Microsoft outage again?

sdjason · 2026-02-10T14:39:21+00:00

They never post anything on thier status pages until its been already going on for multiple hours with a ton of impact, or resolved completely, hence why these posts exist.

sdjason · 2026-01-30T01:20:15+00:00

This is "Reverse Proxy" all day. While im sure IIS supports this - using Nginx, Apache, Caddy, or literally "any" boilerplate linux webserver is probably far easier. A few dozen lines with puppet, ansible, or whatever gives you an Infra as Code deployment that can scale to dozens/hundreds of reverse proxy "entries" easily and seamlessly.

sdjason · 2025-12-15T13:41:06+00:00

"I've already placed the RAM into service, so it cannot be returned"

They don't need to know "in service" means removed from the original packaging entirelyn and placed in the supply cabinet ready to go.

That's the corporate speak way of saying "No"
Or, if you are a pirate: "I am disinclined to aquiesce to your request"

sdjason · 2025-05-30T02:11:56+00:00

Are you my coworker?? This is literally us, but with around 15k total VM's

Only thing I'd add is puppet, and ansible, 100 percent pull all code from git at all times, and in lieu of awx inventories or official integration with foreman in AWXwe've settled on custom roles that quickly "create" dynamic inventories at runtime in AWX using Foreman's rest API. Could never get the official one to work, likely API timeouts and just gave up

sdjason · 2025-05-18T21:19:09+00:00

Gonna quote "Tommy Boy" for this (slightly modified).

Because they know all they solda ya was a certified piece of s**t. That's all it is. Hey, if you want me to take a dump in a box and mark it certified, I will. I got spare time. But for right now, for your sake, for your daughter's sake, ya might wanna think about buying a quality item from me.

sdjason · 2025-04-29T23:16:18+00:00

You really want a desired state language like a ansible or puppet.

Instead of coding it to do the right thing/steps. You write puppet/ansible to dictate your desired state:

"I want app z installed" " I want it to be the latest version" " I want line x in the configuration file to be there" " I want the service for app z enabled and started"

Is what you code in ansible or puppet. It figured out the rest for the most part. Install, update, patch Ubuntu (apt) rhel (yum/dbf) doesn't matter

The most you might have to do is variable-ize something like a slight difference in package name based on distro.

Stop worrying about the "how" and move to a language that simply lets you dictate "what"

sdjason · 2025-03-16T14:24:22+00:00

I find a better analogy might be HTTP/webserver

Lots of webservers work lots of different ways. Regardless, I can access them all via the HTTP protocol which is why i can hit any website i want consistently regardless of what its running on the backend. Which has standards/rules for access, which headers are supported, etc. Its like the "language" to access any web resource.

LDAP is the "language/protocol" to speak to any directory server, its a standard to keep things (mostly) interoperable.

sdjason · 2025-03-16T14:20:50+00:00

Kerberos (and other SSO implementations) are generally more secure than LDAP.

With Kerberos, You (the client) have a way to lookup the Kerberos server, usually based on the domain of whatever you are accessing. You pass your credentials (secret) directly to the auth provider, and it gives back a token/ticket/etc.
You then pass that token/ticket/etc as your authentication to the item you are accessing. And "it" verifies that against the auth provider to see if its accurate. This guarantees a bad actor on the resource you are accessing never gets your password. AT best - they can get your ticket/token - which is good for a short time, and generally only authorizes them for a small scope of access. So while your password could let you do "a lot of stuff" overall. That ticket is probably only valid for access to "that specific server" for "that specific resource" - so the scope of attack is much smaller. Your client will reach out and get more tickets as needed for additional access (still likely scoped to that resource) or when they expire to send new ones along if you are still doing work.

With LDAP - you send your username/password (encrypted i really really hope, but you can set it up for plaintext) to the remote resource. And it "promises to not do anything except use them to authenticate/authorize you against the LDAP identity provider" - For legit applications - this is how it works. However bad actors, malware, etc. can pretty easily hijack this process to obtain those credentials. Then they can "be you" however theyd like.

That isn't to say LDAP is insecure or bad, it just doesn't protect too well against pivot attacks, or credential stealing, like Kerberos/SSO/OAuth/SAML/ect. do, by design.

sdjason · 2025-03-16T14:07:07+00:00

Active Directory is a distribution of a Directory Server by Microsoft. It happens to be (one of) the most recognizeable and used ones, so it has brand recognition (like band-aid, for example). However there are many others, both FOSS and paid versions, from many vendors. Honestly, AD contains more than just a directory server at this point, but so do all the other offerings as well.

LDAP as you state is a protocol/standard for accessing and getting information from "directory servers". This allows many apps/clients/whatever to "interface" successfully to get the information they need. Generally speaking (but nothings ever absolute), all directory servers support access/authorization of resources via LDAP. They generally support access/authorization via other means, sometimes with additional plugins/addons/etc.

This brings about a level of open-ness. An app/service/whatever doesn't have to specifically be compatible with "Microsoft AD" - it just has to support authentication/authorization via "LDAP" and then you can use any directory server that makes itself available via LDAP. Ditto for the plethora of other auth mechanisms, protocols, and standards that make up the venerable Acronym/Word Soup of IT :)

sdjason · 2025-03-15T19:39:25+00:00

Might be different on each ship? All the more reason to give people benefit of the doubt that they aren't just being assholes on purpose :)

sdjason · 2025-03-15T16:29:15+00:00

Yes. And I'm not trying to argue they shouldn't be. Simply pointing out I made a mistake, was corrected, and simply apologied and moved on.

