off-topic-tech

[languid gulch]

why i'm gonna check. it might be fine, and just a massive production consistency issue

but yea, def checking since the nasty one he was showing is a corsair one

most i've gotten my 4090 up to is 325W

but would that matter?

[pure karma]

4090 was melting too so.... yes?

if its a cable issue its just a question of more pins being bad to reach the melting point and not just a power thing no?

obviously more power will make it worst but like its not everything here clearly

[languid gulch]

true

anyway, gonna go check and see how bad it is

brb

[pure karma]

im too lazy to check mine not to mention if repluged it like 5-6 times now so im just reducing my chances checking

[languid gulch]

yea, this was important enough of a thing to make me want to check it

luckily, everything looks decent, and my gpu has the little LED to let me know if it's properly seated/connected

and it's an H++ one

and nothing was slidy when i fiddled with the cables

[pure karma]

Honestly the only thing im woried about is the weight since mine is entirely held up by the conector

[languid gulch]

oh yea mine has the floor jack & it 100% makes a difference

[pure karma]

guess while im at it i may aswell replug my front usb c for the 70th time

It is so trashed and holding on for deer life

Dangit i forgot my phone cant upload video cause its dumb

there

[stray badger]

why sapphire is a good brand - comes with a sag bracket

[pure karma]

i mean i could atach it if i had somewhere to but yea some kind of mount would be good

[pure karma]

the worst part is thats basically what my pc is a bunch of jerry rigged jank that just works colectively

[languid gulch]

i called my previous build Frankenputer

[pure karma]

like my gpu mount isent screwed in because its the wrong threads so its just sitting in the holes...

and even then one of the standoffs is bent like 30 degrees so its a single standoff doing everything

[languid gulch]

at one point i had a sata ssd hanging by its cables

[pure karma]

well thats just the laptop user experience

400 usb devices and a hanging sata drive

[languid gulch]

my first aftermarket cooler was a v1, and it was right when ryzen came out, so they just sold an adapter kit for it & it was an updraft cooler

[charred relic]

I didn't even look at that connector on mine because I knew I didn't need it anyhow

[languid gulch]

well, a vertical airflow cooler, fan was right above the gpu

[pure karma]

its literally just sitting on top of my gpu unpluged now because i dont feel like turning off my pc to plug it back in and honestly im tempted to just leave it there

[charred relic]

Also if you have that much plugged into a laptop get a dock heh

then you can plop it down and plug in one cable

[languid gulch]

i overdid it by trying to run 3 external drives off of a single 4x usb2.0 unpowered hub

[charred relic]

I'll probably get a decent dock for my i

[languid gulch]

they'd randomly kick off & on, and the centrifugal force started rotating my laptop stand

[charred relic]

iPad

I have a keyboard case but i like being able to get it hardlined and powered when im in certain places doing certain things with it

like if im using it for music it'll be nice being able to dock it to all that gear

I've decided the desktop will need a PCIe card to add more

[languid gulch]

i've had good luck with mine

[charred relic]

I don't want to have usb hubs hanging off it

[languid gulch]

5 external, 2 internal

want the link?

[charred relic]

I went over everything and realized i have 1 open type-a

and i have a couple of things not plugged in

no wait i have a type c free back there too...

[languid gulch]

tinyurl.com/mr4x9bx4

this is the one i use, Inateck

$25 doesn't seem too awful compared to others

[pure karma]

why the internal ones?

[languid gulch]

i threw the gigantic xbox dongle on one of the internal ones so it wouldn't snap off

[pure karma]

for like goofy decorations and stuff?

or that

[languid gulch]

no idea what else it could be used for, maybe a 2.5" external or something weird like that, just sitting in the case

[pure karma]

having my side pannel off is actually kinda nice

gives a nice breeze

since i swapped my rad from push to pull

so its blowing towards me now

gonna be hell in the summer buy ay in the winter its lit

[languid gulch]

just wait till july 🤣

[pure karma]

oh great nintek invented melting display outputs instead

genius

[languid gulch]

i mean, at this point why not

as someone pointed out, 5090 OC is now measured in terms of HP

[charred relic]

relocated to the work shop, bit cold but whatever

Still can't get over this 1oz pack of Kester solder my dad had with a price tag of 1.06 on it

It's about 12.50 now. Then again you get ripped off buying 1oz anyhow since you can get 16oz rolls for like 40

[languid gulch]

the costco method of extortion

[charred relic]

Well... they know if somebody is only looking to get 1oz they are likely doing like 1 job and that's it. So they kinda have those types over a barrell

[languid gulch]

yup

[charred relic]

For me buying less than an 8oz roll is a waste of time

[languid gulch]

at least you'll have one to give to your kid in 50 years 🤣

[charred relic]

Solder joints on these boards are small but they add up, probably burn through 1/4 to 1/2oz on an average pedal

Way more on something like a decent size tube amplifier which has a lot of high current AC

End up with some extra beeft solder joints in there

[languid gulch]

with my talent they wouldn't be beefy but a serious short risk

[charred relic]

Remember kids. The excitement of electronics only comes if it can kill you 😄

[languid gulch]

best i've gotten hit with is 8k volts

[charred relic]

I'll need to be exceeding that for a jacobs ladder

Think I'll want like 9k+

need a salvage microwave for it's transformer heh

[languid gulch]

mine was on my ancient pickup on its original spark plug wires

they were frayed as fuck & shorting on the fenders

[charred relic]

oh those will let you know if they have spark lol

[languid gulch]

lil bit yea

[charred relic]

It's enough to create a plasma arc so...

[languid gulch]

eh, when it shorts it's not quite as bad

[charred relic]

I'm saying in general when you look at the end of the wire you vcan see the spark

[languid gulch]

still felt like one of those electrical muscle exerciser thingies

[charred relic]

that's plasma

[languid gulch]

oh yea definitely

[charred relic]

Why I need so much for a jacobs ladder, I have to jump a larger arc at the end

but they sure sound and look neat!

(and can def 100% kill you()

[languid gulch]

could you go for a higher voltage one with basically no amps?

[charred relic]

just voltage mostly

Since I'll probably do something on the larger size I might need to hit 15k+

I just want a 20k watt microwave like that video... so I can cook a hot pocket in under 10 seconds.

[languid gulch]

i think a blowtorch could do that

[pure karma]

just.... light a forest on fire at that point

[charred relic]

But it's moar fun with microwaves

[languid gulch]

fresnel lens would be fun too

[charred relic]

that thing melted tungsten in short order

That guys videos are definitely do not try this at home type shit

like really.. do not try

[languid gulch]

just have a concrete slab under it 🤣

[charred relic]

I'm gonna end up knocking out power to the entire neighborhood one day...

and i'll be out there acting as confused as everyone else 😄

[pure karma]

wasent that a video

any of yall got a link to that microwave video

i feel like i saw it at some point but now i cant find it

[charred relic]

https://www.youtube.com/watch?v=mg79n_ndR68

that dude is great lol

If I had to guess I'd imagine his IQ is fairly fucking high...

[pure karma]

yea i knew i got this recomended at some point

iv heard of this guy for sure he rings a bell

[charred relic]

He does a lot of crazy projects, usually dangerous heh

[pure karma]

I feel like this is the embodiment of here is why safety rules exist

it feels like im watching the weld shop teacher just flinging shit into pots and seeing what happens

one time he made a sodium bomb and lit the ceiling on fire

He also use to discharge the fire extinguishers as a demonstration IN THE CLASSROOM before the fire marshall got tired of refilling them 🤣

[sage pier]

idk what's happening, but youtube is completely unusable

I've let it load for 5 minutes and its still like this

Is there an extension that could fix this?

I've tried disabling all my extensions, reinstalling firefox, and reinstalling windows. Nothing works and it always gets this bad after a couple of months

[charred relic]

that's a tough one

[sage pier]

I did some windows repair scripts in cmd and that fixed it

who was the one that glazes brave? I forgot. Any brave glazers wanna tell me if google sites are just as slow on brave?

[charred relic]

Seems about the same as any other browser to me

[manic cipher]

It looks like you can't use VLC media player to download videos from YouTube anymore. The server refuses the connection from VLC.
Basically Google found the loophole and plugged it.
Something about HTTP Error 403.

Error 403 means that the server is refusing the connection and will not allow one to connect to it.

[wanton orchid]

403 is not server error but ressource error

i.e it does not refuse connection
it simply says you're not allowed to get served what you asked for

[twin dew]

There is supposed to be two metal tabs protruding from the side of the pin that lock it in place with some wiggle room:

But those can fold backwards with enough force and fail.

[languid gulch]

what about the wire itself?

[twin dew]

That pic is for Molex Micro-Fit 3.0 female crimp terminal, in this case two dimple type with gold plate inside for AWG 24-20 cable, didn't try to find proper one.

[twin dew]

Crimped, and should break next to the crimp before that crimp fails.

When done properly. Basically that crimp is supposed to be fully air tight and stronger than the strands themselves.

[languid gulch]

i mean is there any crimp that holds the wire to the full plastic casing

[twin dew]

No?
Why would there be?
Terminal holds to the case.
Wire holds to the terminal.
Weak point are those two tabs.
You want the terminal to move in the housing.

