• 2 Posts
  • 62 Comments
Joined 2 years ago
cake
Cake day: July 2nd, 2023

help-circle
  • Congrats on the acquisition!

    DL380 G9

    Does this machine have its iLO license? If so, you’re in for a treat, if you’ve never used IPMI or similar out-of-band server management. Starting as a glorified KVM, it then has full power control authority (power on/off, soft reset, hard reset), either a separate or shared Ethernet connection, virtual CD and USB, SNMP reporting, and other whiz-bang features. Used correctly, you might never have to physically touch the machine after installation, except for parts replacement.

    What is your go-to place to source drive caddies or additional bays if needed?

    When my Dell m1000e was missing two caddies, I thought about buying a few spares on eBay. But ultimately, I just 3d printed a few and that worked fine.

    Finally, server racks are absurdly expensive of course. Any suggestions on DIY’s for a rack would be appreciated.

    I built my rack using rails from Penn-Elcom, as I had a very narrow space I wanted to fit my machines. Building an open-frame 4-post rack is almost like putting a Lego set together, but you will have to take care to make sure it doesn’t become a parallelogram. That is, don’t impart a sideways load.

    Above all, resist the urge to get by with a two-post rack. This will almost certainly end in misery, considering that enterprise servers are not lightweight.


  • I previously proffered some information in the first thread.

    But there’s something I wish to clarify about self-signed certificates, for the benefit of everyone. Irrespective of whichever certificate store that an app uses – either its own or the one maintained by the OS – the CA Browser Forum, which maintains the standards for public certificates, prohibits issuance of TLS certificates for reserved IPv4 or IPv6 addresses. See Section 4.2.2.

    This is because those addresses will resolve to different machines on different networks. Whereas a certificate for a global-scope IP address is fine because it should resolve to the same destination. If certificate authorities won’t issue certs for private IP addresses, there’s a good chance that apps won’t tolerate such certs either. Nor should they, for precisely the reason given above.

    A proper self-signed cert – either for a domain name or a global-scope IP address – does not create any MITM issues as long as the certificate was manually confirmed the first time and added to the trust store, either in-app or in the OS. Thereafter, only a bona fide MITM attack would raise an alarm, the same as if a MITM attacker tries to impersonate any other domain name. SSH is the most similar, where trust-on-first-connection is the norm, not the outlier.

    There are safe ways to use self-signed certificate. People should not discard that option so wontonly.


  • After reviewing the entire thread, I have to say that this is quite an interesting question. In a departure from most other people’s threat models, your LAN is not considered trusted. In addition, you’re seeking a solution that minimizes subscription costs, yet you already have a VPN provider, one which has a – IMO, illogical – paid tier to allow LAN access. In my book, paying more money for a basic feature is akin to hostage-taking. But I digress.

    The hard requirement to avoid self-signed certificates is understandable, although I would be of the opinion that Jellyfin clients that use pinned root certificates are faulty, if they do not have an option to manage those pinned certificates to add a new one. Such certificate pinning only makes sense when the client knows that it would only connect to a known, finite list of domains, and thus is out-of-place for Jellyfin, as it might have to connect to new servers in future. For the most part, the OS root certificates can generally be relied upon, unless even the OS is not trusted.

    A domain name is highly advised, even for internal use, as you can always issue subdomains for different logical network groupings. Or maybe even ask a friend for a subdomain delegation off of their domain. As you’ve found, without a domain, TLS certificates can’t be issued and that closes off the easy way to enable HTTPS for use on your untrusted LAN.

    But supposing you absolutely do not want to tack on additional costs, then the only solution I see that remains is to set up a private VPN network, one which only connects your trusted devices. This would be secure when on your untrusted LAN, but would be unavailable when awat from home. So when you’re out and about, you might still need a commercial VPN provider. What I wouldn’t recommend is to nest your private VPN inside of the commercial VPN; the performance is likely abysmal.



  • You and friend 1 have working setups. Friend 2 can’t seem to get their setup to work. So the problem has to be specific to friend 2’s machine or network.

