:Where that is highway 3 yeah yeah yeah major highway actually yeah i mean it's uh that was good feedback.

47:16Chris:And we have fixed it right is it on the public site yep all right yeah if you go.

47:20Wes:To uh jupiter broadcasting.com slash boost now it It just goes to the right side.

47:24Chris:Or if you click the boost link at the top of the website, instead of telling you what a boost is, it just takes you to the boost website now, which we just had to work out. But that was good feedback. I'll take hybrid sarcasm. Hybrid sarcasm writes in to me, thank you, Chris, for the rant about Google TV and Android set-top boxes. This is, I think, in the bootleg, and my short version is the reason why Android TV is bad is your fault, because you've bought them, and we've enabled them.

47:50Chris:I just bought a new one, and I cannot believe how bad it is. Uh, I'm ashamed that I've paid them any money for anything that's gone towards Google TV at all. I can't believe it's such a bad product. Uh, hybrid rights. I'm not ashamed of being an Apple ecosystem guy. I like my iPhone and my Apple watch. And because that I enjoy the Apple TV. When I decided that my commitment to jellyfin was strong enough to warrant a proper TV client, I replaced my Apple TV with a Google TV box running Android 14. Uh, yes, I have been down this route myself.

48:17Chris:I mean, because early on, too, like the Jellyfin apps on Apple TV were not very good. And the main Jellyfin app was not nearly as good as the Android Jellyfin app. He said, you took greater offense to the Google-filled interface than I did. I found the app-only mode to be sufficient for our needs, and it meant I didn't have to bother with the launcher that may or may not launch upon reboot. And I have to reboot this thing a lot, he says. It randomly wakes up that Google TV would have incredibly garbled audio, like Michael Bay Transformers chomping on another Michael Bay Transformer kind of audio.

48:49Chris:And the inferior thing is you wouldn't know until you'd already started playing your media, a movie, or whatever a YouTube clip it might be. The only known solution based on my non-agent searching was to restart the whole Google TV unit, and a reboot takes long enough already before navigating the various clicks, then selections just to have the system restart option. Oh, I know. My wife found it easier to turn the power strip off and back on again, and this highlights my frustration with Android in general.

49:14Chris:Blame it on varied hardware support, vague support boundaries, etc. The bottom line is that you never really know what you're going to get when you pick up an Android-powered device. No new Android image was coming to fix this audio bug, so I just had to deal with it. I never had an Apple device with such an infuriating bug. That's why I spent $150 on a new Apple TV, not $300, and $16 on Infuse. My family's media viewing experience is top-notch again thanks to Apple, Jellyfin, and Infuse.

49:41Chris:Yeah.

49:42Wes:I've been very disappointed with the Google TV HLS implementation recently. It's been, I have an older one, but it's been mostly fine. Not as slow as some of the vendor implementations or anything. So for that perspective, it's been fine. YouTube works great. Jellyfin works great, which is most of these use cases. But boy, it hits some HLS stuff that just the old Chromecast line, you know, the Gen 2 stuff had no problem with.

50:05Chris:Oh, really?

50:05Wes:Yeah.

50:05Chris:Oh, that's a bummer.

50:06Wes:It's like, how did you get worse? Or, like, why is HLS.js in my Firefox tab, better than a device that's, like, whole job is to play streaming media?

50:16Chris:It's just Google TV is insufferably bad, and it is the weakest link in the media TV setup.

50:22Wes:And the Rokus are getting worse.

50:24Chris:Yeah. Infuse is good. There's a cost to it. Moonfin is getting better. I still don't think it's quite as smooth on iOS as I would like, but Moonfin's another option to look at as well. but uh yeah i don't know what to do because i've got two kid tvs and i've got an nvidia shield on one and a yaome, google tv on the other and they're both awful and they're really crappy when they wake up about reconnecting to the wi-fi and i don't know what that's about so then that screws up tail tail scale and that doesn't reconnect jellyfin doesn't work even when they get back on the wi-fi and it's real bad.

50:59Brent:Boys it sounds like we are primed for like little tiny computers that are cheap that we can just run our own software on that accomplishes this? Why do we have to rely on the big guys?