If the wires were somehow fixed to the housing, the terminal couldn't move.

Just little movement, so it can align properly with the other sides terminal.

[languid gulch]

yea good point

so 2 tiny metal tabs determine whether or not your connection is solid

[twin dew]

But the amount of force needed to fold those two tabs backwards should normally be excessive.

But yes, if the two sides don't align properly and you force the housing in, the tabs will fold.

[languid gulch]

i was also thinking that maybe people are pulling the connector out by holding onto the wires a bit too much, even unintentionally

[twin dew]

Yes, that is exactly why you aren't supposed to pull on the wires.

[languid gulch]

when i took mine out i couldn't just hold onto the connector, so instead i broke out my ifixit kit and used 2 of the plastic pry tools on either side to back it out

[twin dew]

Because then all the force is transmitted via those small tabs.

[languid gulch]

it's so much more friction than a normal 8 pin to fight with

thankfully mine looks fine, nothing loose on it

[twin dew]

Crimp pull testing results, where two in the middle are what is wanted.
But point of crimping is to force the contact and the wire together with such force that you get welding effect between the surfaces

[languid gulch]

i hope they get it right, issue a general recall of all of them, and put out a decent one

[twin dew]

Of this type of crimp, the larger forward tabs are crimped to the conductor itself.
And the smaller last set is for the insulator, with them usually going throught it in the middle, sometimes only folded over.

Also, that is the reason for that "Don't bend the cable too close to the connector" thing.
As that will cause excessive force on those small tabs at the farthest pins away from the bend direction.

And that "pin depth" thing is about the freedom of movement, when contrained by that wrapping.
There is normally about 1mm of movement for the pins fore-aft.

But because that shrink wrap at the end of the wrapping limits the movement of the wires, some will be at minimum, some will be at maximum.

But that Corsair cable seems to have loose pin even in the closeups.

Just watching the video.

[languid gulch]

oh 100%

i just wonder if that's overuse or a manufacturing defect

[twin dew]

He would have needed to pull the wire completely out, and shown that contact.

Might have been one that wasn't fully inserted in factory and didn't lock.
Or might have had folded wings.

Ah, no, he did push it in to the top position, and then back.
The wings are there, but for some reason the lock level is lot lower than the others.

And that first gen did have much more allowance for that kind of thing.
Which was tightened for the new revision.

Corsair might be using bad quality contacts with inconsistent wings.
Or contacts from one manufacturer and housings from another.

But that amount of slop shouldn't be issue.
As even that worst pin at the max depth is is still way above the level where the pins from card side will go down to.

Remember that the card side pins go down to somewhere around here:

And the end of the contact surface on the female contact side is here:

For that dual dimple one.
Need to find pic of the better leaf spring type.

[languid gulch]

all of it just screams "well, we tried"

and also 0 margin for error or it all burns

[twin dew]

So would had needed to pop that specific pin and another one "normal" out and looked at the contacts.
Easy with right unlock tool.

So that JayZ video might be real, or just bad take.
He again didn't know enough to fully investigate and just threw gasoline on the fire.

[languid gulch]

jay noticing that it's been the end cables that are burned is interesting, which is why i was thinking maybe people are pulling out the connection with just enough extra force on the cables, unintentionally, to loosen them up like that

[twin dew]

Of course the burn happens at the contacts.
That is where the highest resistance is, so most heat.

You would need to use very undersized wires to make them heat more than contacts.

Ah, you mean the outermost contacts in the housing.

[languid gulch]

right, but having the contacts back out even though the clip is secured in place

you'd have no idea it had happened

maybe they should start doing a clear connector 🤣

[twin dew]

Yeah, that is where any bad handling by forcing a turn will cause most.

[languid gulch]

just insane that we're 3 generations into this and still finding serious problems, which kinda makes me think that someone might have already known about it

[twin dew]

Turn that cable sideways, and the far pins get pulled.
As the near wires will have too much length, far ones too little.
And because of that shrink wrap etc. only the non-wrapped part of the wire counts.

Less there is visible wire, worse it is.

[languid gulch]

yea my cable has none of the extra shrink wrap around all the tiny cables thankfully

kinda scary that der8auer was recording 20+ amps going thru one of those

it was worrying enough to see it happening across the industry, but now i've been thrown in with it all with the new pc

[twin dew]

Which is the insanity of that connector.
6 pins that all would need to have about same contact resistance to very tight tolerance, or very bad things happen.
As the contacts are without any headroom between the contact spec and the cable/connector spec.

And no monitoring to make sure that is actually the case.

Well, Asus has that monitoring, but still no automatic action, just user warning in OS.

[languid gulch]

at this point they really should just use a C14

[twin dew]

That is only 15A max.

In US, and 10A in EU.

So really not suitable.

[languid gulch]

stuff a transformer into the GPU 🤣

kinda hoping that someone like GN is able to figure out an easy way to instantly melt the cable in a repeatable way that'd induce a recall

[charred relic]

melt all the things

[narrow folio]

how about the 6 pins are combined into a small copper bar right in the connector and then a single thick wire per bar runs to the other side?

[twin dew]

Which wouldn't do anything to the contact resistance?

[languid gulch]

at this point i wouldn't mind using a fucking bus bar to make a decent connection that won't catch on fire

[narrow folio]

it would not, but the pins would not be pulled sideways that easily

[twin dew]

And that movement is WANTED.

[narrow folio]

and the copper bar would make a nice heat transfer

[twin dew]

Problem is using multiple pins to transfer power at near the contacts max spec, without any active monitoring or balancing.

[narrow folio]

the pins need some room to wiggle into place, yes. I meant pulling out the pins a little when the cable is bent sideways and pulls on the entire connector

[languid gulch]

it's like they're trying to keep it small, but given the size of the big cards, that ship has sailed

[twin dew]

And then just the specific wire would break, or lose contact with the "bar", depending how those are connected.

[narrow folio]

This. a phase measurement per pin would resolve most things

I just don't understand why this is not done in the first place. the 3090 at least had 3 phases

[twin dew]

More expensive.

[languid gulch]

why do it right when you can do it cheap

[narrow folio]

yeah, the negative publicity about the newest 'flame generation' feature of the top gen GPU surely helps to sell more

[languid gulch]

cornered market

and no hints of any antitrust attempts against it

[twin dew]

https://www.reddit.com/r/pcmasterrace/comments/1io4a67/an_electrical_engineers_take_on_12vhpwr_and/

[wanton orchid]

imagine splitting that 1 metal bar in 3 smaller joint metal bars

that sure would increase cost and size tremendously

spoiler : not at all
Nvidia is just fucking lazy

[twin dew]

Meaning the way it was done on 3090 TI.
The separation of VRM to different regions, no cost change.
Being able to monitor the current split, to notice stuff is out of whack, few dollars to few tens of dollars.
Having the ability to switch which input specific VRM gets its power, to be able to do active current redirection, again few dollars to few tens of dollars.

So it does cost.
Not that lot, but enough for the manager/exec level to say to skip it as useless.

[wanton orchid]

but that's when it's crazy

skip literal 1/1000 of the cost for a huge stability and safety hazard

[twin dew]

Must have that sweet sweet infinite growth...

Not only increased revenue year after year.
Not just increased profit.
Also increased profit margin, year after year, forever.

Current MBA and stock market thinking, as impossible as that is in real world.

[willow pike]

geforce pinto

cheaper to deal with any lawsuits than make the cards safer

therefore you don't make the cards safer

[charred relic]

We had a Pinto when I was a kid... brand new 😄

[dire igloo]

Looks like slightly below surface level understanding

Both have usecases where they are superior to the other

[pure karma]

Well the wires are undersized there half the square volume that you need for that much power

[twin dew]

And that contact is rated for 9.5A, so that the wire is undersized is lesser problem, when overload is happening.

Wire is sized correctly for the contact, and has more headroom than the contact.

Oversizing that wire would just make the contact for that wire to heat up even more.

[pure karma]

No ik its sufficient but its half the size to be safe at that power

[twin dew]

When that failure is happening.

So oversizing the wire without oversizing the contact would just make the contacts and connector housings to burn even easier.

[dire igloo]

basically: right now, the cable is losing heat too, so there's less heat burning up the connectors.
make the wire thicker and all that heat is lost at the connectors

[twin dew]

Or did I make the same mistake as yesterday again...
In a way I did.
As the total resistance would go down, so the total voltage losses would go down.
So more voltage getting to the cards, so less current for same power.

But basically not worth it to overspec the cable if the pin is crap.

[dire igloo]

sounds like network stuff: the connection is only as fast as the slowest link

[night girder]

That's also used in the army 😄

[jagged snow]

Heat lost at each component is voltage drop across the component*current
Cable and pin will have the same current, so higher resistance in the cable means more heat lost there which leads to lower potential and thus less voltage drop across the pin

(not trying to correct you, just adding)

[twin dew]

If the card wasn't upping the current to keep the same power.

As the voltage droops.

[jagged snow]

Yeah

[verbal raft]

#SkillIssue

[pure karma]

its with psu brands and mostly not nvidia to be fair

[verbal raft]

is derbaur about to melt one of 10 4090 TI's ?