    To start at the very basics, when WG is disabled, what are friend 2’s DNS servers, as listed in “/etc/resolve.conf” (Linux) or in “ipconfig” on Windows. This can be an IPv4 or IPv6 address. Whatever it is, take note of it. Also try to ping it and make sure the ping is successful.

    Then have friend 2 enable WG. Now try pinging the same DNS servers again. If this fails, you are one step closer to the problem. If this succeeds, then check to see if WG caused new DNS servers to replace the former ones.

    One possibility is that friend 2’s home network also uses 192.168.8.X, and so the machine tries to reach the DNS servers by going through WG. But we need more details before making this conclusion.

    You also said friend 2 can ping 9.9.9.9 (aka Quad9), but is this friend using Quad9 as their DNS server? If so, what exactly is observed when you say that “DNS doesn’t resolve”? Is this an error in a browser or the result from running “nslookup” in the command line?

    IPv6 isn’t likely to be directly responsible for DNS resolution failures, but a misconfigured WG tunnel that causes an IPv6 DNS server to be blackholed is one way to create resolution failure. It may also just be red herring, and the issue is contained entirely to IPv4. I would not recommend turning off IPv6, because that’s almost always the wrong answer and sweeps the other problems under the rug.




  • Do most people really only ride on the throttle?

    I can only offer a morsel of anecdata from around my area, but a rudimentary sample of the ebiking public while waiting at red lights in the last few weeks would suggest that yes, a good number of people riding bikes have the throttle pinned and are going at a good clip, which I would estimate to be 20 MPH (32 kph), the existing Class 2 limit.

    Granted, I’m only really ever at red lights long enough to survey anything when I’m in the suburbs. And I suspect the thinking here is that 20 MPH is plenty fine if the alternative is walking or riding slower on sidewalk. At least around here, most probably know someone who’s eaten pavement on an e-scooter at 15 MPH, so 20 MPH is likely a reasonable pace for a lot of people.

    How about a non-stupid firmware update that locks to 20 if a throttle is connected, and unlocks to 28 if there isn’t one?

    Such a design could work, but probably can’t be done with a firmware update for existing bikes. A lot of throttles are just – and I’m simplifying for generality – a potentiometer feeding an analog signal to the motor controller. The latter might not be able to detect the absence of a throttle, but merely that if a throttle is present, it is not engaged. That’s not sufficient to meet the clarified laws for 2025, so perhaps the industry will rise to produce throttle-presence detecting ebikes going forward.

    Personally, I removed the throttle from my rather-old Class 3 ebike long ago, because I just didn’t use it. When I’m going at the full 28 MPH (45 kph), I’ve got a better feel for the road conditions when I’m actively pedaling, and with the torque sensor backing me up. But I bike as my primary mode of transportation, despite other options available, so it’s also just more fun this way.


  • The other comments correctly mention aspects like managing terrain and the width of railroads vs roadways. What I want to highlight is the development of road building methods at around the same time that metal-on-metal rail developed.

    The 1800s were a wild time. Some clever folks figured out that they could put a contemporary steam engine – invented early 1700s; used only for stationary uses in lieu of water power – onto a wagonway. Wagonways are basically wooden or metal guides/flanges so that a horse-drawn wagon could be pulled along and stay perfectly centered on the path.

    Up until this point in history, the construction of graded, flattened surfaces for moving goods didn’t change very much compared to what the Romans were doing with their roads. That is, a road had to be dug down and some soil removed, then backfilled with coarse material (usually large stones), and then a layer of smaller stones to try to approximate a smooth surface. The innovations the Roman introduced included a keen eye for drainage – freeze/thaw cycles destroy roads – and surveying methods (also to build things like aqueducts and canals). And concrete, of course.

    But even the best built roads of that era were still prone to rutting, where each passing wagon slowly wears a groove into the road. Wooden wagons wider or narrower than the groove would suffer poor performance or outright break down. The wagonways sought to solve that issue by: 1) forcing all wagons to fit within the fixed guides on the sides, and 2) concentrate the grooves to exactly within the guides. The modern steel-on-steel railway takes this idea to its logical end.

