- Encrypt everthing including /boot and /root
- Enter password once
- Support UEFI
Download NixOS minimal iso and copy to USB stick. For example on Mac OSX
$ diskutil list
$ diskutil unmountDisk /dev/disk1 # Make sure you got right device
// A quick script for converting Medium HTML files to Markdown, suitable for use in a static file generator such as Hugo or Jekyll | |
package main | |
import ( | |
"fmt" | |
"io/ioutil" | |
"log" | |
"os" | |
"path/filepath" | |
"regexp" |
self: super: | |
let | |
# Import unstable channel. | |
# $ sudo nix-channel --add http://nixos.org/channels/nixpkgs-unstable nixpkgs-unstable | |
# $ sudo nix-channel --update nixpkgs-unstable | |
unstable = import <nixpkgs-unstable> {}; | |
in | |
{ |
package main | |
import ( | |
"context" | |
"flag" | |
"fmt" | |
"log" | |
"net/http" | |
"os" | |
"os/signal" |
#include <stdio.h> | |
#include <stdlib.h> | |
#include <stdint.h> | |
#ifdef _MSC_VER | |
#include <intrin.h> /* for rdtscp and clflush */ | |
#pragma optimize("gt",on) | |
#else | |
#include <x86intrin.h> /* for rdtscp and clflush */ | |
#endif |
#!/bin/bash | |
set -e | |
REPOS="$(cat $(dirname $0)/.subtree)" | |
usage() { | |
echo "usage: $(basename $0) <command>" | |
echo "commands are: " | |
echo " init sets up all remotes and subtrees locally" |
package main | |
import ( | |
"crypto/tls" | |
"golang.org/x/crypto/acme/autocert" | |
"log" | |
"net" | |
"net/http" | |
) |
Tuning Intel Skylake and beyond for optimal performance and feature level support on Linux:
Note that on Skylake, Kabylake (and the now cancelled "Broxton") SKUs, functionality such as power saving, GPU scheduling and HDMI audio have been moved onto binary-only firmware, and as such, the GuC and the HuC blobs must be loaded at run-time to access this functionality.
Enabling GuC and HuC on Skylake and above requires a few extra parameters be passed to the kernel before boot.
Instructions provided for both Fedora and Ubuntu (including Debian):
Note that the firmware for these GPUs is often packaged by your distributor, and as such, you can confirm the firmware blob's availability by running:
#!/bin/bash | |
set -euo pipefail | |
set +e | |
if ! git diff-files --quiet --ignore-submodules ; then | |
echo "Uncommited changes; stash or commit before deploying" | |
exit 1 | |
fi | |
if ! git diff-index --cached --quiet HEAD --ignore-submodules ; then |
When people come up with ideas, they often assume that:
And these assumptions tend to make people very unhappy. I repeatedly see people succumbing to sadness over multiple discovery. It shouldn't be sad, it should be a happy event, as it confirms our thoughts and presents an opportunity for collaborations.