[verbal raft]

watch buildzoids video

its not PSU makers fault

its NVIDIA skimping on nescessarry protections ( load balancing the cables)

[pure karma]

thats a whole thing but its one of two problems

[twin dew]

And Nvidia designing a connector with razor thin margins.

[verbal raft]

https://tenor.com/view/champoy-el-risitas-kek-issou-etu-gif-17837830

[proud brook]

Anyone perchance know why im getting massive FPS stutters in Satisfactory when looking in the distance? Specs are CPU 5700x3d GPU 7900XTX 64GB Ddr4 ram. Settings are all highest on 4k.

[pure karma]

ram stability probably

[twin dew]

No?

Unstable RAM doesn't cause stuttering or like.

[pure karma]

mine sure does

[verbal raft]

MagicZ moment
i think

https://tenor.com/view/tik-tok-gif-4963626947041558937

[soft bloom]

let the water vaporise and condensate

[dire igloo]

buy air cooler
look inside
water

[soft bloom]

efficiency in simplicity

the only moving part is water and a fan

I wonder if it's possible to make easily-bendable long water pipes with same properties to just connect with outdoors or basement without need for a fan

[verbal raft]

🤔

the more i look at these "leaks" the more i think they are fake

[willow pike]

so intel are corrupting shaders and data while nvidia melts itself

computers are great

[verbal raft]

https://tenor.com/view/gigabyte-psu-explodes-gamers-nexus-power-supply-gif-23202345

https://tenor.com/view/gamers-nexus-gn-power-supply-psu-thermaltake-gif-26526058

[willow pike]

and that too

[verbal raft]

https://tenor.com/view/thanks-steve-intel-gamers-nexus-thanks-steve-gif-2570818544130153718

[willow pike]

thanks steve

[verbal raft]

like : im sorry but there is no way an AMD GPU With 64CU's is only 4% slower than a 4090

or it has FSR UP applied

[willow pike]

it is when it's CPU limited

[verbal raft]

EXTREMELY SURPRISING

[verbal raft]

i guess...

[willow pike]

we ain't gonna know shit until it gets thoroughly tested

[verbal raft]

💯

[willow pike]

even if it is somehow magically faster than a 4090 in monster hunter, it may only be in monster hunter

this is all just people farming for clicks

[willow pike]

i do not like hyper rx

[verbal raft]

its just marketing

[glossy glacier]

AI powered FSR?

[willow pike]

it's a driver switch that turns on all of radeon features

[willow pike]

we knew this already, the DLL is public but nothing can run it

[verbal raft]

just makes you able to use multiple features together

[verbal raft]

some things can

(kinda)

[willow pike]

interesting

not well I bet

the dll is FP8 and only really designed for RDNA4, they're looking into making a version for RDNA3

or was it FP16 I forget

[willow pike]

either way it's AI

[glossy glacier]

Insta buy for me if it is faster in MH ^^

[verbal raft]

fp8

[willow pike]

lmao whoops

[verbal raft]

it only seems to run on RTX GPU's

with optiscaler

[willow pike]

yeah that makes sense, they support a lot of data paths for ai

i would like to see it run on geforces too

[verbal raft]

just so you can compare it to DLSS

[willow pike]

plus so everyone gets more options

but yes that would be neat

[verbal raft]

i think FSR 4 will just be DLSS but 10-30% worse

[willow pike]

if it was even close to DLSS you could build it into directx and everything would use good AI TAA

no more "this game has dlss, that game has fsr, why aren't they updating the dll" shit

just get rid of this shit

can't even use optiscaler on anything with anti cheat

[verbal raft]

too bad i dont play anything with anti cheat

[willow pike]

i hate anything vendor locked, anything that people use to build a moat

[willow pike]

based honestly

i am too old to get sweaty in valorant or wherever

[verbal raft]

also : why would you want optiscaler in those games ?

[proud brook]

Managed to clip my issue. Had to put it in a google drive cause i cant upload it bc its to big. https://drive.google.com/drive/folders/1UXICrZNT7_kZX7TydG4gIxhpYhWXNt8r?usp=sharing

[twin dew]

!ot

And bot is taking a break it seems.

[verbal raft]

thats good

@bot take more brakes

plz

[willow pike]

some online games are demanding enough to need good AI TAA and upscaling

[verbal raft]

i think thats just from the fact that foliage is extremely demanding in this game

i dont think its a stutter issue

(looks more like a performance issue)

[proud brook]

Geussing this is it.

[verbal raft]

maybe putting FSR / TSR / XeSS to balanced would help

[verbal raft]

i had to drop my preset to medium to not have major performance issues BC of that

ultra/high isnt enough

[proud brook]

THat has indeed helped.

[verbal raft]

all my benchmarks if you are curious

[verbal raft]

lowering that setting or upscaling ?

[proud brook]

Setting

And upscaling i think no idea how to get that to work.

[verbal raft]

huh, i guess that did give me a 30% perf boost

[verbal raft]

(thought it was less than that)

[proud brook]

Does this even do anything?

[verbal raft]

yes

but you have to set it to balanced to get a performance bosst

like this

[verbal raft]

quality will also give you a tiny bit

but its like 1-5% IIRC

[proud brook]

Want all native pixels mostly.

[verbal raft]

no downscaling just means replaving the games TAA W FSR AA

which looks better in my opinion

[verbal raft]

then sticking to the lower settings will be a better choice

[proud brook]

Okey thanks for your help man appreciate it!

[verbal raft]

anyway
i dont belive i actually tested cinamatic VS ultra on that one setting

so im gonna try that and add it to my benchmark results

[verbal raft]

here is how all the AA options affected my performance

lumen off main factory
TAA 77
FXAA 77
NONE 78
TSR 63
FSR 69
XESS 67

[willow pike]

embarrassing that TSR is slower than FSR and XESS

[verbal raft]

https://tenor.com/view/champoy-el-risitas-kek-issou-etu-gif-17837830

and looks worse ( IMO )

[willow pike]

i would get extreme blotching with XESS which was very strange to me

[verbal raft]

though to be fair it runs better than XeSS while upscaling
upscaling performance at 75% (TAA for comparison)

TAA 89
TSR 79
FSR 83
XESS 78 (thats surprising)

(well 1fps better)

IIRC this is where i started my benchmarks from

(forgetting that taking a photo in photo mode doesnt clipboard the screenshot)

lumen experiance

i was gonna make another benchmark pass

but
no point

zero difference between the 2 settings

for me

in this scene

[twin dew]

If 7900XTX needs anything other than not using Cinematic settings, and the game is GPU limited, something is really wrong...

[verbal raft]

cinematic

far

[verbal raft]

i could see that happening at 4K TBH

(cuz res is 4K)

though it is strange that it fixed his issue
when it hardly changed anything for me

+3fps

+9% fps

ps
the red forest runs worse than my factory W lumen on

and needs lumen to look good (IMO)

[pure karma]

IT helps with bluring out reflextions and bringing them back atleast somewhat reasonable levels

[pure karma]

if thats a 7900XTX that is some awful performance

[verbal raft]

Oh NO.

RX 6600

[pure karma]

because i was getting over 150 cranked with lumen on my 4070ti with no framegen in the red forest

ok yea i was gonna say

like dam if your only getting 30fps with that the AMD delusion is at an all time high

altho in fairness we have about the same performance if i dont use a empty save

like my save is getting rough

[proud brook]

Are you at 4k or 1440P

[verbal raft]

https://tenor.com/view/cat-cats-what-wut-crazy-gif-20900490

https://tenor.com/view/confused-perplexed-what-gif-10834164

[verbal raft]

i have an RX 6600

NOT an XTX

[verbal raft]

it doesnt just blurr reflections

it blurrs the entire screen

(like XeSS)

[verbal raft]

thats just typical XeSS

[verbal raft]

what res ?

[pure karma]

1440

[verbal raft]

and where ?

[verbal raft]

but where in the red forest

[pure karma]

[verbal raft]

https://tenor.com/view/hahahaha-gif-27342590

[verbal raft]

that matters

[pure karma]

Wherever i was like 5 months ago when i still cared about the performance improvements

[verbal raft]

🤦‍♂️

check it ffs

😤😤🤬🤬🤬

(#trolling)

[soft bloom]

always has been

[verbal raft]

❓

eh?

[soft bloom]

chunky area

[verbal raft]

true

[pure karma]

Lot of green bois

[verbal raft]

<@&387163995947270144>

Thx

😄

[safe trench]

why the whole mod team 😭

just ping an mod without idle or donotdisturb on

[jagged snow]

That's standard practice, and what the mods signed up for lol

You should be pinging the moderator role rather than an individual if it's something that actually requires their attention

[safe trench]

if i did that in a regular server

i would have been vaporized

[jagged snow]

That's really odd

I don't think I'd call that a regular server then

[stray badger]

Why its literally their job

[pure karma]

Basically every server has some kind of dont ping mods rule

[languid gulch]

yea, i had to learn about turning off ping the hard way after a a gentle smack upside the head 🤣

[jagged snow]

Well yeah but
Ping for actual mod stuff is different than unimportant ping

[languid gulch]

ok, is it possible that having a bunch of usb stuff plugged into the back of my mobo is drawing too much power & occasionally it brain farts & resets it all?

every once in a while stuff like a youtube video playing will pause, 2 of my drives will open up, and my bluetooth will reset

[charred relic]

I suppose it would be possible that at times one or more devices draws a little more power leaving everything short... and that could cause devices connected to it to reset

I've had similar issues with those usb hubs before which is why I'm going to just throw in a PCIe x1 card to give me more ports. Make sure they're full speed and fully powered.

