𞋴𝛂𝛋𝛆

  • 76 Posts
  • 555 Comments
Joined 3 years ago
cake
Cake day: June 9th, 2023

help-circle

  • The main problem is when following instructions for command line tools. They might figure out how to use dnf instead of apt, but the extra layers required for ostree are not very friendly. There are a ton of potential frustrations in this area, especially with GPU stuff or hobbyist hardware like Arduino where kernel stuff is needed in userland. At least as of nearly 3 years ago, the documentation in this area sucks. I was on Silverblue for a few years and managed to get through the frustrations due to intermediate experience level. I found toolbox useless compared to distrobox. But using this with something like Arduino was annoying at best. The needed dependencies expected by whatever stuff I wanted to install was usually a big mystery with near useless error failure messages and names of packages and libraries totally unrelated to the package naming in DNF. When updating the base OS, stuff built in these containers is totally useless because I could not update the containers to the new OS image. Playing around with Flash Forth on a microcontroller was even worse. I ended up layering a bunch of stuff on the host because the containers were just not working. When I got an Nvidia machine, I went to Fedora Workstation and have had far fewer issues and frustrations. SB wasn’t bad, but it is a pain to use these if you need kernel level access. Just my $0.02. I was actually on SB for ~2-3 years.



  • I have no confidence it will work or last. I’m not committing to anything either, but at a minimum I need the flattest image possible, meaning a square lens to object from a distance where perspective distortion is minimized. The largest camera sensor (silicon die) will produce the flattest image with less perspective distortion. Each image must contain a known measurement, such as a little machinist’s ruler or other. The point here is that the lines of known measurement must be as close to single pixel accurate as possible. I will not take the time to straiten or correct for errors, - if I have the time and feel like making something. The result will likely be ugly and might not work or last. I need to know the angles and sizes of those protrusions to utilize them like a dovetail. I do not trust anyone’s measurements, especially my own, and I have no desire to dial you up for the ‘measure thrice print twice, measure once unfinished dunce’ - rule. I need the Cartesian planes of X, Y, and Z, (right, front, top) at a minimum.

    I probably do not have time within my project, but if I’m bored and waiting on a long print, maybe.


  • The cheapest fans available often have a lot of injection molded plastic that squeezes out of the gaps of the metal mold when the plastic parts are formed. Removing this may help some.

    The cheapest fans now come with the small motor shaft embedded into the frame with a tiny ball of metal formed at the end of the shaft. The ball is what prevents the shaft and fan blade portion from coming out of the housing. This type of bearing and retention cause more friction than a design that uses a bushing and a small plastic retainer ring. They type with the retainer ring are usually floating in the magnetic field. The little plastic retainer ring on the shaft end is only present in cases where the fan is dropped causing more force than the magnetic field will hold onto. If a person such as yourself, presses on this type of fan at the fan blade hub, you will feel the magnetic field and see the hub deflect and then return to the center of the field. Spinning it will feel frictionless. With the ball shaft type, there is little deflection and it feels like a bit more friction when comparing two side by side.

    With the ball shaft type, most of the noise will be coming from the friction and transmitted through the body of the enclosure. If you isolate the fan with some damping between it and the enclosure it will reduce the noise considerably. Damping the enclosure, and adding rubber feet between any table or surface may also help.


  • Depends on the system. Typically, the older systems do not work like this. The GPS satellites only transmit a signal that contains their location information and the time. The device must collect several of these signals and then use trigonometry to calculate your real location in time and position. Yes there are relativistic effects due to the distance to the satellites and gravity.

    For instance, in home lab electrical engineering, if a person wants a really good reference clock but cannot afford a cesium atomic reference, they can use a relatively cheap GPS system to build a referenced oscillator that is disciplined by the reference clock on these satellites. I think they are cesium too, but it has been awhile since Dave Jones made YT uploads on the eevblog about it. A Garmin bicycle computer is another example. It is triangulating the signals and plotting periodic waypoints with some basic averaging.

    That said, WiFi routers and cellular towers are possible to use for similar triangulation. Maybe check out Hak5 if they are still around. It has been awhile since I looked them up, but they used to make pen testing red team stuff that will infer much about vulnerabilities.



  • Check DNS logs. Discord is proprietary undocumented garbage that connects to dozens of raw IP addresses that have no documentation, rhyme, or reasoning. You have no clue what or who is connected in that mess of garbage, or why they are there.

    It is about like, I’m going to give you access to a phone, a special phone, it just works.

    It is a prison phone. You are in prison when you use it… technically. But you don’t really “see” the “place”. The other inmates are all around you. They see you, but you don’t see them. Never mind that though, the phone just works. Lots of people love that phone. Nobody asks questions. Just use the phone and pay no attention to all the rest. It will be fine.