51:09Chris:What we need is like a headless Jellyfin Linux environment.

51:13Brent:On an old phone that you might have around that runs Linux?

51:16Chris:Just Linux boots to Jellyfin, right? It's like a Wayland desktop that's just Jellyfin. And you just plug it in, you power it on, and it boots.

51:24Wes:All it is is Jellyfin, ready to go.

51:26Chris:Pipewire for the audio, so the audio just freaking works.

51:29Brent:What more do you need?

51:31Chris:Can anybody build this? Can we do this? Is there a decent Jellyfin app for Linux that we could boot to? Anyways, let us know. Boost.JubiterBroadcasting.com, And Devator, or Dev2R, boosts in as our baller booster. Get ready for this, boys. Buckle up. Here we go. 266,806 Satoshis.

51:57Brent:Wow.

52:09Wes:So, not to take away, but we do, I think, Dev here wanted to be transparent. that this is a bit of an inflated number. It's closer probably to like 140 because- Split players? Yeah. The first three had four out of five notes fail.

52:24Chris:Dang it.

52:25Wes:But they stuck with it to keep boosting until they all worked. And that's why it looks so big. So like, I think the value is definitely there.

52:33Chris:Tess, this is, he says, here is to the Texas brisket fund.

52:38Wes:Which we appreciate.

52:39Chris:Yes. I'm looking forward to that. I'm going to get Brent to eat so much meat.

52:44Brent:Yeah, I'm on a diet right now just in preparation.

52:47Chris:Yep, get ready. You're going to have macaroni and cheese as well.

52:51Wes:Well, hybrid sarcasm comes in with 250,000.

52:55Chris:Sacks. Oh, all right. Also fantastic.

53:02Wes:Baller. No message found, but that's okay. We know you, hybrid.

53:06Chris:Okay.

53:06Wes:And we appreciate it. That's a lot of value.

53:08Chris:It is. Thank you, sir. Perfect. True.

53:10Brent:We have here a derivation dingus. with 76,500 sets.

53:16Chris:Oh!

53:22Brent:I loved the Clanker Therapy stream. Personally, I enjoyed it even more this time around since it was less beginner focused. I would love for them to be a more regular thing.

53:33Chris:Yeah, we are working on that.

53:34Brent:Unfortunately, I only caught some of the live stream this time, but I still watch the entire recording and haven't stopped tinkering with Hermes and OpenCord ever since.

53:43Chris:Yes.

53:44Brent:Another message here from Dingus. Another fantastic episode, gents. This episode was packed with stuff I want to try. I'm definitely going to check out Nixar and Nixflex. Chris's entire media stack always makes me jealous. Very well done. And then there's one last message here for Wes. Hey, Wes, thanks for the Fluxcast and OpenCodeFlakes. Both are working great for me.

54:08Chris:You got uses of your Flake.

54:09Wes:Wes. Oh, hey, that's great.

54:10Chris:Wes, you got some Flake users.

54:11Wes:I'm glad it could be useful. That's part of the goal of, you know, the magic Flakes.

54:19Chris:I also am a Wes Flake user. At least on a couple of my systems. Tomato comes in with a row of McDucks, 22,222 sats. Been busy and still catching up on the show, but I wanted to send some sats to help with Texas. Coverage of these community events is a great thing, and I'm looking forward to the episode. Thank you, Tomato. We really appreciate that. We feel like it is too. We're happy to step up and make it happen if we can do it without bankrupting ourselves. Shout out to TechDev.

54:49Wes:Abe comes in with 3,003 sets, As promised, we got the follow-up. Came from self-hosted, is like in the loop, pulled over on the side of Highway 3 in BC to become a member, which we sure appreciate.

55:03Chris:Thank you. Thank you very much.

55:05Brent:Do it safely.

55:09Wes:By the way, did PayPal ever unlock your funds? I sent some sats that way last year.

55:14Chris:We didn't get some of the fiat back, although they still have it. They still have it. But it's only a couple hundred dollars. I think it's probably about $300, $400 worth. So it is something I have to go through.

55:24Brent:They're going to give you interest, right, when you get it unlocked?

55:27Chris:Oh, they want me to fill out 17 documents to prove who I am. Never again. You know, I wanted to do it. I thought it'd be easy.

