Linux - Reddit – Telegram
Linux - Reddit
751 subscribers
4.17K photos
207 videos
39.8K links
Stay up-to-date with everything Linux!
Content directly fetched from the subreddit just for you.

Powered by : @r_channels
Download Telegram
Some nifty stuff ffmpeg can do

# play a video
ffplay output.mp4

# play audio only
ffplay -nodisp output.mp4

# audio streaming of a youtube video
youtube-dl https://www.youtube.com/watch?v=dQw4w9WgXcQ -f bestaudio -o - | ffplay - -nodisp

WAYLAND USERS, LOOK AWAY!

# record screen and save as video
ffmpeg -f x11grab -i :0.0 -f pulse -i 0 output.mp4

# record part of the screen as gif for 5 with seconds
# with 800x600 resolution, 0 x-offset and 30 the y-offset
ffmpeg -f x11grab -framerate 10 -video_size 800x600 -i :0.0+0,30 -t 5 output.gif

# take a screenshot and save as png
ffmpeg -f x11grab -i :0 -t 1 -f mjpeg output.png

Note: the last three commands obviously requires X11, and ffplay may require installing ffmpeg-full on some distros (which is only 2 MiB if ffmpeg is already installed, at least on NixOs)

To be honest, I'm still reading ffmpeg's man page and I don't understand these commands much myself, I just shamelessly copied them from various websites. It all started this morning when I wanted to record the screen using peek (gif screen recorder) which didn't work due to some missing GTK dependency, did some Google-fu and now I'm uninstalling peek in addition to mpv, scrot and kazam (which IMO only serve as wrappers for ffmpeg) ... I can say that things escalated quickly.

https://redd.it/lj4v0w
@r_linux
Does anyone like snap package manager?

ubuntu comes with snap, but I don't understand the benefit.

I feel its redundant and takes up a lot of disk space to have installed. I have read it comes with all the dependencies for each deb, however sometimes I want to install my own dependency versions.

I like using ubuntu on things like raspberry pi, but the first thing I have to do is remove snap.

https://redd.it/lj4mbx
@r_linux
Flatpak security

I've started using Fedora Silverblue and I have few questions about Flathub packages security.
1. Is every single app in separate container, or there's one container for all Flatpak apps?
2. Most of popular apps like Visual Studio Code, are not official versions, I mean Microsoft didn't publish it. As far as I know there's no code review on Flathub. How can I be sure that apps from Flathub repository are safe?
3. Can I be sure that no app in Flathub repository is malicious?

https://redd.it/ljbpr9
@r_linux
Just, a command runner written in Rust

Just lets you save and run commands from files with a terse, readable syntax similar to Make:

build:
cc *.c -o main

# test everything
test-all: build
./test --all

# run a specific test
test TEST: build
./test --test {{TEST}}

It is cross-platform, written in Rust, and actively maintained on GitHub:

https://github.com/casey/just/

Just has a bunch of nice features:

- Can be invoked from any subdirectory
- Arguments can be passed from the command line
- Static error checking that catches syntax errors and typos
- Excellent error messages with source context
- The ability to list recipes from the command line
- Recipes can be written in any language
- Works on Linux, macOS, and Windows
- And much more!

Just doesn't replace Make, or any other build system, but it does replace reverse-searching your command history, telling colleagues the weird flags they need to pass to do the thing, and forgetting how to run old projects.

https://redd.it/ljdcki
@r_linux
Best and Easiest way(s) to Secure OpenSSH authentication on your personal systems.

There are two ways that I like nowadays and both of them involve 2FA and hardware keys. Specifically Yubikey in my case, but other ones will probably work as well.

The traditional approach to securing OpenSSH authorization involves several approaches:

Traditional SSH Keys - A very good and robust approach for managing access on personal systems. In large organizations the problem of key management is hairier then it seems at first glance.
SSH Keys signed with OpenSSH built-in CA support \- A intermediate approach that most people are unaware of that are a good match for many businesses and other organizations. With this approach you are using SSH keys that are signed by a CA. This way you can do things like revoke system access quickly in case of a compromise.
Kerberos - A great approach if you are using AD or FreeIPA already. But the overhead of managing it is pretty high and relatively minor issues with network configurations can cause massive headaches, which makes it detrimental for personal use.

