x

75% of people globally want unbiased news (Pew Research) but are concerned they're not getting that.

Get balanced coverage with Symby. See how stories are covered across diverse outlets and spot when one side covers a story the other skips.

PODCAST

Chaos Computer Club - recent events feed (low quality)

Der Chaos Computer Club ist die größte europäische Hackervereinigung, und seit über 25 Jahren Vermittler im Spannungsfeld technischer und sozialer Entwicklungen.

technology

All Episodes

00:24:59

One Boot Config to Rule Them All: Bringing UAPI Boot...

Chaos Computer Club - recent events feed (low quality) ·

2025/10/01

The UAPI Boot Loader Specification defines conventions that let multiple operating systems and bootloaders share boot config files. So far, only systemd-boot implements it - and it’s UEFI-only by design. As a result, hybrid UEFI/BIOS images require maintaining (and keeping in sync) two sets of bootloader configs: one for systemd-boot, and one for a legacy bootloader such as syslinux. I set out to fix that by building a BIOS bootloader that uses the UAPI Boot Loader Specification - allowing both

00:25:30

OS as a Service at Meta Platforms (asg2025)

Chaos Computer Club - recent events feed (low quality) ·

2025/10/01

I overview how OS management is done at Meta. We run millions of Linux servers and we have to make sure that OS gets updated on all of them in a given period of time. To do that we developed several products: MetalOS (Image based version of CentOS), Antlir (image builder) and Rolling OS Update (a service that keeps a set of DNF repos in sync with upstream repos and uses them to update OS ) Licensed to the public under https://creativecommons.org/licenses/by/4.0/de/ about this event:

00:26:33

Yocto's hidden gem: OTA and seamless updates with...

Chaos Computer Club - recent events feed (low quality) ·

2025/10/01

Updates are a critical piece of managing your fleet of devices. Nowadays, Yocto-based distributions can utilize layers for well-established update mechanisms. But, did you know that recent releases of Yocto already come with a simple update mechanism? Enter systemd-sysupdate: a mechanism capable of automatically discovering, downloading, and installing A/B-style updates. By combining it with tools like systemd-boot, we can turn it into a comprehensive alternative for common scenarios. In this

00:25:20

What's up with test.thing (asg2025)

Chaos Computer Club - recent events feed (low quality) ·

2025/10/01

`test.thing` is a VM runner which targets guests using an API defined by systemd. It started after a conversation at devconf about turning `mkosi qemu` into a library. A quick intro. ~~composefs is an approach to image-mode systems without the disk images. Files are stored in a de-duplicated content-addressed storage with integrity guaranteed through fs-verity. The last year has seen an acceleration of development on composefs-rs, a pure Rust implementation of the ideas behind composefs. Our

00:42:50

UKI, composefs and remote attestation for Bootable...

Chaos Computer Club - recent events feed (low quality) ·

2025/10/01

With Bootable Containers (bootc), we can place the operating system files inside a standard OCI container. This lets users modify the content of the operating system using familiar container tools and the Containerfile pattern. They can then share those container images using container registries and sign them using cosign. Using composefs and fs-verity, we can link a UKI to a complete read only filesystem tree, guaranteeing that every system file is verified on load. We integrate this in bootc by

00:34:54

A terminal for operating clouds: administering S3NS...

Chaos Computer Club - recent events feed (low quality) ·

2025/10/01

S3NS is a trusted cloud operator that self-hosts Google Cloud infrastructure in France, targeting the SecNumCloud certification, the most stringent Cloud certification framework. SecNumCloud includes strict legal and operational constraints. To manage these systems securely and reproducibly, we’ve built a family of dedicated administration terminals based on the image based philosophy. These terminals rely on NixOS semantics and draw from the ParticleOS ecosystem: systemd-repart, and dm-verity,

00:25:51

Leveraging bootable OCI images in Fedora CoreOS and...

Chaos Computer Club - recent events feed (low quality) ·

2025/10/01

In last year's ASG!, bootc and bootable containers were introduced. In this talk, we'll go over what changed since last year, and how Fedora CoreOS and RHEL CoreOS are leveraging bootable containers to reduce maintenance and increase sharing. Licensed to the public under https://creativecommons.org/licenses/by/4.0/de/ about this event: https://cfp.all-systems-go.io/all-systems-go-2025/talk/87TFB7/

00:24:20

Introducing ue-rs, minimal and secure rewrite of...

Chaos Computer Club - recent events feed (low quality) ·

2025/10/01

Introduce ue-rs, a fresh project that aims to be a drop-in reimplementation of update engine, written in Rust. The goal of ue-rs is to have a minimal, secure and robust implementation of update engine, required by A/B update mechanism of Flatcar Container Linux. Just like the existing update engine, it downloads OS update payloads from a Nebraska server, parses its Omaha protocol, verifies signatures, etc. This project, however, is different from the original update engine in the following aspects

00:22:46

container-snap: Atomic Updates from OCI Images using...

Chaos Computer Club - recent events feed (low quality) ·

2025/10/01

Traditional package updates using tools like RPM or Zypper can introduce risks, such as incomplete updates or accidentally breaking the running system. To overcome these challenges, we developed **container-snap**, a prototype plugin designed to deliver atomic OS updates—updates that are fully applied or rolled back without compromising the system's state. container-snap leverages OCI images as the source for updates and integrates seamlessly with openSUSE’s

00:26:27

Dirlock: a new tool to manage encrypted filesystems...