55:34Wes:Try to make it easy for folks. Yeah.

55:35Chris:It was bad. It was bad. It was bad. Bearded Tech? Bearded Tech comes in with 6,643 Satoshis. Thanks again for having me on the pre-show. Great episode. Keep up the great work, as always. P.S. This is a zip code boost. if you multiply it by 15.

55:55Wes:That's a math boost.

55:59Chris:All right, here's the, I kept the, here you go. I kept it for you, Wes.

56:02Wes:Oh, thanks.

56:02Brent:Oh, it's been a while. It's a little dusty there, Wes.

56:05Chris:The old bearded tech. So six, six, four, three times 15.

56:10Wes:Yeah, can you do that in your head for me?

56:12Chris:Wes, you're the guy that likes math. I hate it.

56:17Wes:When have you ever said that?

56:18Brent:I feel like the math says northward. That's what I'm feeling.

56:21Wes:Yeah, okay. Okay, so 6-6-4-3 by 15 would be 99,645. You got any senses for where that is?

56:29Chris:Smells like Alaska. Smells like Alaska. You smell that? Kind of like seawater and fish and a little bit too much bird poop?

56:39Wes:You would be right. Oh, really? That is Palmer, Alaska.

56:42Chris:There you go.

56:43Brent:Nice.

56:43Chris:Thank you, Bearded Tech. Appreciate you.

56:48Wes:We got Gene Bean boosted in with the row of ducks. You all have any thoughts about Hindsight as memory for Hermes and coding sessions both? I'm trying out the coding agent plugin that makes a bake for each repo I work in, plus using a custom skill to promote select things like fleet-wide info to a shared bank. I'm using the self-hosted version on my LAN.

57:07Chris:Nice, Gene. Well, I'll tell you what, Gene. Tell you what, Gene. I use Hindsight with my Hermes agents, and it seems to be pretty useful. It does. And the nice thing I like is depending on the chat interface, I can see when they're calling Hindsight too, and I can see that they do use it. I don't think it would be as useful in my OpenCode sessions because one of the reasons I like to go to OpenCode is kind of a clean, clear, context-focused. But, you know, I can see their values as well, I suppose.

57:37Chris:I feel like a lot of things I would do with hindsight in OpenCode I could just also probably define in a markdown document. Your thoughts on a memory system?

57:45Wes:Yeah, I suppose it depends on how much stuff you have. Do you customize it? Is it worth having some sort of index lookup if you're doing it per project? I think often open code gets used for sort of per project stuff that you intentionally want to restrict. But if you do have a fair amount of crosscutting stuff concerning maybe fleet deployment information, I could definitely imagine it. You just kind of have to decide, are you using it for, how many banks are you doing? And then what are you letting, what are you putting into context by default is probably mostly what it comes down to.

58:13Wes:But yeah, it's great how easy various memory solutions, like there's a ton of them. They're all pretty easy to install in a lot of places. They often have sort of MCPs or APIs or CLIs to get access to.

58:25Chris:Now, that could be the way to go.

58:28Wes:Right. There's things like QMD, which is real easy.

58:29Chris:Hindsight with the Hermes agents. And then if you want your open code session, maybe you turn on, because you can turn MCPs on and off if you do slash MCPs, in open code. You could just turn it on when you need it, turn it off, and use Hindsight via the MCP.

58:43Brent:Nice.

58:43Chris:That could work.

58:45Wes:Also, Gene, just appreciate, love it when you send in stuff you're working on. because you're usually working on something cool.

58:50Chris:Appreciate you.

58:50Brent:We have a new tool where you can tell us what you're working on. Um, Magbot comes in with 2,500 sets. I came here to chew fries and surprise the guys and I'm all out of fries.

59:06Chris:You gotta, now you gotta say it like this.

59:08Brent:All right.

59:09Chris:I came here to chew fries and surprise the guys and I'm all out of fries. It's Duke Nukem, dude. It's a Duke, well.

59:18Brent:And I missed that.

59:19Chris:It's another, it's a movie reference too, but it's a Duke Nukem reference.

59:21Brent:Yeah.

