Untitled Linux Show 273

Technological concepts & product/features covered

1) Shotcut video editor update (Shotcut 26.9)

• UI polish

  • Rounded corners across the interface
  • New Shotcut logo

• Audio improvements

  • Automatic audio ducking for audio timeline track properties
  • Audio quality changes: avoid conversion to 16-bit integers; keep pipeline at 32-bit float
  • Clip gain adjustment workflow: requires Ctrl+Alt + drag to prevent accidental changes
  • Added tooltip for the clip’s audio line

• Timeline / performance

  • Improved performance when:
    • Moving clips between tracks
    • Zooming
    • Undoing operations
  • Added “Generate adjustment clip”
    • A dummy clip that applies filters to the composite of underlying video tracks (without contributing video itself)

• Under the hood

  • Upgraded FFmpeg to 9.0

• Security

  • Security update addressing flaws related to Shotcut network downloads

• Sources

  • Details and links referenced to articles by Bobby Baris and Marcus Nester

---

2) Spectre security research: new variant “BTR” (Branch Target Reuse)

• Background refresher

  • Spectre abuses speculative execution and branch target buffers
  • Wrong predictions are discarded, but leaked data may remain in cache

• What’s new

  • Attack ties speculation to JIT compilers / just-in-time code generation
    • Example mentions: Firefox JS JIT; Linux eBPF/BPF
  • New attack (BTR):
    • Load a BPF program
    • Delete it
    • Load a new program into the same memory region
    • CPU reuses old branch predictions and may speculatively execute from unintended offsets

• Practical impact details

  • Demonstrated leakage rate: ~8 bytes/second
    • Presented as slow (dialup-like) but potentially sufficient for secrets with careful techniques (e.g., pointer chasing)
  • Demo described leakage of kernel data (e.g., password hash in memory and walking process lists)
  • Time estimates across Intel and ARM server CPU families

• Mitigation / fix guidance

  • Not remote: requires local attacker code execution
  • Fixes involve CPU indirect branch predictor barrier (IBP) usage (plus kernel flush behavior)
  • CVEs listed:
    • CVE-2026-6457
    • CVE-2026-6458
  • Fixed Linux kernel versions confirmed:
    • Mainline: 7.2.2+
    • Stable examples: 7.1.4, 6.18.39, 6.12.97, 6.6.145, 6.6.183
  • Guidance: update the kernel; authors note most systems are likely affected

• Discussion angle

  • Spectre variants keep evolving data-exfiltration methods
  • Emphasis on hardware behavior and the importance of software updates

---

3) Security updates outside Spectre

• Cloudflare: building its own certificate authority (CA)

  • Alternative to Let’s Encrypt using ACME
  • Mentions support for quantum-resistant approaches using Merkle-tree-like ideas, integrated with ACME/DNS without huge overhead

• Zimbra email suite vulnerability (open-source)

  • Issue: potential to skip authorization via a crafted email triggering problematic behavior in SNMP-related notification handling
  • Mitigation: update to Zimbra 10.1.20.20 or later

• Certificate lifecycle / revocation discussion

  • Why short certificate lifetimes are favored over OCSP/CRL in practice:
    • OCSP privacy/security risk: clients must reveal which domain they’re checking to a central responder
    • Mention: Let’s Encrypt OCSP support being withdrawn
  • Emphasis on automation: ACME automation makes short-lived certs less operationally painful

---

4) OpenSUSE: immutable mode inside the Leap installer (Leap 16.1)

• Change

  • OpenSUSE consolidating immutable options into an immutable mode inside the Leap installer
  • Reduces the need for a separate “Leap Micro” in many cases

• Technical approach

  • Read-only root filesystem
  • Transactional updates
  • Snapshot-based rollback

• Installer behavior

  • “Gamma installer” adds a toggle for immutable mode

• Related package/desktop updates mentioned

  • Plasma:
    • KDE Plasma 6.6 + OCR support
    • Spectacle updates
    • Accessibility improvements
  • GNOME:
    • GNOME 48
    • HDR support
    • New default audio player

---

5) KDE Plasma 6.8 (testing / release push)

• Key milestone

  • Plasma 6.8 planned as the first Plasma release with no X11 session
  • Wayland-only session; X11 apps still run via Wayland compatibility

• Public testing request

  • KDE developers asked users to hunt bugs during beta up to Oct 14

• Notable features being tested/rolled out

  • Backup tool KUP integrated into Plasma for simple automatic backups
  • Spectacle can include audio + screen recordings; higher quality and less latency screencasting
  • Remote desktop improvements:
    • Two-way clipboard sync
    • Performance improvements
    • “Exclusive” mode behavior
  • Performance / visual tweaks:
    • Triple buffering default for Nvidia GPUs
    • Rounded/shadowed Steam windows
  • HDR format support and improved HDR visuals
  • Accessibility improvements (e.g., dwell clicker)
  • Input/display management:
    • Disable auto-start entries without deletion
    • Pixel nudging monitors with arrow keys
  • “Union” theming engine
    • Preliminary support to style classic Qt Widgets apps too
    • Instructions:
      • Install the Union package
      • Choose Breeze Union in system settings
      • Compare against Breeze
      • Report only Union-specific breaks