    An adhesive railroad seeks to be: all-weather, heavy duty, and efficient. Like Roman roads before it, all railways (except maybe on-street tramways) need to excavate the soil and build it up, usually being higher and wider than the rest of the land. It also minimizes the width of the earthworks, by being so compact and building upward. This sturdy base also provides a strong foundation to support heavy loads, preventing the steel rails from sinking or “rutting”. And finally, putting the wheel atop the rail makes for low-friction operation. Early wooden plateways sort-of did this, but they didn’t manage curves like how modern rails do.

    All the while, instead of trying to support heavy wagons, another clever person sought to reinvent road building outright, postulating that if a surface could just spread out the load from light/medium traffic, then the soil beneath could be used as-is, saving a lot of earthworks. A gravel surface would meet this criteria, but gravel is not all-weather and can develop rutting. The key innovation was the use of binder (basically glue) to hold the surface together, such as tar. This sealing process meant the surface wouldn’t shift underneath traffic. This neatly avoided the issue of dust, made the surface water impermeable, and reduced road maintenance. So famous is this surfacing process that the inventor’s name can still be found in the surface for airport runways, despite runways always being excavated down to a significant depth.

    So on one hand, rail technology developed to avoid all the pitfalls of 1700s roads. On the other hand, road surfacing developed to allow light/medium traffic roads to be economically paved for all-weather conditions. Both developments led to increased speed and efficiency in their domain, and networks of both would be built out.

    Rail networks made it possible to develop the “streetcar suburbs” around major historical cities in the late 1800s. But on the same token, cheap road surfacing made it possible to build 1950s American suburbs, with wide, pedestrian-hostile streets sprawling in serpentine patterns. The fact that sealed roads are water impermeable has also substantially contributed to water pollution, due to increased rain runoff rather than absorbing into the underlying soil.


  • Thank you for your kind remarks. One of the reasons I wanted to completely strip it down and re-season was to later be able to visually assess if I’m doing a sufficient amount of post-mealprep cleanup for cast iron.

    If in 5 years it still looks as good as that photo, then my procedures must be sufficient. If not, then I can devise a plan to adjust my cleanup process. Even though the skillet itself can take a beating and still cook, I want it to reflect my kitchen technique (or lack thereof) so I can learn and improve. Just as the person before me used this instrument, I intend to craft my own culinary destiny, wherever it might take me.

    But all the same, a well-seasoned skillet reflects the passage of time and history. And that’s often worth saving. So I’m not saying all skillets need to be stripped down, nor that all skillets must be left alone to develop copious polymerized layers. In the end, a skillet is a tool, unable to cook on its own. It needs a trained hand to wield its handle, to take decisive action, and to occasionally burn when forgetting to use a handle holder lol




  • IANAL, and lawsuits almost always end up being very fact-intensive, which means that the specifics of the case often make the difference. So it’ll depend. But broadly speaking, if there isn’t a specific law – eg ADA – that specifically assigns liability, then the most typical claim someone would try to make is a theory of negligence. That is, failure of the laundromat to behave with a reasonable degree of care.

    In the absence of signage or disclaimers or waivers (like in some amusement park rides), the jury will have to assess whether this laundromat’s environment suggested some heightened sense of security (eg security cameras, even fake ones) or that management implied or leaned into marketing that made it sound like clothes wouldn’t be stolen there. But a typical coin-op laundromat has people going in and out at all times of day, so it’s not reasonable to think it’s akin to Fort Knox, even without a sign indicating that management disclaims liability for clothes theft.

    As for posting that sign, it won’t change the general lack of liability on the laundromat in a case where someone snatches clothing. But the equation is different if, say, a patron asked a staff member to watch their laundry for 5 minutes as they make a phone call, and that staff member agreed but then went out for a smoke, resulting in an opportunistic thief stealing the $80 bras from the dryer. Here, the laundromat would carry liability, because although they don’t normally watch the clothes, they agreed to do it this once and did it so badly that the clothes were stolen. That’s negligence, despite the sign.

    That said, posting a warning sign is generally encouraged, since a core principle of liability is that avoidance of harms is always going to be preferable than litigating after they’ve already happened. So if the sign causes patrons to stay near their clothes in the machine, then some amount of theft has been outright avoided. For this reason, courts seldom will punish a business for having an overzealous sign, unless the sign itself is materially false or the sign itself causes a hazard (eg a loose “Gusty Winds” highway warning sign that falls over in a light breeze, injuring a middle school student).