I'm down to 2 ports and I'd like to move a couple of the things plugged into the front to the back.

[verbal raft]

Thats just there so you don't ping mods for no reason whatsoever

I also just checked,and this server has no rules on pinging mods

Only rules on pinging developers

[soft bloom]

https://www.youtube.com/watch?v=LQjFGx9mEPw
sooo
interesting how it will turn out in the end
after all - be it from government or thru donations, someone pays for the content
there's some appeal in more direct flow, and there are some worries about it as well

[twin dew]

GN 🤣

They finally got their fan tester into operation:
https://www.youtube.com/watch?v=JQtyxRtsqvA

Testing one fan with various front meshes as sanity check thing to see if they have their process right.

[languid gulch]

it looks like it's just my former OS drive causing issues when plugged straight into the mobo

[verbal raft]

Lol

[charred relic]

yes and they showed off the hole sucker calibration plate.. .my new name for it 😄

[languid gulch]

it's too bad it's not a variable diameter calibrator, otherwise it could have been called a sphincter

[verbal raft]

wat

[languid gulch]

^didn't watch

[charred relic]

nod

And really for all we know they also have a sphincter adapter for something

They didn't show us ALL the plates...

[verbal raft]

Wat
https://videocardz.com/newz/gigabyte-radeon-rx-9070-xt-purchased-and-unboxed-ahead-of-launch

Lol

[pure karma]

Black market sales is wild

[soft bloom]

https://www.youtube.com/watch?v=shFUDPqVmTg
let's just all be adults here

[dire igloo]

babyrage type of finishing statement

[soft bloom]

was looking around quarternary cycles
courses.lumenlearning.com/suny-sustainability-a-comprehensive-foundation/chapter/milankovitch-cycles-and-the-climate-of-the-quaternary/

[safe trench]

https://tenor.com/view/aminagifs-gif-25043494

the cable:

[stray badger]

are those fuses for each pin lol?

[languid gulch]

at this point it's probably an improvement

[sage pier]

with fiber, no matter what server you choose you should get roughly gigabit right?

I did a couple of servers in California and this was the best I could get

[charred relic]

No you'll get whatever the ISP has provisioned on that line heh

I have fiber at 600/600, it's cabable of well past 1Gbps though

[twin dew]

No.
With bad ISP you usually get that paid for speed to their first router, if even that.
Anything past that can be way lower.

And almost all big US & Canada ISPs belong in that bad category.

And even with good ISP, the speeds in general Internet, outside of that ISPs own network aren't guaranteed.
Just that good ISPs try to also negotiate transit agreements to give good speeds to large enough amount of Internet to not cause issues for normal users.

Because the speed you pay for is at minimum just the line speed to their end of the line.
And from the device you connect there (their ONT equivalent) in a switch, they might oversubscribe a lot already to their first router.

Gigabit between ONTs, then 100 subscribers in same switch cluster being forced into shared 10G pipe, (10:1 oversubscription), instead of 100G pipe (no oversubscription).
Or even just 1G pipe (100:1 oversubscription).

But when the speed depends on where you are testing to, that is mostly about transit agreements and capacity at transit points between your ISP and other networks onwards towards the target server.

[twin dew]

In this case the transit from you to the test server is good.
But the transit back from the test server to you is just horrible.

[visual tree]

Can confirm since I work for an ISP. Most people think they have their own dedicated fiber and they always get full speed without realizing they are sharing bandwidth with multiple customers

Almost all ISP's use PON since it's cost-effective

Example for GPON

[twin dew]

And I was just talking about the connection from that GPON OLT onwards to the first actual ISP router (default gateway).

And then from that onwards to general Internet.

Yes, with GPON, there is also oversubscription in the fiber portion too.
With "classic" point-to-point fiber there isn't, and neither was there with ADSL or VDSL.
Cable modems also have oversubscription in the cable wiring portion.

[visual tree]

My neighbors use ISP which offers DOCSIS (cable) and they had speed issues in the past because too many people were connected to a single street cabinet where the amplifier is installed I think

Never worked with cable so I don't know much about it

[twin dew]

With cable modems there is "cell" where the cable wiring is just shared medium connected together and the bandwidth is shared between all subscribers connected to it.

[visual tree]

Also, I recently noticed someone ran over those cabinets and knocked them down and ISP hasn't fixed it yet lol

[twin dew]

Kind of like that GPON, just with coaxial cable being connected together without active ISP side device.

One port on ISP side connected to X number of subscribers, with Y amount of the bandwidth in that coax being set aside for DOCSIS, and rest for cable TV.

With separate downlink and uplink allocations.

Where certain amount of actual internet speed in upload needs more coax bandwidth allocation than same amount of download.

[visual tree]

Found an image online of one of those cabinets

[twin dew]

More TV channels with better quality, smaller the cells need to be to support same amount of subscribers.

Before cable modems, those cells used to be gigantic with just one way signal boosters.

With DOCSIS the signal boosters need to be bi-directional, or there needs to be DOCSIS ISP side modem instead at that location.
Or even nearer to consumers to split the old cells into smaller parts to give decent actual speeds.

Basically juggling amount of TV channels vs. actual bandwidth against cell size (smaller means more expensive for the cable operator, and possibly needing more cabinets etc.)

[visual tree]

Here, cable ISP basically installs a large street cabinet which covers the whole district and then small cabinets with amplifiers in front of each apartment building

[twin dew]

But question is.
Do those small cabinets contain amplifiers, or converters from coax to fiber too, for the Internet traffic.

[visual tree]

Haven't seen them opened yet but I think those smaller cabinets only have coax

[twin dew]

Classic before DOCSIS was just amplifiers, with shared wiring between the local cabinet and the disctict cabinet that actually did the TV transmission sending.
And first cable operators just converted those amplifiers to two-directional ones.
But as traffic has grown, usually they either have had to split that district level coax to multiple runs, or just run fiber to each local cabinet and install DOCSIS ISP modems at those.

Either to run more coax, or run fiber.

[visual tree]

Damn, can't find an image of the whole cabinet but this one looks like it's from the district cabinet (large one)

[twin dew]

Based on the number of fiber runs in the wall compared to the four actually getting used in this cabinet, I would expect there is coax run with TV signals and fiber run with internet traffic going to each local cabinet.
And then one-way amplifier for TV signals, and DOCSIS ISP modem with fiber connection in the local cabinet.
But cannot know.

With those 4 in use fibers being used to send the TV programming to be converted into coax DVB-C signals in that top right large box.

[visual tree]

@twin dew Found it!

This one is from the large cabinet

[twin dew]

Passive coax splitter/combiner on right.
Probably four coax amplifiers at the bottom.
And possibly DOCSIS ISP modem on above those.
Left side might be just fiber connection box, splitting those two visible fibers from the black cable going to it from underground runs.
Which is coming from different red ground pipe than the coax ones.

Leftmost is probably amplifying the incoming TV feed before splitting it 4-ways, one going with that white wire probably into some kind of filter, before getting used in the rest.
But also being sent in two cables onwards to more cabinets.

[visual tree]

Guess I'm staying with fiber (PON), no active elements and the network structure is easier to understand than DOCSIS 😅

Translated image btw

[manic cipher]

Starlink at BestBuy costs $400 just for the receiver device.

[twin dew]

And the relevance of that statement was?

[manic cipher]

About network speed. Paying more for Satellite internet than ground based telecomunications. Even more bandwidth limited.

[verbal raft]

we finally know who was behind that leak

[verbal raft]

Le Dumb redditor

[pure karma]

Slated 😂

[sage pier]

How do you see what category isps fall in without actually signing up for their services

[twin dew]

Reviews/comments from current and previous customers?

In US and Canada, you are fucked, just with somewhat differing things by most of the ISPs, outside of few small regional entities.

[sage pier]

Where I am, I'd be suprised if anyone even does a speedtest other than when a tech shows them the speedtest. Although most of my isps here are national so maybe someone would be knowledgeable enough to at least do a speedtest from a different server than "optimal"

[sage pier]

this is it today when apparently the people aren't using the internet anymore

[charred willow]

I am on a college net routed back to a local carrier, and I get basically half the download but identical upload with cross-country speedtest

919/938 within MI 430/972to CA

[visual tree]

Anyone else feel like internet today is much worse than it was 10 years ago?