---

6) Fedora 45 beta: “boring” performance results

• Benchmark summary

  • Fedora 45 beta is mostly performance-equivalent to Fedora 44
  • “Boring in the best possible way”
  • Biggest noted change: Python version bump (3.14 → 3.15)

• Snapdragon X1 laptop support

  • Expected to improve Qualcomm Snapdragon laptop experience
  • Source referenced: work led by a Linux laptop expert hired away from Red Hat (for Qualcomm Fedora work)

---

7) AlmaLinux certifications: catalog + free tooling (certification evidence)

• Goal

  • Demonstrate hardware/software compatibility with publicly viewable results

• Approach

  • Software certification
    • Publishers add products
    • Users confirm compatibility per Alma Linux release
  • Hardware certification
    • Via rewritten Alma-Certify tool

• Claimed improvements

  • Sub-10-minute certification runs on most hardware
    • Discussion notes quick mode may include only identifying/booting, while deeper tests can be selected
  • Runs from live media or existing installed systems (not strictly requiring a prior Alma install)
  • Machine registration flow uses QR codes

• Output

  • Tool collects normalized inventory:
    • CPUs, memory, disks, network cards, GPUs, firmware, driver versions
  • Results stored in a public catalog with benchmark figures

• Discussion emphasis

  • Provides organizations “proof” and helps vendors justify support

---

8) Netherlands government project using NixOS (“digitally autonomous workplace”)

• Context / motivation

  • Sanctions led to loss of access to Microsoft email for an ICC prosecutor
  • Dutch government recognized dependence on non-European services

• Project description

  • Full-stack approach:
    • OS, office/collaboration, cloud services, management tools, and even AI tooling

• OS selection rationale

  • NixOS reproducibility/auditability
  • Declarative configuration managed in files
  • NixOS foundation in the Netherlands; narrative less tied to a commercial vendor

• Tooling / UX

  • Graphical tool for NixOS config management aimed at Windows admins

• Deployment

  • Pilots in municipalities using older hardware (can’t run Windows 11)
  • Mandate described as formalized by government directive
  • Code hosted with backups and mirrors

---

9) Microsoft: WSL Containers becoming generally available

• What’s new

  • WSL containers (generally available) allow running OCI-compatible container images on Windows
  • Intended outcome:
    • Run Docker containers without installing Docker Engine
    • Optionally without a full Linux + Docker setup

• Limitation

  • Docker Compose not yet supported (Compose support expected soon)

• Developer/ops angle

  • Easier distribution of CLI apps as container images for Windows users

---

Tutorials / command-line tips included

Bash eval tip (Ken)

• Explains that eval causes the shell to parse and execute a string twice (dynamic command construction)

• Examples mentioned

  • Variable containing a pipeline string: using the variable alone fails because it treats parts as literal filenames
  • Using eval with ssh-agent -s to set environment variables in the current shell session
  • Building commands where arguments are composed inside variables

• Safety warning

  • eval can be dangerous due to risks like obfuscated command execution
  • Proper quoting/escaping is crucial

• Related discussion

  • Obfuscation patterns in JS are mentioned as similar “evaluate then run” risks
  • Practical uses discussed (e.g., building commands with dynamic history selection / fuzzy-find workflows)

---

Command/utility tip: schwim (shell with me) (Jeff)

• Schwim, part of the “magic wormhole” ecosystem
  • Creates a code/pairing flow so two machines can connect for file transfer or remote command-ish workflows
  • Avoids manual SSH tunnel complexity
  • Useful when one machine is behind a firewall

---

Games / community tools

Tuxdle (Linux-themed Wordle-style daily puzzle) (Jeff)

• A daily word puzzle using Linux terms/answers
• Gameplay
  • 6 attempts
  • Color-coded closeness
  • Hints in three tiers
• Categories
  • Linux command
  • Linux application
  • Linux term
  • Desktop environment
  • Linux distribution
  • Package manager
• Pro tier
  • Extra daily hints/bonus puzzles
  • Unlocks a direct clue option earlier

---

Main speakers/sources (as mentioned in the subtitles)

Speakers / co-hosts

• Jeff (main co-host; covers security, KDE, Fedora, Microsoft/WSL containers, etc.)
• Ken (co-host; covers Shotcut update, OpenSUSE immutable, eval tip, AlmaLinux certification, etc.)
• Rob (another co-host mentioned as absent/off playing hookie)

Referenced authors/news sources

• Bobby Baris (Shotcut release notes; also referenced for other items)
• Marcus Nester (Shotcut release notes)
• “Verald University at Amsterdam” / “Scroia Superior St. Anna in Italy” (Spectre BTR paper)
• Michael (Foronics) (Fedora 45 beta benchmarks)
• Surrov (referenced multiple times, especially for OpenSUSE immutable mode and AlmaLinux certification coverage)
• Nate Graham (KDE Plasma update/test request; also KDE Linux discussion)
• Victor Greaves (NixOS government project motivation; mentioned in the Netherlands story)
• Jonathan Wright (AlmaLinux infrastructure lead, quoted)