Chaos Computer Club - recent events feed (low quality) ·

2025/10/01

In the Linux world there are several tools and technologies to encrypt data on a hard drive, most falling into one of two categories: block device encryption (like LUKS) or stacked filesystem encryption (like EncFs or gocryptfs). This presentation will introduce Dirlock, a new tool that belongs to a third category: native filesystem encryption, using the kernel's fscrypt API. Dirlock is currently being developed and its aim is to provide a flexible way to encrypt files, suitable for both user

00:39:28

pidfd: What have we been up to? (asg2025)

Chaos Computer Club - recent events feed (low quality) ·

2025/10/01

File descriptors for processes on Linux have been available for quite some time now. Userspace has adapted them widely. Over the last two years or so we've extended the abilities of pidfds significantly. This talk will go over all the new features and deep dive into their implementation and usage. Licensed to the public under https://creativecommons.org/licenses/by/4.0/de/ about this event: https://cfp.all-systems-go.io/all-systems-go-2025/talk/3BMJVH/

00:38:14

Forget zbus, zlink is the future of IPC in Rust...

Chaos Computer Club - recent events feed (low quality) ·

2025/10/01

Last year, Lennart Poettering of the systemd fame, [gave a presentation](https://media.ccc.de/v/all-systems-go-2024-276-varlink-now-) at this very same conference, where he introduced Varlink, a modern yet simple IPC mechanism. He presented a case for Varlink, rather than [D-Bus](https://en.wikipedia.org/wiki/D-Bus) to be the future of Inter-process communication on Linux. As someone who works on D-Bus, I took upon myself to prove him wrong, only to find out that I achieved exactly the opposite. It

00:25:32

CentOS Proposed Updates: Bridging the Gap between...

Chaos Computer Club - recent events feed (low quality) ·

2025/10/01

CentOS Stream is especially suited for production deployments. In these environments it's often common to develop improvements to distribution packages and want to contribute them upstream. Unfortunately, until very recently that required one to then maintain their own build and deployment pipeline for the packages, at least until the changes made their way into the distribution. CentOS Proposed Updates (CPU) SIG aims to bridge this gap - changes that have been submitted as merge requests can be

00:21:43

Privilege delegation for rootless containers, what...

Chaos Computer Club - recent events feed (low quality) ·

2025/10/01

Going for minimal containers with restricted system calls and unprivileged users is the usual Kubernetes approach these days, and it works great for most web apps. However, the development of more complex infrastructure extensions frequently hinders application functionality. While looking for a solution to deploy virtiofsd in an unprivileged container for KubeVirt, we stumbled on seccomp notifiers. Seccomp notifiers are a kernel feature which monitors syscalls and get notifications to a userspace

00:41:04

New Linux Kernel Coredump Infrastructure (asg2025)

Chaos Computer Club - recent events feed (low quality) ·

2025/10/01

Coredumping on Linux has long been a nightmare. Currently two modes are supported: (1) Dumping directly into a file somewhere on the filesystem. (2) Dumping into a pipe connected to a usermode helper process spawned as a child of the system_unbound_wq or kthreadd. For simplicity I'm mostly ignoring (1). There's probably still some users of (1) out there but processing coredumps in this way can be considered adventurous especially in the face of set*id binaries. The most common option should be

00:31:54

Modernizing GNOME (asg2025)

Chaos Computer Club - recent events feed (low quality) ·

2025/10/01

GNOME has collected some very old code over the years. During the recent GNOME 49 release, we've made some drastic cleanups. Most visibly, we've dropped support for X11 and gained many dependencies on systemd. Let's explore some of the what and why for these changes! Licensed to the public under https://creativecommons.org/licenses/by/4.0/de/ about this event: https://cfp.all-systems-go.io/all-systems-go-2025/talk/FQE7QZ/

00:26:05

GNOME OS' prêt-à-booter image (asg2025)

Chaos Computer Club - recent events feed (low quality) ·

2025/10/01

GNOME OS is a distribution based around systemd-sysupdate. This year, we finally created a live installer image using the same /usr partition as the installed OS. The main innovation however is the ability to install without the need to reboot. The user can start working while the installation is happening. This live image is built using systemd-repart. And the installer itself also uses systemd-repart. But systemd-repart is not the complete solution and we had to solve some challenges. Licensed

00:24:23

Slim device software with systemd targets and nspawn...

Chaos Computer Club - recent events feed (low quality) ·

2025/10/01

It has been 10 years since Axis Communications had a presentation at the systemd conference. Back then, we have shown how we have increased our product quality, stability and boot times by porting our platform to systemd. 10 years later, we had different challenges to keep the resource usages and boot times under control. We have started from bottom up and sliced our software for this purpose. This work also got us inspired to create virtual versions of our hardware products that we cluster deploy

00:27:58

Shipping Flatpak applications with an image based...

Chaos Computer Club - recent events feed (low quality) ·

2025/10/01

Flatpak is the de-facto standard for distributing desktop applications across various Linux based systems. It also offers other advantages such as sandboxing. It is particularly useful for image based systems as it installs the applications into a separate location and doesn't try to modify the system. GNOME OS is GNOME's development, testing and QA operating system. It builds the latest and greatest in-development versions of the GNOME desktop and core applications. It is also Linux based system

00:41:53

Unprivileged Containers, with Transient User...

Chaos Computer Club - recent events feed (low quality) ·

2025/10/01

Many traditional container engines make use of the "subuid" concept and the "newuidmap" tool to implement a concept of "unprivileged" user-namespace containers on Linux. This approach has many shortcomings in my PoV, from both a security and scalability standpoint. Recent systemd versions provide a more powerful, more secure, mor scalable alternative, via systemd-nsresourced, systemd-mountfsd and other components. In this talk I want to shed some light on the problems with the "old ways", and in

4,205 results

Similar Podcasts

Lead With AI

Tamara Nall

Linux in the Ham Shack

Black Sparrow Media

Data Engineering Podcast

Tobias Macey

Eye On A.I.

Craig S. Smith

Reflections

Livewire Labs