jansommer

I've installed this on my Surface Go 2 64GB. Runs smooth! Absolutely the best tablet experience for Linux. The support is also wild: My silly questions are answered within hours.

4k is really nice for text. Always annoyed by 1080p screens for work. But yeah gaming - 1080p is fine. I have a 9060 XT and I play games at 4k like Mortal Kombat X, Fallout 4, Evil Within 2, Dead Space Remastered and Wolfenstein: The New Colossus. All 60+ fps on Linux and an ancient cpu.

Doom: The Dark Ages is 1440p and still looks great.

Total waste of money paying so much more for a gpu unless you want local ai, and those weirdo interpolation technologies are a pain in the a* to get working.

A quick search on Xeon production yields that it goes through a rather rigorous testing. I wouldn't be surprised that server cpu's in a desktop pc works longer. I can't overclock it either, and that probably helps with its lifespan as well. But yeah, the fact that it actually powers on when i click the button and isn't a limiting factor after 10 years is quite something.

Could it just be really bad cooling? Looking at 9800X3D, it seems like it's running in a similar range wrt TDP unless you really push the 9800X3D. I'm comparing with desktop cpu's because that's what my workload is. cpu governor is set to performance (no schedutil). No audible change in fan speed during heavy compilation or gaming (very silent humming), and i don't have any fans beside cheap intake, cpu and exhaust fans (1 each) + an excessive amount of dust.

It should be closer to 85W on load. And it's incredibly silent on even a low end cooler. I rarely get above 50° Celcius.

The E5-2620 v4 is great. Have been using it for 10 years now. Wanted to upgrade until I saw current prices. I have 64 GB ddr4. Paired it with rx 9060 xt 16 GB and games run as fast as ever. Perhaps the cpu is a slight bottleneck in DOOM The Dark Ages, but i'm at 60 fps, so no problem. Light llm on the gpu is a nobrainer, and it's cool to see that things can be tuned to run ok on the cpu. I bought 2667 v4 a month ago for 30$. I'd expect it to give a decent performance boost but I just haven't had the need for it yet, but pushing into llm like in the article I'd probably upgrade because 2667 can handle slightly faster ram.

It's easy for others to see what you're downloading: https://iknowwhatyoudownload.com. So if you're unsure if the torrent is legitimate, I'd probably avoid it.

Guy talks about switching to the "Classic" version if

> you just want a simple, open source, local-only JSON-formatting extension that won't receive updates.

Wow that sounds like a tough choice. JSON formatting is moving at such a fast pase that I don't know if I should pay a JSON formatting SaaS a monthly subscription, or if I really can live without updates.

One could also try Android 15 and 16 on Waydroid: https://github.com/WayDroid-ATV/waydroid-builds/releases

Windows subsystem for Android is deprecated. There's a community maintained alternative but it seems to have a few problems wrt. Windows updates.

AI is such a blessing. I use it almost every day at work, and I've spent this evening getting a Bluetooth to USB mapper for a ps4 controller working by having ChatGPT write it for me, for a bigger project I'm working on. Yes, it's going to take some time to fully understand the code and adjust it to my own standards, but i've been playing a game a few hours now and I feel zero latency and plenty of controller rumble that I'm having fun giving some extra power. It pretty much worked with the first 250 lines of C it spew out.

What's gonna be super interesting is that I'm going to have an rpi zero 2 power up my machine when I press the controller's ps-button. That means I might need to solder and do some electrical voodoo that I've never tried. Crossing my fingers that the plan ChatGPT has come up with won't electrocute me.

This is also the university that develops RumbleDB[0]. It uses JSONiq as its query language which is such a pleasure to work with. It's useful for dealing with data lakes, though I've only experimented with it because of JSONiq.

[0] https://github.com/RumbleDB/rumble

Archive Files is for blobs as far as I understand. All your other data remains uncompressed?

Something to consider when using SQLite as a file format is compression (correct me if I'm wrong!). You might end up with a large file unless you consider this, and can't/won't just gz the entire db. Nothing is compressed by default.

Precisely! That's why RDS sounds so interesting. I get a lot more knobs to tweak performance, but I'm curious if a maxed out gp3 with instances that support it is going to fare any better than Aurora.

Have you benchmarked your load on RDS? [0] says that IOPS on Aurora is vastly different from actual IOPS. We have just one writer instance and mostly write 100's of GB in bulk.

[0] https://dev.to/aws-heroes/100k-write-iops-in-aurora-t3medium...

This is super confusing. Check out the RDS Postgres calculator with gp3:

> General Purpose SSD (gp3) - Throughput > gp3 supports a max of 4000 MiBps per volume

But the docs say 2000. Then there's IOPS... The calculator allows up to 64.000 but on [0], if you expand "Higher performance and throughout" it says

> Customers looking for higher performance can scale up to 80,000 IOPS and 2,000 MiBps for an additional fee.

[0] https://aws.amazon.com/ebs/general-purpose/

People who have experience with Aurora and RDS Postgres: What's your experience in terms of performance? If you dont need multi A-Z and quick failover, can you achieve better performance with RDS and e.g. gp3 64.000 iops and 3125 throughput (assuming everything else can deliver that and cpu/mem isn't the bottleneck)? Aurora seems to be especially slow for inserts and also quite expensive compared to what I get with RDS when I estimate things in the calculator. And what's the story on read performance for Aurora vs RDS? There's an abundance of benchmarks showing Aurora is better in terms of performance but they leave out so much about their RDS config that I'm having a hard time believing them.