59:22Chris:I get you, Mayhem. I get you where you're coming from. All right. let's go to the fiat boost skookum comes in with thirty dollars of the fiats, and he says have a safe trip to texas thank you very much skookum appreciate you.

59:36Wes:Uh quick interruption just you know baller booster hybrid over here says i'm really enjoying the new version of jellyfin mpv shim that could be the auto start linux app which i think might be a pretty good.

59:48Chris:Idea you know there's probably also i know somebody's gonna probably say you could do it with cody, You could probably run Jellyfin inside Kodi.

59:56Wes:Yeah, true. Or it can talk to the library as well.

59:59Chris:And I could probably point Kodi at my dispatcher live TV stuff too, right? Kodi probably does that. I don't remember.

1:00:07Wes:Yeah, I haven't used it for a while.

1:00:08Chris:But it looks exactly the same almost. So what I should really try is Kodi, but I don't want to. Anonymous came in with two free member boosts. Your episode triggered some thoughts for me. I don't think that LMs are like transitioning to digital photography. I think it's more like training your outsourced replacement. I also wonder how much banning LLMs is about othering people. 300 isn't enough. Oh, 300 notes. I'm a longtime listener since the land days, and your AI coverage is fantastic, balanced, and practical. On the flip side, personally, I have no interest in Hyperland Omarcha coverage.

1:00:40Chris:Just a FYI signal. Appreciate what you do. Keep up the great show. Well, haven't you heard the good word about Hyperland? No, I get it. It's pretty niche, right? It's pretty niche.

1:00:50Wes:Desktop stuff's already a little niche.

1:00:51Chris:Although I would say pretty great and worth it, but I, yeah, I see what you're saying.

1:00:58Brent:I'm also noticing this might be, well, not quite a zip code boost, but a postal code boost.

1:01:07Chris:It's a free member boost. What are you talking about? What do you see?

1:01:08Brent:Oh yeah, there's a K1B1A1 there, which I recognize as perhaps a Canadian postal code, but maybe, I don't know, the UK does the same.

1:01:19Chris:I thought it was a ham, I thought it was a ham sign.

1:01:20Wes:That's what I thought it might be, too.

1:01:22Brent:I think you might just have to pull out the map, Wes. I can help you if you need.

1:01:25Wes:Yeah, I don't have the Canadian edition.

1:01:27Chris:Oh. I left that with you when we visited. It does say. I got that in my bag here. Gook says it is a Canadian postcode.

1:01:33Wes:All right, there we go.

1:01:34Chris:You know what? In Ottawa. In Ottawa.

1:01:37Brent:It's not. In Ottawa. Oh, yeah, Gloucester. Mmm. Delicious.

1:01:40Chris:Thank you, Anonymous. Good spot there, Brantley. Yeah, good spot. K-Mogged came in. My agents could barely escape out of a paper bag. What kind of precautions are you guys putting in place? Chris mentions he wants his agents to have access to everything. My coworker mentioned not giving them Git. So can they just Git clone a random repo that contains an exploit? Thoughts. It's funny. It's funny because I fought and fought and fought to get these things.

1:02:07Chris:They're so cautious now. they clearly have the fear of God instilled them that they're going to delete something. Of course, every now and then they do.

1:02:15Wes:This is true.

1:02:15Chris:They do every now and then.

1:02:18Wes:Yeah, I've definitely had them delete some things.

1:02:20Chris:What kind of precautions, Wes? What kind of precautions?

1:02:22Wes:Yeah, I mean, a lot of them come with a fair amount of approvals on by default. So you might evaluate that. It's useful to ask them to investigate their own config sometimes, see what options you have in terms of what all you can flip on. And it kind of depends on what environment you layer it on, right? So I think we both have Hermes agents that have their own virtual machines or equivalent. And so within that, I tend to give them pretty broad permissions because I want them maintaining the box, customizing their environment for what they need.

1:02:51Wes:I do think you want some auditing ability, right? Like you might consider where, you know, do you have some sort of proxy? Are you keeping track of like what tool calls they're making? Do you have ways to check that? Do you have ways to control it if you do want to control it? But you could also then, like, maybe you run some of your development stuff within a container and copy the repos in. You can do that pretty easily. So I think it depends on what you're worried about. Are you concerned about malicious attacks? Are you concerned about sort of accidental overrunning of unrelated data?

