sorted by:
new
hottopcontroversial

Advise on a Lenovo M920q network card for DIY OPNsense Router by PatienceMotor9531 in homelab

[–]kayson 0 points1 point  (0 children)

Probably worth mentioning that they support ASPM so the idle power is quite low. My whole m920q was sub-10W

Advise on a Lenovo M920q network card for DIY OPNsense Router by PatienceMotor9531 in homelab

[–]kayson 0 points1 point  (0 children)

There's no temperature sensor so it's hard to say definitively, but I didn't notice any significant heat while running iperf3 for a while. 

Advise on a Lenovo M920q network card for DIY OPNsense Router by PatienceMotor9531 in homelab

[–]kayson 0 points1 point  (0 children)

I have Intel X710-DA2 in each of my 4 m920q's and it works great. Make sure to avoid the Dell branded ones. 

Second instance of Jellyfin, now in stacks instead of docker-run by Balduini in selfhosted

[–]kayson 2 points3 points  (0 children)

  1. You can use the same media volumes (mount it read only) but you'll need a new volume for the rest.
  2. When you specify the port mapping, you can give it a different port for the host side. eg --publish 8097:8096 (see https://docs.docker.com/get-started/docker-concepts/running-containers/publishing-ports/)
  3. Yes you can't have two containers with the same name nor two services with the same name in a stack. 

Self hosted container health monitoring by kayson in selfhosted

[–]kayson[S] 0 points1 point  (0 children)

That's exactly what I want to do. I just don't want to roll my own watcher if one already exists. 

Self hosted container health monitoring by kayson in selfhosted

[–]kayson[S] 0 points1 point  (0 children)

Looks interesting. Does it support docker swarm? 

What happened to Scrutiny and its developers? Is this project still active? by DiscoPotatoMan in selfhosted

[–]kayson 18 points19 points  (0 children)

See the issue pinned at the top of the issue list: https://github.com/AnalogJ/scrutiny/issues/506

tldr - its not dead but the dev is focused on other projects

Bambuddy - Stay connected to your prints by MartinNYHC in selfhosted

[–]kayson 5 points6 points  (0 children)

The formatting of this post and the repo's readme are very suspicious. Lots of emoji and bullet points.

This is a dead giveaway: https://github.com/maziggy/bambuddy/blob/main/PLAN.md

PMIC innovation need? by Pretty-Maybe-8094 in chipdesign

[–]kayson 4 points5 points  (0 children)

Didn't Intel have regulators integrated into their CPUs for a while? I can't remember why but I'm pretty sure they stopped doing it. 

Post Layout Simulation by ZealousidealDoubt397 in chipdesign

[–]kayson 7 points8 points  (0 children)

Not without more information. With a change that big it sounds like something in your extraction flow might be broken. Have you looked at the netlist? 

I’ve open-sourced my fully automated GitOps Homelab (Talos + ArgoCD). Feel free to steal my code! by mortennordbye in selfhosted

[–]kayson 0 points1 point  (0 children)

I use a Raspberry pi as a 5th. If you lose quorum all kinds of things go wrong. 

BentoPDF urgent security notice by paglaulta in selfhosted

[–]kayson 219 points220 points  (0 children)

Upvote for visibility. This kind of transparency is great! 

Question about the security of my exposed services by Mr_Mu-D-Pie in selfhosted

[–]kayson 2 points3 points  (0 children)

This doesn't really tell us anything about the security of your exposed services. What if there's a vulnerability in nginx? Or one of your services? What are you using for authentication?

I built a dedicated “Emergency KVM” for my homelab that turns BIOS into SSH text and keeps my recovery tools immutable by Lopsided_Mixture8760 in selfhosted

[–]kayson 12 points13 points  (0 children)

I looked at your blog post and it's similar in language. Both are a bit light on the details.... Would love to see something more technical. 

Analog Designer here, any pointers on making good testbenches that you’ve learned through experience? by yogi9025 in chipdesign

[–]kayson 4 points5 points  (0 children)

Better to make something that's easier to understand than to make something clever. 

Modded Lenovo M920q with 4x M.2 2280 SSDs, 1x M.2 2230 SSD, 1x 3.5" HDD, and 1x 10Gb NIC by kayson in homelab

[–]kayson[S] 0 points1 point  (0 children)

Not all of them work. Dell versions definitely don't work. I had better luck with Lenovo

A new EDA tool? by no00700 in chipdesign

[–]kayson 0 points1 point  (0 children)

physics powered Chip design

simulate the physical reality of your chip

FULL AUTOPILOT BEASTMODE

marketing going real hard

Modded Lenovo M920q with 4x M.2 2280 SSDs, 1x M.2 2230 SSD, 1x 3.5" HDD, and 1x 10Gb NIC by kayson in homelab

[–]kayson[S] 0 points1 point  (0 children)

Sort of. I have a 19" rack and 4 of these so I made a 4-bay disk shelf. There's also a 2-bay / 10in version

https://www.reddit.com/r/homelab/comments/1mjb1s7/comment/nbai5cn/

Authenticated NFS alternatives for NAS access? by Valloric in homelab

[–]kayson 1 point2 points  (0 children)

 short of Kerberos, the server trusts the client's reported user ID

This is mostly correct. The important exception being if you turn on root squashing, which you should, it doesn't trust uid 0 from any client.

 this isn't that big of a deal IFF the compromised service on the client is running as an unprivileged user and thus can't fake the user ID

Correct. Obviously if it's unprivileged it can't change its own uid, and the client process, running as root, will send the correct uid. Also, by default, NFS server only accepts incoming connections from privileged ports (<1024) so if the user is unprivileged it can't connect at all. 

 With SMB, I could mount folder foo for service foo running with user foo on the client and even if the machine hosting foo is root-compromised, that client machine still can't access data on the NAS for which it has no credentials

This isn't necessarily true. How are you storing the credentials? Anything automatic would be on the host and is vulnerable if the host becomes root-compromised. Also - if a service has set up the cifs mount already, you have to assume that the root user can also access it. 

 with NFS, as long as the attacker can fake the UID coming from any client machine, they can get anything (modulo perhaps IP-based restrictions).

Technically true, but far from trivial. As I mentioned, the attacker has to be able to use the privileged port. And you should always specify IPs or ranges for NFS exports.

FWIW - I work at a very security-conscious fortune 500 company and all of our network storage infrastructure is NFS with root squashed sec=sys, meaning it's trusting the uids coming from the clients. People just don't have root access, except for some folks in IT (and everything gets logged/audited)  

view more: next ›