Already runs smooth on Linux (Wine)

I'm thinking about how to properly test AWS Step Functions. The problem is that I can either mock the entire response for every state in JSON only, or call out to a lambda. What I want is to type check the evaluated JSONPath payload and the mocked JSON response, to ensure that my tests always adheres to global contracts/types written in JSON Schema.

I think it's doable by dynamically creating lambdas based on test cases I define in one way or another, perhaps like mocked integration services, that does nothing but validate if the event from SFN matches a schema, and that the mocked response also matches a schema.

My concern is that I can't find prior projects doing this. My use case is mostly (exclusively at the moment) calling out to lambdas, so perhaps I can get away with this kind of type checking. But it's just weird that something like this doesn't already exist! Past experiences have taught me that if no one have tried it before, my idea is usually not that good.

Let me know what you think!

(Would have liked to use durable execution which totally solves the typing issue, but can't in this case)

You can use tpm2_policyauthorize and allow the PCR to change without having to manually unlock. This was not supported in TPM 1.2.

You can use it with Systemd.

https://github.com/tpm2-software/tpm2-tools/blob/master/man/...

Odd that you have to recover from changing UEFI settings with Secure Boot! You should be able to change any setting when that's enabled. BitLocker binds to a lot of other things when SB is off and might be fragile in that state. But it does seem that some changes will affect PCR 7:

> PCR 7 changes when UEFI SecureBoot mode is enabled/disabled, or firmware certificates (PK, KEK, db, dbx, …) are updated. The shim project will measure most of its (non-MOK) certificates and SBAT data into this PCR. — https://uapi-group.org/specifications/specs/linux_tpm_pcr_re...

It makes sense to use the certificates to generate PCR 7. I wonder if you can swap out the motherboard with one of the same model with the same certificates without modifying the PCR 7 digest...

But if Shim actually modifies the digest, I guess that SB would completely mitigate OP's exploit since the TPM policy is going to fail when the PCR 7 values doesn't match.

Found the article where I read about PCR 7+11 being the default [1]. The reason I looked it up is because if this is actually true, and the TPM is built into the cpu, what prevents someone from placing the cpu and disk on another motherboard?

Say that you have disabled usb booting and secured UEFI settings with a password. If you extract the cpu (and thereby its tpm) and the disk, then you'd still be able to boot, right? Meaning that without a TPM pin, you'd be able to do OP's attack on a different motherboard even when the original machine was off and UEFI settings secured.

What am I missing? Is it that easy to circumvent UEFI settings protection and maintain the PCR 7 value?

[1] https://blog.scrt.ch/2023/09/15/a-deep-dive-into-tpm-based-b...

I wouldn't underestimate that a PIN prevents this attack on machines that are powered off.

You can then go further up the chain with a UEFI settings password and no usb booting. If the password is hard to decrypt, then that's a pretty good approach.

Then there's custom Secure Boot certificates that replaces the ones from MS. It'll work for Linux, not sure about BitLocker. But my Surface tablet doesn't even support custom sb certs.

7+11 is default for BitLocker as far as I know. Binding to other values will bite you later if you update UEFI firmware or change some settings.

GRUB and all other boot loaders are unecessary with UEFI. See my comment history for more.

Kernel updates + Secure Boot is easy with a Debian hook.

The hard part is making it work with TPM when you want to add encryption...

If you can short the reset pins while the computer is running and make it restart without losing power, then yes, I agree. But if you have to shut down to make your modifications, then you won't get past the PIN prompt.

Should be good enough for a personal tablet used for mail and browsing. If I drop it and someone curious finds it, I'd like to make it impossible for them to extract anything useful.

I think you get the biggest advantage from BitLocker when you use TPM (PCR 7+11) with a PIN. That should mitigate the exploit because the FVEK should never be read without the PIN, and if BitLocker does it right (which I think it does) too many wrong PIN's results in the TPM going into dictionary attack lockout mode.

Now I've been trying for months to do the same for Linux. There's systemd-cryptsetup/cryptenroll, but it's only for LUKS and I'm trying to encrypt a few sensitive directories on a super slow internal eMMC with fscrypt (keys for secure boot and /home). The TPM is _EXTREMELY_ hard to code for when things go beyond the basics:

1. Bind to PCR 7

2. Bind to changing PCR 11 (changes whenever the kernel, init, cmdline etc. is updated)

3. Use a PIN - but not the AuthValue, because I want to use the same authorization policy for resetting the DA lockout counter on login, and also have a long password/AuthValue for resetting the counter manually.

4. Make it all work with PCR 11 signatures and public keys provided by systemd-stub.

Maybe this isn't the right place to ask, but there's almost nothing but basic TPM guides out there, so if you're an expert I could really use your help. It's just for a personal project, but I'll write about it once I'm done - if I ever figure it out!

There is rarely a need for GRUB on EFI systems. Create a unified kernel image, create a fat fs gpt partition, mount on /boot/efi and put the image there, then add it to efibootmgr. Sign and use systemd-stub and Shim for Secure Boot. No GRUB, no systemd-boot, just EFI firmware -> initrd -> kernel. Tried and tested on Debian 12 and Trixie. Can also dual boot Windows if the machine has a way to select an OS on boot, something most systems have these days.

I think the work required to do the above vs just using the standard installer is what holds people back, but it's hard to mess up once it's done.

Firefox, also on Android, is what you want for this.