    But to muddy the waters some more, another core principle of liability is that liability should fall upon the person whose behavior if changed will prevent future harms. For stolen clothes, it’s quite clear that the thief should be liable for the value of the stolen bras. If a court instead holds the laundromat liable, then that creates a perverse incentive where rather than spending money on more/better washers, the laundromat must spend that money on cameras and private security, raising the cost of the laundry machines. In additional to absolving civil liability on the thief. All for something which would be more cheaply solved by patrons just watching their laundry, or perhaps installing hasps on the machines so patrons can bring their own locks.

    On the flip side, denying liability means the patron has lost the value of their clothes. Perhaps they now have to spend more on “clothes insurance”, which only serves to benefit an insurance company rather than affording more bras. Adjudicating liability – in any legal system – is a thankless job and there are never perfect answers to the delicate balancing act. Life is messy, and even the best civil tribunals struggle to make sense in all of the turbulent circumstances.

    TL;DR: it depends



  • You’re going to have to clarify what jurisdiction, since USA law is going to be vastly different than EU law, in the realms of product, medical devices, and public accommodations liability.

    But if we did examine the USA, then we can find some generalized rules. For product liability – the responsibility of manufacturers and distributors of a tangible object – strict liability will lay when a product has an inherent defect (meaning it didn’t become defective after the initial sale) and this defect causes some sort of injury. Although this criteria doesn’t depend on the frequency of injuries, if a product is accumulating a body count, that’s usually a good sign that there’s a defect. Causality is also important to establish, as well as any mitigations that may have existed. On this front, a manufacturer might argue that the warnings in the instruction manual specifically advised against diving headlong into a 30 cm deep swimming pool. And although warning consumers to not do something may be somewhat effective at discharging liability, warnings alone do not prevent someone from trying a lawsuit anyway; the popular wisdom that the “pages of warnings” in manuals are written by lawyers is only partly true, since most manufacturer prefer repeat business by customers that are still alive.

    Medical product liability is similar, but slightly different because medical products are built for a specific purpose but a doctor can instruct a patient to use it differently, if medically appropriate. If not used as instructed by the manufacturer, the manufacturer is usually off the hook, but the doctor might be liable for medical malpractice. Maybe. Doctor liability in the USA is framed within a “duty of care”, meaning that the doctor takes on a responsibility to act with a reasonable degree of skill and competency. The “standard of care” idea is related, in that it sets the floor for what is reasonable for all doctors. It is, for example, grossly negligent to a drunk doctor to examine a patient. Harms from such negligence can be litigated through a malpractice suit. But this doesn’t mean all harm is actionable. A successful appendectomy that results in blood sepsis is always going to be a possibility, even with the best infection controls in place. If all the staff discharged their duties within their training, then negligence does not attach. Also, malpractice is not something which can be waived, because even if a patient doesn’t sue, a doctor’s medical license can be suspended. Whereas the risks of a surgery can be described in detail to a patient, for informed consent.

    Finally, public accommodations law sets the floor for how public and private businesses conduct themselves if they provide goods or services to the general public. Very prominently in this realm are accessibility requirements, which are rules that assure the disabled will not have undue burdens that able-bodied people wouldn’t face. The Americans with Disabilities Act (ADA) provides for very stiff fines for non-compliance, and because its objective was to set the standard, there is no provision for a “fix it ticket” approach for enforcement. That is to say, the ADA does not allow business owners to wait until a wheelchair user makes a complaint; they must follow the standard from day 1.

    No doubt there is abuse of the liability laws – there’s nothing more American than filing “ambitious” lawsuits – and this is just a brief (and uncited, '“from the hip”) summary of possible areas of law that might answer your question. But I hope it gives you an idea of why a warning or sticker or sign might incur liability. Or at the very least, an unexpected lawsuit from left-field.






