<d1b2>
<ehntoo> Out of curiosity/boredom I went on a quick vulnerability search in the Rigol MSO5000 firmware. It did not take long at all to find trivial unauthenticated remote code execution as root. I sure hope no one has one of these on the Internet.
<d1b2>
<Darius> I love your optimism
<d1b2>
<ehntoo> I am going to avoid running any shodan searches that might ruin it. ;)
<d1b2>
<Darius> good idea 😄
nelgau has quit [Read error: Connection reset by peer]
bvernoux has quit [Read error: Connection reset by peer]
<azonenberg>
ehntoo: lol. I mean, the lecroy scope API lets you run arbitrary vbscript which i'm sure is trivial to turn into RCE but that's by design
<azonenberg>
in general, i recommend test equipment be kept on an isolated VLAN with no access in or out to the internet, and inbound access only allowed from engineering workstations that need to talk to them
<bvernoux>
To check if the Test and MSI Build fail because of Release (instead of Debug which was by default since lot of time)
massi has quit [Remote host closed the connection]
azonenberg has joined #scopehal
<d1b2>
<azonenberg> @johnsel: ping, you around?
<d1b2>
<azonenberg> I have a Debian 11 instance with an AMD Pro WX 4100, 32GB of RAM, 100GB of storage, and 8 vCPUs (Xeon Silver 4116, although a bit oversubscribed on cores until I upgrade the box) that I'm going to set up as a local CI node as an experiment
<d1b2>
<azonenberg> There is a bunch of other stuff running on the box but it should still be faster than the github runners, and it has a local vulkan capable GPU
<d1b2>
<azonenberg> When I get the new box spun up with more CPU, i should also be able to put a windows CI node on it but cannot dedicate a physical pcie passthru gpu to both
<d1b2>
<azonenberg> The Linux CI machine will migrate over to the new server without any issues, it will be the same physical chassis and virtual block device and GPU. just a newer mobo and CPU
<d1b2>
<azonenberg> (It's a Xen hardware virtualized system)
<azonenberg>
I'm thinking the new CPU is going to be a Xeon Gold 5320 but haven't decided for sure
<d1b2>
<david.rysk> I think that’s in the same class as the AMD Epyc 7453?
<d1b2>
<david.rysk> Sorry, 7543
<d1b2>
<david.rysk> Wait no, 7453 was right 😛
<azonenberg>
Yeah looks similar
<azonenberg>
this is already an intel system, i'm swapping as few parts as I can
<azonenberg>
just bumping to a newer generation cpu with more cores
<azonenberg>
and adding more ram
<d1b2>
<david.rysk> Same board?
<azonenberg>
Likely a new one
<azonenberg>
eyeing the Supermicro MBD-X12SPL-F-O
<azonenberg>
but also not final yet
<d1b2>
<david.rysk> If you’re already swapping board and CPU then it’s worth looking at AMD as well, IMO
<d1b2>
<david.rysk> Well if it will fit in the classes
<d1b2>
<david.rysk> In the chassis*
<d1b2>
<david.rysk> Intel’s most recent generations are good but haven’t hit server yet
<d1b2>
<david.rysk> Looks like those are supposed to become available late this year and will require DDR5
<azonenberg>
Yeah I have 192GB of DDR4 I want to reuse
<azonenberg>
having to replace the ram would significantly increase the cost of the upgrade
<azonenberg>
Anyway,. for the near term I have a Linux test instance we can work with
<azonenberg>
i installed the vulkan SDK and our core dependencies (those in the debian repos at least) already
<azonenberg>
so we shouldn't need to install those again every CI build which will save time
<azonenberg>
I can also spin up a Windows instance on it, but it will not have a GPU so we can't run tests
<azonenberg>
Might still be worth doing just to get faster compiles
<azonenberg>
When I do the upgrade, I will be going for a motherboard with more PCIe slots so I can shove a third GPU into it
<azonenberg>
at which point we can dedicate a card to the CI
<azonenberg>
Tentatively another radeon pro wx 4100, which is far from a new/high end card but it's half height and low power
<azonenberg>
And fairly inexpensive
<azonenberg>
or possibly a w6400 which is quite a bit newer, but seems to be out of stock most places i've checked
<azonenberg>
(oh newegg has them on backorder but expected availability tomorrow so we'll see if that happens lol)
<azonenberg>
In the meantime, although CPU is a bit oversubscribed and there won't be an attached GPU yet
<azonenberg>
I can spin up a win11 instance to do testing on
<azonenberg>
And again, since these are VM images on the same virtual storage backend, we can move them to the new hardware with no issues or reconfiguration
<azonenberg>
And then we can worry about the M1 CI (rented server or just slapping a mac mini on a shelf somewhere) later on
<azonenberg>
actually it looks like xen doesnt support TPM2.0 yet. but i'll set up a win10 VM and then we can upgrade to 11 or set that tpm registry key or whatever later on
<d1b2>
<david.rysk> Version 4.6 or later of xen does
<d1b2>
<david.rysk> Seems incompletely though…
<azonenberg>
Yeah
<azonenberg>
ok win10 instance is at the install screen, i just have to buy a windows license for it
<bvernoux>
You can have one for Win10Pro for 0.5euros
<bvernoux>
I suspect you have similar official license (which are recycled from PC never used or similar and can be used 1 time on any PC)
<bvernoux>
The only limitation is you can use it one time and if you change some major things on the PC is will require a new one ...
<bvernoux>
just for fun I have bought mine 0.70 euros more than 1 year ago and it work fine
<bvernoux>
Also anyone have seen the Ryzen Serie 7000 presentation
<bvernoux>
They say they are 47% more energy efficient vs Competitor (Alder Lake Core+L2)
bvernoux has quit [Quit: Leaving]
<d1b2>
<david.rysk> the server version isn't available yet, but even so Epyc Milan is much more efficient than that series of Xeon
<d1b2>
<david.rysk> And RAM is compatible
<d1b2>
<david.rysk> 7000 will require DDR5 I believe
<azonenberg>
ok back from a few errands, provisioning the windows CI box now. still installing the OS
<azonenberg>
but i'll throw the vulkan SDK on there too
<azonenberg>
My thought is, for regular CI builds we probably don't want to be installing every single dependency from nothing every commit. that's a lot of resources being wasted
<azonenberg>
we can do that in another vm, or even just spin up a blank AWS instance, once a month or once a week or something just to verify we didn't miss anything