Werner changed the topic of #armbian to: armbian - Linux for ARM development boards | www.armbian.com | Github: github.com/armbian | Commits: #armbian-commits | Forums Feed: #armbian-rss | Type 'help' for help | This channel is logged -> irc.armbian.com
ChriChri_ has joined #armbian
ChriChri has quit [Ping timeout: 264 seconds]
ChriChri_ is now known as ChriChri
dddddd has quit [Ping timeout: 264 seconds]
<ArmbianTwitter>
@AgungSuryoPutra (Agung Suryo Putra): Armbian on an Android TV Box https://t.co/ceMUOfrSTE (20s ago)
das_coach has quit [Remote host closed the connection]
sassinak-work has quit [Ping timeout: 256 seconds]
sassinak-work has joined #armbian
<lanefu>
do the C. States armbianmontor follows work with RK3399? my opi4 just seems to run until it overheats and i never see any cstates kickin
agrisis has quit [Ping timeout: 272 seconds]
<lanefu>
oh well.. i cranked my opi4 to 1412mhz and it seems to be stable with rosetta at 71C
<Werner>
Good morning
<lanefu>
Hi!
<lanefu>
What country are you in Werner?
<Werner>
Germany
<Werner>
By the way martinayotte Miouyouyou you are free to request a project affiliation cloak if you like. More about that in the IRC documentation :)
<lanefu>
Wow you get up early
<Werner>
Not just up, at work already :D
<lanefu>
Man
MrFixIt has quit [Ping timeout: 260 seconds]
<IgorPec>
good morning
MrFixIt has joined #armbian
IgorPec has quit [Remote host closed the connection]
IgorPec has joined #armbian
rdorsch is now known as rdorsch`away
algyz has joined #armbian
algyz has quit [Remote host closed the connection]
mirage335 has quit [Ping timeout: 258 seconds]
<douardda>
i'm currently running a quickly written checker script on my inria's station (so the PING critical msg from icinga, I guess)
<douardda>
(oops, wrong chan, sorry)
macc24_ has joined #armbian
macc24 has quit [Disconnected by services]
macc24_ is now known as macc24
<wojci>
lanefu: Thanks for the link. I got the 3 interfaces working .. now with different MAC addresses as well (using another thread from the forum).
dddddd has joined #armbian
Hokedli has joined #armbian
<lanefu>
wojci: awesome!
<ArmbianTwitter>
@21isenough (21isenough): @DecentralisedS @tadpoet @GrapheneOS At time of screenshot: - Laptop with Manjaro Linux - Xiaomi with Android (Miui) - RPi with Raspbian - Rock64 with Armbian Now: - Replacing Android with @GrapheneOS (Where a most of the queries came from) (9s ago)
<wojci>
lanefu, Somewhat. I have issues with setting static IP addresses on my second board. The config seems to be identical.
<Werner>
Identical besides the mac addresses I hope :D
agrisis has joined #armbian
Hokedli has quit [Quit: Konversation terminated!]
plntyk has quit [Quit: Leaving]
<lanefu>
man the OPI4 can kiss my ass
<IgorPec>
haha
<IgorPec>
whats wrong?
<lanefu>
it's been like overheating and crashing with boinc Rosetta@home
<lanefu>
i cranked the clock back to 1412mhz adn it didnt crash
<lanefu>
but got computational errors
<lanefu>
just switched kernels from dev to current via armbian config, adn it just like crashed and died in the middle of it lol
<lanefu>
and c.state seems to stay at 0 nomatter how much heat
<IgorPec>
so thermal throttling doesn't work at all or not fast enough?
<IgorPec>
btw. how to properly isolate build runner?
<IgorPec>
security concerns ... its more or less operaional now
<lanefu>
thermal throttling doesnt seem to work at all
<IgorPec>
ok, we didn't address rockchip much in last release
<IgorPec>
everything else
<Werner>
Ideally the build run includes the complete setup of a container (may it docker or whatever) and when everything is finished destroy it.
<IgorPec>
if we put this runner to merge requests it has to be fully bullet proof
MrFixIt has quit [Quit: Leaving]
<lanefu>
IgorPec: probably easiest security step is probably to lock down DNS to only resolve github and mirrors
MrFixIt^ has joined #armbian
MrFixIt_ has joined #armbian
<lanefu>
then after that probably monitoring for abnormal behavior.... long running processes.. weird outbound conneections etc
MrFixIt_ has quit [Client Quit]
<Werner>
Good point about outbound connections. Did not think about that
<IgorPec>
i want to cut access to my local network first, then regarding signing packages?
<IgorPec>
now things works, but things are not secure
<lanefu>
yeah i'd treat it like an IOT device
<lanefu>
on its own VLAN
MrFixIt^ has quit [Client Quit]
<IgorPec>
KVM guest on its own VLAN?
MrFixIt has joined #armbian
<lanefu>
yep
<IgorPec>
ok, will do that. then ssh/gpg keys
<lanefu>
yep
<lanefu>
the other recommened practice, whch makes things a little more difficult.. is that CI testing is only ran by trusted users
<lanefu>
which is probably the best thing
<IgorPec>
that would solve a lot :)
<lanefu>
a trusted reviewer could approve a PR for testing
<lanefu>
and then trigger that way
<IgorPec>
do we know how to do that?
<lanefu>
that's probably were we should reeally start
<Werner>
Not necessarily if a pr is big and something could be hidden
<lanefu>
Werner: then maybe the PR is too big
<IgorPec>
ok, lets try to figure out worse case. how to make it fully secure
<IgorPec>
the proceess of signing can be elsewhere
<Werner>
Limiting network traffic from/to github should be an easy thing. All their ipv4 addresses are listed here: https://api.github.com/meta
<lanefu>
security is about layers, so just gotta start with low hanging fruit
<IgorPec>
ssh keys are currently on the machine to which anyone can push a code
<IgorPec>
which is clearly bad ;)
<lanefu>
yeah.....
<lanefu>
i need to take a look at yuor runner config
<IgorPec>
runner is simple
<lanefu>
maybe we should start by having an automated build of the runner
<IgorPec>
./compile
<lanefu>
so its easy to add
<lanefu>
haha
<Werner>
Essential ^^
<lanefu>
i have an existing armbian-builder ansible role i could modify to make it into a runner build
<IgorPec>
how do you mean?
<lanefu>
just having some ansible code to easily make any VM a runner ready for us to use