I usually watch online videos using mpv with yt-dlp, basically all you need to do is run mpv with the URL of the video (for example copy+pasted from the browser):

mpv https://www.youtube.com/watch?v=xxxxxxxxx

This is far lighter on the cpu than anything browser-based, even when the browser uses hardware assisted decoding.

This works for many online videos, not just youtube.

you might want to put your yt-dlp preferences in the mpv config file, for example I have the follwing in ~/.config/mpv/mpv.conf

script-opts=ytdl_hook-ytdl_path=/path/to/yt-dlp/yt-dlp.sh
ytdl-format=bestvideo[width<=1920][height<=1080][vcodec~=?'^(vp9|h264|avc1)']+bestaudio/best
cache=yes
cache-on-disk=no
cache-pause-wait=5
cache-pause-initial=yes
demuxer-thread=yes
demuxer-cache-dir=/tmp
demuxer-max-bytes=800MiB
demuxer-readahead-secs=15
cookies=yes
keep-open=yes

I find the title of this thread misleading bordering on clickbait as it could imply that the offcial Devuan server(s) has been comprmised, it should be changed to something like "personal server running an ancient Devuan release compromised".

sudo is one of the first packages that I uninstall on laptops/desktops after a fresh installation.

It is not even meant for the purpose it's being used by most Linux distros, sudo is meant to give limited access to specific commands as root or other restricted user to specific users on a multi-user system, not as a "run everything you want as root" tool on a single user desktop/laptop system.

We have to thank Ubuntu for introducing this misuse of sudo on Linux.

Thanks for the how to, it works fine!

I wouldn't call it hostility, but if you write a reply that clearly shows that you didn't read the previous posts in the thread and therefore write incorrect or redundant stuff then don't expect to be also thanked for that.

I'm a Devuan user and this affects Devuan too so I'm writing it here, I have no interest in joining the Debian forum or ML. Also as I suspected there must be Debian Devs keeping an eye on this forum too, as it's too much of a coincidence that they started working on the yt-dlp package for trixie last night a few hours after I started this thread here.

Yep, the latest upstream version, I'm using that right now since I'm no longer using the outdated and insecure packaged Debian version.

This is not about me, as I already wrote I have now moved on to the upstream binaries anyway, it's about all other Debian 13 / Devuan 6 users who use the Debian yt-dlp package and might not even be aware of this CVE.

But if we have to manually install binaries from upstream to avoid security issues then what's the point of a distro?

My main concern now is how many other long known CVEs are there in other Debian packages that have not been fixed yet?

Do I really have to start checking all the packages that I use for known CVEs that Debian hasn't fixed yet?

Does this not make you concerned?

Well the packaged version from backports (2026.03.17) was working fine for me until a couple of days ago (BTW, yt-dlp isn't only for youtube, it works on many sites), only today it started acting up which is why I was looking for updates and found out about the CVE.

A serious CVE should be a good enough reason to update it.

You can create an /etc/X11/Xmodmap (if you want it for all users) or ~/.Xmodmap (just for your own user) file with the keymappings you need.

To check which keymap corresponds to a key on your keyboard run xev in a terminal.

A mapping looks like this (this adds the '©' symbol on the 'c' key on my keyboard using the right Windows key as modifier):

keysym Super_R = Mode_switch
keysym    c = c C copyright

See also the Xmodmap man-page.

Ok, after some extensive googling I found the solution in the end:

In the following thread on the linux.debian.user newsgroup a Debian user asked the same question 4 years ago:
https://groups.google.com/g/linux.debia … lSllKEIUVk

After lots of trial and error he finds the solution, it's XFCE starting up both ssh-agent and gpg-agent and annoyingly this is not exposed in the "Session and Startup" GUI config tool of XFCE where I had already looked, it requires using xfconf-query to disable:
https://docs.xfce.org/xfce/xfce4-sessio … gpg_agents

I can confirm that running the following two commands (as indicated in the above XFCE docs link) prevents ssh-agent and gpg-agent from being started automatically by XFCE:

xfconf-query -c xfce4-session -p /startup/ssh-agent/enabled -n -t bool -s false
xfconf-query -c xfce4-session -p /startup/gpg-agent/enabled -n -t bool -s false

@rolfie What is that command supposed to do, I get no output from it?

I do have the openssh-client package installed (/usr/bin/ssh-agent is included in this package) and I use ssh all the time, but I have no use for ssh-agent.

The ssh-agent weakens ssh security and can be a real security risk:
https://medium.com/@bornaly/why-i-alway … c52573fa2f

@greenjeans in this thread I would like to find out what starts them in the first place so that I can disable them, I can always re-enable them once I know how to disable them (in case I need them).

Without providing as much detail as possible (for the first one exact sequence of commands used and for the second one screenshots and links of the downloads, in addition to the devuan version you are running) you won't get any real answers as your problem description is way too vague for that.