1:03:22Wes:Those can be pretty different to defend from.

1:03:23Chris:Yeah, and I think the sort of characterization that they're sitting there idle, sort of looking for things to do and, like, downloading repos and doing stuff is... I don't, you would have to develop a program that drives them to do that, right? They're not just going to do that on their own. Even if you put in their sole MD and their agents MD and everything and you said, I want you to run and you prompted them. You put in their sole MD and you put in their agents MD and you prompted them. I want you to run all night and download, get stuff and build it. And they would stop.

1:03:50Chris:They would stop 15, 20 minutes into it and they would stop. And they wouldn't proceed until you answered a question or approve something.

1:03:56Wes:Where they can be as clumsy. And so I think it does, if you are concerned, I would, the first thing to protect against is like have backups of the stuff on anything that they can touch. And then maybe take snapshots. You can do like, I like to do snapshot commits in Git where I take lots of frequent, you know, commits on a branch and then squash it later after the fact. So I have a fine record of what they're doing and you can do the same for your file system. You have that set up.

1:04:19Wes:That way it's more of like a mutable log of their actions and you don't have anything that they accidentally RM because they had too big of a glob or something like that?

1:04:27Chris:Big plus one to that. I think that's, I agree. And then the last thing is Wes made a joke about how he loved wrappers. So when my agents, say, for example, communicate with Home Assistant, they don't just talk directly to the MCP or the API. They do it through a wrapper, and that wrapper only allows them to do certain things, which bit me, actually, because I wanted to remove a device from my Z-Wave network, but i have implicitly disabled deletions through the wrapper so they couldn't when i was first setting this up i didn't want them to accidentally delete new devices well now i trust them enough that i'm willing to give them that access, but i have to go back and add it to my wrapper but that's one way is so they don't talk to the api directly which they absolutely could, they investigate the api in a read-only way we identify the functions they need for their immediate task and then we build a wrapper that only allows those particular tasks and then when they go to communicate with Home Assistant, they execute that particular wrapper.

1:05:22Wes:Yeah, that's where something like MCPs, wrappers, ways that you can offload the deterministic and perhaps dangerous stuff you want more carefully audited out of their direct hands and give them a structured interface that guides them to the right path.

1:05:34Chris:Yeah. That's why there's the hotness around MCPs, too. Senior Smile. Senior Smile says, I figured some listeners may be interested. Similar to ClipR, one of my favorite projects of all time is Asplayer. It allows you to clip sections in YouTube, Jellyfin, and many others. And it exports to ANKI.

1:05:53Wes:Anki? Anki? I used this to, oh, I think that's a note or a flashcard setup.

1:05:59Chris:Right? Oh.

1:06:00Wes:I used this to learn several languages. Nice. That's clever.

1:06:03Chris:It looks like it's on mobile, too. So you could clip this stuff. That's maybe the nice thing that, you know, I guess you could use TuneArt absolutely in the web browser. But this is a mobile app.

1:06:12Wes:I like where this is at. I would not have thought of that.

1:06:14Chris:Yeah.

1:06:14Wes:That's great.

1:06:15Chris:Yeah.

1:06:16Wes:Nefora 92 member boosts in. A long-time listener, now officially a member.

1:06:21Chris:Hey, thank you.

1:06:23Wes:Thank you much. Thanks to you two years ago, I finally gave NixOS a try. And now I feel like a preacher telling everyone how awesome it is.

1:06:30Chris:Funny how that happens.

1:06:31Wes:I'm even hosting a Nix session at work. Wow. Do you have any tips on how to approach it for people who have little to no Linux experience?

1:06:40Chris:Look at the Nixbook project?

1:06:41Wes:It depends on what their goal is. Are they trying to learn it in depth? Are they trying to just have to use a computer that happens to be implemented with NixOS? Those can be pretty different.

1:06:50Chris:Are they already on Linux? Could they use Nix on their existing Linux install and start to get familiar with it that way? They don't have to go full NixOS.

1:06:58Brent:I think TechDev is doing this during the show. Oh, he's trying to get his hands on NixOS for the first time. I don't know if you're there, TechDev. How's it going?