    Business model? Viability? Never mind all of that. Don’t ask questions like that. The numbers do not add up in the slightest. That is the magic of prisons. Justice costs a lot, but it is worth it right. Magic phone is easy. Ask no questions. Expect no answers. Totally normal, everyone is doing it.

    The whole thing is a mass of clueless zombie morons that ask no questions and have no idea who what or why they are connected to with all those raw IP addresses. They all give trust blindly without accountability or understanding.




  • My experience may or may not apply here… In automotive paint refinishing back 15+ years ago, 2 part epoxy primers are special. Most primers are (were) 2k urethane. These are similar to automotive 2k clearcoat in how they work. They both have similar thicknesses, leveling after wet coats, and to a lesser extent - drying properties. With drying properties, the surface levels within a minute or so but it forms a surface film and the back side remains tacky for longer. (Where they differ is that clearcoat takes much longer to fully cure, like weeks to months, while primer is workable within an hour or less.) Epoxy primers are high build fillers. They get hard as a rock and are a pain in the ass to sand down. The two main reasons for using an epoxy are for super rough large surfaces, and this the the relevant bit here, they are used to seal the surface.

    In paint, there are a ton of nightmare situations. Like let’s say some brake fluid got on the paint in a crash, or some idiot used rattle can enamel on a car. Often what happens is that the repair I am doing is not the first time the panel has been repaired. While I would like to clean the issue completely and use typical 2k primers, the previous repair may have used epoxy and buried something terrible. I’m not going to strip the whole panel and have to spray additional adjacent panels to color match when I did not estimate this in the cost quote. Epoxy seals out EVERYTHING. With stuff like spray can enamel, the painted surface never cures. It remains reactive to the solvent of anything sprayed on top of it. If ABS trim or bumper covers are exposed to acetone, similar issues with reactions will happen, unless 2 part epoxy primer is used. Epoxy primer is impermeable in the context of automotive paint; it is the nuclear option. Everything else allows some solvents to pass through it over time.

    If you have ever touched the paint of new cars and noticed the softness, that is uncured clearcoat that is still venting solvents in small quantities. This is also why jams painting inside of the seals is kept to a minimum clearcoat thickness. The thicker the clear, the longer it will take to fully cure. As an ex pro painter, that softness tells me a lot about a finish too. It actually starts forming around 5 minutes after the clear is shot, just after the fingerprint test does not pull a string when removed. That is the first moment when I am able to barely graze the surface with fingertips and not damage the surface. It is still very wet underneath at this stage.

    Hopefully that illustrates how even the hardest of painted surfaces is still able to allow stuff to pass through it. If you want to stop that stuff, you need a paint that is made specifically to seal everything.

    That said, the seals and other materials also need to be up for the task. Most of those are likely just dust seals. How you deal with corners is critical. Just look at stuff like Pelican cases.




  • It is just a cleanliness standard. It is not required. I spent a decade in the details of automotive paint. I only covered the surface basics for paint. What I call clean for paint is an order of magnitude more dirty than a surgeon, and they are orders of magnitude more dirty than a silicon chip foundry. When it comes to making plastic stick and look pretty, an automotive painter might be helpful for framing the scope of what is possible. All I can tell you is I have a Prusa and never have these problems, so I explained my experience and methodology as to why I do as I said. Again, sorry this upsets you.



  • It can coat the inside of the drier. Use Bounty paper towels as a control when in question. Bounty are often used in automotive paint shops for a few reasons, but they are trustworthy for composition. If the two plies are separated, they make a good strain filter. That is the primary reason they are used. They also tend to be lower lint though not perfect. A tack cloth is used in the booth with controlled filtered air flow either across or down draft, so it is not a concern for perfect paint.

    One of the tricks of automotive painting is to add a couple of drops of Palmolive dish soap to the water bucket used with wet sanding. It makes 3M Imperial Wet/Dry sandpaper last several times longer and acts as a mild degreaser the whole time. Any residue is cleaned in the booth stage using a special Wax and Grease Remover solvent that is the least reactive of the painting solvents. While this solvent is used extensively, still the fact that Palmolive dish soap can be used at all indicates how it is clean, consistent, and chemically irrelevant. Automotive paint reacts with many chemicals but specifically silicon is the worst problem. It causes fisheyes aka little divot like holes to form in the clearcoat. In most situations involving contamination and adhesion, silicon is the main issue that will be very persistent. It is so bad in automotive paint that in the worst cases, we turn to adding an actual silicon solution into the 2k clearcoat and trying to guess what concentration will match the problem area to level it. Otherwise, the entire job must be stripped to the raw surface and start over. Silicon issues only show up in the final wet clearcoat layer shortly after it is sprayed and leveled.

