pak9rabid
pak9rabid on Hacker News
I'd be curious to see what the actual link speed is between the two endpoints, rather than a speed test out to the ISP. Are you able to do a speed test with something like iperf3 locally?
Yes. There's always room for improvement.
I hear after 20 years all the accumulated tartar turns into a 2nd layer of enamel.
Systems like the Banana Pi 4 can easily route traffic at near 10 gigabit wire speed. Granted, this particular system has very good hardware offloading capabilities.
Find a decent embedded system & put Linux on it. I've been using that setup for 20'ish years now & have never regretted it.
See also: pfSense, OpenWrt
Ugh...reminds me of the "Pre N" Wifi days, and my stupidity for buying one before 802.11n was actually ratified.
Live & learn...
Oh man, Kid Pix takes me back. That was my very first interaction with a Mac back in 2nd grade in my school's computer lab. It was definitely the favorite app amongst all the students back then, and a helluva improved experience over using the old Apple IIs we had access to prior.
DuckDB is amazing.
I swapped out some data analytics processing that was originally implemented with Python & Postgres to DuckDB and have been immensely pleased with the outcome. Stuff that would take 6+ hours to do with Python/Postgres now takes me around half an hour to complete.
It's a great addition to an existing Postgres database as it has very tight integration with it's native Postgres extension, which allows you to do things like select data from your Postgres database, process it locally with DuckDB, then insert back into your Postgres database.
I'd highly recommend giving it a try.
Yep, came here to say the same thing. I still remember Carmack presenting Doom3 with the GF3 at the Macworld Expo (Feb 2001) and recall him referring to it as the first true GPU.
Funny, though, that when Doom3 was actually released in 2004 a GF3 wouldn't come anywhere close to playing it at an acceptable framerate (a GeForce 6800 was what you wanted for it in those days).
Yep, a reverse-proxy is supposed to handle all the stuff that would need handling in a production environment (as you stated: TLS termination, load-balancing, DoS protection, etc) that an application developer should not have to be concerned with when doing local development. Not only is this a good de-coupling of services, but it makes the developers' jobs much easier when they don't need to be concerned with such things.
At my current job I'm in charge of developing our data analytics platform, and with it being so data-driven I was able to implement like 95% of the logic directly into the database largely as functions and stored procedures. The remaining 5% of the application code is mostly Python, which merely acts as a connector from an HTTP gateway to call said functions and render their output as XLSX files. It's amazing how much I was able to do with mostly SQL (I still had to break down and use plpgsql at times to handle the more procedural stuff, but that was the exception).
And now I'm in the process of replacing some of the more intensive data analytical stuff with DuckDB, which has been just an awesome experience.
Long live SQL!
Oh my god....q2ctf was the absolute best. I still fire it up on LAN parties here from time to time.
> The funny thing too is when 3d graphics were first taking over, the games themselves didn't look as nice as the former 2d ones
Duke3D -> Quake (software rendered of course) definitely fit that description
Boy I really hope somebody got fired for that blunder!
Wow, I was just the other day wondering how these work. Far more complicated than I had expected, but a very cool mechanism!
Probably had to unbolt the brake bar to get it to spin freely backwards?
Perhaps they should just drop the 'security' from the name and simply call it a camera.
I've been using Canonical's LXD for this, under Debian Trixie. Nowadays I can usually get away with just running containers for things I need vs full-blown VMs. I guess the only downside is that in order to get the latest version of LXD installed easily you'd have to do it via snap, which I understand is a dealbreaker for many.
There's also been advancements in cylinder head technology (i.e., VTEC, VVT, etc), which I guess also falls under control systems, but worth mentioning as these technologies are very cool. Honda's iVTEC has it down to a damn science with how to optimize valve lift & duration across the entire RPM spectrum.
Sounds like a fun way to make a lot of friends in law enforcement :)
The only thing the ViRGE was good for was passing through to a Voodoo2
It looks like it can. Check out GPUDirect RDMA.
When you setup your single ethernet port (let's call it eth0) as a VLAN trunk port, you'll get the ability to configure multiple virtual interfaces off of it. How many virtual interfaces you get depends on how many VLANs you want to tag traffic for. For example, if you have 2 VLANS with ids 100 and 200 (100 being your public Internet-facing traffic, and 200 being your LAN traffic), you would then have interfaces eth0.100 and eth0.200 to work with that you can then use in your firewall scripts as if they were two separate, physical interfaces.
This of course means you need a VLAN-aware switch that this single ethernet port can plug into, configured as a VLAN trunk (in Cisco terms) port. You would then want to configure one of the other switch ports as a VLAN access port assigned to VLAN 100 (untagged). This is the port you would plug your cable modem into. Then (in the simplest example) you could assign all the rest of the switch ports to VLAN 200 (untagged), and you would plug all your LAN devices into them.
Yes. You can take advantage of Netfilter's flowtable infrastructure and if you have the right hardware (NVIDIA/Mellanox ConnectX-5 or MediaTekMT7621) it will actually offload the processing of these packets to the NIC hardware. This only applies to established connections, however, but that typically accounts for like 95% of the traffic passing through.
You'd need to run a daemon like miniupnpd to enable UPnP, however I'd avoid it if you can, as it can be a significant security risk.
You can still use the iptables interface for nftables rules if you'd like, but I think you miss out on things like atomic application of rulesets, ranges, lists, and variables (not shell variables).
I've gone through quite a few embedded devices for exactly this use case. So far I've used:
- Soekris net4501 (x86, 486-class CPU) (discontinued)
- PCEngines alix2d3 (x86, AMD Geode LX800) (discontinued)
- PCEngines APU (x86, AMD T40E) (my current router/firewall) (discontinued)
I'm also currently using an APU2 as one of my wireless access points (with hostapd).
All of these have been solid machines that have given me zero problems.
The next system I plan to use is going to be a Banana Pi R4 (ARM Cortex A73), it's a solid choice for a simple router/firewall/DNS/DHCP box. It has a built-in 4-port gigabit switch where each interface can be used as normal Linux interfaces, as well as 2 SFP+ ports that are capable of supporting up to 10 gig ethernet.
It's also one of the few systems that offers true hardware offloading for connection tracking, so things like netfilter flowtables don't have to use any main CPU processing.
I'm currently experimenting with a Banana Pi R4 as a Wifi7 access point (running Debian with hostapd), however the current state of the wifi7 module for it (BPI-R4-NIC-BE14) and Linux driver (mt7996e) is still pretty young and a bit buggy (i.e., limiting transmit power to 6 dBm without patching the driver to override it, and there's apparently a lack of RF shielding which can contribute to low SNR on the receiving end). With the proper patches in place it makes a decent Wifi 6 access point. I'm hoping these issues get ironed out in the future and I can use it as a true Wifi7 AP. frank-w is doing outstanding work to help support the open source community with this new hardware.