1:07:07Mumble:Oh, I'm definitely here. It's not the first time, but I am trying to get this set up for a repeatable build. And there's a base project here that's for another time to talk about. But admittedly, I'm a little outside of the context here.

1:07:21Chris:Yeah, it's on a very cool device. Yeah, it's a unique Nix project, sort of like we've been doing recently. That's such a great point too, because there's so many ways to do that. I actually think one of the most, easiest ways to get started is on your existing desktop even if it's mac os or whatever just get started feel.

1:07:41Wes:For what it's like to try to use uh build stuff and install stuff with.

1:07:44Chris:It we get really focused on the show with nix os because once you learn the next stuff you're like oh crap i want to build my whole machine this way but you don't really have to start that way.

1:07:52Brent:I think my biggest recommendation would be like use your favorite bot to help you nix os is really super good at being understood by the clankers and just have it explain what it's doing. Explain what a Nix config is. Explain what the parts are, how you install stuff. It's excellent at that.

1:08:12Chris:Explain what this Nix error message means because a lot of people struggle with that initially.

1:08:17Wes:Or how do I do this thing?

1:08:19Brent:We used to hear a lot about like, ah, the Nix OS documentation isn't very good. I'm having a hard time understanding it, etc. etc. We haven't heard that what, in a couple years since you could just use your favorite clanker to do it, and I think that's a good thing.

1:08:35Chris:Mm-hmm. Mm-hmm. I mean, it makes quick work of those air messages. All right. Rounding us out. Adversary 17 comes in with a member boost. Anniversary writes, a little behind because life has been busy. I'm listening to this episode and this Rust FS thing, and it sounds really cool. This boost amount is how many gigabytes my server has doing nothing. So if you'd like to use some of it, you know where to find me. Oh! Oh, that's, but this is a free member boost. There was no amount. So it has.

1:09:02Brent:Is this a trick question?

1:09:05Chris:By the way, just a quick follow up. Rust FS is officially in production here at JB.

1:09:11Wes:All right.

1:09:12Chris:Yep. We have put it in production and we talked about it in our clanker therapy stream. If you are interested. But yeah, I knew when we covered it, I knew it'd be put in production. I just didn't know so soon. All right. Thank you, everybody. Thank you to those of you who streamed sats as you listened. Seven of you did so. And together you stacked a mighty 10,917 Satoshis. When you bring it all together, including our fiat boost taken at current market value for sats, this episode stacked a Texas-sized 677,232 satoshis.

1:09:50Chris:Powering up the show to continue for yet another week and getting us ready for Texas. Thank you, everyone. Checkpoint has been saved. And of course, you can go to boost.jupiterbroadcasting.com to boost and get a message on the show and help us get to Texas. And you can put your support on autopilot at jupiter.party or linuxunplugged.com slash membership. Couple of picks, couple of picks. This one, this one is for those of you who like to watch what your system's doing.

1:10:22Chris:It's called HW Monitor and it's a desktop application designed to guess what? monitor your hardware.

1:10:29Wes:And look nice doing it.

1:10:30Chris:Yeah look real nice doing it and it's been a minute since we've mentioned something like this so you know it's probably worth it if we're bringing up a tool like this on the show and it is licensed under MIT mostly written in TypeScript and your buddy Rust.

1:10:46Wes:I'm using Tori.

1:10:48Chris:I think it looks good I think it looks really good, And if you've got, you know, temperature sensors on your graphics card, on your disk, and on your GPUs and your CPUs and your ICMs and your PCMs, it'll support those. It supports your disk sensors. It'll also monitor TCP and UDP socket connections. It'll read your system info so it knows your distro, your kernel, your host name, all of your hardware information.

1:11:12Wes:And because SystemD does everything, it tells you about your SystemD services.

1:11:17Chris:Hmm. Boy. Brian, look at that. Doesn't SystemD do a lot?

1:11:19Brent:Yeah, very comprehensive.

1:11:20Wes:Including showing you recent logs. You get the system CTL status output right there. It's pretty nice.

1:11:26Chris:It does look good, doesn't it? I mean, you know, it's good. It's clean.