    The reason why I have written all of this is to illustrate this point: the silicon is essentially floating on every underlying layer. The solvent has wet the area and the silicon just floats to the top of some filler, 2k primer, sealer, top coat color and when it gets to the clearcoat it blows a hole through it. There are two solutions. Use a two part epoxy primer that is a pain in the ass to sand, or clean the the raw surface with lacquer thinner or virgin acetone. In automotive paint, those two solvents are dangerous for causing a ton of other contamination and reactions issues. However, these are the only solvents that will take off silicon without diluting it and making the problem worse. Alcohol is a joke with no place in the automotive paint world when I was painting. I got out before water based stuff ruined the industry by making refinishing exponentially more expensive. That is only the color coat and some primers, so there may be alcohol used in some way in these, but it will not involve cleaning. Tire shine is the main source of silicon issues in automotive paint.

    I have the empirical experience to know what I am looking at with cleaning and solvents. Alcohol is okay for minor issues, but think of it as constantly diluting and wiping the problem across the whole surface. Eventually, just use some virgin acetone to actually clean the thing properly. Paint is just plastic too. Each type requires a different type of tooth to mechanically bond to. With printing, I use 600 grit to lightly knock the shine off of the print plate surface. I go lighter on the textured sheet, but I only use the textured sheet with PETG because it is the only one that takes the textured pattern completely without showing layer lines. I print weekly on average, and use acetone and sandpaper around once a year. When I use glue stick, I clean the plate with dish soap after. I use alcohol in between. You will need an enclosure for ASA, ABS, and any larger PC prints regardless of the sheet or glue. Two IKEA Lack tables with legs stacked using double sided screws, then a clear shower curtain liner, and some tack nails does the job for under $50.

    I would never use towels from any drier that has ever had fabric softener used in it for automotive paint. That is a contamination nightmare for me.


  • llama.cpp is at the core of almost all offline, open weights models. The server it creates is Open AI API compatible. Oobabooga Textgen WebUI is more user GUI oriented but based on llama.cpp. Oobabooga has the setup for loading models with a split workload between the CPU and GPU which makes larger gguf quantized models possible to run. Llama.cpp, has this feature, Oobabooga implements it. The model loading settings and softmax sampling settings take some trial and error to dial in well. It helps if you have a way of monitoring GPU memory usage in real time. Like I use a script that appends my terminal window title bar with GPU memory usage until inference time.

    Ollama is another common project people use for offline open weights models, and it also runs on top of llama.cpp. It is a lot easier to get started in some instances and several projects use Ollama as a baseline for “Hello World!” type stuff. It has pretty good model loading and softmax settings without any fuss, but it does this at the expense of only running on GPU or CPU but never both in a split workload. This may seem great at first, but if you never experience running much larger quantized models in the 30B-140B range, you are unlikely to have success or a positive experience overall. The much smaller models in the 4B-14B range are all that are likely to run fast enough on your hardware AND completely load in your GPU memory if you only have 8GB-24GB. Most of the newer models are actually Mixture of Experts architectures. This means it is like loading ~7 models initially, but then only inferencing two of them at any one time. All you need is the system memory or the Deepspeed package (uses disk drive for excess space required) to load these larger models. Larger quantized models are much much smarter and more capable. You also need llama.cpp if you want to use function calling for agentic behaviors. Look into the agentic API and pull history in this area of llama.cpp before selecting what models to test in depth.

    Huggingface is the goto website for sharing and sourcing models. That is heavily integrated with GitHub, so it is probably as toxic long term, but I do not know of a real FOSS alternative for that one. Hosting models is massive I/O for a server.


  • PLA will be better for hardware store and hobby junk. You cannot use automotive class finishes and expect them to last. Generally stick to one brand. Most paints are formulated for steel. ABS is the closest to steel in thermal properties. The expansion is the most important attribute. PLA has a different thermal profile so catalysed 2-part paints will not work very well long term. Rattle can enamel is junk by comparison, but it never fully cures like automotive paints. That property helps it stay in place longer in general. There are special adhesion promoters like bulldog for automotive stuff, but the thermal properties will still be an issue.

    Pro automotive paint is 99.9% sanding and prep work. It is far more intense and rigorous than people realize. Perfection happens in the prep work. The actual paint is just a way of showing off that perfection. Mastering automotive paint is actually all about defeating yourself. Perfection is not subject to your emotions or expectations. It is right when it is perfect.