For example, so much misinformation, videos of grifters giving "advices", google results full of websites with AI-generated text, clickbait videos, ragebait videos, etc....

and so many things I can't think of right now

[pure karma]

Of course it is

[visual tree]

I feel like 2005-2014 was the golden age and everything from that point went downhill

[verbal raft]

Intel is soo f"cked

😭

[mental oriole]

Ooof

[pure karma]

3$ an employee is wild

[verbal raft]

[visual tree]

Could someone please unplug Intel's life support

[willow pike]

all algorithms on the internet promote whatever gets the most clicks, not what's accurate, so it rewards everything you just listed; google search itself was enshittified in a similar way

www.wired.com/story/tiktok-platforms-cory-doctorow/

enshittification

Here is how platforms die: First, they are good to their users; then they abuse their users to make things better for their business customers; finally, they abuse those business customers to claw back all the value for themselves. Then, they die.

[dire igloo]

the internet has become a place of profit

[languid gulch]

https://www.youtube.com/watch?v=gthgfuipNRk

the meta section is fucking hilarious

[languid gulch]

i mean, they can carry it, the issue is with how long they can carry it

[pure karma]

i bet this entire channel is on the GN stream rn lol

[languid gulch]

didn't notice

now i am 🤣

8k watching

[pure karma]

dunno what there doing but it keeps crashing

[languid gulch]

the stream or the pc

[pure karma]

the pc

well actually its 3D mark that keeps failing but there blaming it on the pc so im lost

[languid gulch]

do they keep dropping temps too low?

[pure karma]

too high i think

[languid gulch]

ah

i mean that'll do it either way

[pure karma]

they said 53C+ would crash because how high the clocks are

[languid gulch]

think he said they're at 3120mhz

[pure karma]

this whole smoke cooling is sick tho lol

[languid gulch]

i wonder if they have an O2 oximeter in the room

wait, are they just using the nitro as an ambient temp dropper?

and not right on the die?

ah got it

[pure karma]

yes lmao

[languid gulch]

🤣

[pure karma]

there making it suck the liquid nitrogen smoke to cool it

we got smoking 5090's now

[languid gulch]

they should put a pot on the power connector

[pure karma]

power connector was like 15C on the temp cam earlier

surprisingly cool but then again they said ambient is 16C

[wanton orchid]

any recommendation for m.2 nvme ssd for offline reliability ?

I dont care about speed

I want it R.E.L.I.A.B.L.E

i.e : read and write good
data comsistency after half a year offline

[charred relic]

Storm blew through... internet out for hours. Yay for tethering to my phone!?!

[charred relic]

STILL down... storm must have screwed something up royally

[verbal raft]

Ahh,NVIDIA s new selling point : flame generation

[languid gulch]

or a particularly nasty way to do designed obsolescence

[verbal raft]

Im not the only one taking tinfoil hat theories then

[languid gulch]

further tinfoil hat theory: this is nvidia pissing off board partners enough to make them quit

[verbal raft]

So that nevedea can be a monopoly in another thing

[languid gulch]

they're already a functional monopoly with more than 50% of market share

this would be a move to full vertical integration on top of that

[night girder]

I notice a lot of AI generated content websites.

[charred relic]

Internet line still dead

[charred relic]

the luck..... i just happen to fall inside the one small area that's knocked out

[night girder]

doxing 101

[charred relic]

This is the deep south.. seeker finders might want to bear that in mind heh

[night girder]

You mean Griffin?

[charred relic]

I figured it would be more widespread though... then again if it were they might already have it fixed

Yep in fact I can hear the Atlanta Motor Speedway from here... just barely

Too bad I... don't like NASCAR

Drag races can be fun 😄

[tribal kraken]

I've taken my car and bikes to the drag strip to see how they do but never really go into it. The driving is so small part of that. Rather do circuit racing

[charred relic]

Wow that place has a seating capacity of 125,000, and that's not including all of the RV space in the middle

[night girder]

not really mainstream here

[soft bloom]

so much fun on Valentine's day
https://www.youtube.com/watch?v=vr2An2QgJVA
too much

[night girder]

This is what is rooted in our culture.

Modern version.

a lot of cobblestones.

[twin dew]

Somehow I expect that lot of people are only interested in NASCAR for the crashes.

[night girder]

Maybe some, not all

[charred relic]

Most are actually into the strategy and such

you don't draw 125k + a parking lot of ull of RV's for crashes

[night girder]

And the speed is impressive.

It literally can send cars flying.

[charred relic]

I do find other forms of auto racing more exciting personally but yeah

It's also hard to get a real idea of how steep those turns are at a NASCAR track until you stand on one

it's no wonder they can carry that much speed

[twin dew]

And the retail CPU sales are drop in the bucked compared to the overall sales of consumer line CPUs.

[charred relic]

Hasn't AMD made some recent gains in data centers as well?

[twin dew]

Intel is slowly losing grip on the boutique shop builds to consumers, but not really in the large-OEM space still.

[twin dew]

I did specify consumer line CPUs.
Closing the server side out.
Where AMD has been very strong in sales for years already.

[verbal raft]

ive also never seen a **halo **product also be the **Best **selling product

[twin dew]

IIRC the Intel Rebate thing from Athlon 64 days still hasn't fully gone through various courts...

[verbal raft]

its pretty dificult to sell less efficient CPU's than the competition to server

[twin dew]

Still took multiple generations of that before the swing really started.
"No one got fired for buying Intel" (as the new version which used to be "IBM".

[verbal raft]

makes sense

[twin dew]

Partly because of that same rebate thing etc. which made large server OEMs take time to start really invest into AMD lineup.

[charred relic]

The first Ryzens I wasn't ready to upgrade yet plus I wanted to wait and see given previous history.... next gen came out and I was basically sold after seeing it's performance, next gen i was ready to upgrade

I can't even imagine having used an intel chip for this thing

[twin dew]

Direct consumer sales is very fast to swing.
Ready build boutique is little slower.
Large OEM level complete system is very slow and Intel has always used rebates etc. to try to keep AMD out completely.

[night girder]

I still think this is rather impressive.

lift is a pain in the butt for nascar cars 😄

[charred relic]

especially when a lot of engineering goes into preventing...that lol

[night girder]

Nascar did force some regulations to try* to prevent this.

[charred relic]

Power though, sometimes it's too much

[night girder]

They added this to the roofs.

[charred relic]

You can have a brutal lookinc wreck in those things and just walk aware sore

[night girder]

The air just lifting a few tons up into the air, like it's a leave in the wind.

[charred relic]

..or one that doesn't look that bad and it snaps your neck

They engineered that one out tho

[night girder]

They engineered what out?

[charred relic]

the tpye of thing that killed Dale Earnhardt...

[twin dew]

By forcing using neck and head "locking" stuff to protect the neck.

[charred relic]

yeah basically just locks all that in place

But yeah that accident didn't even look bad, not by NASCAR standards. Super tame

[twin dew]

And all that was already in use, not just forced.
And some drivers, like Earnhardt, had decided to not use it.

The danger was known, just that some drivers didn't like they couldn't move their heads.

[night girder]

I mean, c'mon that looks ridiculous.

If people saw this in a movie, most (who don't know lift) would think it's CGI and bullshit (impossible).

[twin dew]

Yeah, but fast enough plate has lot of lift.
And the underside is basically a plate in most sport cars.
When you aren't in right orientation, the various downforce producing devices don't work and you just get the lift from bottom being in wrong angle.

[night girder]

I understand all the science behind it.

But I still find it fascinating to look at.

[twin dew]

Lot of high end sports cars can drive in ceiling once they hit high enough speed.

Because if they didn't generate that much downforce, they would be uncontrollable.

[night girder]

Honestly, I spend too much time looking at cars being lifted by air 🤣

[night girder]

Don't work is a bold statement. Just saw a video where they showed how the roof "spoiler?" works.

The picture I posted. The plate that goes up. And you can see it happen in last gif I posted.

You see on the roof, that there is a plate standing in an angle, and then closes.

[twin dew]

Meant the normal downforce generating aerodynamics.
That is special extra to cause specific type aero effect when the normal stuff has been lost.

The stuff that is engineered to keep the car sticking to the surface when going forward like intended.

Because otherwise the pure speed would cause them to lift up like that on any bump, even when going straight.

[night girder]

Oh, but that's just for every car?

[charred relic]

those plates don't do jack unless the care is going backards...

and they are basically the same as spoilers on an aircraft wing, tons of turbulence... no lift and lots of drag

they have plates on the side too

only those need to be working moving foward... if you are moving backards then well.. um.... hmmm

[twin dew]

Yeah, point is to slow the car down fast if it stops going nose forwards, with passively deplying aero-surfaces.

So it doesn't get so much airtime once the bottom starts generating lift.

[night girder]

Tell that to this guy https://www.youtube.com/watch?v=mjktUfqruN0

[charred relic]

not technically impossible...

[night girder]

4 months ago.

[twin dew]

Also, you almost immediately deleted that video.

The link I mean.

[charred relic]

"The new flaps are designed to deploy more quickly than the previous design, and include canvas "parachutes" on their underside to further disrupt airflow when deployed."

cough... a.... spoiler heh

[night girder]

Because I didn't wanted to post that link but a gif?

[charred relic]

"A race car's body is designed to optimize downforce, but if that body is spun so air is flowing in reverse, lift is generated instead of countered.[2] The roof flaps' job is to disrupt that airflow and prevent lift.[5]"

like.... i said

[night girder]

And you have the video right now?