So for personal use just old fashioned SSH keys are the way to go. However We can make OpenSSH auth even more secure with hardware tokens.

Now the older way to do it is to enable 2FA using OTP (one time password) approach. This generally involves adding additional login requirements in the form of PAM modules. This is going to be the most common search result as it's been in use for years now. It can take advantage of your own TOTP infrastructure or tie into Google's or other providers. This is fine, but I really despise working with PAM. If I can use something OpenSSH supports natively then that is the way to go, IMO. Especially when you can avoid additional infrastructure dependencies.

The two "new" ways I have discovered as of late are:

1. Take advantage of OpenPGP/Smartcard support available on some hardware cards. Most notable Yubikey 5 series, but there are others. With this approach you use GPG and gpg-agent to manage your private keys. Access is protected by a card PIN (can be up to 127 ascii characters).
2. Take advantage of FIDO2. Since version 8.2 OpenSSH has supported FIDO2 authentication natively. Which is freaking fantastic. You should use a password encrypted private key for additional security. Make it more 2FA-ish.

Pros of OpenPGP/Smart card approach:

Can work with older versions of OpenSSH
gpg-agent support is built into proper Linux desktops
All the private keys are managed via hardware token.
Can use hardware token with a wide variety of other software.
More single-sign-on-like You don't have to keep fingering your key for things like ansible.

Cons:

A lot of hardware tokens don't have OpenPGP/Smartcard support.
Can be a pain to migrate secured (password disable) systems from old key to GPG key. You end up doing things like running one shell with SSH_AUTH_SOCK ssh-agent and another with gpg-agent, or setting up aliases to help copy over new keys and remove old ones.
A lot of work is required to setup your card. Need to setup subkeys and such things.
You really need to have a second hardware key as backup in case your main key gets lost or damaged.
By default gpg deletes private keys from your \~/.gnupg keyring after copying to the card, so you have to back up your keyring prior to that if you want to have backups.
Need to configure ssh client to look to gpg-agent instead of ssh-agent.
Can't use cool ed25519 keys.

Pros of FIDO2 approach:

Minimal additional configuration. Pretty much all you need to do is use ssh-keygen. It's exceptionally easy to setup.
ssh-agent is integrated by default in decent Linux desktops.
Uses separate encrypted private key (recommended) for additional password protection.
easy migration to new keys.
Fido2 works well with many websites.

Cons:

Can't backup your hardware token. You need a second token if you want backup.
If you want backup token you have two sets of keys to
manage.
Need to finger the device for each SSH usage (can mitigate with OpenSSH [ControlMaster](https://ldpreload.com/blog/ssh-control) feature. May not be true for all hardware tokens.
Needs very new (>8.2) version of OpenSSH to work. So no-go on LTS installs like vanilla CentOS 8.

As you can see the Fido2 approach is the slicker and newer of the two approaches. Probably slightly more secure as well.

​

With the FIDO2 all you have to do is:

1. Purchase a hardware token that has U2F/FIDO2 support.
2. Setup the FIDO2 PIN (recommended) (for yubikey use yubiky-manager command "ykman set-pin")
3. And then run ssh-keygen:

​

ssh-keygen -C "nice name for key here" -t ed25519-sk -O resident -f ~/.ssh/mynewkey

And it should prompt you for your fido2 pin and that's it. You can begin copying around the key with ssh-copy-id.

​

If you do get a hardware token and it does have OpenPGP support then you really are going to want to use it for other stuff. It can tie into Pass password store, secure communication with email and other protocols and a whole bunch of other stuff. If you are already doing that stuff adding OpenSSH support is fairly trivial.

The approach to properly setting up OpenPGP support using GNUPG is significantly more involved. The best guide I know of is this one:

Dr. duh's YubiKey-Guide

He has you go full-paranoid with offline encrypted creation and backup of the keys among other things. Highly recommended. If you are doing it you might as well do it right.

After that you just need to make sure that you have "enable-ssh-support" set in your \~/.gnupg/gpg-agent.conf. (maybe restart your gpg-agent or log out and log back in, whatever works best for you).

And then tell OpenSSH to use the gpg-agent socket. Set the equivalent of

export SSHAUTHSOCK=$(gpgconf --list-dirs agent-ssh-socket)

If your .bashrc or whatever is appropriate for your setup.

