kaylynb

Not in my experience. I've run both Windows and Linux for the last decade and Windows is the only OS that I ever have problems with updates wasting my time and breaking things. I've been running image-based Linux for the last two years and the worst case is rebooting to rollback to the last deployment. Before that it was booting a different btrfs snapshot.

Fun aside: I had a hardware failure a few years ago on my old workstation where the first few sectors of every disk got erased. I had Linux up and running in 10 minutes. I just had to recreate the efi partition and regenerate a UKI after mounting my OS from a live USB. Didn't even miss a meeting I had 15 minutes later. I spent hours trying to recover my Windows install. I'm rather familiar with the (largely undocumented) Windows boot process but I just couldn't get it to boot after hours of work. I just gave up and reinstalled windows from scratch and recovered from a restic backup.

My servers are pets not cattle. They are heterogeneous and collected over the years. If I used k8s I'd end up having to mostly pin services to a specific machine anyway. I don't even have a rack: it's just a variety of box shapes stacked on a wire shelf.

At some point I do want to create a purpose built rack for my network equipment and maybe setup some homogenous servers for running k8s or whatever, but it's not a high priority.

I like the idea of podman-systemd being an impl detail of some higher level orchestration. Recent versions of podman support template units now, so in theory you wouldn't even need to create duplicate units to run more than one service.

It works pretty well. I've also found that some AI models are pretty decent at it too. Obviously need to fix up some of the output but the tooling for conversion is much better than when I started.

Neat. I like to see other takes on this. Any reason to use rootless vs `userns=auto`? I haven't really seen any discussion of it other than this issue: https://github.com/containers/podman/discussions/13728

I've run my homelab with podman-systemd (quadlet) for awhile and every time I investigate a new k8s variant it just isn't worth the extra hassle. As part of my ancient Ansible playbook I just pre-pull images and drop unit files in the right place.

I even run my entire Voron 3D printer stack with podman-systemd so I can update and rollback all the components at once, although I'm looking at switching to mkosi and systemd-sysupdate and just update/rollback the entire disk image at once.

The main issues are: 1. A lot of people just distribute docker-compose files, so you have to convert it to systemd units. 2. A lot of docker images have a variety of complexities around user/privilege setup that you don't need with podman. Sometimes you need to do annoying userns idmapping, especially if a container refuses to run as root and/or switches to another user.

Overall, though, it's way less complicated than any k8s (or k8s variant) setup. It's also nice to have everything integrated into systemd and journald instead of being split in two places.

Oh yeah I agree. There's a lot of fun problems to solve with Minecraft servers. I didn't mean to imply that there are no reasons for good chunk gen. I'm primarily into technical survival so my personal priorities wouldn't be chunk gen.

Chunk gen makes sense to implement last or never. If you want a performant Minecraft server you need to pregen all the chunks anyway. You can still later regen chunks that have never been visited to get new chunkgen on updates since chunks store the inhabited time.

I think Minecraft server re-implementations are pretty neat and I like to see when a new one comes out. There are also specific purpose server impls like MCHPRS for doing fast redstone compilation for technical minecraft.

Another advantage of printed parts is it's easy to use alternative part designs. There are lots of variants on the standard parts that you most likely will start replacing stock parts with as soon as you get addicted.

I really like Silverblue and run it on a couple of secondary machines (like in my workshop), but it’s still rough for anything off the beaten path.

The largest pain points for me:

- Any kernel modules. I know Ublue has images but I wish Red Hat would just have an official solution that doesn’t require hacky RPMs and such.

- Kernel cmdline args or any initramfs changes: can’t package in image and need to be applied manually. Maybe it’s possible to build a custom initramfs to distribute?

- Secure boot and enrolling moks is very annoying. My current workstation just uses sbctl to sign a UKI against custom keys and everything “just works”. This is part of why kernel modules are a pain in Silverblue too.

If you don’t care about kernel modules with secure boot it’s quite nice though. Practically zero maintenance.

1 Gbps is nice when downloading games and updates. Since everything is digital it can be the difference between waiting 30 minutes or 3 hours. IE: You play a game the night it's released/updated or wait until after work the next day.

Upload speed probably makes more sense for more use cases though. I used to have symmetric 1Gbps fiber and never bothered to setup QOS as my upload was never saturated.

