Pangolin and identity-aware tunnels

We pull on a few loose threads from recent episodes, and some of them unravel into way more than we expected.

Sponsored By:

• Managed Nebula: Meet Managed Nebula from Defined Networking. A decentralized VPN built on the open-source Nebula platform that we love.
• 1Password Extended Access Management: 1Password Extended Access Management is a device trust solution for companies with Okta, and they ensure that if a device isn't trusted and secure, it can't log into your cloud apps.
• CrowdHealth: Discover a Better Way to Pay for Healthcare with Crowdfunded Memberships. Join CrowdHealth to get started today for $99 for your first three months using UNPLUGGED.
• Unraid: A powerful, easy operating system for servers and storage. Maximize your hardware with unmatched flexibility.

Support LINUX Unplugged

Links:

• 💥 Gets Sats Quick and Easy with Strike
• 📻 LINUX Unplugged on Fountain.FM
• LUP's Great Holiday Homelab Form
• LUP's Great Holiday Homelab Old Fart Form (markdown)
• Jellyswarrm — Bring all your Jellyfin servers together
• LiveTV support · Issue #9 · LLukas22/Jellyswarrm
• pangolin — Identity-Aware Tunneled Reverse Proxy Server with Dashboard UI.
• Pangolin | Secure Access Platform
• NixOS Search - Options - Pangolin
• Youtarr — Self-hosted web app that automates downloading, organizing, and scheduling YouTube channel content with support for Plex, Kodi, Emby and Jellyfin
• Add ability to set subfolder for manual downloads · Issue #287 · DialmasterOrg/Youtarr
• Dawarich — Your favorite self-hostable alternative to Google Timeline (Google Location History)
• dawarich CHANGELOG.md
• CVE-2025-40090 | Ubuntu — Since commit 305853cce3794 ksmbd_session_rpc_method() attempts to lock sess->rpc_lock. This causes hung connections / tasks when a client attempts to open a named pipe.
• SMB3 & KSMBD See Performance Improvements With Linux 6.18 — KSMBD also now adds a max IP connections parameter to optionally limit the maximum number of connections permitted per IP address.
• ksmbd vulnerability research · Doyensec's Blog
• ksmbd - Fuzzing Improvements and Vulnerability Discovery (2/3)
• ksmbd - Exploiting CVE-2025-37947 (3/3)
• doyensec's KSMBD-CVE-2025-37947 PoC
• GrapheneOS bails on OVHcloud over France's privacy stance
• GrapheneOS exits France — what it means for encryption
• France's Encryption War Escalates: GrapheneOS Exodus Signals Dangerous Precedent for Open Source Privacy Tech
• Seems like the GrapheneOS phone collab may be with Motorolla.
• Rust For Linux Kernel Co-Maintainer Formally Steps Down
• Bcachefs Ousted from Mainline Kernel: The Move to DKMS and What It Means
• Red Hat Introduces Project Hummingbird for “Zero-CVE” Strategies
• Richard Hipp - Git: Just Say No - YouTube
• 2011 SouthEast LinuxFest - Richard Hipp - Fossilize Your Code - YouTube
• Pick: Gopher64 — Highly compatible N64 emulator.
• Gopher64 — simple64's official and spiritual successor - Libretro — It’s made by the same developer(s). Unlike simple64 however, it’s not based entirely on Mupen64Plus. And it’s aiming for a more LowSpec hardware overhang.
• Install Gopher64 on Linux | Flathub