[charred relic]

just to disrupt airflow

it's a... s spoiler

[night girder]

You: that doesn't work. Nascar: we are improving the system.

How can it not work. But Nascar is still investing in it? 🪿

That was my point 🤷‍♂️

[charred relic]

i didn't say it doesn't work

[night girder]

Not you, but Baldur 😄

[charred relic]

ik said it doesn't give downforce

oh

[twin dew]

It works?
Just not perfect?

And that the lift-up at speed if downforce generating aero is lost by going sideways/backwards is thing that happens to all cars at high speeds.
NASCAR is just the only racing where that happens regularly and they try to mitigate it to extent they easily can now.

[charred relic]

the airflow over those things is... pretty nuts

[night girder]

"various downforce producing devices don't work"

[twin dew]

That was about the normal aero designed to be used when going forward normally.

[charred relic]

yeah i mean the care is an egineered as the rules allow to get it to stick heh

[twin dew]

When those don't work, because you aren't going in right direction for them to work anymore.

[night girder]

Funny, how it was an option to limit the engine. But everyone was like; naaaah.

[twin dew]

Then the bottom turns into lifting surface on any bump.

[night girder]

Doesn't F1 have regulations for engine power? Or was that Nascar?

[charred relic]

they gove over that stuff down to the mm... maybe less on things like the downforce type spoilers and shit

it's nuts how many rules there are areally

[twin dew]

In most fast cars, the bottom is also part of that downforce generation with specific shaping.
But that shaping only works when going forwards.

[night girder]

I vaguely remember an organisation limiting the engines for safety.

[charred relic]

Well at some point the tracks won't be able to contain it

But hey why not find out just how fast you can go through turn 1 eh

[night girder]

NASCAR engines are limited to 358 cubic inches (5.86 liters) of displacement. These power units maintain a traditional V8 configuration with an iron block, emphasizing durability and power. The engines produce a target horsepower (HP) of up to 670 HP. Teams must adhere to these specifications, ensuring that the V8 engines maintain a balance between power output and reliability, with no team allowed to exceed these limits to maintain a level playing field.

In the Cup Series, NASCAR has historically employed restrictor plates to limit engine power for safety reasons. These plates restrict airflow to the engine, cutting its power and, consequently, reducing the speed of the cars on the racetrack. More recently, NASCAR introduced a system involving tapered spacers, which serve a similar purpose to restrictor plates but allow for more precise control over the engine’s horsepower and torque.

It was the restrictor plates. I heard about it in a documentary.

[twin dew]

Basically those fins are about giving extra air resistance when going sideways, but don't affect much when going straight.
So when you start going sideways, they both slow you down, and try to turn the car back forwards (or when gone too far, to go backwards.
And the pop-up spoiler is to slow you down via air resistance when not going forwards.

[charred relic]

Yeah I remember hearing about the plates

And we have moonshiners to thank...

[night girder]

🙈 So silly I know this stuff about NASCAR

[charred relic]

lol

[night girder]

while I will never see a nascar race in my life probably.

[charred relic]

I only know shit because I have family into it

[night girder]

Baldur, you got time?

[twin dew]

Probably.

[night girder]

Would it be stupid of me, to put proxies etc straight on my Synology in containers?

I know Herg recommended to me, to put it on a PI5 (and then I started to look into mini computers etc).

But now I am questioning myself again, if that is smart 🤔

[twin dew]

Usually would be fine.
In theory raises the attack surface onto the Synology a little, from inside the LAN.
But usually it would be perfectly open already from inside the LAN.

And in the very remote case that there is some kind of "external" exploit, it would still require someone from inside the LAN, to try to access some site where that attack is deployed from, via that proxy.

Basically IMHO that little extra security wouldn't be worth the cost in work, electricity, etc. for home network.

[night girder]

That was a worry of mine, that if they break out of the container, they are straight into my nas. If they break outside a container on seperate device, they still have to navigate my network. And depending on how I set that up, I can add extra security?

[twin dew]

But point is, how can someone attack (reverse-)proxy server program.

Either they need to already be in your LAN.
Or there must be some very weird exploit in the proxy server software and someone from inside the LAN needs to visit site which then attacks using that exploit.

[night girder]

Or docker container?

containers still are an attack vector.

[twin dew]

No it isn't.
As you need to first get into that container.
And if the only program that is network aware inside that container is the proxy software, how do you get in?

Unless you deploy container image with backdoor in it.

[night girder]

Docker is vulnerable.

If you think its 100% secure, then you are wrong.

[twin dew]

The ones I have seen have been in the Docker web management interface(s).
Usually in extension interfaces or extensions.

[night girder]

The container is open somehow, else it can't communicate with outside. Container (has open port)-> Synology (has open port) -> LAN -> Internet.

Or you close the port on synology, then it's fixed.

[twin dew]

"could be abused by a malicious extension in Docker Desktop"
Etc.

Point is that you need to secure the management of that Docker.
And I would expect that by default to be via Synologys management interface.

With optional remote access direct, which should be disabled in most cases anyways.

[night girder]

Sadly, yes 😦

No, remote access.

Well, I can enable remote access. Or I can install portainer agent on synology and control it from another device. But I didn't do that.

[twin dew]

And those direct Docker remote access services should be blocked/disabled in that Synology, so that the management is only via that Synology management interface.

Same as with any such tech, the expectation is that the remote management is in separate management-only-network that is very protected from anything else.

[night girder]

"should" being the keyword.

[twin dew]

Meant to configure the Synologys own firewall to block them.

Synology OS has software firewall in it.

[night girder]

yeah, I know

but it has no rules.

[twin dew]

Yes?
Because by default they are meant to be plug and forget devices where the access is only from same LAN.

Point it is that it would be trivial to configure that to block everything but its own management interface and file sharing.
And even limit access to that own management interface to only specific MAC and/or IP as source.

[night girder]

Mhm, then why do so many people set it up seperate?

And I mean, seperate devices.

[twin dew]

Because NASes etc. aren't actually that common?
And there are lot of instructions on how to do stuff with Pis for things like that, but not so much for other ways to do them.

I personally don't understand the point of (reverse-)proxy at all in home use.
There are other ways to do most of that stuff, and MITMing HTTPS to do checking on that is bad idea for most cases, as you then lose ability to check the certificates etc. on your actual computer, as everything will be signed by your own self-generated cert instead.

So for anything not SSL encrypted, there are better ways.
And for SSL encrypted things, you must MITM all that traffic intentionally, if you want more than IP.

[night girder]

Reverse proxy protects your app when you open it up to the internet?

[twin dew]

How, over any other thing that snoops that traffic.

[night girder]

I mean, just google around.

[charred relic]

No need for self signed these days, letsencrypt is a thing

[twin dew]

That is for servers.
Having reverse-proxy before the server.

[twin dew]

Doesn't work when you are trying to analyze traffic going to other servers.

[night girder]

Oh, so a NAS isn't a server? 🤔

Afaik, a NAS is just a server. If I want to put a app on it, and open it up to the internet, a reverse porxy is recommended.

https://www.youtube.com/watch?v=Cs8yOmTJNYQ

This is the video that started my interest in this topic.

[twin dew]

The point of that is that there isn't public IP for the actual server.
So the attack surface is only the actually public services, not everything on it.

And how to protect rest of your home network if the computer hosting internet accessible services has been hacked.

But will need moment to watch the video.

[night girder]

It's not 1 thing you implement. It's firewall + proxies + ...

proxy is open for the internet, everything behind it should be hidden.

"And how to protect rest of your home network if the computer hosting internet accessible services has been hacked."

That's why I asked about seperate device.

[twin dew]

And anything that gets passed through that proxy will still hit that actual service program as is.
If there wasn't some protocol analysis level protection noticing known attack and not passing the data.

But like I said, I need to see what is the idea in that video.

Because so far the video has ignored the actual NAT-router-firewall in the center of the various images.
And this has almost exclusively talked about home hosting HTTP(S) server.
Not any other kind of server so far.
Just hasn't explicitly said it.

[night girder]

Also, treafik I am going to use for crowdsec. I forgot.

www.crowdsec.net

[twin dew]

Which is again purely for HTTP(S).

[night girder]

What? Crowdsec?

[twin dew]

That image at least.

[night girder]

Just high level overview of architecture.

[twin dew]

Traefik itself seems to support HTTP, possibly HTTPS, and generic TCP.
No UDP, and no protocol analysis on anything but HTTP(S).

[night girder]

But proxies are used for more than what you described.

[twin dew]

Ok, it does support UDP, but the TCP and UDP stuff seems to just be about load balancing etc.

[night girder]

yup

[twin dew]

If you have multiple servers handling same thing in parallel.

So were you planning on hosting WWW-pages from your home network to public internet?

I understood you were only planning to host VPN from public source.

And everything else was to need that VPN to access.

[night girder]

vpn into an app for personal use (from outside my LAN)

[twin dew]

Or to be in the LAN.