  • Having sat down to look into whether this court challenge will hold any water, I am thoroughly pleased with how nice the Canadians are, where their federal government annotates their Charter of Rights and Freedoms (a component of the overall Canadian Constitution), and where the environmental law firm taking up this case kindly included the lawsuit in their online press release. Such reader conveniences would be luxurious here in California and the USA.

    Anyway, to start, we need to summarize what Bill 212 – now enacted – changed in the Ontario laws. Reminder: IANAL. The Royal Assent PDF version is the finalized changes to the laws, and it indicates five Acts were amended, by way of five Schedules in the bill. Of those, only Schedule 4 from the bill is relevant, which modified the Highway Traffic Act by adding Section 195.2-195.18. As of this writing, the web version of the Highway Traffic Act has not been updated with the new Sections, but they should appear soon.

    The salient details added by Bill 212 are:

    • Section 195.3: Minister approval for bicycle lanes required
    • Section 195.5: Authority to direct future bicycle lane removals
    • Section 195.6: Bloor Street, University Avenue and Yonge Street bicycle lanes removed; auto lanes restored
    • Section 195.9: reimbursement to municipality for initial construction and removal costs
    • Section 195.14: no lawsuits by individuals for losses due to lane removals

    The Ontario Legislature uses its exclusive “Local Works and Undertakings” power from the Canadian Constitution to write and amend the Highway Traffic Act, meaning that federal law cannot preempt the Legislature on the topic of public works wholly within the province. Overall, it seems that the drafters wrote in all the necessary details seemingly needed for a valid bill.

    The lawsuit challenges the Ontario Attorney General and Minister for Transportation, requesting the provincial court:

    • Determine that Section 195.6 violates the Charter of Rights and Freedoms section 7 and thus unconstitutional
    • Void Section 195.6 from having any effect
    • Grant an injunction to prevent any changes by anyone to the three street’s bike lanes for the time being
    • Grant an order to produce all memos and documents from ministers discussing Bill 202, in unredacted form
    • Order the province to pay the law firm’s expenses

    Section 7 of the Charter reads as:

    Everyone has the right to life, liberty and security of the person and the right not to be deprived thereof except in accordance with the principles of fundamental justice.

    The lawsuit specifically argues that the rights to life and security are infringed. Those are summarized as:

    The right to life is engaged where the law or state action imposes death or an increased risk of death, either directly or indirectly

    Security of the person is generally given a broad interpretation and has both a physical and psychological aspect … Security of the person will be engaged where state action has the likely effect of seriously impairing a person’s physical or mental health

    The challenge will turn on whether fundamental justice was done by Section 195.6, and notably the lawsuit does not seek to challenge any of the other sections, like 195.3 or 196.5. This may just be down to putting their strongest foot forward, since the outright inclusion of three streets by name could be considered arbitrary or gross disproportionality, which are against fundamental justice.

    The principles of fundamental justice include the principles against arbitrariness, overbreadth and gross disproportionality.

    The full link on Section 7 goes into greater legal detail, but I want to point out something which American bicyclists frequently have to consider: if this lawsuit succeeds, could this be weaponized by motorists in future? I think it’s unlikely, because the closest analogy would be if a 400-series Highway were being removed and a motorist wanted to sue to stop that from happening. But the Section 7 challenge can only work if life and security are at stake.

    A motorist would struggle to argue that closing a freeway directly causes cars to use city streets, which imperils the lives of motorists who might get into car crashes, since divided highways tend to have lower death/injury rates. The argument fails because freeways aren’t built for the explicit purpose of safer travel, although they do tend to achieve that by not having pedestrians around. It would also be too tenuous to argue that a freeway removal forces motorists to use the city street; they can also choose a different freeway, or take transit and not drive at all, and the Charter doesn’t guarantee a right to drive an automobile.

    Whereas it is the explicit purpose of Bloor Street’s bike lanes to provide a safe path for bicyclists, separated physically from motor traffic by curbs and bollards. Physical safety is part-and-parcel to the core notion of a protected bike lane.

    I’m not well versed in Canadian constituional law, but the lawsuit takes aim at the most time-sensitive part of Bill 212. And at least to me, it makes a colorable argument that has decent odds of obtaining the injunction to stop the demolition for the moment.