• 2 Posts
  • 77 Comments
Joined 2 years ago
cake
Cake day: June 11th, 2023

help-circle

  • keep it on cache since I do a lot of code compilation, but I will usually switch it to frequency for gaming and stuff.

    Isn’t gaming the most cache-heavy CPU workload there is? The X3D CPUs have consistently topped gaming benchmarks, even outperforming much more modern CPUs that lack 3D cache.

    I’d sooner do it the other way around: frequency for compiling, rendering, transcoding, etc. Cache for gaming!


  • The problem with non-PLP drives is that Rook-Ceph will insist that its writes get done in a way that is safe wrt power loss.

    For regular consumer drives, that means it has to wait for the cache to be flushed, which takes aaaages (milliseconds!!) and that can cause all kinds of issues. PLP drives have a cache that is safe in the event of power loss, and thus Rook-Ceph is happy to write to cache and consider the operation done.

    Again, 1Gb network is not a big deal, not using PLP drives could cause issues.

    If you don’t need volsync and don’t need ReadWriteMany, just use Longhorn with its builtin backup system and call it a day.


  • F04118F@feddit.nltoSelfhosted@lemmy.worldKubernetes storage backends
    link
    fedilink
    English
    arrow-up
    4
    ·
    edit-2
    10 days ago

    I tried Longhorn, and ended up concluding that it would not work reliably with Volsync. Volsync (for automatic volume restore on cluster rebuild) is a must for me.

    I plan on installing Rook-Ceph. I’m also on 1Gb/s network, so it won’t be fast, but many fellow K8s home opsers are confident it will work.

    Rook-ceph does need SSDs with Power Loss Protection (PLP), or it will get extremelly slow (latency). Bandwidth is not as much of an issue. Find some used Samsung PM or SM models, they aren’t expensive.

    Longhorn isn’t fussy about consumer SSDs and has its own built-in backup system. It’s not good at ReadWriteMany volumes, but it sounds like you won’t need ReadWriteMany. I suggest you don’t bother with Rook-Ceph yet, as it’s very complex.

    Also, join the Home Operations community if you have a Discord account, it’s full of k8s homelabbers.


  • F04118F@feddit.nltoMechanical Keyboards@lemmy.mldeleted
    link
    fedilink
    arrow-up
    5
    ·
    edit-2
    11 days ago

    I don’t have experience with any of the models you’re considering. I used a Corsair for years (don’t!) and am currently quite happy with an old Filco Majestouch 2 TKL that I added some white and pink keycaps to.

    The Filco was bought used, is built like a tank and only cost about €80.

    The one thing I miss in it is QMK/VIA support.

    As I understand it, a keyboard with QMK or another firmware with VIA support essentially allows you to program your keyboard however you want. And then bring that programming (“layout”) with you to another board.

    My Filco has 4 dip switches on the back that allow very limited programming: for example, switching Esc and `, or switching Caps Lock and Ctrl.

    But I can’t make it such that Caps Lock works as Caps Lock when long-pressed alone, but as Ctrl when struck in a chord with another key. QMK/VIA would make this possible.

    Even if you don’t want to do this now, having the option to play with combination keys and smart layouts like that is very interesting when you want to downsize from TKL to a smaller board.

    Also, consider the used market.








  • The way I understand it, there’s 2 use cases for a VPN, with different concerns and providers:

    • having access to your private home network from anywhere, through an encrypted tunnel (Tailscale, Wireguard on the router, etc)
    • having your outgoing traffic to the internet go through an anonymized exit node so that your ISP can not watch or sell what you are doing (ProtonVPN, Mullvad VPN, etc)

    Is Tailscale fit for the second? I thought not, as the exit node is not an anonymized VPN server but one of your own machines.







  • You keep using the word “maintenance”. All I’m worried about is not installing any security patches for months.

    The problem that I tried to highlight with my “cherry picking” is:

    • Running a machine with open vulnerabilities for which patches exist also “paints a target on your back”: even if your data is worthless, you are essentially offering free cloud compute.
    • But mostly, a single compromised machine can be an entrypoint towards your entire home network.

    So unless you have separated this Orange Pi into its own VLAN or done some other advanced router magic, the Orange Pi can reach, and thus more easily attack all your other devices on the network.

    Unless you treat your entire home network as untrusted and have everything shut off on the computers where you do keep private data, the Orange Pi will still be a security risk to your entire home network, regardless of what can be found on the little machine itself.


  • No it is

    https://www.pandasecurity.com/en/mediacenter/consequences-not-applying-patches/

    And:

    You’re allowing for more attack vectors that would not be there if the system were to be patched. Depending on the severity of the vulnerability, this can result in something like crashes or something as bad as remote code execution, which means attackers can essentially do whatever they want with the pwned machine, such as dropping malware and such. If you wanna try this in action, just spin up a old EOL Windows machine and throw a bunch of metasploit payloads at it and see what you can get.

    While nothing sensitive may be going to or on the machine (which may seem to be the case but rarely is the case), this acts as an initial foothold in your environment and can be used as a jumpbox of sorts for the attacker to enumerate the rest of your network.

    And:

    Not having vulnerability fixes that are already public. Once a patch/update is released, it inherently exposes to a wider audience that a vulnerability exists (assuming we’re only talking about security updates). That then sets a target on all devices running that software that they are vulnerable until updated.

    There’s a reason after windows Patch Tuesday there is Exploit Wednesday.

    Yes, a computer with vulnerabilities can allow access to others on the network. That’s what it means to step through a network. If computer A is compromised, computer B doesn’t know that so it will still have the same permissions as pre-compromise. If computer A was allowed admin access to computer B, now there are 2 compromised computers.

    From https://www.reddit.com/r/cybersecurity/comments/18nt1o2/for_individuals_what_are_the_actual_security/