1:11:30Wes:If, like, for some reason you're just, like, not already in a terminal, then you could launch this, you know, until you get a terminal going.

1:11:35Chris:You are in a terminal, though, right?

1:11:36Brent:Oh, most of the time.

1:11:37Wes:It must be.

1:11:38Chris:Okay, good, because this next pick requires you be in a terminal. I was telling the boys before the show started, like, I am in the terminal all day long. That and a couple of Electron apps on Firefox. That's it these days. And so I need a way to communicate with the boys. Back in the day, if we were just boys around the neighborhood, we would have had tin cans with string. Never got to do that, though. We missed that phase of life, but we can live it again.

1:12:01Chris:We can relive the glory days we never had with Tin Can CLI, a serverless peer-to-peer voice and text chat for the terminal.

1:12:11Wes:Yeah, Tin Can does what Discord does without needing any one server. The first person to open the app creates the room, sends the invite code it prints to their friends, and they connect with that code from anywhere in the world. No VPN, no portboarding, no accounts.

1:12:23Chris:I want to be clear. This is a terminal app and it has a really righteous TUI. It's awesome.

1:12:29Wes:Made with ratatui.

1:12:31Chris:And it even has like a little string between them. It's cute. And the whole thing is just adorable.

1:12:37Wes:It seems quite well done.

1:12:38Chris:I think there's like a ton server, right? There is like a proxy at some point. So you will hit like a server that they're hosting to help discover the two. But then I think the calls are direct peer to peer.

1:12:47Wes:Yeah. And then even on top of that, there's also like you have a coordinator role who kind of sets things up. But then separately, the voice mesh is all where any of the actual audio is sent. And that never goes through the control plane.

1:12:58Chris:How good is that TUI, though? Right? It's worth the install just for the TUI experience. And if you're already in there, it's just one of your tabs now on your terminal, and it is MIT licensed, and it is, you guessed it, 97.8% rust. Not necessarily a requirement at all. It's just what people are releasing these things in. And we just happen to have a soundboard.

1:13:19Wes:I mean, you know, I think part of it is Ratatouille has to become such a nice way to make Tui's that if you want to make a Tui, that's a great way to do it.

1:13:26Chris:Well, look at that thing.

1:13:28Wes:It is beautiful.

1:13:28Chris:Tincan-CLI. We'll have a link in the show notes. We got some good links, And those are all at linuxunplugged.com slash 687 or in your podcasting app. We try to put them in there as well. You got any hot tips before we get out of here? Like speaking of like website, we got a website that links to an RSS feed.

1:13:47Wes:Oh, yes, we do.

1:13:48Chris:That seems like there might be something in there people want to know about.

1:13:51Wes:Well, like if you have a question, because like maybe we're trying to repeat URLs that we're trying to tell you to go to, but we do a bad job of linking to them sometimes. Well, that information could be found in the transcript.

1:14:00Chris:That's true.

1:14:01Wes:Yeah, there's a VTT file, you download that, you grab in there, you get a bot to do it, whatever.

1:14:05Chris:You can clank your way through it if you want.

1:14:07Wes:Yes, you can.

1:14:07Chris:Whatever. Then there's also a sneaky MP4.

1:14:11Wes:Right. With our faces.

1:14:12Chris:Sometimes you can.

1:14:13Wes:And sometimes the Tui apps.

1:14:14Chris:Sometimes. Sometimes you get to see them in there. I can't say. But you can find out. Go to linuxunplugged.com slash RSS and get the RSS feed and put in any app or clanker you want. But the real pro moves to show up and make it a Tuesday on a Sunday, 10 a.m. Pacific, 1 p.m. Eastern, over at jblive.tv. That's also labeled at jupyterbroadcasting.com slash calendar in your time zone. That's also where we'll put the clanker stream when we're doing one.

1:14:39Chris:And, of course, meetup.com slash jupyterbroadcasting. We love your feedback and your support, boost.jupyterbroadcasting.com. And we have our Mumble info, our Matrix info, which has recently been updated, all of it at jupyterbroadcasting with links along the top of the website. It's pretty great. I love those links. Thanks so much for joining us on this week's episode. See you back here next week.