After that you can run:

ssh-add -L

to list your public key. Which then you can copy around manually. Or just use ssh-copy-id, it'll do the right thing even though there is no pub file in \~/.ssh for it.

​

After that then pick a standard OpenSSH hardening guide. All the same things apply. Just don't go nuts. No need to make it easy to trivially trigger a denial of service on yourself using silly things like fail2ban. Remember with passwords disabled brute force attacks are worthless. Failed logins are just OpenSSH doing it's job and are about as interesting as logging pings. Successful logins are what you should be monitoring for and be paranoid about!

In /etc/ssh/sshd_config do things like:

PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no

​

https://redd.it/ljd9rl
@r_linux
code-connect: Open files in VS Code over remote terminal connections

I put this little thing together out of frustration while working with remote machines via SSH.

My usual workflow consists of connecting to a remote machine via SSH using my favorite terminal. Whenever I need to open a file in this terminal session, I can't simply run code nginx.conf as that would open a VS Code window on the remote machine. But I want to display the file in my local editor window without having to set up X11 or VNC. So I'm stuck with vim. Oof.

When using VS Code to establish a remote SSH session, the above works like a charm using the integrated terminal. The same goes for WSL sessions. Again, for other terminal sessions, this is not the case.

So I looked closer at how VS Code communicates between remote and client and came up with a repo based on an answer on StackOverflow. If you're interested in how it works, I've written a small summary in the README.

Meet code-connect

All you need to do is to source a noscript in your .bashrc. Run code-connect to find an open IPC socket and a corresponding code binary, which is now available in your shell session. You're now free to run code . anywhere on your remote machine to attach to your locally running VS Code window!

Users of the fish shell also get the easy option to install through a plugin.

https://github.com/chvolkmann/code-connect

Hope it's helpful to you guys, comments and feedback are welcome!

https://redd.it/ljfl3d
@r_linux
Possible to share GPU (Nvidia) between QEMU (Windows Guest; HDMI output) and docker containers?

I've been using my Nvidia GPU with docker without any problems (ie. nvidia-docker container/runtime) but I'd like to add a virtual Windows OS (ie. QEMU) to my host (Debian 10.8).

Is it possible to share one GPU between docker and QEMU?

Example:

Docker -> FFMPEG -> Transcoding
Docker -> Plex -> Transcoding
QEMU -> Windows 10 Guest OS -> (Gaming) -> HDMI output

https://redd.it/ljh5np
@r_linux
Microsoft Edge browser on linux

I heard new Microsoft Edge is better than Chrome. Is it true what i am reading. I thought Internet Explorer and Edge are same so i havent used it yet. How useful is it for web developers? Is it any better than remaining like firefox and chrome

https://redd.it/ljep15
@r_linux
fun nonsense = fortune + dadadodo

Somewhere in a distro's repositories there'll be the ancient games package(s), containing the fairly well known fortune and the slightly less well known dadadodo.

fortune pulls witty, silly, stupid and/or downright thought provoking things from a database. dadadodo is designed to take text and uses Markov chains to turn it into new text, which probably doesn't make any sense, but occasionally hits fortune levels of thought-provocation with a good input text.

Tennis between thoughts and slow cogs turning:

$ dadadodo -o ~/.fortunes.dadadodo <(fortunes -m .)

i.e. output a personal (~/ is home directory) database of fortune text from all fortunes (matching any character - regexp .) for later re-use

$ alias dddd='dadadodo -l ~/.fortunes.dadadodo -c $((1+RANDOM%3))'

i.e. set up an alias to run dadadodo using the aforementioned database with an output count of between 1 and 3 paragraphs at RANDOM.

Now when I run dddd I get odd nonsense such as:

The day! A is the Computer showed the soft Ritz: cracker?

You ever come in a crime or what's So that When your car you get
a Teddywookie: CSA, there must unintelligible chimeras, then
we're, one to remain then disappears.

etc.

https://redd.it/ljkzuo
@r_linux
Console like OS

What is the best console like linux distro. I'm new and would like to install linux in my old laptop. I heard that linux runs fast on old hardwares and i want to turn it into something like a portable console.

https://redd.it/ljmejc
@r_linux
Scaling with xrandr

Hello,

I am having trouble scaling my screen with xrandr to 200% without losing quality.