[night girder]

That's my start. (or end-goal as a start)

Might give more access down the road. But first thing to do, is make a wall around my LAN. Then build in a gate, with a good gatekeeper. In the beginning, the gatekeeper will only allow me in (VPN).

crowdsec is just to get rid of all the bots probing 😄

[twin dew]

Basically the only relevant things on that specific video, if not doing public HTTP(S) server from your home, was that splitting the LAN into multiple ones, for different purposes and security levels, is good idea.
And that having some kind of IDS/IPS is good.
Where that IDS/IPS can be for example that Traefik with Crowdsec, for the specific types of traffic that combination supports.
Which isn't most types.

And that splitting into multiple happens on suitable NAT-router with firewall.
Most consumer ones cannot do that, as they only support single internal network for most part, outside of more limited guest-WLAN SSID.

Everything else was specific to HTTP(S) hosting from home to full public use.

In that video, the reverse-proxies were there to make port forwarding rules more specific, and to move authentication and monitoring stuff from the actual servers to separate device for management and performance reasons.

Where using cloudflare removes lot of that known bad traffic already so it never hits your own connection and overloads that.

[night girder]

How does this communication work? VPN on device 1 = ? protocol ? = VPN on device 2

[twin dew]

And then that local reverse proxy was more for that management side and more granular traffic monitoring like that crowdsec addon etc.

[night girder]

How does a VPN communicate to other device to **create **tunnel?

[twin dew]

VPN client outside your LAN hits your NAT-router, which forwards the traffic to the VPN server.
Which then makes that VPN clients traffic seem to originate from that VPN server.

[night girder]

Because you mention "HTTP(S)", I don't see that as a bad thing to secure?

So https?

[twin dew]

Point was that that is only relevant if you try to server web pages to Internet, from your LAN.

Without having to use VPN to get inside the LAN first.

And for that kind of limited service availibility, the attacker would first need to attack that VPN server software to get into the machine running that VPN server software, or to connect as VPN client.

And any crowdsec or like solution would need to be deployed on that NAT-router, or the VPN server.
Or as some other monitoring solution in the "pipe" that sees that traffic.

[night girder]

It will all be on one device, or that was my question earlier.

[twin dew]

Best would be on that VPN server, as that will then see both the VPN traffic coming in, and the actual traffic going out of that VPN server.

To rest of the LAN.

Or would need to be transparent separate device between VPN server and rest of LAN(s).

Which is why in my case IDS is living on the main NAT-router, and I have multiple LANs where any traffic between the LANs needs to pass through that same NAT-router.

[night girder]

And that's why I asked about VLAN a few days ago

[twin dew]

But for that VLANs are just implementation detail.
Point is to design the arch, and then convert it into VLANs before physical implementation.

[night girder]

First, it's technical possible to all throw this in containers on one device right?

[twin dew]

Basically just means that instead of multiple LAN-ports and multiple cables and multiple switches, you can use one LAN-port and one cable and one switch.

[night girder]

[DEVICE 1 >> DOCKER-CONTAINERS: vpn -> treafik -> crowdsec -> app?]

[twin dew]

You don't really have "apps" in this case.

For "best" security for this, you would want:
NAT-Router-Firewall with multiple LAN/VLAN support.
VPN-Server.
NAS.
Rest of LAN.

Where that VPN-server could in theory live on the NAS as container, but would probably best for it to live in DMZ zone, and NAS & rest of LAN in LAN zone.
With IDS/IPS of some sort on that NAS-Router-Firewall and limited traffic what that VPN-server can send towards the NAS, and none to rest of the LAN.

In theory that VPN-server could also live on that NAT-Router-Firewall instead too, as container or virtual machine.

[night girder]

I do have an app in this case? That's the one I want to get access too.

It's the whole point of this setup.

Having an app in a docker container, being accessible from outside my LAN.

With security.

[twin dew]

And you expect someone to break into that VPN, and then access that app.
And then to have reverse-proxy to protect against that?
Instead of just more generic IDS/IPS solution instead?

[night girder]

Nobody expects fire. Doesn't mean you shouldn't install fire alarm 🤔

and again

reverse proxy doesn't protect me. reverse proxy + crowdsec does.

https://github.com/crowdsecurity/crowdsec

[twin dew]

Remember, any attacker hitting that App would first have to had compromised that NAT-router (which should have no publicly accessible services), or that VPN-server software remotely.

Point was to go for more generic IDS/IPS solution, over reverse-proxy that only gets used for one specific kind of traffic if the VPN-server is compromized.

Which might include Crowdsec in the mix.

So that ANY traffic from that compromized VPN-server, or even trying to compromize that VPN-server, gets included in the checked traffic.

[night girder]

Mhm. Good point.

[night girder]

Also, no? reverse proxy + crowdsec before VPN, not after.

[twin dew]

Cannot do anything, as that VPN traffic is encrypted in way that that reverse-proxy can only filter based on IPs.

[night girder]

[proxy + crowdsec] filters out unwanted traffic, rest of traffic goes to VPN.

Oh right ...

[twin dew]

So basically only IP based filtering based on source address would work at that point.

Which can be already done with almost any good software firewall solution or any other IDS/IPS solution.

[night girder]

Well it would still protect VPN a bit.

security is adding layers.

not just one layer.

So I was thinking, the more layers, the better 🙂

And don't forget, I do this as a hobby. To learn.

[twin dew]

Which was the point on doing that IDS/IPS on that NAT-Router-Firewall.
Which would be in front of all other devices.
And if that VPN-server is then split into its own (V)LAN, where the traffic has to pass through that NAT-Router-Firewall before hitting rest of the LAN, then you get also monitoring of the decrypted traffic.

[night girder]

But I don't want to use my ISP firewall. It's crap UI.

[twin dew]

You cannot for this stuff.

[charred relic]

Watching Gaming Historian makes me feel old AF

[twin dew]

Would need to set that ISP device to Bridge mode if possible, or to do double-NAT or like.

[night girder]

Sorry

[twin dew]

With second router behind that ISP device.

[night girder]

I mean, I don't want to use firewall on ISP router.

So you are suggesting. Don't do treafik + crowdsec (free). Buy second router and put firewall on it?

[twin dew]

Point was that that reverse-proxy part you are stuck in is mostly just HTTP(S) thing.
And the generic solution you are looking is that Intrusion Detection System (only warns that traffic happened) or Intrusion Protection System (blocks the traffic in real time)

[twin dew]

Point was to for example get that mini-PC, and use it as router-firewall.

[night girder]

Ah, that I can do.

[charred relic]

A lot of folks buy off lease office small form desktops and shit for that oo

[twin dew]

ISP router in bridge mode, goes to switch as one VLAN that only connects to that actual router.
And comes out same port (or different port if the device has at least 2 LAN ports), goes to switch as another VLAN
And that second VLAN is what other devices use.

[night girder]

dw, already on that. M715Q

[charred relic]

depends on what size you want and how much of a deal you need

shit even the rack stuff is pretty cheap

[night girder]

www.lenovo.com/us/en/p/desktops/thinkcentre/m-series-tiny/thinkcentre-m715q-tiny/11tc1mt715q

[twin dew]

Or have two separate devices, one as that NAT-Router-firewall.
Second as VPN-server.
Where there is third (V)LAN where that VPN-server device lives on.

[night girder]

Can find second hand for 50 euro.

then some memory for 18 euro and I got 16gb for 70 euros.

[twin dew]

So VPN traffic comes from internet.
Passes through ISP router.
Goes to actual router.
Gets firewalled and if passes, goes through IDS/IPS.
Gets forwarded to VPN-server.
Gets inspected by VPN-servers firewall.
Gets unencrypted.
Gets inspected by VPN-servers firewall.
Gets sent back to the actual router.
Gets firewalled and if passes, goes through IDS/IPS.
Hits actual LAN.

[night girder]

I was kind of hoping to put VPN on same device as the rest (the mini PC)

[twin dew]

And that can be easily done with just service on same OS.
As container inside that OS.
Or as virtual machine.

[night girder]

I can always later buy second device and seperate. But as a start, I don't want to swim in devices.

[twin dew]

With that virtual machine being most secure, and that specific device supported HW virtualization.

[charred relic]

I'm glad I don't have to spend too much brain power on this sort of stuff... the wonders of having a guy lol

It's not where you go it's who you know...

[twin dew]

Just "not as secure" as completely separate machine.
As if that VPN-service gets hacked, then if container or virtual machine, you can try to attack via those towards that base OS running the router and IDS/IPS.

But perfectly fine in reality.

[night girder]

Baldur is my sanity check in this case. I look stuff up on the internet. Then make up a plan. Then validate it with Baldur.

[twin dew]

That was just about the "most secure" solution.
With that "run the VPN-server on the router" is the common solution and good enough.

[charred relic]

I think at some point to worry about more on that kind of connection you have to almost be planning to piss somebody off or something lol

[night girder]

• So VPN traffic comes from internet.
• Passes through ISP router.
• Goes to actual router.
  [MINI PC]
• Gets firewalled and if passes, goes through IDS/IPS.
• Gets inspected by VPN-servers firewall.
• Gets unencrypted.
• Gets inspected by VPN-servers firewall.
• Gets firewalled and if passes, goes through IDS/IPS.
• Hits actual LAN.
  [NAS]

[charred relic]

Past a point somebody already has to put in work to get at you, they go for easy targets unless you specifically are being targeted

[night girder]

So that would be the flow with MINI PC?