    You want the highest pressure spray cans as possible. Also, if you do not used all of the can at once, flip it upside down and clear the nozzle by letting the siphon into the empty void and spraying. If you have a compressor that does not shoot out a bunch of oil or water, a cheap Harbor Freight pink gun with the nozzle of the can beside the spray gun will work wonders by atomizing the spray far more effectively.


  • You are solely responsible for vetting the software that you choose to run.

    I do not review or care about the tools a person uses to create their projects. I appreciate the disclaimer when the person discloses their aptitude and confidence in their code.

    Free software and Unix culture is a culture of hackers. Stallman’s very degree is in AI. Emacs is mostly a thing because lisp was adapted early on for AI development many decades ago.

    Junk code is nothing new. X11 is notoriously bad, yet you likely have parts of it running on your hardware. Proprietary code is far far worse than anything a hacker posts as open source, yet you are running proprietary blobs on whatever device you are looking at now. Even if you are like myself with a libreboot machine, Leah readily admits that you need to run the core duo microcode if you want it to run right, and are not using that hardware for your primary device. The culture of antiAI is dogmatic nonsense. It is a tool, not a religion. It can be used harmfully or helpfully. I can’t fix stupid in anyone except myself. I do not fault anyone for what they run, the projects they share, or the background they come from. I encourage everyone to be positive and help their fellow hackers. I value participation and enthusiasm. Dogma and negativity are toxic.

    I am ultra liberal. You have a right to all information, a right to skepticism, a right to error, and a right to protest in non violent forms aka the right to offend others. You do not have a right to infringe the rights of others.

    This anti AI populism infringes the rights to all information and right to error if any administrative actions are taken. Your right to protest and skepticism is duly noted. If these become toxic in any ways that alter the dissemination of information, or toxic/harmful to the individual sharing information, I will remove the offending comments. If the person continues, I will escalate. I am only the janitor here. I clean up the messes. I do not matter, but neither does anyone else here. It is a community, and only the community matters. Garbage software is bog standard. Crusade against things that matter like proprietary software leveraged hardware theft and SaaS.




  • The easiest way I know of to check any machine is to put another router or machine in front of it with a white list firewall or way of logging DNS traffic. You just need to spot the address in the list.

    DNS filtering usually only filters on incoming packets, but for bot stuff that should catch issues.

    In general, most routers run everything from a serial flash chip on the board. These are usually 8, 16, or 32 megabytes. They have a simple bootloader like U-Boot. This is what loads the operating system. These devices have a UART serial port on the PCB. You can use a USB to serial UART adaptor to see what is happening in the device. With a proprietary OS, you are still likely to see the pre-init boot sequence that the bootloader prints to terminal. Most operating systems also print information to this interface, at least of the couple dozen junk devices I have been given and messed around with. I make a little mount for a USB to serial adaptor and add it to all of my routers when new, so I only need to plug in USB to get to the internal bootloader and tty terminal interface of OpenWRT. You will need to know the default baud rate of the device, although it is probably listed somewhere online or can be guessed as one of the common high values at or above 9600.

    Getting into this further gets complicated. It is probably better to look for any CVE that is relevant to the device or software and work backwards. Look for any software updates that have obfuscated the risk for each CVE. If the issue was not fixed, that is where to look to see if someone has exploited the device. Ultimately, they need clock cycles from the CPU scheduler. So it must be a process or some way of executing code from unregistered memory.

    This is getting to the edge of what I have messed around with and understand. There may be a way to get a memory map that includes unused pages, and compare that with a hex dump of the flash memory. This is outside of your scope of a proprietary OS, but hopefully frames the abstract scope of what is possible on this class of device when you have an open source stack. The main advantage of this kind of device and issue is that you can physically remove the flash chip and then see and manipulate every page and memory location. The device likely doesn’t have microcode loaded into the CPU(s) that make it challenging to determine what is going on.

    There is probably an easier way, but a hex dump of the current system can be hashed against the factory updated version to see if any differences are present. It is likely that any exploit will include a string with the address to connect to somewhere in flash memory. It could be obfuscated through encryption or a cypher, but a simple check for strings in the hex dump and a grep for “http” is a simple way to looks for issues.

    The OpenWRT forum is a good general source. The people behind the bootloaders for these devices are also Linux kernel developers and on the OpenWRT forum.


  • Just be aware that W11 is secure boot only.

    There is a lot of ambiguous nonsense about this subject by people that lack a fundamental understanding of secure boot. Secure Boot, is not supported by Linux at all. It is part of systems distros build outside of the kernel. These are different for various distros. Fedora does it best IMO, but Ubuntu has an advanced system too. Gentoo has tutorial information about how to setup the system properly yourself.