I moved and am stuck with "1Gbps" Comcast. Which really means 25Mbps upload. I had to setup qdiscs on my gateway and split my network into tiers to get acceptable upload speeds and latency for the workstations in my home. I maybe have more uploads than 'normal' people, as I have automated backups that store data off-site, but normal people have "backups" in the form of cloud storage I think.

Uploading videos (to YouTube, for example) is painfully slow. I'm simulating living in Australia when I upload a video.

Linux is about as consistent as Windows these days. /etc isn’t really a “dumping ground” for everything and is quite static now. Just diffed a snapshot of /etc on my workstation from a month ago and there aren’t really any changes I didn’t put there myself. It’s reasonable to make /etc immutable on a lot of systems; something impossible with the registry.

Home is a bit more chaotic but most applications follow the XDG specs. Mostly. Less so with cache and state files (vscode, for example, dumps tons of cache/state files in .config instead of .cache and .local/state). And weird things like Flatpak shoving everything in .var.

I’d say things generally behave about as well as windows apps which often treat documents as a dumping ground for all kinds of files. I always have to go to pcgamingwiki to find game data locations without having to check half a dozen places.

For administration I really like the /usr and /etc divide. Vendor files go on /usr, and overrides for the running system in /etc. It’s useful to be able to peek in /usr to see defaults.You don’t really get that ability with the registry. With some more modern setups /etc is bootstrapped from /usr (for example, with systemd-tmpfiles) and you can “factory reset” a system by clearing out /etc (with some asterisks around restoring state for a few of the legacy state files still kept in /etc if the system is has manually created users/groups).

Sometimes breaking changes for ZFS are backported to LTS anyway.

The article title is very misleading. This isn't bypassing FDE in any way. It's just getting a root shell on a machine you have physical access to with a particular boot configuration.

Clever? Yes. But no encryption is bypassed.

Most systems will only be listening to PCR 7 anyway, so a similar attack could be done by loading your own custom bootloader, or possibly reading messages on the SPI bus when booting. This is just a nice trick that's easier/faster.

There is a balance of convenience versus security and this could be prevented easily by disabling recovery shell or registering more PCRS (with correct boot setup), but would be much more annoying to remotely administer since you could get failure states where the TPM won't release the keys in a variety of situations.

Ultimately TPM-only unlock is a significant increase in security vs unsophisticated attackers and probably fine for 99% of people, but isn't something to rely on if you are concerned about sophisticated attackers.

Even with perfect PCR setup and enrolling only custom keys in UEFI, a running machine is still vulnerable. Cold boot or DMA attacks (Thunderbolt or PCI) are just a few that come to mind. These sound extremely sophisticated but are easily done even with hobbyist equipment. Any running machine with currently unlocked disks should be assumed to be possible to compromise with physical access.

If interested in Linux boot chain Poettering has a good read: https://0pointer.net/blog/brave-new-trusted-boot-world.html

There are a lot of interesting talks around Linux boot security in the upcoming All Systems Go! conference: https://all-systems-go.io/

Microsoft has info regarding boot security in BitLocker Countermeasures: https://learn.microsoft.com/en-us/windows/security/operating...

Most people don't realize how dangerous automobiles really are. Accidents are one of the leading causes of death in the US until people get to be 45+ and cancer starts overtaking it. Even in 2020-2021 CDC data that probably has less people driving than usual: https://wisqars.cdc.gov/data/lcd/home. One thing I liked about living in a city was being able to walk to work. I'm reluctant to work anywhere I have to commute because the last few years have likely significantly reduced my chance of accidental death purely due to remote work.

In some ranges it's the leading cause, although overdose deaths sometimes win out. It's kind of absurd that this isn't brought up in articles about remote work. Newspapers run articles about gun violence every day despite it being wwaaaayyyy less likely than dying in an automobile accident, but the far greater danger of commuting is almost never discussed.

This has been my experience in the US. C++ is my favorite language. I learned programming using it in the mid nineties. I still keep up with developments although I wouldn't consider myself the most skilled with it anymore.

The only job I've ever had that used it was a civil engineering company in a small city in the deep south, and it was mostly just C. The pay was good for the area, but nothing spectacular.