I am currently using the command xrandr --ouput eDP-1 --auto --scale 0.5x0.5 however the quality sucks. If anyone knows how to fix this please do let me know!

https://redd.it/ljnzlc
@r_linux
Introducing yabridge 3.0, with the first ever Linux <-> Windows VST3 plugin bridge

yabridge is a modern and transparent way to use Windows VST2 and VST3 plugins on Linux as if they were native Linux VST2 and VST3 plugins. VST2 and VST3 are the two most widely used standards for audio processing plugins.

I'm very proud to finally announce yabridge 3.0! I've spent the last few months working on adding support for VST3 plugins to yabridge. With this release yabridge now supports the entire VST 3.7.1 specification. This proved to be an interesting challenge since true VST3 plugin bridging had not been done before, but in the end I'm very happy with the results. If you're interested then you can read about some of the design decisions in the architecture document. Outside of supporting several new features that aren't supported by VST2, VST3 plugins running under yabridge also tend to be much more efficient than their VST2 counterparts because of the way VST3's audio processing works. And sicne new developers are not allowed to create commercial VST2 plugins anymore because of the licensing, robust VST3 plugin bridging seemed like a logical next step for improving the pro audio experience on Linux.

Outside of VST3 support and a number of other improvements, fixes, and new configuration options, I've also spend a lot of time optimizing the editor experience even further. Resizing windows should be more responsive with these changes, and closing windows is now deferred meaning that closing and switching between editors in some DAWs is much faster now. Yabridge now also changes realtime scheduling policies on the fly to minimize the risk that expensive GUI operations interfere with audio processing. This should get rid of any potential xruns when opening and interacting with plugin editors for certain plugins that do a lot of heavy computations there. There are a lot more editor related changes outside of this including a frame rate limiting option, a way to used Wine's own XEmbed implementation and an option to forcefully enable drag-and-drop in REAPER.

A full changelog with an exhaustive list of changes, improvements and fixes can be found here:

https://github.com/robbert-vdh/yabridge/releases

https://redd.it/ljp2vd
@r_linux
Malware in default repositories - is it possible?

I was using many distributions recently. I started wondering, how high is risk of getting malware from default repositories. Can I assume that I can download completely random packages from default Arch, Debian or Fedora repositories, and I should be safe? I believe only trusted packages should be present in default repositories. But i guess it might be different from distro to distro. I'm usually using only out of the box settings for repositories, or I'm adding only trusted ones like repo listed on official Visual Studio Code WWW.

https://redd.it/ljq8r5
@r_linux
What are some of the best books to learn the Linux Operating System?

I’ve been wanting to learn the linux operating system for quite some time now but don’t know exactly where to start. I have been looking at a few books but not sure which one is well worth the money for a complete beginner. Anyone have any recommendations?

https://redd.it/ljsrlu
@r_linux
Switch to Linux

Hello Guys!

I'am kinda new to the Linux Platform and I want to make a switch.

My Question is: If I buy a laptop that has Windows pre Installed on it, and i install let's say Ubuntu for example. Are all the necessary drivers in the new Install (The Distro grabs it automatically) or do I need to get them somewhere else, like the Manufacturers website.

https://redd.it/ljuwx7
@r_linux
My experience with cloud storage services

I want to share my experience. When I moved to Linux for job (I'm an artist and know linux for a long time, but previously I've used linux just for fun purposes) I've faced a problem: noone of most popular cloud services works properly/or being hard to configure (for example: google drive can't deal with my 100gb backup of artworks and settings from scratch on fresh install). So I found an application named koofr (from Slovenia, servers based in Switzerland) that have native linux client. It works good for 2 years for me.
I'll be happy if this helps somebody with the same problems.

https://redd.it/ljws8s
@r_linux
Canon Pixma MG2522 is fully compatible with Zorin OS

Both print AND scan are working, just struggling to get the ink cartridges clean. Hooked up automatically with usb cord without having to install any drivers. Will have to get some more ink (I may have to order online). Had problems with the hp scanner not working - which is mainly what I need it for. Just wanted to share the good news for anyone who needs it! Picked it up from the Goodwill for $6. Imagine that! I needed to use my own cord but I guess I got lucky I had one that worked :)

https://redd.it/ljwbgj
@r_linux