secure

I have been using an HP z440 for years as my work machine. It’s fine, performance-wise, and definitely for running a browser, video conferencing, and terminal emulators.

One downside of workstation machines is that everything seems to be custom, even mundane things like fan connectors. See https://michael.stapelberg.ch/posts/2021-08-28-silent-hp-z44... for my experience with swapping the fans against quieter models.

Another great resource from Tridgell himself is this Ottawa Linux Symposium talk: http://olstrans.sourceforge.net/release/OLS2000-rsync/OLS200...

I’m using the defaults of each server.

In practice, as you suspected, this amounts to AES, as per the curl -v output:

SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384

No, it didn’t max out CPU (not even a single core) on either of the machines.

My theory is that you only have a limited time window per TCP packet, and decrypting TLS exceeds that time window. I haven’t verified that theory yet, though.

Thanks, fixed now. I could have sworn it showed up before I clicked submit.

It’s not just normal, init7 is doing better than many big players in this regard.

For comparison: init7 POPs used to be connected with 10 Gbit/s “only”, so even 10 people maxing out their Gigabit line would saturate the uplink. This turned out to never be a problem over the years, I would always get maximum speed. The average usage is very low, in part also because transfers complete so quickly.

Corresponding blog post: http://neugierig.org/software/blog/2022/03/n2.html

You can try increasing the debounce time to paper over this issue. Requires using a replacement controller like https://github.com/kinx-project/kint/ of course :)

If your provider offers 10 Gbit/s, you only need to change the fiber optics modules at either end of the connection. The same lines can be used, no need to run anything extra.

Hello, I’m the maintainer!

You’re right about the lack of a C runtime being intentional. However, C programs can be run if you take on the task of keeping them up-to-date: https://gokrazy.org/prototyping/

Regarding WiFi, we have https://github.com/gokrazy/wifi which currently only works for unencrypted WiFi. If at some point there is a Go solution to configure encrypted WiFi, I’m all for it!

It definitely works with gokrazy, we even have a guide for it: https://gokrazy.org/userguide/install/caddy-http-server/

It’d be wasteful for my use-case to put in a newer GPU.

I do have a newer GPU, but it’s in my gaming PC. Using the previous-gen gaming PC in my desktop PC makes sense for me.

All the empty space isn’t necessarily my choice, the case just doesn’t come in a smaller version. That said, it was really easy to build the machine when there’s enough space to maneuver :)

Yep, that’s still the reason :)

Yep, I had no choice in the matter.

For my own purchases, I do buy PC components with Noctua fans as suggested :)

The init7 CTO confirmed he’s running that same intel card and he’s getting 25 Gbit/s speeds: https://twitter.com/spale75/status/1414644121092952065

init7 requirements are at https://www.init7.net/en/support/router-information/

The specific 25G optic is https://www.flexoptix.net/en/p-b1625g-10-ad.html?co10426=972... and indeed does not support FEC.

The remote end is a Cisco C9500-48Y4C, on which one can turn off FEC.

On the Intel side, I found https://www.intel.com/content/dam/www/public/us/en/documents..., which mentions that while No-FEC might result in “poor link quality” (sure, that’s why people use FEC), it does not say anything about degraded mode or limits to 10G.

By controller datasheet, I take it you’re referring to https://www.mouser.cn/datasheet/2/612/710_series_datasheet_v...

That document contains a state machine diagram listing 25G AUI‐RS, 25G AUI‐FC and 25G AUI‐N (in order) before the fallback to 10G SFI.

Did you misread or am I missing something?

In either case, I’ll try the card. If it won’t link at 25G, I can get a different one. Any recommendations? :)

It’s done by the Linux kernel with default settings.

Another good tip is to use Direct Attach Cables (DAC), which have a much lower power consumption and save you the cost of 2 fiber optics as well. This only works on short distances of course, but between the MikroTik and a few devices that might very well be the case.

In https://twitter.com/kuenzler/status/1397814747379154944 (German), Fredy Künzler from init7 talks about PON and why init7 is opposed to it.

He makes the calculation that from the ≈3000 CHF needed to connect a location with fiber, only 50 CHF difference come down to PON or AON. The advantage of dedicated lines (for all ISPs, too!) overweighs the financial savings in his reasoning.

Thank you. I have added a note to the article with your correction :)

Yeah, I’ll probably turn off some fans to see how the temperatures react. That’s for some time in the future, though… :)

I describe the relevant UEFI option in https://michael.stapelberg.ch/posts/2021-07-10-linux-25gbit-... :)

I have built such a gateway for SSH: it accepts the connection, powers on the target machine if needed, then forwards traffic.

https://github.com/stapelberg/zkj-nas-tools/blob/master/wolg...

The advantage over just catching any packets is that an SSH connection is authorized, so less noisy in terms of undesired wakeups.

Ideally yes. But with the resources needed for 25 Gbps, not using one machine for multiple purposes seems wasteful. The server only stores publically available data, though, so not a big deal from a security perspective.

In none of my tests did I need to change power saving settings. My iperf3 transfers stayed at 10 Gbps throughout.

You mean 10 Gbit/s per link? Even on the 25 Gbit/s card?

Where can I read more about FEC (forward error correction?) and how that affects link speeds?

“The poster” (hey!) has put fiber around their house :)

https://michael.stapelberg.ch/posts/2020-08-09-fiber-link-ho...

https://michael.stapelberg.ch/posts/2021-05-16-home-network-...

I’m using the machine also as a server, so it replaces 2 existing devices. In terms of power consumption, it’s likely only a small increase, if at all.

I’m not aware of any tutorials unfortunately, but I would recommend connecting with your local Makerspace or Hackerspace. They can often be a great resource to find other people interested in electronics :)