I moved to Seattle and the only C++ jobs were at FAANGs, and only a small portion of jobs at those companies. I worked at two FAANGs and only used Java and C#. I learned frontend web stacks largely due to job flexibility and it almost always pays the best vs amount of stress/work needed to put in.

Yeah I could probably write C++ at <insert FAANG> for 2x the salary but I'd also have to work 80h work weeks and deal with FAANG internal politics and sabotage from coworkers, depending on FAANG and which variation of "don't call it stack ranking" they use this year.

On the other hand I can use TypeScript and work from my home office. I've been considering moving back to the south just because much lower living expenses, family, and availability of remote work for web stacks. I can't get that with C++.

Sparse sets.

They're often used in Entity Component System architectures since you have O(1) add/remove/find, & O(n) iteration. Iterations are also packed, which is a bonus for cache efficiency.

Can be difficult to implement well, but the concept is simple and a neat example of a useful specialty data structure. Take a look at https://github.com/skypjack/entt

Ansible. I maintain 4 workstations (3 Linux, 1 Windows) from the same config. It's a bit overkill but it has the flexibility to deal with the hardware and OS differences.

Linux is essentially automatic. Install OS using custom arch-iso build. Download Ansible config repo. Run playbook.

Windows is a bit more rough. Ansible runs in WSL connecting to the host via ssh.

For work I just fork my personal config, add changes needed for work environment in a private repo. I can pull upstream changes and rebase easily.

Main downside is it's a bit verbose, and I still need manual steps to converge certain types of changes (like deleting/moving configs) because I don't want to write even more code to do that.

Having all the additional steps in a role and not just config files is extremely useful when revisiting a configuration years later.

For development, I usually just use Git to synchronize changes. Syncthing is useful sometimes.

Thanks. I've heard good things about them, but they were sold out for a long time.

I actually did many days of research into assembling my own KVM. HDMI is surprisingly straightforward but DP is a nightmare of nested standards. Just one example: There is support for running i2c tunneled through another protocol. The biggest issue is the link speeds that a DP1.4 cable runs at. The chips needed to do the switching are expensive and pretty much need to be machine assembled. When you get to those frequencies the trace design and board composition even become a factor.

After all that I don't find the $299+ for a good KVM to actually be that excessive. It's surprising how difficult it is to electronically do "I unplug cable and plug another one in".

I don't even need stuff like display spoofing, etc, since I only use one machine at a time and don't constantly switch, but it was just way too much work to put together. If you only need slower link speeds it's doable.

The mouse is a big problem for me. I didn't used to care either, but started using a 144Hz monitor years ago and now it's hard for me to go back. Even my TV is 120Hz.

I just notice discomfort when my monitor isn't >90Hz or so. On Windows it occasionally will reset to 60Hz, maybe due to video card driver updates? I could probably re-adjust back to 60Hz in a few weeks but I don't see the point of going through the discomfort, especially when I occasionally do play games where the higher frame rate makes a much more drastic difference.

Same here. I can’t really use a monitor that’s less that 120Hz, even for engineering work. 60Hz monitors give me eye strain.

It’s impossible to find any KVM at any price point that works with 120Hz, and certainly not 120Hz@3840x1600. Forget about G-Sync.

I resorted to just keeping short USB and DP or TB->DP cable extenders plugged into the computer ports and have a “cable zone” where I just unplug and replug all the cables to switch machines. The short extensions are to protect the ports in the machines from wearing out.

It’s way cheaper than any KVM and it actually works.

How do you tell if a dog is a service dog though? The ADA already allows excluding misbehaving service animals, which should cover a good portion of 'fraudulent emotional service animals' considering how well most people mistrain their animals.

There are legitimate service animals for a wide variety of real conditions that a lay person could not be expected to consider. Dogs that can detect incoming seizures or problematic psychological states, and they could look very similar to an 'emotional support animal' but actually be a legitimate service animal.

OPN/pfSense have been mentioned.

Don't waste time with WiFi on the gateway itself as most WiFI chips you can buy are crippled in firmware for regulatory reasons. Just use a dedicated commercial AP hooked up directly or VLANed.

Once you get comfortable with something like pfSense I highly recommend switching to regular Free/OpenBSD, or Linux depending on what you're comfortable with. I find it much easier to manage a gateway with the entire configuration in version control than a GUI. There aren't that many services that a gateway needs to run.