[charred relic]

Go to the next level and harden your linux installs 😄

[night girder]

arch linux needs hardening?

[cobalt ivy]

I like your pfp

[twin dew]

Yes, basically after ISP-router, but before NAS, it would be internal to that mini-PC.
With possibly virtual machine internal LAN in mix that VPN-service was running inside container or virtualization instead of the "main"/"hypervisor" OS.

[charred relic]

i dunno what arch installs by default

[night girder]

nothing 🤣

[charred relic]

typically it has to be installed intentionally as it's a whole... thing

your system will not function normally out of the box without work heh

[twin dew]

Crowdsec has Suricata log support for example.
Where Suricata is open source IDS or IPS solution with automatic rule updates etc.

[night girder]

Thanks for your input. Long conversation. But ... we agree. That it's wisest to put it on seperate device and not all on my NAS?

[charred relic]

I was kidding... mostly. But if you really really did want to be secure that would be the path along with the networking stuff.

[night girder]

And that I should start with a good firewall.

[charred relic]

It sounds like you're already planning overkill for a home setup so... you should be fin elol

[twin dew]

Some of the services could be on that NAS.
But you would anyways first need proper router&firewall solution.
And that can then easily be used to run light services on it in virtualized OS or like.

[night girder]

Yeah, 100% overkill. But it would give me some piece of mind. Peace of mind?

[twin dew]

IDS or IPS depending on how you configure.

[charred relic]

Well having too much won't hurt... other than adding complexity

[night girder]

If you don't know what you are doing, I think you can really mess security up.

And actually enlarge the attack vector, instead of making it smaller 🤣

[charred relic]

plus you'll know how to do stuff if you need it in the future even if you don't NEED it now

[night girder]

That's why I am thinking about it for a few weeks now. And not just implementing it and see what happens.

[charred relic]

start small and expand on that

if you start with a million new things it'll be way way harder to know wtf went wrong

[twin dew]

Basically my own solution is that NAT-router-firewall-IDS (to be converted into IPS later).
With very secured access to and only accessible service being SSH with certificate from LAN side with additional limitations.

Then DMZ with single physical server, with very secured hypervisor OS, and then services in multiple virtualized machines.
And separata LAN.
(also IOT network for single IP camera that I don't want neither DMZ or LAN have general access to).

With each virtual machine OS with very restrictive firewalls, so that you cannot attack between them easily via network side, only by compromising the hypervisor somehow.

[charred relic]

oh wow Grsecurity went commercial at some point

[night girder]

ssh... wow. Oh SSH only inside lan?

[charred relic]

I have a machine that is maintained entirely via SSH

if it had a display i'd have a damn hard time seeing it from here too...

[cobalt ivy]

It's in the walls, Jim. 0_0

[twin dew]

Meaning I can access that firewall machine from one machine in LAN, with right certificate.
So need username, certificate and certificate password to access.

[charred relic]

I mean... I could remote desktop but by

[night girder]

in LAN gotcha 👌

[charred relic]

pretty sure the switch my buddy got for me is all CLI

[twin dew]

And DMZ doesn't have even that access to it.
Basically compromise DMZ machine, you still cannot easily attack that firewall machine.
It does expose DHCP and DNS to DMZ, but IIRC thats it.

Could in theory move those later to that server into another VM.

[night girder]

oh, I forgot. There will be a switch before the mini PC. Not sure if that adds another attack vector.

[twin dew]

In a way, if that mini-PC only has single LAN port.
You basically need to configure that switch to not give management access over the VLAN that is for the WAN side.
And trust that there isn't some exploit that goes around that.

In the switch firmware itself.

Or just add second LAN port with USB or PCIe/m.2 adapter to that mini-PC.

[night girder]

That's why I asked about how many LAN ports me device should have.

because it would be switch -> mini PC -> rest of LAN.

and I though we can fix this with the VLANs.

[twin dew]

VLANs allow the router to not need multiple ports.
But if the WAN is also via the switch, then in theory the switch is internet accessible, if configured wrong or if that management access restriction side has exploits.

Separate WAN, and separate LAN side ports on router are better for that reason.
But nominally not needed with VLAN capable switch.

I'm not aware of any case where there was such vulnerability, but theoretically they can exist.

Just that getting kind of device you were looking for, with 2 LAN ports, is significantly more expensive than ones with just 1.

[twin dew]

And USB-dongle will work in almost all cases as second port if needed.

[charred relic]

i just have to... get around to all that. He has a AP too. And a rack. And a rack UPS...

[charred relic]

Do I need a server closet. Well no but eventually I'll have one.

[twin dew]

And of course having just single 1Gb/s Ethernet port for both WAN and LAN side shared with separate VLANs will limit the combined upload/download to 1Gb/s, not 2Gb/s like with separate ports.
As all traffic will hit the one port in both directions, once going into the router, second time leaving it.

[charred relic]

and PoE too which is perfect for phase 2

[twin dew]

So 1000/0, 500/500, 0/1000 as example theoretical splits.

[night girder]

"But if the WAN is also via the switch, then in theory the switch is internet accessible, if configured wrong or if that management access restriction side has exploits." what do you mean by this?

[twin dew]

Moment.

[night girder]

All I see on my GS308T is VLAN. Nothing about WAN.

[twin dew]

WAN, Wide Area Network.
Internet without firewall/router before it and switch.

[night girder]

Yes, but how is my switch WAN accessible?

If there is a router in front of it.

[twin dew]

Like I said, wait a moment.

[night girder]

Dynamic VLAN creation mode is disabled btw.

and what I've read, the GS308T don't have a WAN port either.

[twin dew]

First pic is how you do it with single switch, VLANs and only single port on that mini-PC router.
Second is without VLANs with at least two ports required on the mini-PC router.

In first pic that switch is internet connected for that VLAN 1, and if it accepts any kind of commands over that VLAN, it is theoretically internet-configurable.

[twin dew]

WAN port is just name for internet connected network port.
And any switch port can be internet connected.

[night girder]

Ok, that firtst picture.

Is what got me all screwed up in my head a while back.

[twin dew]

This is why I said to first design without VLANs.

And then convert to using them.

[night girder]

That's what I want.

[twin dew]

That second pic is how the traffic moves in both cases.

[verbal raft]

Alex forgot to turn auto verification off again

[night girder]

Yeah, I understand now.

[verbal raft]

(Alex Krycek)

[night girder]

So the firewall, is "gatekeeping" VLAN 1 into VLAN 2.

Telling what traffic can go from on lan into another.

And all the attacker see, is (v)LAN 1.

[twin dew]

Just that if doing it with single port on Mini-PC, and managed switch with VLANs, there is VLAN with pure internet traffic connected to the switch.
So in theory that switch is internet-administrable, if the config was done wrong or if there is firmware bug allowing going around that configuration.
Basic way is that you just set that "only this VLAN number can access management".

[night girder]

and the rest of my devices are safe on (V)LAN 2?

[night girder]

But isn't that the case already right now?

[twin dew]

Yes, those two diagrams are identical on functional level.
Traffic on VLAN1 and VLAN2 are completely separated from each other, if some device doesn't move that traffic between those two.
Like if they were completely separate physical cables.

[night girder]

No, I mean right now. How I am using it.

Router -> WAN -> Switch -> LAN

So, isn't my switch already "internet-administrable"

regardless of the VLAN etcs.

[twin dew]

Switch configuration detail.
Currently you have single VLAN on it, with ID 1.
Which all ports are "natively" connected to, and which the management interface is accessible over.

And to change to that kind of VLAN config, you would create two new VLANs in it.
Configure one port to only work as WAN VLAN port with no VLAN tags allowed and connect that to the ISP router.
Then configure another port to allow VLAN tagged traffic with WAN and LAN tags and connect that to the mini-PC router.
And configure rest of the ports only allow LAN VLAN traffic, with no VLAN tags allowed.

And configure that management interface to only allow access from LAN VLAN.

Not from default ID 1, or the ID you used for WAN side.

So without some firmware exploit, you can only then access its management interface from inside the LAN side.
Even when it is physically connected direct to internet, just ignoring anything happening on that side.

[twin dew]

That isn't WAN anymore after that Router.

[night girder]

Then why is it in this case?

[twin dew]

If it isn't in bridge-mode.

[night girder]

Internet -> ISP router -> WAN -> Switch.

Ah! Gotcha.

[twin dew]

Because in that pic the ISP router has been neutered, to act as a switch basically.

[night girder]

So, Mini-PC router would be in bridge?

Or, no ISP router would be.

Yes, ISP router bridges traffic to Mini-PC router.

[twin dew]

Just to pass everything in both directions without doing anything above layer 2.
So not doing anything on IP level at all.

[night girder]

I don't think I can do this.

The LAN is a bit more complex than that. Not everything is behind the switch 😄

[twin dew]

Can also be done with ISP router still in full router mode.
But that just leads to need for double-NAT or like, and needing to configure any port forwardings on the ISP router too.

[twin dew]

But basic thing is, that to get anything "real" done, that ISP router needs to be ditched to maximum extend possible.
And the functionality it is currently providing provided by new devices behind the new router.

[night girder]

ISP router goes to TV decorder.