    The US government also has a handy PDF about setting up secure boot properly. This subject is somewhat complicated by the fact the UEFI bootloader graphical interface standard is only a reference implementation, with no guarantee that it is fully implemented, (especially the case in consumer grade hardware). Last I checked, Gentoo has the only tutorial guide about how to use an application called Keytool to boot directly into the UEFI system, bypassing the GUI implemented on your hardware, and where you are able to set your own keys manually.

    If you choose to try this, some guides will suggest using a better encryption key than the default. The worst that can happen is that the new keys will get rejected and a default will be refreshed. It may seem like your system does not support custom keys. Be sure to try again with the default for UEFI in your bootloader GUI implementation. If it still does not work, you must use Keytool.

    The TPM module is a small physical hardware chip. Inside there is a register that has a secret hardware encryption key hard coded. This secret key is never accessible in software. Instead, this key is used to encrypt new keys, and hash against those keys to verify that whatever software package is untampered with, and to decrypt information outside of the rest of the system using Direct Memory Access (DMA), as in DRAM/system memory. This effectively means some piece of software is able to create secure connections to the outside world using encrypted communications that cannot be read by anything else running on your system.

    As a more tangible example, Google Pixel phones are the only ones with a TPM chip. This TPM chip is how and why Graphene OS exists. They leverage the TPM chip to encrypt the device operating system that can be verified, and they create the secure encrypted communication path to manage Over The Air software updates automatically.

    There are multiple Keys in your UEFI bootloader on your computer. The main key is by the hardware manufacturer. Anyone with this key is able to change all software from UEFI down in your device. These occasionally get leaked or compromised too, and often the issue is never resolved. It is up to you to monitor and update… - as insane as it sounds.

    The next level key below, is the package key for an operating system. It cannot alter UEFI software, but does control anything that boots after. This is typically where the Microsoft key is the default. It means they effectively control what operating system boots. Microsoft has issued what are called shim keys to Ubuntu and Fedora. Last I heard, these keys expired in October 2025 and had to be refreshed or may not have been reissued by M$. This shim was like a pass for these two distros to work under the M$ PKey. In other words, vanilla Ubuntu and Fedora Workstation could just work with Secure Boot enabled.

    All issues in this space have nothing to do with where you put the operating systems on your drives. Stating nonsense about dual booting a partition is the stupid ambiguous misinformation that causes all of the problems. It is irrelevant where the operating systems are placed. Your specific bootloader implementation may be optimised to boot faster by jumping into the first one it finds. That is not the correct way for secure boot to work. It is supposed to check for any bootable code and deplete anything without a signed encryption key. People that do not understand this system, are playing a game of Russian Roulette. There one drive may get registered first in UEFI 99% of the time due to physical hardware PCB design and layout. That one time some random power quality issue shows up due to a power transient or whatnot, suddenly their OS boot entry is deleted.

    The main key, and package keys are the encryption key owners of your hardware. People can literally use these to log into your machine if they have access to these keys. They can install or remove software from this interface. You have the right to take ownership of your machine by setting these yourself. You can set the main key, then you can use the Microsoft system online to get a new package key to run W10 w/SB or W11. You can sign any distro or other bootable code with your main key. Other than the issue of one of the default keys from the manufacturer or Microsoft getting compromised, I think the only vulnerabilities that secure boot protects against are physical access based attacks in terms of 3rd party issues. The system places a lot of trust in the manufacturer and Microsoft, and they are the owners of the hardware that are able to lock you out of, surveil, or theoretically exploit you with stalkerware. In practice, these connections are still using DNS on your network. If you have not disabled or blocked ECH like cloudflare-ech.com, I believe it is possible for a server to make an ECH connection and then create a side channel connection that would not show up on your network at all. Theoretically, I believe Microsoft could use their PKey on your hardware to connect to your hardware through ECH after your machine connects to any of their infrastructure.

    Then the TMP chip becomes insidious and has the potential to create a surveillance state, as it can be used to further encrypt communications. The underlying hardware in all modern computers has another secret operating system too, so it does not need to cross your machine. For Intel, this system is call the Management Engine. In AMD it is the Platform Security Processor. In ARM it is called TrustZone.

    Anyways, all of that is why it is why the Linux kernel does not directly support secure boot, the broader machinery, and the abstracted broader implications of why it matters.

    I have a dual boot w11 partition on the same drive with secure boot and have had this for the last 2 years without ever having an issue. It is practically required to do this if you want to run CUDA stuff. I recommend owning your own hardware whenever possible.