If you feel like you'll miss pf on the *BSDs check out nftables on Linux. It's not as well documented but it's much less painful than iptables.

To loop this into the UPnP discussion: when you build your own gateway from scratch you have to add a UPnP daemon and configure it yourself, instead of forgetting to disable it and exposing poorly configured IOT stuff.

This is the way to do it.

NAT is not really security and UPnP doesn't really do much to prevent malicious software already on your network from doing malicious things except perhaps hosting itself on your WAN to spread further.

What disabling it does help is prevent improperly configured or flawed devices from accidentally exposing themselves to your WAN. IOT devices? Put them on a network with no UPnP. Workstations and video game consoles with up-to-date patches? UPnP is probably fine.

I saw this iCloud pushing in-person at an Apple store a few months ago:

Someone had brought in their iPhone and it needed to be wiped for repair. The rep was pushing iCloud under threat of losing their data. It seemed like such a scam. I can only imagine what it feels like to be tech-illiterate and told you must buy a subscription or we'll wipe your family photos.

A 'premium' phone like an iPhone should really have a free backup for at least the data size of the phone. At the very least you should be able to get iCloud free for when your phone is in for repair.

Not necessarily more power efficient. Modern desktop systems have quite good power management features.

Depending on the workload, a device that consumes a lot of power but also goes into an idle state much faster could actually use less overall power.

Take a look at any of Greg Kroah-Hartman's comments on patches that screw up ZFS.

One of the biggest ones was removing exports of kernel functions that ZFS used for encrypted datasets: https://marc.info/?l=linux-kernel&m=154689892914091

I'm fine with this sort of stuff in general assuming it doesn't affect LTS, but this specific patch was backported to LTS kernels even though it has nothing to do with security or bugfixes. I had several zpools I had to apply custom kernel patches on the machines for no other reason than because somebody is mad at licensing.

Bcachefs isn't even stable enough to use in production. Btrfs is okay, and I've used it before, but it's also a minefield of killing your data depending on what features you use. If you use all the features you need to make it on par with ZFS you may as well dump your data in the trash.

ZFS 'just works' and none of the features are incomplete or have asterisks attached that compromise data integrity. Yeah it has architectural problems, doesn't do stuff the Linux way, and has a license that makes devs angry. It's also never lost a byte for me in production for almost a decade of use.

I know the Linux devs don't owe me anything and I'm not really angry or anything about this. It's just a fact that it's frustrating to have to deal with political problems just to run a server.

The Linux kernel devs hate ZFS and actively sabotage it even backporting changes specifically to break ZFS to LTS branches.

It's fine if you use something like Ubuntu where it's officially shipped with the distro. If not, be prepared to apply kernel patches whenever the kernel team takes a snipe at ZFS.

I'm not trying to be political here, just my day-to-day experience working with several Linux machines running large zpools. It's still worth it compared to the alternatives but if I could use FreeBSD I would.

WireGuard is great, but I think it's really undersold when it's described as being just a vpn. It's really an encrypted tunnel that is configured like a network adapter in the Linux network stack.

This lets you configure it with stuff like systemd-networkd and unit files, or easily spin up a tunnel with a few `ip` commands, and setup some simple nftables rules to do all sorts of stuff.

I do use it as a vpn as well, but it's so much easier to setup than, say, OpenVPN, where you need to create tun/br interfaces and then tie them together with a service, etc. That said, OpenVPN and other actual VPN software does more than just a tunnel (like pushing routes, config settings, etc), so WireGuard cannot replace everything by itself.

The documentation is rather sparse, but there isn't much to it either. The manpages have what you need to know and the rest is just general Linux network stack knowledge.

I'm not sure I would call them impractical for everyday wear. I wear N95 masks when commuting during active wildfires. The news always says not to wear them because you won't put them on properly, but it's really not that hard to ensure the fitment is correct. It's not like the construction workers that wear them occupationally are rocket scientists.

My partner is more vulnerable to respiratory problems and has always worn N95 masks when in public during flu season. What's changed now is she gets all kinds of shit from people because they think she somehow hoarded masks away from healthcare workers. We've had boxes N95 masks for years, but now we're assholes for hoarding...

Even if the mask doesn't actually protect you, it will prevent you from touching your face and mouth absent-mindlessly.