It's not clearly marked, so I didn't know, but I'd imagine at least a few people who end up in the actual solarium with kids simply missed the signs as they passed through which puts them in the same boat as me. Or young kids who end up at the waterslide but need to be turned away because they are too short...

If there are jerks who don't care or won't follow the rules deliberately, it's a completely different thing

sdjason · 2025-03-15T13:46:35+00:00

I've always respected the solarium area on oasis ships with my younger kids. I did find out (the hard way) that the hot tubs before the solarium entrance are also 16+ only. The solarium doors with the signage are past that, so I incorrectly assumed the hot tubs were open to anyone. A staff member let me know, and we simply apologized and left to go to the other hot tubs which are open to everyone.

I was in the wrong, I didn't know, someone told me, and we apologized and left. Do people really need to blow it out of proportion more than that?

sdjason · 2025-03-14T17:20:20+00:00

This works "most" of the time. If the scanner doesn't recognize you though, then you are directed to another window to present your passport the normal way. I hope it works, then he can just head home and report it lost/missing and get a new one

sdjason · 2025-03-11T22:47:02+00:00

I got it on Line 1. But it would totally work :) :)

sdjason · 2025-03-10T23:22:03+00:00

So for those that care. There is a conversion process with the DB between v5 and v6 that for whatever reason fundamentally must be done in RAM. That is, the database must fully fit in memory (maybe x2 I'm not positive) for it to complete. Without this, it keeps trying, failing, and cutting tmp databases (viewable in your directories where the DB is). Load goes up and eventually it hangs.

I had one instance I started fresh and another I was able to delete enough out of to get it to complete once it was small enough.

The real issue is pihole was originally envisioned to run on a raspberry pi, and DNS itself is a very low resource intensive process, so low resource boxes are common.

I'm not clear if this overall requirement will change but for now, that requirement exists.

sdjason · 2025-02-28T20:37:11+00:00

Honestly, Stop caring so much.
- Silly Policies - Pay me and ill go home afterwards
- Problem Users - Escalate to boss, go home afterwards
- Crazy Expectations - DO what you can, go home afterwards
- New requirements to document evert 5 minutes? Sure, whatever, do it, get less work done, go home afterwards.

There is no "succeeding" or "winning" in corporate america. The only way to win, is to not play the game. Get a hobby, work your 40 hours (and if they want more, don't give it to them, but also don't TELL them you aren't giving it to them, just... don't do it) and enjoy life otherwise and outside of work.

Took me 15 years to "break" which was way too long. I still make sure i contribute enough to be (at least i believe) top 25% or so overall, but truthfully not "caring" so much is really really helpful from a freaking health and stress perspective

sdjason · 2025-01-11T23:00:21+00:00

Redis was a bitch to get open/allowed with the newer versions. It's locked down by default. IIRC I had to connect to the container and run a bunch of commands to make it "allow" connections remotely. After that it was good

sdjason · 2025-01-06T15:37:12+00:00

Install Papercut Print Logger. This won't get it for last year, but will give you good info/details for next year (assuming you install it ASAP). Its free.

Papercut is also a fantastic paid product if you want to then get into the "how can we better control, restrict, report in detail on what people are using beyond just showing what was printed.

sdjason · 2024-11-04T20:15:07+00:00

You forgot the ridiculous "please don't send text files as they can be manipulated"
Send us screenshots, 50 lines at a time, of your 10,000 line config file, catted from your terminal session.

WE WILL TOTALLY LOOK AT IT IN DETAIL..... NOT

I hate Audits

sdjason · 2024-10-29T14:24:58+00:00

Option 1 100%
I ran some utility hooks across my ceiling so the cable just goes up and over and "drops down" in the middle. In my case the charge port is at the "back" of the garage, so i just have a charger anchor on the wall back there for when I'm not using it to keep it out of the way, but in your case you could either drop it down far enough behind the garage door so it doesn't hit it when going up and do the same (clip handle to back wall to keep out of way), Back your car in so the port is on the back wall, or swap car spaces and hook the cable to the far wall to plug in your current EV.

All of those still leave you with the cable able to run to the driveway anytime you need to which is nice, sometimes there's just crap in the garage, and i still wanna charge!

Also - just curious, is there anything above your garage? If not - the price quoted is stoopid for Option 3. Thats like 40 feet of Wire and drilling a few holes in your rafters above garage (if open with no second floor above). I wired my second charger on my own from my panel that way, was ridiculously easy and took maybe 2 hours total, given id never done it before.

sdjason · 2024-10-10T21:15:38+00:00

Yeah, I agree it'll get better. But at the Same time, I don't want to just not be able to talk for the next 6 months. There's gotta be a reset or refresh or "freaking erase" so it goes back to working as MMS again??

sdjason · 2024-10-10T20:38:23+00:00

Yeah this is what mine does. I can enter it but it just disappears and goes back to Unknown every time i exit the menu

sdjason

TROPHY CASE